HTB | Scepter

Machine - https://app.hackthebox.com/machines/Scepter

IP - 10.10.11.65

NMAP

└─$ nmap -sT -p- --min-rate 10000 10.10.11.65 -Pn -oA nmap_ports
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-23 18:47 IST
Warning: 10.10.11.65 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.65
Host is up (0.44s latency).
Not shown: 33674 closed tcp ports (conn-refused), 31841 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
111/tcp   open  rpcbind
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
636/tcp   open  ldapssl
2049/tcp  open  nfs
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49664/tcp open  unknown
49665/tcp open  unknown
49667/tcp open  unknown
49673/tcp open  unknown
49696/tcp open  unknown
49709/tcp open  unknown
49726/tcp open  unknown
49764/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 169.44 seconds

Port 2049

Let’s see the mount

We can see the helpdesk mount and everyone have the permission to view it

Foothold/shell

Shell as H.Brown

helpdesk mount

Let's mount the helpdesk share and take a look inside.

We can see .crt and .key for baker and .pfx file for clark, lewis and scott

Let’s view the certificate of baker

Let’s take a look at the key

attempting to authenticate via pfx

Since we have Clark, Lewis and Scott PFX files, we can try to authenticate

First, convert them into hash and use John to crack them

I was not able to authenticate via Clark, Lewis and Scott PFX files

Let’s make PFX for baker

PFX for baker

When prompted for passphrase, we can provide the password of clark, lewos and scott pfx and when prompt for export password let’s keep it empty

Let’s change the permission for pfx

Now we can use certipy to get the hash from the pfx

We can successfully authenticate via this hash

Bloodhound

Since we authenticate as ldap we can use bloodhound-python

We can see D.BAKER@SCEPTER.HTB -> ForceChangePassword -> A.CATER@SCEPTOR.HTB

ForceChangePassword

We will change the password for a.carter

Bloodhound again with new cred

GenericALL

We can see A.CARTER@SCEPTER.HTB -> MemberOf -> IT SUPPORT@SCEPTER.HTB -> GenericAll -> STAFF ACCESS CERTIFICATE@SCEPTER.HTB

grant a.carter full control (GenericAll) over the Organizational Unit (OU) called STAFF ACCESS CERTIFICATE By giving a.carter GenericAll on that OU:

  • You gain the ability to abuse ADCS (Active Directory Certificate Services).

  • You can impersonate users via certificates.

A Staff Access Certificate, in the context of AD CS, is a certificate issued to individual staff members to grant them access to specific resources or applications within the organization's network. These certificates are typically used for authentication purposes, allowing staff to prove their identity and gain access to authorized areas.

ESC9

I try to find ADCS vulnerability so I tried with .carter and d.baker, both we found ESC9 from Baker’s cred

and we have GenericAll on StaffAccessCertificate, also, we can see

Certificate Name Flag : SubjectAltRequireEmail

Since a.carter have GenericAll on STAFF ACCESS CERTIFICATE@SCEPTER.HTB and we want d.baker to have that access we can use impacket-dacledit with -inheritance to get FullControl over d.baker, who is also a member of STAFF ACCESS CERTIFICATE OU

Feature

bloodyAD GenericAll

impacket-dacledit with -inheritance

Affects Only Target Object

✅ Yes

✅ Yes

Affects Child Objects

❌ No

✅ Yes (if -inheritance used and not blocked)

Grants Access Type

GenericAll (standard right)

Custom ACL entry (FullControl, but customizable)

Method Used

Direct AD right via DACL

Explicit ACL modification via DACL

AdminCount Bypass Warning

❌ No warning

⚠️ Warns about adminCount=1 (inhibits inheritance)

Now we need to set the email of controlled account to that of target

Let’s try for administrator

now we can request the pfx

But when I try to get the hash, it says Name mismatch between certificate and user 'administrator', which was strange

Let’s try with a different user’s email

Let’s start with h.brown

Now we can try to get the hash

Now we can get the shell

found user.txt

Privilege Escalation

ESC9 with modification (ESC14)

On looking at ldapdomaindump, we could abuse ESC9 for the account h.brown because it was the only account with an LDAP attribute altSecurityIdentities set to X509:<RFC822>h.brown@scepter.htb

h.brown is a member of the group CMS.

Let’s check ACE for CMS group

The line SCEPTER\CMS has WriteProperty on 00fbf30c-91fe-11d1-aebc-0000f80367c1 - Target: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb tells us that SCEPTER\CMS has write access to altSecurityIdentities on p.adams

So if we can change/add altSecurityIdentities for p.adams we can get the hash and we know that p.adams has DCsync Rights

Now for ESC9 we need to update the email for d.baker

Now let’s try to get the hash

DCSync

and we are in

found root.txt

PreviousHTB | OfficeNextHTB | Haze

Last updated