HackTheBox | BabyTwo [OSCP Style]

Main ideas / concepts covered

• OSCP-style workflow for HackTheBox “BabyTwo [Baby2]” (a Domain Controller):
  • Confirm the target is alive and infer likely OS characteristics (e.g., TTL heuristics).
  • Perform a fast, complete port discovery scan.
  • Run service/version enumeration on discovered ports.
  • Enumerate AD-related attack paths from open SMB/Kerberos/LDAP-like services.
  • Start from no initial credentials (“go completely blind”), then gain access via:
    • anonymous/guest SMB shares
    • Kerberos user discovery and brute forcing
  • Use BloodHound to map privilege escalation paths.
  • Pivot into AD exploitation using:
    • Login script modification (logon script hijack via write access to Netlogon/script share)
    • GPO abuse via DACL/GenericAll permissions leading to privileged scheduled task execution
    • DCSync + Pass-the-Hash to obtain final admin execution and the flag.

---

Methodology / instruction list (step-by-step)

1) Setup local working directories

• Create a directory named Baby2 (the machine name).
• Inside it, create three main subdirectories:
  • content
  • NMAP
  • scripts

2) Confirm the machine is active + infer OS via TTL

• Send a packet and check you receive a response (host is up).
• Use TTL-based inference:
  • Windows default TTL: ~128 (often observed as 127/128 after intermediary hops)
  • Linux default TTL: ~64 (often observed as 63)
• If Windows-like TTL is detected, assume you’re attacking Windows/DC/AD-relevant services.

3) Optional: run a helper script to identify OS type

• Run a Python-based helper that reports what the machine appears to be.
• In the described workflow, it outputs that the machine looks like Windows.

4) Port scanning (fast and broad)

• Run an Nmap scan covering all TCP ports:
  • Range: 1-65535
  • Focus: TCP first
  • Output only open ports (e.g., --open)
• Use Nmap “stealth scan” behavior:
  • Does not complete the full TCP three-way handshake
  • Uses RESET instead of completing the connection
• Speed-focused options:
  • High minimum rate (e.g., --min-rate 5000)
• Disable slower/default discovery steps:
  • Avoid DNS resolution
  • Skip ARP/host discovery (assume the host is up)
• Export scan results to a file for reuse (don’t rescan later).

5) Extract open ports quickly and enumerate services

• Use a custom Zsh/bash helper to:
  • Parse grepable Nmap output using regex
  • Copy open port numbers to the clipboard (via xclip)
• Run a second targeted Nmap scan on only the open ports:
  • -sC (default scripts)
  • -sV (service/version detection)
• Export results again for later parsing.

6) Initial AD/host enumeration with netexec

• Use netexec to query SMB/Kerberos-relevant context:
  • Identify machine name (e.g., DC)
  • Identify AD domain (e.g., baby2.vl)
• Update name resolution:
  • Add entries to /etc/hosts so domain-based names resolve to the target IP.

7) Anonymous/guest SMB enumeration for foothold discovery

• Check SMB shares using SMB tooling (e.g., netexec / smbmap):
  • Attempt guest or blank/anonymous access
• Identify common DC share names:
  • docs, homes, netlogon, sysvol (referred to as “Sysball” in the notes)
• Look for write permissions, especially in:
  • NETLOGON (often contains logon scripts)

8) Kerberos user discovery and validation (no credentials yet)

• Enumerate likely users from shares (e.g., from homes, visible DC usernames).
• Validate usernames against the domain using kerbrute:
  • Build/compile kerbrute from Go source
  • Run user enumeration with domain + DC IP + username list
  • Keep only valid usernames

9) AS-REP roasting options (if applicable)

• The workflow mentions AS-REP roasting:
  • If a user has preauth not required, getnpusers.py-style roasting can work.
• Without credentials at that time, it’s treated as not feasible.
• The plan shifts toward shares + credential collection first.

10) RID cycling / RID brute-force to expand the user list

• Use netexec’s RID brute approach:
  • Enumerate SID types and extract usernames
• Deduplicate and build a user wordlist using text tools.

11) Password guessing / credential discovery

• Brute-force authentication using netexec:
  • Try candidate passwords such as password == username
  • Consider case-sensitivity
• Use “continue on success” to collect multiple valid creds.
• Result: two credentials found (e.g., Carl More and Library / “library” as a candidate).

12) Deepen enumeration with authenticated access

• Use authenticated RPC/SMB listing to enumerate users/groups.
• Recursively search shared resources:
  • Focus on Netlogon-like locations for scripts:
    • login.vbs and related .lnk shortcuts
• Use LNK parsing to download .lnk files and resolve their redirections.
• Confirm whether login.vbs directly exposes credentials:
  • In the described flow, it does not reveal credentials immediately.

