HackTheBox - Garfield
Source: YouTube · IppSec · published Nov 7, 2026 · 51:53
This video walks through the HackTheBox machine "Garfield," an assumed-breach AD box requiring LDAP ACL enumeration that BloodHound misses and RODC abuse to reach domain admin 0:00.
Key Takeaways:
• Starting as j.arbuckle, nmap reveals a Windows AD domain (garfield.htb) with an 8-hour clock skew requiring Kerberos time sync 1:20
• BloodHound shows no outbound control, but bloodyAD's get-writable reveals scriptPath write access on nearly all accounts 6:41
• A malicious script.bat on SYSVOL plus scriptPath on l.wilson.adm resets that password on login, yielding a WinRM shell 11:00
• LWilson.adm joins RODC Administrators and writes managedBy on RODC1$ for full admin; an alternative path is traditional RBCD 21:59
• secretsdump needs -use-vsss (shadow copy) to extract the RODC krbtgt_8245 hash from NTDS.dit 26:23
• Final escalation: RODC golden ticket, clear msDS-NeverRevealGroup, add Domain Admins to msDS-RevealOnDemandGroup, then DC-sync administrator's hash 44:29
The walkthrough stresses learning from error messages to debug real-world AD attacks, offering a solid lesson in RODC-specific techniques.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing Darfield from hack the box. This box up to the user flag is pretty easy as long as you know old ad enumeration as the paths don't show up in blood hound. It is assumed breach and the first user can write to script path. Again, blood hound doesn't show this but if you use bloody ad the get writable does and then there's like a find interesting ACL's or something in power view that would also show this but bloody ID is the way I do it nowadays. Once we do this, we can take over an administrator account that can do a lot of readonly domain controller shenanigans. There's two paths to admin on this readonly domain controller. Either the traditional resourcebased constraint delegation or we can write the manage by attribute. With ad…