Blackfield

Verified writeups for the Blackfield machine of Hack The Box

Blackfield

$ tldr AS-REP Roast → ForceChangePassword → SeBackupPrivilege → DCSync

·	·
Operating system	Windows
Difficulty	Hard
Vector	Active Directory
IP	10.10.10.192
Retirement date	2020-10-03
Skills	SMB Enumeration Kerberos User Enumeration (Kerbrute) ASRepRoast Attack (GetNPUsers) Bloodhound Enumeration Abusing ForceChangePassword Privilege (net rpc) Lsass Dump Analysis (Pypykatz) Abusing WinRM SeBackupPrivilege Exploitation DiskShadow Robocopy Usage NTDS Credentials Extraction (secretsdump) Active Directory

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Active Directory	HackTricks	Open
BloodHound	BloodHound docs	Open
GetNPUsers (Impacket)	HackTricks	Open
SMB (139/445)	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Kerberoasting · DCSync · Group Policy Preferences (GPP) · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Object — Windows, Hard
• Intelligence — Windows, Medium
• Search — Windows, Hard
• Mantis — Windows, Hard
• Cascade — Windows, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07