JobApplicant

Scenario

JobApplicant is a lab that covers the compromise of a web application portal through configuration abuse, allowing a PDF file to behave as a script and act as a webshell. The attacker uses this webshell for data exfiltration and initial access to the domain controller, performs Kerberoasting against a service account, exploits dangerous write rights over an AD CS certificate template (ESC4), retrieves a certificate and the NTLM hash of a high-privilege user, conducts a DCSync attack, and creates a Golden Ticket for persistence before cleaning up all operation artifacts. Players will start by investigating the IIS access log, progress through file system records, and then correlate findings with the Security event log to reconstruct the full attack chain.

Executive Summary

An external host scanned a college’s resume-upload portal, then uploaded a PDF and a web.config that told IIS to run PDFs as server-side script, turning the resume into a webshell. Through it the attacker dropped a remote-access binary, pulled files from the resume reviewers’ share and learned who the company wanted to hire. From the foothold they Kerberoasted a certificate authority service account, uploaded Certipy and rewrote the ACL of a certificate template (ESC4) so any authenticated user could enrol, then requested a certificate as Administrator and turned it into an NTLM hash. With that identity they ran DCSync, minted a Golden Ticket for krbtgt, and finally used the webshell to delete every tool they had dropped. The IIS log, the NTFS MFT and USN journal, and the Security event log line up on the same UTC clock and tell the whole story.

Artifacts

• IIS logs: u_ex250723.log to u_ex250727.log → read with grep and Python. W3C format, UTC
• $MFT: parsed with MFTECmd. Gives creation times, parent paths and resident file content
• $J (USN journal): parsed with MFTECmd. Per-file create, extend, close and delete records
• Security.evtx: parsed with EvtxECmd to CSV. Kerberos (4768/4769), AD CS (4886/4887/4898/4900) and directory access (4662) events

Timestamp note: IIS, USN and the Security log are all UTC and agree with each other, so no conversion is needed. Every time question uses YYYY-MM-DD hh:mm:ss.

Initial Access

Read the IIS logs for the days before the incident first to learn what normal traffic looks like, then move to u_ex250727.log. One external address starts hitting the site with GET /index.aspx requests that return 404, which is scanning, and its first row is the earliest attacker contact.

grep -v '^#' u_ex250727.log | awk '{print $1,$2,$9,$10,$11}' | head

The source in the first row from Q1 accounts for 11,784 requests in the day’s log, all with the same Firefox on Linux user agent. That volume of probing against one site is the reconnaissance source.

grep -v '^#' u_ex250727.log | awk '{print $9}' | sort | uniq -c | sort -rn | head

Filter the attacker IP for POST requests to the upload page, then confirm the stored name on disk. Parse $MFT and $J with MFTECmd and look for creates under wwwroot\resumes. A PDF with a GUID appended to the original name is created at 19:28:29, just after the upload POST.

MFTECmd -f '$J' --csv work/usn

grep -i 'resumes' work/usn/*.csv | grep -i FileCreate | grep '2025-07-27 19:2'

A second upload POST lands at 19:28:18, and after it the stored PDF from Q3 is requested and executes as script instead of being served as a document. IIS only changes handler mappings per directory through a configuration file, and a web.config.lnk in the Recent folder points the same way.

grep -i 'web.config' work/usn/*.csv

Execution

After the webshell is live, new executables appear in the same upload folder. The USN journal shows an .exe created at 19:35:58, and its name matches the del= parameter the attacker sends to the shell during cleanup (see Q19), which ties the two together.

grep -iE '\.exe' work/usn/*.csv | grep FileCreate | grep '2025-07-27 19:3'

Tip: The name column in the journal has no path. Pair it with the parent path from the MFT to get the full drive-letter path.

Collection

The webshell takes a get= parameter to read files. The first request carrying it, at 19:34:23, names a certificate file in the reviewers’ share.

grep -E 'get=' u_ex250727.log | head -3

The reviewers’ share holds an ideal candidates.txt file. It is small enough to be resident in its MFT record, so the content is in the $MFT itself. MFTECmd left the resident data column empty, so the raw record has to be read directly. The name is split by the update-sequence bytes at each sector boundary, so apply the fixup array before reading the text.

MFTECmd -f '$MFT' --csv work/mft

# python3 -I: apply USA fixup to the record, then read the resident $DATA
rec = bytearray(mft[off:off+1024])
usa_off, usa_n = struct.unpack_from('<HH', rec, 4)
for i in range(1, usa_n):
    rec[i*512-2:i*512] = rec[usa_off+2*i:usa_off+2*i+2]

Gotcha: Without the fixup the first line comes out with two bytes of garbage in the middle of a word and looks like a different name.

