search

Querier HTB

IP

10.10.10.125

Nmap scan

sudo nmap -sV -sC -A -oA namp_results 10.10.10.125

we have the following ports open

  • 135: RPC

  • 139: NetBIOS

  • 445: SMB

  • 1433: Mssql

Let's start with SMB enumeration

hashtag
SMB

let's see if we can find any shares as an anonymous user.

Looks like we have a share "report" lets mount to the drive and have a closer look

Looking through the share "report" we do see a document, lets copy it onto our machine

When we try to open the document through LibreOffice we are warned that the file contains macros.

What we can do is press okay and continue to open the xlsm file within LibreOffice go to Tools → Macros → Edit Macros.

we should be bought to the following page.

we can see we have a set of Mssql credentials.

  • Quick tip xlsm, xlsx, docx are just zip archives, therefore we can decompress them.

hashtag
Mssql

Since we have a set of Msql credentials, let's try and connect to the server.

  • reporting doesn’t have required privs/permissions to establish a ‘xp_cmdshell’

We can most likely capture some credentials

We can use impacket to capture the NTLMv2-SSP hash, first lets setup our smb server

then from our Mssql client we can use xp_dirtree to try and retrieve a file from our impacket smb server

Once there is a connection established, we can see we captured the NTLMv2-SSP hash

Let's use Hashcat to crack the hash

first, we need to find the hash mode for Hashcat

Now lets crack it

Now that we have Mssql password let's attempt an xp_cmdshell first let's use impacket-mssqlclient and test our credentials

we need to enable xp_cmdshell

Our next goal is to establish a reverse shell on the target machine we need to

  1. Download nc64.exe onto the system

  2. Run nc64.exe to connect back to our netcat listener

Move nc64.exe into your working directory.

Now we can set up a smb server to grab our nc64.exe.

Now from our xp_cmdshell

Now we have nc64.exe on our target machine we can start our netcat listener.

From our xp_cmdshell lets run nc64.exe and connect to our listener.

we now have a reverse shell on the system.

hashtag
Privilege Escalation via mssql-svc

First Lets get some system information and run it through wes-ng

Copy and paste the output to our local machine and run it through wes-ng

  • no luck

if we refer to https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalationarrow-up-right specifically cached GPP(Group Policy Preferences) Password, within the

we can find a file "Groups.xml" if we look at the file.

  • we find a encrypted password, we can use gpp-decrypt to decrypt the password

We get the password

From here we can use impacket-psexec to get a shell on the system as the Administrator

We now have a shell as nt authority\system

PreviousWPE CapstonesNextBastion HTB

Last updated