IP Address: 10.10.11.69

As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account:

First, let's get started with identifying with the open ports and possible services that is running the target server.

From the nmap result, it is clearly evident that the target IP is an IP of a Domain Controller of a Windows AD. The domain name of the DC is fluffy.htb

Let's add the domain name of our target server to our /etc/hosts file to be able to clearly communicate using the domain of the DC.

and add the following contents:

The easiest point that we can start to enumerate would be through the SMB Shares. For the test, we can attempt to login into the share using the guest account without any password using nxc

The output means that the guest user account can be accessed through the SMB share without any password required. Let's take an advantage of this, but exploring the shares enabled to the guest account.

The IPC$ share seems to be readable to the guest account. With that, we can attempt to enumerate users with RID brute force option in nxc

Dump this user list into a file and format them to just contain the usernames (you might have to manually also clear the junk in the username list)

In the list, we identify the user account j.fleischman, to which we are already provided with the user credentials from the machine description.

Username: j.fleischman
Password: J0elTHEM4n1990!

Make use of this account's access to list out the shares available.

The IT folder, with both Read and Write permission is assigned to j.fleischman user account. Connect to the SMB share using smbclient and find out what is inside the folder.

Inside the folder, we can list out many zip files and one pdf document. To analyse it further, download all the files onto your local computer using the get command.

(Later we find out that we just need the upgrade_Notice.pdf file)

Diving into the PDF file found form the SMB Share. That PDF file talks about a recent Pen-test/ audit done on the domain controller.

Following the found CVEs of the domain controller, we find a relevant possible exploit of a CVE (CVE-2025-24071) which provides us with the NTLMv2 Hashes of the Domain controller.

A relevant and work GitHub Repository for exploiting the CVE-2025-24071 can be found Here .

As a first step, let's clone this repository into our attacker's machine.

The usage of the tool seems to be simple,

For that, we can use Responder.py file this GitHub repository.

Now, let's run Responder.py file interfacing our HackTheBox VPN Tunnel.

Open another terminal and connect to the smb share.

Upload the file using the put command

And immediately the Responder.py reflects us the vulnerable user's NTLMv2 hash.

Copy and add the hash into a text file (hash.txt) to crack for the password against the Rockyou.txt file using Hashcat.

Crack the hash

Kudos!!!! The password of the new user p.agila is cracked.

To understand the complete structure and possible foot holds that we can try to exploit further, we can make use of Blood Hound

With the credentials obtained of the user account, pass it through blodhound-python connector which connects and gathers possible information from the domain controller.

In the BloodHound web application, upload the files generated from the Blood Hound connector.

Once uploaded, Under the explore tab, let's start to search from the user [email protected] account.

Clearly, skimming through the user account, we notice the user [email protected] is a part of the Service Accounts. And this Service Accounts has multiple other accounts part of the same group with GenericWrite permissions.

From the recommendation Linux abuse of the this GenericWrite privilege, we can exploit the vulnerability of Shadow Credentials.

The Blog that I am following for this exploit is this

According to the Blog post, the first step, is to make sure that the p.agila is a part of the SERVICE ACCOUNTS where in the winrm_svc account is also in the same group.

Following the Linux Abuse section of the BloodHound, let's clone the pyWhisker github tool onto our attacker's machine.

Using this tool, we will list all the current (if) existing shadow credentials of winrm_svc account.

It is empty

Hence, let's add a new KeyCredential to the winrm_svc account and export the key certificates.

Move those key_<--file--> to a suitable folder

With the key added to the winrm_svc account, we need to now request for a new TGT from the server.

For that, we will use another tool called PKINIT.

Now request of the TGT

If you too are get this error minikerberos.protocol.errors.KerberosError: Error Name: KRB_AP_ERR_SKEW Detail: "The clock skew is too great".

You need to adjust the time of your attacker computer (your Kali Linux) to the time of the DC (approximately difference of 5 minutes is accepted).

There we use a tool called FakeTime (Click Here to know more)

#Install-Facketime

#use-Faketime

To get the time of the target DC, we can use a tool called ntpdate

We just need the date and time of the server

Finally our command tools like this:

Save this ticket that was generated into a file.

In our attacker's machine, we need to set the Kerberos ticket environment variable to use the obtained TGT of the winrm_svc account