Signed Hack The Box | Silver Ticket | OPENROWSET BULK | CVE-2025-33073 | Ligolo Pivot | Season 09 скачать в хорошем качестве

Signed Hack The Box | Silver Ticket | OPENROWSET BULK | CVE-2025-33073 | Ligolo Pivot | Season 09

Signed - Hack The Box (Medium | Windows | Season 9) In this walkthrough, we tackle the "Signed" machine from Hack The Box — a Windows Domain Controller with only MSSQL (port 1433) exposed. We escalate from a low-privilege SQL login to SYSTEM through Silver Ticket forgery and CVE-2025-33073 NTLM reflection. 🔹 Attack Path Overview: ━━━━━━━━━━━━━━━━━━━━━━ • Foothold: MSSQL access with provided credentials (scott) • Credential Capture: xp_dirtree + Responder → mssqlsvc NTLMv2 hash • Privilege Escalation: Silver Ticket forging to claim MSSQL sysadmin (SIGNED\IT group) • User Flag: xp_cmdshell as mssqlsvc service account • Root Flag (Unintended): OPENROWSET(BULK) with elevated Kerberos ticket (Domain Admins group) • Root Flag (Intended): Ligolo tunnel + CVE-2025-33073 NTLM reflection → relay to WinRM → SYSTEM shell 🔹 Techniques Covered: ━━━━━━━━━━━━━━━━━━━━━━ • MSSQL enumeration methodology (enum_logins, enum_impersonate, enum_links, enum_db) • NetNTLMv2 hash capture via xp_dirtree + Responder • Kerberos Silver Ticket forgery with custom group memberships • Kerberos clock skew troubleshooting • OPENROWSET(BULK) / BULK INSERT for file reading • Ligolo-ng reverse tunneling (agent upload via MSSQL) • CVE-2025-33073: NTLM reflection bypass via marshalled target information • SMB coercion (DFSCoerce, PetitPotam, PrinterBug) + NTLM relay to WinRM 🔹 CVEs Exploited: ━━━━━━━━━━━━━━━━━━ • CVE-2025-33073 — NTLM Reflection bypass using marshalled target info in crafted DNS hostnames 🔹 Tools Used: ━━━━━━━━━━━━━━ • Nmap, Impacket (mssqlclient, ticketer, ntlmrelayx), Responder, Hashcat • Ligolo-ng (proxy + agent), krbrelayx (dnstool.py), NetExec (nxc), coerce_plus 🔹 References: ━━━━━━━━━━━━━━ • Synacktiv CVE-2025-33073: https://www.synacktiv.com/en/publicat... • Zero Networks: https://zeronetworks.com/blog/examini... • Machine: https://app.hackthebox.com/machines/775 ⚠️ Disclaimer: This video is for educational purposes only. Always obtain proper authorization before testing. Do not use these techniques against systems you do not own or have explicit permission to test. #chatgpt HackTheBox #CTF #OSCP #Pentesting #ActiveDirectory #Kerberos #SilverTicket #MSSQL #NTLMRelay #CVE202533073 #Windows #PrivilegeEscalation #0xdtc #InfoSec #CyberSecurity #EthicalHacking #HTB #redteam