text: What's going on, YouTube? This is IPS. I'm doing certificate from Hack the Box, which starts off with a pretty niche but cool file upload exploit in a PHP application. It accepts zip files and will unzip it into a directory, but it checks the extensions before performing that unzip operation to try to prevent any dangerous files from being uploaded. I'll show two ways to bypass this filter. The first by inserting a null bite. So, when it creates the file, it chops off a portion of the file, letting us have a PHP file. The second way I find extremely cool. It was used in a fishing attack. It's called zip stacking where we just use cat to combine two zip files into one. Some zip programs read the first file, others read the second file. And it's a pretty cool attack that I recommend you watching. Anyways, once we do that, we gain access to an account that has a pcap file that can read a

title: HackTheBox - Certificate


text: kerros request. We can extract that hash, crack it with hashcat, and gain access to an account that has some privileges on the active directory certificate service that lets us take ownership over an account that can take ownership over the disk. Windows EFS protects root.ext. So we have to get the administrator NLM hash to read it. And to do that, we'll perform the golden ticket attack by extracting the signing key. So with that being said, let's jump in. As always, we're going to start off with an end map. So - sc for default scripts, SV enumerate versions vv for double verbose. This gives us things like the TTL OA output all formats put in the end map directory and call it certificate and then the IP address of 10101.71. This can take some time to run. So I've already ran it. Looking at the results,

title: HackTheBox - Certificate


text: we have 12 ports open. The first one being DNS on port 53. And the banner tells us it's simple DNS plus. And whenever I see this banner, which is the default for Active Directory, I always just scroll down quickly and look. Yes, it is AD. We have LDAP exposed. And looking at the domain, we have certificate.htb. So I'm going to go ahead and add that to my host file. So pseudo v etsy host. And we can add 101171 certificate.htb. And it's also going to tell us the fully qualified name which has the host name DC1. So let's go ahead and add that as well. So we'll do DC1 certificate.hcb. And I also like adding the host name or net bios name which is just dc1. We can save that. And the last thing about this service is we see a certificate-la which is a non like default certificate.

title: HackTheBox - Certificate


text: most likely active directory um certificate services or ADCS is installed in this box. But let's go back to the top. So we had DNS. We also have HTTP on port 80. Its banner tells us it's Apache HTTPD which is odd. Um normally Windows runs on IIS but if we look at the banner we see um Windows is running Apache which is normally the X ampstack or XAMP. I don't know exactly how to pronounce that but it is um Apache running on Windows. Additionally the TTL is 127. If the box was running a like Linux VM and then had Apache running there, I'd expect the TTL to be 126. Uh the banner is also telling us PHP is configured for this Apache. So we know most likely it's a PHP web server. Let's look at what else we have. Uh Kerros, some RPC stuff. LDAP. Uh probably SMB is next. Yes, more Kerros.

title: HackTheBox - Certificate


text: LDAP. Uh scrolling down, nothing really too interesting. It looked like that was like LDAP and global catalog other just standard active directory things. Uh there is a 8 hour clock skew. So if we want to do anything Kerburush related, we should run NTP date to sync our time. Um so let's go take a look at what else we have. We can run net exec real quick. So net exec SMB dco1 certificate.htb.

title: HackTheBox - Certificate


text: And what this is going to do is just um we can see if there's any like open file shares. So we can do d-shares. And then I don't think you have to do it anymore, but we could specify like a blank username and a blank password to see if like um we can log in that way. Uh doesn't look like we can. So we have login failure there. So let's see. Um let's go over to the web server. So I'm going to go to certificate.htb and do I have burpswuite intercepting? I do. So let's turn that off. And we get a page. Um, if we look at the links, we can see like about.php is there. Uh, contacts.php. So, this is definitely going to be a PHP web server. All the extensions indicate that. We could look at the source to see if it's like um WordPress or things like that. Uh, we probably notice by like the file structure on these links. You normally see like a um WP uh

title: HackTheBox - Certificate


text: WP-inccludes directory, things like that you'd find. We could run Durbuster. You can also just look at the HTTP history.

title: HackTheBox - Certificate


text: Go to one of these. Let's see where is index.php. I probably should just intercept it, but nope. This is going to be where index.php is. We see it's giving us the PHP session cookie. No laral cookies or things like that. So, most likely just hand jammed PHP code. No like big framework like Laravel, a cake PHP, things like that. That also confirms no WordPress because WordPress would also have unique cookies. So, there's a lot of things we can do on the website. I'm just going to um jump through it really quick. If we scroll down, there is like classes. And if we click on a class, we need to enter a username. If we go to account register, we can create an account. And I don't know why it just hangs uh randomly, but oh well. Our first name, let's do root atac.rocks. Password of password.

