Blog

Fluffy

Quickie

User

We are provided access to the user j.fleischman:J0elTHEM4n1990!.

Using netexec, we can quickly scan for share access to see where the user can read/write to.

netexec smb 10.10.11.69 -u j.fleischman -p  J0elTHEM4n1990!  --shares
SMB         10.10.11.69     445    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.69     445    DC01             [+] fluffy.htb\j.fleischman:J0elTHEM4n1990! 
SMB         10.10.11.69     445    DC01             [*] Enumerated shares
SMB         10.10.11.69     445    DC01             Share           Permissions     Remark
SMB         10.10.11.69     445    DC01             -----           -----------     ------
SMB         10.10.11.69     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.69     445    DC01             C$                              Default share
SMB         10.10.11.69     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.69     445    DC01             IT              READ,WRITE      
SMB         10.10.11.69     445    DC01             NETLOGON        READ            Logon server share 
SMB         10.10.11.69     445    DC01             SYSVOL          READ            Logon server share

We can easily see that IT share looks suspicious - let's use impacket-smbclient to check it out.

impacket-smbclient j.fleischman@10.10.11.69 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Password:
Type help for list of commands
# ls
[-] No share selected
# use it
# ls
drw-rw-rw-          0  Wed Jun  4 05:55:26 2025 .
drw-rw-rw-          0  Wed Jun  4 05:55:26 2025 ..
drw-rw-rw-          0  Fri May 16 22:51:49 2025 Everything-1.4.1.1026.x64
-rw-rw-rw-    1827464  Fri May 16 22:51:49 2025 Everything-1.4.1.1026.x64.zip
drw-rw-rw-          0  Fri May 16 22:51:49 2025 KeePass-2.58
-rw-rw-rw-    3225346  Fri May 16 22:51:49 2025 KeePass-2.58.zip
-rw-rw-rw-     169963  Sat May 17 22:31:07 2025 Upgrade_Notice.pdf

Upgrade_notice.pdf suggest to use a particular cve - cloning it and using Responder gives us a callback!.

Cracking it gives us access to the user p.agila:prometheusx-303.

As always, use bloodhound to map out possible AD attack vectors.

Looks simple enough

GenericAll lets us basically do anything to the group Service Accounts - we can add the newly obtained p.agila to it with net rpc

GenericWrite lets us do either a targeted kerberoasting attack or shadow credentials attack (requires ADCS). Let's opt for shadow credentials as there is the presence of ca_svc here which suggest the use of ADCS.

Root

winrm_svc has GenericWrite writes to the users ldap_svc and ca_svcwhich means we can perform the shadow credentials attack again to retrieve their respective NThash.

ca_svc is part of the Cert Publisher Group which when queried with certipy, is vulnerable to ESC16

Looking at the documentation, we will go with scenario A as we fufill the criteria from the previous owned users.

Attacker (winrm_svc@fluffy.htb) has GenericWrite permission over a "victim" account (ca_svc@fluffy.htb). The victim account can enroll in any suitable client authentication template (e.g., the default "User" template) on the ESC16-vulnerable CA. The target for impersonation is administrator@fluffy.htb.

First, we need to set the upn of our victim account ca_svc to administrator@fluffy.htb

Next, we need to request for the certificate with the associated spn using the victim account ca_svc, specifying a template such as User

Lastly, we need to revert the upn before authenticating as Administrator

PreviousCelestialNextMirage

Last updated