Manager — HTB Writeup | The Hack Sparrow

Executive summary — Manager is a Medium Active Directory box where the final escalation vector relies on Active Directory Certificate Services (AD CS). With RID brute and trivial password spraying (username=password) we get operator, which authenticates to MSSQL; without xp_cmdshell, xp_dirtree lists the filesystem and locates a website backup leaking credentials for raven (user flag). raven discovers a misconfigured SubCA template (ENROLLEE_SUPPLIES_SUBJECT): after becoming a CA officer, enabling the template, requesting and manually approving a certificate as Administrator, it authenticates via PKINIT and retrieves their NTLM hash for Pass-the-Hash.

Platform	Hack The Box
Operating system	Windows
Domain	`manager.htb`
Difficulty	Medium
Status	Retired
CA	`manager-DC01-CA`
Target IP	`10.129.5.242`

Attack map

[1] RID brute -> users -> password spraying (operator:operator)
        |
[2] MSSQL as operator -- no xp_cmdshell, but xp_dirtree lists the filesystem ->
      a website backup reachable over HTTP
        |
[3] Backup leaks raven's credentials  ->  user.txt
        |
[4] adPEAS/Certipy -- SubCA template with ENROLLEE_SUPPLIES_SUBJECT
      raven adds itself as a CA officer + enables SubCA
        |
[5] Request a cert impersonating administrator@manager.htb -- CERTSRV_E_TEMPLATE_DENIED
      but the request IS created (Request ID) -> approve it manually as officer
        |
[6] Retrieve administrator.pfx -> PKINIT (Certipy auth) -> Administrator's NTLM hash
      (clock skew fixed with ntpdate)
        |
[7] Pass-the-Hash (psexec.py)  ->  nt authority\system  ->  root.txt

1. Reconnaissance

echo "10.129.5.242 manager.htb dc01.manager.htb ca.manager.htb" | sudo tee -a /etc/hosts

nmap -Pn -sC -sV 10.129.5.242   # DNS, Kerberos, LDAP, SMB, MSSQL(1433), HTTP, WinRM

These three hostnames (manager.htb, dc01.manager.htb, ca.manager.htb) aren't added on a whim: later on, Certipy needs to resolve the DC and CA names to talk to the certificate's RPC/DCOM services. Without this entry in /etc/hosts, certipy commands fail with opaque errors like Failed to resolve or Failed to get dynamic TCP endpoint for CertSvc, hard to tie back to DNS if you don't already know it.

Resumen ejecutivo — Manager es un Medium de Active Directory donde el vector de escalada final se basa en Active Directory Certificate Services (AD CS). Con RID brute y un password spraying trivial (usuario=contraseña) conseguimos operator, que autentica en MSSQL; sin xp_cmdshell, xp_dirtree permite listar el filesystem y localizar un backup web filtrando credenciales de raven (user flag). raven descubre una plantilla SubCA mal configurada (ENROLLEE_SUPPLIES_SUBJECT): tras convertirse en officer de la CA, habilitar la plantilla, solicitar y aprobar manualmente un certificado a nombre de Administrator, se autentica con él vía PKINIT y recupera su hash NTLM para Pass-the-Hash.

Plataforma	Hack The Box
Sistema operativo	Windows
Dominio	`manager.htb`
Dificultad	Medium
Estado	Retired
CA	`manager-DC01-CA`
IP objetivo	`10.129.5.242`

Mapa del ataque

[1] RID brute -> usuarios -> password spraying (operator:operator)
        |
[2] MSSQL como operator -> sin xp_cmdshell, pero xp_dirtree lista el filesystem ->
      backup del sitio web accesible por HTTP
        |
[3] Backup filtra credenciales de raven  ->  user.txt
        |
[4] adPEAS/Certipy -- plantilla SubCA con ENROLLEE_SUPPLIES_SUBJECT
      raven se anade como officer de la CA + habilita SubCA
        |
[5] Solicitar cert suplantando a administrator@manager.htb -- CERTSRV_E_TEMPLATE_DENIED
      pero la peticion SI se crea (Request ID) -> aprobarla manualmente como officer
        |
[6] Recuperar administrator.pfx -> PKINIT (Certipy auth) -> hash NTLM de Administrator
      (desfase de reloj corregido con ntpdate)
        |
[7] Pass-the-Hash (psexec.py)  ->  nt authority\system  ->  root.txt

1. Reconocimiento

echo "10.129.5.242 manager.htb dc01.manager.htb ca.manager.htb" | sudo tee -a /etc/hosts

nmap -Pn -sC -sV 10.129.5.242   # DNS, Kerberos, LDAP, SMB, MSSQL(1433), HTTP, WinRM

Los tres nombres (manager.htb, dc01.manager.htb, ca.manager.htb) no se añaden por capricho: más adelante Certipy necesita resolver el nombre del DC y de la CA para hablar con los servicios RPC/DCOM del certificado. Sin esta entrada en /etc/hosts, los comandos de certipy fallan con errores opacos como Failed to resolve o Failed to get dynamic TCP endpoint for CertSvc, difíciles de relacionar con DNS si no se conoce de antemano.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.