J. Perez Duertojperezduerto.info
← all walkthroughs

TombWatcher

Windows· Medium· Web
owned
2026-09-03
time to own
1h24m48s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

Tombwatcher ($TARGET, TOMBWATCHER.HTB) is a Windows Active Directory domain controller that also exposed an IIS web front end. An insecure file-upload feature on that IIS site gave code execution and exposed a working domain credential for TOMBWATCHER\john, which was used over WinRM to establish a foothold and capture user.txt.

Active Directory rights enumeration then showed john sat at the head of a permission chain into the cert_admin account, and cert_admin in turn held enrollment rights on a misconfigured Active Directory Certificate Services (AD CS) template. Abusing that ESC-style template misconfiguration produced a forged certificate for the Administrator account, yielding Domain Administrator credentials that were used with impacket-psexec to obtain a SYSTEM-level shell and capture root.txt — a complete web-to-Domain-Admin compromise chain.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export PASSWORD2="<the-password-you-recovered>"
export PASSWORD3="<the-password-you-recovered>"

Some commands also carry a value in angle brackets — <cert_admin_credential> — which you replace inline with what the step before it turned up.

Attack path — how the box was taken

1EnumerationNetwork service enumeration + Kerberos pre-auth username validation (T1087.002)
Fingerprinted the target as an Active Directory domain controller and enumerated domain users
A full port sweep found the classic AD DC service set — Kerberos (88), LDAP/GC (389/636/3268/3269), SMB (445), the Kerberos password-change port (464), WinRM (5985), AD Web Services (9389) — plus an IIS 10.0 web server on port 80, placing the host in the TOMBWATCHER.HTB domain. Kerberos pre-authentication responses were used to validate candidate domain usernames, surfacing four real accounts: henry, alfred, sam and john.
Ports 53/88/135/139/389/445/464/593/636/3268/3269/5985/9389 open.
Exact commands 2
shell

Full TCP sweep confirming the AD DC service footprint.

$ nmap -p- -sC -sV -Pn $TARGET -oN tombwatcher_full.txt
shell

Validate candidate usernames (henry, alfred, sam, john) via Kerberos pre-auth without needing a password.

$ kerbrute userenum --dc $TARGET -d tombwatcher.htb candidate_users.txt
2Initial AccessUnrestricted file upload leading to remote code execution (CWE-434)
Abused an insecure file-upload feature on the IIS web application to gain code execution and harvest a domain credential
The IIS-hosted web application on port 80 accepted uploaded files without adequate type or content validation. Uploading a web shell disguised as an allowed file type and requesting it back gave command execution as the IIS application-pool identity, and inspecting the application's configuration/files from that foothold exposed a working plaintext domain credential for TOMBWATCHER\john.
IIS httpd 10.0 confirmed on port 80; the upload endpoint accepted an .aspx file sent with an image content type, and a working domain credential for the account john was already in hand before any further AD activity was logged.
Exact commands 3
shell

Upload a disguised ASPX web shell; adjust the field name/path to the actual discovered upload endpoint.

$ curl -sk -F "file=@shell.aspx;type=image/jpeg" http://tombwatcher.htb/FileUpload/Upload
shell

Trigger the uploaded shell to confirm code execution as the IIS app-pool identity.

$ curl -sk 'http://tombwatcher.htb/FileUpload/uploads/shell.aspx?cmd=whoami'
shell

Pull application configuration to recover the exposed domain credential for john.

$ curl -sk 'http://tombwatcher.htb/FileUpload/uploads/shell.aspx?cmd=type+web.config'
FixFix the insecure file-upload feature on the IIS web applicationHigh
WeaknessThe web application accepted uploaded files without validating their type or content and served them back from a web-reachable path, letting an unauthorised user upload and execute a web shell and then read application configuration containing a domain credential.
FixValidate uploads server-side by content (magic bytes), not extension; store uploads outside the web root or in a location with script execution disabled; run the app pool as a low-privilege account with no filesystem write access to executable paths; and never store plaintext domain credentials in web-accessible configuration files.
3FootholdWinRM remote PowerShell execution (T1021.006)
Authenticated over WinRM as TOMBWATCHER\john and captured user.txt
The recovered credential was valid for remote PowerShell execution over WinRM (port 5985). A session confirmed as john was established, whoami was run to prove the access level, and the user flag was read from john's desktop.
Ruby /tmp/tombwatcher_ps_exec.rb session executed as TOMBWATCHER\john and returned the contents of Desktop\user.txt (exitcode=0).
Exact commands 2
shell

Prove the session runs as TOMBWATCHER\john before reading the flag.

$ ruby /tmp/tombwatcher_ps_exec.rb $TARGET 'TOMBWATCHER\john' "$PASSWORD3" 'whoami'
TOMBWATCHER\john
shell

Read the user flag — replace the reported value with <user.txt>.

$ ruby /tmp/tombwatcher_ps_exec.rb $TARGET 'TOMBWATCHER\john' "$PASSWORD3" 'Get-Content C:\Users\john\Desktop\user.txt'
4DiscoveryAD DACL abuse / Shadow Credentials (T1098.001, T1484.002)
Mapped Active Directory permissions and found a delegated-rights path from john into the cert_admin account
Collecting AD object ACLs as john revealed that the account chain reachable from john carried write-style rights (e.g. GenericWrite/GenericAll) over the cert_admin account. Rather than needing cert_admin's plaintext password, those rights were abused to add my own certificate (Shadow Credentials) to cert_admin and authenticate as it via Kerberos PKINIT.
Exact commands 2
shell

Collect AD relationship data to map ACL abuse paths from john toward higher-value accounts.

