--- title: "HTB: Fries" url: https://daily.dev/posts/htb-fries-dvgyizfpy source_url: https://0xdf.gitlab.io/2026/07/25/htb-fries.html type: article source: "0xdf hacks stuff" published: 2026-07-25T15:11:45.099Z updated: 2026-07-25T15:21:26.938Z tags: ["security", "docker", "active-directory"] reading_time: 61 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: Fries **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 61 min read · 0 upvotes · 0 comments ## Summary A detailed walkthrough of HackTheBox's 'Fries' machine, an assume-breach Windows Active Directory box with a complex attack chain. Starting with provided credentials that only work on a Gitea instance, the path involves exploiting CVE-2025-2945 (Python eval RCE in pgAdmin 9.1), pivoting through Docker containers, abusing NFS shares by impersonating domain users to steal Docker daemon certificates, forging client certificates to access the Docker API and mount the host filesystem, recovering encrypted PWM service account credentials, reading a group managed service account password, and finally chaining three ADCS misconfigurations to forge an administrator certificate and take over the domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB: HackNet](https://daily.dev/posts/htb-hacknet-ytv8gsdvp) · 0xdf hacks stuff · 0 upvotes · 0 comments - [HTB: Browsed](https://daily.dev/posts/htb-browsed-lodgcpqoh) · 0xdf hacks stuff · 0 upvotes · 0 comments - [HTB: Eighteen](https://daily.dev/posts/htb-eighteen-zmjitbdjn) · 0xdf hacks stuff · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#active-directory](https://daily.dev/tags/active-directory) [View this post on daily.dev](https://daily.dev/posts/htb-fries-dvgyizfpy)