RPC
RPCclient
realblackcat@htb[/htb]$ rpcclient -U "" - N 10.129.14.128
Enter WORKGROUP\'s password:
rpcclient $> rpcclien๋ smb ์๋ฒ์์ ํน์ ํจ์๋ฅผ ์คํํ์ฌ ์ ๋ณด๋ฅผ ์ป์ ์ ์๋ ๋ค์ํ ์์ฒญ์ ์ ๊ณต
์ฟผ๋ฆฌ
์ค๋ช
srvinfo
์๋ฒ ์ ๋ณด
enumdomains
๋คํธ์ํฌ์ ๋ฐฐํฌ๋ ๋ชจ๋ ๋๋ฉ์ธ ์ด๊ฑฐ
querydominfo
๋ฐฐํฌ๋ ๋๋ฉ์ธ์ ๋๋ฉ์ธ, ์๋ฒ ๋ฐ ์ฌ์ฉ์ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
netshareenumall
์ฌ์ฉ ๊ฐ๋ฅํ ๋ชจ๋ ๊ณต์ ๋ฅผ ์ด๊ฑฐํฉ๋๋ค.
netsharegetinfo <share>
ํน์ ๊ณต์ ์ ๋ํ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
enumdomusers
๋ชจ๋ ๋๋ฉ์ธ ์ฌ์ฉ์๋ฅผ ์ด๊ฑฐํฉ๋๋ค.
queryuser <RID>
ํน์ ์ฌ์ฉ์์ ๋ํ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
RPCclient โ Enumeration
rpcclient $> srvinfo #์๋ฒ ์ ๋ณด
DEVSMB Wk Sv PrQ Unx NT SNT DEVSM
platform_id : 500
os version : 6.1
server type : 0x809a03
rpcclient $> enumdomains #๋คํธ์ํฌ์ ๋ฐฐํฌ๋ ๋ชจ๋ ๋๋ฉ์ธ ์ด๊ฑฐ
name:[DEVSMB] idx:[0x0]
name:[Builtin] idx:[0x1]
rpcclient $> querydominfo #๋ฐฐํฌ๋ ๋๋ฉ์ธ์ ๋๋ฉ์ธ, ์๋ฒ ๋ฐ ์ฌ์ฉ์ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
Domain: DEVOPS
Server: DEVSMB
Comment: DEVSM
Total Users: 2
Total Groups: 0
Total Aliases: 0
Sequence No: 1632361158
Force Logoff: -1
Domain Server State: 0x1
Server Role: ROLE_DOMAIN_PDC
Unknown 3: 0x1
rpcclient $> netshareenumall #์ฌ์ฉ ๊ฐ๋ฅํ ๋ชจ๋ ๊ณต์ ๋ฅผ ์ด๊ฑฐํฉ๋๋ค.
netname: print$
remark: Printer Drivers
path: C:\var\lib\samba\printers
password:
netname: home
remark: INFREIGHT Samba
path: C:\home\
password:
netname: dev
remark: DEVenv
path: C:\home\sambauser\dev\
password:
netname: notes
remark: CheckIT
path: C:\mnt\notes\
password:
netname: IPC$
remark: IPC Service (DEVSM)
path: C:\tmp
password:
rpcclient $> netsharegetinfo notes #ํน์ ๊ณต์ ์ ๋ํ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
netname: notes
remark: CheckIT
path: C:\mnt\notes\
password:
type: 0x0
perms: 0
max_uses: -1
num_uses: 1
revision: 1
type: 0x8004: SEC_DESC_DACL_PRESENT SEC_DESC_SELF_RELATIVE
DACL
ACL Num ACEs: 1 revision: 2
---
ACE
type: ACCESS ALLOWED (0) flags: 0x00
Specific bits: 0x1ff
Permissions: 0x101f01ff: Generic all access SYNCHRONIZE_ACCESS WRITE_OWNER_ACCESS WRITE_DAC_ACCESS READ_CONTROL_ACCESS DELETE_ACCESS
SID: S-1-1-0์ด ์๋ ์ต๋ช ์ฌ์ฉ์์๊ฒ ์ด๋ค ์ ๋ณด๊ฐ ์ ์ถ๋ ์ ์๋์ง ๋ณด์ฌ์ค
๊ฐ์ฅ ์ค์ํ ๊ฒ์ ์ด๋ฌํ ์๋น์ค์ ์ต๋ช ์ผ๋ก ์ก์ธ์คํ๋ฉด ๋ค๋ฅธ ์ฌ์ฉ์๊ฐ ๋ฐ๊ฒฌ๋ ์ ์์ผ๋ฉฐ, ๊ฐ์ฅ ๊ณต๊ฒฉ์ ์ธ ๊ฒฝ์ฐ ๋ฌด์ฐจ๋ณ ๋์ ๊ณต๊ฒฉ์ ๋ฐ์ ์ ์์.
