HackTheBox - Tombwatcher
Source: YouTube · IppSec · published Oct 11, 2025 · 42:48
The video demonstrates how to bypass a common Active Directory dead end in the "Tomb Watcher" Hack The Box challenge by exploiting the AD Recycle Bin to restore a tombstoned computer object for privilege escalation.
Key Takeaways:
• The challenge begins with a lengthy Active Directory attack chain that ultimately hits a dead end because the target user object is a "tombstone" (soft deleted) and cannot be resolved by standard tools like Certify 0:10.
• The presence of a SID instead of a username in the Certify output indicates the object has been moved to the AD Recycle Bin rather than being permanently purged 0:13.
• Understanding that "delete" in AD often means moving to the Recycle Bin is crucial, as these objects can be restored and used to gain access 0:25.
• The solution involves restoring the tombstoned computer object to allow the attacker to resume the attack chain and achieve the final goal 0:34.
Mastering AD recovery mechanisms is essential for penetration testers to overcome enumeration barriers in complex Active Directory environments.
Sources:
- 0:10 Introduction to the "Tomb Watcher" challenge and the initial AD attack chain.
- 0:13 Explanation of the Certify output showing a SID instead of a user object.
- 0:18 Definition of a "tombstone" as a soft-deleted object in Active Directory.
- 0:25 Clarification that AD deletes often move objects to the Recycle Bin.
- 0:34 Strategy to restore the object to bypass the dead end.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ipsac. We're doing Tomb Watcher from Hack the Box, which starts out with a pretty lengthy active directory attack chain, which will test your impact and bloody AD knowledge. However, you'll come to a dead end that is tough to enumerate yourself past. If you look at certify output, you'll see a SID, not user object can do what you need. The SID is shown because Active Directory cannot resolve the object as it's currently a tombstone, which is essentially just saying it is soft deleted. When dealing with computers, it is important to remember delete does not mean purge. Oftent times delete is just moving something to the recycle bin where it can be restored at a later time. Once we realize this, we can restore the object, take ownership and then perform activ…