https://bstell.ing/tags/active-directory/ Recent content in Active Directory on bstell.ing Hugo en-us Fri, 12 Jan 2024 00:00:00 +0000 https://bstell.ing/writeups/certified/ Fri, 12 Jan 2024 00:00:00 +0000 https://bstell.ing/writeups/certified/ <p><em>A write-up of the HackTheBox machine &ldquo;Certified&rdquo;. This box revolves around a vulnerable certificate template that we can abuse to achieve Domain Admin privileges.</em></p> <h2 id="the-target">The target</h2> <p><img alt="HTB Overview" loading="lazy" src="https://bstell.ing/writeups/certified/overview.png"></p> <p>The host is a domain controller for <code>certified.htb</code>, and we are handed one working account, <code>judith.mader</code>. The objective is the built-in <code>Administrator</code>. In outline the path runs from that account, through ownership of a group, to a service account, and finally to the certificate authority, where a misconfigured template lets us issue ourselves a certificate in the Administrator&rsquo;s name.</p>