> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.
# MultiMaster
> Verified writeups for the MultiMaster machine of Hack The Box
# MultiMaster
\$ tldr SQLi unicode + WAF bypass → AD enum → privesc
| · | · |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operating system | Windows |
| Difficulty | Insane |
| Vector | Active Directory |
| IP | `10.10.10.179` |
| Retirement date | 2020-09-19 |
| Skills | SQLI (SQL Injection) - Unicode Injection WAF Bypassing Advanced Python Scripting - Creation of an automation tool to handle Unicode in SQL injection Database enumeration through the previously created utility Cracking Passwords Active Directory Enumeration Enumerating domain information through SQL injection Obtaining domain RIDs through SQL injection Applying brute-force attack (SID = SID+RID) to obtain existing domain users \[Python Scripting] SMB Brute Force Attack (Crackmapexec) Enumerating AD existing users (rpcclient/rpcenum) Abusing Remote Management User group Microsoft Visual Studio 10.0 Exploitation (User Pivoting) Using libwebsockets in order to connect to a CEF Debugger (RCE) AMSI Bypass - Playing with Nishang AMSI Bypass - Bypass-4MSI Alternative (evil-winrm) DLL Inspection - Information Leakage BloodHound Enumeration Abusing the GenericWrite privilege on a user Making a user vulnerable to an ASREPRoast attack - Disabling Kerberos Pre-Authentication Requesting the TGT of the manipulated user Abusing Server Operators Group Abusing an existing service by manipulating its binPATH We change the password of the administrator user after restarting the manipulated service |
## Writeups
| Language | Author | Format | Link |
| -------- | ----------- | ------ | -------------------------------------------------------------- |
| 🇪🇸 ES | **S4vitar** | Vídeo | [Open](https://www.youtube.com/watch?v=z6nmcyk1Pbo) |
| 🇬🇧 EN | **0xdf** | Texto | [Open](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) |
| 🇬🇧 EN | **IppSec** | Vídeo | [Open](https://www.youtube.com/watch?v=iwR746pfTEc) |
## Skill resources
Curated documentation for each technique listed in the *Skills* column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.
| Skill | Source | Link |
| ------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------ |
| Information Leakage | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/information-leak.html) |
| Active Directory | HackTricks | [Open](https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/index.html) |
| SQL Injection | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/sql-injection/index.html) |
| SQL Injection | PortSwigger | [Open](https://portswigger.net/web-security/sql-injection) |
| Brute Force / Rate-Limit Bypass | HackTricks | [Open](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/brute-force.html) |
| BloodHound | BloodHound docs | [Open](https://bloodhound.specterops.io/) |
| WebSockets Vulnerabilities | PortSwigger | [Open](https://portswigger.net/web-security/websockets) |
| Port Forwarding / Pivoting | HackTricks | [Open](https://book.hacktricks.wiki/en/generic-hacking/tunneling-and-port-forwarding.html) |
| AS-REP Roasting | HackTricks | [Open](https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/asreproast.html) |
| SMB (139/445) | HackTricks | [Open](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html) |
| Remote Code Execution (RCE) | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html) |
## Related skills worth mastering
Kerberoasting · DCSync · GetNPUsers (Impacket) · Group Policy Preferences (GPP) · Cross-Site Scripting (XSS) · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI)
## If you liked this machine, try
* [StreamIO](/en/htb/machines/windows/medio/streamio) — Windows, Medium
* [Intelligence](/en/htb/machines/windows/medio/intelligence) — Windows, Medium
* [Bankrobber](/en/htb/machines/windows/insano/bankrobber) — Windows, Insane
* [Fulcrum](/en/htb/machines/linux/insano/fulcrum) — Linux, Insane
* [Blackfield](/en/htb/machines/windows/dificil/blackfield) — Windows, Hard
***
## Comments & tips
Did the official writeup not work? Found a smarter trick? Share it here — comments live in [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).
*Last updated: 2026-06-07*