HackTheBox - Overwatch
Source: YouTube · IppSec · published May 9, 2026 · 38:18
This video demonstrates a walkthrough of the "Overwatch" Hack The Box machine, focusing on exploiting Windows Communication Foundation (WCF) and SQL Server misconfigurations to gain initial access and escalate privileges.
Key Takeaways:
• The attack begins by identifying an open file share containing a .NET executable and configuration file. Analyzing the config file leaks a Microsoft SQL password, while the executable reveals a WCF endpoint vulnerable to command injection 0:08.
• After locating the SQL service on a non-default port, the attacker logs in and discovers a "dead" linked server setup. By hijacking the DNS name associated with this linked server, they extract another set of credentials 0:21.
• These stolen credentials allow the attacker to authenticate via WinRM, providing remote access to the Windows environment and enabling further exploitation of the WCF service 0:33.
The summary highlights how configuration leaks and linked server abuses can chain together to compromise a Windows system.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing Overwatch from Hack The Box, which is a pretty fun box that showcases the Windows Communication Foundation. But before we get into that, we find an open file share that has a .NET executable and config. Looking at the config leaks a Microsoft SQL password, and the executable lets us know the application has an endpoint configured in WCF, and it's vulnerable to command injection. The Microsoft SQL service is on a non-default port, but once we find that, we can log in and discover there's a dead linked server setup. We can hijack the DNS name and get another credential by using the linked server. And that lets us onto the box through WinRM, which we can use to hit the Windows Communication Foundation endpoint on port 8000 and …