> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Helpline

> Verified writeups for the Helpline machine of Hack The Box

# Helpline

<p className="machine-summary"><span className="prompt"><code>\$ tldr</code></span> ManageEngine ServiceDesk RCE → Mimikatz + EFS decrypt → SYSTEM</p>

<div className="machine-meta">
  | ·                | ·                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Operating system | Windows                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
  | Difficulty       | Hard                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
  | Vector           | <span className="vbadge vbadge-windows-privesc">Windows privesc</span>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
  | IP               | `10.10.10.132`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
  | Retirement date  | 2019-08-17                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
  | Skills           | ManageEngine ServiceDesk Plus User Enumeration ManageEngine ServiceDesk Plus Authentication Bypassing ManageEngine ServiceDesk Plus Remote Code Execution Disabling Windows Defender (PowerShell) Mimikatz - Getting NTLM User Hashes (lsadump::sam) Reading Event Logs with Powershell (RamblingCookieMonster) \[Get-WinEventData] Decrypting EFS files with Mimikatz Getting the certificate with Mimikatz (crypto::system) Decrypting the masterkey with Mimikatz (dpapi::masterkey) Decrypting the private key with Mimikatz (dpapi::capi) Building a correct PFX with Openssl Installing the PFX via certutil Installing VNC in the box via msiexec Connecting to the VNC service using vncviewer Converting Secure String File to PlainText Using RunAs to execute commands as the administrator |
</div>

## Writeups

| Language | Author                   | Format | Link                                                             |
| -------- | ------------------------ | ------ | ---------------------------------------------------------------- |
| 🇪🇸 ES  | **S4vitar**              | Vídeo  | [Open](https://www.youtube.com/watch?v=EGlLewVI_M0)              |
| 🇪🇸 ES  | **El Pingüino de Mario** | Vídeo  | [Open](https://www.youtube.com/watch?v=CRSm_pocJj0)              |
| 🇬🇧 EN  | **0xdf**                 | Texto  | [Open](https://0xdf.gitlab.io/2019/08/17/htb-helpline-kali.html) |
| 🇬🇧 EN  | **0xdf**                 | Texto  | [Open](https://0xdf.gitlab.io/2019/08/17/htb-helpline-win.html)  |
| 🇬🇧 EN  | **0xdf**                 | Texto  | [Open](https://0xdf.gitlab.io/2019/08/17/htb-helpline.html)      |
| 🇬🇧 EN  | **IppSec**               | Vídeo  | [Open](https://www.youtube.com/watch?v=Vs3oSDlzxwA)              |

## Skill resources

Curated documentation for each technique listed in the *Skills* column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

| Skill                          | Source      | Link                                                                          |
| ------------------------------ | ----------- | ----------------------------------------------------------------------------- |
| Remote Code Execution (RCE)    | HackTricks  | [Open](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html) |
| Authentication Vulnerabilities | PortSwigger | [Open](https://portswigger.net/web-security/authentication)                   |

## Related skills worth mastering

Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

## If you liked this machine, try

* [Chaos](/en/htb/machines/linux/medio/chaos) — Linux, Medium
* [Epsilon](/en/htb/machines/linux/medio/epsilon) — Linux, Medium
* [Knife](/en/htb/machines/linux/facil/knife) — Linux, Easy
* [Shibboleth](/en/htb/machines/linux/medio/shibboleth) — Linux, Medium
* [SwagShop](/en/htb/machines/linux/facil/swagshop) — Linux, Easy

***

## Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).

<div className="rootea-giscus-wrap" data-giscus-term="machine:helpline" data-giscus-lang="en" />

*Last updated: 2026-07-27*

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"TechArticle","headline":"Helpline — HTB Writeup Index","name":"Helpline","url":"https://rootea.es/en/htb/machines/windows/dificil/helpline","inLanguage":"en","datePublished":"2019-08-17","dateModified":"2026-07-27","about":{"@type":"Thing","name":"Hack The Box (HTB)"},"keywords":"Remote Code Execution (RCE), Authentication Vulnerabilities","isPartOf":{"@type":"WebSite","name":"rootea.es","url":"https://rootea.es"},"author":{"@type":"Organization","name":"rootea.es"},"proficiencyLevel":"Difícil"}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://rootea.es/en"},{"@type":"ListItem","position":2,"name":"Windows","item":"https://rootea.es/en/htb/machines/windows/dificil/index"},{"@type":"ListItem","position":3,"name":"Hard","item":"https://rootea.es/en/htb/machines/windows/dificil/index"},{"@type":"ListItem","position":4,"name":"Helpline","item":"https://rootea.es/en/htb/machines/windows/dificil/helpline"}]}`}
</script>