title: HackTheBox - Certificate


text: And the username is going to be IPSAC. We can specify student or teacher for account type. If we specify teacher, it'll need um we need a contact support to verify the identity to activate the account. So I'm just going to do a student account. If we click submit, we get registration successful. We can log in here. So let's log in with IPSC and password. And let's see if we go over to courses.

title: HackTheBox - Certificate


text: We can click on a course and you have like ID is equal to one. Um, normally I just add things like a single quote.

title: HackTheBox - Certificate


text: Then we can do d-space dash. Um, right now I'm just testing for SQL injection quickly. Probably would send these type of things to SQL map just to um, find out. I also may send it to like fuff and then uh, fuzz 1 through 9,999 to see if there's any hidden classes I don't have access to that potentially I could see. Right? There's always those possibilities. Maybe they have a um old course that they um deleted softly so like it's still accessible if you know the ID and that could be one when they were building the website and have like sensitive information things like that. Um but things like that I would be testing for. We have a feedback form. I'd probably test for like cross-ite scripting here. We can click enroll.

title: HackTheBox - Certificate


text: And if we do that we have the course outline where we can watch videos supposedly or go to submit. If I click on submit, it tells us it accepts PDF, DOCX, PowerPoint, or Excel. And it can also be in zip archives. So, I'm just going to test this real quick. I'm just going to do echo. Um, we'll do please subscribe to IPSC.pdf. And then I'm going to do ziple legit.zip ipsc.pdf. And we're going to try uploading this and see exactly what the behavior is. So, let's go. IPSAC http certificate legit.zip upload. It tells us where the file is.

title: HackTheBox - Certificate


text: If we click that, there we go. We can access this file. Um, our browser is trying to render it as a PDF because that's what the mime type's coming back with. But if I curl it, it just says please subscribe. So, all we have to do is put files in a zip, right? So, let's try um.php here. Uh, let's do echo.php.

title: HackTheBox - Certificate


text: Then we can do that zip command. Let's do zip. Instead of legit.zip, I'm going to call this um test.zip, I guess. Go back to the upload test.zip. Submit. Malicious content. So, it is checking the extension within the zip file itself. We know it's not like the metadata of the zip because we didn't actually give it a PDF. We just had that PDF extension. And I know of two ways we can exploit this. We're going to talk about null bytes first and that is a common like technique to bypass things. Um because in the zip it is going to be buffered right if I do a xxd on legit.zip we see all the bytes that make up of this and the file name is going to start right here. We see ipsc.pdf and this is going to be IP right there and 0 a this is 10 and that's going to be the length of this. Right? So if I do echo- n ipsseack.pdf wc- c 10 um let's um create a new file.

title: HackTheBox - Certificate


text: So I will do a touch ipsc.pdf2 and I have to put two ps there right.

title: HackTheBox - Certificate


text: Let's add this. So we can do ziple legit.zip ipsc.pdf2.

title: HackTheBox - Certificate


text: We'll xxd this again. So now we see two files in this. The ipssec.pdf PDF that's still 0 A which is 10. Now let's see PDF 2 is right there.

title: HackTheBox - Certificate


text: And now that is going to be 0 B right. So right after before IPS we have 1 C and then back here is the bite right we can see the 1 C right there. And then here is going to be the length. If we do this one more time let's do 23.

title: HackTheBox - Certificate


text: Um we have to create that file first. Let's do touch 23. Sure. And then xxd legit.zip. Where is There's two. Here's 23.

title: HackTheBox - Certificate


text: Um, let's see. It would be up here actually for the file structure. IPSAC. There's Oh, there we go. 0 C right there. Uh, before it was like 0 A, Z B, zero C. So that would be 10 11 12. So why this works is because when the PHP is reading the file name, it knows the length. So it's going to read this entire length um right here, right? And then when it goes to write a file, if we do null bite, it's not like buffered or length terminated or whatever. It's just going to write until it reaches that null bite and that's going to be what terminates it. So since PHP potentially is reading the full file name including the null bite, we can still have a PDF extension on, but when it goes to extract that file and write to the U file system, the null bite would terminate it and that extension will get dropped. That is the theory of

title: HackTheBox - Certificate


text: this attack, right? So we can test this out real quick. Um, I'm going to grab a reverse shell. I always like using the uh reverse shell from this GitHub repo. I just Google Ivan reverse shell because it's like the one from pentest monkey that a lot of people use, but it works very well on Windows. The pentest monkey one does not work that well on Windows.

