HTB: Authority

Tue, 02 Jun 2026 00:00:00 +0000

Windows box, Medium. The foothold here isn’t a CVE or a spray. It’s an Ansible deployment someone left readable on an SMB share with no credentials required. Three vault-encrypted credential blobs in the configs looked protected. They weren’t, because all three used the same master password. Once you crack those, you land on a PWM service on port 8443: a self-service password management portal backed by an LDAP directory. The interesting part is that PWM’s configuration file specifies which LDAP server to authenticate against. Change that URL to point at your own machine, upload the config back through the portal, and the service helpfully connects to your Responder listener using the LDAP service account in cleartext.

Pwm on kanyo's blog

HTB: Authority