Querier

OS: Windows, Difficulty: Medium, IP: 10.10.10.125

Initial Enumeration

# Nmap 7.70 scan initiated Sun Jul 28 02:15:58 2019 as: nmap -sV -sC -O -A -oN O-Detailed -p 49670,445,49667,1433,139,49671,49688,5985,135,49669,47001,49664,49665,49666 10.10.10.125
Nmap scan report for 10.10.10.125
Host is up (0.22s latency).

PORT      STATE  SERVICE       VERSION
135/tcp   open   msrpc         Microsoft Windows RPC
139/tcp   open   netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open   microsoft-ds?
1433/tcp  open   ms-sql-s      Microsoft SQL Server  14.00.1000.00
| ms-sql-ntlm-info: 
|   Target_Name: HTB
|   NetBIOS_Domain_Name: HTB
|   NetBIOS_Computer_Name: QUERIER
|   DNS_Domain_Name: HTB.LOCAL
|   DNS_Computer_Name: QUERIER.HTB.LOCAL
|   DNS_Tree_Name: HTB.LOCAL
|_  Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2019-07-27T12:38:20
|_Not valid after:  2049-07-27T12:38:20
|_ssl-date: 2019-07-27T19:40:20+00:00; -1h06m51s from scanner time.
5985/tcp  open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open   msrpc         Microsoft Windows RPC
49665/tcp open   msrpc         Microsoft Windows RPC
49666/tcp open   msrpc         Microsoft Windows RPC
49667/tcp open   msrpc         Microsoft Windows RPC
49669/tcp open   msrpc         Microsoft Windows RPC
49670/tcp open   msrpc         Microsoft Windows RPC
49671/tcp open   msrpc         Microsoft Windows RPC
49688/tcp closed unknown
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=7/28%OT=135%CT=49688%CU=31917%PV=Y%DS=2%DC=T%G=Y%TM=5D
OS:3CB857%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=
OS:S%TS=U)OPS(O1=M54DNW8NNS%O2=M54DNW8NNS%O3=M54DNW8%O4=M54DNW8NNS%O5=M54DN
OS:W8NNS%O6=M54DNNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN
OS:(R=Y%DF=Y%T=80%W=FFFF%O=M54DNW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%
OS:W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
OS:T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A
OS:=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%D
OS:F=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=8
OS:0%CD=Z)

Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -1h06m50s, deviation: 0s, median: -1h06m51s
| ms-sql-info: 
|   10.10.10.125:1433: 
|     Version: 
|       name: Microsoft SQL Server 
|       number: 14.00.1000.00
|       Product: Microsoft SQL Server 
|_    TCP port: 1433
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2019-07-28 01:10:22
|_  start_date: N/A

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   221.96 ms 10.10.14.1
2   222.13 ms 10.10.10.125

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jul 28 02:17:19 2019 -- 1 IP address (1 host up) scanned in 81.37 seconds

SMB Enumeration

Checking contents of Reports

Fetch the file and unzip the contents

Credentials for the SQL Server: reporting:PcwTWTHRwryjc$c6

Logoimpacket/examples at master · fortra/impacketGitHub

All the scripts used can be found at Impacket's Github Repository.

MS SQL Database Enumeration

DIRTREE can be run without any restriction, thus we can use this to capture NTLM hashes.

On attacking machine.

On victim machine's SQL server

Results

This hash can be cracked using JTR or Hashcat to get the credentials for the user mssql-svc i.e mssql-svc:corporate568

We have code execution, now we'll use PowerCat to get a reverse shell on the system using xp_cmdshell. Please note, you'll have to host PowerCat on your machine first to download it on the victim machine.

LogoGitHub - besimorhino/powercat: netshell features all in version 2 powershellGitHub

User Own

Root Own

We'll download and import all modules from PowerSploit repository and use them for further enumeration.

LogoPowerSploit/Privesc at master · PowerShellMafia/PowerSploitGitHub

Useful Commands:

Now we'll use the credentials to execute commands as Administrator.

Learning Outcome

Learnt a little too much from this box, NTLM hash catching, Powershell Modules, Invoke-Command module, and MS-SQL using Impacket. Amazing Box.

PreviousActiveNextSecNotes

Last updated

Was this helpful?