> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-medium.md).

# HTB Windows 中等难度

Windows 中等难度的 HackTheBox 机器，包含多阶段漏洞利用、服务滥用和权限提升路径。

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Hospital HackTheBox Windows 中等难度</h4></td><td>Hospital HackTheBox 中等难度 Windows 机器复盘，涵盖 Web 枚举、滥用文件/上传 p0wny-shell 工具、破解受保护的哈希密码、.eps 文件命令注入类型，并附有实用的枚举、漏洞利用、立足点与提权笔记。</td><td><a href="/pages/08787de53c0331978a0e5756f0aec9b2eb984834">/pages/08787de53c0331978a0e5756f0aec9b2eb984834</a></td></tr><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Sniper HackTheBox Windows 中等难度</h4></td><td>Sniper HackTheBox 中等难度 Windows 机器复盘，涵盖本地文件包含（LFI）、远程文件包含（RFI）（失败）、通过 SMB 服务器的远程文件包含（net usershare 技术）（成功）、创建 webshell 并实现远程命令执行（RCE），并附有实用的枚举、漏洞利用、立足点与提权笔记。</td><td><a href="/pages/406b0956cf49321dad76640e5f8ac2d053d88fa3">/pages/406b0956cf49321dad76640e5f8ac2d053d88fa3</a></td></tr><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Jeeves HackTheBox Windows 中等难度</h4></td><td>Jeeves HackTheBox 中等难度 Windows 机器复盘，涵盖 Jenkins 利用（Groovy Script Console）、破解 KeePass、哈希传递（Psexec）、RottenPotato（SeImpersonatePrivilege），并附有实用的枚举、漏洞利用、立足点与提权笔记。</td><td><a href="/pages/f99f228ef695aa9cf00aa1eac61e1a96f8ea6095">/pages/f99f228ef695aa9cf00aa1eac61e1a96f8ea6095</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-medium.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.