We've made it.
We're in the last episode of the capstone and this box is no joke whatsoever.
This one is difficult if you struggle on this one.
That's perfectly fine.
If you got it.
Congratulations.
So let's take a look at our results here you can see that we have RBC open one thirty nine for forty
five.
Pretty typical.
We've also got M.S. sequel so we've got a Microsoft sequel server here and you can see a little bit
information about this computer it is called the query here it's on the HP B domain so hack the box
domain and we've got it looks like a win our type port open and a lot of our P C's down here.
So let's see if we have any information coming down here we've got some looks like some Sequel Server
information looks like it's running Sequel Server 2017 we've got S&P security mode signing enabled but
not required.
OK.
And that's about it.
So let's go ahead and explore.
Really we don't have much to explore we can we can take a look at one thirty nine for forty five and
we could take a look at fourteen thirty three.
Maybe there's some sort of default credentials and maybe there's an exploit for Sequel Server.
We don't really know at this point but really where we want to be as we want to look at SMB is probably
the likelier path and then we'll see if maybe if there's nothing there then we're going to try doing
like default credentials here or something along those lines.
But let's go ahead and dive in.
I'm gonna open a new tab up and we'll just do an SMB client on this we'll do a dash L and then I've
actually forgotten the IP address 10 10 10 as one something.
One twenty five.
All right.
Ten ten ten one twenty five.
We'll go ahead and just list this out enter password see what happens okay.
And we get one non typical here right.
We've talked about the typical share names we see reports is the one that looks not familiar.
So we're gonna go ahead and just do a reports and we'll actually just try to connect to this and see
what we can gather from this.
Gonna go ahead and hit enter and we're in.
So let's do l s and there's only one thing to download which is this currency volume report and it's
an excel file.
So let's copy this and let's go ahead and just do a get in our copy paste just like that okay.
And now this should be sitting in our root folder.
So since this is the only thing I'm going to go ahead and exit and since this is an Excel document we
could use excel and take a look at it.
And if you want to go that route you absolutely can you would actually have to look at macros inside
of this to find what we're looking for but you could do some things to this as well just to kind of
see maybe there's something in here that we could take a look at.
You could do a quick bean walk on this file
and you can actually see let me blow this up that there are a ton of archives in here right.
There is a bunch of different examples and that's how these these Excel files are actually compiled
is with a bunch of different Excel files and we can see here all the different examples that exist so
we could pull this down if we wanted to.
We do have been lock dash dash help.
You could take a look at the different bean walk options and the one that I'm really looking into is
extract.
This is really cool boardwalk.
We use a lot for steganography but here as well you can look at just been walk and see what files are
inside of another file.
So we can do an extract on this and I'm going to tab up and just actually come over here and do a dash
E OK.
And this is what was extracted.
So now typically we can see into the currency or wherever it just popped over.
So let's do it.
ELLIS All right so my tab crashed on me I just opened up a new tab and it closed that one out and let's
go ahead and Ellis and we can see here that there is a currency volume report extracted.
So we're just going to C.D. into that.
We see these into currency value report extracted.
We Ellis in here and you can see that there's different files in here.
If we actually see into the Excel LSA there's a few different workbooks and worksheets and cetera where
we're actually after is investigating these manually.
So if we didn't use the Excel version of this and go in and look at the the macros individual basic
then we're going to have just kind of look at this as we go now if you went through and kind of just
read through all these.
That's absolutely appropriate method.
Again just like the box previously we have to do our enumeration the more enumeration we do the better
off we're going to be and we're going to go ahead and look at this VBA project.
So I'm just gonna cut out VBA project that been and if we take a look at this we actually have credentials
sitting in here
so you can see right here I'll make it bigger that we have a user I.D. of reporting and a password.
PCCW whatever this is very long password good password actually let's go ahead and copy this.
I'm going to just put this into a file.
That way we have it safe here.
So from here what we're going to do is we're going to try to connect to the database.
So these look like they are sequel connections right Sequel Server query here.
And we've got a new I.D. President working directory.
So from here we're going to I'm actually just going to see the back to root and we're going to go ahead
and try to connect now impact impact it keeps coming up.
It's fantastic impact it can connect to my sequel server or with using a tool called My secret client
dot pi.
