Eighteen: exploiting BadSuccessor (CVE-2025-53779)
A write-up of the HackTheBox machine “Eighteen”. This box revolves around turning application password hashes into an Active Directory foothold, then looks at the dMSA privilege-escalation path that Windows Server 2025 introduced. The target The host is a domain controller for eighteen.htb (DC01), and we are given one SQL Server login, kevin. Three TCP services are exposed: an IIS site on 80, SQL Server 2022 on 1433, and WinRM on 5985. DNS on 53/udp confirms the domain controller role. The path runs from the SQL login, through an application database and the password hashes stored in it, to a domain account reachable over WinRM, and from there toward a delegated managed service account (dMSA) escalation specific to Server 2025. ...