GS-032: BITSTREAM (P3) — SQL Owned + Bob’s NTLM Hash Cracked (HackSmarter) | 2026-07-09

This live stream features Haxabyte continuing the easy-rated "Bitstream" range on Hacksmarter, demonstrating how to escalate access via MSSQL to obtain a user's plaintext password 0:24.

Key Takeaways:
• After exploiting XSS and an IDOR on the web application in a previous session, the stream focuses on the SQL workstation using impacket-mssqlclient with discovered credentials 0:37.
• The xp_cmdshell module is enabled to execute system commands directly from the MSSQL context, allowing file transfers and payload execution 1:41.
• Two methods for establishing command and control are demonstrated: dropping a Beacon using the Adaptics C2 framework and catching a reverse shell with Penelopey using an MSFVenom payload 1:05.
• Privilege escalation from the MSSQL Express service account to NT AUTHORITY\SYSTEM is achieved using a "God Potato" exploit leveraging SeImpersonatePrivilege 1:47.
• Due to Windows 2025 compatibility issues with standard Mimikatz binaries, the host uses a specialized Windows LSA credentials extractor to pull the NTLM hash, which is then quickly cracked with Hashcat to reveal Bob's password ("Pokemon") 4:08.

The stream effectively highlights that even with administrative access, CTFs often require specific flag answers, and modern OS versions can break standard legacy exploitation tools.

Sources:

• 0:24 Introduction to the Bitstream Hacksmarter range and learning objectives
• 0:37 Using impacket-mssqlclient to connect to the database
• 1:41 Enabling and using xp_cmdshell for remote command execution
• 1:05 Demonstrating C2 beaconing (Adaptics) and reverse shells (Penelopey)
• 1:47 Privilege escalation to SYSTEM using God Potato
• 4:08 Extracting and cracking Bob's NTLM hash to get the flag