rpcclient๋ฅผ ์ฌ์ฉํ์ฌ ์ฌ์ฉ์๋ฅผ ์ด๊ฑฐํ๋ ๋ฐฉ๋ฒ์ ์ดํด๋ณด์
Rpcclient โ ์ฌ์ฉ์ ์ด๊ฑฐํ
rpcclient $> enumdomusers #๋ชจ๋ ๋๋ฉ์ธ ์ฌ์ฉ์๋ฅผ ์ด๊ฑฐํฉ๋๋ค.
user:[mrb3n] rid:[0x3e8]
user:[cry0l1t3] rid:[0x3e9]
rpcclient $> queryuser 0x3e9 #ํน์ ์ฌ์ฉ์์ ๋ํ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
User Name : cry0l1t3
Full Name : cry0l1t3
Home Drive : \\devsmb\cry0l1t3
Dir Drive :
Profile Path: \\devsmb\cry0l1t3\profile
Logon Script:
Description :
Workstations:
Comment :
Remote Dial :
Logon Time : Do, 01 Jan 1970 01:00:00 CET
Logoff Time : Mi, 06 Feb 2036 16:06:39 CET
Kickoff Time : Mi, 06 Feb 2036 16:06:39 CET
Password last set Time : Mi, 22 Sep 2021 17:50:56 CEST
Password can change Time : Mi, 22 Sep 2021 17:50:56 CEST
Password must change Time: Do, 14 Sep 30828 04:48:05 CEST
unknown_2[0..31]...
user_rid : 0x3e9
group_rid: 0x201
acb_info : 0x00000014
fields_present: 0x00ffffff
logon_divs: 168
bad_password_count: 0x00000000
logon_count: 0x00000000
padding1[0..7]...
logon_hrs[0..21]...
rpcclient $> queryuser 0x3e8
User Name : mrb3n
Full Name :
Home Drive : \\devsmb\mrb3n
Dir Drive :
Profile Path: \\devsmb\mrb3n\profile
Logon Script:
Description :
Workstations:
Comment :
Remote Dial :
Logon Time : Do, 01 Jan 1970 01:00:00 CET
Logoff Time : Mi, 06 Feb 2036 16:06:39 CET
Kickoff Time : Mi, 06 Feb 2036 16:06:39 CET
Password last set Time : Mi, 22 Sep 2021 17:47:59 CEST
Password can change Time : Mi, 22 Sep 2021 17:47:59 CEST
Password must change Time: Do, 14 Sep 30828 04:48:05 CEST
unknown_2[0..31]...
user_rid : 0x3e8
group_rid: 0x201
acb_info : 0x00000010
fields_present: 0x00ffffff
logon_divs: 168
bad_password_count: 0x00000000
logon_count: 0x00000000
padding1[0..7]...
