I just solved Garfield from Hack the Box
Garfield Machine Summary
Garfield is a hard-difficulty Windows machine on Hack The Box that focuses on advanced Active Directory abuse, Kerberos exploitation, Read-Only Domain Controller (RODC) misconfiguration, internal pivoting, and credential extraction. The machine begins with classic enumeration, where Nmap is used to identify exposed Windows and Active Directory services such as SMB, LDAP, Kerberos, DNS, WinRM, and domain controller-related ports. Further SMB enumeration reveals accessible shares, while SMB user enumeration and Active Directory permission enumeration help identify valid users, group memberships, and permission relationships that can be abused later in the attack chain.
The initial foothold is achieved by abusing Active Directory permissions and SYSVOL access. After authenticating with the discovered domain credentials, I enumerated the SYSVOL share and identified the garfield.htb\scripts directory containing the printerDetect.bat logon script. Since the script location was writable, I prepared a PowerShell reverse shell payload, encoded it in UTF-16LE Base64, staged it inside a batch file, and overwrote the existing SYSVOL script. I then abused the scriptPath attribute in Active Directory by assigning the modified printerDetect.bat script to the Liz Wilson user object. With a Netcat listener running, the script execution resulted in a reverse shell as garfield\l.wilson.
From the Liz Wilson shell, I escalated access by resetting the password of the administrative account l.wilson_adm. I validated the new credentials using NetExec over WinRM and then obtained an interactive Evil-WinRM shell as l.wilson_adm. From this shell, I performed domain computer enumeration and discovered both DC01.garfield.htb and RODC01.garfield.htb. Further RODC and privilege enumeration revealed the internal RODC host at 192.168.100.2, while group membership enumeration showed that the compromised account belonged to useful domain groups, including Tier 1. At this stage, I captured the user flag from the l.wilson_adm desktop.
The next phase focused on reaching and abusing the internal RODC. Since RODC01 was located on an internal subnet, I prepared Ligolo-ng for pivoting by downloading the Windows agent and Linux proxy. I uploaded the Ligolo agent to the target through Evil-WinRM, configured the Ligolo proxy on my Kali machine, added the RODC host resolution entry, and started the Ligolo proxy listener. After executing the Ligolo agent from the compromised host, the agent connected back successfully. I then fixed the TUN interface issue, started the Ligolo tunnel, added internal network routing for 192.168.100.0/24, and confirmed connectivity to RODC01 with ping. Once routing was working, I checked SMB access to the RODC using the l.wilson_adm credentials.
With internal access established, I created a fake machine account named FAKE$ and verified its existence through LDAP enumeration. I then abused Resource-Based Constrained Delegation by configuring RODC01 to allow the fake machine account to delegate to it. Before requesting Kerberos tickets, I synchronized my Kali time with the domain controller to avoid Kerberos clock-skew issues. Using the fake machine account, I requested an S4U service ticket for cifs/RODC01.garfield.htb while impersonating Administrator. I exported the Kerberos ticket into the cache and used it with Impacket PsExec to authenticate to RODC01, gaining a shell as NT AUTHORITY\SYSTEM.
After obtaining SYSTEM on the RODC, I transferred tools to RODC01 for credential extraction and further Kerberos abuse. I staged and transferred Mimikatz using a Python HTTP server and certutil, launched Mimikatz, enabled debug privileges, and dumped the RODC-specific krbtgt_8245 secrets. This revealed the AES256 key for the RODC krbtgt account, which was later used to forge an RODC golden ticket. I then staged PowerView, transferred it to the compromised host, bypassed the PowerShell execution policy, imported the module, and confirmed the availability of domain object manipulation functions.
Using PowerView, I abused the RODC password replication policy by modifying msDS-RevealOnDemandGroup to include the Allowed RODC Password Replication Group and the Administrator account, then clearing msDS-NeverRevealGroup. This allowed Administrator credential material to be requested through the RODC path. I then staged and transferred Rubeus, executed it to confirm it was working, and used the dumped RODC krbtgt AES256 key to create an RODC golden ticket for the Administrator account. With that forged ticket, I performed an RODC Key List Request using Rubeus, which returned the Administrator password hash. The final stage involved converting and abusing the Kerberos ticket material on Kali. I copied the Base64 ticket output, cleaned and decoded it into a .kirbi file, then converted it into a Linux-compatible .ccache file using impacket-ticketConverter. After exporting the ticket with KRB5CCNAME, I used NetExec with --use-kcache --ntds to authenticate as GARFIELD.HTB\Administrator and dump NTDS from DC01, confirming full domain compromise and recovering the Administrator NTLM hash. Finally, I used Evil-WinRM with pass-the-hash authentication as Administrator and read the root flag from the Administrator desktop, completing the Garfield machine.
Overall, Garfield demonstrates a full Active Directory attack chain involving SMB and SYSVOL enumeration, writable logon script abuse, Active Directory scriptPath manipulation, privilege escalation to a higher-privileged account, internal pivoting with Ligolo-ng, RBCD abuse, Kerberos S4U exploitation, SYSTEM access on an RODC, RODC krbtgt extraction, password replication policy abuse, RODC golden ticket creation, Key List Request abuse, NTDS dumping, and final Administrator pass-the-hash access.
Protected Page
e
f
g
i
j
k
l
Keywords:
Garfield (Hard) | Hack The Box
Garfield Writeup - HackTheBox
RODC01.garfield.htb
HackTheBox: Garfield
Garfield HackTheBox Writeup - Hard Windows Active Directory
Garfield - HackTheBox Season 10 Walkthrough
HackTheBox - FAWN [Garfield]
Garfield WriteUp - HackTheBox
I just solved Garfield on Hack The Box!
HTB Writeup - Garfield
Garfield | HTB Walkthrough
CTF Walkthroughs - Garfield Machine
Owned Garfield from Hack The Box!
0 Comments