HTB Archetype Walkthrough: Exploiting SMB and MSSQL on Windows Server 2019

·3 views

The Hack The Box machine 'Archetype' runs Windows Server 2019 and exposes several open ports, including SMB on port 445 and Microsoft SQL Server 2017 on port 1433. An Nmap scan revealed the target's configuration, prompting an SMB enumeration using a guest account via smbclient. A publicly accessible SMB share named 'backups' contained a configuration file called prod.dtsConfig, which leaked sensitive credentials. The file exposed a Windows domain account, ARCHETYPE/mysql_svc, along with its plaintext password, M3g4c0rp123. Notably, the compromised account is a Windows domain account rather than a native SQL Server login, which shapes the subsequent exploitation path.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Rheinmetall Open-Sources Battlesuite Connected Weapon System Protocol

German defense manufacturer Rheinmetall has publicly released the protocol documentation for its Battlesuite onboard API, a connected weapon system interface. The release, published on GitHub Pages, covers version 9.10.0 of the onboard API. Battlesuite is Rheinmetall's framework for networked military vehicle and weapon system integration. By open-sourcing the protocol documentation, Rheinmetall makes its technical specifications accessible to developers and potential partners. The move reflects a broader trend of defense contractors publishing interface standards to encourage ecosystem development.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer's 2021 AI Presentation Forecast GenAI Boom 20 Months Before ChatGPT

A software developer gave a presentation on artificial intelligence in March 2021, during a full-stack programming bootcamp, at a time when the tech world was focused on crypto and NFTs. The presentation covered OpenAI's beta platform, the evolution from GPT-2 to GPT-3, and live demos using natural language to generate Excel spreadsheets and functional React interfaces. These capabilities were considered remarkable at the time but have since become commonplace in the industry. The talk also outlined core AI concepts including machine learning, deep learning, supervised and unsupervised learning, and real-world applications such as disease diagnosis and autonomous driving. The developer now reflects on the presentation as a record of the trajectory that led to the generative AI surge that followed ChatGPT's launch in late 2022.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Per-Entity Redis Index Eliminates Costly Full-Keyspace Scans on Cache Invalidation

A software developer has published a technical demo showing how a per-entity index can solve a common Redis cache invalidation problem. When upstream data changes, such as a user's subscription expiring, engineers typically resort to pattern-based commands like KEYS to find and delete all related cache entries. Because Redis is single-threaded, running KEYS across millions of entries can block the server for seconds, stalling every other client request in the meantime. The proposed solution attaches an index to each entity at write time, enabling targeted lookups instead of full-keyspace scans during invalidation. The author has released benchmark scripts and implementation code so developers can reproduce and evaluate the approach under their own workloads.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Old Backlog Tickets Lose Context Over Time, Not Just Clarity

A well-written ticket can become less useful than a brief new one simply because its surrounding context has decayed over time. As months pass, team discussions, assumptions, and priorities that once informed a ticket are forgotten or become outdated, even if the ticket text itself remains unchanged. During refinement, teams should first ask whether an old ticket still reflects current goals before jumping to implementation planning. Engineers at times have refined months-old tickets only to discover mid-process that the work was no longer needed, highlighting the cost of treating old decisions as still valid. Treating ticket age as a signal to re-validate scope and intent — rather than adding formal expiry rules — can prevent wasted effort and misaligned delivery.

0 comments Read more at DEV Community