Welcome to another Hack the Box walkthrough. In this blog post, I have demonstrated how I owned the Garfield machine on Hack the Box. Hack The Box is a cybersecurity platform that helps you bridge knowledge gaps and prepares you for cyber security jobs.
You can also test and grow your penetration testing skills, from gathering information to reporting. If you are new to this blog, please do not forget to like, comment and subscribe to my YouTube channel and follow me on LinkedIn for more updates.About the Machine
Garfield is a Hard Difficulty Level Machine on Hack the Box
Protected Page
The first step in owning the Garfield machine like I have always done in my previous writeups is to connect my Kali Linux terminal with Hack the Box server. To establish this connection, I ran the following command in the terminal:
Once the connection between my Kali Linux terminal and Hack the Box server has been established, I started the Kobold HTB machine and I was assigned an IP address (10.129.25.190).
e
Nmap Enumeration
I began by running a full service and version scan against the new target to identify exposed services:
Host Configuration
Before proceeding further, I configured local name resolution to properly interact with the domain services:
I added the target IP and associated domain names to my /etc/hosts file. This ensured that tools relying on DNS (especially Kerberos and LDAP) would resolve correctly. Proper hostname resolution is critical in Active Directory environments. With this in place, I was ready to continue enumeration without resolution issues.
Time Synchronization
I noticed a significant clock skew during enumeration, which would break Kerberos-based authentication. Since Kerberos is highly time-sensitive, I needed to sync my machine with the target Domain Controller.
I disabled automatic time sync and manually aligned my system time with the target. The output confirmed a large time adjustment (~8 hours), explaining previous authentication issues. Fixing this ensured Kerberos tickets would now be accepted, allowing me to proceed with AD attacks reliably.
SMB Enumeration
I authenticated to the target using valid domain credentials to enumerate available SMB shares. This helps identify accessible resources and potential paths for privilege escalation or lateral movement.
I successfully listed the shares and confirmed access to standard administrative shares like ADMIN$, C$, NETLOGON, and SYSVOL. The presence of NETLOGON and SYSVOL is typical in Domain Controllers and can contain useful scripts or policies. The SMB1 error can be ignored, as modern systems disable SMB1 by default. This confirmed my credentials are valid and can be leveraged for further enumeration.
RPC Enumeration
I leveraged my valid domain credentials to enumerate domain users via RPC, which is useful for identifying potential targets for password attacks or privilege escalation.
I successfully enumerated several domain accounts, including standard users and privileged accounts like Administrator and krbtgt. I also identified additional users such as l.wilson and l.wilson_adm, which may indicate a privileged account worth targeting. This confirmed my credentials have sufficient access for enumeration, giving me a solid user list for further attacks like Kerberoasting or password spraying.
RPC Enumeration
I continued leveraging my authenticated access to enumerate domain groups via RPC, aiming to identify privileged groups and potential escalation paths.
I successfully listed all domain groups, including highly privileged ones like Domain Admins, Enterprise Admins, and Schema Admins. I also noticed custom groups such as IT Support and Tier 1, which could indicate delegated privileges within the environment. These groups are key targets for further enumeration, especially when mapping users to groups to identify misconfigurations or privilege escalation opportunities.
LDAP Enumeration
I used my valid domain credentials to query LDAP and enumerate computer objects within the domain. This helps identify domain-joined machines that could be targeted later.
BloodHound Setup
Before continuing enumeration, I ensured that BloodHound and its dependencies were properly installed on my attack machine. This tool will help visualize Active Directory relationships and identify attack paths.
I ran the installation and confirmed BloodHound was already present, with only an additional dependency (pycryptodome) being installed. This ensured my environment was fully ready for AD data collection. With BloodHound set up, I can now proceed to gather domain data and map privilege escalation paths more effectively.
BloodHound Enumeration
With BloodHound installed, I proceeded to collect Active Directory data using my valid domain credentials. This step is crucial for mapping relationships and identifying potential privilege escalation paths.
I attempted Kerberos authentication but it failed due to connectivity issues, so the tool fell back to NTLM and continued successfully. I was able to enumerate key AD objects including users, groups, computers, and GPOs across the domain. The output confirmed a small environment with only two machines and no domain trusts. This data will now be ingested into BloodHound to visually analyze attack paths and identify privilege escalation opportunities.
LDAP Enumeration
I performed a deeper LDAP query to inspect sensitive attributes related to password replication on the Domain Controllers, specifically targeting RODC behavior.
I identified that RODC01 has cached credentials (msDS-RevealedUsers) for accounts like Administrator and krbtgt_8245, which is highly interesting from an attack perspective. The msDS-NeverRevealGroup showed protected groups whose credentials are never cached, while msDS-RevealOnDemandGroup defines allowed replication. This indicates that sensitive credentials may be stored on the RODC, opening a potential path for credential extraction and privilege escalation.
ACL Enumeration
I used BloodyAD to identify objects in the domain where my user had write permissions, which is critical for finding privilege escalation paths through ACL abuse.
I discovered that I had write access to attributes like scriptPath on multiple users, including krbtgt_8245, l.wilson, and l.wilson_adm. This is particularly interesting as modifying scriptPath can lead to code execution during logon. I also noticed extensive writable attributes on my own user, including msDS-AllowedToActOnBehalfOfOtherIdentity, which could be abused for delegation attacks. These findings indicate multiple potential privilege escalation paths through AD object manipulation.
Exploitation - ScriptPath Abuse
I set up a listener and crafted a PowerShell reverse shell payload, then encoded it to bypass execution restrictions on the target.
I wrapped the payload into a batch script and uploaded it to the SYSVOL scripts share so it could be executed during user logon.
I then abused my write privileges on l.wilson by modifying the scriptPath, forcing execution of my malicious script upon logon.
After a short delay, I received a reverse shell as garfield\l.wilson, confirming successful code execution on the target.
With this access, I escalated privileges by resetting the password of the privileged account l.wilson_adm.
This completed the privilege escalation path by leveraging ACL misconfigurations and logon script abuse to gain control over a higher-privileged account.
Initial Foothold (WinRM Access)
With the newly reset credentials, I authenticated to the target via WinRM to gain an interactive shell as the privileged user.
I successfully established a remote PowerShell session and navigated to the user’s Desktop directory. From there, I enumerated the contents and located the user.txt flag. Reading the file confirmed full access as l.wilson_adm, marking a successful foothold on the system. This validated the privilege escalation path and gave me a stable shell for further post-exploitation.
Privilege Escalation (Group Abuse)
After gaining access as a privileged user, I leveraged my permissions to further escalate privileges within the domain by modifying group memberships.
I successfully added l.wilson_adm to the RODC Administrators group, granting elevated control over the Read-Only Domain Controller. This group membership is powerful, as it can be abused to extract cached credentials or perform further domain-level attacks. This step positioned me closer to full domain compromise by expanding my privileges within the AD environment.
v
w
x
y
z
Keywords:
garfield.htb
garfield htb write up
garfield htb walkthrough
dc01.garfield.htb
garfield hack the box write up
garfield htb machine complete solution pdf
garfield hack the box walkthrough solution
garfield htb season 10 solution Windows machine
Garfield HTB Hard Windows Machine Season 10
rooted Garfield from hack the box
solved Garfield hack the box hard windows machine htb
pwned Garfield from hack the box
Garfield ctf solution hack the box
0 Comments