HackTheBox - Fluffy

BLUF: This video walks through the "Fluffy" Hack the Box machine, demonstrating that outdated tools can hinder progress on "easy" boxes due to new vulnerabilities like ESC16, while detailing an initial foothold via a CVE-based SMB exploit 0:00.

Key Takeaways:
• The attacker uses a specially crafted zip file to exploit a Windows SMB vulnerability, triggering an automatic login that captures NTLMv2 hashes for cracking 0:31.
• After cracking credentials, the attacker gains "Service Account Managers" rights, allowing them to add shadow credentials to service accounts for lateral movement 0:29.
• The final privilege escalation relies on the ESC16 vulnerability in ADCS, which requires a recent version of Certipy to detect and exploit the weak security extension mapping 0:07.

Success in modern AD pentesting depends on maintaining updated tooling to identify emerging certificate exploits and leveraging initial footholds for precise privilege escalation paths.

Sources:

• 0:00 Introduction to Fluffy HTB and the impact of tool updates on detecting ESC16.
• 0:31 Execution of the SMB exploit to capture NTLMv2 hashes.
• 0:29 Leveraging Service Account Managers rights for shadow credential attacks.
• 0:07 Explanation of ESC16 and the necessity of updated Certipy versions.