HTB | Certified

Machine - https://app.hackthebox.com/machines/Certified

Machine Information - As is common in Windows pentests, you will start the Certified box with credentials for the following account: Username: judith.mader Password: judith09

NMAP

└─$ nmap -sC -sV -p 53,88,135,139,389,445,464,3268,3269,5985,9389,49667,49689,49690,49691,49720,49741,49776 10.10.11.41 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-09 12:54 IST
Nmap scan report for 10.10.11.41
Host is up (0.59s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-09 14:24:54Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.certified.htb, DNS:certified.htb, DNS:CERTIFIED
| Not valid before: 2025-06-11T21:04:20
|_Not valid after:  2105-05-23T21:04:20
|_ssl-date: 2025-08-09T14:26:35+00:00; +7h00m04s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.certified.htb, DNS:certified.htb, DNS:CERTIFIED
| Not valid before: 2025-06-11T21:04:20
|_Not valid after:  2105-05-23T21:04:20
|_ssl-date: 2025-08-09T14:26:35+00:00; +7h00m04s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-08-09T14:26:33+00:00; +7h00m03s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.certified.htb, DNS:certified.htb, DNS:CERTIFIED
| Not valid before: 2025-06-11T21:04:20
|_Not valid after:  2105-05-23T21:04:20
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49690/tcp open  msrpc         Microsoft Windows RPC
49691/tcp open  msrpc         Microsoft Windows RPC
49720/tcp open  msrpc         Microsoft Windows RPC
49741/tcp open  msrpc         Microsoft Windows RPC
49776/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-08-09T14:25:57
|_  start_date: N/A
|_clock-skew: mean: 7h00m03s, deviation: 0s, median: 7h00m03s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 126.55 seconds

SMB

We do not have permission to view any interesting shares

We can get the user list

Bloodhound

Foothold/shell

Shell as management_svc

WriteOwner

On analysing the Bloodhound result, we know:

JUDITH.MADER@CERTIFIED.HTB -> WriteOwner -> MANAGEMENT@CERTIFIED.HTB

and MANAGEMENT_SVC@CERTIFIED.HTB -> MemberOf -> MANAGEMENT@CERTIFIED.HTB

So we will set JUDITH.MADER@CERTIFIED.HTB as the group owner of MANAGEMENT@CERTIFIED.HTB

Next, I need to give judith.mader the full control over the groups:

Let’s add ourselves

GenericWrite

Since Management have GenericWrite over Management_svc we can either use Targeted Kerberos or shadow credentials

We will be doing Shadow Credential to get the hash

Since Management_svc is a Member Of Remote Management Users we can winrm

and we are in and got the user.txt

Privilege Escalation

GenericAll

Now we can use shadow credentials to get the hash for the CA_operator

ESC 9

we found ESC9

ESC9 vulnerabilities arise when a certificate template is explicitly configured not to include the szOID_NTDS_CA_SECURITY_EXT (OID 1.3.6.1.4.1.311.25.2) security extension in the certificates it issues. This extension, which contains the requester's SID, was introduced by Microsoft as part of the May 2022 "Certifried" updates (CVE-2022-26923 and KB5014754) to enable "strong certificate mapping". Strong mapping allows DCs to reliably and securely map a presented client certificate to a specific user or computer account in Active Directory using its SID.

ESC9 can be exploited in a couple of primary ways:

  1. With UPN Manipulation (in Compatibility Mode or Disabled Mode)

  2. Combined with ESC6 (CA allows SAN specification)

We will use 1st method

Step 1: Read initial UPN of the victim account (Optional - for restoration).

Step 2: Update the victim account's UPN to the target administrator's sAMAccountName.

Since management_svc had GenericAll over ca_operator, which means full control over that AD object. That includes the ability to Change userPrincipalName

Step 3: Request a certificate as the "victim" user from the ESC9 template.

Step 4: Revert the "victim" account's UPN

Step 5: Authenticate as the target administrator.

Now i can winrm via hash and get the root.txt

PreviousHTB | AnalysisNextHTB | Baby

Last updated