HackTheBox - Scepter
Source: YouTube · IppSec · published Jul 19, 2025 · 1:07:24
This video demonstrates an ESC14 Active Directory Certificate Services attack on the Hack The Box "Scepter" machine, detailing how to chain NFS enumeration, certificate cracking, and LDAP attribute manipulation to achieve domain admin access 0:05.
Key Takeaways:
• Initial access is gained by mounting an NFS share to retrieve encrypted user certificates, which are then cracked using Hashcat to reveal credentials 0:13
• Certify identifies a false positive for ESC9 because the certificate template lacks the UPN flag, necessitating a shift to ESC14 exploitation via alternate security identities 0:22
• BloodHound reveals a path to Generic All over a user, while LDAP queries uncover a user with an alternate security identity configured as an email address 0:31
• ESC14 is executed by assigning the target's email to your own account, requesting a certificate, and authenticating as the impersonated user 0:39
• The attack chain continues by leveraging new permissions to modify another user's alternate security identity, eventually leading to DC Sync and domain admin access 0:44
The walkthrough highlights that complex ADCS attacks often require chaining multiple techniques and careful enumeration to uncover non-obvious vulnerabilities.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This IPS me doing scepter from hack the box which I think does a great job showcasing the ESC14 active directory certificate services attack because it is relatively well hidden. But in order to get credentials to start looking at ADCS, we first discover an NFS server is running on Windows which has some encrypted user certificates. Once cracked, we can build our own certificate that gives us the authenticated user privilege but no shell. If we ran certify here, it shows it is vulnerable to ESC9, but that's a false positive as UPN aren't enabled for this certificate template. Looking at Blood Hound, we discover a path that grants us generic all over a user and another user has an alternate security identity set as an email. So, we can assign ourselves their email a…