HTB | Certificate

machine - https://app.hackthebox.com/machines/Certificate

IP -10.129.238.3

NMAP

─$ nmap -sT -p- --min-rate 10000 10.129.238.3 -Pn -oA nmap_ports                                                                          
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-06-01 00:54 IST
Nmap scan report for 10.129.238.3
Host is up (0.31s latency).
Not shown: 65519 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown
49686/tcp open  unknown
49688/tcp open  unknown
49706/tcp open  unknown
60728/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 98.69 seconds

SMB

The guest account is disabled, and junk accounts return STATUS_LOGON_FAILURE:

Port 80

Let’ look for directory and subdirectory

We can login as student

Foothold/shell

/uploads

We found “No quizz found with the given SID.” on /uploads

found upload functionality

Uploading a normal text file gives the following error

We can upload the PDF and view

When trying to upload and view a doc file, it gets downloaded

Since we can upload a zip file we can try to upload a shell.php with a null byte (maybe bypass?) inside a zip

I tried manually but no luck so we will below exploit.py

Now we will upload the shell2.zip and visit the file with /shell.php?cmd=whoami

and we can execute cmds

Let’s try to get revshell

found password.txt

found webdav cred

DB

We found db.php

Since we know we have xampp installed let's use mysql.exe in C:\\xampp\\mysql\\bin and let's take a look at the database

We found hashes for users

cracking password

Let's try and crack these passwords with hashcat.

Shell as Sara.b

and we are in sara.b

we found a pcap file

Shell as Lion.SK

WS-01_PktMon.pcap

On analysing protocols, we can see

Let’s look at Kerberos

We found a valid (maybe ?) packet

We can refer to this

In our case, the encryption mode (etype) is eTYPE-AES256-CTS-HMAC-SHA1-96 (18), which is the same as the vscrub

The cname and realm are in req-body: Lion.sk and CERTIFICATE.HTB, respectively.

We get the following hash

We will use hashcat to crack the hash

Let’s winrm with the cred

and we are in

found user.txt

Privilege Escalation

Bloodhound

According to the description of Domain CRA Managers.

The members of this security group are responsible for issuing and revoking multiple certificates for the domain users

ESC3

Let’s look for vulnerable templates

We can refer to this for ESC3

Shell as Ryan.K

Exploitation with Certipy

The exploitation process involves obtaining an Enrollment Agent certificate and then using it to request a certificate for a privileged user, which is then used for authentication.

  • Step 1: Obtain an Enrollment Agent certificate. The attacker (lion.sk@certificate.htb) enrolls for a certificate from the misconfigured EnrollAgent template.

Step 2: Use the Enrollment Agent certificate to request a certificate on behalf of the target user. The attacker uses their lion.sk.pfx (their agent certificate obtained in Step 1) to request a certificate from the SignedUser template (or another suitable agent-enrollable target template) on behalf of certificate\\ryan.k.

Step 3: Authenticate using the "on-behalf-of" certificate. The attacker uses the ryan.k.pfx (obtained in Step 2) to authenticate as the ryan.

Now we can winrm

And we are in as ryan

Shell as Administrator

SeManageVolume

According to Microsoft, the SeManageVolumePrivilege is used for:

This policy setting determines which users can perform volume or disk management tasks, such as defragmenting an existing volume, creating or removing volumes, and running the Disk Cleanup tool.Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data.

Basically this privilege gives accesses to the disks.

I found the CsEnox exploit let’s download and copy it on the box nd exploit

Now I am able to view Administrator files

I can view, but I could not read the root.txt

Maybe a Drive-level filter is in place

Stored (”My”) certificate

We can view the "My" store (also known as the Personal certificate store) for the current user.

Here we can see Certificate-LTD-CA

That is unusual because the "My" store is intended for end-entity certificates (your own certificates that usually have a private key).

We can use this Certificate-LTD-CA to get the certificate and hash for Administrator, and for that

  • We need the export pfx of Certificate-LTD-CA

we are getting error , seems like we do not have private key (or we do not have access)

So we will need ./SeManageVolumeExploit.exe to give ryan permission to read the cert

  • Now we have to transfer the PFX file to our machine, forge an admin certificate

  • Now using adminsitartor_forged.pfx we will try authenticate

  • login as administrator, and we have root.txt

PreviousHTB | FluffyNextHTB | TombWatcher

Last updated