HackTheBox - Overwatch

Why It Matters

The walkthrough shows how misconfigured WCF services and exposed credentials can lead to complete system takeover, urging enterprises to tighten configuration security and monitor internal service communications.

Key Takeaways

• Open SMB share reveals .NET executable and config leaking SQL credentials.
• Config shows WCF service on port 8000 vulnerable to command injection.
• SQL service runs on non‑standard port 6520; credentials grant database access.
• Linked server abuse enables DNS hijack and additional privileged credentials.
• WinRM with harvested credentials allows remote code execution and root access.

Summary

The video walks through the Hack The Box "Overwatch" machine, illustrating how a seemingly innocuous SMB file share can expose a .NET executable and its configuration file, which inadvertently discloses a Microsoft SQL password. The author then discovers that the application hosts a Windows Communication Foundation (WCF) endpoint on port 8000 that lacks authentication and is vulnerable to command injection.

Key steps include enumerating the SMB share, downloading Overwatch.exe and its config, decompiling the binary with ILSpy to reveal WCF service contracts, and identifying a kill‑process function that accepts unsanitized input. The SQL service runs on an unusual port 6520; using the leaked credentials, the analyst gains database access, uncovers a dead linked server, hijacks its DNS name, and extracts additional privileged credentials. Those credentials enable WinRM access, which is then leveraged to invoke the vulnerable WCF endpoint and achieve full system compromise.

Notable techniques highlighted are the use of native SMB client tools to avoid detection, ILSpy for .NET decompilation, and scripting with NXC, Rusthound, and BloodHound to map privilege relationships. The kill‑process command injection is demonstrated by sending a crafted request to the WCF service, which executes arbitrary PowerShell commands on the host.

The chain underscores how a single configuration leak can cascade through multiple services—SMB, SQL, linked servers, WinRM, and WCF—culminating in root access. It serves as a cautionary example for organizations to harden WCF endpoints, enforce least‑privilege database accounts, and monitor for abnormal service interactions.

Original Description

00:00 - Introduction

00:45 - Start of nmap

03:00 - Null Authentication lets us list open shares

05:30 - Using SMBClient and downloading the overwatch binary and config from the fileshare

08:40 - Using ilSpycmd to decompile the dotnet from Linux

10:04 - Looking at the overwatch source, which is a WCF (Windows Communication Foundation) Binary

14:00 - Taking nmap allports output, doing some bashful to get a list of open ports to do our normal nmap against the open ports

17:40 - Finding MSSQL on port 6520, we can login. The Enum_Links shows an SQL Server, it hangs and says the host SQL07 doesn't exist

21:45 - Using BloodyAD to show AD Attributes we can write to, discover we can create DNS Entries, then creating a DNS Entry for SQL07 to point back to us and then getting the SQLMGMT user credentials

25:00 - Looking at the WCF Endpoint, examining the WSDL and explaining it a little bit

26:30 - Executing endpoints in the WCF Endpoint from PowerShell with New-WebServiceProxy and getting RCE on the server

33:00 - Showing how we could have enumerated services from our first shell