iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
HTB’s retired Escape machine is a medium-difficulty Windows Active Directory lab. Its intended route links a guest-readable SMB share to temporary SQL credentials, forced authentication by the SQL service, a cracked service-account password, a separate password leak in a SQL log, and an ESC1-vulnerable certificate template. The final certificate lets the lab user impersonate Administrator. This walkthrough follows that chain using command-line tools rather than Metasploit; it describes the reported lab path, not a currently reachable machine. HTB’s machine page identifies Escape as retired and summarizes the route.
How the Escape attack chain fits together
The machine is reported as Windows Server 2019 in the sequel.htb domain, with the domain controller named DC. Those are walkthrough-specific lab details, not a guarantee about a live target. The route is a sequence of distinct weaknesses: exposed internal material gives database credentials; the SQL service’s authentication can be captured and cracked; a separate log leak provides another user’s password; and certificate-template settings enable Administrator impersonation. PurpleSec’s walkthrough documents the intermediate steps and instance details.
1. Find the SMB share and the SQL credentials
Begin with service and share enumeration, looking for SMB, MSSQL, and the usual Active Directory services. The reported route finds a guest-accessible share named Public. Its contents include a PDF about SQL Server procedures that discloses temporary MSSQL credentials.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The important failure is not merely that a file is readable: internal operational documentation containing credentials was placed where unauthenticated or guest-level access could retrieve it. Treat the PDF credentials as database access for the next step, not as proof that you already have Windows command execution.
#1 Best Overall
2. Connect to MSSQL without assuming command execution
Use the credentials found in the PDF to authenticate to the SQL Server with an MSSQL client. The walkthrough reports that this login does not initially have permission to run xp_cmdshell. Do not conflate a successful database login with a shell on the Windows host: the documented foothold instead depends on causing the service account to authenticate outward.
3. Capture and crack the SQL service account authentication
HTB’s synopsis describes the SQL service as inducible to authenticate to an attacker-controlled system, with the resulting service-account hash crackable. In the detailed route, this produces an NTLM challenge-response for sql_svc; cracking that captured material yields the service account’s password, which is then used for WinRM access.
Rank #2
The dependency matters: the disclosed SQL credentials allow interaction with the database, while the service’s outbound authentication exposes material associated with the SQL service identity. The hash capture is not the same thing as a plaintext password being found in a log later. HTB summarizes the forced-authentication and crackable-hash portion of the intended chain on the Escape machine page.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Use the separate SQL log credential leak
After obtaining the service-account foothold, the walkthrough identifies a password exposed in a SQL Server backup error log. That plaintext leak is an independent credential-handling mistake, not a result of cracking sql_svc. The reported password permits access as ryan.cooper, providing the identity used to investigate the domain’s certificate services.
5. Identify and abuse the ESC1 certificate template
ESC1 is a certificate-template configuration weakness, not a standalone software exploit. In the reported setup, the template allows Domain Users to enroll, accepts a subject or Subject Alternative Name (SAN) supplied by the requester, and supports client authentication. Together, those settings let an eligible requester obtain a certificate that represents another user rather than being restricted to the requester’s own identity.
The route uses the template to request a certificate for Administrator, then authenticates with it through PKINIT (Kerberos authentication using public-key credentials). The resulting authentication path exposes the Administrator hash, which provides domain-level access in the lab. The security issue is the template’s combination of broad enrollment rights, requester-controlled identity, and client-authentication capability; changing any one of those conditions can prevent this impersonation path.
Why this is a no-Metasploit route
The documented chain uses command-line tooling, including Impacket and Certipy, plus remote-management access. It does not require Metasploit. PurpleSec’s walkthrough records tool versions from its own point in time; those versions do not establish present-day compatibility. For a retired lab, follow the machine’s documented concepts while checking the syntax and behavior of the tool versions available in your environment.
What to take away from the lab
- Guest-readable SMB content can expose operational documents that should not be public, including temporary credentials.
- Database authentication and host command execution are different privileges; the initial SQL login is not automatically a shell.
- A forced service authentication can expose crackable NTLM material tied to the service account.
- A plaintext password in an error or backup log is a separate leak and can enable lateral movement.
- Certificate enrollment settings can turn a template into an identity-impersonation path when requesters control the subject and client authentication is enabled.
Further Windows practice
For broader Windows privilege-escalation study beyond this particular retired machine, HTB Academy lists a Windows Privilege Escalation course. Its scope is adjacent to the skills used here, rather than a substitute for the machine-specific chain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
