{
  "id": 16295843,
  "title": "HTB - Support Writeup - no Metasploit",
  "url": "https://urgent.news/2026/10/24/htb-support-writeup-no-metasploit",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T07:33:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nekohige/htb-support-writeup-no-metasploit-515g"
  },
  "original_language": "en",
  "account": "During a system assessment, a readable file named UserInfo.exe was discovered on the guest account. This binary performed LDAP communication and contained a plaintext password that could be recovered through binary analysis. The \"support\" user, with whom the shell was gained, belonged to a group that had GenericAll access over the Domain Controller (DC). Exploiting this vulnerability through Remote Bulletin Board (RBCD) led to obtaining Administrator privileges.\n\nTo enumerate open ports, nmap was employed. Open ports included 135 (RPC), 139 (NetBIOS/SMB), 445 (SMB), 53 (DNS), 389 (LDAP), and 88 (Kerberos), suggesting an Active Directory-enabled standalone Windows machine. The domain was identified as \"support.htb\".\n\nThe system was tested for anonymous and guest login capabilities on shared resources, which revealed the existence of a unique folder called \"support-tools\". By connecting to this folder via SMB and listing its contents, several interesting files were discovered, including the targeted UserInfo.exe.\n\nUpon disassembling the binary, it was found to have a function capable of logging in to LDAP, with the encryption method documented within the code. Utilizing Python, the password extracted from the binary - nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz - was employed to authenticate with the LDAP server. Finally, the contents of the directory were retrieved using ldapsearch with the supplied password.",
  "summary": "Summary There was a file readable by the guest account. Furthermore, it included UserInfo.exe , a binary that performs LDAP communication, and we were able to recover a plaintext password from it by analyzing the binary. The group that support (the account whose shell we obtained) belongs to had GenericAll rights over the DC. We exploited this via RBCD to obtain Administrator. #### Recommendation…",
  "key_points": [
    "Readable file UserInfo.exe found on guest account",
    "Binary performs LDAP communication with plaintext password",
    "Support user with GenericAll access exploited via RBCD"
  ],
  "editors_take": "Hardcoded credentials within local binaries provide attackers a direct path to domain-level privileges by bypassing standard authentication through the exploitation of excessive group permissions.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}