Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Machine
Eighteen
OS
Windows
Difficulty
Easy
Steps
4
Added
15 Nov 2025

MSSQL creds from the web app pivot to a WinRM user; a BadSuccessor dMSA whose predecessor is Administrator inherits admin and reads the root flag over SMB.

0Reconnmap1FootholdMSSQL creds2Lateraladam.scott3PivotBadSuccessor4Priv escdMSA admin
1Recon2Foothold3Lateral4Pivot5Priv escnmap1MSSQL creds2adam.scott3BadSuccessor4dMSA admin5

How it went

  1. 0
    nmap

    nmap shows only IIS (a Flask app) and WinRM on a Windows 2025 domain controller.

  2. 1
    MSSQL creds

    MSSQL creds (kevin) from the app lead to a webapp DB holding adam.scott's password.

  3. 2
    adam.scott

    adam.scott logs in over WinRM for the user flag.

  4. 3
    BadSuccessor

    adam.scott's IT group has CreateChild on OU=Staff, so a new dMSA whose predecessor is Administrator inherits admin, and Rubeus extracts its keys and PAC.

  5. 4
    dMSA admin

    Through a chisel tunnel, the dMSA's ticket reads Administrator's files over SMB.