#esc4

HTB PingPong Complete Writeup - ESC13, Cross-Domain DACL, gMSA, JEA, RBCD & ESC4→ESC1

PingPong is a HackTheBox Season 10 Insane Windows machine built around a bidirectional forest trust between ping.htb (DC1) and pong.htb (DC2, hidden on 192.168.2.0/24). NTLM is disabled domain-wide - every step is Kerberos-only. The chain begins with ESC13, an ADCS vulnerability where a certificate template's issuance policy is linked to a security group via msDS-OIDToGroupLink, causing the KDC to inject the group's SID into the PAC at PKINIT time. This grants WinRM access without the user being a member of the group. From there, ownership of a cross-domain group (PING\IT owns PONG\gMSA Managers) is abused by converting the group scope to DomainLocal and adding a Foreign Security Principal, enabling ReadGMSAPassword on Pong_gMSA$. The gMSA credentials unlock a restricted JEA endpoint on DC1 that leaks c.carlssen's password from PSReadLine history, giving WinRM access to DC2 and the user flag. Privilege escalation continues through GenericWrite on svc_sql to set RBCD, S4U impersonation to obtain MSSQL sysadmin, SeImpersonatePrivilege via GodPotato to add c.carlssen to DC2 Administrators, DCSync to recover R.Martinelli (a cross-domain CA Manager), and finally ESC4 to write ESC1 conditions onto the SmartcardAuthentication template before PKINIT as [email protected] yields the root flag.