/ tags/ mssql

# HTB-Escape

2026-01-244 min read

Using kerbrute I was able to find the following service accounts present:

2026-01-234 min read

Using the enum4linux-ng tool I was able to enumerate the following information:

2025-11-225 min read

Since we already got valid creds I decided to use nxc to spray the credentials

2025-11-176 min read

I tried the creds for winrm but they didn’t work, let’s try them for port 80 instead.

2025-10-165 min read

Using the given credentials we are able to login using impacket: