---
description: Writeup for Shenzi from offsec Proving Grounds
---

# Meathead

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.214.70 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3yHFLkMtVFgGpd3IOjZT%2Fimage.png?alt=media\&token=ead89c79-4353-4cbb-a19f-b84230e8344b)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSkFDh6Pwo6P9bsOgWDk5%2Fimage.png?alt=media\&token=84c31ea7-1360-47c3-8e9d-8840e5c34850)

### Service Enumeration

### HTTP (Port 80)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fs1lFph8dV6ZtykRD4d0C%2Fimage.png?alt=media\&token=5a99e4f5-4e13-4599-9d8e-22256aa895b0)

Can't really determine the version number. Default credentials also don't work.

### FTP (Port 1221)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FQt46dEpKofPqAY53CVOp%2Fimage.png?alt=media\&token=8402b4a3-466d-49bc-a27c-ed0345910e19)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FNy0yB9rtFU9v5iWeRHbO%2Fimage.png?alt=media\&token=505febf4-7d96-4565-b691-69308a72fa86)

The `MSSQL_BAK.rar` file looks interesting, however, it is password protected.

We can use john to crack it.

`rar2john MSSQL_BAK.rar > hash`

`john --wordlist=/usr/share/wordlists/rockyou.txt hash`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F08lm8yTKWopJYPmwGp6c%2Fimage.png?alt=media\&token=d691490a-a349-4fc9-acd0-2314f24ab6e6)

Looks like we got the password: `letmeinplease`

We try to unrar the file again and it works this time.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlHmcSVca0HFvjJu49quF%2Fimage.png?alt=media\&token=04b100ae-02a6-4e48-ac19-d98ec4cf5839)

Looks like we got the credentials for the MSSQL server. `sa:EjectFrailtyThorn425`

## Exploit

Before we carry on, we need to append the target server information into **`/etc/freetds/freetds.conf`**

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FKXmerGHfsDSUTs4C67KF%2Fimage.png?alt=media\&token=fa8daf19-66cf-4295-8255-5ed12ab7cc44)

Next, create a **.sqshrc** file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlJAv8ep3sFPinptqPbHK%2Fimage.png?alt=media\&token=26fbc4ad-89b3-4539-be07-f7457396bccf)

Now we're ready to connect to the server with `sqsh`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRZ6pHrqKHVCexr9sGgGg%2Fimage.png?alt=media\&token=670950d4-e6c2-40d6-93be-807b2497091b)

{% embed url="https://book.hacktricks.xyz/pentesting/pentesting-mssql-microsoft-sql-server#execute-commands" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRBWe1j4TSiVo0j6hauOW%2Fimage.png?alt=media\&token=1a36a73b-6d56-4ba9-91ad-3ad70a74d394)

We have successfully gotten RCE.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F6TKPntwr5062eIXZvjl0%2Fimage.png?alt=media\&token=ad256984-ae11-4ebb-9e4d-8a62fc3f3c21)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FJ6objr4R8lYrV0ELBHWd%2Fimage.png?alt=media\&token=98cc39f9-c32b-4a0a-9fea-6c186fa52288)

We search the registry hoping to find any plaintext passwords.

`reg query HKLM /f pass /t REG_SZ /s`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVa2P2rXG9maDZMOm5U5K%2Fimage.png?alt=media\&token=9c89ae32-b641-42a3-9918-3f9c3c564650)

We see this and we can try to RDP into the target machine.

`xfreerdp /u:jane /p:TwilightAirmailMuck234 /v:192.168.214.70`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEd3PTT171z3kGHNK7bPs%2Fimage.png?alt=media\&token=b271c1be-9e28-454f-98ef-26d1bd87e8f5)

## Privesc

Immediately, Plantronics Hub on the desktop catches our attention. Let's check the version of it.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FiFcO12fZo6TO2aomVAlD%2Fimage.png?alt=media\&token=47444102-0dc4-4631-a599-f26a7f45db6d)

{% embed url="https://www.exploit-db.com/exploits/47845" %}

Just follow the steps above and we get SYSTEM.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FvACqKmHlz4bK90HznbCd%2Fimage.png?alt=media\&token=14a8a6b3-fb40-4605-98e9-0f935a664e99)
