Fluffy HTB
FLUFFY Target Overview Fluffy is a Windows Active Directory machine that focuses heavily on SMB enumeration, NTLM hash capture, delegated Active Directory permissions, and AD CS abuse. The attack chain began with valid domain credentials that allowed access to an internal SMB share. Inside the share, an upgrade notice revealed multiple vulnerable applications and CVEs. Researching CVE-2025-24071 led to a Windows File Explorer spoofing attack that was used to trigger outbound SMB authentication and capture an NTLMv2 hash using Responder. After cracking the captured hash, additional domain credentials were obtained and used for BloodHound enumeration. BloodHound revealed a privilege escalation path involving nested group memberships and delegated GenericWrite permissions over multiple service accounts. These permissions were abused using Shadow Credentials attacks with Certipy to recover NTLM hashes for several privileged service accounts. Access as winrm_svc provided an authenticated WinRM shell on the target system. Further AD CS enumeration revealed that the Certificate Authority was vulnerable to ESC16, allowing certificate-based impersonation attacks due to disabled SID security extensions. By temporarily modifying the ca_svc account’s UPN to impersonate administrator, a forged certificate was issued and later used to authenticate as the Domain Administrator. Finally, Pass-the-Hash authentication with PsExec resulted in full SYSTEM-level compromise of the Domain Controller. Machine Information As is common in real life Windows pentests, you will start the Fluffy box with credentials for the following account: j.fleischman / J0elTHEM4n1990! Attack Path Enumerate SMB shares using provided credentials Discover vulnerable software references Exploit CVE-2025-24071 to capture NTLM hash Crack credentials and enumerate AD with BloodHound Abuse GenericWrite using Shadow Credentials Obtain service account hashes Access host via WinRM Exploit ESC16 in AD CS Impersonate Administrator Gain SYSTEM access on the Domain Controller Enumeration Nmap Scans Analyzing the Nmap Scan From the Nmap results, the domain name dc01.fluffy.htb ,fluffy.htb was identified. The scan also indicated a noticeable clock skew, which can cause authentication-related issues, especially in Active Directory environments. Because of this, synchronizing the local system time with the target became necessary before proceeding further. Adding the Domain to /etc/hosts To ensure proper hostname resolution, the discovered domain was added to the local /etc/hosts file: This allows the system to correctly resolve the hostname while interacting with the target services and web applications. At this stage, it was assumed that the environment had already been partially compromised, and valid credentials were provided as part of the assessment scope: These credentials would be used during the next stages of enumeration and authentication testing. SMB Enumeration with NetExec Using the provided credentials, SMB authentication against the target was tested using NetExec (nxc): The authentication was successful, confirming that the provided credentials were valid for the fluffy.htb domain. Since SMB port 445 was accessible, the next step was to enumerate available network shares and identify any accessible resources. Enumerating SMB Shares The enumeration results revealed that the user had READ and WRITE permissions on the IT share. Since writable shares can often expose sensitive files, scripts, credentials, or opportunities for lateral movement, the next step was to inspect the contents of the IT share. Connecting to the SMB Share After identifying that the IT share was accessible with READ and WRITE permissions, the next step was to connect to the share using smbclient and inspect its contents. A successful connection confirmed that the credentials had sufficient access to interact with the share. Dumping Files from the SMB Share Once connected, the available files and directories inside the share were enumerated: The share contained several interesting files, including: KeePass Everything Search An upgrade notice PDF Since writable or internal IT shares often contain useful documentation, configuration files, or credentials, all files were recursively downloaded for offline analysis. The following commands were used to disable interactive prompts, enable recursive downloading, and retrieve all files from the share: Reviewing the Upgrade Notice While analyzing the files retrieved from the IT share, the Upgrade_Notice.pdf document appeared particularly interesting. After opening the PDF, it revealed that the organization had recently performed a vulnerability assessment and identified several applications requiring updates and security patches. image The document referenced multiple vulnerable software versions and associated CVEs. Since outdated internal software can often provide a direct path to exploitation, the next step was to research the listed vulnerabilities and determine whether any publicly available exploits could be leveraged against the target environment. The upgrade notice referenced multiple vulnerabilities affecting different applications and services within the environment. | CVE ID | Severity | Description | |----------|----------|----------| | CVE-2025-24996 | Critical | NTLM Hash Disclosure Spoofing Vulnerability | | CVE-2025-24071 | Critical | Windows File Explorer Spoofing Vulnerability | | CVE-2025-46785 | High | Zoom Meeting SDK Denial of Service Vulnerability | | CVE-2025-29968 | High | Windows Server 2008 AD CS Denial of Service Vulnerability | | CVE-2025-21193 | High | Active Directory Federation Services Spoofing Vulnerability | | CVE-2025-3445 | Low | mholt/archiver Zip Slip Path Traversal Vulnerability | Among these, the most interesting vulnerabilities from an offensive perspective were the NTLM disclosure and spoofing-related issues, as they could potentially be abused to capture authentication