Credential Access

The USN journal shows a short-named executable created at 19:40:14, and a roasted.txt file appears at 19:40:39, 25 seconds later. That output file in the same folder is the Kerberoast hash dump, so the executable that preceded it is the roasting tool.

grep -iE 'r\.exe|roasted' work/usn/*.csv | grep -i FileCreate

Parse Security.evtx with EvtxECmd and look at Kerberos service ticket requests (event 4769) at the time of Q8. At 19:40:39, the same moment roasted.txt appears, the web server’s service account requests a ticket for the CA service account.

EvtxECmd -d work/ev --csv work/evtx

grep ',4769,' work/evtx/*.csv | grep '2025-07-27 19:40'

Gotcha: The format mask is domain-qualified (DOMAIN.edu\account). Take the domain from the account fields in the event and keep the capitalisation HTB expects.

Privilege Escalation

Search the USN journal for the Certipy binary. It has a FileCreate record at 19:51:32, but that is the empty file being allocated. The write finishes with a DataExtend | FileCreate | Close record at 19:52:03, and that is the moment the tool exists in full.

grep -i 'Certipy.exe' work/usn/*.csv

Gotcha: The first FileCreate record is not the answer. “Successfully created” is the closing record, once the upload has finished writing.

Pull the AD CS events from the Security log after Certipy lands. Event 4900 (certificate template security was updated) fires at 19:56:38 for the template being modified, which is the ESC4 step: the attacker rewrote the template so it could then be abused for enrolment.

grep -E ',(4886|4887|4898|4900),' work/evtx/*.csv | grep '2025-07-27 19:5'

Note: This was reasoned from the sequence of AD CS events rather than read from a single labelled artifact; HTB accepted it.

The 4900 event from Q11, and the matching 4898 (template loaded) event, carry the template name and its TemplateVersion. The version is the one stamped after the attacker’s modification.

grep -E ',(4898|4900),' work/evtx/*.csv | grep -o 'TemplateInternalName[^;]*;[^;]*TemplateVersion[^;]*'

The 4900 event records NewSecurityDescriptor as an SDDL string. The ACE ending in the AU trustee alias gives full control to every authenticated principal, which is what turns template write rights into a template anyone can abuse.

grep ',4900,' work/evtx/*.csv | grep -o 'NewSecurityDescriptor.*'

Tip: SDDL trustee aliases are short codes. AU expands to a built-in group name, which is what the answer expects.

Event 4887 (certificate issued) shows request ID 8 with a subject alternative name set to the Administrator UPN, which is the ESC1-style abuse the modified template allowed. The USN journal agrees: administrator.pfx is created at 19:57:55, the moment Certipy writes the issued certificate to disk.

grep -E ',(4886|4887),' work/evtx/*.csv | grep '2025-07-27 19:57'

grep -i 'administrator.pfx' work/usn/*.csv

Certificate authentication (PKINIT) shows up as a 4768 TGT request for Administrator that carries the certificate details. CertSerialNumber in that event at 19:59:15 is the serial of the certificate issued in Q14, and that TGT is what the attacker redeems for the NTLM hash.

grep ',4768,' work/evtx/*.csv | grep '2025-07-27 19:59' | grep -o 'CertSerialNumber[^;]*'

Credential Access (DCSync)

Replicating directory secrets from a domain controller with the Administrator identity is DCSync, the DCSync sub-technique of OS Credential Dumping. This is reference knowledge, with the evidence shown in Q17.

DCSync leaves event 4662 (an operation was performed on an object) with the directory replication property GUID 1131f6aa-... (DS-Replication-Get-Changes) requested by a non-DC account. The first such event by Administrator is the start of the dump.

grep ',4662,' work/evtx/*.csv | grep -i '1131f6aa' | head -1

Note: The first matching 4662 was chosen as the success time by reasoning on the replication GUID; HTB accepted it.

Persistence

Search the USN journal for ticket files. A .kirbi is created at 20:06:33, about 80 seconds after the DCSync, and its name embeds the forged user and the krbtgt target.

grep -i '\.kirbi' work/usn/*.csv

Gotcha: The forged user name in the filename has a doubled letter at the end. Copy the filename verbatim rather than retyping it.

