# Archetype

## Initial Scan

```nmap
sudo nmap -T4 -Pn -sV -sC -v 10.129.95.187 -oA Archetype
```

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F2egqib8EBLevVbugjL6O%2Fimage.png?alt=media&#x26;token=d8c79342-4734-445a-9003-e06cf1f6ea25" alt=""><figcaption></figcaption></figure>

## Task 1

Which TCP port is hosting a database server?

Answer: 1433

## Task 2

What is the name of the non-Administrative share available over SMB?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FU8cTv3jWsUgumWiyJJ1j%2Fimage.png?alt=media&#x26;token=d139c044-cc13-40fd-9b9b-545fe371fc8e" alt=""><figcaption></figcaption></figure>

Answer: backups

## Task 3

What is the password identified in the file on the SMB share?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fp0ypZhggx4Qhk2N7z2da%2Fimage.png?alt=media&#x26;token=369a29c2-87b3-42a1-9227-1d82ad37dc48" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FwjcpKV84qCtRsLKJQcY3%2Fimage.png?alt=media&#x26;token=bfd3db53-ea07-4ca1-8fab-ab7ac1d9fc8c" alt=""><figcaption></figcaption></figure>

Answer: M3g4c0rp123

## Task 4

What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F6phwr3QT1eRlpf9iatcG%2Fimage.png?alt=media&#x26;token=c2c3fd07-dfbf-4609-86e8-8e03990d4cda" alt=""><figcaption></figcaption></figure>

Answer: mssqlclient.py

## Task 5

What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FJRYX6CKnW7dPemTJnz1p%2Fimage.png?alt=media&#x26;token=243a7482-1144-4140-9099-b086343a044a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F6zVyuFezClyFfxdsv4Pk%2Fimage.png?alt=media&#x26;token=0a197323-2373-4c80-afaa-142012b603d5" alt=""><figcaption></figcaption></figure>

Answer:xp\_cmdshell

## Task 6

What script can be used in order to search possible paths to escalate privileges on Windows hosts? [PEASS Github](https://github.com/carlospolop/PEASS-ng) Answer: winpeas

## Task 7

What file contains the administrator's password?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FonUcBszD9SKQdVe0PZIW%2Fimage.png?alt=media&#x26;token=19cdd339-fce7-4091-84a7-656ebf9a6204" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FsdlJ4duNs3pqjnvesOys%2Fimage.png?alt=media&#x26;token=fdd075aa-c16d-4e0c-b806-3378dab3dd96" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FbgO11gayby7ukHERiTUr%2Fimage.png?alt=media&#x26;token=ec3a4e7b-76e3-4c26-a60a-5cdaeb70a2cd" alt=""><figcaption></figcaption></figure>

Answer: ConsoleHost\_History.txt

## Task 8

Submit user flag

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fevgsij9WTrhixEOoNV2c%2Fimage.png?alt=media&#x26;token=4da3fd2d-cecf-4b55-b016-d24119536669" alt=""><figcaption></figcaption></figure>

Answer: 3e7b102e78218e935bf3f4951fec21a3

## Task 9

Submit root flag&#x20;

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F5SBD4cDjp5OitHkVR1Se%2Fimage.png?alt=media&#x26;token=ba912bb7-69d4-4c46-8f5a-4afc5251bc28" alt=""><figcaption></figcaption></figure>

```powershell
.\winPEASx64.exe
```

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FTVTYk7VAaGsYCE2eQAqY%2Fimage.png?alt=media&#x26;token=23a6fa7b-366e-4593-9adf-4a4d974d1fad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FRMkXgINyg3olUy6hw4fT%2Fimage.png?alt=media&#x26;token=d83a10bb-b8b2-4ab5-b41c-f2a03fbd0a2d" alt=""><figcaption></figcaption></figure>

Administrator Password: `MEGACORP_4dm1n!!`

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FgXrs2pTbwPb87GawZcUV%2Fimage.png?alt=media&#x26;token=f35363eb-37d4-44c0-b773-48ee074195e4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FodNbYV3L7GCHKUJrD0S7%2Fimage.png?alt=media&#x26;token=92ace24f-b101-443b-966e-6fb50a2ab2f7" alt=""><figcaption></figcaption></figure>

Answer: b91ccec3305e98240082d4474b848528