HackTheBox Logging

This walkthrough of the Hack The Box "Logging" machine demonstrates a multi-stage privilege escalation chain, leveraging GMSA abuse, DLL sideloading, and WSUS poisoning to achieve Domain Admin access 0:00.

Key Takeaways:
• Initial access is gained by incrementing the known password for the Wallace.Everett account from 2025 to 2026 0:31.
• The attacker exploits generic write rights to grant themselves permission to read the password of the MSAHealth$ Group Managed Service Account (GMSA) 14:22.
• Using the GMSA hash, the attacker authenticates as MSAHealth$ and exploits a DLL sideloading vulnerability in a scheduled task to escalate to Jay.Clifton 24:15.
• The attacker leverages ESC17 certificate template abuse to issue a certificate for wsus.logging.htb, enabling them to poison the WSUS server 39:50.
• By configuring DNS to point wsus.logging.htb to their attacker machine and using the wsux tool, they deliver a malicious update that grants local administrator rights to svc-recovery 49:15.
• Finally, the attacker uses psexec with the svc-recovery credentials to gain SYSTEM access and retrieve the root flag 58:40.

This walkthrough highlights the critical importance of auditing GMSA permissions, monitoring for unusual certificate enrollments, and securing WSUS configurations against DNS-based attacks.

Sources:

• 0:31 Password incrementation for initial access
• 14:22 GMSA password read exploitation
• 24:15 DLL