I just solved Pirate from Hack the Box
Pirate Machine Summary
Pirate is a hard difficulty Windows machine on Hack The Box that focuses on advanced Active Directory abuse, including machine account takeover, gMSA credential extraction, NTLM relay, and Kerberos delegation attacks. The machine demonstrates how chaining multiple AD misconfigurations can ultimately lead to full domain compromise.
The attack begins with Nmap enumeration, where I identified a domain controller exposing typical AD services such as SMB, LDAP, Kerberos, and WinRM. I performed SMB authentication to validate access and configured my environment through host configuration, followed by proper Kerberos configuration and time synchronization to ensure ticket-based attacks would function correctly.
I then collected domain data using BloodHound enumeration and performed BloodHound analysis, which revealed attack paths involving delegation and machine account privileges. Although I attempted Kerberoasting, the more viable path involved abusing machine accounts.
Next, I set up pre2k for pre2k enumeration, which allowed me to discover valid machine account credentials. Using these, I performed SMB authentication (machine account) but encountered restrictions, prompting me to abuse the account by resetting its password (machine account abuse) and successfully taking control of it (machine account takeover).
With this access, I deployed gMSADumper and performed gMSA credential dumping, extracting hashes for managed service accounts. I then used these credentials for SMB authentication (gMSA account) and gained WinRM access (gMSA account), establishing a foothold on the system.
From there, I conducted network enumeration and identified an internal subnet. Through internal network enumeration, I discovered an additional host that was not externally accessible. To reach it, I prepared for pivoting by setting up Chisel (pivot preparation) on both Linux and Windows, then established a reverse SOCKS tunnel (pivoting).
Using this tunnel, I performed Nmap enumeration (pivoted network) and gained WinRM access (pivoted host), confirming access with SMB enumeration (pivoted host). At this stage, I launched an NTLM relay attack, combined with authentication coercion, successfully relaying machine account authentication to LDAP.
This allowed me to create a new machine account and configure delegation rights, leading to Kerberos delegation abuse. Using S4U techniques, I impersonated the Administrator account and achieved privilege escalation (SYSTEM via Kerberos).
To solidify access, I updated host configuration (internal mapping) and performed credential dumping (secrets extraction), which revealed additional credentials including plaintext passwords. I then abused these through Active Directory abuse, including password resets and SPN manipulation, enabling another round of Kerberos delegation abuse.
Finally, I leveraged Kerberos ticket usage to authenticate as Administrator against the domain controller. This resulted in full domain controller compromise, where I obtained a SYSTEM shell and retrieved the root flag.
Overall, Pirate is an excellent example of a complex, real-world Active Directory attack chain, combining machine account abuse, gMSA extraction, NTLM relay, coercion, pivoting, and Kerberos delegation to achieve complete domain dominance.
Protected Page
b
c
d
Keywords:
pirate htb hard machine complete solution
dc01.pirate.htb Pirate HTB Season 10 machine walkthrough
pirate user flag htb season 10
Pirate - HackTheBox
Mastering Pirate: Beginner's Guide from HackTheBox
Pirate Writeup - HackTheBox
Pirate HackTheBox Writeup - Complete Season 10 Machine
Hack The Box - Season 10 HTB Pirate Writeup
Pirate | HTB Writeups
Pirate HTB Write Up - isiaqibrahim.com
pirate.htb
Hack The Box - Season 10 HTB Pirate Writeup
HTB: Pirate Writeup
0 Comments