Host & Network Penetration Testing: The Metasploit Framework (MSF) (Skill Check Lab)

Hey Folks, Hope you are doing well! I have solved this lab yesterday.

Ahh! it took good amount of time. I would say never took help of any AI/LLM. That will ruin your thinking and take you to another direction.

I would say, yeah, let’s go. I took help from other written articles for few hints because i am naive penetration tester trying to learn. But i will keep this blog as simple as possible for my future reference and for you guys.

I can say from reading the Lab description, it’s about MSSQL SERVER.

So, Let’s fire up our lab and do a nmap scan on the target “target.ine.local”

Watch, Nmap Scan. We have port 1433 open which is Microsoft SQL Server 2012.

Flag 1: Gain access to the MSSQLSERVER account on the target machine to retrieve the first flag.

We need to gain access to this server. Let’s fired up the “msfconsole” and search for anything related to “mssql 2012”.

I just wanted to know more about this server, So i can try with mssql_ping.

If you want more information about any auxiliary module or exploit, Just use it and type info.

Now i will set RHOSTS here and run it.

Let’s get credentials of this server, Remember the mysql server enumeration. In that we have privileged or known user is “root” likewise we have “sa” in mssql. ( I get this info from the internet)

So let’s do brute forcing to get the password. Use this Auxiliary module “auxiliary/scanner/mssql_login”

we will use “/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt”

If you look closely to this results. It’s logging in with Username “sa” and blank password.

Now we need one exploit which will give us a reverse shell.

I have read info of 35 number exploit. I think we can use it.

I tried to run , but then i got his error that tells “Target SQL server arch is x64, payload architecture is x86”

So i have changed the payload Arch, to x64 and ran this. Got the meterpreter session.

So i have started Enumeration on it. Like getting privs, uid and sysinfo.

I typed shell and i got the shell. Then i have started finding the flag. I got the First flag in C:\flag1.txt

C:>type flag1.txt type flag1.txt 6650530ca8b54ad585f16637a0db5ced

Second Flag hint is, Locate the second flag within the Windows configuration folder.

So , where is the confi folder. Generally in windows we have confi folder “C:\Windows\System32\config” Let’s try it.

Access is denied. That’s interesting. We might need to escalate our privileges. I didn’t know how to do that, but somehow i figured out.

We need to get back to our meterpreter session and put this “getsystem”

Then i tried, in the meterpreter session itself

“ls C:/Windows/System32/config” and we got the flag2.txt

meterpreter > cat c:/Windows/System32/config/flag2.txt f5bddacbb5ef45079f0eaf15a7a4f5f6

Third Flag Hint : The third flag is also hidden within the system directory. Find it to uncover a hint for accessing the final flag.

I didn’t know where the third flag will be there. I tried a lot and finally got it.

We have EscalatedPrivilages already. We can read it.

C:\Windows\System32\drivers>cd etc cd etc

C:\Windows\System32\drivers\etc>type EscaltePrivilageToGetThisFlag.txt type EscaltePrivilageToGetThisFlag.txt c4993224f8b147518a467e34c49792cd

C:\Windows\System32\drivers\etc>

Now we need to get Fourth Flag.

4. Investigate the Administrator directory to find the fourth flag.

I might think here like we have one user “Administrator”. Need to explore this.

And I did it. The Flag was in Desktop.

C:\Users\Administrator\Desktop>type flag4.txt type flag4.txt 9eaf0d06d06144509d0524694b95f63b

So, we got our all the Flags. Now you can try too. Just remember, we are here to learn, understand and do. I took help of other articles, internet and alot of things. I believe taking help is not bad thing. Keep doing , keep exploring. Thank you for reading my blog. There are many things on the way.