hackthebox - bastion （考点：smb & mount &vhd guestmount & sam hash & mRemoteNG 提权）

最新推荐文章于 2024-03-27 22:00:46 发布

冬萍子

最新推荐文章于 2024-03-27 22:00:46 发布

阅读量845

点赞数

本文链接：https://blog.csdn.net/weixin_45527786/article/details/106223181

版权

本文详细介绍了如何利用SMB服务进行渗透测试，包括扫描发现开放的SMB端口，挂载与访问VHD文件，提取SAM哈希，使用impacket工具解密密码，以及通过mRemoteNG实现提权至管理员权限的过程。

摘要由CSDN通过智能技术生成

1 扫描

22想到可能有ssh登录，139 445是smb，要想到进去找敏感文件。

PORT    STATE SERVICE      VERSION
22/tcp  open  ssh          OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey: 
|   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
|   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
|_  256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds

2 smb利用

因为没有80web，突破口就只剩在了smb
可以看到有个Backups。

C:\root> smbclient --list 10.10.10.134 -U ""
Enter WORKGROUP\'s password: 

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        Backups         Disk      
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.134 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
C:\root>

继续深入，note提示文件太大了，不要直接下载。。

C:\root> smbclient //10.10.10.134/Backups -U ""
Enter WORKGROUP\'s password: 
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Apr 16 06:02:11 2019
  ..                                  D        0  Tue Apr 16 06:02:11 2019
  note.txt                           AR      116  Tue Apr 16 06:10:09 2019
  SDT65CB.tmp                         A        0  Fri Feb 22 07:43:08 2019
  WindowsImageBackup                  D        0  Fri Feb 22 07:44:02 2019

                7735807 blocks of size 4096. 2759421 blocks available
smb: \> more note.txt

在这里插入图片描述

继续深入，发现了vhd虚拟硬盘文件。

smb: \> cd WindowsImageBackup
smb: \WindowsImageBackup\> ls
  .                                   D        0  Fri Feb 22 07:44:02 2019
  ..                                  D        0  Fri Feb 22 07:44:02 2019
  L4mpje-PC                           D        0  Fri Feb 22 07:45:32 2019

                7735807 blocks of size 4096. 2759421 blocks available
smb: \WindowsImageBackup\> cd L4mpje-PC
smb: \WindowsImageBackup\L4mpje-PC\> ls
  .                                   D        0  Fri Feb 22 07:45:32 2019
  ..                                  D        0  Fri Feb 22 07:45:32 2019
  Backup 2019-02-22 124351            D        0  Fri Feb 22 07:45:32 2019
  Catalog                             D        0  Fri Feb 22 07:45:32 2019
  MediaId                             A       16  Fri Feb 22 07:44:02 2019
  SPPMetadataCache                    D        0  Fri Feb 22 07:45:32 2019

                7735807 blocks of size 4096. 2759421 blocks available
smb: \WindowsImageBackup\L4mpje-PC\> cd "Backup 2019-02-22 124351"
smb: \WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\> ls
  .                                   D        0  Fri Feb 22 07:45:32 2019
  ..                                  D        0  Fri Feb 22 07:45:32 2019
  9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd      A 37761024  Fri Feb 22 07:44:03 2019
  9b9cfbc4-

最低0.47元/天解锁文章

冬萍子

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
hackthebox - bastion （考点：smb & mount &vhd guestmount & sam hash & mRemoteNG 提权）

1 扫描22想到可能有ssh登录，139 445是smb，要想到进去找敏感文件。PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH for_Windows_7.9 (protocol 2.0)| ssh-hostkey: | 2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)| 256 cc:2e:56:ab:19:97:d5:bb:03
复制链接

扫一扫