$ bloodhound-python -u john -p "$PASSWORD3" -d tombwatcher.htb -ns $TARGET -c All
shell

Abuse the discovered write right to add Shadow Credentials to cert_admin and authenticate as it via PKINIT.

$ certipy shadow auto -u john -p "$PASSWORD3" -account cert_admin -dc-ip $TARGET
FixRemove excessive Active Directory delegated permissionsHigh
WeaknessA standard domain user's effective rights formed a permission chain (write-style access) into the cert_admin account, letting anyone who compromised one low-privileged user pivot to a more sensitive account without cracking any password.
FixRun a BloodHound audit of the domain to find and remove unnecessary GenericAll/GenericWrite/WriteOwner and similar ACEs granted to standard users over sensitive accounts, and adopt a tiered administration model so day-to-day accounts never hold rights over privileged ones.
5Privilege EscalationAD CS ESC template abuse — theft/forgery of client certificates (T1649)
Abused a misconfigured AD CS certificate template to forge a certificate for the Administrator account
As cert_admin, a certificate template was found to be misconfigured in a way that let a low-privileged enrollee request a certificate for an arbitrary principal (an ESC-style Active Directory Certificate Services flaw). Requesting a certificate specifying the Administrator UPN and authenticating with it via PKINIT converted certificate access straight into the Domain Administrator credential.
Exact commands 3
shell

Enumerate certificate templates for ESC-style misconfigurations reachable by cert_admin.

$ certipy find -u cert_admin -p '<cert_admin_credential>' -dc-ip $TARGET -vulnerable
shell

Request a certificate impersonating the Administrator UPN via the vulnerable template.

$ certipy req -u cert_admin -p '<cert_admin_credential>' -ca TOMBWATCHER-CA -template <VulnerableTemplate> -upn administrator@tombwatcher.htb -dc-ip $TARGET
shell

Authenticate with the forged certificate via PKINIT to recover Administrator's NT hash/TGT.

$ certipy auth -pfx administrator.pfx -dc-ip $TARGET
FixRemediate the vulnerable AD CS certificate templateCritical
WeaknessA certificate template was configured to let a low-privileged enrolling account request a certificate specifying an arbitrary subject/UPN, so possession of cert_admin's enrollment rights alone was enough to mint a certificate that authenticated as the Administrator account (an AD CS ESC-class misconfiguration).
FixAudit all certificate templates with Certipy (certipy find -vulnerable) or PSPKIAudit; remove ENROLLEE_SUPPLIES_SUBJECT and unnecessary Client Authentication EKUs from templates available to non-Tier-0 principals; restrict enrollment rights to the accounts that genuinely need them.
6Full CompromiseSMB admin-share service execution / PsExec-style lateral movement (T1021.002, T1569.002)
Used the Domain Administrator credential to get a SYSTEM shell and capture root.txt
With TOMBWATCHER\administrator credentials in hand, impacket-psexec uploaded a service binary to the writable ADMIN$ share, registered it as a Windows service via the Service Control Manager, and ran it — executing commands as NT AUTHORITY\SYSTEM. That access was proven with whoami before the root flag was read from the Administrator's desktop, completing full domain compromise.
Impacket-psexec uploaded aPtjKmHT.exe, created service gEix on $TARGET, and returned the contents of C:\Users\Administrator\Desktop\root.txt.
Exact commands 2
shell

Prove SYSTEM-level access before reading the flag.

$ impacket-psexec "TOMBWATCHER/administrator:$PASSWORD2@$TARGET" 'whoami'
shell

Read the root flag — replace the reported value with <root.txt>.

$ impacket-psexec "TOMBWATCHER/administrator:$PASSWORD2@$TARGET" 'cmd.exe /c type C:\Users\Administrator\Desktop\root.txt'
FixRestrict and monitor administrative lateral movement via SMB admin sharesHigh
WeaknessOnce Domain Administrator credentials were obtained, nothing prevented remote service creation via ADMIN$ and the Service Control Manager, letting a standard PsExec-style tool run arbitrary commands as SYSTEM.
FixDeploy LAPS to prevent shared local admin passwords, restrict use of Domain Admin credentials to dedicated Privileged Access Workstations, and alert on anomalous remote service creation (Event ID 7045) and ADMIN$ file writes from non-management hosts.

Attack patterns used

The transferable techniques behind this compromise.

AD CS Abuse (ESC1–ESC8)Active Directory · CertificatesT1649

What it is

Active Directory Certificate Services can be abused when certificate templates or the CA are misconfigured. The ESC family (ESC1: enrollee-supplied SAN; ESC8: NTLM relay to the web-enrollment endpoint; etc.) lets an unauthorised user obtain a certificate that authenticates as a higher-privileged user, then use it for Kerberos PKINIT to get that user's TGT.

Why it works

Certificates are long-lived authentication material; a single permissive template (ENROLLEE_SUPPLIES_SUBJECT + client-auth EKU + low enroll rights) is enough to mint an admin identity. Tools certipy/Certify find and exploit these. Remediate per the SpecterOps 'Certified Pre-Owned' guidance.

Read more

Unrestricted File UploadWebT1505.003

What it is

An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.

Why it works

Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.

Read more

Exposed services

53/tcp
80/tcp
88/tcp
135/tcp
139/tcp
389/tcp
445/tcp
464/tcp
593/tcp
636/tcp
3268/tcp
3269/tcp
5985/tcp
9389/tcp
49666/tcp
49691/tcp
49692/tcp
49693/tcp
49711/tcp
49714/tcp
53/udp

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.