春秋云镜-【仿真场景】Exchange writeup

墨蓝 2024-03-26 18:56 15阅读 0赞

### **0x00 Intro** ###

1.  OSCP 渗透风格，脱离C2和MSF之类的工具
2.  Box 难度不高

### 0x01 Info ###

*  Tag: JDBC, Exchange, NTLM, Coerce Authentication, DCSync![dae4ef102a33d62add995cddd26ed25d.png][]

### 0x02 Recon ###

1.  Target external IP`39.98.179.149`
2.  Nmap results![69582bd9650bd24b8dbc62fd3de2f7b1.png][]
3.  直接关注8000端口，前面我已经怼过80了，没东西直接过![d375847ccc3f108507e475fd6766fba0.png][]
4.  华夏ERP，有很多漏洞的，入口点卡了很久，后面看到JDBC，直接谷歌一搜就搜到大哥的文章了  
    Fastjson高版本的奇技淫巧 – Bmth (bmth666.cn)([http://www.bmth666.cn/bmth\_blog/2022/10/19/Fastjson%E9%AB%98%E7%89%88%E6%9C%AC%E7%9A%84%E5%A5%87%E6%8A%80%E6%B7%AB%E5%B7%A7/\#%E8%93%9D%E5%B8%BD%E6%9D%AF2022%E5%86%B3%E8%B5%9B-%E8%B5%8C%E6%80%AA][http_www.bmth666.cn_bmth_blog_2022_10_19_Fastjson_E9_AB_98_E7_89_88_E6_9C_AC_E7_9A_84_E5_A5_87_E6_8A_80_E6_B7_AB_E5_B7_A7_E8_93_9D_E5_B8_BD_E6_9D_AF2022_E5_86_B3_E8_B5_9B-_E8_B5_8C_E6_80_AA])
5.  构造payload![d2270b682625fa67d8ff99a2f0ff6d43.png][]
6.  Configure MySQL\_Fake\_Server![53d0e7a214c8fe4f55bf6a9bc3546dad.png][]
7.  未授权 + MySQL Connector JDBC反序列化组合拳直接RCE![212b7a73b5b6e3c9e25a232814023f23.png][]
8.  RCE后直接获取 Flag01![104e90015e10570bf1a020d597a59b7c.png][]

### 0x03 入口点：172.22.3.12 ###

1.  SMB扫描内网主机，看到Exchange关键字 (EXC01)，尝试访问![012af87f9e2b2a0665ee89a60fcfc817.png][]
2.  172.22.3.9 为 Exchange![75c379288a26572216fad0a312fa395e.png][]
3.  Proxylogon 直接打死，获取system权限![c7829d531065e15a677d597359a0a0e0.png][]![e80543b0cff6e2f671b2e362fc7c6b28.png][]
4.  flag02(后续凭据收集略过)![1190fdadf5ceb7cf13532972188300ae.png][]

### 0x04 入口点：172.22.3.9 ###

*  快进1：已经收集到了exchange机器账户的hash
 *  快进2：同时收集到了一个域账户凭据：Zhangtong

1.  这边已经通过上面的操作收集到了exchange的机器账户hash，exchang的机器账户在域内对整个domain-object有writedacl权限，那我们直接使用dacledit.py给Zhangtong加dcsync权限(其实你也可以给自己加上dcsync)![fa701e1b05326042daa242b010ce010a.png][]
2.  Dcsync，获取到域管和用户lumia的hashes![b2298c9fd418e52386bb1ee9028c68c0.png][]
3.  进入 172.22.3.2 获取flag04![cabd719942b09f9556099467b7954944.png][]

### 0x05 Final：172.22.3.26 ###

1.  172.22.3.26上面的Lumia用户文件夹里面有个secret.zip![48be3310ea1d206a47b9811d77dbdcdd.png][]
2.  直接PTH Exchange导出Lumia mailbox里面的全部邮件以及附件![2cec8d0f96c4cedda59674a060228a8f.png][]
3.  item-0.eml，提示密码是手机号![fd4d2049a623e61edd47a9b2002174d9.png][]
4.  刚好导出的附件里面有一个csv，里面全是手机号![597a6bb73c5ca6dce014fbbd406b4e72.png][]
5.  常规操作，转换成pkzip格式的hash再跑字典，跑出密码![cbfcbd0aae08ee5b44863898a7c19ce0.png][]![e28e3ab59af0df75c3a650f0460437b7.png][]![f4c81ec25d7e8de90142b27914024579.png][]
6.  flag03![7526d2b02de1beab3fa2619e56cfd239.png][]![ead3b7e628d03750ff862d26ff757f0a.png][]

