以後newstar2025想复刻都單獨出 , 方便標籤
最近一時興起复習了一下pwn , 巨難….. , 還把L1nk的模板偷下來自己用了 , 回來打L1nk出的題 , fmt 和 got 如題 , 大概是要做把printf_got 改成 system_got表 , 利用printf 改2字節:
開了canary 和 NX
先把 ld 和 libc 連一下:
1234567patchelf --set-interpreter \/home/ghsc/NewStar2025/pwn/fmt_got/ld-linux-x86-64.so.2 \fmt_gotpatchelf --replace-needed libc.so.6 \/home/ghsc/NewStar2025/pwn/fmt_got/libc.so.6 \fmt_got
去ida分析一下:
不難看出read 和 printf 分別都是我們的目標:
gdb分析一下canary 在 rbp-0x8上 :
ni到printf上 : fmtarg 0x7fffffffcc88
可以canary 到: %39$p
...
這個靶機是Neo4j的RCE , 還有AD爆破 Kerberos Brute-Force , 上一次的靶機是委派攻擊 , 這一次比上次的好像簡單了
工具:
CVE-2021-34371 Neo4j RCE
kerbrute
kerbrute 爆破字典
在vps先下好java:
123sudo apt install openjdk-11-jdk -yjava -versionjavac -version
用fscan:
123456789101112131415161718192021┌──────────────────────────────────────────────┐│ ___ _ ││ / _ \ ___ ___ _ __ __ _ ___| | __ ││ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / ││ / /_\\_____\__ \ (__| | | (_| | (__| < ││ \_ ...
Machine Information :In the Layover machine, you uncovered a name and a booking confirmation code. Maybe they’ll come in handy here? Jenny Crawford / KS7X2M
鼠鼠找到的tips :Touch HTB Walkthrough
用 nmap 掃 :
12345678910(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.149.70Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-19 08:56 +0800Nmap scan report for touch.thb (10.129.149.70)Host is up (0.31s latency).Not shown: 996 filtered tcp ports (no-response)PORT STATE SERVICE135/tcp open m ...
這是鼠鼠打的第一個春秋雲境靶機 , 因為靶機是公網的 , 要自己準備vps來打 , 還要很多工具 , 後期還要域滲透(第一次碰)
參考Blog :
Brute4Road
Windows提权方式汇总
土豆家族工具使用适配表格大全
Kerberos (不是K8s)
工具準備:
MDUT 數據庫的利用工具
redis rce
Stowaway 内网代理搭建
wpscan
wpscan api token
域滲透工具:
bloodhound AD域环境分析
Powersploit
mimikatz
Rubeus 利用
flag01用nmap 掃了掃:
123456789101112131415161718(base) PS E:\ctf tools\Web security\fscan> nmap 39.99.134.102Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-15 14:03 +0800Nmap scan report for 39.99.134.102Host is up (0.048s latency).Not s ...
看了很多blog都有fscan我都下個試試: fscan
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647(base) PS E:\ctf tools> .\fscan-nolocal_2.2.2_windows_x64.exe -h 10.129.244.214┌──────────────────────────────────────────────┐│ ___ _ ││ / _ \ ___ ___ _ __ __ _ ___| | __ ││ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / ││ / /_\\_____\__ \ (__| | | (_| | (__| < ││ \____/ |___/\___|_| \__,_|\___|_|\_\ │└─────── ...
最近鼠鼠迷上了P5R , 久違做一下HTB:
用nmap掃一下:
12345678910111213(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.244.176Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-17 20:12 +0800Nmap scan report for 10.129.244.176Host is up (0.58s latency).Not shown: 995 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh80/tcp open http443/tcp open https4444/tcp open krb52450389/tcp open unknownNmap done: 1 IP address (1 host up) scanned in 10.23 seconds
有https ,鼠鼠打這麼久ctf都沒去學https的相關 ...
這是一個最簡單的windows靶機 , 鼠鼠認為用這靶機入門window滲透剛剛好 , 第一次寺starting point 上 . 先connect pwnbox:
參考的blog
用sudo -l 後可以看看 GTFOBins 有沒有相關手法 , 提權payload網站: GTFOBins
用nmap掃掃:
123456789101112(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.112.72Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 16:05 +0800Nmap scan report for 10.129.112.72Host is up (0.23s latency).Not shown: 996 closed tcp ports (reset)PORT STATE SERVICE135/tcp open msrpc139/tcp open netbios-ssn445/tcp open microsoft-ds5985/t ...
Task1How many open TCP ports are listening on Nexus?
2個
1234567891011(base) PS C:\Users\1984l\OneDrive\桌面> nmap -sV -Pn 10.129.106.93Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-02 23:08 +0800Stats: 0:00:16 elapsed; 0 hosts completed (1 up), 1 undergoing Service ScanService scan Timing: About 50.00% done; ETC: 23:08 (0:00:07 remaining)Nmap scan report for 10.129.106.93Host is up (1.1s latency).Not shown: 998 closed tcp ports (reset)PORT STATE SERVICE VERSION22/tcp open ssh OpenSS ...
Task1How many open TCP ports are listening on Orion?
hint說要-p-來指定端口全端口
1nmap -sV -sC -p- 10.129.105.255
12345678910C:\Users\1984l>nmap 10.129.111.21Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-08 20:37 +0800Nmap scan report for 10.129.111.21Host is up (0.66s latency).Not shown: 998 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh80/tcp open httpNmap done: 1 IP address (1 host up) scanned in 9.21 seconds
2
Task2What is the version of CraftCMS running on the target?
看來掃出了 ...
鼠鼠第一次打HacktheBox
參考影片
Task1How many TCP ports are open?
用本地的powershell來掃 , 記得下一個nmap
123456789(base) PS C:\Users\1984l> nmap 10.129.104.75Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-31 18:15 +0800Nmap scan report for 10.129.104.75Host is up (0.47s latency).Not shown: 997 closed tcp ports (reset)PORT STATE SERVICE21/tcp open ftp22/tcp open ssh80/tcp open http
答案是三個。
可以搜一搜vsFTPd 3.0.3 的chagelog
exiftool在 Web 題裡它常用在 檔案上傳漏洞。
還可以把網站下來看看相關信息,
例如 HTB 題目裡網站可能用了某個舊軟體，但頁面上沒有直接寫版本或發布日期， ...
