HackTheBox - EscapeTwo
Source: YouTube · IppSec · published May 24, 2025 · 42:36
BLUF: This video demonstrates an "assumed breach" style Hack The Box challenge where initial credentials lead to domain admin via a Microsoft SQL injection and subsequent Certificate Authority exploitation. 0:05
Key Takeaways:
• The challenge begins with provided credentials that grant access to file shares, revealing a spreadsheet with additional credentials. 0:11
• These new credentials provide CISadmin access to Microsoft SQL, enabling the attacker to execute commands and gain a shell on the box. 0:17
• Analyzing the SQL install script reveals another password, which when sprayed across the domain, compromises a service account. 0:23
• Compromised service accounts often hold ownership over the Certificate Authority, allowing modification of certificate templates. 0:29
• Modifying the template allows exploitation of the ESC1 vulnerability to impersonate the administrator user. 0:35
The walkthrough highlights the critical importance of securing service accounts and certificate templates in Active Directory environments.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC me doing escape 2 from hack the box which is an assumed breach style box meaning we start out with a set of credentials and these credentials let us access a lot of services but if we check out the fileshare we can find a spreadsheet that has a set of credentials and these credentials lead to cisadmin access over Microsoft SQL which we can use to get a shell on the box and looking at the install script for Microsoft SQL reveals another password which if we spray the domain leads to another user that has a right owner over the certificate authority a service account. So, we can take that account over, which lets us modify a certificate template, which essentially allows us to make that template vulnerable to ESC1, allowing us to impersonate the administ…