Summary: This box was a Windows domain controller that had some relaxed permissions on SMB shares that allowed me to obtain my initial foothold on the machine.  After gaining access I enumerated the system and found a user with elevated privileges who also inadvertently left their password in plain text in a transcript file.  Once … Continue reading HTB – Resolute

This box had an interesting way of obtaining initial access by backing up the Redis config to a file.  I was able to exploit this and upload/backup an ssh key I generated and add it to the "authorized_keys" on the target box.  At that point user level access was obtained and the path to root was a simple exploit because the "Webmin" service was running as root.