Fluffy — HTB Writeup | The Hack Sparrow

Executive summary — Fluffy is an Easy Active Directory box in assume-breach mode (we're given j.fleischman:J0elTHEM4n1990!). The initial nmap scan gives away a Domain Controller (fluffy.htb / DC01) and a writable SMB share, IT, where a leftover PDF leaks another username, p.agila. There we upload a malicious .library-ms file (CVE-2025-24071, related to CVE-2025-24054) that forces NTLM authentication: Responder captures p.agila's hash, which we crack with hashcat. BloodHound shows p.agila is in Service Account Managers, which has GenericAll over the Service Accounts group; that group in turn has GenericWrite over winrm_svc and ca_svc. We join the group, abuse Shadow Credentials to take winrm_svc (user flag), and pivot from there to ca_svc, vulnerable to AD CS ESC16, to issue an Administrator certificate and close out the box (root flag). Path: IT share -> .library-ms -> p.agila -> winrm_svc -> ESC16 -> Administrator.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.10.11.69`

Attack map

[assume-breach] j.fleischman : J0elTHEM4n1990!  (SMB/LDAP, no WinRM)
   |  IT share (R/W): KeePass, Everything, Upgrade_Notice.pdf -> "p.agila" hint
   v
[SMB write] upload malicious .library-ms (CVE-2025-24071/24054) + Responder
   v
[p.agila]  NetNTLMv2 -> hashcat -> prometheusx-303
   |  BloodHound: p.agila -> Service Account Managers -> GenericAll over Service Accounts
   |             Service Accounts -> GenericWrite over winrm_svc and ca_svc
   v
[winrm_svc]  Shadow Credentials (certipy) -> WinRM (user.txt)
   |  ca_svc vulnerable to ESC16 (Security Extension disabled)
   v
[ADMIN]  change ca_svc UPN -> issue Administrator cert -> auth (root.txt)

1. Reconnaissance

A full port sweep followed by a targeted -sCV makes it obvious we're facing a domain controller: Kerberos, LDAP, SMB, the Global Catalog and WinRM are all open.

nmap -p- --min-rate 10000 10.10.11.69
nmap -sCV -p53,88,139,389,445,464,593,636,3268,3269,5985 10.10.11.69

🧠 53 (DNS), 88 (Kerberos), 389/3268-3269 (LDAP + Global Catalog), 445 (SMB) and 5985 (WinRM) together are the classic DC fingerprint. The LDAP banner itself confirms the domain and the controller's hostname:

Domain: fluffy.htb
DC: DC01.fluffy.htb

Resumen ejecutivo — Fluffy es un Easy de Active Directory en modo assume-breach (nos dan j.fleischman:J0elTHEM4n1990!). El nmap inicial delata un Domain Controller (fluffy.htb / DC01) y un share SMB IT con escritura donde un PDF filtra el nombre de otro usuario, p.agila. Ahi subimos un fichero .library-ms malicioso (CVE-2025-24071, emparentada con CVE-2025-24054) que fuerza autenticacion NTLM: Responder captura el hash de p.agila, que crackeamos con hashcat. BloodHound muestra que p.agila esta en Service Account Managers, que tiene GenericAll sobre el grupo Service Accounts; ese grupo tiene a su vez GenericWrite sobre winrm_svc y ca_svc. Nos unimos al grupo, abusamos de Shadow Credentials para tomar winrm_svc (user flag) y desde ahi pivotamos a ca_svc, vulnerable a AD CS ESC16, para emitir un certificado de Administrator y cerrar la caja (root flag). Recorrido: share IT -> .library-ms -> p.agila -> winrm_svc -> ESC16 -> Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.10.11.69`

Mapa del ataque

[assume-breach] j.fleischman : J0elTHEM4n1990!  (SMB/LDAP, no WinRM)
   |  share IT (R/W): KeePass, Everything, Upgrade_Notice.pdf -> pista "p.agila"
   v
[SMB write] subir .library-ms malicioso (CVE-2025-24071/24054) + Responder
   v
[p.agila]  NetNTLMv2 -> hashcat -> prometheusx-303
   |  BloodHound: p.agila -> Service Account Managers -> GenericAll s/ Service Accounts
   |             Service Accounts -> GenericWrite s/ winrm_svc y ca_svc
   v
[winrm_svc]  Shadow Credentials (certipy) -> WinRM (user.txt)
   |  ca_svc vulnerable a ESC16 (Security Extension deshabilitada)
   v
[ADMIN]  cambiar UPN de ca_svc -> emitir cert de Administrator -> auth (root.txt)

1. Reconocimiento

Un escaneo completo de puertos seguido de un -sCV dirigido deja claro que estamos ante un controlador de dominio: Kerberos, LDAP, SMB, el Global Catalog y WinRM, todo abierto.

nmap -p- --min-rate 10000 10.10.11.69
nmap -sCV -p53,88,139,389,445,464,593,636,3268,3269,5985 10.10.11.69

🧠 53 (DNS), 88 (Kerberos), 389/3268-3269 (LDAP + Global Catalog), 445 (SMB) y 5985 (WinRM) juntos son la huella tipica de un DC. El propio banner LDAP confirma el dominio y el hostname del controlador:

Domain: fluffy.htb
DC: DC01.fluffy.htb

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.