root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat mist.md
// writeups

Mist

30 Mar 2024 · 24 min read · root access
writeupshacktheboxwindowsInsaneretiredvip
Mist - maquina de Hack The Box

Executive summary — Mist is an Insane Active Directory box centred on AD CS chains. The entry point is an unauthenticated file disclosure in Pluck CMS (CVE-2024-9405) that leaks the admin password hash; after cracking it, a malicious PHP module gives RCE as svc_web on MS01. Abusing an automatic shortcut (.lnk) synchronisation mechanism escalates to the real domain account Brandon.Keywarp. From there, this box's complete methodology involves an authentication-coercion attack with an NTLM relay against LDAPS on the DC to compromise the MS01$ machine account, Shadow Credentials plus Kerberos S4U to get local Administrator on MS01 (user flag), another user's KeePass database, and from there ReadGMSAPassword, AddKeyCredentialLink and two rounds of ESC13 over AD CS templates up to domain Administrator on DC01 (root flag).

PlatformHack The Box
Operating systemWindows Server 2022 (AD Domain Controller + member host)
Domainmist.htb
DifficultyInsane
StatusRetired
Target IP10.129.17.140
Attacker IP<ATTACKER_IP>

Attack map

[1] Recon -- only 80/tcp open; Apache+PHP; Pluck 4.7.18 (http-generator + /docs/ listing)
        |
[2] CVE-2024-9405 (file disclosure) -> unsalted SHA-512 admin hash -> crack -> lexypoo97
      malicious .zip module -> PHP webshell -> RCE as ms01\svc_web
      (AMSI bypass + Base64 encoding for -enc)
        |
[3] Writable "Common Applications" folder with synced .lnk files ->
      Notepad.lnk hijack -> run by an automated process -> mist\brandon.keywarp
        |
[4] AD CS "pass the certificate": Certify + Rubeus -> brandon.keywarp's NTLM hash ->
      SOCKS tunnel (Chisel) into 192.168.100.0/24 -> SharpHound (full collection)
        |
[5] PetitPotam + NTLM relay to LDAPS (LDAP signing not enforced) ->
      Shadow Credentials over MS01$ -> MS01$'s hash
        |
[6] Rubeus asktgt/s4u (MS01$) -> S4U2self impersonating Administrator (CIFS) ->
      local Administrator on MS01  ->  user.txt
        |
[7] Sharon.Mullard's KeePass .kdbx (Hashcat mask attack on a partially leaked password) ->
      op_Sharon.Mullard (domain account)
        |
[8] ReadGMSAPassword -> svc_ca$ -> AddKeyCredentialLink (Shadow Credentials) -> svc_cabackup
        |
[9] ESC13 x2 (ManagerAuthentication -> Certificate Managers; BackupSvcAuthentication ->
      ServiceAccounts/Backup Operators) -> reg.py backup of SAM/SYSTEM/SECURITY -> DCSync
      +-> domain Administrator  ->  root.txt

1. Reconnaissance

nmap -p- --min-rate=3000 -T4 -Pn -oN nmap_all_ports.txt 10.129.17.140

Only one open port: 80/tcp. A common pattern on HTB Insane Windows boxes: the firewall blocks SMB, RPC and Kerberos externally even though this is a Domain Controller, forcing all initial enumeration through the web service.

nmap -p80 -sC -sV -oN nmap_detailed.txt 10.129.17.140
80/tcp open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)

NSE scripts add more: http-generator identifies exact Pluck 4.7.18; http-robots.txt lists /data/ and /docs/ as disallowed; there's a redirect to /?file=mist.

gobuster dir -u http://10.129.17.140 \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -t 100 -o gobuster_root.txt
curl http://10.129.17.140/docs/

/docs/ has directory listing enabled, with typical Pluck files (CHANGES, COPYING, UPDATING, update.php) reliably confirming the exact 4.7.18 version.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.