https://wearethebug.dev/tags/xp_cmdshell/Recent content on WE ARE THE BUGTradecraften-usTue, 14 Feb 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-breach/Tue, 14 Feb 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-breach/Breach is a medium difficulty Windows machine, where guest access to an SMB share is available. By leveraging write permissions on that SMB share, NTLMv2 hashes of a domain user are captured to obtain valid credentials. With access as a low-privileged domain user, a kerberoastable service account (svc_mssql) is revealed. After getting access to the service account, a Silver Ticket attack is performed to impersonate the `Administrator` user and gain access to Microsoft SQL Server. Through the xp_cmdshell feature, remote code execution is achieved as the svc_mssql service account. Finally, privilege escalation is performed by abusing the SeImpersonatePrivilege privilege.