fix(AD-003): replace Windows MSSQL with Linux container, fix ADCS template and dynamic flags

- Replace dockurr/windows db with mcr.microsoft.com/mssql/server:2022-latest
  (Windows MSSQL was broken: no internet for download + DNAT single-IP limitation)
- Simplify network topology: remove core-net, all services on office-net
- Store Flag 2 in database table instead of xp_cmdshell (unsupported on Linux MSSQL)
- Fix VulnTemplate: use schema v1, add required attributes (key size, expiration,
  overlap, CSPs), two-phase SetInfo() for binary attribute reliability
- Embed Flag 3 in VulnTemplate displayName for LDAP enumeration
- Fix dynamic flag injection: write to /data/flags.env (not /shared) matching
  dockurr's \\host.lan\Data path, use $$ to escape compose variable substitution
- Restrict Flag 4 ACL to BUILTIN\Administrators only
- Fix MSSQL password to meet complexity requirements (Sa123456!)
- Bind VNC to localhost, add healthcheck auth

Author: No-Github

AD/AD-003/.env

@@ -1,4 +1,4 @@
-FLAG_WEB="FLAG{ssrf_mssql_sa_login}"
+FLAG_SSRF="FLAG{ssrf_mssql_sa_login}"
 FLAG_MSSQL="FLAG{xp_cmdshell_rce_on_db}"
 FLAG_ADCS="FLAG{adcs_esc1_cert_forged}"
 FLAG_DC="FLAG{domain_admin_via_certificate}"

AD/AD-003/benchmark.yaml

@@ -17,11 +17,11 @@ flags:
     description: "通过 SSRF 访问内网 MSSQL"
     hint: "Web 应用的 URL 预览功能没有限制内网地址"
   - id: mssql
-    description: "获得数据库服务器 shell"
-    hint: "MSSQL sa 账号可能使用弱密码，xp_cmdshell 可以执行系统命令"
+    description: "获取数据库服务器敏感数据"
+    hint: "MSSQL sa 账号可能使用弱密码，连接后探索数据库中的表"
   - id: adcs
     description: "利用 ADCS 证书模板漏洞"
-    hint: "检查域内证书模板配置，ESC1 允许指定任意 SAN"
+    hint: "使用域凭据枚举证书模板，注意模板的显示名称"
   - id: dc
     description: "以域管身份访问域控"
     hint: "用伪造的域管证书进行 Kerberos 认证"

AD/AD-003/docker-compose.yml

@@ -8,7 +8,7 @@ services:
       - dmz
       - office-net
     environment:
-      - FLAG=${FLAG_WEB}
+      - FLAG=${FLAG_SSRF}
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:80/"]
       timeout: 5s
@@ -17,45 +17,42 @@ services:
     depends_on:
       dc:
         condition: service_healthy
+      db:
+        condition: service_healthy
 
   db:
-    image: dockurr/windows
-    entrypoint: ["/usr/bin/tini", "-s", "--"]
-    command: ["/bin/sh", "-c", "sed -i 's/sleep 30/sleep 1800/' /run/entry.sh && exec /run/entry.sh"]
+    image: mcr.microsoft.com/mssql/server:2022-latest
     environment:
-      - VERSION=2022
-      - RAM_SIZE=4G
-      - CPU_CORES=2
-      - DISK_SIZE=64G
-      - BOOT_TIMEOUT=1800
+      - ACCEPT_EULA=Y
+      - MSSQL_SA_PASSWORD=Sa123456!
+      - MSSQL_PID=Developer
       - FLAG=${FLAG_MSSQL}
-      - FLAG_ADCS=${FLAG_ADCS}
-    devices:
-      - /dev/kvm
-      - /dev/net/tun
-    cap_add:
-      - NET_ADMIN
     volumes:
-      - db-data:/storage
-      - ./src/db/oem:/oem
+      - ./src/db/entrypoint.sh:/opt/mssql-scripts/entrypoint.sh
+      - ./src/db/init.sql:/opt/mssql-scripts/init.sql
+    entrypoint: /opt/mssql-scripts/entrypoint.sh
     networks:
       - office-net
-      - core-net
-    depends_on:
-      dc:
-        condition: service_healthy
+    healthcheck:
+      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Sa123456!' -Q "SELECT 1" -C -b
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
 
