NanoCorp is a Windows Active Directory machine built around a careers portal that accepts uploaded application archives. I’ll craft a malicious archive that leaks a service account’s authentication to my host when an automated job extracts it, and crack the result to get a foothold. With BloodHound, I’ll map a permissions chain that lets me add my user to a support group and then reset a second service account’s password. That account sits in the Protected Users group, so I’ll authenticate over Kerberos to get a shell. From there, I’ll find the Checkmk monitoring agent installed and abuse CVE-2024-0670 to drop write-protected files into a temp directory that the agent runs as SYSTEM, taking full control of the host. In Beyond Root, I’ll dig into the scheduled automations that keep the box in its intended state.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox 'NanoCorp' Windows Active Directory machine. The attack chain starts by exploiting CVE-2025-24071 — crafting a malicious .library-ms file inside a ZIP archive uploaded to a careers portal — to capture a service account's Net-NTLMv2 hash via Responder and crack it with hashcat. BloodHound reveals a permissions chain: web_svc can add members to IT_Support, which can ForceChangePassword on monitoring_svc. Since monitoring_svc is in Protected Users, Kerberos authentication is required to get a WinRM shell. Privilege escalation to SYSTEM abuses CVE-2024-0670 in the Checkmk monitoring agent, which runs as SYSTEM and allows dropping write-protected files into its temp directory.

HTB: NanoCorp