search
Blog

DarkZero

As is common in real life pentests, you will start the DarkZero box with credentials for the following account john.w / RFulUtONCOL!

hashtag
User

Use of MSSQL Linked Servers to gain user access to DC02.darkzero.ext from DC01.darkzero.htb

impacket-mssqlclient john.w@DC01.darkzero.htb -windows-auth
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

Password:
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (darkzero\john.w  guest@master)> enum_links
SRV_NAME            SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE      SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
-----------------   ----------------   -----------   -----------------   ------------------   ------------   -------   
DC01                SQLNCLI            SQL Server    DC01                NULL                 NULL           NULL      

DC02.darkzero.ext   SQLNCLI            SQL Server    DC02.darkzero.ext   NULL                 NULL           NULL      

useLinked Server       Local Login       Is Self Mapping   Remote Login   
-----------------   ---------------   ---------------   ------------   
DC02.darkzero.ext   darkzero\john.w                 0   dc01_sql_svc

Using a meterpreter payload from revshells.com, we can get a session on metasploit.

We can proceed to enumerate all possible windows exploits using exploit suggester, and obtain a SYSTEM shell on DC02

hashtag
Root

Enumerating trust relationships with poweview.py, we see the following trust attributes

We see the ENABLE_TGT_DELEGATION flag being set. Using DC02 to monitor for incoming authentication requests, we can coerce authentication from DC01.

We can then use ticketConverter for interoperatibility between .kirbi and .ccache

evil-winrm to get the flag

PreviousReboundNextCTF Writeups

Last updated