From User to Domain Admin Explained | HackTheBox TombWatcher Writeup

One forgotten AD cert and an old deleted account can hand an attacker the whole domain.

In the recently retired HTB box called TombWatcher, I started from a normal user and followed trust relationships inside Active Directory.

I run BloodHound to map an attack path that chains targeted Kerberoasting, a GMSA read, ForceChangePassword, and a shadow-credential. That path gives us access to the AD Recycle Bin, where we can recover an old ADCS admin account , then reuse that account to complete the ESC15 chain and escalate to Administrator.

Walkthrough Summary

Starting point / creds & target : HTB provides henry:H3nry_987TGV! as initial credentials; the host is a Windows DC (DC01.tombwatcher.htb) with typical AD/DC ports (LDAP, Kerberos, SMB, WinRM, etc.).

Recon → focus : nmap + web content confirmed an IIS site and AD services; author prioritises web/SMB/BloodHound and ADCS enumeration (AD attack surface).

BloodHound path / privilege abuse : BloodHound showed a path where sam has WriteOwner over john; the author sets sam as owner of john and grants GenericAll so sam can manipulate john (password, credentials, or Kerberoast).

Shadow-credential (cert-based) escalation to user shell : Using bloodyAD to change owner + certipy shadow auto the author injects a KeyCredential for john, authenticates with that cert, obtains a TGT and extracts John’s NT hash , then uses that hash to get an Evil-WinRM shell and capture user.txt.

AD Recycle Bin recovery → old ADCS admin : The environment has the AD Recycle Bin enabled; the author enumerates deleted objects, finds multiple cert_admin deleted entries in the OU=ADCS, and recovers the old cert_admin account.

ESC15 (CVE-2024-49019) abuse → domain compromise : The CA is vulnerable to ESC15 (aka “EKUwu” / CVE-2024-49019). By exploiting this the author crafts a malicious cert (injects Application Policies / agent attributes), obtains an Administrator certificate, authenticates with it (certipy) to get a TGT and the Administrator NT hash , then uses that hash to WinRM as Administrator and read root.txt.