dreadnaught- Machine
- Fries
- OS
- Windows
- Difficulty
- Hard
- Steps
- 5
- Added
- 22 Nov 2025
Git-history DB creds lead to a pgAdmin RCE; NFS GID spoofing steals a Docker CA for a host escape, and PWM-captured creds drive an AD CS ESC6/ESC7 path to domain admin.
How it went
- 0nmap
nmap shows an AD DC behind an nginx proxy with Gitea, PWM, and pgAdmin vhosts.
- 1pgAdmin RCE
Gitea email login exposes DB creds in .git history, and pgAdmin 9.1.0 falls to an eval() RCE (CVE-2025-2945) in a container.
- 2svc + NFS
A pgAdmin env password sprays to SSH as svc; NFS AUTH_SYS GID spoofing reads the Docker CA private key.
- 3Docker cert
A forged CN=root Docker client cert starts a privileged container that mounts the host, giving root on the host and its SSH key.
- 4svc_infra
A cracked PWM config hash plus an LDAP-redirect health check capture svc_infra, which reads the gMSA_CA_prod$ password.
- 5AD CS ESC6/7
The gMSA abuses AD CS ManageCa (ESC7) and EDITF (ESC6) to mint an admin-UPN cert; PassTheCert over Schannel takes domain admin.