Eighteen HTB
EIGHTEEN BOX Welcome to another Hack The Box walkthrough. In this write-up, I’ll walk through how I compromised the Eighteen machine on Hack The Box. Hack The Box is a great platform to build and refine your penetration testing skills, covering everything from enumeration to exploitation. If you’re new here, feel free to follow along and connect with me on LinkedIn for more updates Target Overview Eighteen is an easy-difficulty Windows machine on Hack The Box that demonstrates common weaknesses in database access control and Active Directory misconfigurations. The attack begins with valid credentials, which are used to access an MSSQL service. By abusing impersonation privileges, sensitive application data is extracted, including password hashes. These hashes are cracked offline and reused for password spraying, leading to WinRM access as a domain user. Privilege escalation is achieved through misconfigured Active Directory permissions. Membership in a group with CreateChild rights over an Organizational Unit allows exploitation of the BadSuccessor technique. This leads to the creation of a delegated Managed Service Account (dMSA) linked to the Administrator account, resulting in full domain compromise. >Credentials Provided: kevin : iNa2we6haRj2gaw! Nmap Scan Nmap Analysis The scan exposed a few interesting attack surfaces: Port 80 – HTTP (IIS 10.0) IIS is running on port 80 and redirects to http://eighteen.htb/, confirming a virtual host setup. This hints that the real application is behind the vhost, so adding it to /etc/hosts is necessary. Port 1433 – MSSQL MSSQL is exposed and leaks valuable AD info: Domain: EIGHTEEN Host: DC01 FQDN: DC01.eighteen.htb The hostname DC01 suggests this is a Domain Controller — a strong indicator that AD abuse will be part of the attack chain. MSSQL here is a prime foothold candidate. Port 5985 – WinRM WinRM is enabled, which means if valid credentials are obtained, this will be the easiest path to get a shell. Setting Up Host Mapping Before starting enumeration, I added the target hostname to my /etc/hosts file: This allows my system to resolve cctv.htb to the target IP. Many Hack The Box machines use virtual hosts, so accessing the application with the correct hostname is important for it to work properly. Testing Provided Credentials Credentials Provided: kevin : iNa2we6haRj2gaw! To validate the credentials, I used NetExec (nxc) a powerful post-exploitation tool (successor of CrackMapExec) commonly used for enumerating and validating credentials across services like SMB, MSSQL, WinRM, etc. 🔗 Download: https://github.com/Pennyw0rth/NetExec Since port 1433 (MSSQL) was open from the Nmap scan, I tested the credentials against the MSSQL service: The credentials were valid, confirming access to the MSSQL service. With a successful login, I moved forward to interact with the service using the Impacket toolkit. MSSQL Access via Impacket With valid credentials confirmed, I connected to the MSSQL service using the Impacket toolkit: The login was successful, giving me interactive access to the MSSQL server. From here, I proceeded with enumeration to identify permissions, accessible databases, and potential privilege escalation paths. Enumerating Impersonation Privileges I checked for impersonation privileges using: The output shows that the user kevin has IMPERSONATE privileges over the appdev account. This means I can switch context and act as appdev, potentially gaining higher privileges within MSSQL. Then, I verified the current user context: If appdev has higher privileges, this can be leveraged further for privilege escalation or command execution. Identifying Accessible Databases After switching to the appdev context, I enumerated accessible databases: Among the available databases, financial_planner stood out as a custom application database. Switching to Target Database I switched to the financial_planner database for further enumeration: This is likely where application-specific data and sensitive information are stored. Enumerating Tables After switching to the financial_planner database, I listed all available tables: Among these, the users table stood out as the most interesting target, as it likely contains credentials or sensitive user data. Dumping User Credentials I queried the users table to check for stored credentials: Cracking the Password Hash I extracted the password hash from the database: Cracking the Password Hash (Custom Approach) Hashcat does not support PBKDF2-SHA256 in this exact format out-of-the-box, so I created a small custom Python script to brute-force the hash using a wordlist. First, I extracted the admin hash from the database and saved it into a file named hash.txt for reference. Then, I wrote a script (hash-cracker.py) using Python’s built-in hashlib module to manually perform the PBKDF2 hashing. Cracking the Password Hash (Custom Script) Since standard tools had compatibility issues with the PBKDF2 format, I used a custom Python script to crack the hash. Once a match is found, the correct password is printed. Outcome After running the script, the correct password was successfully recovered and used for further access. Script Breakdown Hash Function: Uses pbkdf2_hmac with SHA256 Salt: Extracted from the hash (AMtzteQIG7yAbZIa) Iterations: 600,000 rounds (makes cracking slower but more secure) Wordlist: rockyou.txt Optimization: Multiprocessing to speed up brute-force attempts The script computes the hash for each password in the wordlist and compares it against the target hash. Web Application Login Using the cracked credentials (admin:iloveyou1), I authenticated to the web application on port 80 and gained access to the admin panel. image Enumerating Domain Users Using NetExec, I performed RID brute forcing to enumerate domain users: Preparing for Password Spray I extracted the usernames and saved them into a file: Next, I reused the cracked password (iloveyou1) to perform password spraying against these users Password Spraying via WinRM Using the collected usernames, I performed password spraying with the cracked password (iloveyou1) against the WinRM service: The password reuse was successful for the user adam.scott, confirming valid credentials. Gaining Access via WinRM With valid credentials identified, I logged into the system using Evil-WinRM: This provided an interactive shell on the target machine. User Flag Privilege Escalation With a shell as adam.scott, I started enumerating the system to find a path to Administrator. Checking User Privileges After gaining a shell as adam.scott, I checked the assigned privileges: The SeMachineAccountPrivilege stood out, as it allows a user to add machines to the domain. This privilege can be abused in certain scenarios for privilege escalation within Active Directory environments. adam.scott is a member of EIGHTEEN\IT and has permission to add machine accounts to the domain. Privilege Escalation via BadSuccessor (dMSA Abuse) https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory From enumeration, I confirmed that adam.scott is a member of the EIGHTEEN\IT group and has the SeMachineAccountPrivilege, allowing him to add machine accounts to the domain. This is critical because the IT group has delegated permissions over an Organizational Unit (OU), including the ability to create new objects (CreateChild). Privilege Escalation via BadSuccessor + Kerberos Abuse Updating NetExec (NXC) Pivoting using Chisel Upload Chisel to Target Start Chisel Server (Attacker) Start Chisel Client (Target) Configure Proxychains Add these lines at the bottom: Test Internal Access Fixing Clock Skew (Kerberos) Required because Kerberos fails if time is out of sync. Exploiting BadSuccessor using (NetExec) Using the Kerberos Ticket: Kerberos authentication successful Its Time to Dump the NTDS file Pass-the-Hash (Administrator Access) Root Flag