NanoCorp - HTB Machine Writeup

Difficulty: Hard | OS: Windows | Status: Completed

dc01.nanocorp.htb is the Windows Domain Controller for Nanocorp — running Active Directory (LDAP/Kerberos), DNS, SMB and WinRM (HTTPS). Compromise chain: NTLM capture → cracked NANOCORP\web_svc → abused to obtain monitoring_svc Kerberos access → WinRM + Check_MK MSI repair exploit → SYSTEM (Administrator).

Tags: Active Directory, Kerberos / Service Account Abuse, Check_MK MSI Repair (CVE exploit)