> For the complete documentation index, see [llms.txt](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/hack-the-box/scepter-active-directory.md). # Scepter - Active Directory Hard Rated Lab - Hack The Box ## Initial Scan ### RustScan {% code overflow="wrap" expandable="true" %} ``` PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-05-23 23:36:14Z) 111/tcp open rpcbind syn-ack ttl 127 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/tcp6 nfs | 100005 1,2,3 2049/tcp mountd | 100005 1,2,3 2049/tcp6 mountd | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: scepter.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-05-23T23:37:22+00:00; +7h58m43s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.scepter.htb | Issuer: commonName=scepter-DC01-CA/domainComponent=scepter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-11-07T20:25:34 | Not valid after: 2026-11-07T20:25:34 | MD5: 1582 0ca9 794a 4caf 2309 50ae 8ac5 cbd4 | SHA-1: fd03 810d 8150 f2ee 73f6 35b2 5042 d348 541e c5ef | SHA-256: 0588 c9de af6b f807 b16a de6c 0f09 08d9 0d78 45bf 1542 15cd 29ef c1a0 af0a 60d2 | -----BEGIN CERTIFICATE----- | MIIFyDCCBLCgAwIBAgITYgAAAAoWUbEdz8QwxAABAAAACjANBgkqhkiG9w0BAQsF | ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHc2NlcHRl | cjEYMBYGA1UEAxMPc2NlcHRlci1EQzAxLUNBMB4XDTI1MTEwNzIwMjUzNFoXDTI2 | MTEwNzIwMjUzNFowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPbg | z24KEMEITsmdVQO9GheEtbO03OKPIAz131aqh5uhTSoQ7nRF61uTshKwb8z9OvRD | ExDi0ucsfI1sx2XfgBqWTM1hj94I8UF2zeGtQVJxh0PsF58PfUp5FJi1vFBD0Esm | 5GVDqmOuN8Gu4bIqgU82uPxWbazL7rvKRymsDFYVP8p2R0QL0cJkzfVKKCN15LYi | APhzsfdwjeGbPs/kjVih9WIybA9V10CQIhrfsyoEotXnrG46HvJd8rcbvjHNjgAC | AV8/k0AELQ5lj/MW2tksh+VQeobPGAoVpMwabpV6osgng42+Q7MhxR5H9mQMcZRR | 5hcqxZvjf2dp9I2dBhECAwEAAaOCAvEwggLtMDgGCSsGAQQBgjcVBwQrMCkGISsG | AQQBgjcVCILhx22D9pwIhsmFFIOHx0SG0JR4gSoBHAIBbgIBADApBgNVHSUEIjAg | BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIwDgYDVR0PAQH/BAQDAgWg | MDUGCSsGAQQBgjcVCgQoMCYwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYKKwYB | BAGCNxQCAjAdBgNVHQ4EFgQUpoE3w6iTJj5wKaJuhqQEkQh1GlMwHwYDVR0jBBgw | FoAUjAQmINw0RbYfBxqdvUWXq/9M34swgc0GA1UdHwSBxTCBwjCBv6CBvKCBuYaB | tmxkYXA6Ly8vQ049c2NlcHRlci1EQzAxLUNBKDEpLENOPWRjMDEsQ049Q0RQLENO | PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy | YXRpb24sREM9c2NlcHRlcixEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHBBggrBgEF | BQcBAQSBtDCBsTCBrgYIKwYBBQUHMAKGgaFsZGFwOi8vL0NOPXNjZXB0ZXItREMw | MS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vydmlj | ZXMsQ049Q29uZmlndXJhdGlvbixEQz1zY2VwdGVyLERDPWh0Yj9jQUNlcnRpZmlj | YXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAeBgNV | HREBAf8EFDASghBkYzAxLnNjZXB0ZXIuaHRiMEsGCSsGAQQBgjcZAgQ+MDygOgYK | KwYBBAGCNxkCAaAsBCpTLTEtNS0yMS03NDg3OTU0Ni05MTY4MTg0MzQtNzQwMjk1 | MzY1LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAAGoSdQIWy5gAz16h+6nBlqk4dOz | 9DQkF905FXLtkIiBJ2LDuWstULZlwHXMtHySXXxNXaKfoMt9z5gpvs6cusA7mG54 | iGx1KgqezrJxQLZIFOIJshkNDDH6p9bkrZgOJuDvTSrmuKPSXefpfFnvxiPq9ymI | VTZCZfVSEMwzs3/GaW3QWp7RNivJnS6K8TQmth/qMA2Nn9X8P8if4gFKTSaPc2VI | X7e3ATtMsKAP4OLqfOfZM6/YJ4STmjpf/5MY2PjGzya0GUPfe3/rQZslVk2/GswZ | fJ8fnMgtNSatjuq76hA3b8ZYOdLbUktDHnmQiuBPG35LyGRhRnPliSKboyw= |_-----END CERTIFICATE----- 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: scepter.