HackThebox - Eighteen

Why It Matters

It shows how a single misconfigured SQL impersonation can cascade into full domain compromise, emphasizing critical hardening steps for enterprises.

Key Takeaways

• SQL impersonation lets attacker read user table and dump passwords.
• RID brute force enumerates domain usernames for password spraying.
• Cracked PBKDF2‑SHA256 hash revealed admin password 'I love you one'.
• WinRM with evil‑winrm provided remote shell on Windows 2025 host.
• BadSuccesor exploit remains viable despite patches, aiding post‑exploitation.

Summary

The video walks through the Hack The Box machine “Eighteen,” an assumed‑breach scenario where the tester starts with a set of credentials for a Microsoft SQL Server. Initial reconnaissance with Nmap reveals only HTTP (IIS) and MSSQL ports, and the tester quickly pivots to the database using the supplied login. Key techniques include leveraging SQL impersonation (Kevin can impersonate appdev) to read the users table, extracting a PBKDF2‑SHA256 password hash, and cracking it to reveal the admin password “I love you one.” A RID brute‑force enumeration generates domain usernames, which are later used for password‑spraying via WinRM and the evil‑winrm tool to obtain a remote shell on the Windows 2025 host. Notable moments feature the line “Kevin can impersonate appdev,” the discovery of the cracked admin password, and the mention of the BadSuccesor exploit—still useful despite being largely patched. The tester also demonstrates handling of Flask cookies, z‑lib compression, and the challenges of domain versus local authentication. The walkthrough highlights how weak database permissions, reusable hashes, and unpatched Windows exploits can be chained to gain full system compromise, underscoring the need for strict impersonation controls, strong password hashing, and timely patch management.

Original Description

00:00 - Introduction

00:45 - Start of nmap

02:20 - Taking a look at the page, manually decoding the Flask Cookie

06:15 - Running NetExec with MSSQL Priv module which lets us know we can impersonate, switching to mssqlclient

09:30 - Impersonating appdev, which can read the financial_planner table

12:25 - Converting the PBKDF2 hash to the Django format so we can try to crack it

16:20 - Using NXC to run RID BRUTE through MSSQL and get other users to spray the password with

20:50 - Using Evil-WinRM to access the box as Adam.Scott then poke at the webserver files, nothing here

22:45 - Getting the Windows Patch Level, noticing windows 2025 and searching exploits to find BadSuccessor

30:00 - Setting up Chisel so we can tunnel back to our box to run the badsuccessor module with nxc

32:50 - Looking at NXC Issues to see the support for BadSuccessor is still a PR, installing the special branch with uv

39:15 - Setting our system time to the time on the webserver based upon the Date Header from Curl

40:15 - Running BadSuccessor getting the NTLM hash of administrator and using psexec to get on the box