Machine Synopsis

`Fries` is a hard Windows machine that combines web exploitation, container abuse, network file system misconfigurations, and Active Directory Certificate Services (`ADCS`) attacks. Initial access is achieved through a `Gitea` source code repository discovered via subdomain enumeration. Exposed credentials lead to a `pgAdmin` instance vulnerable to CVE-2025-2945, resulting in remote code execution inside a Docker container. Enumeration of the container reveals credentials that provide `SSH` access to the underlying Linux host. Further enumeration reveals an insecure `NFS`, which is abused through a combined `UID` and `GID` confusion attack to gain access to `Docker certificates`. These certificates are leveraged to authenticate to the Docker daemon as a privileged client, allowing a container to be launched with the host filesystem mounted and granting full access to the host. Analysis of a `PWM` configuration file exposes a password hash, which is cracked offline to gain administrative access to the `PWM` interface. By leveraging `LDAP` configuration settings, cleartext domain credentials are captured via `Responder`. Active Directory enumeration reveals the ability to read a Group Managed Service Account (`gMSA`) password, which is used to enumerate `ADCS`. Misconfigured certificate authority permissions allow abuse of `ESC7` to modify `CA` policy and enable user-supplied Subject Alternative Names, leading to `ESC6`. A forged certificate for the domain Administrator is requested and used to grant `DCSync` privileges, allowing the NTDS database to be dumped. Finally, extracting the Administrator’s `NTLM` hash allows access as the `Administrator`.