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.scepter.htb | Issuer: commonName=scepter-DC01-CA/domainComponent=scepter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-11-07T20:25:34 | Not valid after: 2026-11-07T20:25:34 | MD5: 1582 0ca9 794a 4caf 2309 50ae 8ac5 cbd4 | SHA-1: fd03 810d 8150 f2ee 73f6 35b2 5042 d348 541e c5ef | SHA-256: 0588 c9de af6b f807 b16a de6c 0f09 08d9 0d78 45bf 1542 15cd 29ef c1a0 af0a 60d2 | -----BEGIN CERTIFICATE----- | MIIFyDCCBLCgAwIBAgITYgAAAAoWUbEdz8QwxAABAAAACjANBgkqhkiG9w0BAQsF | ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHc2NlcHRl | cjEYMBYGA1UEAxMPc2NlcHRlci1EQzAxLUNBMB4XDTI1MTEwNzIwMjUzNFoXDTI2 | MTEwNzIwMjUzNFowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPbg | z24KEMEITsmdVQO9GheEtbO03OKPIAz131aqh5uhTSoQ7nRF61uTshKwb8z9OvRD | ExDi0ucsfI1sx2XfgBqWTM1hj94I8UF2zeGtQVJxh0PsF58PfUp5FJi1vFBD0Esm | 5GVDqmOuN8Gu4bIqgU82uPxWbazL7rvKRymsDFYVP8p2R0QL0cJkzfVKKCN15LYi | APhzsfdwjeGbPs/kjVih9WIybA9V10CQIhrfsyoEotXnrG46HvJd8rcbvjHNjgAC | AV8/k0AELQ5lj/MW2tksh+VQeobPGAoVpMwabpV6osgng42+Q7MhxR5H9mQMcZRR | 5hcqxZvjf2dp9I2dBhECAwEAAaOCAvEwggLtMDgGCSsGAQQBgjcVBwQrMCkGISsG | AQQBgjcVCILhx22D9pwIhsmFFIOHx0SG0JR4gSoBHAIBbgIBADApBgNVHSUEIjAg | BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIwDgYDVR0PAQH/BAQDAgWg | MDUGCSsGAQQBgjcVCgQoMCYwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYKKwYB | BAGCNxQCAjAdBgNVHQ4EFgQUpoE3w6iTJj5wKaJuhqQEkQh1GlMwHwYDVR0jBBgw | FoAUjAQmINw0RbYfBxqdvUWXq/9M34swgc0GA1UdHwSBxTCBwjCBv6CBvKCBuYaB | tmxkYXA6Ly8vQ049c2NlcHRlci1EQzAxLUNBKDEpLENOPWRjMDEsQ049Q0RQLENO | PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy | YXRpb24sREM9c2NlcHRlcixEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHBBggrBgEF | BQcBAQSBtDCBsTCBrgYIKwYBBQUHMAKGgaFsZGFwOi8vL0NOPXNjZXB0ZXItREMw | MS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vydmlj | ZXMsQ049Q29uZmlndXJhdGlvbixEQz1zY2VwdGVyLERDPWh0Yj9jQUNlcnRpZmlj | YXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAeBgNV | HREBAf8EFDASghBkYzAxLnNjZXB0ZXIuaHRiMEsGCSsGAQQBgjcZAgQ+MDygOgYK | KwYBBAGCNxkCAaAsBCpTLTEtNS0yMS03NDg3OTU0Ni05MTY4MTg0MzQtNzQwMjk1 | MzY1LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAAGoSdQIWy5gAz16h+6nBlqk4dOz | 9DQkF905FXLtkIiBJ2LDuWstULZlwHXMtHySXXxNXaKfoMt9z5gpvs6cusA7mG54 | iGx1KgqezrJxQLZIFOIJshkNDDH6p9bkrZgOJuDvTSrmuKPSXefpfFnvxiPq9ymI | VTZCZfVSEMwzs3/GaW3QWp7RNivJnS6K8TQmth/qMA2Nn9X8P8if4gFKTSaPc2VI | X7e3ATtMsKAP4OLqfOfZM6/YJ4STmjpf/5MY2PjGzya0GUPfe3/rQZslVk2/GswZ | fJ8fnMgtNSatjuq76hA3b8ZYOdLbUktDHnmQiuBPG35LyGRhRnPliSKboyw= |_-----END CERTIFICATE----- |_ssl-date: 2026-05-23T23:37:22+00:00; +7h58m44s from scanner time. 2049/tcp open nlockmgr syn-ack ttl 127 1-4 (RPC #100021) 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: scepter.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-05-23T23:37:22+00:00; +7h58m43s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.scepter.htb | Issuer: commonName=scepter-DC01-CA/domainComponent=scepter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-11-07T20:25:34 | Not valid after: 2026-11-07T20:25:34 | MD5: 1582 0ca9 794a 4caf 2309 50ae 8ac5 cbd4 | SHA-1: fd03 810d 8150 f2ee 73f6 35b2 5042 d348 541e c5ef | SHA-256: 0588 c9de af6b f807 b16a de6c 0f09 08d9 0d78 45bf 1542 15cd 29ef c1a0 af0a 60d2 | -----BEGIN CERTIFICATE----- | MIIFyDCCBLCgAwIBAgITYgAAAAoWUbEdz8QwxAABAAAACjANBgkqhkiG9w0BAQsF | ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHc2NlcHRl | cjEYMBYGA1UEAxMPc2NlcHRlci1EQzAxLUNBMB4XDTI1MTEwNzIwMjUzNFoXDTI2 | MTEwNzIwMjUzNFowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPbg | z24KEMEITsmdVQO9GheEtbO03OKPIAz131aqh5uhTSoQ7nRF61uTshKwb8z9OvRD | ExDi0ucsfI1sx2XfgBqWTM1hj94I8UF2zeGtQVJxh0PsF58PfUp5FJi1vFBD0Esm | 5GVDqmOuN8Gu4bIqgU82uPxWbazL7rvKRymsDFYVP8p2R0QL0cJkzfVKKCN15LYi | APhzsfdwjeGbPs/kjVih9WIybA9V10CQIhrfsyoEotXnrG46HvJd8rcbvjHNjgAC | AV8/k0AELQ5lj/MW2tksh+VQeobPGAoVpMwabpV6osgng42+Q7MhxR5H9mQMcZRR | 5hcqxZvjf2dp9I2dBhECAwEAAaOCAvEwggLtMDgGCSsGAQQBgjcVBwQrMCkGISsG | AQQBgjcVCILhx22D9pwIhsmFFIOHx0SG0JR4gSoBHAIBbgIBADApBgNVHSUEIjAg | BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIwDgYDVR0PAQH/BAQDAgWg | MDUGCSsGAQQBgjcVCgQoMCYwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYKKwYB | BAGCNxQCAjAdBgNVHQ4EFgQUpoE3w6iTJj5wKaJuhqQEkQh1GlMwHwYDVR0jBBgw | FoAUjAQmINw0RbYfBxqdvUWXq/9M34swgc0GA1UdHwSBxTCBwjCBv6CBvKCBuYaB | tmxkYXA6Ly8vQ049c2NlcHRlci1EQzAxLUNBKDEpLENOPWRjMDEsQ049Q0RQLENO | PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy | YXRpb24sREM9c2NlcHRlcixEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHBBggrBgEF | BQcBAQSBtDCBsTCBrgYIKwYBBQUHMAKGgaFsZGFwOi8vL0NOPXNjZXB0ZXItREMw | MS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vydmlj | ZXMsQ049Q29uZmlndXJhdGlvbixEQz1zY2VwdGVyLERDPWh0Yj9jQUNlcnRpZmlj | YXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAeBgNV | HREBAf8EFDASghBkYzAxLnNjZXB0ZXIuaHRiMEsGCSsGAQQBgjcZAgQ+MDygOgYK | KwYBBAGCNxkCAaAsBCpTLTEtNS0yMS03NDg3OTU0Ni05MTY4MTg0MzQtNzQwMjk1 | MzY1LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAAGoSdQIWy5gAz16h+6nBlqk4dOz | 9DQkF905FXLtkIiBJ2LDuWstULZlwHXMtHySXXxNXaKfoMt9z5gpvs6cusA7mG54 | iGx1KgqezrJxQLZIFOIJshkNDDH6p9bkrZgOJuDvTSrmuKPSXefpfFnvxiPq9ymI | VTZCZfVSEMwzs3/GaW3QWp7RNivJnS6K8TQmth/qMA2Nn9X8P8if4gFKTSaPc2VI | X7e3ATtMsKAP4OLqfOfZM6/YJ4STmjpf/5MY2PjGzya0GUPfe3/rQZslVk2/GswZ | fJ8fnMgtNSatjuq76hA3b8ZYOdLbUktDHnmQiuBPG35LyGRhRnPliSKboyw= |_-----END CERTIFICATE----- 3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: scepter.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.scepter.htb | Issuer: commonName=scepter-DC01-CA/domainComponent=scepter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-11-07T20:25:34 | Not valid after: 2026-11-07T20:25:34 | MD5: 1582 0ca9 794a 4caf 2309 50ae 8ac5 cbd4 | SHA-1: fd03 810d 8150 f2ee 73f6 35b2 5042 d348 541e c5ef | SHA-256: 0588 c9de af6b f807 b16a de6c 0f09 08d9 0d78 45bf 1542 15cd 29ef c1a0 af0a 60d2 | -----BEGIN CERTIFICATE----- | MIIFyDCCBLCgAwIBAgITYgAAAAoWUbEdz8QwxAABAAAACjANBgkqhkiG9w0BAQsF | ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHc2NlcHRl | cjEYMBYGA1UEAxMPc2NlcHRlci1EQzAxLUNBMB4XDTI1MTEwNzIwMjUzNFoXDTI2 | MTEwNzIwMjUzNFowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPbg | z24KEMEITsmdVQO9GheEtbO03OKPIAz131aqh5uhTSoQ7nRF61uTshKwb8z9OvRD | ExDi0ucsfI1sx2XfgBqWTM1hj94I8UF2zeGtQVJxh0PsF58PfUp5FJi1vFBD0Esm | 5GVDqmOuN8Gu4bIqgU82uPxWbazL7rvKRymsDFYVP8p2R0QL0cJkzfVKKCN15LYi | APhzsfdwjeGbPs/kjVih9WIybA9V10CQIhrfsyoEotXnrG46HvJd8rcbvjHNjgAC | AV8/k0AELQ5lj/MW2tksh+VQeobPGAoVpMwabpV6osgng42+Q7MhxR5H9mQMcZRR | 5hcqxZvjf2dp9I2dBhECAwEAAaOCAvEwggLtMDgGCSsGAQQBgjcVBwQrMCkGISsG | AQQBgjcVCILhx22D9pwIhsmFFIOHx0SG0JR4gSoBHAIBbgIBADApBgNVHSUEIjAg | BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIwDgYDVR0PAQH/BAQDAgWg | MDUGCSsGAQQBgjcVCgQoMCYwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYKKwYB | BAGCNxQCAjAdBgNVHQ4EFgQUpoE3w6iTJj5wKaJuhqQEkQh1GlMwHwYDVR0jBBgw | FoAUjAQmINw0RbYfBxqdvUWXq/9M34swgc0GA1UdHwSBxTCBwjCBv6CBvKCBuYaB | tmxkYXA6Ly8vQ049c2NlcHRlci1EQzAxLUNBKDEpLENOPWRjMDEsQ049Q0RQLENO | PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy | YXRpb24sREM9c2NlcHRlcixEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHBBggrBgEF | BQcBAQSBtDCBsTCBrgYIKwYBBQUHMAKGgaFsZGFwOi8vL0NOPXNjZXB0ZXItREMw | MS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vydmlj | ZXMsQ049Q29uZmlndXJhdGlvbixEQz1zY2VwdGVyLERDPWh0Yj9jQUNlcnRpZmlj | YXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAeBgNV | HREBAf8EFDASghBkYzAxLnNjZXB0ZXIuaHRiMEsGCSsGAQQBgjcZAgQ+MDygOgYK | KwYBBAGCNxkCAaAsBCpTLTEtNS0yMS03NDg3OTU0Ni05MTY4MTg0MzQtNzQwMjk1 | MzY1LTEwMDAwDQYJKoZIhvcNAQELBQADggEBAAGoSdQIWy5gAz16h+6nBlqk4dOz | 9DQkF905FXLtkIiBJ2LDuWstULZlwHXMtHySXXxNXaKfoMt9z5gpvs6cusA7mG54 | iGx1KgqezrJxQLZIFOIJshkNDDH6p9bkrZgOJuDvTSrmuKPSXefpfFnvxiPq9ymI | VTZCZfVSEMwzs3/GaW3QWp7RNivJnS6K8TQmth/qMA2Nn9X8P8if4gFKTSaPc2VI | X7e3ATtMsKAP4OLqfOfZM6/YJ4STmjpf/5MY2PjGzya0GUPfe3/rQZslVk2/GswZ | fJ8fnMgtNSatjuq76hA3b8ZYOdLbUktDHnmQiuBPG35LyGRhRnPliSKboyw= |_-----END CERTIFICATE----- |_ssl-date: 2026-05-23T23:37:22+00:00; +7h58m44s from scanner time. 