Kill Chain
| Phase | Action | Finding |
|---|---|---|
| Reconnaissance | Nmap full port scan | AD services exposed Kerberos, LDAP, SMB, MSSQL |
| Enumeration | SMB guest access | Found software$ share containing a thick client .NET application |
| Vulnerability Analysis | Decompiled overwatch.exe via dnSpy | Hardcoded credentials discovered in SQL connection string |
| Initial Access | Authenticated to MSSQL with found credentials | Linked server SQL07 identified; ADIDNS poisoning used to coerce NTLMv2 hash, cracked to gain WinRM access |
| Privilege Escalation | Local service on port 8000 running as SYSTEM | MonitoringService SOAP endpoint — KillProcess vulnerable to command injection |
| Impact | Full system compromise | Read C:\Users\Administrator\Desktop\root.txt |
Reconaissance
nmap -p $ports -sVC <target>
Several AD related services are exposed, including Kerberos (88), LDAP (389/3268), SMB (445), and MSRPC, confirming Active Directory infrastructure. The host also exposes RDP (3389) and Microsoft SQL Server 2022 at 6520 is a non default port, which may present additional attack surface for authentication attacks, service exploitation, or credential harvesting.
Initial Access
Service Enumeration
Enuemerating smb share with nxc revealed guest access to the software$ share.
The software$ share contains what appears to be a custom software package and its dependencies — a .NET compiled application.
The software$ share hosts a custom software package and supporting dependencies, including a compiled .NET application.The files are further downloaded to an attacker controlled machine inspect locally. Since the software is .NET, it can be decompiled to review the source via a tool like dnSpy tool.
Code analysis revealed that the application stores Microsoft Edge browser history in a SQL Server database, hardcoded credentials were discovered within the sql connection string.
Authenticating to Active Directory
Using the hardcoded credentials to collect AD objects for Bloodhound:
Logging in to MSSQL server at 6520 with the above credentials, the same credential was reused with overwatch.htb. The user only has limited access though. After thorough enumeration, another linked SQL server SQL07 was identified.
However, attempting to access the linked server sql07 throws an error, the server is not found or accessible. Either the SQl07 server is down or the DNS entry for SQL07 is not present.
ADIDNS Poisoning
We can use Responder to coerce the server into authenticating to an attacker-controlled host. For this, ADIDNS poisoning is used.
What is ADIDNS poisoning?
Active Directory Integrated DNS (ADIDNS) stores DNS records inside Active Directory itself, replicating them across domain controllers. Authenticated users can add or modify DNS records in the zone. By injecting a rogue DNS record pointing a hostname (such as sql07) to our machine, we can coerce NTLM authentication when the SQL server attempts to resolve and connect to that name.
More on ADIDNS HackerRecepie: ADIDNS
update /etc/krb5.conf and run kinit to grab a ticket.
This is not a complete DNS zone record but sufficient for the use case. Using nsupdate with the Kerberos ticket, the DNS record for overwatch.htb is modified to point to our attacker machine:
DNS record updated successfully:
Now after connecting with the MSSQL client and executing a command at the linked server, the request is made — which gets captured by Responder:
The NTLMv2 hash of the account that impersonated to authenticate to the AD network is captured:
From Bloodhound analysis, the sqlmgmt account is a member of RemoteManagement, so we can remote into the machine
With the ticket synced, evil-winrm is used to authenticate to the machine and grab the first flag:
Privilege Escalation
After thorough enumeration and cross-checking, an open port was found listening locally at 8000:
Port 8000 process is running with PID 4, it is running as SYSTEM and listening locally.
A Chisel binary is dropped for port forwarding and accessing the service. Before dropping in, always ensure the client and server versions match.
Chisel is connected and running:
The endpoint returns a 404. But it's an active endpoint.
During earlier inspection of overwatch.exe, a class named MonitoringService was identified:
After some trial and error MonitorService endpoint was identified.
The MonitoringService class has three functions:
KillProcessStartMonitoringStopMonitoring
There appears to be a vulnerability in KillProcess as it accepts the user controlled value without any sanitization directly into command making it vulnerable to command injection.
The MonitorService endpoint is valid. The service uses a SOAP architecture.
What is SOAP?
SOAP (Simple Object Access Protocol) is an XML-based messaging protocol for exchanging structured information in web services. It defines how to format requests and responses using XML envelopes, and is commonly used in enterprise .NET services. A ?wsdl suffix on the endpoint URL exposes the full service definition.
Resolving the semantics of the SOAP interface by supplying MonitorService?wsdl:
More on SOAP — W3Schools: XML SOAP
Our focus is on KillProcess.
Exploitation
Crafting the XML envelope for the SOAP action to pass an instruction to kill a process.
Sending the request to the overwatch service:
It seems that sqlmgmt account was granted admin privileges. Signing in, using evil-winrm. Checking local group memberships.
The final root.
