Box Information
| Box Name | Signed |
|---|---|
| OS | Windows |
| Difficulty | Medium |
| Release Date | 2025-10-11 |
Introduction
Signed is the third box of HackTheBox Season 9. It is a medium difficulty Windows box that exposes only MSSQL externally. We enumerate the box and gain initial access to the service with the credentials scott / Sm230#C5NatH. We use dirtree to authenticate to an attacker-controlled SMB server in order to capture the service account’s NTLMv2 hash. After cracking the hash, we re-authenticate to MSSQL with our new credentials and discover limited privileges. We enumerate privileged groups and discover SIGNED/IT, for which we then forge a Silver Ticket and gain code execution through the MSSQL service. Upon gaining access to the machine, we discover it is vulnerable to CVE-2025-33073 (NTLM reflection), and we use Chisel to route our traffic through a proxychains SOCKS5 proxy. We then add a malicious DNS entry that starts with localhost to abuse the SMB driver vulnerability. We start our ntlmrelayx server and point it to the dc01.signed.htb WinRM server, and finally use PetitPotam to coerce the domain controller into authenticating to our server using NTLM local authentication.
User
We first begin with an initial enumeration of the machine. Nmap output shows nothing but MSSQL open. We connect to the service using impacket-mssqlclient and begin enumerating the database. After enumerating the default databases and tables, we begin enumerating our permissions to discover we are quite limited with our current user. No xp_cmdshell or OLE Automation privileges. We can use xp_dirtree to attempt at reading files though, which we abuse to capture the service accounts NTLMv2 hash.
Use hashcat mode netntlmv2 to crack the hash with rockyou.txt.
Once we connect back to the service, we discover we are still very limited with permissions, even with the service account! Enumerating privileged users/groups reveals an interesting SA Group - SIGNED/IT.
We can craft a silver ticket and add the groups permissions to the ticket, but we must first enumerate the domain and group SID.
We use the above command to craft our silver ticket, adding the -group flag with the RID of the SIGNED/IT group. Export our ticket to our environment and connect to the MSSQL server using kerberos authentication. Confirm our privileges by enabling xp_cmdshell on the service and executing commands.
Execute a reverse shell through powershell and get the user flag!
SYSTEM
After heavy enumeration of the box and running a bloodhound ingestor, I hit a brick wall with this box. There were no indicators of anything - no files, user privileges, suspicious services, nothing. I decided to set up a socks5 proxy using chisel and forward all the ports to my kali instance for further enumeration.
After doing some digging and correlating the machine name - Signed - I discovered this box was vulnerable to a recent vulnerability that involved NTLM Reflection - CVE-2025-33073.
The original research can be found here.
To keep things concise here, the vulnerability is in the way SMB handles negotiating NTLM authentication when it receives a request. Researchers discovered that if you create a DNS entry with the Hostname prefixed - e.g., srvPADDINGPADDINGPADDING, when deciding what challenge response to send back, it would check if Client hostname was the same as the Server hostname, and if they were in the same domain. By exploiting this, the token from lsass.exe that was under the SYSTEM context would be added to the response, allowing us to capture and relay the privileged NTLM and ultimately gain a SYSTEM shell on this machine.
Add our fake DNS entry using dnstool.py
Start our ntlmrelayx server pointing toward dc01.signed.htb WinRM service
- Exploit PetitPotam using the hostname we used in the DNS entry
If we look at the output of our ntlmrelayx server, we see our attack was successful!
Connect to the opened port over telnet and get our root flag :D