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 5986/tcp open ssl/wsmans? syn-ack ttl 127 |_ssl-date: 2026-05-23T23:37:22+00:00; +7h58m44s from scanner time. | tls-alpn: | h2 |_ http/1.1 | ssl-cert: Subject: commonName=dc01.scepter.htb | Subject Alternative Name: DNS:dc01.scepter.htb | Issuer: commonName=dc01.scepter.htb | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2024-11-01T00:21:41 | Not valid after: 2025-11-01T00:41:41 | MD5: e84c 6894 816e b7f5 4338 0a1f a896 2075 | SHA-1: 4e58 3799 020d aaf4 d5ce 0c1e 76db 32cd 5a0e 28a7 | SHA-256: 1eb9 f2f9 b905 28bf dc30 e0d1 1f29 933b 52fd f440 7c5a 4c2d 4847 7751 7b6e a180 | -----BEGIN CERTIFICATE----- | MIIDLTCCAhWgAwIBAgIQYr4O5l5zSo9Nt/NWAsz/gDANBgkqhkiG9w0BAQsFADAb | MRkwFwYDVQQDDBBkYzAxLnNjZXB0ZXIuaHRiMB4XDTI0MTEwMTAwMjE0MVoXDTI1 | MTEwMTAwNDE0MVowGzEZMBcGA1UEAwwQZGMwMS5zY2VwdGVyLmh0YjCCASIwDQYJ | KoZIhvcNAQEBBQADggEPADCCAQoCggEBALt+NmALaj8ktEddCkYyQCYPKE6NQUr1 | jAgCUHPqlKlLvRsbWQmTe7R6GNp6oZotbipCeX3dK8URKg/cbiXspKoArfDtJMtL | NA3r3+sAS881NPYs+nxOZTQ3ZdLqQBWClXXTHHjg9eLySGOiEoOPtyE2ctw71MHn | yyrKW4JYLpI8SNqtjOXW3mXNrsHRbHU3AZ3nh+OrG8T8zWWs3BKGFYtg/8YBoXYE | EnLXJ7C+LRwJ+rEF3TLsYYIpSGb5LVgH/9HJ7x6gr7g4CZsdZ7/E+V5rlVa6Y3HU | Ta1q3mdme7nsEoBsB7GQJ7TCTtAL85T+Pd4gaxjqJrWkFzRx4dIyQX0CAwEAAaNt | MGswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD | ATAbBgNVHREEFDASghBkYzAxLnNjZXB0ZXIuaHRiMB0GA1UdDgQWBBQCeVUszMLJ | drdv7S3qV6FfMT7NOzANBgkqhkiG9w0BAQsFAAOCAQEASeFO9X3n9Xpj8GSocGrX | GfCyoIvPKHdO18JJVVkehshdXGBUyAlanX90vh5rrqPE2s9rDhqxSUfSl9+deOii | aAobzESCZNzvcqiz3IdRFtI+YP/Uz8PPRXdO8KQCPJ2jVLgo/GCuXfllooJJnhOT | ZYdRCCMCLNdudmhkwAO7EvwW4cDBhMaZy2GcpIP37yjZpwCvmdBVfN4R5Ra+265V | AnYngzq39K+rPSA/eMDHkaQ+q+hTj7XrVXqW8Uyecbw4lMqslZr5/fZJGZS6nmcI | 2UEYW/JnpvR02lAZjuoM+/Neu7fl2CEvAggG7vcu0M1TN44adcP3F5tnljuUdy3j | jw== |_-----END CERTIFICATE----- 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49673/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49694/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 49695/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49699/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49700/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49713/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49740/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49761/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows 10 1709 - 21H2 (97%), Microsoft Windows Server 2016 (96%), Microsoft Windows Server 2019 (96%), Microsoft Windows 10 (93%), Microsoft Windows 10 21H1 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2022 (93%), Microsoft Windows 10 1903 (92%), Windows Server 2019 (92%), Microsoft Windows Vista SP1 (92%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.98%E=4%D=5/23%OT=53%CT=%CU=30629%PV=Y%DS=2%DC=T%G=N%TM=6A11CA17%P=x86_64-pc-linux-gnu) SEQ(SP=102%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U) SEQ(SP=105%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U) OPS(O1=M552NW8NNS%O2=M552NW8NNS%O3=M552NW8%O4=M552NW8NNS%O5=M552NW8NNS%O6=M552NNS) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70) ECN(R=Y%DF=Y%T=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=) T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=) T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G) IE(R=Y%DFI=N%T=80%CD=Z) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=258 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-05-23T23:37:17 |_ start_date: N/A | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 17046/tcp): CLEAN (Couldn't connect) | Check 2 (port 43406/tcp): CLEAN (Couldn't connect) | Check 3 (port 26590/udp): CLEAN (Timeout) | Check 4 (port 12145/udp): CLEAN (Failed to receive data) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: mean: 7h58m43s, deviation: 0s, median: 7h58m43s ``` {% endcode %} ## Initial Enumeration ### SMB (445) * Initial enumeration with the guest account and attempting to list out shares with an unauthenticated session is not working:
