TombWatcher — HTB Writeup | The Hack Sparrow

Executive summary — TombWatcher is a Domain Controller that chains seven links of ACL (DACL) abuse, each one enabling the next without a single memory-corruption exploit: starting from an assumed-breach credential and ending at Domain Admin, by way of targeted Kerberoasting, reading a group Managed Service Account's (gMSA) password, resurrecting a deleted user from the AD Recycle Bin — the source of the machine's name — and a modern AD CS attack: ESC15 / EKUwu (CVE-2024-49019) against a legacy certificate template.

Platform	Hack The Box
Operating system	Windows Server 2019 (AD / AD CS)
Difficulty	Medium
Status	Retired
Target IP	`10.129.49.75`
Domain	`tombwatcher.htb`

Attack map

henry : H3nry_987TGV!  (assumed breach)
   |  WriteSPN
   v
Alfred -- targeted Kerberoast --> basketball
   |  AddSelf
   v
Infrastructure group
   |  ReadGMSAPassword
   v
gMSA ANSIBLE_DEV$  (NTLM cb3161cb2c9d84b58ba3014f55040d75)
   |  ForceChangePassword
   v
sam -- set password --> Newpass123!
   |  WriteOwner
   v
john  (set owner -> GenericAll -> set password)  <- user.txt, WinRM
   |  GenericAll
   v
OU=ADCS (empty) -> AD Recycle Bin: restore cert_admin (SID -1111)
   |
   v
AD CS ESC15/EKUwu (WebServer template, Schema v1, ESS=True)
   inject SAN=administrator + AppPolicy "Client Authentication"
   (PKINIT rejects it; schannel/LDAP accepts it)
   v
[ROOT] LDAPS as Administrator -> add john to Domain Admins -> root.txt

1. Reconnaissance

The initial scan confirms a Domain Controller for tombwatcher.htb:

sudo nmap -Pn --top-ports 50 10.129.49.75      # 53,80,135,139,389,445,464,636... (DC)
netexec smb 10.129.49.75

DC01 (name:DC01) (domain:tombwatcher.htb) (signing:True) (Null Auth:True)

The starting model is assumed breach: the exercise begins with a domain user credential already in hand (henry / H3nry_987TGV!), the way most real red team engagements start once initial access (phishing, a leaked credential) is already established. Validating it and enumerating the rest of the accounts:

netexec smb 10.129.49.75 -u henry -p 'H3nry_987TGV!'          # [+]
netexec smb 10.129.49.75 -u henry -p 'H3nry_987TGV!' --users

Administrator, Guest, krbtgt, Henry, Alfred, sam, john

Before touching Kerberos or AD CS it's worth syncing the local clock with the DC's — Kerberos requires under 5 minutes of skew, and any later certipy operation would fail silently on a skewed clock:

sudo ntpdate -u 10.129.49.75

Resumen ejecutivo — TombWatcher es un Domain Controller que encadena siete eslabones de abuso de ACLs (DACL), cada uno habilitando el siguiente sin necesitar ningún exploit de memoria: desde una credencial de partida (assumed breach) hasta Domain Admin, pasando por un Kerberoasting dirigido, la lectura de la contraseña de una cuenta de servicio gestionada (gMSA), la resurrección de un usuario borrado desde la Papelera de reciclaje de AD —de ahí el nombre de la máquina— y un ataque moderno de AD CS: ESC15 / EKUwu (CVE-2024-49019) contra una plantilla de certificados heredada.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 (AD / AD CS)
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.49.75`
Dominio	`tombwatcher.htb`

Mapa del ataque

henry : H3nry_987TGV!  (assumed breach)
   |  WriteSPN
   v
Alfred -- targeted Kerberoast --> basketball
   |  AddSelf
   v
Grupo Infrastructure
   |  ReadGMSAPassword
   v
gMSA ANSIBLE_DEV$  (NTLM cb3161cb2c9d84b58ba3014f55040d75)
   |  ForceChangePassword
   v
sam -- set password --> Newpass123!
   |  WriteOwner
   v
john  (set owner -> GenericAll -> set password)  <- user.txt, WinRM
   |  GenericAll
   v
OU=ADCS (vacia) -> Papelera de reciclaje: restaurar cert_admin (SID -1111)
   |
   v
AD CS ESC15/EKUwu (plantilla WebServer, Schema v1, ESS=True)
   inyectar SAN=administrator + AppPolicy "Client Authentication"
   (PKINIT rechaza; schannel/LDAP acepta)
   v
[ROOT] LDAPS como Administrator -> add john a Domain Admins -> root.txt

1. Reconocimiento

El escaneo inicial confirma un Domain Controller de tombwatcher.htb:

sudo nmap -Pn --top-ports 50 10.129.49.75      # 53,80,135,139,389,445,464,636... (DC)
netexec smb 10.129.49.75

DC01 (name:DC01) (domain:tombwatcher.htb) (signing:True) (Null Auth:True)

El modelo de partida es assumed breach: se arranca ya con una credencial de usuario de dominio (henry / H3nry_987TGV!), como en cualquier ejercicio de red team donde el punto de entrada ya está comprometido (phishing, credenciales filtradas). Se valida y se enumera el resto de cuentas:

netexec smb 10.129.49.75 -u henry -p 'H3nry_987TGV!'          # [+]
netexec smb 10.129.49.75 -u henry -p 'H3nry_987TGV!' --users

Administrator, Guest, krbtgt, Henry, Alfred, sam, john

Antes de tocar Kerberos o AD CS conviene sincronizar el reloj local con el del DC — Kerberos exige una diferencia menor de 5 minutos y cualquier operación de certipy más adelante fallaría en silencio si el reloj está desfasado:

sudo ntpdate -u 10.129.49.75

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.