Archetype Walkthrough

Here I will begin with the path of "Starting Point". Basically it’s a series of 9 machines rated easy that should be rooted in a sequence.

HTB Starting Point 9 machines

They will provide official walkthroughs for each 9 machines. As I think it will be very helpfull for noob to understand the platform, techniques and more about HTB. And when it comes to noob, no one is here to find just zero-day vulnerabilities. So from my perspective, it's fine to read each and every walkthroughs provided by HTB and others to understand by yourself. "Walkthroughs are the teachers".

Official HTB Write-up

Enough talks 🥱, let's start to hack. 🐱‍💻

Disclaimers: No flags (user/root) are shown in this writeup (as usual in writeups), so follow the procedures to grab the flags! 🐱‍👤

00. Start Machine …

To start machine, Just click "Join Machine".

Start Machine

Then you can see the IP address for that machine. usually it is 10.10.10.27 🤠

Before going to enumeration steps we can simply ping to the IP address and check our VPN connection and whether machine is alive. Sometimes machines might "Disable" ping requests from passing through the firewall. But in most case ping will be a success!

01. Enumeration First …

01.1 Fast ports scan

Here is the output 👇

I have some tricky bash script to get all open ports as bash variable call "ports". Somehow it will be helpful later. 😎

Yes, we can simply combine those two lines into one. But I need to see results quickly. That's why I divide it into two parts. If you want it in one line, you can use

Here is the output 👇

Here we can see some * (Interesting) ports. others can be avoid.

01.2 Run Nmap Scripting Engine

To get the best result we can run the Nmap Scripting Engine for all open ports. Now we know all open ports so that we can point out and run the script engine as fast as possible.

Most of the case this will be end up an error because of $ports variable. This is not the right time to fix it so if you get any error, run the command without $ports variable and point out all ports.

Here is the output 👇

Now we know the OS is Windows (Microsoft SQL Server 2017 RTM) and it has SMB (1433) port open. And lets enumerate further. Remember enumerating is the key! 🔑

01.3 List all available shares

So here it has smb (1433) port open. I used smbclient to list out all the available shares as anonymous user.

Here is output 👇

Here we got something very interesting right? There is only single share ‘backups’ accessible with no passwords. so let's try to access it and see what's inside.😎😋

So now we are done with SMB shell and there is a file called ‘prod.dtsConfig'. so let's download it.

Now we can open prod.dtsConfig file and yeah that ‘prod.dtsConfig’ file contains a SQL connection string, containing credentials for the local Windows user ARCHETYPE\sql_svc 🥂.

02. Lets get Foothold !!

Now we have credentials, Let's try connecting to the SQL Server using Impacket's mssqlclient.py

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself. Packets can be constructed from scratch, as well as parsed from raw data, and the object oriented API makes it simple to work with deep hierarchies of protocols. The library provides a set of tools as examples of what can be done within the context of this library.

source : https://github.com/SecureAuthCorp/impacket

02.1 Download and use mssqlclient.py

First we need to simply wget and download the mssqlclient.py script.

And then run the script and check whether we are working as a sysadmin (privileged user) or not.

Now we can use the IS_SRVROLEMEMBER function to check whether the current SQL user has sysadmin (highest level) privileges on the SQL Server.

According to the return value (1 = login is a member of role.) yes we have highest privileges.😁 This will allow us to enable xp_cmdshell and gain RCE on the host.

Check below awesome blog posts to understand that trick.

02.2 Usage of xp_cmdshell

To get xp_cmdshell, type below commands.

The whoami command output trigger that the SQL Server is also running in the context of the user ARCHETYPE\sql_svc.

However, Now we can run system commands using xp_cmdshell. why can't we get proper shell. 🤠

Hmmmmah !! what a nice smell for powershell reverse-shell huh! 😍

You can get some idea about reverse shells from below links,

But personally, I like to use Nishang's Invoke-PowerShellTcpOneLine.ps1 to create my rev-shell.

After deleting all comments and unwanted things, powershell script will be like this. 👇

Remember: Type ifconfig tun0 and replace YourIP

02.3 Get Reverse Shell

Now time to get reverse shell. Save above powershell script as anyname.ps1 (here I use script.ps1) and power up mini webserver. I'm a very lasy man you know 🙄 so here I use updog instead of typing long shit in python 😑

Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use HTTP basic auth.

source : https://github.com/sc0tfree/updog

To listen the connection, I always use the swiss army knife (netcat) tool. personally I do not like to get shell through multi handler (metasploit). Trust me, using netcat tool you can learn a lot of things beyond metaspolit. 👽

03. Exploit the target …

Now we can issue the command to download and execute the reverse shell through xp_cmdshell.

I divided up my terminal up to 3 parts using Tmux multiplexer.

RevShell

Woooh!!! We got our shell. 💀 A shell is received as sql_svc, and we can get the user.txt on their desktop.

user.txt

04. Privilege Escalation …

To escalate privileges we can run different tools. By the way, before run any tool there are some steps that you need to run to enumerate some information. I will be showing you one by one in each walkthroughs.

Did you remember? now we are in service account called sql_svc. It's good practice to check recently accessed files/executed commands (Keep in mind as good practice). Mostly (default) our console history will be saved in C:\Users\<account_name>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt . Now you understand what our next step is.

Right, Let's check above file using type command.

Here is the output 👇

Oh no no no noooo.. You see?

The backup share is mapped with admin credentials. Remember if you saw something like this. ready to launch Impacket's psexec.py script.

Here is the output 👇

Finally we have Administrator Privileges. 👌 Now we can access the flag on the administrator desktop.

root.txt

Find me on @twitter

PreviousTable of contentsNextOopsie Walkthrough

Last updated

Was this helpful?