[Protected] Signed HackTheBox Writeup
[Protected] Signed HackTheBox Writeup
October 14, 2025

Nmap Scan
Starting Nmap 7.97 ( https://nmap.org ) at 2025-10-14 21:29 +0200
Nmap scan report for 10.129.242.173
Host is up (0.026s latency).
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
| 10.129.242.173:1433:
| Target_Name: SIGNED
| NetBIOS_Domain_Name: SIGNED
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: SIGNED.HTB
| DNS_Computer_Name: DC01.SIGNED.HTB
| DNS_Tree_Name: SIGNED.HTB
|_ Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-10-14T17:28:46
|_Not valid after: 2055-10-14T17:28:46
|_ssl-date: 2025-10-14T19:30:09+00:00; 0s from scanner time.
| ms-sql-info:
| 10.129.242.173:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH
Enter the Password to Unlock Content
Where can I find the password?
For Linux CTF machines, retrieve the root password hash from the /etc/shadow file.
- Access the file:
cat /etc/shadow(requires root privileges). - Example:
root:$y$j9T$Vy...Gp9B:20286:0:99999:7:::
For Windows CTF machines, retrieve Administrator NT Hash from NTDS.DIT if it's a Domain Controller otherwise retrieve the local Administrator NT hash from the SAM database.
- Use
secretsdump.pyfrom Impacket orhashdumpin Meterpreter (requires administrative privileges). - Example:
Administrator:500:aad3b435b...d3b435b51404ee:0b133be956...701affddec:::
Last updated on