Home

Mantis

Foothold

Nmap Results

┌──[Sun Nov  6 02:49:21 PM CST 2022]-[wlan0:192.168.1.153 tun0:10.10.16.2]-[TheScriptKid]-[/home/pentester/Documents/PenetrationTesting/oscp]
└──# rscan $ip                                        
rustscan --accessible -u 5000 -b 2500 -a 10.129.228.181 -- -Pn -A

PORT      STATE SERVICE      REASON          VERSION
88/tcp    open  kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2022-11-06 20:52:43Z)
135/tcp   open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
389/tcp   open  ldap         syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
1337/tcp  open  http         syn-ack ttl 127 Microsoft IIS httpd 7.5
1433/tcp  open  ms-sql-s     syn-ack ttl 127 Microsoft SQL Server 2014 12.00.2000.00; RTM
|   DNS_Domain_Name: htb.local
|   DNS_Computer_Name: mantis.htb.local
8080/tcp  open  http         syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-title: Tossed Salad - Blog
Viewing The Landing Page Appears To Be a Default IIS Server, However, On An Unusual Port
Viewing The secure_notes Directory Reveals Interesting Files. One With An Interesting Name
The Dev Notes Tells Me That The An SQL User is admin

I Decided To Further Look Into The Dev Notes Filename As It Looks Like A Base64 String.

Decoding The String Shows Which Appears To Be Now A Hex String Revealing A Password

Using The Credentials admin:m$$ql_S@_P@ssW0rd! I Proceed to connect to mssql service using dbeaver

Connected To MSSQL

Privilege Escalation

Navigating to an interesting table in the orcharddb reveals james's password

With James's password I look up the SID for his user

I then proceed to create a privileged ticket granting ticket

With impacket's goldenpac tool I supply james credentials and gain system access

User Proof

user.txt

Root Proof

root.txt

Badge

PreviousGiddy

Last updated