The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The retired Hack The Box Escape machine is a medium-difficulty Windows Active Directory lab. Its intended path moves from a guest-readable SMB share to MSSQL, then through a captured service-account hash, a separate password leak, and an ESC1 certificate-template misconfiguration to Administrator-level domain access. This walkthrough follows that sequence without Metasploit; it is a guide to the lab, not a claim that a live target is currently available.
Escape’s route at a glance
HTB describes Escape as a retired Windows Active Directory machine. A detailed community walkthrough reports the lab host as Windows Server 2019 in the sequel.htb domain, with the domain controller named DC. Those are reported instance details, not a guarantee about any currently reachable system. The documented route uses command-line tooling, including Impacket and Certipy, rather than Metasploit. [HTB machine page; PurpleSec walkthrough]
As an Amazon Associate I earn from qualifying purchases.
- Enumerate network services and SMB shares; find the public operational PDF.
- Use its temporary MSSQL credentials and identify the SQL service’s authentication exposure.
- Capture and crack the
sql_svcNTLM hash, then use the resulting foothold. - Find a different credential in a SQL Server backup error log and move laterally as
ryan.cooper. - Abuse an ESC1-vulnerable certificate template to request a certificate for Administrator and obtain domain-level access.
Find the SMB share and database credentials
Enumerate before assuming a service is the entry point
Begin with ordinary service and share enumeration in the authorized HTB lab. The walkthrough reports SMB and MSSQL alongside Active Directory services, and identifies a guest-readable share named Public. Inspect accessible share contents for operational documents rather than treating the share as harmless just because it is readable without an account.
Recommended Free Tools
Read the SQL Server procedures PDF
The PDF in the share contains temporary MSSQL credentials. Use those credentials to connect to the database service, following the walkthrough’s command-line approach with Impacket. The important security lesson is that internal procedures and temporary secrets exposed through anonymous or guest SMB access can turn a low-friction file listing into a database foothold.
#1 Best Overall
Do not treat this login as immediate operating-system command execution. The account described in the walkthrough initially lacks permission to run xp_cmdshell; database access and host command execution are separate privileges. [PurpleSec walkthrough]
Turn MSSQL’s outbound authentication into a foothold
HTB’s synopsis describes the next weakness at a high level: the MSSQL service can be induced to authenticate to an attacker-controlled system, exposing authentication material that can be cracked. In the detailed route, the captured NTLM material belongs to the sql_svc service account. This is not the same as cracking the PDF’s temporary database password: the route depends on the server’s service identity authenticating outward, then using the recovered service-account credentials for remote access.
- Set up an authorized listener or capture endpoint in your lab environment and use the SQL-side technique documented for the machine to trigger the service’s outbound authentication.
- Capture the resulting NTLM challenge-response material for
sql_svc. - Attempt an offline crack against an appropriate wordlist. The walkthrough reports that this hash is crackable; success depends on the supplied hash and the cracking resources available to you.
- Use the recovered credentials for the reported WinRM foothold. Do not infer that SQL login alone grants this access.
The chain matters: SQL access enables the authentication trigger, but the identity presented to the listener is the SQL service account. The service account’s crackable authentication is what bridges the database exposure to remote host access. HTB’s synopsis establishes this high-level dependency; the specific account and WinRM step are reported by PurpleSec. [HTB machine page; PurpleSec walkthrough]
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse the SQL error-log leak for lateral movement
After the service-account foothold, the walkthrough identifies a separate mistake: a password is exposed in a SQL Server backup error log. Use the leaked credential to access the machine as ryan.cooper, as reported in that walkthrough.
This is an independent credential-disclosure step, not a consequence of cracking sql_svc. Keeping the two discoveries distinct makes the route easier to troubleshoot: the captured hash establishes one identity, while the log supplies another user’s password. [PurpleSec walkthrough]
Understand and abuse the ESC1 certificate template
Why the template permits impersonation
ESC1 describes a certificate-services misconfiguration, not a standalone software exploit. In the reported template configuration, Domain Users can enroll, the requester can supply the certificate subject or subject alternative name, and the certificate supports client authentication. Together, these settings let an eligible requester ask for a certificate that represents another user rather than only the requester’s own identity.
Request Administrator identity and authenticate
From the later account context, inspect the certificate templates and identify the vulnerable configuration with Certipy, the command-line tool used in the walkthrough. The reported route requests a certificate specifying Administrator as the identity, then uses certificate-based PKINIT authentication to obtain the Administrator account’s hash. Use that identity for the lab’s domain-level access objective.
The permissions and identity behavior are the essential checks: enrollment must be available to the requester, subject information must be requester-controlled, and the certificate must be usable for client authentication. If one of those conditions is absent, do not assume the same ESC1 path applies. HTB identifies ESC1 as the intended final issue; the detailed configuration and PKINIT sequence are reported in the walkthrough. [HTB machine page; PurpleSec walkthrough]
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What “without Metasploit” means here
The documented path avoids Metasploit but is not tool-free: it names Impacket for database and authentication-related work, remote-management access through WinRM, and Certipy for certificate-service enumeration and abuse. PurpleSec’s commands and tool versions reflect its walkthrough at the time it was written; they are not a promise of compatibility with every current release. Match options to the versions installed in your authorized lab, and troubleshoot authentication or syntax errors without assuming the machine’s intended chain has changed. [PurpleSec walkthrough]
How to reason through a failure
- The SQL login works but no shell is available: that is consistent with the walkthrough; the initial database account does not have
xp_cmdshellpermission. Continue investigating the service-authentication route instead of assuming command execution is enabled. - No useful hash appears at the listener: verify that the SQL-side trigger actually causes the service identity to authenticate outward and that your capture endpoint is reachable from the lab target.
- The captured hash does not crack: cracking is conditional, not guaranteed for arbitrary credentials. Confirm you captured the expected service account material and avoid confusing it with the temporary password printed in the PDF.
- The later user credentials fail: make sure the password came from the SQL backup error log; it is a distinct step after the
sql_svcfoothold. - Certificate enrollment does not yield impersonation: re-check enrollment rights, requester-controlled subject/SAN, and client-authentication usage. ESC1 depends on their conjunction, not simply on finding a certificate template.
Further Windows learning
For broader practice beyond this machine, HTB Academy lists a Windows Privilege Escalation course covering adjacent Windows skills. It is supplementary learning, not a prerequisite for the route above. [HTB Academy Windows Privilege Escalation]
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