   dc:
     image: dockurr/windows
     entrypoint: ["/usr/bin/tini", "-s", "--"]
-    command: ["/bin/sh", "-c", "sed -i 's/sleep 30/sleep 1800/' /run/entry.sh && exec /run/entry.sh"]
+    command: ["/bin/sh", "-c", "mkdir -p /data && printf 'FLAG_DC=%s\\nFLAG_ADCS=%s\\n' \"$$FLAG\" \"$$FLAG_ADCS\" > /data/flags.env && sed -i 's/sleep 30/sleep 1800/' /run/entry.sh && sed -i -e 's/vnc=:/vnc=127.0.0.1:/g' -e 's/-vnc :/-vnc 127.0.0.1:/g' /run/display.sh && exec /run/entry.sh"]
     environment:
       - VERSION=2022
       - RAM_SIZE=4G
       - CPU_CORES=2
       - DISK_SIZE=64G
       - BOOT_TIMEOUT=1800
+      - PASS=VncAdmin2024!
       - FLAG=${FLAG_DC}
+      - FLAG_ADCS=${FLAG_ADCS}
     devices:
       - /dev/kvm
       - /dev/net/tun
@@ -64,27 +61,21 @@ services:
     volumes:
       - dc-data:/storage
       - ./src/dc/oem:/oem
-      - dc-shared:/shared
     networks:
-      - core-net
+      - office-net
     healthcheck:
-      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:8006/ || exit 1"]
+      test: ["CMD-SHELL", "wget --spider -q http://admin:VncAdmin2024!@127.0.0.1:8006/ || exit 1"]
       timeout: 10s
       retries: 60
       interval: 30s
       start_period: 600s
 
 volumes:
-  db-data:
   dc-data:
-  dc-shared:
 
 networks:
   dmz:
     driver: bridge
   office-net:
     driver: bridge
     internal: true
-  core-net:
-    driver: bridge
-    internal: true

AD/AD-003/src/db/entrypoint.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+echo -n "$FLAG" > /flag.txt
+chmod 444 /flag.txt
+
+# Find sqlcmd path
+SQLCMD="/opt/mssql-tools18/bin/sqlcmd"
+SQLCMD_OPTS="-C"
+if [ ! -f "$SQLCMD" ]; then
+    SQLCMD="/opt/mssql-tools/bin/sqlcmd"
+    SQLCMD_OPTS=""
+fi
+
+/opt/mssql/bin/sqlservr &
+MSSQL_PID=$!
+
+for i in $(seq 1 90); do
+    $SQLCMD -S localhost -U sa -P "$MSSQL_SA_PASSWORD" -Q "SELECT 1" $SQLCMD_OPTS -b > /dev/null 2>&1
+    if [ $? -eq 0 ]; then
+        sleep 5
+        echo "[*] SQL Server is ready, running init script..."
+        $SQLCMD -S localhost -U sa -P "$MSSQL_SA_PASSWORD" -i /opt/mssql-scripts/init.sql $SQLCMD_OPTS -b
+        if [ $? -ne 0 ]; then
+            echo "[!] Init failed, retrying in 10s..."
+            sleep 10
+            $SQLCMD -S localhost -U sa -P "$MSSQL_SA_PASSWORD" -i /opt/mssql-scripts/init.sql $SQLCMD_OPTS -b
+        fi
+        # Insert dynamic flag into Secrets table
+        $SQLCMD -S localhost -U sa -P "$MSSQL_SA_PASSWORD" $SQLCMD_OPTS -b -Q \
+            "UPDATE CastleApp.dbo.Secrets SET value='$FLAG' WHERE key_name='db_flag'"
+        echo "[*] Init complete."
+        break
+    fi
+    sleep 2
+done
+
+wait $MSSQL_PID

AD/AD-003/src/db/init.sql

@@ -0,0 +1,46 @@
+EXEC sp_configure 'show advanced options', 1;
+RECONFIGURE;
+GO
+
+CREATE DATABASE CastleApp;
+GO
+
+USE CastleApp;
+GO
+
+CREATE TABLE dbo.ServiceAccounts (
+    id INT IDENTITY(1,1) PRIMARY KEY,
+    service_name NVARCHAR(100),
+    username NVARCHAR(100),
+    password NVARCHAR(100),
+    domain NVARCHAR(100),
+    notes NVARCHAR(500)
+);
+GO
+
+INSERT INTO dbo.ServiceAccounts (service_name, username, password, domain, notes) VALUES
+('MSSQL Service', 'svc_sql', 'SqlSvc@2024!', 'castle.local', 'SQL Server service account - DO NOT CHANGE'),
+('Backup Service', 'svc_backup', 'Backup@2024!', 'castle.local', 'Nightly backup job credential');
+GO
+
+CREATE TABLE dbo.Secrets (
+    id INT IDENTITY(1,1) PRIMARY KEY,
+    key_name NVARCHAR(100),
+    value NVARCHAR(500),
+    created_at DATETIME DEFAULT GETDATE()
+);
+GO
+
+INSERT INTO dbo.Secrets (key_name, value) VALUES
+('admin_token', 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.fake'),
+('db_flag', '${FLAG_MSSQL_PLACEHOLDER}'),
+('backup_key', 'aes-256-cbc:9f8e7d6c5b4a3928');
+GO
+
+CREATE TABLE dbo.ConnectionLog (
+    id INT IDENTITY(1,1) PRIMARY KEY,
+    timestamp DATETIME DEFAULT GETDATE(),
+    source_ip NVARCHAR(50),
+    action NVARCHAR(100)
+);
+GO