search

P.O.O

Entry Point

10.13.38.11

Lets start with our initial nmap scan

sudo nmap -p- --min-rate 1500 -T4 10.13.38.11 | cut -d"/" -f1 | tr '\n' ','

we have the following ports open on the target machine 10.13.38.11

80,1433

Lets run a more in-depth scan of the target

sudo nmap -sCV -p80,1433 10.13.38.11 -oA 10.13.38.11_tcp

results

80/tcp   open  http     Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
1433/tcp open  ms-sql-s Microsoft SQL Server 2017 14.00.2027.00; RTM+
| ms-sql-info: 
|   10.13.38.11:1433: 
|     Version: 
|       name: Microsoft SQL Server 2017 RTM+
|       number: 14.00.2027.00
|       Product: Microsoft SQL Server 2017
|       Service pack level: RTM
|       Post-SP patches applied: true
|_    TCP port: 1433
| ms-sql-ntlm-info: 
|   10.13.38.11:1433: 
|     Target_Name: POO
|     NetBIOS_Domain_Name: POO
|     NetBIOS_Computer_Name: COMPATIBILITY
|     DNS_Domain_Name: intranet.poo
|     DNS_Computer_Name: COMPATIBILITY.intranet.poo
|     DNS_Tree_Name: intranet.poo
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-01-19T03:16:01
|_Not valid after:  2054-01-19T03:16:01
|_ssl-date: 2024-01-19T12:27:43+00:00; +1s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

we can see

  • HTTP Microsoft IIS httpd 10.0 server

  • domain name intranet.poo we can add this to our hosts file

  • mssql server 2017

Lets check out the webserver

  • Looks like a default IIS server

Lets run feroxbuster and see if we can discover anything

Lets check for any vhosts

  • Nothing interesting

Lets run nikto to see if we can find any vulnerabilities

  • we do se somthing interesting

We can see the web server has a .DS_Store file withim the servers Root directory

what is a .DS_Store file ?

  • it is a hidden file that is automatically created by MacOS operating system when a user opens a folder with the Finder application. The file contains information about which files are in the folder and contains options such as what icons look like.

Why do we care?

here is a great blog that can explain that better then myself

LogoThe risk of .DS_Store - CyberAntCyberAntchevron-right

We can utilize the following parser to enumerate the .DS_Store file

LogoGitHub - Keramas/DS_Walk: Python tool for enumerating directories and files on web servers that contain a publicly readable .ds_store file.GitHubchevron-right

results

we can see a number of interesting entries such as dev and admin

we need a way of finding admins credentials

after some googling we do find this

LogoMicrosoft IIS Tilde VulnerabilityKnowledge Basechevron-right

essentialy we can utilize the "~" tilde to enumerate files and folders on the IIS server. we can use the tilde to discover the first six characters of files and folders along with there extension

we can utilize the following tool

LogoGitHub - bitquark/shortscan: An IIS short filename enumeration toolGitHubchevron-right

results

We need to find the missing character we can use wfuzz for this

we can see the http://intranet.poo/dev/304c0c90fbc6520610abbf378e2339d1/arrow-up-right contains a file poo_co*.txt we need to find the rest of the filename

create a wordlist

running wfuzz

we do find one 200 response

navigating to

http://intranet.poo/dev/304c0c90fbc6520610abbf378e2339d1/db/poo_FUZZ.txtintranet.poochevron-right

we can see the following

Lets see if we can authenticate to the mssql server

first i want to see if ica n run commands with the xp_cmdshell

  • no luck

Lets conduct some basic enumeration

mssql version

List the databases

current datebase

  • couldnt find anything to interesting

We could utilize a mssql server link and point it to an external source

  1. Lets find our current servers name

  1. we can check for linked servers, we can query the sysservers table

  • we can see there is another linked remote server POO_CONFIG

we can utilize the EXECUTE to run queries on other servers

example

  • after enumerating further there wasnt anything to interesting

Lets see if we can get POO_CONFIG to execute queries on POO_PUBLIC

  • notice how the command ran as the 'sa' users, from what i can tell this is most likely a configuration issue, the issue resides in allowing any users on POO_PUBLIC the ability to run queries on POO_CONFIG as the internal users, but the second link looks like it allows any user from the POO_CONFIG to run queries as the 'sa' user

we can see when when we check our permissions through POO_CONFIG -> POO_PUBLIC

  • we can see we have ALL the permissions

Lets create a new 'sa' user with a password so we dont have to keep relying on server links

  1. creating a user

  1. giving our user the necassary permissions

Lets login via our newly created user

  • we are now logged in as a systems administrator

reading the flag

Lets enable xp_cmdshell

  • Note: when we have triggers in place these are essentialy a policy put in place to alert and block attempts at certain actions such as enabling xp_cmdshell, these triggers reside in the sys.server_triggers

  • we can disable them by

Now that we have command execution our next bet will be to estblish a revers-shell on the system

Lets check out the web.config file

Alright i want to try and find a way to access this file

fun fact, when a webserver is enabled to run the stored procedure sp_execute_external_script, and that it is configured to do that as a different user, so lets try and use the this particular procedure to run a simple python script

we can see this procedure is running under the user of poo_public01

Lets see if we can read the web.config file now

and we know have the contents of web.config file

Lets try these creds at the /admin login prompt we found earlier

  • they work

  • i dont see a way in the terms of a foothold within this page, lets go back our mssql client and enumerate the machine further

we do find an IPv6 address

Lets see what nmap can find on this address

results

we can see winrm is enabled, meaning we should be able to use evil-winrm and gain access to the machine

  • we need to add the the hostname and IP address to our hosts file

COMPATIBILITY

Now we should be able to win-rm into the machine

  • it worked

Now we need to find a way of pivoting

we can upload SharpHound.exe via winrm, but try to execute the tool we encounter some problems, Since Administrator is not a domain account we cant query the domain, so we will run SharpHound.exe via our mssql client since we have access to a service account shrek123 we can impersonate a computer account which can query the domain

  1. upload SharpHound.exe via winrm

  1. execute SharpHound.exe via mssqlclient

  1. Now we can download the output zip file onto our local machine and ingest it to bllodhound

Looking through bloodhound we can see within the built in query Shortest Paths to domain admins from kerberoastable users

we can see the user P00_ADM@INTRANET.POO is a member off the help desk and has GnericAll privileges on the Domain Admins group, meaning we can add any member to the Domain Admins group

  1. Lets perform some kerberoasting on the user P00_ADM@INTRANET.POO

  • we will utilize the Invoke-Kerberoast,ps1 script from

https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1raw.githubusercontent.comchevron-right

  • before we run the powershell script via winrm Lets turn off defender to be safe

  • Now we can upload the script

  1. Now just like SharpHound we are going to utilize our mssqlclient session and execute the script

results

  • we can see two account have returned a hash, lets utilize hashcatt and crack these

  • To help clean the hash and get it ready for cracking

  • tried to crack theb hashes but no luck, maybe the hash broke somehow

Now we can crack it using hashcat

  • we had to try a few different wordlists but eventually found it

creds

Now we can use p00_adm's account and add it to the Domain admins group, then we can upload PowerView.ps1

  1. Lets upload PowerView.ps1 via winrm, and import the module

  1. Lets create a PS credential

Now that p00_adm is part of the domain admins group, we can use the account to access the c$ share on the DC

PreviousXenNextHololive THM

Last updated