Thehackerslabs on HYH's Blog

Thehackerslabs-Phantom Robotics

Mon, 13 Jul 2026 00:00:00 +0000

the writeup of Phantom Robotics in Thehackerslabs

Thehackerslabs-Shadows

Sun, 12 Jul 2026 00:00:00 +0000

the writeup of Shadows in Thehackerslabs

Thehackerslabs-Folclore

Tue, 02 Sep 2025 00:00:00 +0000

the writeup of Folclore in thehackerslabs

Thehackerslabs-Patata Mágica

Sat, 30 Aug 2025 00:00:00 +0000

the writeup of Patata Mágica in thehackerslabs

Thehackerslabs-Welcome To The Jungle

Sat, 23 Aug 2025 00:00:00 +0000

the writeup of Welcome To The Jungle in thehackerslabs

Thehackerslabs-Evelator

Fri, 22 Aug 2025 00:00:00 +0000

the writeup of Evelator in Thehackerslabs, Active Directory.

Thehackerslabs-Pa Que Aiga Lujo

Thu, 21 Aug 2025 00:00:00 +0000

the writeup of Pa Que Aiga Lujo in thehackerslabs.

Thehackerslabs-Merchan

Thu, 05 Jun 2025 00:00:00 +0000

writeup of Merchan in Thehackerslabs

Thehackerslabs-Hexthink-Silent-Shadow

Wed, 04 Jun 2025 00:00:00 +0000

Nmap

[root@kali] /home/kali/hexthink-silent-shadow  
❯ nmap 192.168.55.67 -sV -A -p-                                                                                                            
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4d:6e:39:a4:15:86:88:70:c7:9d:09:91:a3:0b:18:8c (ECDSA)
|_  256 f9:21:5d:25:ee:76:05:db:01:3b:45:c9:68:b0:82:9f (ED25519)
80/tcp   open  http        Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.58 (Ubuntu)
3306/tcp open  mysql       MariaDB 5.5.5-10.11.11
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.11.11-MariaDB-0ubuntu0.24.04.2
|   Thread ID: 34
|   Capabilities flags: 63486
|   Some Capabilities: LongColumnFlag, Support41Auth, Speaks41ProtocolOld, SupportsCompression, IgnoreSigpipes, Speaks41ProtocolNew, IgnoreSpaceBeforeParenthesis, InteractiveClient, FoundRows, ODBCClient, ConnectWithDatabase, DontAllowDatabaseTableColumn, SupportsLoadDataLocal, SupportsTransactions, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults
|   Status: Autocommit
|   Salt: wPg7y~-c,O)~bPI]yfu:
|_  Auth Plugin Name: mysql_native_password
9090/tcp open  zeus-admin?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, SqueezeCenter_CLI, TLSSessionReq, TerminalServerCookie, WMSRequest, X11Probe, drda, ibm-db2-das, informix: 
|_    Protocolo incorrecto. Esto no es HTTP.

Mysql

进入到80端口的index.php，查看到存在ctf_user用户，可以使用密码登录，尝试使用空密码登录呢

Thehackerslabs-Black Gold

Tue, 08 Apr 2025 00:00:00 +0000

Box Info

OS	Windows
Difficulty	Hard

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.10 -sV -A -p-

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title:  Neptune 
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-08 07:26:35Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
53459/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
53460/tcp open  msrpc         Microsoft Windows RPC
53470/tcp open  msrpc         Microsoft Windows RPC
53479/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 08:00:27:37:4E:C0 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-04-08T07:27:27
|_  start_date: N/A
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:37:4e:c0 (Oracle VirtualBox virtual NIC)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

修改**/etc/hosts**

Thehackerslabs-B.I.G

Sat, 05 Apr 2025 00:00:00 +0000

Box Info

OS	Windows
Difficulty	Hard

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.212.4 -sV -A -p-

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-05 23:20:54Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: bbr.thl, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: bbr.thl, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49686/tcp open  msrpc         Microsoft Windows RPC
57043/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 08:00:27:29:23:16 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Microsoft Windows 2016
OS CPE: cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows Server 2016 build 10586 - 14393
Network Distance: 1 hop
Service Info: Host: BIG; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 15h54m38s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_nbstat: NetBIOS name: BIG, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:29:23:16 (Oracle VirtualBox virtual NIC)
| smb2-time: 
|   date: 2025-04-05T23:21:49
|_  start_date: 2025-04-05T19:55:29

将bbr.thl添加到**/etc/hosts**