12345ip a10.129.230.220TARGET="10.129.230.220"
01.信息搜集靶机发现目标靶机 ip 为
123456fscan -h $TARGET > fscan.log228080grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu
两个 http 一个 mqtt 服务
02.渗透打点端口扫描12345678910111213141516sudo nmap -sT -sV -sC -O -p 22,8080 $TARGET -oA nmapscan/detailPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:| 256 3e:ea:45:4b:c5:d1 ...
1TARGET="10.129.228.94"
Celestial - HTB MediumNode.js Express 框架，利用 node-serialize 反序列化漏洞获取 RCE，通过 adm 组权限读取系统日志发现 root cronjob 实现提权。
01.信息搜集Nmap 端口扫描1sudo nmap -sT -sV -sC -O -p 3000 $TARGET -oA nmapscan/detail
123456PORT STATE SERVICE VERSION3000/tcp open http Node.js Express framework|_http-title: Site doesn't have a title (text/html; charset=utf-8)Device type: general purposeRunning: Linux 3.X|4.XOS details: Linux 3.2 - 4.14
仅开放 3000 端口，运行 Node.js Express。
Web 目录扫描1 ...
Cerberus HTB 渗透笔记
靶机: Cerberus | 难度: Hard | OS: Windows (DC + Linux Container)日期: 2026-07-19
攻击链概览123外部:8080(Icinga) → LFI → 认证写入 → RCE(www-data@容器) → Chisel隧道 → WinRM(matthew@DC) → user.txt→ ADSS(CVE-2022-47966) → SYSTEM → root.txt ← 🔴 阻塞
一、信息搜集
端口 8080 (Apache + Icinga Web 2)
重定向到 http://icinga.cerberus.local:8080/icingaweb2
LFI: /icingaweb2/lib/icinga/icinga-php-thirdparty/<path>
容器 /etc/hosts: 172.16.22.1 DC.cerberus.local
凭据 (resources.ini): matthew:IcingaWebPassword2023
二、立足点 ...
12345ip a10.129.35.227TARGET="10.129.35.227"
CrossFit01.信息搜集靶机发现目标靶机 ip 为
123fscan -h $TARGET > fscan.loggrep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu
端口扫描123456789101112131415161718192021sudo nmap -sT -sV -sC -O -p 21,22,80 $TARGET -oA nmapscan/detailPORT STATE SERVICE VERSION21/tcp open ftp| ssl-cert: Subject: commonName=*.crossfit.htb/organizationName=Cross Fit Ltd./stateOrProvinceName=NY/countryName=US| fingerpr ...
12345ip a10.129.228.120TARGET="10.129.228.120"
01.信息搜集靶机发现目标靶机 ip 为 10.129.228.120
12345678fscan -h $TARGET > fscan.log53,80,88,135,139,389,445,636,3268,3269grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nuhttp://10.129.228.120:139http://10.129.228.120:80
两个 http
02.渗透打点端口扫描1234567891011121314151617181920212223242526272829303132333435363738sudo nmap -sT -sV -sC -O -p 53,80,88,135,139,389,445,636,3268,3269 $TARGET -oA nmapsc ...
1234ip a10.129.95.154TARGET="10.129.95.154"
01.信息搜集靶机发现目标靶机 ip 为 10.129.95.154
12345678910111213141516171819fscan -h $TARGET > fscan.log# ===== 服务信息 =====10.129.95.154:135 msrpc @10.129.95.154:445 microsoft-ds SMB@ A 8 ( @ N .g x `v + l0j <0: + 7 * H * H * H + 7 *0( & $not_defined_in_RFC4178@please_ignore10.129.95.154:53 domain version bindhttp://10.129.95.154:139http://10.129.95.154:8010.129.95.154:3269 unknown10.129.95.154:389 unknown10.129.95.154:3268 unknown10.129.95.154 ...
12345ip a10.129.228.112TARGET="10.129.228.112"
01.信息搜集靶机发现目标靶机 ip 为 10.129.228.112
12345678910111213fscan -h $TARGET > fscan.log# ===== 服务信息 =====10.129.228.112:135 msrpc @10.129.228.112:445 microsoft-ds SMB@ A <X H Re ) u Ma s * `( + 0 0 + 7 + 7http://10.129.228.112:50000http://10.129.228.112:80# ===== Web服务 =====http://10.129.228.112:50000http://10.129.228.112:80grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu
两个 http ...
12345ip a10.129.35.181TARGET="10.129.35.181"
01.信息搜集靶机发现目标靶机 ip 为
12345fscan -h $TARGET > fscan.log53,80,88,135,139,389,445,636,1433,3268,3269,5985grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu
02.渗透打点端口扫描1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081 ...
12345ip a10.129.232.31TARGET="10.129.232.31"
01.信息搜集靶机发现目标靶机 ip 为
1234567891011121314151617181920212223242526272829303132fscan -h $TARGET > fscan.log# ===== 开放端口 =====10.129.232.31:44510.129.232.31:63610.129.232.31:598510.129.232.31:5310.129.232.31:13910.129.232.31:326810.129.232.31:38910.129.232.31:326910.129.232.31:13510.129.232.31:88# ===== 服务信息 =====10.129.232.31:135 unknown10.129.232.31:445 microsoft-ds SMB@ A a l v J 2 b/ ; x `v + l0j <0: + 7 * H * H * H + 7 *0( & $no ...
12345ip a10.129.227.227TARGET="10.129.227.227"
01.信息搜集靶机发现目标靶机 ip 为 10.129.227.227
12345fscan -h $TARGET > fscan.log22.80grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu
02.渗透打点端口扫描1234567891011121314151617181920sudo nmap -sT -sV -sC -O -p 22,80 $TARGET -oA nmapscan/detailPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:| 3072 9e:1f:98:d7:c8:ba:6 ...