title: HackTheBox - Certificate


text: So, let's go to source um reverse php shell raw. And we can just w get this. And then I'm going to rename it uh just shell.php. Actually, um let's rename it to shell dot PHP. I'm going to do two periods and then PDF. And the reason why is I want to replace this null bite or this period with a null bite in B. So we'll do that.

title: HackTheBox - Certificate


text: And I'm going to zip uh we'll call it shell.zip. shell.zip.

title: HackTheBox - Certificate


text: And then give it this file. Okay. And let's go back over to the server.

title: HackTheBox - Certificate


text: So, let's go try not try again. Let's just click back.

title: HackTheBox - Certificate


text: Let's go to browse. And then we called it what? Shell.zip.

title: HackTheBox - Certificate


text: We can go to burpswuite um proxy intercept on submit. And then we have the hex here. So, what I want to do is I'll center a repeater actually. Um, we want to switch over to raw or hex right here. And this is going to let us modify the bites. We could just open up in a hex editor locally, but we can do it here as well. So, right here we have shell.php period period PDF. Uh, 2 E is period. So, I'm going to click right there. I'm going to put this a null bite. So, we have shell.php nullbyte. PDF. And then it's also happens near the end of this file. All right, right here. And let's see where is the 2E2E right here. So I'm going to put this one as a null bite as well. And then we're going to send the payload.

title: HackTheBox - Certificate


text: And if we scroll down, let's see.

title: HackTheBox - Certificate


text: It should say, there we go. File uploaded successfully. And it gives us the link here. So, let's go ahead and copy this. I'm going to start a shell r nclvmpp 90001 and let's go and request this file. Uh, I can turn burp suite off. Enter.

title: HackTheBox - Certificate


text: Send it. Hopefully, we get a call back. My IP is 10148. And you know what I forgot to do? Uh, we forgot to change the IP address in the shell. It's sending a shell to 127001. So, let's go ahead and update that real quick. 10 10 14 8 91.

title: HackTheBox - Certificate


text: Save that. And then let's remove shell.zip zip. Shell.zip like this. Recreate it. And I'm going to go redo the proxy. Click back. Browse.

title: HackTheBox - Certificate


text: Shell.zip. Intercept.

title: HackTheBox - Certificate


text: That is on. Submit. Send it to repeater. And we have to do the same thing again. So there are two spots where we have the file name right here. Uh PDF where are we?

title: HackTheBox - Certificate


text: There we go. N bite. Scroll all the way down and right here. Okay. Send it.

title: HackTheBox - Certificate


text: We should look at the response file upload successfully. We can access it here.

title: HackTheBox - Certificate


text: Okay. Disable burpuite. Click on it. And I don't have my Rivershell listening.

title: HackTheBox - Certificate


text: It's taking its time to send us the shell.

title: HackTheBox - Certificate


text: Let's see. Oh, there we go. We got a shell. Awesome. So, I did say there are two ways we can do this. There is another attack which I think is arguably cooler than um putting the null bite in.

title: HackTheBox - Certificate


text: So, I'm going to go back over to Google and I'm going to Google zip concatenation attack and let's see. Uh, I don't think this is the post I wanted. Where is it? Here we go.

title: HackTheBox - Certificate


text: And this was common in uh fishing attacks because what it's actually going to do is have the zip behave different ways based upon the program that is um executing it. Uh so what they do is create a first zip, a second zip, and then put them on top of each other. And then sometimes the zip program will pull from the very first file, sometimes it pulls from the second file. And we can demonstrate that pretty easily on our box. So, let's go. Uh, we have two zips, actually. We have shell.zip. I'm going to actually delete shell.zip real quick. Or we don't have to delete it. Let's just do shell.php PDF. And I'm going to call this just shell.php now. And we'll zip. We'll call it stacked.zip on shell.php. So, we have two zips. We have the Let's do legit and then stacked. So I'm going to do cat legit then stacked and we're

title: HackTheBox - Certificate


text: going to call it both.zip. And if I do an unzip-l on both, it tells me shell.php is in this. So it's reading from this second zip, right? If I do a sevenzip l.zip, we have the other zip ipsack. PDF. So this attack is popular because they would attach zips to emails and then the anti-PAM filter would open it. It would see, oh, this is a legitimate zip. So it makes its way to the person's like Outlook inbox or whatever email program they're using. They click on the zip. Windows is using WinRAR or something which pulls the second zip in that and that's where the payload is. So it bypassed like email scanning because um the scanner was opening a different zip which is weird. It's just weird behavior by the zips, right? So, what happens now if we just upload this both.zip to the server? Uh, let's go over to Burpswuite.

title: HackTheBox - Certificate


text: Turn intercept off. Um, let's go browse and I'm going to zip or execute both.zip. We can submit it.