So what we're gonna do is we're just going to connect.
We can do a dash help and take a quick look at it and it's very similar in the syntax that we use otherwise.
So just like P.S. exact or however we want to use their tool set it's the domain username password at
the target IP address.
So we're going to do is we're gonna go ahead and just type that in which is going to look something
like this will do MF sequel client dot pi.
We're gonna say clearer reporting remember reporting was the I.D..
We're gonna go ahead and just in quotations here paste the password and then we're gonna go and say
at 10 10 10 that one twenty five and we're gonna use Windows authentication
just like this.
Go ahead and hit enter and you can see we have now connected to the machine now ideally what we're after
when we connect to a sequel server is we want to say hey let's go ahead and try to get a shell and what
we can do is we could say hey enable XP command shell which is just like this enable XP command so you
can just hit enter or tab and then enter you can see that we actually don't have the permission to do
this.
So if we were able to get a command shell here we would be able to access the command line and run commands.
So because we cannot we need to enumerate this box further now because this box is named query or it
kind of gives a hint as to how we need to access this machine remember every box name kind of is a little
bit of a hint and with sequel and sequel injection and getting on to these shells here we actually have
the capability of pulling down hashes.
Now if you're familiar with responder from the practical ethical hacking cause you know that we can
pull down hashes we can actually pull down a hashes from sequel we can force the hash to come to us.
So this is a great example of how we can do this and this could actually be leveraged in real world
situations.
So let's take a look at what we can do.
We could say something along the lines of running responder and we going to have to run responder.
We actually take one step shorter and just run a another impact tool kit which is SMB server so we can
open up a new tab
and before we do that we can go ahead make a directory or click we just call it share.
And what we're going to do is we're going to just use SMB server dot pie we can say hey SMB to support
because remember from the map scan we're running on SMB too and we can just say Cher is going to be
Cher
OK.
And now it's loading where we're just waiting for some sort of interaction with our SMB server.
So we're gonna do on our end is we're going to execute a command called XP underscore dir tree.
OK.
And this is going to allow us to make a call out to this connection.
So if we say something like XP.
Execute.
Sorry XP dur tree.
And then we say something along the lines of 10 that turned up 14 dot 8 which is my IP address and then
I just say my share or actually share sorry.
We can do something along the lines of this execute that and if we go check over here you can see that
we actually pulled down a hash.
This is really cool stuff right.
It's to pull down a hash.
Now this is going to be a until M. v. to hash.
This is just like we pull down a hash with the responder.
We can go ahead and try to crack this so let's copy this down.
And if you want more information actually before we copy this if you want more information.
There is a great post I'm going to attach to this which is this post here on how this works.
If you want deeper information exactly how this works.
This is a really cool pen testing trick.
OK so this is a great article by Mark Moe and you can see it's been around for a while and walks you
through exactly all of this.
So this is a really cool trick.
And then we can go ahead and try to crack this.
Now I'll show you two different ways.
So let's go ahead and I'm going to control C on the server and I'm going to copy this.
Let's copy this into a new file so I'm just going to say get it.
Well let's call it password TSC Amina.
Paste this in here.
Now we can save this and we can go ahead and try running something like John the Ripper.
So let's run a John dash dash health really quick.
And we're gonna need to know the format which is net entail and B2 and then we're also going to need
to use a word list which I'm just gonna use Rocky that text that I have in my my downloads folder.
So all I'm going to do is use something along the lines of John and I'll do format net t o am the two
password dot text and then we'll say word list equals downloads slash rock you don t t actually not
show sorry it's take out show.
Show us to show the password which I had to just clear my pop file and I was using to show command so
I've got it on my mind.
OK.
So you can see that we've cracked the corporate five six eight password.
Now the other option here say if you weren't using something like Rocky that text or say if you were
but you this password is maybe towards the bottom of the list.
You wanted to get this done as fast as possible you could absolutely use hash get.
Now I use hash cat 60 40 XY for my machine I use it on the windows.
Now say this was your base OS and you weren't sitting here living in a VM which is what I'm doing then
you're right now what you're doing is you're utilizing your CPO what you want to utilise for hash cracking
is your GPO.
