> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Scrambled

> Writeups verificados de la máquina Scrambled de Hack The Box

# Scrambled

<p className="machine-summary"><span className="prompt"><code>\$ tldr</code></span> Kerberoasting → SMB Kerberos auth → AD privesc</p>

<div className="machine-meta">
  | ·                 | ·                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
  | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Sistema operativo | Windows                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
  | Dificultad        | Medio                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
  | Vector            | <span className="vbadge vbadge-ad">Active Directory</span>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
  | IP                | `10.10.11.168`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
  | Fecha de retirada | 2022-10-01                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
  | Skills            | Web Enumeration Information Leakage Ldap Enumeration Kerberos Enumeration User Enumeration - Kerbrute Password Brute Force - Kerbrute SMB Enumeration - Kerberos Authentication \[getTGT.py] ASREPRoast Attack - GetNPUsers.py (Failed) Kerberoasting Attack - GetUserSPNs.py Manipulating the GetUserSPNs.py script to make it work the way we want it to work Cracking Hashes Attempting to authenticate to the MSSQL service via kerberos (Failed) Explaining Kerberos Auth Flow (TGT, TGS, KDC, AS-REQ, AS-REP, TGS-REQ, TGS-REP, AP-REQ, AP-REP) Explaining how Silver Ticket Attack works Forging a new TGS as Administrator user (NTLM Hash, Domain SID and SPN) \[ticketer.py && getPAC.py] Connecting to the MSSQL service with the newly created ticket MSSQL Enumeration Enabling xp\_cmdshell component in MSSQL \[RCE] Abusing SeImpersonatePrivilege \[JuicyPotatoNG Alternative for Windows Server 2019] (Unintended Way) Binary and DLL Analysis Downloading OpenVPN from a Windows machine and configuring it to reverse downloaded resources Dnspy Installation DLL Inspection with Dnspy - Found a backdoor in the code We realize that serialization and deserialization of data is being used Creating a malicious base64 serialized Payload with ysoserial.net in order to get RCE We send the serialized data to the server \[Privilege Escalation] |
</div>

## Writeups

| Idioma  | Autor                    | Formato | Enlace                                                                    |
| ------- | ------------------------ | ------- | ------------------------------------------------------------------------- |
| 🇪🇸 ES | **S4vitar**              | Vídeo   | [Abrir](https://www.youtube.com/watch?v=osmFGqnFe8c)                      |
| 🇪🇸 ES | **El Pingüino de Mario** | Vídeo   | [Abrir](https://www.youtube.com/watch?v=rxm2bmILNoY)                      |
| 🇬🇧 EN | **0xdf**                 | Texto   | [Abrir](https://0xdf.gitlab.io/2022/10/01/htb-scrambled-beyond-root.html) |
| 🇬🇧 EN | **0xdf**                 | Texto   | [Abrir](https://0xdf.gitlab.io/2022/10/01/htb-scrambled-linux.html)       |
| 🇬🇧 EN | **0xdf**                 | Texto   | [Abrir](https://0xdf.gitlab.io/2022/10/01/htb-scrambled-win.html)         |
| 🇬🇧 EN | **0xdf**                 | Texto   | [Abrir](https://0xdf.gitlab.io/2022/10/01/htb-scrambled.html)             |
| 🇬🇧 EN | **IppSec**               | Vídeo   | [Abrir](https://www.youtube.com/watch?v=_8FE3JZIPfo)                      |

## Recursos por skill

Documentación curada para cada técnica que aparece en la columna *Skills* de arriba. Fuentes: HackTricks, GTFOBins, PortSwigger, etc.

| Skill                            | Fuente      | Enlace                                                                                                  |
| -------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------- |
| Information Leakage              | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/information-leak.html)                           |
| Cracking Hashes (hashcat / John) | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/brute-force.html)           |
| Insecure Deserialization         | PortSwigger | [Abrir](https://portswigger.net/web-security/deserialization)                                           |
| Kerberoasting                    | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/kerberoast.html) |
| GetNPUsers (Impacket)            | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/asreproast.html) |
| SMB (139/445)                    | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html)          |
| Remote Code Execution (RCE)      | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html)                          |

## Skills relacionadas que conviene dominar

Active Directory · DCSync · BloodHound · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

## Si te gustó esta máquina, prueba

* [Jewel](/htb/machines/linux/medio/jewel) — Linux, Medio
* [Anubis](/htb/machines/windows/insano/anubis) — Windows, Insano
* [StreamIO](/htb/machines/windows/medio/streamio) — Windows, Medio
* [Blackfield](/htb/machines/windows/dificil/blackfield) — Windows, Difícil
* [Search](/htb/machines/windows/dificil/search) — Windows, Difícil

***

## Comentarios y truquillos

¿Algo no funcionó del writeup oficial? ¿Has encontrado un truco mejor? Compártelo aquí — los comentarios viven en [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).

<div className="rootea-giscus-wrap" data-giscus-term="machine:scrambled" data-giscus-lang="es" />

*Última actualización: 2026-06-07*

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"TechArticle","headline":"Scrambled — HTB Writeup Index","name":"Scrambled","url":"https://rootea.es/htb/machines/windows/medio/scrambled","inLanguage":"es","datePublished":"2022-10-01","dateModified":"2026-06-07","about":{"@type":"Thing","name":"Hack The Box (HTB)"},"keywords":"Information Leakage, Cracking Hashes (hashcat / John), Insecure Deserialization, Kerberoasting, GetNPUsers (Impacket), SMB (139/445), Remote Code Execution (RCE)","isPartOf":{"@type":"WebSite","name":"rootea.es","url":"https://rootea.es"},"author":{"@type":"Organization","name":"rootea.es"},"proficiencyLevel":"Medio"}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Inicio","item":"https://rootea.es"},{"@type":"ListItem","position":2,"name":"Windows","item":"https://rootea.es/htb/machines/windows/medio/index"},{"@type":"ListItem","position":3,"name":"Medio","item":"https://rootea.es/htb/machines/windows/medio/index"},{"@type":"ListItem","position":4,"name":"Scrambled","item":"https://rootea.es/htb/machines/windows/medio/scrambled"}]}`}
</script>