Eighteen — HTB Writeup | The Hack Sparrow

Executive summary — Eighteen is a Windows Server 2025 domain controller (DC01.eighteen.htb) solved by chaining credential reuse with a cutting-edge Active Directory flaw. Starting from an assumed breach foothold, kevin's domain password turns out to also be his MSSQL login; from there we abuse SQL permissions (IMPERSONATE + DML) to dump the web app's admin hash, verify it offline, spray it against domain accounts and land adam.scott. The final escalation exploits BadSuccessor (CVE-2025-53779) against a dMSA to steal the Administrator NTLM hash. Path: MSSQL → web creds → WinRM → BadSuccessor → Root.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.33.24`

Attack map

[80/HTTP]  Financial Planner (Flask behind IIS)
   │  probes negative; a pyodbc error leaks the MSSQL backend
   ▼
[1433/MSSQL]  kevin = SQL login (reused domain password)
   │  IMPERSONATE appdev → DML over financial_planner → dump the admin hash
   ▼
[creds]  Werkzeug hash verified offline → iloveyou1
   │  password spraying over WinRM
   ▼
[WinRM]  adam.scott:iloveyou1 (Pwn3d!) → user.txt · member of IT
   │  IT has CreateChild over OU=Staff (Windows 2025 domain)
   ▼
[BadSuccessor / CVE-2025-53779]  chisel SOCKS pivot + bloodyAD --prepatch
   │  the dMSA TGT reveals the Administrator NTLM hash
   ▼
[ROOT]  pass-the-hash as Administrator → root.txt

1. Reconnaissance

We start by mapping the attack surface with a full TCP port scan. There's an important speed nuance here:

nmap -p- --min-rate 500 -Pn -n -T3 --max-retries 3 10.129.33.24

Why slow it down: a first scan with --min-rate 3000 produced a false negative on 1433 due to overly aggressive rate-limiting. When the result looks suspiciously thin on a Windows/AD box, it's worth re-scanning slower with more retries before writing off services.

Open ports:

80/tcp    open  http      Microsoft IIS 10.0  (reverse proxy → Flask app "Financial Planner", eighteen.htb)
1433/tcp  open  ms-sql-s  Microsoft SQL Server 2022 RTM (16.0.1000)
5985/tcp  open  wsman     WinRM — host DC01, domain eighteen.htb, Windows Server 2025

Everything else (Kerberos 88, LDAP 389/636/3268, SMB 445, RDP 3389) is firewalled from the outside. DNS over UDP (53) does answer and confirms the SRV records _kerberos._tcp / _ldap._tcp → dc01.eighteen.htb.

Resumen ejecutivo — Eighteen es un controlador de dominio Windows Server 2025 (DC01.eighteen.htb) que se resuelve encadenando reutilización de credenciales con una vulnerabilidad de Active Directory de última generación. Partiendo de un escenario assumed breach, la contraseña de dominio de kevin resulta ser también su login de MSSQL; desde ahí se abusan permisos SQL (IMPERSONATE + DML) para volcar el hash del admin de la app web, se rompe/verifica offline, se rocia contra cuentas de dominio y se consigue adam.scott. La escalada final explota BadSuccessor (CVE-2025-53779) sobre una dMSA para robar el hash NTLM de Administrator. Recorrido MSSQL → Web creds → WinRM → BadSuccessor → Root.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.33.24`

Mapa del ataque

[80/HTTP]  Financial Planner (Flask tras IIS)
   │  pruebas negativas; el error de pyodbc filtra el backend MSSQL
   ▼
[1433/MSSQL]  kevin = SQL login (contraseña de dominio reutilizada)
   │  IMPERSONATE appdev → DML sobre financial_planner → volcado del hash del admin
   ▼
[creds]  hash Werkzeug verificado offline → iloveyou1
   │  password spraying por WinRM
   ▼
[WinRM]  adam.scott:iloveyou1 (Pwn3d!) → user.txt · miembro de IT
   │  IT tiene CreateChild sobre OU=Staff (dominio Windows 2025)
   ▼
[BadSuccessor / CVE-2025-53779]  pivote SOCKS con chisel + bloodyAD --prepatch
   │  el TGT de la dMSA revela el hash NTLM de Administrator
   ▼
[ROOT]  pass-the-hash como Administrator → root.txt

1. Reconocimiento

Empezamos mapeando la superficie de ataque con un escaneo de todos los puertos TCP. Aquí hay un matiz importante de velocidad:

nmap -p- --min-rate 500 -Pn -n -T3 --max-retries 3 10.129.33.24

Por qué bajar la velocidad: un primer escaneo con --min-rate 3000 dio un falso negativo en el 1433 por rate-limiting demasiado agresivo. Cuando el resultado parece sospechosamente escueto en una máquina Windows/AD, merece la pena repetir más lento y con más reintentos antes de descartar servicios.

Puertos abiertos:

80/tcp    open  http      Microsoft IIS 10.0  (reverse-proxy → app Flask "Financial Planner", eighteen.htb)
1433/tcp  open  ms-sql-s  Microsoft SQL Server 2022 RTM (16.0.1000)
5985/tcp  open  wsman     WinRM — host DC01, dominio eighteen.htb, Windows Server 2025

Todo lo demás (Kerberos 88, LDAP 389/636/3268, SMB 445, RDP 3389) está filtrado por firewall desde el exterior. DNS por UDP (53) sí responde y confirma los registros SRV _kerberos._tcp / _ldap._tcp → dc01.eighteen.htb.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.