Now I might be just speaking to the choir because this is somewhat of a intermediate course.
Right even though it's called for beginners This is more of you already kind of know your stuff but
you should be cracking with a GP GPO So John's great.
If you want to try to crack something really fast but my recommendation is to use something like hash
cat on your P.C. or your base OS and it would just be something like hash cat 60 for EMC if you're on
Windows you would do it m of thirteen hundred and for the A.L. and B two and then you would just say
something like hashes that text rock you that text and then I like to do a dash o to optimize it and
that would also work very well.
So we actually found the password faster than I thought we would.
So we've gone ahead and cracked it when I did this the first time through I cracked this with hash cat.
So I don't really run John a lot.
I like to run hash cat on my base so as.
So here we are we've got the password and now we can go ahead and just paste that
and we can see this is actually a service account right.
My sequel service so we can try to use this password in a few ways we can try to access the computer
using something like P.S. exact and if we don't have a local admin rights we're not going to pull anything
down.
We could attempt to do something like kerb crossing if you're familiar with active directory and attacks
because we have a actual account domain account then we can try to pull down these services but we're
pulling down probably the only service here and unless this is actually running as an administrator
or domain administrator then we're not be able to do much with this account from that perspective.
So we could query and see what other services are there and you never know if this is running as domain
admin by the way so it never hurts to fire this off as a P.S. exact or w my exact and try to see if
you can get access to this machine.
But in this case we actually won't be able to do that.
So what we're gonna do instead is I'm just gonna copy this and we're going to go ahead and just kill
this sequel session and we're going to run the same thing again but instead of reporting we're going
to use the MF sequel service service HMS sequel bash service and the pass or we're gonna use here as
we're just going to paste what we just found corporate 568 windows off.
Try that one and hey look we have authenticated to this.
Now what did we try last time that we were unable to do.
We tried to execute a XP command shell and let's go ahead and try that again and see maybe if we're
lucky
OK it says hey we have changed from 0 to 1 we are actually now a command shell and something I just
thought of that hit me right now is that when I told you about the the cracking with hash at the M is
actually fifty six hundred.
I don't know why I said thirteen hundred I think I was thinking of Kerber roasting fifty six hundred
is NGL and be too so sorry for that misstatement there but I was just thinking about that as we're doing
this anyway back to this.
So now we have enabled XP command show we should be able to do a dir and see where we can get access
to so we could say like dir see sorry XP command shell DRC and you can see that we have command access
to this machine now and from in here we can see that here is likely the reports share that we were looking
at.
So what we we need to do here is we can't execute commands like this but it's a lot friendlier to have
a shell of our own.
So what we can do is just upload really quick a net CAD or anything just to do this we could actually
even run power shelf we want to and try to get a reverse shell whatever your favorite way of getting
a reverse Shell is.
I'm just gonna go ahead and upload net cat that you see which I do believe we still have in our transfer
folder so Alex here and net cat is sitting in there.
So let's go ahead and just do a python dash em simple a TTP server of 80.
We're gonna host this bad boy up and then we're going to actually just do a quick power show command.
You could use sir you chill here if you want but we're just going to run power shell and so we're just
gonna say XP.
Command shell and then we're going to say something along the lines of like power show we could just
use invoke when request
and then say something like HBP 10 10 14 by 8 for me.
We're gonna grab net cat DLC and then we're just gonna put that into an alt file and then I'll file
as it's going to be we'll put it in reports.
I don't know where we can write although I'm guessing reports is fine.
We could make a temp directory here and just add to that too if we need to.
We'll do net Cat Daddy see and see if this works.
Make sure you add your final quote there.
Let's do a I made a typo here.
Let's take we take this away.
Let's try a dash C on this powerful and see if this works we'll do a command and then run that.
Let's see if that grabs that file.
It does.
OK so my my apologies on the syntax there was a dash C that needs to go here and then from here what
we can do is we can actually execute the next command.
So we could just say something like XP command shell and make sure you're spinning up your neck cat.
I haven't spun it up yet but we could say see reports neck cat that you see and we're gonna want something
like tend tend 14 not a.
And we'll just pick like four four four four is fine and then we'll just execute command the XY so we're
gonna go over here kill our server we'll just do neck cat and the LP for 444 was that run commando.