logon_hrs[0..21]...์ด์ ์ด ๊ฒฐ๊ณผ๋ฅผ ์ฌ์ฉํ์ฌ ๊ทธ๋ฃน์ RID๋ฅผ ์๋ณํ ๋ค์ ์ ์ฒด ๊ทธ๋ฃน์์ ์ ๋ณด๋ฅผ ๊ฒ์ํ๋๋ฐ ์ฌ์ฉํ ์ ์์
Rpcclient โ ๊ทธ๋ฃน ์ ๋ณด
rpcclient $> querygroup 0x201
Group Name: None
Description: Ordinary Users
Group Attribute:7
Num Members:2์ด ๋ชจ๋ ๋ช ๋ น์ ์ฌ์ฉํ ์ ์๋ ๊ฒ์ ์๋, ์ฌ์ฉ์์ ๋ฐ๋ผ ํน์ ์ ํ์ด ์์ ์ ์์ but user<RID>์ ๋ํ ์ฟผ๋ฆฌ๋ ๋๋ถ๋ถ RID๋ฅผ ๊ธฐ๋ฐ์ผ๋ก ํ์ฉ๋๋ฏ๋ก rcpclient๋ฅผ ์ฌ์ฉํ์ฌ ๋ฌด์ฐจ๋ณ ๋์ ์ ํตํด ์ ๋ณด๋ฅผ ์ป์ ์ ์์.
์ด๋ฅผ ์ฌ์ฉํ๊ธฐ ์ํ ๋๊ตฌ๋ ์ฌ๋ฌ๊ฐ์ง๊ฐ ์กด์ฌ, ์ด๋ฐ ๋๊ตฌ๋ฅผ ๊ณ์ ์ฌ์ฉํ๋ ค๋ฉด bash๋ฅผ ์ฌ์ฉํ์ฌ for ๋ฃจํ๋ฅผ ๋ง๋ค์ด์ rcpclient๋ฅผ ์ฌ์ฉํ์ฌ ์๋น์ค์ ๋ช ๋ น์ ์ ์กํ๊ณ ๊ฒฐ๊ณผ๋ฅผ ํํฐ๋งํ ์ ์์
๋ฌด์ฐจ๋ณ ์ฌ์ฉ์ RID ๊ฐ์ ์ ์ฉ
realblackcat@htb[/htb]$ for i in $(seq 500 1100);do rpcclient -N -U "" 10.129.14.128 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done
User Name : sambauser
user_rid : 0x1f5
group_rid: 0x201
User Name : mrb3n
user_rid : 0x3e8
group_rid: 0x201
User Name : cry0l1t3
user_rid : 0x3e9
group_rid: 0x201์ด์ ๋ํ ๋์์ผ๋ก samrdump.py๋ฅผ ์ฌ์ฉํ ์ ์์
Samrdump.py
realblackcat@htb[/htb]$ sfor i in $(seq 500 1100); do
rpcclient -N -U "" [IP_ADDRESS] -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";
donefor i in $(seq 500 1100); do
rpcclient -N -U "" [IP_ADDRESS] -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";
done10.129.14.128
Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation
[*] Retrieving endpoint list from 10.129.14.128
Found domain(s):
. DEVSMB
. Builtin
[*] Looking up users in domain DEVSMB
Found user: mrb3n, uid = 1000
Found user: cry0l1t3, uid = 1001
mrb3n (1000)/FullName:
mrb3n (1000)/UserComment:
mrb3n (1000)/PrimaryGroupId: 513
mrb3n (1000)/BadPasswordCount: 0
mrb3n (1000)/LogonCount: 0
mrb3n (1000)/PasswordLastSet: 2021-09-22 17:47:59
mrb3n (1000)/PasswordDoesNotExpire: False
mrb3n (1000)/AccountIsDisabled: False
mrb3n (1000)/ScriptPath:
cry0l1t3 (1001)/FullName: cry0l1t3
cry0l1t3 (1001)/UserComment:
cry0l1t3 (1001)/PrimaryGroupId: 513
cry0l1t3 (1001)/BadPasswordCount: 0
cry0l1t3 (1001)/LogonCount: 0
cry0l1t3 (1001)/PasswordLastSet: 2021-09-22 17:50:56
cry0l1t3 (1001)/PasswordDoesNotExpire: False
cry0l1t3 (1001)/AccountIsDisabled: False
cry0l1t3 (1001)/ScriptPath:
[*] Received 2 entries.rpcclient๋ก ์ป์ ์ ๋ณด๋ SMBMap ํน์ CrackMapExec ๋๊ตฌ๋ก๋ ์ป์ ์ ์์
SMBmap
realblackcat@htb[/htb]$ smbmap -H 10.129.14.128
[+] Finding open SMB ports....
