HTB - Voleur
TL;DR - An assumed-breach, Kerberos-only box starting with ryan.naylor:HollowOct31Nyt. A share holds a password-protected Access_Review.xlsx, cracked with John, which leaks cleartext creds for svc_ldap and svc_iis. BloodHound shows svc_ldap has WriteSPN over svc_winrm, so I add an SPN and kerberoast it, crack the hash, and get a WinRM shell (user.txt). svc_ldap is in restore_users, so I restore the deleted user todd.wolfe from the AD Recycle Bin, decrypt his DPAPI-protected credentials to get jeremy.combs, use a leaked SSH key to log in as svc_backup, and from there grab ntds.dit + SYSTEM, dump the hashes, and pass-the-key as Administrator for root.txt. ...