#12 ARCHETYPE - Starting Point - Hack the Box || Complete Walkthrough

Welcome to TIER II! 

Well done at reaching this point. From now on boxes are becoming a bit more difficult in the context of steps, usage of tools, and exploitation attempts as they start looking similar to the boxes in the main platform of HTB. Starting with Archetype which is a Windows machine, you can have a chance to exploit a misconfiguration in Microsoft SQL Server, try getting a reverse shell, and get familiarized with the use of the Impacket tool in order to further attack some services.

Enumeration

Performing a network scan to detect what ports are open is already known as an essential part of the enumeration process. This offers us the opportunity to better understand the attacking surface and design targeted attacks. As in most cases, we are going to use the famous Nmap tool.

We found that SMB ports are open and also that a Microsoft SQL Server 2017 is running on port 1433. 

Enumerate Microsoft SQL server 2017 with the help of smbclient

We are going to enumerate the SMB with the tool smbclient.

• -N : No password 
• -L : This option allows you to look at what services are available on a server

We located a couple of interesting shares. Shares ADMIN$ and C$ cannot be accessed as the Access Denied error states, however, we can try to access and enumerate the backups shared by using the following command:

There is a file named prod.dtsConfig which seems like a configuration one. We can download it to our local machine by using the get command for further offline inspection.

Open the file to inspect the content:

By reviewing the content of this configuration file, we spot in clear text the password of the user ARCHETYPE\sql_svc, which is M3g4c0rp123, for the host ARCHETYPE. With the provided credentials we just need a way to connect and authenticate to the MS-SQL server.

Enumerate the ARCHETYPE using Impacket

Impacket tool includes a valuable Python script called mssqlclient.py which offers such functionality. But first, we should better understand what Impact is and how we can install it.

Visit the Impacket Github link by searching on Google, where you can read all about this tool. 

You can find the mssqlclient.py file from the example directory.

After understanding the options provided, we can try to connect to the MSSQL server using the below command:

We provide the password we spotted previously in the configuration file:

We successfully authenticated to the Microsoft SQL Server!

Foothold

After our successful connection, run help to find out the options of our SQL shell. The help option describes the very basic functionalities it offers.

Gain Foothold from SQL Shell

First, let me enable the XP command shell from 0 to 1. Then, run reconfigure. 

The whoami command output reveals that the SQL Server is also running in the context of the user ARCHETYPE\sql_svc. However, this account doesn't seem to have administrative privileges on the host.

Now, we will attempt to get a stable reverse shell. We will upload the nc64.exe binary to the target machine and execute an interactive cmd.exe process on our listening port. We can download the binary from GitHub.

• Link: https://github.com/int0x33/nc.exe/blob/master/nc64.exe

Now copy this file to the htdocs of the XAMPP webserver. Now Run the control panel and start the Apache web server. My Apache server is running on port 8080.

In order to upload the binary in the target system, we need to find the appropriate folder for that. We will be using PowerShell for this task since it gives us much more features than the regular command prompt. 

In order to use it, we will have to specify it each time we want to execute it until we get the reverse shell. To do that, we will use the PowerShell -c command. 

• -c flag instructs the PowerShell to execute the command.

We will print the current working directory by using pwd command.

Run the below command to upload the nc64.exe file to the download directory.

Now use the below command to get a reverse shell connection:

Before that make sure you have started the Netcat listener on your host machine.

Once you execute the XP Command shell You can find out a reverse shell.

Finally looking back at our Netcat listener we can confirm our reverse shell and our foothold to the system.

The user flag can be found on the user's Desktop.

Privilege Escalation

Escalate Privilege using WinPEAS

For privilege escalation, we are going to use a tool called winPEAS, which can automate a big part of the enumeration process in the target system.

Let me change the directory to Downloads.

Now visit the GitHub link and download the winPEAS.exe file. We will transfer it to our target system by using a once more xampp server.

• Click Here to download: 

On the target machine, we will execute the wget command in order to download the program from our system. We will use Powershell for all our commands.

We successfully downloaded the binary:

Now execute it:

The output of the tool is long, here you can find out some history, logs, and backups. From the output, we can observe that we have SeImpersonatePrivilege, which is also vulnerable to juicy potato exploit.

However, we can first check the two existing files where credentials could possibly be found.

As this is a normal user account as well as a service account, it is worth checking for frequently accessed files or executed commands. To do that, we will read the PowerShell history file, which is the equivalent of .bash_history for Linux systems. The file ConsoleHost_history.txt can be located in this directory.

Now, navigate to the folder where the PowerShell history is stored.

To read the file, we will input, type, and then the file which we want to read.

As you can see, the administrator password i.e.,  MEGACORP_4dm1n!!

Get ADMINISTRATOR Aceess using PSEXEC

We can now use the tool psexec.py again from the Impacket suite to get a shell as the administrator.

The root flag can now be found on the Desktop of the Administrator user.

Finally, we have managed to get both flags.

Task Answer

TASK 1: Which TCP port is hosting a database server?

Ans. 1433

TASK 2: What is the name of the non-administrative share available over SMB?

Ans. backups

TASK 3: What is the password identified in the file on the SMB share?

Ans. M3g4c0rp123

TASK 4: What script from the Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?

Ans. mssqlclient.py

TASK 5: What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?

Ans. xp_cmdshell

TASK 6: What script can be used in order to search possible paths to escalate privileges on Windows hosts?

Ans. winpeas

TASK 7: What file contains the administrator's password?

Ans. ConsoleHost_history.txt