Back to writeups
HTBmachineMediumsolved

Mythical

17 Jul 2026 · by 0xIDA

Solvers

Mythical

Author: 0xIDA
Platform: HTB Mini Pro Lab · Category: machine · Difficulty: Medium

Solvers

Summary

Assumed-breach mini pro lab with Mythic Apollo on DC01. KeePass backup via rsync yields domjoin; ADCS ESC4→ESC1 produces DA. Forest trust into mythical-eu leads to MSSQL trustworthy privesc and PrintSpoofer SYSTEM. Master flag is the root WDigest cleartext password in LSASS.

Solution

Backups

  • Mythic https://10.13.38.32:7443, Apollo as Momo.Ayase on DC01
  • rsync share rsync://192.168.25.1/mythical → flag.txt + it.kdbx
  • KeePass4 master 741852 → domjoin / hKvhexY5BtAgtWAY
MYTH{306e2c1b5690892f21b5d86ea4bbdbc3}

Certified

  • Certify/StandIn: Machine template ESC4→ESC1 (SAN + Domain Users enroll)
  • Cert as administrator@mythical-us.vl → Rubeus TGT → Admin NTLM c583ef48c5ed66c727aecb6fab87ac12
  • PTH / schtasks → SYSTEM (C:\ProgramData\Google\update.exe)
MYTH{76cf35201cef0f28026e5bc18e9caa87}

Mythical Master

  • Trust ticket mythical-us$ → mythical-eu.vl
  • \\dc02\dev → getusers.exe → svc_ldap / spray svc_sql (osaRXWkDf2y5SGh5)
  • SQL msdb TRUSTWORTHY + db_owner → sysadmin → xp_cmdshell → agent
  • SeImpersonate → PrintSpoofer SYSTEM
  • Apollo mimikatz privilege::debug sekurlsa::logonpasswords → root WDigest
MYTH{5ce966ce482c67269934e0d01c169b20}

Flag

MYTH{5ce966ce482c67269934e0d01c169b20}

Tools

Mythic Apollo, rsync, keepass4brute, Certify, StandIn, Rubeus, Invoke-SMBExec, sqlcmd, PrintSpoofer, mimikatz