HackTheBox-windows-Resolute

大家好，这里是 大余安全 的第 188 篇文章，本公众号会每日分享攻防渗透技术给大家。

靶机地址：https://www.hackthebox.eu/home/machines/profile/220

靶机难度：中级（4.7/10）

靶机发布日期：2020年5月28日

靶机描述：

Resolute is an easy difficulty Windows machine that features Active Directory. The Active Directory anonymous bind is used to obtain a password that the sysadmins set for new user accounts, although it seems that the password for that account has since changed. A password spray reveals that this password is still in use for another domain user account, which gives us access to the system over WinRM. A PowerShell transcript log is discovered, which has captured credentials passed on the command-line. This is used to move laterally to a user that is a member of the DnsAdmins group. This group has the ability to specify that the DNS Server service loads a plugin DLL. After restarting the DNS service, we achieve command execution on the domain controller in the context of NT_AUTHORITYSYSTEM .

请注意：对于所有这些计算机，我是通过平台授权允许情况进行渗透的。我将使用Kali Linux作为解决该HTB的攻击者机器。这里使用的技术仅用于学习教育目的，如果列出的技术用于其他任何目标，我概不负责。

一、信息收集

很简单的思路，将服务器级别的插件设置为dayu.dll共享，停止和启动DNS服务器...

获得了root_flag信息...

不会的google搜索DnsAdmins组shell exploit吧..很多文章都讲解了...

linux快打完了，回归windows退休的几台...

由于我们已经成功得到root权限查看user和root.txt，因此完成这台中级的靶机，希望你们喜欢这台机器，请继续关注大余后期会有更多具有挑战性的机器，一起练习学习。

如果你有其他

如果觉得这篇文章对你有帮助，可以转发到朋友圈，谢谢小伙伴~