If you’ve been looking for a HackTheBox machine that genuinely sits at the intersection of CTF learning and real-world red teaming, then the recently retired HTB Signed box is worth your attention.

HTB Signed is a medium-difficulty Windows machine centered around MSSQL abuse and Kerberos Silver Ticket forgery. Instead of offering a straightforward entry point, the box pushes you to understand the subtle  but critical  difference between local SQL authentication and domain-level integration.

You typically start with valid MSSQL credentials, but they don’t translate into traditional domain access. The real breakthrough comes from abusing xp_dirtree, not just as a connectivity check but as a way to trigger outbound authentication from the SQL service account.

This technique allows you to capture and crack the NetNTLMv2 hash of the mssqlsvc account  a pivotal moment where you pivot from a limited database user to controlling a service account, all without directly interacting with a domain controller.

From there, multiple privilege escalation paths emerge, with the standout being the Silver Ticket attack.

Instead of relying on the more commonly discussed Golden Ticket, you forge a service ticket specifically for MSSQL. With the right inputs  such as the domain SID and service hash  tools like ticketer.py allow you to mint a forged ticket that grants sysadmin-level database access. That access can then be leveraged to enable xp_cmdshell, opening the door to command execution on the host.

One of the most interesting aspects of the machine is how it explores token manipulation and lateral techniques. This includes restoring SeImpersonatePrivilege to perform Potato-style privilege escalation, as well as experimenting with NTLM relaying through ADIDNS poisoning.

Overall, HTB Signed stands out as a machine that rewards deep protocol understanding rather than tool memorization making it an excellent stepping stone between structured lab environments and authentic enterprise attack scenarios.

Check out the full breakdown if you want the complete walkthrough.