Updated Administrator Writeup

Author: bytebl33d

_posts/2025-04-19-htb-administrator.md

@@ -2,13 +2,14 @@
 layout: single
 title:  "HTB Administrator Writeup"
 seo_title: "Writeup for the HackTheBox Administrator Machine"
-date:   2025-04-19 10:01:00 +0200
+date:   2025-04-19 21:01:00 +0200
 categories: ['HackTheBox', 'Windows', 'Active-Directory']
 classes: wide
 toc: true
 header:
     teaser: "/assets/images/headers/Administrator.png"
 ---
+Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the `michael` account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user `olivia` has `GenericAll` permissions over `michael`, allowing us to reset his password. With access as `michael`, it is revealed that he can force a password change on the user `benjamin`, whose password is reset. This grants access to `FTP` where a `backup.psafe3` file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user `emily`. Further enumeration shows that `emily` has `GenericWrite` permissions over the user `ethan`, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for `ethan`, who is found to have `DCSync` rights ultimately allowing retrieval of the `Administrator` account hash and full domain compromise.
 
 As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: 
 ```