HackTheBox - Pirate
Source: YouTube · IppSec · published Sep 5, 2026 · 1:20:18
Hack the Box "Pirate" is a Windows AD box chaining pre-Windows 2000 group weaknesses, gMSA reads, NTLM relay, and delegation abuse to impersonate any domain user via SPN manipulation 0:00.
Key Takeaways:
• Recon shows AD (DNS 53, IIS 80, WinRM 5985); TTL 126 and port 2179 suggest a Hyper-V VM one hop away 1:20
• Assumed-breach user "pentest" finds a.white has constrained delegation and a.white_adm (Key Admins) can write SPNs—the endgame is impersonating anyone on DC01 5:57
• MS01 is in "Pre-Windows 2000 Compatible Access" (password = hostname), missed by BloodHound's default queries; net exec's pre2k module finds it 13:41
• As MS01$ over Kerberos, d-gmsa reads gMSA hashes, granting WinRM on DC1 and Web01 14:50
• From Web01 (Chisel pivot), SMB signing off + WebClient running enables HTTP-to-LDAP relay, setting RBCD on Web01 for Exchange01; S4U impersonates Administrator, secretsdump reveals a.white's password, and BloodyAD resets a.white_adm's 28:00
• Rewriting the SPN to DC01 yields an S4U ticket as Administrator/CIFS for SYSTEM on DC01; an unintended path uses RemotePotato to steal a.white's hash, relaying via LDAPS 1:07:30
A thorough demo of chaining AD misconfigurations while favoring stealthier alternatives to noisy techniques.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is Ipsac, and today we'll be doing Pirate from Hack the Box, which is a fun Windows box that involves some NLM relaying. Before we get into that though, we have to jump through a lot of AD enumeration. And that's what I like most about this box, because you can put together the entire attack chain from the assume breach scenario all the way to root from the Blood Hound data. However, unlike a lot of active directory, it's not just copying and pasting what Blood Hound says. The first thing is we find computers that are member of the pre200 Windows compatibility group enabling us the ability to read some group managed service account hashes and that gets us winrm privileges to DC1 and web 01. From web 01 we can perform a NLM relay over to LDAP. The intended way…