Posts

About 本文是关于Apache commons collections反序列漏洞利用链的过程复现 Environment JDK version jdk-8u65-windows-x64 Common collections version 3.2.1 Java Archive Downloads - Java SE 8 oracle.com passwords - BugMeNot. (如果下载JDK需要登录，这里是免费的账户) ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/Titanic ❯ nmap titanic.htb -sV -T4 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.52 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ReadAnyFiles 进入titanic.htb，点击Book Now，使用burpsuite进行抓包发现一个download路由 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali ❯ nmap cat.htb PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Dirsearch 存在git泄露 用git-dumper获取到源码 [root@kali] /home/kali/Cat ❯ git-dumper http://cat.htb/.git/ ./catgit XSS 在view_cat.php中发现存在XSS的可能性 ...

前言 最近出来了一个新的国产AI模型DeepSeek，并且具有深度思考的功能。 我体验过后感觉比ChatGPT要好很多，体现在DeepSeek能更好的理解用户的问题。 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/Backfire ❯ nmap backfire.htb -sV -Pn -T4 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u4 (protocol 2.0) 443/tcp open ssl/http nginx 1.22.1 5000/tcp filtered upnp 8000/tcp open http nginx 1.22.1 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 访问backfire.htb:8000可以得到两个文件 ...

Box Info OS Windows Difficulty Easy Nmap [root@kali] /home/kali/Active ❯ nmap active.htb -sV -Pn -T4 PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49165/tcp open msrpc Microsoft Windows RPC 49167/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows SMB File Leak 匿名登陆SMB，发现可以读取的Replication ...

Box Info OS Windows Difficulty Hard Nmap [root@kali] /home/kali/Blackfield ❯ nmap Blackfield.htb -sV -T4 PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows 把BLACKFIELD.local添加到**/etc/hosts** ...

Box Info OS Windows Difficulty Medium Nmap [root@kali] /home/kali/Cascade ❯ nmap Cascade.htb -sV -T4 PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49165/tcp open msrpc Microsoft Windows RPC Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows 把cascade.local添加到**/etc/hosts** ...

Box Info OS Windows Difficulty Easy Nmap [root@kali] /home/kali/Forest ❯ nmap forest.htb -sV -T4 PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 27.68 seconds 将htb.local加入**/etc/hosts** ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/Headless ❯ nmap headless.htb Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 5000/tcp open upnp 进入5000端口查看，自动跳转到一个support路由 Dirsearch [root@kali] /home/kali/Headless ❯ dirsearch -u headless.htb:5000 Target: http://headless.htb:5000/ Starting: 401 - 317B - /dashboard 200 - 2KB - /support Task Completed 进入dashboard，发现需要身份认证 ...