Posts tagged with

mssql

HackTheBox - EscapeTwo Writeup

EscapeTwo is an easy Windows machine focused on full domain compromise. Starting with low-privileged credentials, we extract more creds from a corrupted Excel file, gain MSSQL and WinRM access, and discover ADCS misconfigurations. Exploiting these flaws leads to the Administrator hash and full domain control.

S SH∆FIQ∆IM∆N
May 27, 2025
1 min read

smb smbmap smbclient-ng netexec-mssql impacket-mssqlclient mssql netexec-winrm evil-winrm xp_cmdshell bloodhound sharphound powerview.ps1 account-cert-publishers-group writeowner certipy-ad adcs-esc4 rubeus psexec-hash psexec.py impacket-psexec
HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

S SH∆FIQ∆IM∆N
February 9, 2025
1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash
HackTheBox - Archetype Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 20, 2021
1 min read

reverse-powershell legacy smb smbclient crackmapexec-smb impacket-mssqlclient mssql xp_cmdshell nishang modify-services windows-check-OS-architecture