HackTheBox - Checkpoint
Source: YouTube · IppSec · published Oct 24, 2026 · 45:24
This walkthrough covers HackTheBox "Checkpoint," an assumed-breach Windows Server 2025 AD box solved by chaining tombstone reanimation, a malicious VS Code extension, a DMSA takeover, and local VM backup pillaging to reach Domain Admin 0:00.
Key Takeaways:
• Recon: Using alex.turner credentials, nmap shows DNS, SMB, and WinRM (no web) on domain checkpoint.htb; RustHound/BloodHound and BloodyAD are used for enumeration 0:54
• Tombstone Reanimation: BloodyAD shows write rights over deleted objects; net exec's tombstone module restores deleted user Mark Davies, who is then compromised via password reuse of alex.turner's password 8:12
• Malicious VS Code Extension: Mark Davies has read/write on the "devdrop" share for VS Code extensions; a reverse-shell extension is built with the right engine version and onStartupFinished activation event, yielding a shell as ryan.brooks 17:18
• DMSA Takeover: Ryan Brooks has GenericAll over service.deploy and create-child rights in a custom DMSA OU; a BadSuccessor-style DMSA attack authenticates as service.deploy 35:00
• VM Backup Pillaging: service.deploy's Backup Access group grants access to a VM Backups share; instead of exfiltrating huge files, vmcats.exe runs locally to dump the Administrator NTLM hash from VM memory, giving Domain Admin and the flag 39:59
Checkpoint demonstrates modern AD attack paths—tombstone restoration, extension persistence, and DMSA abuse—without relying on ADCS.
Sources:
- 0:00 Overview of the Checkpoint box and attack chain
- 0:54 nmap recon and credential authentication
- 8:12 Writable objects and tombstone restoration
- 17:18 Building and deploying the malicious VS Code extension
- 35:00 DMSA takeover of service.deploy
- 39:59 VM backup pillaging with vmcats to dump the admin hash
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is Ipsac, and today I'll be doing Checkpoint from Hack the Box, which is an assumed breach Windows box, meaning we start out with a set of credentials. I really enjoy this box because there is no web. It starts out with finding out that our account can reanimate tombstones, which is just a way to unddelete accounts from Active Directory. The account we recover has the ability to install Visual Studio Code extensions, which is a really nice persistence vector, but also has been used in some supply chain uh compromised style of attacks. Once we do this, we discover we have a generic right over another user. But without ADCS, it's tough to get onto that account. Thankfully, this is Windows 2025 and we have all the needed things to configure a delegated managed s…