[+] User SMB session established on 10.129.14.128...
[+] IP: 10.129.14.128:445 Name: 10.129.14.128
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
home NO ACCESS INFREIGHT Samba
dev NO ACCESS DEVenv
notes NO ACCESS CheckIT
IPC$ NO ACCESS IPC Service (DEVSM)CrackMapExec
realblackcat@htb[/htb]$ crackmapexec smb 10.129.14.128 --shares -u '' -p ''
SMB 10.129.14.128 445 DEVSMB [*] Windows 6.1 Build 0 (name:DEVSMB) (domain:) (signing:False) (SMBv1:False)
SMB 10.129.14.128 445 DEVSMB [+] \:
SMB 10.129.14.128 445 DEVSMB [+] Enumerated shares
SMB 10.129.14.128 445 DEVSMB Share Permissions Remark
SMB 10.129.14.128 445 DEVSMB ----- ----------- ------
SMB 10.129.14.128 445 DEVSMB print$ Printer Drivers
SMB 10.129.14.128 445 DEVSMB home INFREIGHT Samba
SMB 10.129.14.128 445 DEVSMB dev DEVenv
SMB 10.129.14.128 445 DEVSMB notes READ,WRITE CheckIT
SMB 10.129.14.128 445 DEVSMB IPC$ IPC Service (DEVSM)๋ ๋ค๋ฅธ ๋๊ตฌ๋ก๋ enum4linux-ng๊ฐ ์์. ์ด ๋๊ตฌ๋ ์ ๋ถ๋ ์๋์ง๋ง ๋ง์ ์ฟผ๋ฆฌ๋ฅผ ์๋ํํ๋ฉฐ ๋ง์ ์์ ์ ๋ณด๋ฅผ ๋ฐํํ ์ ์์
Enum4Linux-ng-์ด๊ฑฐํ
realblackcat@htb[/htb]$ enum4linux-ng 10.129.14.128 -A
ENUM4LINUX - next generation
==========================
| Target Information |
==========================
[*] Target ........... 10.129.14.128
[*] Username ......... ''
[*] Random Username .. 'juzgtcsu'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
=====================================
| Service Scan on 10.129.14.128 |
=====================================
[*] Checking LDAP
[-] Could not connect to LDAP on 389/tcp: connection refused
[*] Checking LDAPS
[-] Could not connect to LDAPS on 636/tcp: connection refused
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
=====================================================
| NetBIOS Names and Workgroup for 10.129.14.128 |
=====================================================
[+] Got domain/workgroup name: DEVOPS
[+] Full NetBIOS names information:
- DEVSMB <00> - H <ACTIVE> Workstation Service
- DEVSMB <03> - H <ACTIVE> Messenger Service
- DEVSMB <20> - H <ACTIVE> File Server Service
- ..__MSBROWSE__. <01> - <GROUP> H <ACTIVE> Master Browser
- DEVOPS <00> - <GROUP> H <ACTIVE> Domain/Workgroup Name
- DEVOPS <1d> - H <ACTIVE> Master Browser
- DEVOPS <1e> - <GROUP> H <ACTIVE> Browser Service Elections
- MAC Address = 00-00-00-00-00-00
==========================================
| SMB Dialect Check on 10.129.14.128 |
==========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
SMB 1.0: false
SMB 2.02: true
SMB 2.1: true
SMB 3.0: true
SMB1 only: false
Preferred dialect: SMB 3.0
SMB signing required: false
==========================================
| RPC Session Check on 10.129.14.128 |
==========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user session
[+] Server allows session using username 'juzgtcsu', password ''
[H] Rerunning enumeration with user 'juzgtcsu' might give more results
====================================================
| Domain Information via RPC for 10.129.14.128 |
====================================================
[+] Domain: DEVOPS
[+] SID: NULL SID
[+] Host is part of a workgroup (not a domain)
============================================================
| Domain Information via SMB session for 10.129.14.128 |