### 0x06 Outro ###

1.  Exchange 后渗透那，作者本意是想让我们用 NTLM Relay去完成DCSync提权，获取Exchange SYSTEM权限后，触发webdav回连中继到ldap，这里的话就不尝试了，有兴趣的话可以看我上一篇文章 Spoofing

2.Lumia用户登录exchange那，作者也是想让你改掉Lumia用户的密码，但是我就懒了，直接PTH

原文链接： [https://www.anquanke.com/post/id/286967][https_www.anquanke.com_post_id_286967]

[dae4ef102a33d62add995cddd26ed25d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/2a35561f24cf4710be43df4896358772.png
[69582bd9650bd24b8dbc62fd3de2f7b1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/3fc35f60e75a4f83b7db47591d248dab.png
[d375847ccc3f108507e475fd6766fba0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/bf24bcaae7584ddb913bf6254d763d96.png
[http_www.bmth666.cn_bmth_blog_2022_10_19_Fastjson_E9_AB_98_E7_89_88_E6_9C_AC_E7_9A_84_E5_A5_87_E6_8A_80_E6_B7_AB_E5_B7_A7_E8_93_9D_E5_B8_BD_E6_9D_AF2022_E5_86_B3_E8_B5_9B-_E8_B5_8C_E6_80_AA]: http://www.bmth666.cn/bmth_blog/2022/10/19/Fastjson%E9%AB%98%E7%89%88%E6%9C%AC%E7%9A%84%E5%A5%87%E6%8A%80%E6%B7%AB%E5%B7%A7/#%E8%93%9D%E5%B8%BD%E6%9D%AF2022%E5%86%B3%E8%B5%9B-%E8%B5%8C%E6%80%AA
[d2270b682625fa67d8ff99a2f0ff6d43.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/9cb7c7e52ca045aeae9ae949bba8245e.png
[53d0e7a214c8fe4f55bf6a9bc3546dad.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/11979b54cabe4d7bb2299053c46eaf82.png
[212b7a73b5b6e3c9e25a232814023f23.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/d0e3ea2c08de47b49dc023a86f1f83d7.png
[104e90015e10570bf1a020d597a59b7c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/65eb6d47901f42c8accd8b3a6c2d1cd8.png
[012af87f9e2b2a0665ee89a60fcfc817.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/a3ad218b48274ad89d44d4e0fd80b757.png
[75c379288a26572216fad0a312fa395e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/c0887b0770504c6aa4f69f6d06bab19e.png
[c7829d531065e15a677d597359a0a0e0.png]: https://img-blog.csdnimg.cn/img_convert/c7829d531065e15a677d597359a0a0e0.png
[e80543b0cff6e2f671b2e362fc7c6b28.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/5bcba5be8c074b51a81341458c0db663.png
[1190fdadf5ceb7cf13532972188300ae.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/1840834c43134ba8ac61c2a38e175ec1.png
[fa701e1b05326042daa242b010ce010a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/b51cd8adba254a6684b8c1c24a18c32c.png
[b2298c9fd418e52386bb1ee9028c68c0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/e72c9e6dc4bb46bcacd445f3812daf0a.png
[cabd719942b09f9556099467b7954944.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/3d61b525f518494982a68b7702fa5710.png
[48be3310ea1d206a47b9811d77dbdcdd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/961a28ef28cc4ee1b9fd71d4c66ffbbb.png
[2cec8d0f96c4cedda59674a060228a8f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/a0943be608584df788a7c7d9de3f4a90.png
[fd4d2049a623e61edd47a9b2002174d9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/6c3f1f061f02413e94f8b1d81cef73b9.png
[597a6bb73c5ca6dce014fbbd406b4e72.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/1166305d0f4d4104a72acc15146a55c2.png
[cbfcbd0aae08ee5b44863898a7c19ce0.png]: https://img-blog.csdnimg.cn/img_convert/cbfcbd0aae08ee5b44863898a7c19ce0.png
[e28e3ab59af0df75c3a650f0460437b7.png]: https://img-blog.csdnimg.cn/img_convert/e28e3ab59af0df75c3a650f0460437b7.png
[f4c81ec25d7e8de90142b27914024579.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/fa98f05d24184b60b6456d55c145a446.png
[7526d2b02de1beab3fa2619e56cfd239.png]: https://img-blog.csdnimg.cn/img_convert/7526d2b02de1beab3fa2619e56cfd239.png
[ead3b7e628d03750ff862d26ff757f0a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/7154d32dd4f24367b57c1a69fc70d1f6.png
[https_www.anquanke.com_post_id_286967]: https://www.anquanke.com/post/id/286967