HackThebox - Eighteen
Source: YouTube · IppSec · published Apr 11, 2026 · 41:15
This video details a Hack The Box walkthrough for machine "18," starting with an assumed breach via Microsoft SQL credentials and escalating to system access using the "Bad Successor" exploit on Windows Server 2025 0:00-0:36.
Key Takeaways:
• The initial attack vector leverages MSSQL impersonation to access a web app's user table, allowing the attacker to dump and crack a password 0:08-0:16.
• Because the cracked password's associated username is unknown, a RID brute force is used to generate a username list, followed by a password spray using net exec 0:18-0:24.
• The target is identified as running Windows Server 2025, which is vulnerable to the "Bad Successor" exploit for privilege escalation 0:25-0:33.
The creator explains their learning process regarding the Bad Successor exploit throughout the video, providing viewers with both practical steps and a conceptual understanding of the vulnerability.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing 18 from Hack The Box, which starts off as an assumed breach scenario where we get credentials to Microsoft SQL. Once we log in, we discover we can impersonate another user that gives us access to read the users table of the web app, where we can dump and crack a password. However, we don't know what user that password goes to, so we'll perform a RID brute force to generate a username list, then net exec to spray the password. Once on the box, we discover it's running Windows 2025, and Googling around shows it may be vulnerable to Bad Successor, which is an exploit I didn't know much about how it worked before solving the box. However, after solving it, I have a much better understanding. And while this is mostly patched, it …