No.2--HackTheBox--ServMon

HackTheBox-ServMon

Windows
难度：eazy
[https://app.hackthebox.com/machines/ServMon]

---

ServMon是一台简单的Windows机器，其特点是HTTP服务器托管一个NVMS-1000（网络监视管理软件）实例。人们发现这很容易受到LFI的攻击，LFI用于读取用户桌面上的密码列表。使用凭据，我们可以作为第二个用户SSH到服务器。作为这个低权限用户，可以枚举系统并找到‘ NSClient ’（一个系统监视代理）的密码。创建SSH隧道后，我们可以访问NSClient web应用程序。该应用程序包含创建可在“NT AUTHORITY\SYSTEM”上下文中执行的脚本的功能。用户被赋予重新启动“NSCP”服务的权限，在创建恶意脚本后，该服务被重新启动，并以SYSTEM的身份执行命令。

---

footstep

1.namp扫描

┌──(kali㉿kali)-[~]
└─$ nmap 10.129.246.65      
Nmap scan report for 10.129.246.65
Host is up (0.50s latency).
Not shown: 991 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
5666/tcp open  nrpe
6699/tcp open  napster
8443/tcp open  https-alt

Nmap done: 1 IP address (1 host up) scanned in 72.91 seconds

首先尝试80端口发现是一个管理界面的入口，但是没有密码，继续尝试登录ftp，使用anonymous可以登录，在ftp服务器中发现两个有用的文件

┌──(kali㉿kali)-[~]
└─$ ftp 10.129.246.65
Connected to 10.129.246.65.
220 Microsoft FTP Service
Name (10.129.246.65:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||49685|)
125 Data connection already open; Transfer starting.
02-28-22  06:35PM       <DIR>          Users
226 Transfer complete.
ftp> cd Users
250 CWD command successful.
ftp> ls
229 Entering Extended Passive Mode (|||49686|)
150 Opening ASCII mode data connection.
02-28-22  06:36PM       <DIR>          Nadine
02-28-22  06:37PM       <DIR>          Nathan
226 Transfer complete.
ftp> cd Nadine
250 CWD command successful.
ftp> ls
229 Entering Extended Passive Mode (|||49687|)
125 Data connection already open; Transfer starting.
02-28-22  06:36PM                  168 Confidential.txt
226 Transfer complete.
ftp> ls /Users/Nathan
229 Entering Extended Passive Mode (|||49688|)
150 Opening ASCII mode data connection.
02-28-22  06:36PM                  182 Notes to do.txt
226 Transfer complete.

使用get命令下载后可以看到

┌──(kali㉿kali)-[~]
└─$ cat Confidential.txt 
Nathan,

I left your Passwords.txt file on your Desktop.  Please remove this once you have e