Defense Evasion

The cleanup goes through the webshell’s del= parameter, so the first request carrying it in the IIS log marks the start. The USN journal shows the matching FileDelete for the remote-access binary from Q5 in the same second.

grep -E 'del=' u_ex250727.log | head -1

grep -i FileDelete work/usn/*.csv | grep '8619.exe'

Attack Summary

Phase	Action
Reconnaissance	Scan of the portal from one external IP
Initial Access	Resume PDF and web.config uploaded; PDF executes as script
Execution	Remote-access binary dropped into the upload folder through the webshell
Collection	Files read from the resume reviewers’ share, including the candidate list
Credential Access	Kerberoasting tool dropped; ticket for the CA service account requested
Privilege Escalation	Certipy uploaded; certificate template ACL rewritten (ESC4)
Privilege Escalation	Certificate issued for Administrator and exchanged for its NTLM hash
Credential Access	DCSync against the domain controller
Persistence	Golden Ticket generated for krbtgt
Defense Evasion	Dropped files deleted through the webshell

Forensic Timeline

Timestamp (UTC)	Event
2025-07-27 19:27:35	First attacker request in the IIS log
2025-07-27 19:28:18	Second upload POST (the web.config)
2025-07-27 19:28:29	Resume PDF created in wwwroot\resumes
2025-07-27 19:34:23	First get= read of a file in the reviewers’ share
2025-07-27 19:35:58	Remote-access binary created in the upload folder
2025-07-27 19:40:14	Kerberoasting tool created
2025-07-27 19:40:39	Service ticket for the CA service account requested; roasted.txt written
2025-07-27 19:52:03	Certipy finished writing to disk
2025-07-27 19:56:38	Certificate template security descriptor modified
2025-07-27 19:57:55	Administrator certificate issued and saved as a .pfx
2025-07-27 19:59:15	PKINIT TGT for Administrator using the certificate
2025-07-27 20:05:14	First DCSync replication event
2025-07-27 20:06:33	Golden Ticket .kirbi created
2025-07-27 20:11:13	Cleanup begins with the first del= request

IOCs

Type	Value
IP	143.198.231[.]177
File	c:\inetpub\wwwroot\resumes\Resume9_eba15ba0-81ca-4d0f-9fad-3fc1fc92c181.pdf (the stored name; the folder is from the Q3 create records)
File	web.config (handler override in the upload folder)
File	c:\inetpub\wwwroot\resumes\8619.exe
File	r.exe, roasted.txt
File	Certipy.exe, administrator.pfx
File	shinyboi_wowza_edu_2025_07_27_20_06_33_Administratorr_to_krbtgt@WOWZA.EDU.kirbi
Account	WOWZA.edu\ca_svc (Kerberoasted)
Certificate template	PDFSigner v100.4
Certificate serial	1D00000008A6E7524F029E603A000000000008

MITRE ATT&CK

Technique	ID	Description
Exploit Public-Facing Application	T1190	Upload feature abused with a handler-override web.config
Server Software Component: Web Shell	T1505.003	Resume PDF executed as script
Ingress Tool Transfer	T1105	Remote-access binary, Kerberoast tool and Certipy dropped through the shell
Steal or Forge Kerberos Tickets: Kerberoasting	T1558.003	Service ticket for the CA service account
Steal or Forge Authentication Certificates	T1649	Certificate issued for Administrator through the modified template
File and Directory Permissions Modification: Windows	T1222.001	Template security descriptor rewritten (ESC4)
OS Credential Dumping: DCSync	T1003.006	Replication requests from a non-DC identity
Steal or Forge Kerberos Tickets: Golden Ticket	T1558.001	Forged ticket for krbtgt
Indicator Removal: File Deletion	T1070.004	Tools deleted through the webshell

Defender Takeaways

Uploads must never land where the web server can execute them. The portal stored resumes under wwwroot and allowed an uploaded web.config to remap how PDFs are handled. Store uploads outside the web root, reject configuration file names and extensions, and deny handler overrides in the upload directory.

A Kerberoastable CA service account is a path to the PKI. A tool dropped by the web server’s identity requested a ticket for ca_svc. Use long random passwords or gMSAs for service accounts, and alert on 4769 requests from a web-tier account for other service principals.

AD CS template ACLs need monitoring. Event 4900 and 4898 on a template, followed by 4887 issuing a certificate with an Administrator UPN, is the full ESC4 chain in four log lines. Remove broad write rights on templates and alert on any security descriptor change that grants Authenticated Users anything.

DCSync is visible if 4662 is audited. The replication GUID requested by a non-DC account was recorded, and the Golden Ticket followed 80 seconds later. Alert on replication rights used outside domain controllers and rotate krbtgt twice after any such event.

Journals outlive cleanup. The attacker deleted every tool, but the MFT and USN journal still recorded each create, extend and delete with timestamps. Keep the journal sized so it covers an incident window and collect it early.

Conclusion

The attacker went from a resume upload to Domain Admin and a forged krbtgt ticket in under 45 minutes, using a mis-set web handler, a roastable service account and a template ACL that anyone could rewrite. The tools were deleted at the end, but the IIS log, MFT, USN journal and Security log recorded every step.