https://z3r0s6.github.io/tags/esc13/Recent content in ESC13 on z3r0sHugoenSun, 19 Apr 2026 00:00:00 +0000https://z3r0s6.github.io/machines/pingpong/Sun, 19 Apr 2026 00:00:00 +0000https://z3r0s6.github.io/machines/pingpong/<p><strong>Difficulty:</strong> Insane<br> <strong>OS:</strong> Windows<br> <strong>Points:</strong> 50<br> <strong>Release:</strong> 2026-04-27<br> <strong>Starting Creds:</strong> <code>c.roberts / AssumedBreach123</code></p> <hr> <h2 id="attack-chain"> Attack Chain <a class="heading-link" href="#attack-chain"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <pre tabindex="0"><code>c.roberts (PING.HTB) → ESC13 (TemporaryWinRM) → PKINIT TGT + TempWinRMAccess SID → WinRM on DC1 → Ligolo-ng tunnel → DC2 reachable (192.168.2.2) → WriteDACL on gMSA Managers (PONG) → GenericAll → scope flip (Global→Universal→DomainLocal) → Add cross-forest FSP → ReadGMSAPassword → Pong_gMSA$ NTLM/AES → JEA endpoint on DC1 (restricted) → PSReadLine history → c.carlssen / A()DUJ!@414 → WinRM on DC2 → user.txt → c.carlssen GenericWrite on svc_sql → RBCD (Pong_gMSA$ → svc_sql) → S4U2Proxy impersonate c.adam → MSSQL xp_cmdshell → local admin on DC2 → c.carlssen → Domain Admins (PONG) → DCSync → R.Martinelli → R.Martinelli ∈ CA Managers (PING) → ESC4 on SmartcardAuthentication → ESC1 → cert for Administrator@ping.htb → PKINIT → root.txt on DC1 </code></pre><hr> <h2 id="recon"> Recon <a class="heading-link" href="#recon"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>Classic Windows DC port profile: <code>53, 88, 135, 389, 445, 464, 636, 3268, 3269, 5985, 9389</code></p>