HTB Pirate Predictable Machine Passwords, gMSA Credential Th...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/09/05/htb-pirate.html
• Blog Title: HTB Pirate: Predictable Machine Passwords, gMSA Credential Theft, RBCD, and SPN-Jacking
• Suggested Section: Windows Hardening > Active Directory Methodology, especially Resource-based Constrained Delegation, Constrained Delegation, and a new subsection for predictable pre-created computer-account passwords and SPN-jacking/service-class substitution; cross-reference gMSA credential theft

🎯 Content Summary

Overview and impact: This Hack The Box Pirate walkthrough documents an assume-breach attack against the Windows Active Directory domain pirate.htb, beginning with the supplied low-privileged credentials pentest / p3nt3st2025!&. The demonstrated portion identifies pre-created computer accounts whose legacy passwords equal their lowercase hostnames, compromises MS01$, abuses its membership in Domain Secure Servers to read ...

🔧 Technical Details

Detecting hidden internal hosts through TTL and TCP path differences: Compare traceroutes or response TTLs across ports exposed on the same public address. If most services terminate at a Windows host with TTL 127 but one service returns TTL 126 or requires an extra hop, that port may be forwarded to a VM or container behind the visible server. Use TCP-aware tracing such as lft target:port, because ordinary ICMP traceroutes may not reproduce the forwarding path.

Predictable pre-created computer-account passwords: Enumerate computer accounts created in advance for legacy domain joins. Some retain an initial password equal to the lowercase hostname without the trailing $, such as account MS01$ with password ms01. NetExec's pre2k module enumerates candidates, tests the password format, requests TGTs, and saves the credential caches. Test Kerberos explicitly with -k...

🤖 Agent Actions

Plan:

1. Inspect the AD documentation tree and read at least five relevant pages.
2. Fetch and verify the source/primary research, excluding forbidden domains.
3. Identify genuinely missing techniques and select one existing target page.
4. Edit, validate citations/formatting, and review the diff.
   Repository review shows dedicated constrained-delegation, RBCD, gMSA/dMSA, Kerberos, LDAP relay-hardening, and AD methodology pages. I’m now checking exact coverage and source provenance before selecting the single best page, as required by the non-duplication rule.
   The RBCD and protocol-transition portions are already well covered. Two additions remain materially new: legacy pre-created machine-account credentials (including Kerberos-only validation) and full SPN-jacking (distinct from existing same-host /altservice substitution). I’m locating primary research for those techniques and will avoid duplicating the already-documented relay/RBCD chain.
   Plan update: source verification is complete. I will modify two existing pages only:

• README.md: the missing pre-created machine-account → gMSA authorization chain.

• constrained-delegation.md: ghost/live SPN-jacking and same-key service-class substitution.
  RBCD relay/setup is already present, so it will not be duplicated.
  Edits are implemented. I’m now reviewing the exact diff for technical accuracy, citation numbering, forbidden-source leakage, markdown structure, and repository cleanliness.
  A final provenance check found an authoritative Microsoft schema page for msDS-GroupMSAMembership. I’m adding it ahead of the reporting blog in the per-file reference order and tightening that paragraph’s attribution.
  Plan update: content and references are finalized. Remaining work is validation only: run whitespace/reference checks and an mdBook build if the local toolchain is available, then inspect the final status.
  Implemented HackTricks updates in two existing pages:

• src/windows-hardening/active-directory-methodology/README.md

  • Predictable pre-created computer-account passwords.
  • NetExec pre2k enumeration and Kerberos-specific validation.
  • Chaining compromised machine accounts into gMSA password retrieval.

• src/windows-hardening/active-directory-methodology/constrained-delegation.md

  • Ghost and live SPN-jacking.
  • BloodyAD and Impacket workflow.
  • Distinction from service-class substitution.
  • Event IDs 4742/4769 detection details.

Added numbered references to the original SPN-jacking research, NetExec source, Microsoft schema documentation, and the supplied blog.

Validation passed:

• git diff --check
• Citation/reference integrity
• Forbidden-source check

mdbook build was skipped because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/09/05/htb-pirate.html

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology, especially Resource-based Constrained Delegation, Constrained Delegation, and a new subsection for predictable pre-created computer-account passwords and SPN-jacking/service-class substitution; cross-reference gMSA credential theft".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0