Hello everyone, I would like to ask: why can use RBCD to get administrator permissions, I know that RBCD can get the domain machine permissions that are added by the same domain user, but we do not know who is added to the domain, and there is no account to join the domain.
I know, the original machine itself is the domain control, and lorra199 users have the permission to modify the domain control attributes, so that you can use RBCD to obtain administrator permissions.
This explains it pretty perfectly.
2 Likes
Thank you
Did you manage to get it? Still stuck on it, neither with nc.exe or powershell I get some reverse connection
Holy glory this machine was amazing but so frustrating at times! 100% one of the best I’ve done on HTB and an such many new things to learn. There are a few parts that will make you pull out your hair but the end result is worth it.
If anyone needs help, my DMs are open.
hard box but I learn some forensics to avoid having to spin a windows VM.
you use use:
- Command Reference · volatilityfoundation/volatility Wiki · GitHub
or also you can use and this got me better results: - GitHub - ufrisk/MemProcFS: MemProcFS
Happy Hacking!!!