春秋云镜-【仿真场景】Tsclient writeup

深藏阁楼爱情的钟 2024-03-26 18:55 80阅读 0赞

### **0x1 Info** ###

*  Tag:  
    MSSQL，Privilege Escalation，Kerberos，域渗透，RDP
    
    ![image][]
    
      
    靶场地址：https://yunjing.ichunqiu.com/ranking/summary?id=BzMFNFpvUDU

### 0x2 Recon ###

1.  Target external ip`47.92.82.196`
2.  nmap
    
    ![image][image 1]
3.  MSSQL 弱口令爆破，爆破出有效凭据，权限为服务账户权限(MSSQLSERVER)`sa:1qaz!QAZ`
    
    ![image][image 2]

### 0x3 入口点 MSSQL - 172.22.8.18 ###

*  前言，该机器不在域内

1.  直接MSSQL shell(这里做完了忘记截图了..)
    
    ![image][image 3]
2.  提权，这里直接获取Clsid暴力怼potato(前面几个clsid是用不了的)  
    修改GetClsid.ps1，添加执行potato
    
    ![image][image 4]
    
      
    Potato和GetClsid.ps1
    
    ![image][image 5]
    
      
    执行GetClsid.ps1
    
    ![image][image 6]
    
      
    获取到有效clsid以及命令执行结果
    
    ![image][image 7]
3.  导出SAM，SYSTEM，Security
    
    ![image][image 8]
    
      
    解出凭据，用administrator + psexec 139横向(外网没有开445)就能获取到 flag01`administrator 2caf35bb4c5059a3d50599844e2b9b1f`
    
    ![image][image 9]
4.  qwinsta和端口连接看到有机器rdp过来
    
    ![image][image 10]
    
    ![image][image 11]
5.  这边使用administrator psexec后上msf(system权限)，使用incognito模块，模拟至john(本人实测，只有msf的incognito能完成后续操作，f-secure lab等其他的模拟令牌工具没成功)
    
    ![image][image 12]
6.  使用john的token执行 net use 看到 \\\\tsclient\\C 共享
    
    ![image][image 13]
7.  直接获取 \\\\tsclient\\C 下面的 credential.txt，同时提示 hijack image (镜像劫持)`xiaorang.lab\Aldrich:Ald@rLMWuy7Z!#`
    
    ![image][image 14]

*  快进，略过搭建代理过程

1.  CME 扫描 172.22.8.0/24，有三个机器提示密码过期了
    
    ![image][image 15]
2.  测试一下 DC01 88端口是否开启(测是否域控)，DC01为域控
3.  smbpasswd.py 远程修改一下过期密码，改成111qqq...
    
    ![image][image 16]
4.  ldapshell.py 验证，登录域成功
    
    ![image][image 17]
5.  CME 枚举 RDP，显示能登录进入 172.22.8.46(用CME官方的RDP模块不会扫出有效RDP凭据，这边自己写了一个基于xfreerdp的CME模块)[XiaoliChan/CrackMapExec-Extension][XiaoliChan_CrackMapExec-Extension]
    
    ![image][image 18]

### 0x4 域渗透 - 入口 - 172.22.8.46 ###

1.  登录进入，查看到 xiaorang.lab\\Aldrich 不是这台机器的管理员，只是普通用户

*  提权，两种方法  
    Priv-ESC1：镜像劫持提权(常规)  
    Get-ACL查看到任何用户都可以对注册表 "HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" 进行写入，创建操作
    
    ![image][image 19]
    
      
    创建一个劫持magnify.exe(放大镜)的注册表，执行CMD.exe
    
    ![image][image 20]
    
      
    锁定用户
    
    ![image][image 21]
    
      
    点击放大镜
    
    ![image][image 22]
    
      
    提权至system
    
    ![image][image 23]
    
      
    Priv-ESC2：krbrelayup提权  
    域普通权限用户在域内机器，直接带走(非常规，推荐)
    
    ![image][image 24]
    
    ![image][image 25]

1.  快进mimikatz，获取到当前机器的机器账户 win2016$

xiaorang.lab\WIN2016$ 4ba974f170ab0fe1a8a1eb0ed8f6fe1a

### 0x5 域渗透 - DC Takeover ###

*  两种方法

1.  观察 WIN2016$ 的组关系，发现处于 Domain Admins 组，直接使用 Dcsync 带走 DC01 (过程略)
    
    ![image][image 26]
2.  约束委派(非常规)  
    Bloodhound收集域信息，分析，发现存在约束委派
    
    ![image][image 27]
    
      
    使用 getST.py 进行约束委派攻击
    
    ![image][image 28]
    
      
    带走 DC01
    
    ![image][image 29]

###  ###

原文链接： [https://www.freebuf.com/articles/system/352237.html][https_www.freebuf.com_articles_system_352237.html]

[image]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/4bdb7b4a7ba0436684a303644883f0fa.png
[image 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/60bbe8d0736f4247a513b87e58ce0529.png
[image 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/099a86e303be492db5e322cd79c9ad51.png
[image 3]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/6b0f12cb9586434593961148a7aeafdd.png
[image 4]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/5efaea5af38045af8ca1d00819f538bc.png
[image 5]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/e88c242b56d1451c9e3f944936ca87db.png
[image 6]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/8e020b4c72fd4a4e9c5bce0ad2461e29.png
[image 7]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/c22a422bd1ee4d18970985dc7c9770f0.png
[image 8]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/726edcf9a72f49a395a0aef7314232fa.png
[image 9]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/52ed84278b2d4e5f85c9a1ce6f9ec5f4.png
[image 10]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/81ed0de45e3e4ea4b9450d230296490f.png
[image 11]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/93fbca22dee046899d1137827ed14b58.png
[image 12]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/b9e440e4f2ad48259de1aef352eccc83.png
[image 13]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/cbbb909a121547c995c0ff80aac82125.png
[image 14]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/d5d9b40b76b24e72948f675f2b6a6216.png
[image 15]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/e06891e46b59401084a25e6ac1dd6d87.png
[image 16]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/dbaac98a252444cd9832e83e8e7c5805.png
[image 17]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/bf27e2b6771848d1a279f8cc1cf12eb5.png
[XiaoliChan_CrackMapExec-Extension]: https://github.com/XiaoliChan/CrackMapExec-Extension
[image 18]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/62fcd0cbbd924aeab2b00c68e897ab7e.png
[image 19]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/596a07377cc7443e81d165711c0a26c0.png
[image 20]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/c9fe212ad5324711814ebe1c99e0eb74.png
[image 21]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/7030b68ed6d44379af525b23dce2894f.png
[image 22]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/ef982a24fcd44e278ee6e3772eb2046a.png
[image 23]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/e6407832628d46f2bbaac45ff3470aee.png
[image 24]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/be261e94477540ffb98e1c913a439449.png
[image 25]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/592bc113c45342029811f890005e78f0.png
[image 26]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/b07dfd2f5f8141be8dab72c4a65616cc.png
[image 27]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/6276a1908ff5426aa6c952e6da1571cd.png
[image 28]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/f52c53f3389240f78e494b46552c6cff.png
[image 29]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/26/fc0f30910e9c4700a81d6617b7f122dc.png
[https_www.freebuf.com_articles_system_352237.html]: https://www.freebuf.com/articles/system/352237.html