Escape

Tue, 09 Jun 2026 00:00:00 +0000

Introduction

Escape is a medium-difficulty Windows machine built around a realistic Active Directory attack path. There is no flashy web exploit here: the whole box is about chaining together small pieces of information leaked across an AD environment.

The chain looks like this: a document sitting on an anonymous SMB share hands us a low-privilege MSSQL account. From MSSQL we coerce the service account into authenticating back to us and capture its hash. That single credential, sprayed across the domain, gives us a shell. On the host we find a domain user’s password hiding in an SQL error log, and finally we abuse a misconfigured Active Directory Certificate Services (AD CS) template (ESC1) to mint a certificate for the Domain Administrator.

Adcs on appl3b0y

Escape

Introduction