Authority is a Windows domain controller. I’ll access open shares over SMB to find some Ansible playbooks. I’ll crack some encrypted fields to get credentials for a PWM instance. The PWM instance is in configuration mode, and I’ll use that to have it try to authenticate to my box over LDAP with plain text credentials. With those creds, I’ll enumerate active directory certificate services to find they are vulnerable to ESC1, with a twist. Rather than any user being able to enroll with the template, it’s any domain computer. I’ll add a fake computer to the domain and use that to get a certificate for the DC. That certificate doesn’t work directly, but I can use a pass-the-cert attack to dumb hashes and get access as administrator.

0xdf hacks stuff

Authority is a Windows domain controller that has open TCP ports, including SMB, DNS, HTTP, and HTTPS. The article discusses the enumeration of SMB and DNS, as well as finding Ansible playbooks in the Development share. It also explores the PWM instance running on TCP port 8443 and the vulnerability of ADCS to ESC1. The article provides steps to extract LDAP credentials and perform a PassTheCert attack to escalate privileges on the domain controller.

HTB: Authority