Medium

Active machine — write-up published after retirement.

Overview Odori is a medium-difficulty Linux machine that blends Windows forensics with Linux privilege escalation. The foothold is not found on the live host at all - an anonymous Samba share points to a BitLocker-encrypted .vmdk disk image that has to be cracked offline, mounted, and mined for Windows secrets. Inside the image, DPAPI-protected credentials for the svc_backup service account are recovered through a chain of standard offline techniques (hive parsing, an offline Administrator password reset, and mimikatz DPAPI decryption). ...

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Overview Stack: Ubuntu 24, WordPress 7.0, SQLite. 1 2 3 4 5 6 7 8 9 10 11 12 13 reconnaissance v audio file discloses Jake's password (a restricted WP user) v hardcoded client-side AES-GCM key -> stored XSS in the admin panel v XSS creates an administrator account v admin -> Theme File Editor -> PHP webshell -> RCE (www-data) v wp-config.php -> walter's credentials -> SSH -> user.txt v local OCR service (PHP as root) -> write PHP -> RCE as root -> root.txt Reconnaissance 1 2 3 4 nmap -sV -p- 10.10.10.x --min-rate 5000 # open: 22/tcp (SSH), 443/tcp (HTTPS) wpscan --url https://makesense.htb --enumerate u,vp,vt --disable-tls-checks Key wpscan findings: ...

Overview Windows Server 2022 (build 10.0.20348). Stack: Apache XAMPP + PHP 8.1. Stage Technique Result Recon nmap: 22 (SSH), 80 (HTTP), 3389 (RDP) Windows, a video upload form Foothold .wax/.asx playlist leaks Net-NTLMv2 via Responder hash for MEDIA\enox Crack hashcat -m 5600 + rockyou enox:1234virus@ Access SSH (WinRM/5985 is closed) shell as enox Lateral NTFS junction from Uploads\<md5> to C:\xampp\htdocs write a webshell as Apache Shell webshell + reverse shell nt authority\local service PrivEsc FullPowers (recover SeImpersonate) then GodPotato nt authority\system Two official paths to SYSTEM: ...

Overview Voleur is a medium-difficulty Windows machine built around an Active Directory environment with NTLM authentication fully disabled. The challenge begins as an assumed breach, with low-privileged credentials for ryan.naylor provided as the starting point. The full attack chain covers: Kerberos setup and SMB enumeration leading to a password-protected Excel file whose cracked contents expose service account credentials; BloodHound-driven discovery of a WriteSPN misconfiguration enabling targeted Kerberoasting against svc_winrm; Active Directory Recycle Bin abuse to restore a deleted user; offline DPAPI credential decryption to recover a higher-privileged account; and finally, pivoting through a Windows Subsystem for Linux instance to extract backup copies of ntds.dit, SYSTEM, and SECURITY - yielding the Administrator NT hash and full domain compromise. ...

Overview Machine author: xct. Windows Server Domain Controller. Domain: cicada.vl. Host: DC-JPQ225. Kill chain: a password on a sticky note in an image from an open NFS share, Kerberos authentication (NTLM disabled), ADCS vulnerable to ESC8, a Kerberos relay (bypassing the self-relay block) plus PetitPotam coercion, a certificate as the DC machine account, DCSync, the Administrator hash, a shell. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [NFS 2049] share /profiles (everyone) | exfil vacation.png + marketing.png v [OSINT/image] password on a sticky note: Rosie.Powell : Cicada123 | auth ONLY via Kerberos (NTLM disabled) v [ADCS] certipy find -> CA vulnerable to ESC8 (Web Enrollment over HTTP) | NTLM self-relay blocked + NTLM disabled -> need a Kerberos relay v [DNS + coercion] bloodyAD: a DNS record with a serialized empty CREDENTIAL_TARGET_INFORMATION | PetitPotam forces the DC to auth to us v [certipy relay] Kerberos relay -> /certsrv/certfnsh.asp -> cert for DC-JPQ225$ v [certipy auth] PKINIT -> TGT + machine-account NT hash v [secretsdump] DCSync -> Administrator hash v [wmiexec] shell as cicada\administrator -> user.txt + root.txt The key lesson: how to perform ESC8 in an environment where NTLM is fully disabled, so the classic NTLM relay does not work. The solution is a Kerberos relay using a crafted DNS record containing a serialized (empty) CREDENTIAL_TARGET_INFORMATION structure, which bypasses the self-relay restriction. ...

Overview Windows Server Domain Controller. Domain: tombwatcher.htb. DC: DC01.tombwatcher.htb (10.10.10.x). A chain of AD ACL/ACE abuses ending in ADCS ESC15 (CVE-2024-49019). 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 henry (starting credentials) | WriteSPN v alfred -- targeted Kerberoast -> hashcat -> password "basketball" | AddSelf v INFRASTRUCTURE -- group with ReadGMSAPassword | ReadGMSAPassword v ansible_dev$ -- gMSA, read msDS-ManagedPassword -> NTLM hash | ForceChangePassword v sam -- password reset | WriteOwner -> set owner -> add GenericAll -> reset password v john -- member of Remote Management Users -> WinRM -> user flag | GenericAll over OU=ADCS v === ADCS / ESC15 === 1. Certipy find -> the WebServer template has an orphaned SID in Enrollment Rights 2. AD Recycle Bin -> 3x cert_admin; SID ...-1111 = GUID 938182c3... 3. Restore-ADObject -> cert_admin returns to OU=ADCS and regains the template right 4. dacledit (inheritance) -> john gets FullControl over cert_admin -> password reset 5. ESC15: request with an injected "Enrollment Agent" Application Policy 6. request on-behalf-of Administrator -> administrator.pfx 7. certipy auth -> Administrator NT hash -> PtH -> root flag Each step is one ACE/permission in AD that lets you take over the next object. The final stage combines AD Recycle Bin with an ADCS misconfiguration. ...

Overview Authority is a medium-difficulty Windows machine built around a chain of classic Active Directory misconfigurations. It starts with an anonymously readable SMB share containing Ansible automation, moves through cracking an Ansible Vault to unlock a PWM (password self-service) admin panel, abuses the panel’s “Test LDAP Profile” feature to capture cleartext service-account credentials, and finishes by exploiting a vulnerable AD CS certificate template (ESC1). Because the DC does not support PKINIT, the certificate is used over Schannel (Pass-the-Cert) to authenticate as Administrator and take over the domain. ...