title: HackTheBox - Certificate


text: And I think it just hung on me. That was weird.

title: HackTheBox - Certificate


text: Earth.zip. Submit. Hung.

title: HackTheBox - Certificate


text: That wasn't happening before. I wonder it's because we have a shell going. So, I'll exit that shell.

title: HackTheBox - Certificate


text: Hopefully, I don't regret that. Let's do both.

title: HackTheBox - Certificate


text: Submit. Still hanging.

title: HackTheBox - Certificate


text: Um, I'm just going to say let's remove both.zip. I'm only going to put one file in the zip. So, we can say uh let's do rm legit. We'll do zip legit.zip. And we'll only put ipsseack.pdf in this. And then we can cat IPS.pdf. PDF and then shell not IPSC.pdf ipsc.zip or legit.zip. That's what it was to both.zip.

title: HackTheBox - Certificate


text: Okay. Hopefully this works. It's going to refresh this page. Make sure everything's good there. Where is both?

title: HackTheBox - Certificate


text: Submit. There we go. So maybe it was just the zip I was using. I know I did a lot of weird things in that zip, but we should be able to do a RL wrap.

title: HackTheBox - Certificate


text: Let's click here. It's opening ipsc.pdf. But if we say uh what we called it shell.php, we should get a call back. So that is two different ways we can exploit that, right? um because the PHP code it's going into the zip reading it and then supposedly I guess it's using a different program to extract the zip. So um stacked works there as well. So hopefully both those attacks made sense and you enjoyed that. But let's go take a look at what's on the server. Whenever I exploit a server and land on the web server, my first step is always looking for the database. So let's go into the root directory. Do a diir. There is a db.php. If we type that out, we can get credentials to the database. So, I'm going to go ahead and add this to creds.ext real quick. Um, we can say my SQL. Let's copy this user, which I think I had my clipboard. I do. And then we

title: HackTheBox - Certificate


text: can also put the password here. Okay.

title: HackTheBox - Certificate


text: Um, we could save the database name, but we don't need to. Uh, since this is XAMP, um, Examp's going to have a MySQL directory and bin. And then it has the MySQL.exe program. We could open up Chisel and then tunnel to access my SQL, but might as well just use the binary that's on the box, right? Uh, so we can do /mysql.exe u, and then I'm going to purposely make a mistake here um because this is a weird ba um batch quirk. not bash but bash command prompt. So we'll do mysql- u uh -p. We need to put this password in now.

title: HackTheBox - Certificate


text: Copy paste. And then what else do we need? Uh dash e show databases. This is going to be the query, right? If I run this, it doesn't work. Um I expected an actual error message.

title: HackTheBox - Certificate


text: I wonder if P doesn't have a space after it. There we go. Access denied. Um, so I'm going to copy this. I'm going to do PowerShell.

title: HackTheBox - Certificate


text: I'm going to run it again. And then we get the results. This seems bonkers, right? Um, command prompt is one of the few that single quotes will actually still expand things. We want double quotes actually in Bash, right? Because what's happening is it's treating this password as a special character. Like I think it's the at sign or maybe the exclamation point, but that's not actually getting sent as that. It's treating it as some weird special character that we would have to escape in single quotes. If we change it to double quotes, um, change everything to double quotes.

title: HackTheBox - Certificate


text: I was going to say it works. Uh, well, that is the issue. I swear it worked before. Um, oh, we have a single quote still. There we go. So, that is the weird quirk in command prompt. You should always use double quotes, not single quotes. Everywhere else, it's normally single quotes. Um, except in Golang, which is backicks. But, let's go back. I'm just going to use PowerShell because it's easier to work with. So, we have the database there. If I do a dash capital D, we can specify which database we want to use. So, I'm going to copy this, put it here, and then instead of show databases, we can do show tables. We see the tables in here. We have courses users. So, I want to get the um users out of this. So, let's do describe users.

title: HackTheBox - Certificate


text: We can see the columns ID, first name, last name, username, email, password. Probably username, password is what we want, right? So we can say select, let's do username, password from users. There we go. We have everything we need. So I'm going to copy this. And then I'm going to go over to the Kraken, which is just another box on my network. I don't like Kraken on my host machine because I'm recording as well. I can drop frames when I'm using something like hashcat. Um, I just wouldn't crack in a VM. You can crack on your host machine if you want, but if you crack in a VM, it's going to go extremely slow. So, let's do V hashes. This name is certificate. I'm just going to call that hashes because I forgot what format it is in.

title: HackTheBox - Certificate


text: It looks like brypt to me. Um, let's replace all this with colons.

title: HackTheBox - Certificate


text: I probably should write a said script to do it quickly, but by the time I figure out exactly what the syntax with that is, I probably would have finished already.

