Windows

Active machine — write-up published after retirement.

Overview Pirate is a Windows Active Directory box built around delegation abuse. The domain controller, DC01, doubles as a Hyper-V host: a second web server, WEB01, runs as a guest VM on an internal virtual switch (192.168.100.0/24) that is not directly reachable from the VPN. The only externally reachable host is DC01 itself. The captured chain starts with two Group Managed Service Account NTLM hashes (gMSA_ADCS_prod$ and gMSA_ADFS_prod$). Because gMSA managed-password blobs are stored in LDAP and readable by authorized principals, their NTLM hashes can be derived without ever cracking a password, and both accounts are allowed to log in over WinRM. That gives a foothold on DC01, from which a chisel reverse SOCKS tunnel opens the internal 192.168.100.0/24 segment and WEB01. ...

Overview Windows Server 2022 (build 10.0.20348). Stack: Apache XAMPP + PHP 8.1. Stage Technique Result Recon nmap: 22 (SSH), 80 (HTTP), 3389 (RDP) Windows, a video upload form Foothold .wax/.asx playlist leaks Net-NTLMv2 via Responder hash for MEDIA\enox Crack hashcat -m 5600 + rockyou enox:1234virus@ Access SSH (WinRM/5985 is closed) shell as enox Lateral NTFS junction from Uploads\<md5> to C:\xampp\htdocs write a webshell as Apache Shell webshell + reverse shell nt authority\local service PrivEsc FullPowers (recover SeImpersonate) then GodPotato nt authority\system Two official paths to SYSTEM: ...

Overview Redelegate is a Windows Active Directory Domain Controller that layers a chain of small misconfigurations into a full domain compromise. The box exposes anonymous FTP alongside the usual DC services and a Microsoft SQL Server instance. The FTP share leaks a shared KeePass database and a couple of “audit” documents, one of which conveniently hints at the exact weak password pattern in use on the domain (SeasonYear!). That hint cracks the KeePass passphrase, which in turn yields a set of stored credentials. ...

Overview Voleur is a medium-difficulty Windows machine built around an Active Directory environment with NTLM authentication fully disabled. The challenge begins as an assumed breach, with low-privileged credentials for ryan.naylor provided as the starting point. The full attack chain covers: Kerberos setup and SMB enumeration leading to a password-protected Excel file whose cracked contents expose service account credentials; BloodHound-driven discovery of a WriteSPN misconfiguration enabling targeted Kerberoasting against svc_winrm; Active Directory Recycle Bin abuse to restore a deleted user; offline DPAPI credential decryption to recover a higher-privileged account; and finally, pivoting through a Windows Subsystem for Linux instance to extract backup copies of ntds.dit, SYSTEM, and SECURITY - yielding the Administrator NT hash and full domain compromise. ...

Overview Machine author: xct. Windows Server Domain Controller. Domain: cicada.vl. Host: DC-JPQ225. Kill chain: a password on a sticky note in an image from an open NFS share, Kerberos authentication (NTLM disabled), ADCS vulnerable to ESC8, a Kerberos relay (bypassing the self-relay block) plus PetitPotam coercion, a certificate as the DC machine account, DCSync, the Administrator hash, a shell. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [NFS 2049] share /profiles (everyone) | exfil vacation.png + marketing.png v [OSINT/image] password on a sticky note: Rosie.Powell : Cicada123 | auth ONLY via Kerberos (NTLM disabled) v [ADCS] certipy find -> CA vulnerable to ESC8 (Web Enrollment over HTTP) | NTLM self-relay blocked + NTLM disabled -> need a Kerberos relay v [DNS + coercion] bloodyAD: a DNS record with a serialized empty CREDENTIAL_TARGET_INFORMATION | PetitPotam forces the DC to auth to us v [certipy relay] Kerberos relay -> /certsrv/certfnsh.asp -> cert for DC-JPQ225$ v [certipy auth] PKINIT -> TGT + machine-account NT hash v [secretsdump] DCSync -> Administrator hash v [wmiexec] shell as cicada\administrator -> user.txt + root.txt The key lesson: how to perform ESC8 in an environment where NTLM is fully disabled, so the classic NTLM relay does not work. The solution is a Kerberos relay using a crafted DNS record containing a serialized (empty) CREDENTIAL_TARGET_INFORMATION structure, which bypasses the self-relay restriction. ...

Overview Windows Server Domain Controller. Domain: tombwatcher.htb. DC: DC01.tombwatcher.htb (10.10.10.x). A chain of AD ACL/ACE abuses ending in ADCS ESC15 (CVE-2024-49019). 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 henry (starting credentials) | WriteSPN v alfred -- targeted Kerberoast -> hashcat -> password "basketball" | AddSelf v INFRASTRUCTURE -- group with ReadGMSAPassword | ReadGMSAPassword v ansible_dev$ -- gMSA, read msDS-ManagedPassword -> NTLM hash | ForceChangePassword v sam -- password reset | WriteOwner -> set owner -> add GenericAll -> reset password v john -- member of Remote Management Users -> WinRM -> user flag | GenericAll over OU=ADCS v === ADCS / ESC15 === 1. Certipy find -> the WebServer template has an orphaned SID in Enrollment Rights 2. AD Recycle Bin -> 3x cert_admin; SID ...-1111 = GUID 938182c3... 3. Restore-ADObject -> cert_admin returns to OU=ADCS and regains the template right 4. dacledit (inheritance) -> john gets FullControl over cert_admin -> password reset 5. ESC15: request with an injected "Enrollment Agent" Application Policy 6. request on-behalf-of Administrator -> administrator.pfx 7. certipy auth -> Administrator NT hash -> PtH -> root flag Each step is one ACE/permission in AD that lets you take over the next object. The final stage combines AD Recycle Bin with an ADCS misconfiguration. ...

Overview Ghost is an Insane Windows machine built around an Active Directory forest with a sizable Linux web stack bolted onto the front. The initial surface is entirely web: a Ghost CMS blog, an internal Next.js intranet, and an ADFS-fronted “Ghost Core” application. The intranet authenticates against LDAP without sanitizing input, which gives both a login bypass and a blind character-by-character brute force of account secrets. That recovers Gitea credentials, and the Gitea source code exposes a modified Ghost CMS endpoint vulnerable to arbitrary file read and a Rust intranet API vulnerable to command injection. ...

Overview Authority is a medium-difficulty Windows machine built around a chain of classic Active Directory misconfigurations. It starts with an anonymously readable SMB share containing Ansible automation, moves through cracking an Ansible Vault to unlock a PWM (password self-service) admin panel, abuses the panel’s “Test LDAP Profile” feature to capture cleartext service-account credentials, and finishes by exploiting a vulnerable AD CS certificate template (ESC1). Because the DC does not support PKINIT, the certificate is used over Schannel (Pass-the-Cert) to authenticate as Administrator and take over the domain. ...

Overview StreamIO is a Windows Active Directory box (domain streamIO.htb, hostname DC) running IIS + PHP with MSSQL as the backend database. The foothold chains a UNION-based SQL injection on a streaming subdomain into credential recovery, a hidden debug parameter that exposes a local file include, and finally a remote file include that reaches a raw eval() for code execution. From there the path is pure credential reuse and Active Directory ACL abuse: database credentials pulled from the web root unlock a backup database with fresh hashes, saved Firefox logins hand over a domain user, and a WriteOwner/Owns edge over a group with ReadLAPSPassword lets us read the LAPS-managed local administrator password and log in as administrator. ...