> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/try-harder/windows/meathead.md).

# Meathead

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.214.70 all`

![](/files/o8sQmyDL6Jh81pUqaMpH)

![](/files/mzVsXJqfcR83XuJm5LiL)

### Service Enumeration

### HTTP (Port 80)

![](/files/KPAPByZJzH7WlfeBlH2l)

Can't really determine the version number. Default credentials also don't work.

### FTP (Port 1221)

![](/files/dd53zvWLn6C9RgEHqFiY)

![](/files/Nk6ONWaYcDlHKoB8dUfO)

The `MSSQL_BAK.rar` file looks interesting, however, it is password protected.

We can use john to crack it.

`rar2john MSSQL_BAK.rar > hash`

`john --wordlist=/usr/share/wordlists/rockyou.txt hash`

![](/files/UaSfUNxHSb3D41VoWmZD)

Looks like we got the password: `letmeinplease`

We try to unrar the file again and it works this time.

![](/files/32Obfg8H6Q6WXw7O81vp)

Looks like we got the credentials for the MSSQL server. `sa:EjectFrailtyThorn425`

## Exploit

Before we carry on, we need to append the target server information into **`/etc/freetds/freetds.conf`**

![](/files/ijQoJWeUlanES1YFFF7o)

Next, create a **.sqshrc** file.

![](/files/hwsglIny8a2yO9gbSDt4)

Now we're ready to connect to the server with `sqsh`.

![](/files/m3tvMnmRmmNdeaLQbKHA)

{% embed url="<https://book.hacktricks.xyz/pentesting/pentesting-mssql-microsoft-sql-server#execute-commands>" %}

![](/files/CAyQxXgvhovULRLIICAa)

We have successfully gotten RCE.

![](/files/uLat5yDq3TQB2cs8t3iR)

![](/files/WEvhHpTYvL1qlGGyFph6)

We search the registry hoping to find any plaintext passwords.

`reg query HKLM /f pass /t REG_SZ /s`

![](/files/5Fb15mQehWKXdpSxUMJg)

We see this and we can try to RDP into the target machine.

`xfreerdp /u:jane /p:TwilightAirmailMuck234 /v:192.168.214.70`

![](/files/Sri6Mzx29mxEe3Y9aMO8)

## Privesc

Immediately, Plantronics Hub on the desktop catches our attention. Let's check the version of it.

![](/files/NGXDytE4lOXRhB7W4mYc)

{% embed url="<https://www.exploit-db.com/exploits/47845>" %}

Just follow the steps above and we get SYSTEM.

![](/files/HsyDhUKqF0nNnlJ0xOnQ)