---
title: "HTB: NanoCorp"
url: https://daily.dev/posts/htb-nanocorp-qn0fcbqsp
source_url: https://0xdf.gitlab.io/2026/06/20/htb-nanocorp.html
type: article
source: "0xdf hacks stuff"
published: 2026-06-20T15:07:31.482Z
updated: 2026-06-20T15:17:52.158Z
tags: ["security", "windows", "active-directory"]
reading_time: 49
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HTB: NanoCorp

**[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 49 min read · 0 upvotes · 0 comments

## Summary

A detailed walkthrough of the HackTheBox 'NanoCorp' Windows Active Directory machine. The attack chain starts by exploiting CVE-2025-24071 — crafting a malicious .library-ms file inside a ZIP archive uploaded to a careers portal — to capture a service account's Net-NTLMv2 hash via Responder and crack it with hashcat. BloodHound reveals a permissions chain: web_svc can add members to IT_Support, which can ForceChangePassword on monitoring_svc. Since monitoring_svc is in Protected Users, Kerberos authentication is required to get a WinRM shell. Privilege escalation to SYSTEM abuses CVE-2024-0670 in the Checkmk monitoring agent, which runs as SYSTEM and allows dropping write-protected files into its temp directory.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://0xdf.gitlab.io/2026/06/20/htb-nanocorp.html>

## Similar posts on daily.dev

- [HTB: DarkCorp](https://daily.dev/posts/htb-darkcorp-26vq8n3fx) · 0xdf hacks stuff · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#active-directory](https://daily.dev/tags/active-directory)

[View this post on daily.dev](https://daily.dev/posts/htb-nanocorp-qn0fcbqsp)