[Day 11] Networking Where Are The Reindeers? | Advent of Cyber 3 (2021)

Today is about network again and a little bit of a database query. I am very interested in learning database, because I rarely touch with the database.

Let’s expose the database..

# There is an open port related to MS SQL Server accessible over the network. What is the port number?

1433

I use -sS for stealth scan, and -sV to see the version and -Pn for break the ping blocking.

# If the connection is successful, you will get a prompt. What is the prompt that you have received?

1>

# We can see four columns in the table displayed above: id, first (name), last (name), and nickname. What is the first name of the reindeer of id 9?

Rudolph

I use SELECT * FROM reindeer.dbo.names; but you can also use SELECT * FROM reindeer.dbo.names WHERE id=9;

# Check the table schedule. What is the destination of the trip scheduled on December 7?

Prague

With the same way.

# Check the table presents. What is the quantity available for the present “Power Bank”?

25000

# There is a flag hidden in the grinch user's home directory. What are its contents?

THM{YjtKeUy2qT3v5dDH}

Check for the command xp_cmdshell first.

And as you can see, the flag.txt hide in the Grinch’s Documents folder.

# Congratulations, the flag you have recovered contains the password of McDatabaseAdmin! In this task, we learned how to use sqsh to interact with a MS SQL Server. We learned that if xp_cmdshell is enabled, we can execute system commands and read the output using sqsh.

just click Question Done

Conclusion

I learn some new knowledge today, it’s about MS SQL Server Vulnerabilities, xp_cmdshell and sqsh command. I am very happy, and thanks.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store