EscapeTwo — HTB Writeup | The Hack Sparrow

Executive summary — EscapeTwo is an Easy Active Directory box in assume-breach mode (we're given rose:KxEPkKe6R8su). An SMB Accounting Department share holds Excel files with credentials for several users and for sa (MSSQL); a spray confirms oscar, whose LDAP enumeration reveals the service accounts sql_svc and ca_svc (Kerberoasting them goes nowhere). With sa and xp_cmdshell we get a shell as sql_svc, and a sql-Configuration.INI leaks a password reused by ryan (WinRM, user.txt). In BloodHound, ryan has WriteOwner over ca_svc: with bloodyAD we take ownership and grant ourselves GenericAll, apply Shadow Credentials, and abuse an AD CS template vulnerable to ESC4 to issue an Administrator certificate. Path: xlsx -> sa/MSSQL -> ryan -> ca_svc (WriteOwner) -> ADCS ESC4 -> Administrator.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.6.78`

Attack map

[assume-breach] rose : KxEPkKe6R8su  (SMB)
   |  "Accounting Department" share -> accounts.xlsx leaks sa/angela/oscar/kevin
   v
[spray] oscar valid -> netexec --users/--rid-brute reveals sql_svc, ca_svc, ryan
   |  Kerberoasting (sql_svc, ca_svc) -> hashes not cracked (dead end)
   v
[MSSQL]  sa : MSSQLP@ssw0rd! -> xp_cmdshell -> shell as sql_svc
   |  sql-Configuration.INI -> reused password -> ryan
   v
[ryan]  WinRM -> BloodHound: ryan WriteOwner over ca_svc
   |  bloodyAD: owner + GenericAll -> Shadow Credentials -> ca_svc hash
   v
[ADCS]  ca_svc -> ESC4 on DunderMifflinAuthentication -> Administrator cert
   v
[ADMIN]  Pass-the-Hash -> root.txt

1. Preparation: name resolution

Several certipy commands later on depend on the domain controller's hostname resolving correctly. Better to pin it in /etc/hosts up front than discover it mid-attack.

echo "10.129.6.78 dc01.sequel.htb sequel.htb dc01" | sudo tee -a /etc/hosts
ping -c1 dc01.sequel.htb

This makes the attacking box resolve dc01.sequel.htb, sequel.htb and dc01.

Resumen ejecutivo — EscapeTwo es un Easy de Active Directory en modo assume-breach (nos dan rose:KxEPkKe6R8su). Un share SMB Accounting Department guarda ficheros Excel con credenciales de varios usuarios y de sa (MSSQL); un spray confirma a oscar, cuya enumeración LDAP revela las cuentas de servicio sql_svc y ca_svc (el Kerberoasting sobre ellas no da fruto). Con sa y xp_cmdshell conseguimos shell como sql_svc, y un sql-Configuration.INI filtra una contraseña reutilizada por ryan (WinRM, user.txt). En BloodHound, ryan tiene WriteOwner sobre ca_svc: con bloodyAD nos hacemos dueños y nos damos GenericAll, aplicamos Shadow Credentials y abusamos de una plantilla de AD CS vulnerable a ESC4 para emitir un certificado de Administrator. Recorrido: xlsx -> sa/MSSQL -> ryan -> ca_svc (WriteOwner) -> ADCS ESC4 -> Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.6.78`

Mapa del ataque

[assume-breach] rose : KxEPkKe6R8su  (SMB)
   |  share "Accounting Department" -> accounts.xlsx filtra sa/angela/oscar/kevin
   v
[spray] oscar valido -> netexec --users/--rid-brute revela sql_svc, ca_svc, ryan
   |  Kerberoasting (sql_svc, ca_svc) -> hashes sin crackear (callejon sin salida)
   v
[MSSQL]  sa : MSSQLP@ssw0rd! -> xp_cmdshell -> shell como sql_svc
   |  sql-Configuration.INI -> password reutilizada -> ryan
   v
[ryan]  WinRM -> BloodHound: ryan WriteOwner sobre ca_svc
   |  bloodyAD: owner + GenericAll -> Shadow Credentials -> hash de ca_svc
   v
[ADCS]  ca_svc -> ESC4 en DunderMifflinAuthentication -> cert de Administrator
   v
[ADMIN]  Pass-the-Hash -> root.txt

1. Preparación: resolución de nombres

Varios comandos de certipy más adelante dependen de que el hostname del controlador de dominio resuelva correctamente. Conviene fijarlo desde el principio en /etc/hosts en vez de descubrirlo a medio ataque.

echo "10.129.6.78 dc01.sequel.htb sequel.htb dc01" | sudo tee -a /etc/hosts
ping -c1 dc01.sequel.htb

Con esto el equipo atacante resuelve dc01.sequel.htb, sequel.htb y dc01.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.