[RedBlock]

Season 7 is finally here.

[RedBlock]

As is common in real life Windows pentests, you will start this box with credentials for the following account: rose / KxEPkKe6R8su

---

Nmap scan report for escapetwo.htb (10.10.11.51)
Host is up (0.044s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl

[RedBlock]

Administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ff

[macavitysworld]

- xlsx files
- get creds
- mssqlclient.py
- enable xp_cmdshell
- enumerate and find creds in config
- esc2 for privesc

[BlackBeer]

I've been suck on this box all day. Thank you LostGem and macavitysworld!

[VoidNull]

- xlsx files
- get creds
- mssqlclient.py
- enable xp_cmdshell
- enumerate and find creds in config
- esc2 for privesc

Got any more tips for the xlsx files? Should they be found on the SMB share that are available?

[RedBlock]

- xlsx files
- get creds
- mssqlclient.py
- enable xp_cmdshell
- enumerate and find creds in config
- esc2 for privesc

Got any more tips for the xlsx files? Should they be found on the SMB share that are available?

smbmap -H 10.10.11.51 -u rose -p 'KxEPkKe6R8su'
IP: 10.10.11.51:445 Name: esc.htb Status: Authenticated Disk Permissions Comment

---

Accounting Department READ ONLY ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ NO ACCESS Remote IPC NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share Users READ ONLY
and then 
smbclient //10.10.11.51/Accounting\ Department -U rose

will show the files

[VoidNull]

- xlsx files
- get creds
- mssqlclient.py
- enable xp_cmdshell
- enumerate and find creds in config
- esc2 for privesc

Got any more tips for the xlsx files? Should they be found on the SMB share that are available?

smbmap -H 10.10.11.51 -u rose -p 'KxEPkKe6R8su'
IP: 10.10.11.51:445 Name: esc.htb Status: Authenticated Disk Permissions Comment

---

Accounting Department READ ONLY ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ NO ACCESS Remote IPC NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share Users READ ONLY
and then 
smbclient //10.10.11.51/Accounting\ Department -U rose

will show the files

Oh my. Well of course. Forgot about the necessity of backslash in spaces. Thanks alot

[Asdjkl01]

Any nudge for the config file? Could you share how you found it also if not to much? I'm just struggling with enumeration.

[userhere123]

Any nudge for the config file? Could you share how you found it also if not to much? I'm just struggling with enumeration.

accounts.xlsx --> sharedStrings.xml