title: HackTheBox - Certificate


text: I thought I erased like an extra character on Steve. So, apparently it's just stev, right? But there we go. So, let's do slashhashcat dash I think it's d- username um hashes and then opt word list rock. Let's see if it initializes correctly.

title: HackTheBox - Certificate


text: It detects a few potential brypts. Um I'm going to guess it's just the standard Unix one because that's what it looks like. I have no reason to think it's using form CC e-commerce. So, let's do - 3200.

title: HackTheBox - Certificate


text: see if we get any results here. So, it's going to initialize the devices and probably take a minute or two to crack. I'm thinking let's see how long it says if we get any results immediately. We probably should get my result immediately because it was password. We also get a second user. The password is blink 182. I'm just going to kill this out because I don't think we crack anything else. But I'm going to do the d-show command. And that tells me Sarah B's password is blank 182. So let's go ahead and vcreds.ext.

title: HackTheBox - Certificate


text: Um Sarah.B. Was it capital? I think it was a capital B, right? Uh yep, it is. Okay. So, we want to see um if that's actually the correct username because the active directory and um website could mismatch. So, what I'm going to do is a get ad user- filter star. I'm going to select on SAM account name and that's going to list all the users in this. And we have um Sarah B right here. So, we have a potential user. Let's do net exec SMB um DC1 certificate HDB Sarah.B be password of blink 182 and let's see that is good um we can't access the box we can do uh d-shares to see if we have anything there we could also now run like um rust hound we can check if winrm is enabled um so we can do instead of smb winrm and see if we can access it this way it looks like we can because it says poned So, let's go ahead

title: HackTheBox - Certificate


text: and say evil winrm-up.

title: HackTheBox - Certificate


text: That all looks good, right? So, we're going to go here and we get in. If I look at the desktop, we don't have a user.ext. If we look at directory, uh there is a directory called WSO1. If we look here, we have description.ext and a pcap. So, I'm going to do a type description.ext.

title: HackTheBox - Certificate


text: And we see a note here that says workstation one's not able to open reports and they adapt attached a pcap for analysis. So I'm just going to go ahead and download this pcap. So we'll do a download on the pcap.

title: HackTheBox - Certificate


text: And while that downloads let's go ahead create a new pane. Um there we go. So I'm going to do wireshark then wso1 pcap.

title: HackTheBox - Certificate


text: And we have quite a big packet capture actually, right? Um we see SMB2 and some various other things. My very first thought whenever I get a pcap is running a program called pcreds. So if I search for pcreds, let's see, we have it here.

title: HackTheBox - Certificate


text: Get clone preds. And then we can go in there. We have to do a Python 3-m uh VM.VM source VM bin activate.

title: HackTheBox - Certificate


text: Uh they don't have requirements.ext.

title: HackTheBox - Certificate


text: What? Oh, there we go. uh we need to install a few libraries. So I'm just going to install these two. I think I have lib pcapdev already on my system.

title: HackTheBox - Certificate


text: But if we run these now we should be able to run preds. We can give it the file name of what was it? There we go. And extracts net nm v2 hash. Now we could try cracking this. I'm not going to because it doesn't actually crack anything. But I just want to show the very first thing I do when I get a pcap file. I run against pcreds. Um, this hasn't been updated to add a lot of new um, hashes.

title: HackTheBox - Certificate


text: If we look at this though, if we type, let's see, kerros, we can see a kerros request. And it first attempts this pre-authent um, as request. And then we see pre-author is required. And then we do this as request. And this is going to be um it's not that hard, but it's I guess one of those things like how do you know this? Well, normally just going to Google and reading things. And hack the box is a great way um to come across these things. So, let's uh Google as I think from router is the post I came across. Yeah, this is good. I would highly highly highly recommend reading this. Um, they do create a program at the bottom of it that can just do it automatically. Let's see. Is this the one I used? Oh, we'll do it manually as well. Um, GitHub openw wrt. Is this it?

title: HackTheBox - Certificate


text: I don't think this is the actual program I used. It'll probably work.

title: HackTheBox - Certificate


text: But let's go find a different one. Back to Google.

title: HackTheBox - Certificate


text: I'm just going to Google um KB5 roast parser. I think this is a more upto-date one. So I'm just going to get clone this real quick.

title: HackTheBox - Certificate


text: Uh get I can leave it in the Python VM. That is fine. Uh Python 3 KB5 roast ROS parser. Let's give it the pcap. And then it wants what type of request. So we can do as request and it gives us the hash. Right? So the blog post tells us exactly how that's created. But I can just walk through that. Um let's see. So it's a KB5PA.

