In Beyond Root, two other ways to abuse the MSSQL access, via file read and JuicyPotatoNG. Because the tooling for this box is so different I’ll show it from both Linux and Windows attack systems. I’ll reverse those to find a deserialization vulnerability, and exploit that to get a shell as SYSTEM. From there, I’ll get some more creds, and use those to get access to a share with some custom dot net executables. I’ll kerberoast and get a challenge/response for a service account, and use that to generate a silver ticket, getting access to the MSSQL instance. I’ll find user creds with hints from the page, and get some more hints from a file share.

NTLM authentication is disabled for the box, so a lot of the tools I’m used to using won’t work, or at least work differently. There are some hints on a webpage, and from there the exploitation is all Windows.

Scrambled presented a purely Windows-based path. Htb-scrambled ctf hackthebox kerberos deserialization windows silver-ticket reverse-engineering

Universal media server ps4 backdoor