One credential in. Every host in Ninja Hacker Academy out.

The seeded credential was validated against 47 services across all five hosts through twelve lanes. Forty-six rejected it — sa is a local SQL Server principal, so it had no business succeeding anywhere else. The one acceptance was enough to own the tier.

1. 01
   Assumed breach

   saattached to the subnet root as a graph entity
2. Validated across 47 services in 12 lanes
3. 02
   One acceptance

   192.168.57.22:1433SQL\SQLEXPRESS
4. Server principal and configuration enumeration
5. 03
   Authorization mapped

   7 sysadmin loginsincl. academy\frank and SQL\vagrant
6. xp_cmdshell enabled on the instance
7. 04
   Execution proven

   sqlOS command execution in the service context

   Code execution
8. 05
   Machine context

   SQL$the computer account's directory rights

• What it gave up
• academy\frank — a domain user holding sysadmin, learned without touching a DC
• SQL\vagrant — a provisioning account left with database administrator rights
• xp_cmdshell enabled — OS command execution in the SQL service context

NHA's designed entry point is the IIS application here. PCE never touched it. web entered the engagement as a machine account inside a container that SQL$ controlled — a different door into the same building.

1. 01
   Container control

   SQL$GenericAll on CN=Computers,DC=academy
2. Write msDS-AllowedToActOnBehalfOfOtherIdentity
3. 02
   RBCD configured

   webimpersonate arbitrary users to its services
4. Authenticated host access
5. 03
   Local escalation

   writable scheduled-task command pathservice running as SYSTEM
6. Path overwritten, task executes
7. 04
   SYSTEM on WEB

   web192.168.57.21

   SYSTEM

• What it gave up
• RBCD write on the machine object — impersonation of any user to web's services
• SYSTEM execution via a writable scheduled-task path

The starting credential had no privileged access to share. frank's delegation configuration did. Protocol transition makes this a full impersonation primitive rather than a restricted forwarding rule, and the service class on the second hop is not enforced.

1. 01
   Delegation collected

   academy\frankTRUSTED_TO_AUTH_FOR_DELEGATION
2. Ticket obtained on behalf of any user
3. 02
   Allowed target

   eventlog/share.academy.ninja.lanservice class unenforced on the second hop
4. Service class swapped, access widened
5. 03
   Privileged on SHARE

   share192.168.57.23

   Privileged access
6. Local privilege-escalation enumeration
7. 04
   SYSTEM on SHARE

   writable scheduled-task command pathshare data recovered

• What it gave up
• A privileged service ticket to a host the starting credential had no rights on
• SYSTEM execution via a writable scheduled-task path
• Share contents recovered

With host footholds established, PCE collected the academy directory and worked the authorization model rather than looking for an exploit. Dangerous ACLs, delegation attributes and the trust configuration all came from ordinary authenticated reads.

1. 01
   Directory collected

   dc-acSharpHound-class collection
2. ACL, delegation and trust enumeration
3. 02
   Dangerous ACLs

   GenericAll · WriteDacl · WriteOwnerincl. rights over AdminSDHolder
4. Abuse paths walked, not just listed
5. 03
   Delegation surface

   constrained · unconstrained · RBCDall three classes present
6. Trust configuration read from both sides
7. 04
   ACL abuse confirmed

   academy.ninja.lanEXP_ACL relationships recorded

   ACL abuse

• What it gave up
• Dangerous ACL graph across the academy domain, with exploit relationships recorded
• AdminSDHolder rights — persistence that reapplies itself after cleanup
• Bidirectional trust to ninja.hack, enumerated from both domain controllers