HTB · Cerberus — Three-Headed Privilege Escalation
Chaining an SSRF in a SAML responder with a misconfigured ADCS template for domain admin.
· 9 min read
#htb#ad#saml#adcs
Recon
Standard scan reveals 80/443/445/88. The web app exposes a SAML SSO endpoint that fetches the IdP metadata over HTTP.
Foothold
The metadata fetcher resolves arbitrary hostnames — a classic SSRF. Pointing it at the internal ICPR web enrollment lets us request a certificate.
Privilege escalation
The Cerberus-User template allows enrolleeSuppliesSubject with Client Authentication EKU. Request a cert for Administrator, PKINIT, and obtain the NT hash.
certipy req -u svc -p '...' -ca CERBERUS-CA \
-template Cerberus-User -upn administrator@cerberus.htbNotes
ESC1 is everywhere. Audit msPKI-Certificate-Name-Flag on every template.