Intelligence

Verified writeups for the Intelligence machine of Hack The Box

Intelligence

$ tldr ADIDNS DNS record → Responder NetNTLMv2 → gMSA + delegation → DA

·	·
Operating system	Windows
Difficulty	Medium
Vector	Active Directory
IP	10.10.10.248
Retirement date	2021-11-27
Skills	Information Leakage Kerberos Enumeration (Kerbrute) Creating a DNS Record (dnstool.py) [Abusing ADIDNS] Intercepting Net-NTLMv2 Hashes with Responder BloodHound Enumeration Abusing ReadGMSAPassword Rights (gMSADumper) Pywerview Usage Abusing Unconstrained Delegation Abusing AllowedToDelegate Rights (getST.py) (User Impersonation) Using .ccache file with wmiexec.py (KRB5CCNAME) Active Directory

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
Active Directory	HackTricks	Open
BloodHound	BloodHound docs	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Kerberoasting · DCSync · AS-REP Roasting · Group Policy Preferences (GPP) · GetNPUsers (Impacket) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Object — Windows, Hard
• Reel — Windows, Hard
• Blackfield — Windows, Hard
• Curling — Windows, Easy
• Mantis — Windows, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07