title: HackTheBox - Certificate


text: So if we go here, I think KB5PA just means as request. So I'm going to hold on. be this. So this is the type of request it is. So 18. Where's 18 coming from? That is the um encryption I think. Let's see that is in here somewhere.

title: HackTheBox - Certificate


text: Same oh encryption type 18. So that's where it's getting it from. Um this is a AS256 HMAC Shaw 1. Uh let's see. We got lion.sk. That is going to be the CNAME. And then this realm, this is actually um incorrect in a request, which is weird. I think if you look at the actual KOB5 um rep roster, it's pulling like it looks at the pcap and when it sees this, then it pulls the updated realm of let's see, we go to ticket. Oh, there we go. Certificate.htb. But I think what's happening here actually is we attempt to make the request and it tells us pre-authentication is required. And when we look at this, I want to say this gives us the salt, right? Uh time info, PA data. No, is this it? Yeah, there we go. So the salt of certificate HTTP and Lion SK. So I think it's actually encrypting with this. So it tells us hey pre-authentication is required to do

title: HackTheBox - Certificate


text: this um as request and then we use the salt in order to encrypt and it uses this E type of 18. And what is it actually encrypting? Right. Um it doesn't encrypt the ticket itself. The only thing that is encrypted is the timestamp. Um I'm trying to figure out exactly where it says that here. There we go. Um there we go. Uh encrypted time stamp. And it's really odd how it does it. Uses the time stamp kind of as um a signature I guess is a good way to put it, right? It's got to encrypt it with something. What's it going to encrypt it with that both the client and server know? The NLM hash of the user. So it encrypts the current time with the NLM hash and then salts it with the realm and username. And that is where we get the certificate. HTTP and line SK. And that's why we can crack this hash because this piece right here, that's

title: HackTheBox - Certificate


text: going to be the cipher 23. It starts with 23F and ends with F0. If we go over here, we have the cipher 23 and that's going to end at F-Zero. I bet if I do a copy value, put this here. Uh, wrong clipboard. There we go. So, this is the same exact hash, right? So if we go here, we can delete word paste identical. So that's where it's pulling it from. It's just the cipher here, which is the encrypted timestamp. And this is encrypted with the NLM hash of the user. So when we go to hashcat, we give it a word list. It takes every word in that word list, nm hashes it, and then tries to decrypt this to see if it gets to a time stamp. That's essentially how this works in a nutshell. So let's catashes.ext. We can grab this. Go back over to the Kraken V. Um, hashes. This can be certificate dot kob 5, I guess. Paste this. I should

title: HackTheBox - Certificate


text: have done like kob8 or something, but oh well. Uh, hashcat hashes opt word list rocku.ext. And let's see if we get anything here.

title: HackTheBox - Certificate


text: Finishing test. And there we go. one recovered. So if we do a d-shell, we can see lion sk is a keyboard walk.

title: HackTheBox - Certificate


text: So we can try testing this out real quick. nxc SMB 1010 1171 Lion SK password. And there's no reason why I use the IP address instead of host name. I've been using host name a lot. I just I guess typed the IP address out of habit. But there we go. Lion SK can also access or we also have Lion SK's password. So I can go V creds.ext lion.sk put in this pass.

title: HackTheBox - Certificate


text: Um that's not the password.

title: HackTheBox - Certificate


text: 2 WSX. I think that's the password. Um that should be.

title: HackTheBox - Certificate


text: Let's deactivate because there's no need to be in that pip virtual environment and we can uh go back here and see if we could win RM. I'm going to show two different ways we can enumerate this information. Um first since we can win rm, we could just look at what groups we're a member of, right? So if we do dash I like this and who am I all this should tell me the groups, right? Um, let's see. Enabled by default, well known.

title: HackTheBox - Certificate


text: Man, it is. Okay, there we go. Here's the group name. Um, domain CRA. I'm guessing that is going to be like a um certificate registration agent or something, which means we probably should look at certify output, right? This is the key piece to notice. Um, but if we ran like rustound or we could run sharp hound on the box, but I like doing things on my box when I can. So, I'm going to run rust hound real quick. So, I'm going to do rustound domain certificate.htb username line sk of that keyboard walk. I'm pretty sure I just typed that correctly. Let's see. I probably should have added - z for zip, but oh well, it worked. Let's go. Blood Hound server docker compose up-d start the containers and then we will upload blood hound data and um look at the certificate that way. If you use the Python ingesttor the Python ingesttor doesn't do certificates at least last

title: HackTheBox - Certificate


text: time I checked. That's why I switched over to Rust Hound because I think it does a much better job at um downloading data for Blood Hound. So again, if you use the Python ingesttor, you probably won't be able to get the same results you're about to see here. Um, there we go. Looks like it is started up local host. I want to say 8088 is where run Blood Hound. It is. We can log in and then we're going to upload the data. So click on administration, upload files, and then let's go over to HTTP certificate. all these JSON files. Upload. And I'm going to pause the video because it normally takes a minute or two to ingest. And then we'll look at the results. And there we go. It has been ingested. I don't know exactly what file fails to ingest, but that doesn't really matter. I'm used to seeing that by now.