### NFS over RPC (111) * I can see that there is an NFS over RPC port open (port 111). Per this article , "NFS is a system designed for client/server that enables users to seamlessly access files over a network as though these files were located within a local directory." * This is a Network File System (NFS) that uses RPC calls to route requests between clients and servers so that remote file operations appears as local calls. There is a way that we can connect via unauthenticated means to the NFS share. First, we can list out the NFS on the target host and see that everyone has access to the /helpdesk: {% code overflow="wrap" expandable="true" %} ``` showmount -e ``` {% endcode %}
* We can then attempt to mount the NFS. Per the HackTricks article, we want to specify to use version 2 because it doesn’t have any authentication or authorization. NFS version 2 was not a flag option, it still will work. We can run the following command and list out the contents: {% code overflow="wrap" expandable="true" %} ``` sudo mkdir /mnt/helpdesk #Creates the mount point sudo mount -t nfs -o nolock 10.129.244.44:/helpdesk /mnt/helpdesk #mounts the NFS from the target to the specified mount point ``` {% endcode %}
* We can see that there are certificate files that are very interesting. We can simply recursively copy these files to our working directory on our Kali host from the NFS by running this command: {% code overflow="wrap" expandable="true" %} ``` sudo cp -r /mnt/helpdesk/ . ``` {% endcode %} ## Gaining a Foothold as User 'd.baker' * We can start by attempting to crack these .pfx files. We can use 'pfx2john' to hash these three pfx files and then run that hash against a wordlist. We can see that running john against all three files comes back with the same password:
* We can then attempt to use certipy to export the certificate as a pfx file after supplying the cracked password. Unfortunately, we will see that our client is not trusted. This appears to be a dead-end as the other users produce the same results:
### Pivot Time * We know that we have pfx files and crt and key file for 'baker.' I am going to focus on this and see if this is of any use as having both the certificate and private key might lead us to something. Per this article , we can list out the contents of the certificate using 'openssl'. I can see that this user is 'd.baker': {% code overflow="wrap" expandable="true" %} ``` openssl x509 -in baker.crt -text ``` {% endcode %}
* Ok, we have the certificate and the private key for baker. Using the same article, we can attempt to convert the .key and .crt to a .pfx, which we could then use certipy to auth to the DC and gain access to the users TGT. I will try this route. I will run the following command to create a PKCS#12 file, which is a an archive file format for storing many cryptography objects as a single file . * Essentially, this is going to be a container file that will hold the private key file and X509 certificate that we can use to authenticate. First, we need to create a .pem file : {% code overflow="wrap" expandable="true" %} ``` openssl x509 -in baker.crt -outform PEM -out baker.pem ``` {% endcode %} * Next, we can use these files to create our PKCS#12 file. Upon running the command, it prompted me for a password. I went ahead and used the password that we previously cracked and it allowed for the creation of the cert.pfx file: {% code overflow="wrap" expandable="true" %} ``` openssl pkcs12 -in cert.pem -inkey key-pem.key -export -out cert.pfx ``` {% endcode %}
* Next, I will go ahead and test this out. I will first run the command to sync our Kali machine with the DC and then attempt to auth with the cert.pfx. We can see that we can gain entry to the users NTLM hash and the TGT is stored in the ccache file: {% code overflow="wrap" expandable="true" %} ``` sudo ntpdate && certipy-ad auth -pfx cert.pfx -dc-ip ``` {% endcode %}
* Verifying successful authentication:
