hackthebox - Querier （SqlServer mssql 渗透 & olevba & group policy passwords 提权）

1、扫描

可见smb和mssql 开了。连web都没有，就这几个端口渗透了

C:\root> nmap -A 10.10.10.125
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-13 09:36 CST
Nmap scan report for 10.10.10.125 (10.10.10.125)
Host is up (0.34s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
1433/tcp open  ms