🌙Scepter

https://app.hackthebox.com/machines/Scepter

Recon

Using the htbscan from Scripts/Functions/Tools

Adding the domain-controller to our hosts as well.(The latest version of htbscan should do this as well)

NFS Server

We find some certificates on that NFS Server and a key as well. Mount it to /tmp

User

We gonna try to crack these certificates using john

With that password we are able to generate a pfx for baker without any password, just hit enter. Moreover changing owner- and groupchip.

Syncing our clock(not necessary needed twice) and getting the cert.

Now we ned to add the domain-controller to our resolver and using the hash with bloodhound to get some overview how we can escalate further

Checking our results with bloodhound for kali.

If you haven't installed it already here are the steps:

Starting neo4j then open the link and change the password. Afterwards we start bloodhound in a new terminal and just dropping our zip-file. When th eimport is done we can use the search

When we enter the User Baker at search, select him and check shortest path

After this we gonna check these nodes, when we right click Carter we see some interesting action "ForceChangePassword"

So let's do this.

Another bloodhound check with these new credentials and user

We are now in a group called staff access certificate

LogoADCS ESC14 Abuse TechniqueMedium

Enter password 'Password123' at the beginning

Root

Getting a stable meterpreter-sesssion. Creatin our payload with msfvenom, starting our listener in metesploit.

Uploading our payload and executing it

Creating a new computer and analyzing the x509

Adding meow.scepter.htb to our hosts-file

Last updated