LinkedInHTB ProfileAbout

HTB - Fluffy

Description

This machine follows an assumed breach scenario, starting with a user who has Read/Write access to an SMB share. Leveraging a recent Windows vulnerability, the attacker uploads a crafted .zip file containing a .library-ms file pointing to a malicious address. When any user extracts the archive, the system initiates an NTLMv2 authentication attempt to the attacker-controlled listener. Capturing the hash via smbserver or responder, the attacker cracks it to obtain credentials for another domain user. This user has GenericAll over a group, and the group has GenericWrite over three domain users, allowing takeover through a shadow credentials attack. One compromised user has WinRM access to the target system, and another is a member of the Cert Publishers group. By enumerating certificate templates, the attacker identifies and exploits an ESC16 misconfiguration to escalate privileges and obtain Domain Admin access.

Enumeration

As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account: j.fleischman / J0elTHEM4n1990!

Nmap Scan

I will start with normal Nmap scan, but first export the machine IP, Username, Password, and domain to variables for easy usage.

Nmap Scan

Then, put open ports into ports variable and run Nmap script and version scan

Summary

I always update /etc/hosts before I attack the domain to avoid any tooling issues.

I started by enumerating SMB, looking for accessible shares, and I found that I had READ/WRITE permission on IT share

I connected to the share and found a weird thing. There are archive files, and the corresponding archived data were extracted in the same place.

There was also .pdf file which I downloaded and opened locally:

The PDF showed that several vulnerabilities affect the Windows system and need urgent updates to patch these vulnerabilities.

On the same PDF, there is a table with CVE ID and severity of the vulnerabilities

Foothold

CVE-2025-24071 is a recent windows vulnerability that allows stealing hashes using after unzipping archive files inside windows environment.

Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a.rararchive, leading to NTLM hash disclosure. The user does not need to open or execute the file—simply extracting it is enough to trigger the leak.

LogoGitHub - 0x6rss/CVE-2025-24071_PoC: CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms FileGitHub

I cloned the repo, ran the exploit, and uploaded the exploit file (.zip).

On another terminal, I opened smbserver to receive the NTLMV2 authentication

The hash was cracked successfully

With p.agila cred or j.fleischman, I could collect LDAP data with bloodhound.py

Lateral movement

  • BloodHound showed the escalation path from p.agila to 3 domain users:

    1. ca_svc is a member of Cert Publishers

    2. ldap_svc

    3. winrm_svc can winRM to the box

  • With GenericAll on Service Accounts, I can add any user to that group, inheriting its privileges

  • With GenericWrite, I could perform the following attacks:

    1. targetedkerberoast (Assign SPN to a user and obtain a hash to crack it offline)

    2. Shadow Credential (Add Key Credentials for a user)

I prefer to perform Shadow Credential attack because it follows OPSEC consideration

Add myself to Service Accounts group

Add shadow cred for winrm_svc

User flag: 2eb60ea1cc7b27axxxxxxxxxxxxxxx

Privilege Escalation

There was another account in Cert Publishers group and BloodHound described its privileges

First, I looked for ADCS in the domain with nxc and found one with the name offluffy-DC01-CA

Second, I added a key credential to ca_svc and got his hash

Then, I used the latest version of certipy to find vulnerable templates to ESC attacks

ESC16 describes a misconfiguration where the CA itself is globally configured to disable the inclusion of the szOID_NTDS_CA_SECURITY_EXT (OID 1.3.6.1.4.1.311.25.2) security extension in all certificates it issues. This SID extension, introduced with the May 2022 security updates (KB5014754), is vital for "strong certificate mapping", enabling DCs to reliably map a certificate to a user or computer account's SID for authentication.

I used Certipy Wiki to perform an ESC16 attack:

This is the case in my situation here:

  1. Change the victim account's UPN to match a target privileged account's sAMAccountName.

Request kerberos ticket to authenticate with instead of NTLM authentication to have the updated UPN in the ticket information

  1. Request a certificate (which will automatically lack the SID security extension due to the CA's ESC16 configuration).

  1. Revert the UPN change.

  1. Use the certificate to impersonate the target.

Get the root flag

PreviousHTB - CicadaNextMedium

Last updated