[Protected] Eighteen HackTheBox Writeup
[Protected] Eighteen HackTheBox Writeup
November 16, 2025

Nmap Scan
Starting Nmap 7.98 ( https://nmap.org ) at 2025-11-16 17:49 +0100
Nmap scan report for dc01.eighteen.htb (10.129.146.185)
Host is up (0.38s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to http://eighteen.htb/
|_http-server-header: Microsoft-IIS/10.0
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info:
| 10.129.146.185:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.129.146.185:1433:
| Target_Name: EIGHTEEN
| NetBIOS_Domain_Name: EIGHTEEN
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: eighteen.htb
| DNS_Computer_Name: DC01.eighteen.htb
| DNS_Tree_Name: eighteen.htb
|_ Product_Version: 10.0.26100
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-11-16T17:02:56
|_Not valid after: 2055-11-16T17:02:56
|_ssl-date: 2025-11-16T23:49:33+00:00; +7h00m02s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 7h00m01s, deviation: 0s, median: 7h00m00s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.14 secondsAs is common in real life Windows penetration tests, you will start the Eighteen box with credentials for the following account: kevin / iNa2we6haRj2gaw!
Enter the Password to Unlock Content
Where can I find the password?
For Linux CTF machines, retrieve the root password hash from the /etc/shadow file.
- Access the file:
cat /etc/shadow(requires root privileges). - Example:
root:$y$j9T$Vy...Gp9B:20286:0:99999:7:::
For Windows CTF machines, retrieve Administrator NT Hash from NTDS.DIT if it's a Domain Controller otherwise retrieve the local Administrator NT hash from the SAM database.
- Use
secretsdump.pyfrom Impacket orhashdumpin Meterpreter (requires administrative privileges). - Example:
Administrator:500:aad3b435b...d3b435b51404ee:0b133be956...701affddec:::
Last updated on