Fluffy HTB Writeup | HacktheBox | Season 8
2025-05-25 06:32:20 - xone
Machine Information
As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account:
j.fleischman
/
J0elTHEM4n1990!
🧾 Enumeration
Run a comprehensive TCP scan:
nmap -v -sCTV -p- -T4 -Pn -oN $IP.txt $IP PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-05-25 11:17:17Z) 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fluffy.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.fluffy.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.fluffy.htb | Issuer: commonName=fluffy-DC01-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-04-17T16:04:17 | Not valid after: 2026-04-17T16:04:17 | MD5: 2765:a68f:4883:dc6d:0969:5d0d:3666:c880 |_SHA-1: 72f3:1d5f:e6f3:b8ab:6b0e:dd77:5414:0d0c:abfe:e681 |_ssl-date: 2025-05-25T11:19:02+00:00; +7h00m00s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: fluffy.htb0., Site: Default-First-Site-Name) |_ssl-date: 2025-05-25T11:19:01+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=DC01.fluffy.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.fluffy.htb | Issuer: commonName=fluffy-DC01-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-04-17T16:04:17 | Not valid after: 2026-04-17T16:04:17 | MD5: 2765:a68f:4883:dc6d:0969:5d0d:3666:c880 |_SHA-1: 72f3:1d5f:e6f3:b8ab:6b0e:dd77:5414:0d0c:abfe:e681 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fluffy.htb0., Site: Default-First-Site-Name) |_ssl-date: 2025-05-25T11:19:02+00:00; +6h59m59s from scanner time. | ssl-cert: Subject: commonName=DC01.fluffy.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.fluffy.htb | Issuer: commonName=fluffy-DC01-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-04-17T16:04:17 | Not valid after: 2026-04-17T16:04:17 | MD5: 2765:a68f:4883:dc6d:0969:5d0d:3666:c880 |_SHA-1: 72f3:1d5f:e6f3:b8ab:6b0e:dd77:5414:0d0c:abfe:e681 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: fluffy.htb0., Site: Default-First-Site-Name) |_ssl-date: 2025-05-25T11:19:00+00:00; +6h59m59s from scanner time. | ssl-cert: Subject: commonName=DC01.fluffy.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.fluffy.htb | Issuer: commonName=fluffy-DC01-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-04-17T16:04:17 | Not valid after: 2026-04-17T16:04:17 | MD5: 2765:a68f:4883:dc6d:0969:5d0d:3666:c880 |_SHA-1: 72f3:1d5f:e6f3:b8ab:6b0e:dd77:5414:0d0c:abfe:e681 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 22015/tcp closed unknown 24137/tcp closed unknown 30426/tcp closed unknown 32316/tcp closed unknown 46649/tcp closed unknown 48434/tcp closed unknown 49667/tcp open tcpwrapped 49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49678/tcp open msrpc Microsoft Windows RPC 49681/tcp open msrpc Microsoft Windows RPC 49695/tcp open msrpc Microsoft Windows RPC 49711/tcp open tcpwrapped 49745/tcp open tcpwrapped 54298/tcp open tcpwrapped 54334/tcp open tcpwrapped 61778/tcp closed unknown Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Update /etc/hosts
echo "xx.xx.xx.xx DC01.fluffy.htb fluffy.htb" | sudo tee -a /etc/hosts
Spray attack
As you know, we already have credentials for a low-privileged account, so now we'll just perform a spray attack using the NXC tool.
└─$ nxc smb 10.10.11.69 -u j.fleischman -d fluffy.htb -p 'J0elTHEM4n1990!' SMB 10.10.11.69 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False) SMB 10.10.11.69 445 DC01 [+] fluffy.htb\j.fleischman:J0elTHEM4n1990!
SMB Enumeration
We know that with the help of the credentials, we're able to log in to SMB. Now, we want to check whether we can find any juicy information on the SMB server. For example, we might look for writable directories, shared drives, or sensitive files.
In an Active Directory environment, finding SMB access can lead to several possible scenarios:
- Access to shared folders containing credentials, config files, or password notes.
- Enumeration of user and group information from readable shares like NETLOGON or SYSVOL.
- Uploading files to writable shares that could be used for lateral movement or privilege escalation (e.g., planting a malicious script).
- Discovering login scripts or GPO files that contain plaintext credentials.
- Checking for misconfigured permissions that allow overwriting existing files.
So, let’s enumerate the shares thoroughly and analyze them for any of these opportunities.
Enumerating SMB Shares
Next, we enumerate the available SMB shares to identify accessible resources:
nxc smb $IP -u j.fleischman -d fluffy.htb -p 'J0elTHEM4n1990!' --shares SMB 10.10.11.69 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False) SMB 10.10.11.69 445 DC01 [+] fluffy.htb\j.fleischman:J0elTHEM4n1990! SMB 10.10.11.69 445 DC01 [*] Enumerated shares SMB 10.10.11.69 445 DC01 Share Permissions Remark SMB 10.10.11.69 445 DC01 ----- ----------- ------ SMB 10.10.11.69 445 DC01 ADMIN$ Remote Admin SMB 10.10.11.69 445 DC01 C$ Default share SMB 10.10.11.69 445 DC01 IPC$ READ Remote IPC SMB 10.10.11.69 445 DC01 IT READ,WRITE SMB 10.10.11.69 445 DC01 NETLOGON READ Logon server share SMB 10.10.11.69 445 DC01 SYSVOL READ Logon server share
As you can see, the IT directory has write permissions.
Access is restricted by HackTheBox rules#
The solution to the problem can be published in the public domain after her retirement.
Look for a non-public solution to the problem in the telegram channel .