search

Certified Write-up - HTB

As is common in Windows pentests, you will start the Certified box with credentials for the following account: Username: judith.mader Password: judith09

hashtag
Recon

Starting off with an nmap syn scan over all ports:

sudo nmap -sS -Pn -n -p- 10.10.11.41 -oN all_syn.txt

#Output:

PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown
49668/tcp open  unknown
49673/tcp open  unknown
49674/tcp open  unknown
49683/tcp open  unknown
49716/tcp open  unknown
49739/tcp open  unknown
55012/tcp open  unknown

Using these ports to run over a vulnerability scan.

hashtag
Enumeration

This looks to be a DC. Available ports for enumeration are LDAP, SMB.

I tried few ways, LDAP enumeration shows heavy AD CS. So we will use certipy:

This looks to be vulnerable:

Our user is not from the operator ca group:

hashtag
Foothold

We are not in the group. Let's Kerberoast management_svc because ldap shows it is kerberoastable:

Let's sync our clocks:

Setting the clock to match it:

Let's run impacket again:

Uncrackable.

I tried various ways, but everything fails. Weird.

Bloodhound says we have WriteOwner Permissions over management@certified.htb:

I am trying to get this.

So, let's add name ourselves the new owner of the group:

Let's now add a new ACE that will give us WriteMembers over Management:

Let's now add ourselves in the group:

Verifying via LDAP query:

After few minutes/hours, I realized the path does not want us to change management_svc password, but maybe do a shadow credentials attack.

Sweeeeet!!! We got the pfx!

Let's get the damn TGT now!

Getting the NT Hash for management_svc:

hashtag
PrivEsc

Change ca_operator password:

Let's get a pfx:

I checked the templates again as operator ca:

Ran ESC9 PrivEsc attack:

Setting the UPN of ca_operator to Administrator so that we can retrieve Administrator .pkx:

Requesting .pfx:

Setting back ca_operator UPN to it:

Authentincating:

PreviousAdministrator Write-up - HTBNextJab Write-Up - HTB

Last updated