Escape
Medium Windows Box
Nmap Scan
$ nmap -sC -sV -Pn -oN nmap 10.10.11.202
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-20 09:13 +08
Nmap scan report for 10.10.11.202
Host is up (0.060s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-05-20 09:07:58Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-05-20T09:09:19+00:00; +7h54m36s from scanner time.
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2024-05-19T01:27:27
|_Not valid after: 2025-05-19T01:27:27
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-05-20T09:09:18+00:00; +7h54m36s from scanner time.
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2024-05-19T01:27:27
|_Not valid after: 2025-05-19T01:27:27
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
| 10.10.11.202:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-05-18T17:37:48
|_Not valid after: 2054-05-18T17:37:48
|_ssl-date: 2024-05-20T09:09:19+00:00; +7h54m36s from scanner time.
| ms-sql-ntlm-info:
| 10.10.11.202:1433:
| Target_Name: sequel
| NetBIOS_Domain_Name: sequel
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: dc.sequel.htb
| DNS_Tree_Name: sequel.htb
|_ Product_Version: 10.0.17763
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2024-05-19T01:27:27
|_Not valid after: 2025-05-19T01:27:27
|_ssl-date: 2024-05-20T09:09:19+00:00; +7h54m36s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-05-20T09:09:18+00:00; +7h54m36s from scanner time.
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2024-05-19T01:27:27
|_Not valid after: 2025-05-19T01:27:27
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-05-20T09:08:42
|_ start_date: N/A
|_clock-skew: mean: 7h54m36s, deviation: 0s, median: 7h54m35s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 93.98 secondsInitial Access
Guest account in SMB
When trying with guestaccount for enum4linux, we realised that there is share folder that we are able to access.
After going into that share folder, we will see that there is an SQL Server Procedures file inside.
We will then download the file to our local machine.
In the PDF file, there are a few interesting things. There are instructions on how to access the SQL Server from a non domain joined machine.
There is instructions about what account to use for new hired and users that are still waiting to be created.
So, we will then connect to the MSSQL Server using impacket-mssqlclient.
Getting Net-NTLMv2 for sql_svc
We will start responder on kali.
Next, we will run the follow command so that we can capture the sql_svc's NTLMv2 hash on responder.
After which, we will try to crack it to get the password.
The password for the sql_svc is REGGIE1234ronnie.
Next, we will try to see if it is able to be used on winrm and sure enough it is able to run.
After logging into the user using evil-winrm, we will start to enumerated the machine and will come accross something interesting in the SQL log files. It seems that is the username and password of another user.
Finally, we will log in using evil-winrm and sure enough we are able to login and get the user flag
Privilege Escalation
Certificate Template vulnerability
Last updated