dreadnaught- Machine
- Overwatch
- OS
- Windows
- Difficulty
- Medium
- Steps
- 4
- Added
- 24 Jan 2026
A .NET binary on an open SMB share leaks SQL creds; ADIDNS poisoning captures a WinRM account, and a WCF service's PowerShell injection runs as SYSTEM.
How it went
- 0nmap
nmap shows an AD domain controller with MSSQL on 6520 and WinRM.
- 1.NET binary
Anonymous SMB yields overwatch.exe; decompiling it leaks sqlsvc MSSQL creds and a WCF KillProcess command injection.
- 2ADIDNS poison
MSSQL has a linked server (SQL07) with no DNS record; ADIDNS poisoning plus Responder captures sqlmgmt's cleartext creds.
- 3sqlmgmt
sqlmgmt is in Remote Management Users, so WinRM lands the user flag.
- 4WCF inject
The WCF service runs as SYSTEM; injecting into KillProcess's PowerShell gives SYSTEM command execution.