Escape

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.242.117
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-04 06:51 EST
Nmap scan report for 10.129.242.117
Host is up (0.0078s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
1433/tcp  open  ms-sql-s
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49689/tcp open  unknown
49690/tcp open  unknown
49710/tcp open  unknown
49714/tcp open  unknown

Looks like an AD machine to me. Interestingly, they made port 1433 public facing.

SMB Enum

We can find one share available through smbmap:

Before checking this share out, we can enumerate the possible usernames and groups using enum4linux with the same credentials. We find the the domain name is called sequel.

Checking the share out, we can find that there's one file here:

We can download this file and view it.

SQL Server Procedures

This is the file contents:

The next page contains a guest login for the SQL server. We also find a user called brandon.brown, who is likely some kind of database administrator.

We can use mssqlclient.py to connect and interact with this database:

I was able to confirm that xp_dirtree is working on this SQL database, thus allowing us to capture hashes either via smbserver.py or responder.

Just run this within the database:

Afterwards, we would capture an NTLM hash.

We can try to crack this hash via whatever method available to find this password:

With these credentials, I was able to login via evil-winrm.

Privilege Escalation

SQL Logs

This user did not have the flag or any other local privileges. However, since we are an SQL user, we can perhaps read some sensitive SQL files.

Within the C:\SQLServer\Logs file, we can find an ERRORLOG file:

Within that file, we can find some credentials:

With these credentials, we can login as ryan.cooper.

We can grab the user flag now.

Certify.exe -> Admin NTLM

I ran a winPEAS scan to enumerate for me. This scan found some certificates on the machine that could potentially be the PE vector.

We can use certify.exe to find out if this is vulnerable. Using certify.exe find /vulnerable, we can find one certificate:

We can then request for this certificate using this command:

This would output an RSA key and a certificate:

Afterwards, we can simply use openssl to convert this output into a .pfx file:

Then, transfer the pfx file and rubeus.exe to the machine. We can use asktgt with the certificate.

Now that we have confirmed this works, we can append /getcredentials to the end of the Rubeus command.

Then, just pass the hash!

PreviousEpsilonNextFaculty

Last updated