Certified — HTB Writeup | The Hack Sparrow

Executive summary — Certified is a Domain Controller with not a single CVE involved: the entire chain lives inside the Active Directory permission graph. Three chained ACL delegations (WriteOwner → GenericWrite → GenericAll) hand over control of the userPrincipalName attribute of an account with enrollment rights on a misconfigured certificate template, enabling AD CS ESC9 to impersonate the domain Administrator without ever touching a password — both intermediate pivots are solved with Shadow Credentials, reversible and quiet.

Platform	Hack The Box
Operating system	Windows Server 2019 (Build 17763) — Domain Controller
Difficulty	Medium
Status	Retired
Target IP	`10.129.231.186`
Domain	`certified.htb`
Starting point	`judith.mader : judith09` (assumed breach)

Attack map

judith.mader : judith09   (assumed breach, no WinRM)
   │  WriteOwner
   ▼
MANAGEMENT group
   │  1. set owner -> judith  2. add genericAll -> judith  3. self-join
   ▼
management_svc  (GenericWrite inherited from the group)
   │  Shadow Credentials (msDS-KeyCredentialLink -> PKINIT -> U2U)
   │  NT: a091c1832bcdd4677c28b5a6a1295584            <- user.txt (WinRM)
   ▼
ca_operator  (GenericAll from management_svc)
   │  Shadow Credentials again
   │  NT: b4b86f45c6018f1b664f70805f45d8f2
   │  only principal with Enrollment Rights on...
   ▼
AD CS — "CertifiedAuthentication" template  (NoSecurityExtension = ESC9)
   │  1. (as management_svc, GenericAll) ca_operator.UPN := "Administrator"
   │  2. (as ca_operator) certipy req -> cert with SAN UPN=Administrator,
   │     NO objectSid
   │  3. ca_operator.UPN := restored to ca_operator@certified.htb
   │  4. certipy auth -pfx -> with no SID the KDC maps by UPN
   ▼
[ROOT] Administrator NT: 0d5b49608bbce1751f708748f67e2d34 -> Pass-the-Hash -> root.txt

1. Reconnaissance

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.231.186

Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown

The remaining 65,516 ports are filtered, not closed: a firewall is dropping packets, so any callback to Kali on an arbitrary port is risky. Worth planning the exploitation without reverse shells — exactly what this chain allows, running entirely over LDAP, Kerberos and RPC.

sudo nmap -p53,88,135,389,445,5985 -sCV -oN scans/services.txt 10.129.231.186

88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: ...)
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject Alternative Name: DNS:DC01.certified.htb, DNS:certified.htb, DNS:CERTIFIED
| Not valid before: 2025-06-11T21:05:29
|_Not valid after:  2105-05-23T21:05:29
|_clock-skew: mean: 7h00m22s, deviation: 0s, median: 7h00m21s
|_    Message signing enabled and required

Two details worth flagging: an LDAPS certificate valid for 80 years points at an internally issued CA with an excessive lifetime — an early hint that AD CS is present in the domain — and mandatory SMB signing rules out any NTLM relay from the outset.

sudo bash -c 'echo "10.129.231.186 certified.htb dc01.certified.htb DC01" >> /etc/hosts'

Notice what's missing: no port 80, no port 443. The CA is present but without the web enrollment role (certsrv). All interaction with it will happen over RPC/DCOM (MS-ICPR) on the high ports. The machine name, the 80-year certificate, and — later — an account named ca_operator are the thematic hint: the end of the chain is AD CS, but it has to be enumerated over LDAP against the Public Key Services container instead of hunting for a web interface that doesn't exist.

Resumen ejecutivo — Certified es un Domain Controller sin un solo CVE de por medio: la cadena entera vive en el grafo de permisos de Active Directory. Tres delegaciones de ACL encadenadas (WriteOwner → GenericWrite → GenericAll) entregan el control sobre el atributo userPrincipalName de una cuenta con derecho de inscripción en una plantilla de certificado mal configurada, lo que permite explotar AD CS ESC9 para suplantar al Administrador del dominio sin tocar una sola contraseña — los dos pivotes intermedios se resuelven con Shadow Credentials, reversibles y silenciosos.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 (Build 17763) — Domain Controller
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.231.186`
Dominio	`certified.htb`
Punto de partida	`judith.mader : judith09` (assumed breach)

Mapa del ataque

judith.mader : judith09   (assumed breach, sin WinRM)
   │  WriteOwner
   ▼
Grupo MANAGEMENT
   │  1. set owner -> judith  2. add genericAll -> judith  3. me uno
   ▼
management_svc  (GenericWrite heredado del grupo)
   │  Shadow Credentials (msDS-KeyCredentialLink -> PKINIT -> U2U)
   │  NT: a091c1832bcdd4677c28b5a6a1295584            <- user.txt (WinRM)
   ▼
ca_operator  (GenericAll de management_svc)
   │  Shadow Credentials otra vez
   │  NT: b4b86f45c6018f1b664f70805f45d8f2
   │  único principal con Enrollment Rights sobre...
   ▼
AD CS — plantilla "CertifiedAuthentication"  (NoSecurityExtension = ESC9)
   │  1. (como management_svc, GenericAll) ca_operator.UPN := "Administrator"
   │  2. (como ca_operator) certipy req -> cert con SAN UPN=Administrator,
   │     SIN objectSid
   │  3. ca_operator.UPN := restaurado a ca_operator@certified.htb
   │  4. certipy auth -pfx -> sin SID el KDC mapea por UPN
   ▼
[ROOT] NT Administrator: 0d5b49608bbce1751f708748f67e2d34 -> Pass-the-Hash -> root.txt

1. Reconocimiento

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.231.186

Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown

Los 65.516 puertos restantes están filtered, no closed: hay un firewall descartando paquetes, así que cualquier callback hacia Kali por un puerto arbitrario es problemático. Conviene planificar la explotación sin shells inversas — que es exactamente lo que permite esta cadena, apoyada por completo en LDAP, Kerberos y RPC.

sudo nmap -p53,88,135,389,445,5985 -sCV -oN scans/services.txt 10.129.231.186

88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: ...)
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject Alternative Name: DNS:DC01.certified.htb, DNS:certified.htb, DNS:CERTIFIED
| Not valid before: 2025-06-11T21:05:29
|_Not valid after:  2105-05-23T21:05:29
|_clock-skew: mean: 7h00m22s, deviation: 0s, median: 7h00m21s
|_    Message signing enabled and required

Dos detalles con valor propio: el certificado LDAPS con un periodo de validez de 80 años apunta a una CA interna con configuración desmesurada — indicio temprano de que hay AD CS en el dominio — y la firma SMB required descarta de entrada cualquier relay NTLM.

sudo bash -c 'echo "10.129.231.186 certified.htb dc01.certified.htb DC01" >> /etc/hosts'

Obsérvese lo que NO hay: ni puerto 80 ni 443. La CA está presente pero sin el rol de inscripción web (certsrv). Toda la interacción con ella ocurrirá por RPC/DCOM (MS-ICPR) sobre los puertos altos. El nombre de la máquina, el certificado de 80 años y —más adelante— una cuenta llamada ca_operator son la pista temática: el final de la cadena va a ser AD CS, pero conviene enumerar por LDAP contra el contenedor Public Key Services en vez de buscar una interfaz web que no existe.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.