## Bloodhound Enumeration * Awesome, we are able to gain entry with an AD user. We can now start to enumerate and begin to query ldap. I will run Bloodhound as a means of speeding up the enumeration process. We can see that our user has ForceChangePassword rights over user 'A.Carter':
* User 'A.Carter' is a member of the IT Support group and this group has GenericAll rights over the Staff Access Certificate OU. With these GenericAll rights on this OU, we can add a new ACE on the OU that will inherit down to the objects under that OU:
* We will change the password for user 'A.Carter' using bloodyAD:
* Additionally, we can see that the Staff Access Certificate OU contains user d.baker, which we can see from the ldapsearch we conducted:
* At this point, we now control the A.Carter user who has GenericAll rights over the OU that contains d.baker. This means that we can fully control this OU and anything we do will apply to d.baker as well. ## Certificate Enumeration with Certipy-AD * After enumerating AD CS for any vulnerable templates, I then decided to pull the all certificate template names in the domain. The following template shows that member of the group 'staff' have enrollment rights. Checking LDAP, we can see that d.baker is a member of this group. What is also interesting, that I have not previously seen, is the Flags containing altrequireemail. I will conduct research on this: {% code overflow="wrap" expandable="true" %} ``` 1 Template Name : StaffAccessCertificate Display Name : StaffAccessCertificate Certificate Authorities : scepter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireEmail SubjectRequireDnsAsCn SubjectRequireEmail Enrollment Flag : AutoEnrollment NoSecurityExtension Extended Key Usage : Client Authentication Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 99 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2024-11-01T02:29:00+00:00 Template Last Modified : 2024-11-01T09:00:54+00:00 Permissions Enrollment Permissions Enrollment Rights : SCEPTER.HTB\staff Object Control Permissions Owner : SCEPTER.HTB\Enterprise Admins Full Control Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Local System SCEPTER.HTB\Enterprise Admins Write Owner Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Local System SCEPTER.HTB\Enterprise Admins Write Dacl Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Local System SCEPTER.HTB\Enterprise Admins ``` {% endcode %}
## ESC14 Vulnerability * After doing some reading in this article and this one , we can determine that there is an ESC14 vulnerability present. Per the aforementioned article, "The altSecurityIdentities attribute of Active Directory (AD) computers and users allows you to specify *explicit certificate mappings*. An explicit certificate mapping is a reference to a certificate. Anyone with a certificate matching the reference in an explicit certificate mapping of a principal can use this certificate to authenticate as the principal. An attacker can therefore abuse write access to the altSecurityIdentities attribute of an AD computer or user to add an explicit certificate mapping referring to a certificate in the attacker’s possession, and then use this certificate to authenticate as the said computer or user." * We can query LDAP to find any users with 'altSecurityIdentities' set. We will see that user 'h.brown' has a weak certificate mapping of 'X509:\' `X509:EmailAddress` (maps by an RFC822 name, typically an email address, from the SAN):
* Ok, given that we know A.Carter has GenericAll writes over the 'Staff Access Certificate' OU, d.baker falls under this OU and is a member of 'Staff' group, which has Enrollment Rights on the StaffAccessCertificate, we could potentially use all of this to take advantage of the weak cert mapping, I could potentially replace or map a setting as the user 'h.brown' and gain access. Now, this user is part of the Protected Users as well. Let's see if we can gain access to this user. * First, since we have complete control over the OU, we can start by granting FullControl of the d.baker user over this OU and confirm by querying DACL:
