MultiMaster

Verified writeups for the MultiMaster machine of Hack The Box

MultiMaster

$ tldr SQLi unicode + WAF bypass → AD enum → privesc

·	·
Operating system	Windows
Difficulty	Insane
Vector	Active Directory
IP	10.10.10.179
Retirement date	2020-09-19
Skills	SQLI (SQL Injection) - Unicode Injection WAF Bypassing Advanced Python Scripting - Creation of an automation tool to handle Unicode in SQL injection Database enumeration through the previously created utility Cracking Passwords Active Directory Enumeration Enumerating domain information through SQL injection Obtaining domain RIDs through SQL injection Applying brute-force attack (SID = SID+RID) to obtain existing domain users [Python Scripting] SMB Brute Force Attack (Crackmapexec) Enumerating AD existing users (rpcclient/rpcenum) Abusing Remote Management User group Microsoft Visual Studio 10.0 Exploitation (User Pivoting) Using libwebsockets in order to connect to a CEF Debugger (RCE) AMSI Bypass - Playing with Nishang AMSI Bypass - Bypass-4MSI Alternative (evil-winrm) DLL Inspection - Information Leakage BloodHound Enumeration Abusing the GenericWrite privilege on a user Making a user vulnerable to an ASREPRoast attack - Disabling Kerberos Pre-Authentication Requesting the TGT of the manipulated user Abusing Server Operators Group Abusing an existing service by manipulating its binPATH We change the password of the administrator user after restarting the manipulated service

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
Active Directory	HackTricks	Open
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
Brute Force / Rate-Limit Bypass	HackTricks	Open
BloodHound	BloodHound docs	Open
WebSockets Vulnerabilities	PortSwigger	Open
Port Forwarding / Pivoting	HackTricks	Open
AS-REP Roasting	HackTricks	Open
SMB (139/445)	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Kerberoasting · DCSync · GetNPUsers (Impacket) · Group Policy Preferences (GPP) · Cross-Site Scripting (XSS) · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI)

If you liked this machine, try

• StreamIO — Windows, Medium
• Intelligence — Windows, Medium
• Bankrobber — Windows, Insane
• Fulcrum — Linux, Insane
• Blackfield — Windows, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07