Gmsa

Overview Pirate is a Windows Active Directory box built around delegation abuse. The domain controller, DC01, doubles as a Hyper-V host: a second web server, WEB01, runs as a guest VM on an internal virtual switch (192.168.100.0/24) that is not directly reachable from the VPN. The only externally reachable host is DC01 itself. The captured chain starts with two Group Managed Service Account NTLM hashes (gMSA_ADCS_prod$ and gMSA_ADFS_prod$). Because gMSA managed-password blobs are stored in LDAP and readable by authorized principals, their NTLM hashes can be derived without ever cracking a password, and both accounts are allowed to log in over WinRM. That gives a foothold on DC01, from which a chisel reverse SOCKS tunnel opens the internal 192.168.100.0/24 segment and WEB01. ...

Overview Windows Server Domain Controller. Domain: tombwatcher.htb. DC: DC01.tombwatcher.htb (10.10.10.x). A chain of AD ACL/ACE abuses ending in ADCS ESC15 (CVE-2024-49019). 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 henry (starting credentials) | WriteSPN v alfred -- targeted Kerberoast -> hashcat -> password "basketball" | AddSelf v INFRASTRUCTURE -- group with ReadGMSAPassword | ReadGMSAPassword v ansible_dev$ -- gMSA, read msDS-ManagedPassword -> NTLM hash | ForceChangePassword v sam -- password reset | WriteOwner -> set owner -> add GenericAll -> reset password v john -- member of Remote Management Users -> WinRM -> user flag | GenericAll over OU=ADCS v === ADCS / ESC15 === 1. Certipy find -> the WebServer template has an orphaned SID in Enrollment Rights 2. AD Recycle Bin -> 3x cert_admin; SID ...-1111 = GUID 938182c3... 3. Restore-ADObject -> cert_admin returns to OU=ADCS and regains the template right 4. dacledit (inheritance) -> john gets FullControl over cert_admin -> password reset 5. ESC15: request with an injected "Enrollment Agent" Application Policy 6. request on-behalf-of Administrator -> administrator.pfx 7. certipy auth -> Administrator NT hash -> PtH -> root flag Each step is one ACE/permission in AD that lets you take over the next object. The final stage combines AD Recycle Bin with an ADCS misconfiguration. ...

Overview Ghost is an Insane Windows machine built around an Active Directory forest with a sizable Linux web stack bolted onto the front. The initial surface is entirely web: a Ghost CMS blog, an internal Next.js intranet, and an ADFS-fronted “Ghost Core” application. The intranet authenticates against LDAP without sanitizing input, which gives both a login bypass and a blind character-by-character brute force of account secrets. That recovers Gitea credentials, and the Gitea source code exposes a modified Ghost CMS endpoint vulnerable to arbitrary file read and a Rust intranet API vulnerable to command injection. ...