Scrambled

Verified writeups for the Scrambled machine of Hack The Box

Scrambled

$ tldr Kerberoasting → SMB Kerberos auth → AD privesc

·	·
Operating system	Windows
Difficulty	Medium
Vector	Active Directory
IP	10.10.11.168
Retirement date	2022-10-01
Skills	Web Enumeration Information Leakage Ldap Enumeration Kerberos Enumeration User Enumeration - Kerbrute Password Brute Force - Kerbrute SMB Enumeration - Kerberos Authentication [getTGT.py] ASREPRoast Attack - GetNPUsers.py (Failed) Kerberoasting Attack - GetUserSPNs.py Manipulating the GetUserSPNs.py script to make it work the way we want it to work Cracking Hashes Attempting to authenticate to the MSSQL service via kerberos (Failed) Explaining Kerberos Auth Flow (TGT, TGS, KDC, AS-REQ, AS-REP, TGS-REQ, TGS-REP, AP-REQ, AP-REP) Explaining how Silver Ticket Attack works Forging a new TGS as Administrator user (NTLM Hash, Domain SID and SPN) [ticketer.py && getPAC.py] Connecting to the MSSQL service with the newly created ticket MSSQL Enumeration Enabling xp_cmdshell component in MSSQL [RCE] Abusing SeImpersonatePrivilege [JuicyPotatoNG Alternative for Windows Server 2019] (Unintended Way) Binary and DLL Analysis Downloading OpenVPN from a Windows machine and configuring it to reverse downloaded resources Dnspy Installation DLL Inspection with Dnspy - Found a backdoor in the code We realize that serialization and deserialization of data is being used Creating a malicious base64 serialized Payload with ysoserial.net in order to get RCE We send the serialized data to the server [Privilege Escalation]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
Cracking Hashes (hashcat / John)	HackTricks	Open
Insecure Deserialization	PortSwigger	Open
Kerberoasting	HackTricks	Open
GetNPUsers (Impacket)	HackTricks	Open
SMB (139/445)	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Active Directory · DCSync · BloodHound · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Jewel — Linux, Medium
• Anubis — Windows, Insane
• StreamIO — Windows, Medium
• Blackfield — Windows, Hard
• Search — Windows, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07