This document provides a detailed walkthrough for the Mirage HTB machine. The exploitation path involves NFS enumeration, DNS hijacking to intercept NATS credentials, Kerberoasting, and a sophisticated Active Directory certificate abuse (ESC10) to achieve full domain compromise.
1. Initial Reconnaissance
1.1. Port Scanning
We begin with a standard nmap scan to identify open ports and running services.
nmap -p- -sV -sC 10.10.11.78
The scan reveals typical Active Directory services (Kerberos, DNS, LDAP) and an interesting, less common service on port 4222, identified as NATS.
We discover the domain names mirage.htb and dc01.mirage.htb. Let's add them to our /etc/hosts file.
echo "10.10.11.78 dc01.mirage.htb mirage.htb" | sudo tee -a /etc/hosts