Escape

Enumeration

Rustscan

sudo rustscan -t 1500 -b 1500 --ulimit 65000 -a 10.10.11.202 -- -sV -sC -oA ./{{ip}}

Ports

Open 10.10.11.202:53
Open 10.10.11.202:88
Open 10.10.11.202:135
Open 10.10.11.202:139
Open 10.10.11.202:389
Open 10.10.11.202:445
Open 10.10.11.202:464
Open 10.10.11.202:593
Open 10.10.11.202:636
Open 10.10.11.202:1433
Open 10.10.11.202:3268
Open 10.10.11.202:3269
Open 10.10.11.202:5985
Open 10.10.11.202:9389

Services

CrackMapExec

The guest user has read access to Public

SMB

I used smbmap to check if any files are present on the Public share

Lets download the file using smbclient

Great the file contains some credentials to connect to the sqlserver

Foothold

Exploitation

SQLServer: Steal NetNTLM Hash

After connecting to the sqlserver using impacket-mssqlclient I discovered that I'm able to use xp_dirtree

Enumeration

Exploitation

First I setup a smbserver on our attacking machine

Next part is to execute xp_dirtree to get a connection on our smbshare

Got the hash

Cracking the hash is also working just fine

Leaked Passwords

Using evil-winrm I was able to get access to the system While checking for interesting files I stumbled across a SQLServer Log called ERRORLOG.BAK

In that file we can identify a new user account and a password

Escalation

Local Enumeration

As always I started to enumerate again using the newly gathered credentials First thing I checked was the groups I'm in which made me aware to check for an AD Certificate Service

Checking for vulnerable Certificate Templates

Exploitation

Certificate: Localadmin

I'll now generate a new certificate using certify.exe for the user Administrator

Convert the certificate for later usage with rubeus

After transferring the converted certificate to my target I use it to generate a TGT and display the NTLM hash to use it with evil-winrm

Administrator

Last updated