Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Machine
NanoCorp
OS
Windows
Difficulty
Hard
Steps
4
Added
8 Nov 2025

An SCF file in a resume upload leaks a service hash; an AddSelf/ForceChangePassword ACL chain reaches WinRM, and a CheckMK agent LPE (CVE-2024-0670) gives SYSTEM.

0Reconnmap1FootholdSCF hash leak2LateralACL abuse3Pivotmonitoring_svc4Priv escCheckMK LPE
1Recon2Foothold3Lateral4Pivot5Priv escnmap1SCF hash leak2ACL abuse3monitoring_svc4CheckMK LPE5

How it went

  1. 0
    nmap

    nmap shows a domain controller also running Apache/PHP with a hiring subdomain.

  2. 1
    SCF hash leak

    A resume ZIP holding a .scf file is browsed by a service account, leaking web_svc's NTLMv2 hash to Responder, which cracks from rockyou.

  3. 2
    ACL abuse

    BloodHound shows web_svc can AddSelf to IT_SUPPORT and ForceChangePassword monitoring_svc; resetting it with Internal4New keeps AES keys for its Protected Users membership.

  4. 3
    monitoring_svc

    A Kerberos TGT gives monitoring_svc a WinRM (HTTPS) PowerShell session and the user flag.

  5. 4
    CheckMK LPE

    The CheckMK agent runs as SYSTEM; pre-seeding read-only cmk_all_*.cmd and triggering an MSI repair via RunasCs (CVE-2024-0670) runs a payload as SYSTEM.