* Now, we will take advantage of the weak cert mapping by modifying d.bakers email to reflect that of user h.brown, which we previously observed in the 'altSecurityIdentifier' attribute. To do this, I will create an ldif file that has the following content. This way, we can supply the file using ldapmodify: {% code overflow="wrap" expandable="true" %} ``` dn: CN=d.baker,OU=Staff Access Certificate,DC=scepter,DC=htb changetype: modify replace: mail mail: h.brown@scepter.htb ``` {% endcode %} * Attempting to use the ldapmodify method failed several times. I will pivot to using bloodyAD instead. We will update the user 'd.baker' mail attribute to reflect that of user 'h.brown' and then verify that this is set:
* Now, we can request a certificate for the user 'd.baker' using the template that we identified earlier:
* Per this article: "The target has an explicit weak mapping of type `X509RFC822`. The attacker can modify the `mail` attribute of the victim so that it matches the `X509RFC822` mapping of the target. It is then possible to enroll on the certificate model with the victim, and use the certificate obtained to authenticate as the target." * Now, we know that we associated or mapped the user 'h.brown' email with our controlled user 'd.baker' for the ESC14 attack. Now, since we have this certificate, we can auth and specify a username. This allows us to request, on behalf of the target principal, a certificate that we can then use to gain access and request a TGT and get the NT hash for the user with weak mappings:
* We now gain access:
## Host Enumeration * As we previously saw, these are the groups this user is part of:
* Enumeration of the OUs in the domain show that there is a 'Helpdesk Enrollment Certificate OU'. We previously found the 'Staff Access Certificate' OU in Bloodhound. We will check Bloodhound for the other OU now:
* HelpDesk Enrollment Certificate contains the user P.Adams:
* P.Adams is a member of the Replication Operators group and this group has DCSync capabilities over the DC. If we can gain access as this user, we can dump the NTDS.dit from the DC and it is game over at that point:
* Intriguing, after some digging and upon looking at the ACLs on the OU 'HelpDesk Enrollment Certificate', we can see that members of CMS (which h.brown is a member) have Alt-Security-Identities, WriteProperty permissions on this OU. Possibly we could conduct another certificate vulnerability, gain access to the HelpDesk Enrollment Certificate, and then request a cert for the P.Adams user. This would give us the TGT for the user, which we could use to auth and perform a DCSync attack:
## Another Round of Certipy Enumeration * We will go back and enumerate our Certipy output again. We can see a 'HelpdeskEnrollmentCertificate' template that allows 'Domain Computers' Enrollment permissions. Interesting, this could be our way to gain access to the P.Adams user. We could possibly add another computer. We will need to check the MAQ of the domain to see if we can create computer accounts: {% code overflow="wrap" expandable="true" %} ``` 1 Template Name : HelpdeskEnrollmentCertificate Display Name : HelpdeskEnrollmentCertificate Certificate Authorities : scepter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : AutoEnrollment Extended Key Usage : Server Authentication Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 99 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2024-11-01T03:42:58+00:00 Template Last Modified : 2024-11-01T03:43:09+00:00 Permissions Enrollment Permissions Enrollment Rights : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Domain Computers