Timelapse
Overview Timelapse is an Easy Active Directory box built around a single domain controller (DC01, domain timelapse.htb). The entry point is an anonymously readable SMB share that stores a backup zip containing a PFX certificate bundle. The zip and the PFX inside it are both password protected, but both fall quickly to john against rockyou.txt. Once the certificate and private key are extracted, they authenticate to WinRM over TLS as legacyy, which owns the user flag. ...
Hack The BoxTimelapseWindowsEasy