material or trigger outbound authentication attempts from the target system. The next step was to research these vulnerabilities further and determine whether any of them could be leveraged within the current environment. Researching CVE-2025-24071 Among the vulnerabilities listed in the upgrade notice, CVE-2025-24071 appeared especially interesting because it could potentially be abused to trigger outbound SMB authentication requests and leak NTLM hashes. A public Proof-of-Concept (PoC) exploit was available on GitHub: The repository was cloned locally for further analysis: --- Understanding the Vulnerability CVE-2025-24071 is a Windows File Explorer Spoofing Vulnerability caused by the way Windows automatically processes .library-ms files. The vulnerability abuses implicit trust behavior in Windows Explorer. By crafting a malicious .library-ms file containing an attacker-controlled SMB path and packaging it inside a ZIP archive, it becomes possible to trigger automatic SMB authentication attempts from the victim system. When the victim extracts or interacts with the archive, Windows attempts to access the remote SMB share, which can leak the victim’s NTLM hash to the attacker-controlled server. This makes the vulnerability particularly useful in Active Directory environments where captured NTLM authentication material can later be cracked or relayed. --- Generating the Malicious Archive The provided PoC was used to generate a malicious ZIP archive targeting the attacker machine: The exploit successfully generated a malicious ZIP archive named exploit.zip, which would later be used to trigger outbound SMB authentication from the target environment. Starting Responder Since the vulnerability was designed to trigger outbound SMB authentication requests, the next step was to start Responder and listen for incoming NTLM authentication attempts from the target environment. Responder was configured on the VPN interface (tun0) to capture any NTLM hashes sent back by the victim system. Responder was now actively waiting for inbound authentication requests. --- Uploading the Malicious ZIP Archive The malicious exploit.zip archive generated earlier was uploaded to the writable IT SMB share. The idea behind this step was that if a user browsed, extracted, or interacted with the archive, Windows Explorer would automatically process the embedded .library-ms file and initiate an outbound SMB authentication request to the attacker-controlled system. The file was uploaded using smbclient: Once uploaded, the next step was simply to wait for a user or automated process to interact with the malicious archive. Capturing the NTLMv2 Hash After a few minutes, Responder successfully captured an inbound NTLMv2 authentication request from the target system: This confirmed that the vulnerability had been successfully exploited and that the target system initiated SMB authentication to the attacker-controlled host, leaking the NTLMv2 authentication material for the user p.agila. The captured hash could now potentially be cracked offline or used in relay-based attacks. Cracking the Captured NTLMv2 Hash After successfully capturing the NTLMv2 authentication material using Responder, the next step was to attempt offline password cracking in order to recover valid credentials for the user p.agila. The captured hash was first saved into a file: Since the captured material was an NTLMv2 hash, Hashcat mode 5600 was used along with the rockyou.txt wordlist to perform an offline dictionary attack. --- Cracking the Hash with Hashcat The hash was successfully cracked, revealing the password: p.agila : prometheusx-303 At this point, valid credentials for another domain user had been recovered, opening additional opportunities for lateral movement and further Active Directory enumeration. Validating the Recovered Credentials After cracking the NTLMv2 hash, the recovered credentials were validated against the domain using NetExec: The authentication succeeded, confirming that the credentials were valid. However, the account did not display a Pwned! status in Nxc, indicating that the user likely did not possess local administrator privileges or direct remote execution rights on the target system. Since valid domain credentials had now been obtained, the next logical step was to perform Active Directory enumeration using BloodHound to identify privilege escalation paths, delegated permissions, group memberships, or other attack paths that could lead to higher privileges within the domain. BloodHound Enumeration Since the recovered credentials did not provide immediate administrative access, the next step was to perform Active Directory enumeration using BloodHound to identify possible privilege escalation paths within the domain. NetExec was used to automatically collect BloodHound-compatible data from the domain: The collected ZIP archive was then imported into BloodHound for graph-based analysis. --- Analyzing BloodHound Relationships After importing the data into BloodHound, several interesting relationships were identified: image The graph revealed the following privilege chain: p.agila is a member of the SERVICE ACCOUNT MANAGERS group SERVICE ACCOUNT MANAGERS has GenericAll privileges over the SERVICE ACCOUNTS group SERVICE ACCOUNTS has GenericWrite permissions over the WINRM_SVC account This was an important finding because: GenericAll allows full control over an object GenericWrite allows modification of specific attributes on the target object Together, these delegated permissions suggested a potential path to compromise the WINRM_SVC account by abusing Active Directory object control permissions. Abusing Group Permissions Based on the BloodHound analysis, the p.agila user was a member of the SERVICE ACCOUNT MANAGERS group, which had elevated control over the SERVICE ACCOUNTS group. To inherit the delegated permissions assigned to the SERVICE ACCOUNTS group, the p.agila account was added as a member: At this point, p.agila inheri