search
LinkedInHTB ProfileAbout

HTB - Certificate

hashtag
Description

This machine showcases a multi-stage attack path beginning with remote code execution achieved through ZIP file concatenation, embedding both a PDF and a malicious PHP shell. Post-exploitation, database credentials are harvested to pivot to a second user, followed by lateral movement to a third user. The third account has certificate enrollment privileges, allowing the attacker to exploit ESC3 and escalate to a fourth user. This final user, through Active Directory group membership, holdsSeManageVolumePrivilege, which is abused to export the CA's private key. A forged golden certificate is then used to impersonate high-privileged users, ultimately leading to Domain Admin compromise.

hashtag
Enumeration

I started with normal Nmap scan to find all open ports

Nmap Scan

Exported all open ports to a variable and ran the script and version detection scans

Summary

I always update /etc/hosts before I attack the domain to avoid any tooling issues

I started with web server enumeration. Visiting http://certificate.htb/ gives this web page:

There were not many pages on the site. only /register, /login, /blog, contacts.php, index.php, and about.php endpoints

I wanted to log into the site, but I had to register for an account first:

Here is the successful registration message

Then, I went to log in to the site with my username & password

Landed here after logging in and saw the new endpoint /coures.php

http://certificate.htb/courses.php

I clicked on the first course and then Enroll button:

This message appeared after I clicked Enroll button and also the following section, as well

Watch button did nothing but sumbit took me to another page:

The page only accepts .zip, .pdf, .xlsx files

hashtag
Foothold

After testing the function with my team, we managed to get RCE using the following technique:

The site only accepts .pdf, so creating one zip file containing .pdf and another one containing .php reverse shell

Reverse shell content:

you can replace shell.ps1 with your desired powershell reverse shell

Then concatenated the two zip files into one:

The site gave me a direct link for .pdf file

What I did was to request rev.php not file.pdf

hashtag
Lateral Movement

hashtag
Shell as Sara.b

Under C:\xampp\htdocs\certificate.htb, I found db.php which contains the DB connection string credentials

And I confirmed that MySQL database was running on the host

I searched for the binary mysql.exe to use it to connect to the database without the need to upload Chisel.exe and performing reverse port forwarding, and found it under C:\xammpp\mysql\bin

I found two users with @certificate.htb email in the table. Maybe they are domain users, and I could see here that Sara.B is a domain user

The hash for Sara was cracked successfully

Confirm access

With Sara credentials, I used bloodhound.py to collect domain LDAP data:

I also checked the share access, but didn't find anything

From BloodHound-GUII found Sara is a member of Account Operators privileged group besides other groups. With this membership, I can take over any account I want, except Administrators

This path was patched by HTB Team, So you will not see Account Operators membership. The path involved going from Sara.B to Lion.SK or Ryan.K directly

Also. Members ofHelp Desk users can access the box via winRM

There are 3 users other than xamppuser and sara have a Desktop folder on the box

Lion.SK is a member of Domain CRA Managers

BloodHound described that group:

Also, Ryan is a member of Domain Storage Managers

BloodHound described that group:

My strategy was to get either one of the two users, and might get high privileges, whether on CA as Lion or at the file system level as Ryan

First, I accessed the box via winRM as Sara

hashtag
Shell as Lion.SK

Then, I found those files in Documents folder

Download both files

When I opened the .pcap file with wireshark, I saw many TCP packets, so I filtered them out, and several KRB5 packets appeared

If I could extract the full authentication process, I might be able to get a hash and try to crack it.

When I searched for a way to extract the hashes from .pcap, I found this repo

Clone the repo to my Kali

The first hash lacked the domain name, so it had to be modified from CERTIFICATE to CERTIFICATE.HTB

hashtag
Shell as Ryan.K

With Doamin CRA Managers group, I enumerated the certificate templates as Lion.SK and found one vulnerable to ESC3

ESC3 vulnerabilities exploit weaknesses related to Certificate Request Agents, also known as Enrollment Agents. An Enrollment Agent is an account authorized to request certificates on behalf of other users. This functionality is legitimate in scenarios such as helpdesk staff enrolling smart cards for users or for automated certificate provisioning systems. However, if an attacker gains access to an active Enrollment Agent certificate, or if they can enroll for a new Enrollment Agent certificate due to misconfigured template permissions, they can abuse this privilege to obtain certificates for other users, including highly privileged accounts like Domain Administrators.

I used Certipy Wikiarrow-up-right to perform the attack:

Request a certificate for lion

Request a certificate as administrator Failed due to this error CERTSRV_E_UNSUPPORTED_CERT_TYPE

A quick search for this error showed me that the requested template (User) hasn't been published/issued by the CA, so I used certipy to find all enabled templates in the CA, and the problem was that the template User wasn't there but SignedUser instead

I modified the command and ran it again, but also failed to get a certificate for administrator account due to CERTSRV_E_SUBJECT_EMAIL_REQUIRED. The good news was when I changed the requested user to Ryan.K it worked

Auth as Ryan and get his hash:

Get a shell with Ryan.k And I found that he has SeManageVolumePrivilege which makes sense being a member of domain Storage Managers

I searched on GitHub about how to abuse this privilege and I found two repos. The second one has a compiled exploit, so I used it

What the exploit does:

  • This exploit grants full permission on C:\ drive for all users on the machine.

    • Enables the privilege in the token

    • Creates handle to .\C: with SYNCHRONIZE | FILE_TRAVERSE

    • Sends the FSCTL_SD_GLOBAL_CHANGE to replace S-1-5-32-544 with S-1-5-32-545

The repo author suggests adding malicious dll on this path: C:\Windows\System32\spool\drivers\x64\3 and then run specific commands to trigger it and get SYSTEM access. However, this path is not even there on the box.

hashtag
Privilege Escalation

  • Alternatively, with full read permission on C:\ I could read possible files such as:

    • SAM, SYSTEM, SECURITY Hives

    • NTDS.DIT database

    • Root CA private key

On action, I got no access on all of them except Root CA private key

hashtag
Here are the steps I followed to get the private key:

  1. Download the exploit and upload it to the box:

  1. Exploit and get full permission on C:\

  1. Export the CA private key

With the CA private key, I can forge golden certification and access the box as an administrator.

I used this link as a reference:

Certificate authority | The Hacker Recipesarrow-up-right

To avoid kerberos clock skew, run sudo timedatectl set-ntp off; sudo rdate -n dc01

Get the root flag

Root Flag: 19f55bf4156dxxxxxxxxxxxxxxxxxxx

PreviousHTB - VintageNextInsane

Last updated