Fries is an assume breach Windows box that hides a sprawl of Linux services behind the domain controller. I’ll start with a set of credentials that don’t work anywhere obvious and use them to log into a Gitea instance, recovering database and pgAdmin access along the way. An outdated pgAdmin is vulnerable to a Python eval remote code execution bug that lands a shell in a container. From environment variables and the pgAdmin database I’ll collect more credentials and spray them to get a shell on the Docker host, which is itself a Hyper-V guest. There I’ll abuse a network file share by recreating a domain user locally to read the Docker daemon’s certificates, forge a client certificate, and use the Docker API to mount the host filesystem and become root. Root on that host holds a PWM configuration with an encrypted service account password, which I’ll recover to move into the domain. That account can read a group managed service account password, and from there I’ll abuse control over the certificate authority, chaining three ADCS misconfigurations to forge a certificate for the administrator and take over the domain.

0xdf hacks stuff

A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided credentials that only work on a Gitea instance, the path involves exploiting CVE-2025-2945 (Python eval RCE in pgAdmin 9.1), pivoting through Docker containers, abusing NFS shares by impersonating domain users to steal Docker daemon certificates, forging client certificates to access the Docker API and mount the host filesystem, recovering encrypted PWM service account credentials, reading a group managed service account password, and finally chaining three ADCS misconfigurations to forge an administrator certificate and take over the domain.

HTB: Fries