============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: DEVSMB
NetBIOS domain name: ''
DNS domain: ''
FQDN: htb
================================================
| OS Information via RPC for 10.129.14.128 |
================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[+] Found OS information via 'srvinfo'
[+] After merging OS information we have the following result:
OS: Windows 7, Windows Server 2008 R2
OS version: '6.1'
OS release: ''
OS build: '0'
Native OS: not supported
Native LAN manager: not supported
Platform id: '500'
Server type: '0x809a03'
Server type string: Wk Sv PrQ Unx NT SNT DEVSM
======================================
| Users via RPC on 10.129.14.128 |
======================================
[*] Enumerating users via 'querydispinfo'
[+] Found 2 users via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 2 users via 'enumdomusers'
[+] After merging user results we have 2 users total:
'1000':
username: mrb3n
name: ''
acb: '0x00000010'
description: ''
'1001':
username: cry0l1t3
name: cry0l1t3
acb: '0x00000014'
description: ''
=======================================
| Groups via RPC on 10.129.14.128 |
=======================================
[*] Enumerating local groups
[+] Found 0 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 0 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 0 group(s) via 'enumdomgroups'
=======================================
| Shares via RPC on 10.129.14.128 |
=======================================
[*] Enumerating shares
[+] Found 5 share(s):
IPC$:
comment: IPC Service (DEVSM)
type: IPC
dev:
comment: DEVenv
type: Disk
home:
comment: INFREIGHT Samba
type: Disk
notes:
comment: CheckIT
type: Disk
print$:
comment: Printer Drivers
type: Disk
[*] Testing share IPC$
[-] Could not check share: STATUS_OBJECT_NAME_NOT_FOUND
[*] Testing share dev
[-] Share doesnt exist
[*] Testing share home
[+] Mapping: OK, Listing: OK
[*] Testing share notes
[+] Mapping: OK, Listing: OK
[*] Testing share print$
[+] Mapping: DENIED, Listing: N/A
==========================================
| Policies via RPC for 10.129.14.128 |
==========================================
[*] Trying port 445/tcp
[+] Found policy:
domain_password_information:
pw_history_length: None
min_pw_length: 5
min_pw_age: none
max_pw_age: 49710 days 6 hours 21 minutes
pw_properties:
- DOMAIN_PASSWORD_COMPLEX: false
- DOMAIN_PASSWORD_NO_ANON_CHANGE: false
- DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
- DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
- DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
- DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
domain_lockout_information:
lockout_observation_window: 30 minutes
lockout_duration: 30 minutes
lockout_threshold: None
domain_logoff_information:
force_logoff_time: 49710 days 6 hours 21 minutes
==========================================
| Printers via RPC for 10.129.14.128 |
==========================================
[+] No printers returned (this is not an error)
Completed after 0.61 seconds์ด๊ฑฐ๋ฅผ ์ํด ๋ ๊ฐ ์ด์์ ๋๊ตฌ๋ฅผ ์ฌ์ฉํด์ผ ํจ. ๋๊ตฌ์ ํ๋ก๊ทธ๋๋ฐ์ผ๋ก ์ธํด ์๋์ผ๋ก ํ์ธํด์ผ ํ๋ ๋ค๋ฅธ ์ ๋ณด๋ฅผ ์ป์ ์ ์๊ธฐ ๋๋ฌธ -> ๋ฐ๋ผ์ ๋๊ตฌ๊ฐ ์ด๋ป๊ฒ ์์ฑ๋์๋์ง ์ ํํ ์ ์ ์๋ ์๋ํ๋ ๋๊ตฌ(autorecon ๊ฐ์)์๋ง ์์กดํด์ ์๋จ
Last updated