HTB STARTING POINT · Tier 2

Archetype

Anonymous SMB exposes a config file with SA credentials. MSSQL xp_cmdshell goes active, winPEAS finds a PowerShell history file with admin credentials. Classic AD escalation in four steps.…

April 27, 2026 · 4 min · crAIzy
MSSQL RCESMB Anonymous