Firstly thanks to @VbScrub for this beautiful machine. Secondly thanks to @TazWake for that initial nudge for user3.
Rooted.
I will give two important points which will help to root the box.
- use breakpoints for exe and dlls.
- Sometimes you don’t need to recover just get the information from AD.
HTB complaining root flag to be incorrect. @VbScrub will reset set a new flag for root?
Finally reset worked to get the new flag.
PM for any help !!