{
  "id": 7614140,
  "title": "HTB - Archetype",
  "url": "https://urgent.news/2026/09/15/htb-archetype",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-15T19:22:28.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/zkrnvkf/htb-archetype-25l2"
  },
  "original_language": "en",
  "account": "The HTB - Archetype challenge provides a fun and straightforward machine to tackle, as described by a reporter on September 15, 2026. Utilizing Nmap, the researcher first scans the IP address 10.129.192.92 and identifies that the host is up with several open ports, including 135/tcp (Microsoft Windows RPC), 139/tcp (Microsoft Windows netbios-ssn), 445/tcp (Microsoft-ds), 17763/tcp (Microsoft-ds), 1433/tcp (Microsoft SQL Server 2017 RTM), and 5985/tcp (Microsoft HTTPAPI httpd 2.0). Further examination reveals that the machine is part of the Archetype domain, running Windows Server 2019 Standard 17763.\n\nWith port 445 open, the researcher attempts to connect to the target machine using an empty password, but this attempt fails. Next, they enumerate the SMB shares accessible with the guest account by using smbclient -L //10.129.193.31, which reveals a share called \"backups.\" By attempting to access this share through SMB, the researcher downloads a file named \"prod.dtsConfig\" and extracts two crucial pieces of information: a Windows domain account named \"ARCHETYPE/mysql_svc\" and its password \"M3g4c0rp123.\"\n\nInitially, the researcher tries using impacket-psexec to gain an interactive shell on the target machine, but the attempt fails. To overcome this, they explore alternative methods, such as executing a binary that would establish a reverse shell back to their Kali machine. After searching for a suitable binary, they download nc.exe from a GitHub repository and set up a simple HTTP server on their Kali machine to transfer the nc64.exe file to the target Windows machine. Using the impacket-mssqlclient command, they authenticate to the SQL Server host with Windows authentication and execute PowerShell commands through xp_cmdshell to retrieve the nc64.exe file and save it to the sql_svc user's downloads directory. With this successful transfer, the researcher gains an interactive shell, obtaining the user flag.",
  "summary": "OS: Windows Difficulty: Very Easy This was a fun machine to do :) After the Nmap enumeration, we obtained the following results: Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-15 11:05 -0400 Nmap scan report for 10.129.192.92 Host is up (0.24s latency). Not shown: 65523 closed tcp ports (reset) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn…",
  "key_points": [
    "HTB - Archetype challenge identified on September 15, 2026",
    "Windows Server 2019 Standard running on target machine",
    "User flag obtained through reverse shell on SQL Server"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}