> For the complete documentation index, see [llms.txt](https://cybersec.th4ntis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybersec.th4ntis.com/hackthebox/starting-point/tier-2/archetype.md).

# Archetype

## Initial Scan

```nmap
sudo nmap -T4 -Pn -sV -sC -v 10.129.95.187 -oA Archetype
```

<figure><img src="/files/mlQYKRkKtw4sizvgI9yz" alt=""><figcaption></figcaption></figure>

## Task 1

Which TCP port is hosting a database server?

Answer: 1433

## Task 2

What is the name of the non-Administrative share available over SMB?

<figure><img src="/files/1Y7AQGOT1ZMLs3zTcCWK" alt=""><figcaption></figcaption></figure>

Answer: backups

## Task 3

What is the password identified in the file on the SMB share?

<figure><img src="/files/PaLC7xhgITjMiUTEHCSt" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/whQUGcffKeHtXOGQFLx6" alt=""><figcaption></figcaption></figure>

Answer: M3g4c0rp123

## Task 4

What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?

<figure><img src="/files/PXLoGBIBRXbVAU7jEZ9j" alt=""><figcaption></figcaption></figure>

Answer: mssqlclient.py

## Task 5

What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?

<figure><img src="/files/u1iC0AsjDWK1OtvBl66i" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/vxNgaaFNMbgvAgQdk7yi" alt=""><figcaption></figcaption></figure>

Answer:xp\_cmdshell

## Task 6

What script can be used in order to search possible paths to escalate privileges on Windows hosts? [PEASS Github](https://github.com/carlospolop/PEASS-ng) Answer: winpeas

## Task 7

What file contains the administrator's password?

<figure><img src="/files/LHyokQRiRw8eotGOvres" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/0iITF5vChgkxuqKxTo4R" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sVlbkE5g1t9gobxIJRDw" alt=""><figcaption></figcaption></figure>

Answer: ConsoleHost\_History.txt

## Task 8

Submit user flag

<figure><img src="/files/MRwA3fRz1HSyToDcFmgz" alt=""><figcaption></figcaption></figure>

Answer: 3e7b102e78218e935bf3f4951fec21a3

## Task 9

Submit root flag&#x20;

<figure><img src="/files/KQg7okMk6Cs0qshrxyoL" alt=""><figcaption></figcaption></figure>

```powershell
.\winPEASx64.exe
```

<figure><img src="/files/mTyQE1JLduIXmYzapqGE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/HvsoHA6Dww6TuXo4291h" alt=""><figcaption></figcaption></figure>

Administrator Password: `MEGACORP_4dm1n!!`

<figure><img src="/files/kUCPlfueAV2izZxrNofC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5r4TqJsm7w4uG6CDsHg5" alt=""><figcaption></figcaption></figure>

Answer: b91ccec3305e98240082d4474b848528