---

BloodHound-driven escalation

13) Run BloodHound Python collection

• With valid credentials:
  • Run BloodHound Python
• Provide:
  • username/password
  • domain
  • DC IP
  • collection method: “all”
• Export output as a ZIP for upload.

14) Deploy BloodHound via Docker

• Use Docker Compose (download deploy files via wget).
• Start the container and access BloodHound on localhost:8080.
• Upload the collected ZIP and wait for analysis.

15) Identify exploitable relationships

• Review BloodHound nodes (e.g., Carl Moore / Amelia Griffiths).
• Find write/control opportunities in AD.
• Focus on logon script association, indicating logon script modification can yield command execution on user login.

---

Exploit #1: Logon script hijacking (command execution via next login)

16) Connect to relevant SMB share (case matters)

• Use SMB tooling to access the Sysvol/script directory.
• Ensure correct share naming/casing (e.g., Carl Mure vs Carlmure).
• Confirm read/write access.

17) Modify the logon script

• Upload/replace the logon script file in the script directory:
  • Save a modified login.vbs
  • Preserve original logic as much as possible
  • Inject a command execution path (to create a reverse shell)
• Use a reverse shell payload generated for PowerShell, typically:
  • Base64-encoded command
  • Reverse HTTPS/HTTP details vary
  • Port 443 to attacker IP is referenced
• Start a listener on the attacker machine.
• Wait for the victim user to log in to trigger execution.

18) Validate access via reverse shell

• Receive a shell as the compromised user (example shown: Amelia Griffiths).
• Use BloodHound again to determine whether this grants:
  • elevated control
  • additional controllable objects (users/GPOs)

---

Exploit #2: GPO abuse for privilege escalation

19) Abuse rights to gain control over a GPO (GenericAll / DACL abuse)

• BloodHound shows GPO ADM has GenericAll on:
  • Default Domain Policy
  • and/or Default Domain Controllers Policy
• Since GenericAll implies full control, you can modify GPO settings.
• The workflow emphasizes verifying rights are real and mapping them to specific abuse techniques.

20) Use GPO DACL abuse to change another user password (setup)

• Use PowerView to manipulate AD object ACLs:
  • Grant the attacker principal GenericAll on the target GPO ADM
  • Use that control to set/change the GPO ADM password
• Validate the newly set credentials.

21) Abuse GPO to create an elevated scheduled task and add you to Admins

• Use pgpoabuse.py (pgpoabuse workflow), providing:
  • domain (e.g., baby2.vl)
  • user (GPOADM)
  • password
  • GPO identifier/ID (from BloodHound selection)
  • --command (command script to run)
  • -F (force scheduled task creation)
• Example command effect:
  • Add the attacker-controlled user back into administrators, e.g.:
    • net localgroup administrators ... GPOADM /add
• Wait for propagation (GPO updates can take several minutes).

22) Confirm escalation and access via Evil-WinRM

• Recheck admin group membership:
  • net localgroup administrators
• Connect as GPOADM using Evil-WinRM (WinRM shell).

---

Exploit #3: DCSync + Pass-the-Hash to take full control

23) Perform DCSync to obtain credential hashes

• Use DCSync with GPOADM privileges:
  • target DC: baby2.vl / DC IP
  • provide username + password
• Retrieve NTLM hashes for key accounts (including Administrator).

24) Pass-the-Hash and verify final access

• Use Evil-WinRM with Pass-the-Hash:
  • authenticate as Administrator using the captured hash
• Navigate to admin desktop and retrieve the flag.

---

Speakers / sources featured

• Speaker/host: YouTube presenter (single narrator; no name given in subtitles)
• Referenced tools/scripts:
  • Hack The Box (HTB): Baby2, Pupi (previous)
  • Nmap
  • Python scripts (batch formatting helper via Zsh bat-like wrapper)
  • TTL heuristic
  • netexec (including RID brute mention)
  • Xclip
  • grep/regex tooling (custom Zsh bash functions)
  • smbmap
  • Kerbrute
  • RPC client (null session mentioned + authenticated enumeration)
  • BloodHound Python
  • BloodHound (web UI)
  • Docker / Docker Compose
  • PowerView.ps1
  • pgpoabuse.py
  • lnkparse / lnkparse-like tool
  • Evil-WinRM
  • DCSync
  • jq
  • rlwrap
  • Reverse shell payload sources (e.g., “revshells.com”)
  • Netcat (listener referenced)