Puppet

Author: 0xIDA

Summary

HTB/VulnLab mini pro-lab: internal Sliver multiplayer C2, Windows FILE01 foothold → PrintNightmare/UAC SYSTEM → LSA secret for Puppet service account → DC it share SSH key → PM01 root via Puppet → DC01 SYSTEM + SharpDPAPI on Task Scheduler credential for domain user root (final flag). Four flags: Sleep, Nightmare, Dance, Puppet Master.

Solution

1. Entry — FTP + Sliver multiplayer

VPN: mini pro-lab OVPN. Gateway 10.13.38.33 exposes anonymous FTP with sliver-client_linux + multiplayer config, and mTLS C2 on 31337/8443.

socat TCP-LISTEN:31337,reuseaddr,fork,bind=127.0.0.1 TCP:10.13.38.33:31337
./sliver-client_linux

Live FILE01 beacon as bruce.smith → Flag Sleep.

2. SYSTEM on FILE01 — Nightmare

PrintNightmare adds local adm1n. UAC/fodhelper or schtasks for durable SYSTEM. Administrator/Public loot → Flag Nightmare. Dump SAM/SYSTEM/SECURITY; secretsdump recovers svc_puppet_win_t1 from LSA.

3. PM01 — Dance

As svc_puppet_win_t1, mount \\DC01\it, take SSH key (passphrase puppet). Sliver SSH to svc_puppet_lin_t1@puppet.vl on PM01 → sudo puppet / SUID → Flag Dance in /root/flag.txt.

4. DC01 — Puppet Master

svc_puppet_win_t1 has SCManager + C$ on DC01. Stage SharpDPAPI and run as SYSTEM:

PsExec64 \\172.16.40.5 -accepteula -s cmd /c "SharpDPAPI.exe machinetriage > C:\Windows\Temp\sdp_out.txt"

Decrypts Task Scheduler credential for PUPPET\root → final flag.

Flags

Sleep:         PUPPET{1c1740d66f707111a911e5f6a96d7d36}
Nightmare:     PUPPET{3b3072985c0759f048842861ef5aac55}
Dance:         PUPPET{c093652c9a73eaee0b43e039a04eff77}
Puppet Master: PUPPET{8b6626457fbee7a7e2b74a2aa6754aa9}

Solvers

Tools

Sliver, PrintNightmare/fodhelper, impacket-secretsdump, PsExec, SSH, Puppet, SharpDPAPI