title: HackTheBox - Certificate


text: If I look at the search lion SK, I could we could add them to owned real quick. And let's see if we do outbound object control. We can see he's a member of domain users which gives the ability to enroll some certificates but also domain CRA managers which gives us access to this delegated certificate registration agent. At least I think that's what it stands for. Um but this is going to be the key thing. So let's run certify and see if this is vulnerable to anything. So let's do I'm just going to go into new pane to make it easy. Um, certify find you lion.sk password of that keyboard walk. Then target certificate.htb and we want the dash vulnerable flag and see what it shows. DNS resolution failed. Is that an issue? Did I type in this certificate? Nope. That looks fine.

title: HackTheBox - Certificate


text: I think it's querying it. Um, yeah, it is. Awesome. I'm not sure exactly uh what was going on, but it's retrieving the configuration there, checking web enrollment, and it should output the result soon. And it's going to give me a text file that I just have to cat. I think if you run the old version of certify, it would just output it out to standard out. Or maybe there's a flag like std out. Um but I'm going to cat this file. And then we see it is vulnerable to ES3. The template has the request agent EKU set. And what that's going to enable us to do is register certificates on behalf of other users. Um, we could Google this and get to a blog post. Um, let's see. This probably, let's see, ES3 ADCS exploit. I'm not going to read the blog post, but find one. This is good.

title: HackTheBox - Certificate


text: Um, this RBT security is a good article if you wanted to read up more on it, right? It has all the details, but to exploit it, we're going to first do a request to get a certificate out. So, I'm going to do certify request. Um, where's that fine command? We'll do request like that just so we don't have to type the password again. And then we want the CA and that is certificate.

title: HackTheBox - Certificate


text: What was it? -Ltdca that is the authority and then the template that we want is going to be delegated and this should give us a pfx file that we can then use to request other certificates. So hopefully this works.

title: HackTheBox - Certificate


text: Come on. There we go. We have the pfx right here. So what we want to do is let's see do we specify we want signed user this and then we can say on behalf of I'm going to try the administrator administrator. There we go. Dashpfx client skfx. So what we're doing here is we're requesting a certificate from the signed user template and saying hey the um delegated CRA certificate is telling us that you can assign us tickets on behalf of other users.

title: HackTheBox - Certificate


text: And if we request this it's actually going to fail because um the email is unavailable. And for this to work um it's using signed user. So we need to have um an email. And if we go back to where we have a shell. Um, which one did I use? Get AD user right here. Yeah, this is what I did. Um, let's select SAM account name. And uh, I think the property is actually mail, not email. And we probably need dash properties. There we go. We can see administrator doesn't have an actual email. Uh, so we can request certificates on any of these users. We could look around in Blood Hound to see if there's anything that sticks out, but what I'm going to do is a get ad group and look at what groups are in Active Directory. And it's going to be sorted by the domain SID. So, we'll get the um groups as they were created. And I think I

title: HackTheBox - Certificate


text: screwed this up. I probably need like a dash filter. Um, is it dash filter star?

title: HackTheBox - Certificate


text: There we go. Uh, let's do select. We'll do Sam account name maybe. And I'm going to do sit as well.

title: HackTheBox - Certificate


text: Uh, oh, my whole shell died there.

title: HackTheBox - Certificate


text: Okay, we'll do it from evil one. Get AD group. Um, filter star. Select Sam account name Sid.

title: HackTheBox - Certificate


text: Did I misspell that? I'm just going to do name. I think that's the one I normally use. There we go.

title: HackTheBox - Certificate


text: So, I'm going to ignore all the like ones that come with Windows right here.

title: HackTheBox - Certificate


text: This is still one that comes with Windows. If you install the DNS service, the DNS admin, we have CRA managers, finance, HR, marketing, help desk, domain storage managers. So, we already have an account in domain CRA managers.

title: HackTheBox - Certificate


text: That's not interesting to us. If we saw fileshares, I may request um things here. Help desk is another good one.

title: HackTheBox - Certificate


text: Maybe that has a blood hound path. But domain storage managers, this sounds like it has the most control because they're a storage manager. Maybe they have physical access to or they have administrative access to the hard drives, right? So, I'm going to do a get ad group member on the domain storage members or managers. And we see Ryan.