SCEPTER.HTB\Enterprise Admins Object Control Permissions Owner : SCEPTER.HTB\Administrator Full Control Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Enterprise Admins Write Owner Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Enterprise Admins Write Dacl Principals : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Enterprise Admins Write Property Enroll : SCEPTER.HTB\Domain Admins SCEPTER.HTB\Domain Computers SCEPTER.HTB\Enterprise Admins [+] User Enrollable Principals : SCEPTER.HTB\Domain Computers ``` {% endcode %} * Hmm, the MAQ is set to 0:
* What we need now is to enumerate and see if there are any groups, OUs, etc that we could possibly add a computer account to the domain. Being that we previously confirmed A.Carter has GenericAll rights over the Staff Access Certificates, we should be able to add a computer account to this OU:
* Now that this has been completed and we control a machine account, we can request a certificate using the specified template:
## Gaining Access to User 'P.Adams' * Here is the output from the certificate we just obtained. We currently have a pkcs12 file, which we will remember holds the x509 certificate that we learned about earlier. We can list this out. Claude was helpful in giving me syntax to list out the x509 portion:
* Continuing to read the article , we can use explicit certificate mapping to specify the 'altSecurityIdentities' for a user. However, per the article, "The altSecurityIdentities attribute needs the IssuerName, SubjectName, or SerialNumber values in “forward” format, meaning that you have to reverse the values when writing them. You must keep the byte order for the serial number, so “A1B2C3” should result in “C3B2A1” and not “3C2B1A”." * We can perform this attack and specify the 'x509IssuerSerialNumber', but we will need to supply the issuer name and the serial number:

Photo from SpecterOps article.

* We will retrieve the specified mapping, reverse the values, map this to the P.Adams user and then request a certificate on behalf of that user. First, we need to get the correct output for the SerialNumber mapping:
* Next, we will get the correct format for this to work. I had Claude craft me a quick python script to ask for the Issuer and Serial number. This will take the input and convert it to the correct 'forward' format: {% code overflow="wrap" expandable="true" %} ``` #!/usr/bin/env python3 """ Format x509IssuerSerialNumber for altSecurityIdentities. Reverses IssuerName RDN order and byte-reverses the serial number. """ import sys def reverse_serial_bytes(serial: str) -> str: """Byte-reverse a hex serial number. 'A1B2C3' -> 'C3B2A1'""" serial = serial.replace(":", "").replace(" ", "").upper() if len(serial) % 2 != 0: serial = "0" + serial pairs = [serial[i:i+2] for i in range(0, len(serial), 2)] return "".join(reversed(pairs)) def format_mapping(issuer_dn: str, serial_hex: str) -> str: clean_issuer = issuer_dn.replace(", ", ",").replace(" ,", ",") rev_serial = reverse_serial_bytes(serial_hex) return f"X509:{clean_issuer}{rev_serial}" if __name__ == "__main__": issuer_dn = input("Issuer DN : ").strip() serial_hex = input("Serial Hex : ").strip() result = format_mapping(issuer_dn, serial_hex) print("\nSet altSecurityIdentities to:") print(f" {result}") ``` {% endcode %}
* Now, we can map this to the P.Adams user:
Now that we have the correct syntax and the correct mapping, we can request a certificate and specify the username P.Adams. If this all works, we should get a TGT and the users NTLM hash:
* Success!
## Privilege Escalation * We previously established that the user 'P.Adams' has DCSync rights over the DC. We can now dump the NTDS.dit:
* I will now PtH to gain access as the Administrator user:
## Resources ### NFS over RPC Mounting of NFS * ### Certificate Recovery Leading to Creds * * * ### ESC14 Vulnerability * * *