HackTheBox — NanoCorp
Abusing a careers-portal zip upload to leak and crack web_svc's NTLMv2 hash via CVE-2025-24071 / CVE-2025-24054, walking a BloodHound ACL chain to monitoring_svc, then hijacking a vulnerable Checkmk agent's MSI self-repair (CVE-2024-0670) through RunasCs to execute code as SYSTEM.
Overview
NanoCorp is a Hard-rated Windows Active Directory machine built around a careers portal that accepts uploaded application archives. We start by abusing a recent Windows NTLM hash-disclosure flaw (CVE-2025-24071 / CVE-2025-24054) through the zip-upload feature to capture and crack a service account's hash, then walk an Active Directory ACL chain with BloodHound and BloodyAD to move between service accounts, and finish by abusing a vulnerable Checkmk agent's MSI self-repair routine (CVE-2024-0670) to execute code as SYSTEM.
Attack chain: malicious .library-ms zip → Responder captures web_svc NTLMv2 hash → crack with hashcat → BloodHound reveals web_svc –AddSelf→ IT_SUPPORT –ForceChangePassword→ monitoring_svc → WinRM over Kerberos (Protected Users) → enumerate Checkmk agent on port 6556 → CVE-2024-0670 MSI-repair temp-file hijack → SYSTEM