title: HackTheBox - Certificate


text: Um, his name is Ryan K. Awesome. So, I'm going to go back to the certificate. And what we're going to do is certificate Ryan K and request a certificate for him. And if we go back to Blood Hound, let's see. Does Ryan K have any paths. Oh, come on.

title: HackTheBox - Certificate


text: Ryan K.

title: HackTheBox - Certificate


text: Let's say mark as owned. I think I added the last one to high value instead of owned. I look at outbound object control. Um, this is just because member of domain user Let's see cipher. Where is shortest path from? Let's see. Unconstrained.

title: HackTheBox - Certificate


text: Come on. Owned objects. There we go.

title: HackTheBox - Certificate


text: Is there anything? So, Ryan K. Nope. We did mark the lion as owned. Doesn't look like there's anything too interesting. Right. So we have the certificate for Ryan K. So this one let us create the certificate.

title: HackTheBox - Certificate


text: I'm going to use a um certifi pfx Ryan K then DCIP 1010 1171 and this should get me the um NLM hash of Ryan. So let's see if we get that getting TGT.

title: HackTheBox - Certificate


text: it may actually fail um because yep the clock skew. So let's do pseudo NTP date on the IP address fixer time. And if you do that and it doesn't work, you probably have your v uh time being set by open VM tools. So you want to open virtual box or VMware like go in the properties of your VM and disable time sync there. You don't want your OpenVM tools syncing time. Um that's probably the most likely candidate. But there we go. But we have the NLM hash of Ryan K. So if I do evil winner rm- u Ryan K capital H then we need dash I 1010 10171 we can do a who am I/all and we have se man manage volume privilege and this is a dangerous privilege. Um with this we can take control over the uh file system.

title: HackTheBox - Certificate


text: Let's see. Exploit. And I'm going to use the exploit from Enox. There's one from XCT as well. I don't know if that's doing the same exact thing, but when solving the box, I use this one. I liked it because it had a compiled .exe for me to use really easily.

title: HackTheBox - Certificate


text: So, let's just do a uh wget on this. And then I'm going to go cd program data upload this. And what it's actually going to do is replace the domain administrator ACL with everyone. And that's going to enable us to go into files. Right? So if I do a diir on slash users administrator desktop, it's going to fail right now. Right? So let's run this exploit. So I'm going to do a dot slash. The exploit says changed 841 entries. We do a diir. And there we go. We go. Whoops. Let's change that to a cd. Now, if we try to access root.ext, we can't. And the reason why is um it is encrypted. It's using the Windows encrypted file system, EFS. So, we need administrators NLM hash to be able to access this file essentially. So, we're not done just yet. We do have um access to the entire file system. So, we could potentially like download NTDS. And extract it that way. But, um I think the coolest thing

title: HackTheBox - Certificate


text: to do would be just to um use the golden ticket attack because I haven't really showed that before. Um so, I'm going to go back into program data and we want to go back to our certify output. Uh let's see. Do we have find?

title: HackTheBox - Certificate


text: Yep, here we go. Uh, I probably catted it. Right.

title: HackTheBox - Certificate


text: There we go. So, this is going to be the master certificate, right? And we have the serial number right here. So, what I'm going to do is export it. So, I'm going to use what is it? Cert util export pf pfx.

title: HackTheBox - Certificate


text: And then what we want to specify is um the serial number and then the file name. So I'm just do CA.pfx and this is going to export the certificate of the root authority. So this is going to be what signs all the tickets, right? So now if I download CA.pfx, we'll now be able to forge tickets of anyone we want. We can sign anything, right? We have the golden ticket. So, I'm going to do a certify and then forge. Uh, we'll give it the CA PFX of CA.pfx. The user principle name of administrator at certificate.htb.

title: HackTheBox - Certificate


text: And then we need the subject. Uh, let's go back to Blood Hound. We are logged out for some reason. See, let's close our other tabs.

title: HackTheBox - Certificate


text: Administrator. There we go. Where is the UPN?

title: HackTheBox - Certificate


text: We'll just give it the distinguished name. There we go. And I think that's all we need, right?

title: HackTheBox - Certificate


text: Yep. And this doesn't even talk to the domain. It just forges the um certificate with the CA. like it doesn't need to reach out to the domain but now we can use this um to authenticate right so we can specify pfx administrative forged dcip 1010 1171 and we get the ntlm hash right here so let's do evil winr rm- i 1010 1171 u administrator capital h for the hash and And this lets us in. So we can do cd desktop diir type root.ext. And there we go. That is the box. Hope you guys enjoyed it. Take care and I will see you all next

title: HackTheBox - Certificate