--- title: HTB: Fries | daily.dev description: A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided... canonical: https://daily.dev/posts/htb-fries-dvgyizfpy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HTB: Fries | daily.dev og:description: A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided... og:url: https://daily.dev/posts/htb-fries-dvgyizfpy og:image: https://api.daily.dev/og/posts/DvGyIzfPY.png og:image:alt: HTB: Fries og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: Fries **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 61 min read · 0 upvotes · 0 comments ## Summary A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided credentials that only work on a Gitea instance, the path involves exploiting CVE-2025-2945 (Python eval RCE in pgAdmin 9.1), pivoting through Docker containers, abusing NFS shares by impersonating domain users to steal Docker daemon certificates, forging client certificates to access the Docker API and mount the host filesystem, recovering encrypted PWM service account credentials, reading a group managed service account password, and finally chaining three ADCS misconfigurations to forge an administrator certificate and take over the domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB: HackNet](https://daily.dev/posts/htb-hacknet-ytv8gsdvp) · 0xdf hacks stuff · 0 upvotes · 0 comments - [HTB: Browsed](https://daily.dev/posts/htb-browsed-lodgcpqoh) · 0xdf hacks stuff · 0 upvotes · 0 comments - [Data Retired Box from Hackthebox](https://daily.dev/posts/data-retired-box-from-hackthebox-aatyuxn7y) · InfoSec Write-ups · 1 upvotes · 0 comments - [HTB: Eighteen](https://daily.dev/posts/htb-eighteen-zmjitbdjn) · 0xdf hacks stuff · 0 upvotes · 0 comments - [CodePartTwo HTB Walkthrough](https://daily.dev/posts/codeparttwo-htb-walkthrough-gzwjbhyde) · InfoSec Write-ups · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#active-directory](https://daily.dev/tags/active-directory) [View this post on daily.dev](https://daily.dev/posts/htb-fries-dvgyizfpy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HTB: Fries","url":"https://daily.dev/posts/htb-fries-dvgyizfpy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/htb-fries-dvgyizfpy"},"datePublished":"2026-07-25T15:11:45.099Z","dateModified":"2026-07-25T15:21:26.938Z","description":"A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"0xdf hacks stuff","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"0xdf hacks stuff","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/16cdada70d5f4fac8b588c53bcf005ff","url":"https://daily.dev/sources/0xdf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/htb-fries-dvgyizfpy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker,active-directory","timeRequired":"PT61M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"0xdf hacks stuff","item":"https://daily.dev/sources/0xdf"},{"@type":"ListItem","position":3,"name":"HTB: Fries"}]} ```