I just solved Fries from Hack the Box
Fries Machine Summary
Fries is a hard-difficulty Windows machine on Hack The Box that combines web enumeration, credential discovery, container abuse, NFS misconfiguration, Docker API exploitation, LDAP credential capture, Active Directory enumeration, gMSA abuse, and AD CS privilege escalation. The machine starts with a broad external attack surface, where Nmap enumeration reveals services such as SSH, DNS, HTTP/HTTPS, Kerberos, LDAP, SMB, WinRM, and Active Directory-related ports, confirming that the target is part of the fries.htb domain.
After adding the discovered hostnames to /etc/hosts, I performed time synchronization with the domain controller to avoid Kerberos-related issues later in the attack chain. The initial credentials provided with the machine did not work over SSH, so I shifted focus to web enumeration. Subdomain fuzzing revealed code.fries.htb, which hosted a Gitea instance. Using the provided credentials, I authenticated to Gitea and began reviewing repositories and commits. During Gitea commit enumeration, I discovered sensitive information inside previous commits, including PostgreSQL database credentials, a secret key, and a reference to another internal subdomain: db-mgmt05.fries.htb. After resolving this hostname locally, I accessed the PgAdmin portal and authenticated using the machine-provided credentials. From there, I connected to the PostgreSQL server using the database password recovered from Gitea.
Inside PgAdmin, I performed database enumeration and confirmed that PostgreSQL had dangerous capabilities enabled. I used PostgreSQL file system enumeration with pg_ls_dir('/') to list the container’s root directory and then tested file read access using pg_read_file('/etc/passwd'). After confirming access, I created a command output table and used COPY FROM PROGRAM to test command execution by running id, which showed that commands were being executed as the postgres user. With command execution confirmed, I used COPY FROM PROGRAM to obtain a reverse shell from the PostgreSQL container. I then upgraded the shell for better interactivity. In parallel, I also exploited an authenticated PgAdmin RCE vulnerability using Metasploit, which gave me a Meterpreter session as the pgadmin user. Post-exploitation enumeration inside the PgAdmin container exposed environment variables containing the PgAdmin default administrator credentials.
I reused the recovered password against a small list of possible SSH usernames and found valid SSH access as the svc user. After logging in, I enumerated local services and discovered an NFS export at /srv/web.fries.htb. I then established an internal network pivot using sshuttle, allowing my Kali machine to access internal services through the compromised host. To interact with the NFS export from my machine, I installed the required FUSE and NFS tooling, configured /etc/fuse.conf to allow user_allow_other, and mounted the exported share locally. NFS share enumeration revealed directories such as certs, shared, and webroot. The certs directory contained CA and server certificate material, including the CA private key, which created a certificate abuse opportunity.
Using the exposed CA key, I generated and signed a new client certificate with CN=root. I then created an SSH local port forward to access the Docker API listening on 127.0.0.1:2376 on the target. After installing the Docker client locally, I authenticated to the Docker API using the forged certificate and listed the running containers. This confirmed access to containers including pwm, pgadmin4, web, postgres, and gitea. I entered the PWM container and enumerated its configuration file, PwmConfiguration.xml. The configuration showed that PWM was using LDAP over LDAPS to communicate with dc01.fries.htb and referenced the service account svc_infra. I modified the LDAP server URL in the configuration to point to my attacker machine and started Responder on my VPN interface. When PWM attempted to authenticate, Responder captured the LDAP credentials for CN=svc_infra,CN=Users,DC=fries,DC=htb.
After validating the captured svc_infra credentials with LDAP, I used BloodHound to perform Active Directory enumeration. BloodHound revealed that svc_infra had ReadGMSAPassword permissions over the managed service account GMSA_CA_PROD$. Using bloodyAD, I retrieved the msDS-ManagedPassword attribute and extracted the NTLM hash for the gMSA account. I then authenticated over WinRM as GMSA_CA_PROD$, confirming that the account had remote access. With the gMSA foothold, I moved into AD CS enumeration using Certipy. Certipy identified the domain certificate authority fries-DC01-CA and revealed vulnerable certificate configurations, including ESC7, ESC6, and ESC16-related weaknesses. I requested certificates through AD CS and eventually authenticated using the generated certificate material. Certipy returned the NTLM hash for the domain Administrator account.
Finally, I used Evil-WinRM with the Administrator NTLM hash to authenticate to the domain controller. This gave me full administrative access to the machine. From the Administrator desktop, I retrieved both root.txt and user.txt, completing the Fries machine. Overall, Fries demonstrates a realistic chained attack path involving web credential leakage, database command execution, container escape-style abuse, NFS certificate exposure, Docker API access, LDAP credential capture, gMSA password retrieval, and AD CS-based domain privilege escalation.
Protected Page
c
d
e
f
Keywords:
Fries - HackTheBox
Fries (Hard) | Hack The Box
fries.htb
Mastering Fries: Beginner's Guide from HackTheBox
Hack The Box: Fries Machine Walkthrough
Fries - HackTheBox Walkthrough
Fries HTB Write Up Premium
db-mgmt05.fries.htb
code.fries.htb
Hack The Box - Season 9 HTB Fries Writeup
Hack The Box: Fries (Full Walkthrough)
Fries HTB Writeup
HTB Walkthrough - Fries machine
I just solved Fries from Hack The Box
Pwned Fries from Hack The Box
Owned Fries from Hack The Box!
Hack The Box CTF Walkthrough - Fries
Fries HTB - Capture The Flag - Hack The Box
0 Comments