You see cross your fingers right.
We've got a shell.
Who am I.
So now we're sitting here as the query your M.S. sequel service perfect so let's see the over two reports
since we know we can write there and I'm going to go ahead and pull off the same thing we did from episode
2 of this or box 2 where we use the basic power shell for pen testers.
So I just went ahead and copied that line over here and we're going to download and execute power up.
Now remember power up was running a runs on the invoke all.
So we'll go ahead and take a look at that really quick but I'm just setting this up the port 80 to download
from us and we're going to execute that.
Let's go ahead and just open up a new tab real quick.
And if we get it power up we could see we've got invoke all checks here.
OK.
So invoke all checks at the end.
We're just going to run this all at once when we download this.
So let's pull this file.
Make sure that we have everything we need 10 dot 10 to 14.
Eight port 80 power wrapped up.
Yes one.
Should invoke all checks and we run this.
Go ahead and try it
and this might take a second and it might take a second and be easier if I actually have the web server
running huh.
OK.
Make sure you up servers running.
Let's try it one more time.
There we go it's launching power up and this will just take a second to run through.
So this is going to be interesting to see what it finds and I'll talk through this as it's going actually
it's done.
Let's scroll up and see if it found anything
and it does find one thing so it finds in here the USO S.V. C. OK.
So let's take a look at the USO SBC.
If we do something along the lines of SC QC U.S. Oh SBC
you will see that it is executing in its binary path.
This Windows system 32 SBC hosted at XY dash K Net services dash P Well this looks a lot like a binary
path exploitation right where if we do have and we could run access check on this and see if we have
the service all service if we have re read right but this is kind of already done this for us it's saying
hey we have the permissions to abuse this and we could actually cheat and use the invoke service user
ad but we could just come in here and pop a reverse shell as well so we can do is we could say hey we
already have net cat on this machine what if we just modify the path of this so we can do S.V. r sc
config right.
Just like before USO SBC if I can type guys and girls have been path equals and then we'll say something
like see reports net candidate sexy and we'll say 10 10 14 dot eight and we're going to give this 1
5 5 5 5 just a different port than before and of course execute command see just like that so let's
do it.
SC QC really quick make sure that that actually did work and it's not lying to us gay you can see that
we have changed the binary path now we need to stop this and start this.
Remember we could do that pretty easily.
We could say SC stop us so SPC gay and then we could say SC start and don't run this yet.
USO SBC makes sure that we have we can go ahead and stop this we'll just do a net cat and the LP on
all fives
and SC start USO FCC OK who am I.
And boom we are authority system.
So we did a binary path exploitation just like we learned.
So a couple things to note.
There is a second way to actually escalate this machine or an even easier way to escalate this machine
depending on how your power up runs.
Now our power up did not pull it down.
However there is what is called a GP password.
So if you are familiar with the practical ethical hacking course we ran through what GBP passwords are.
There's another great box on this called active from hack the box which covers GBP passwords even better
but stored on this machine is a GBP password in a configuration file.
Now you can drop that and actually grab the password because they are decrypted all and you can grab
the password from this and utilize that to get an administrator shell using a P.S. exact or w my exact
or however you need to to get into the machine.
So that is a second path if you want to challenge yourself and go after that you absolutely can.
There are tools to pull down GP passwords and actually power up should do it.
I'm surprised that it didn't but there are other ways to do this.
I wanted to show you something different because in the last video we did do a password configuration.
I thought it was great to end on the binary path which is part of one of my favorite.
I do love the unquote service bad so I'm good at service past my favorite binary passed close second
and this is something that you'll absolutely see as much as you'll see the the configuration and just
the ability to enumerate.
So we've made it through all five we're done and you should be feeling accomplished even if you didn't
get all the boxes even if you struggled.
That's the point.
You need to learn how to struggle need to learn how to overcome from these situations and improve.
So hopefully all five of these boxes you will learn something and you've gotten a little bit better
you've got to see different types of escalation and you've just overall grown as a as a hacker.
So I'll catch you up in the next video as we talk about the conclusion and where we kind of go from
here.
So it has been wonderful teaching you all and I look forward to seeing you in the next video.