https://blog.qife122.com/tags/kiosk%E9%80%83%E9%80%B8/ Recent content in Kiosk逃逸 on 办公AI智能小助手 Hugo zh-cn qife Wed, 10 Sep 2025 00:55:02 +0800 https://blog.qife122.com/p/htb-vulnescape%E4%BB%8Ekiosk%E9%80%83%E9%80%B8%E5%88%B0uac%E7%BB%95%E8%BF%87%E5%AE%8C%E6%95%B4%E6%94%BB%E5%87%BB%E9%93%BE%E5%88%86%E6%9E%90/ Wed, 10 Sep 2025 00:55:02 +0800 https://blog.qife122.com/p/htb-vulnescape%E4%BB%8Ekiosk%E9%80%83%E9%80%B8%E5%88%B0uac%E7%BB%95%E8%BF%87%E5%AE%8C%E6%95%B4%E6%94%BB%E5%87%BB%E9%93%BE%E5%88%86%E6%9E%90/ <h1 id="htb-vulnescape">HTB: VulnEscape</h1> <h2 id="初始扫描">初始扫描</h2> <p>nmap扫描发现仅开放一个TCP端口：RDP（3389）：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span><span class="lnt">9 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">oxdf@hacky$ nmap -p- -vvv --min-rate <span class="m">10000</span> 10.129.234.51 </span></span><span class="line"><span class="cl">Starting Nmap 7.94SVN <span class="o">(</span> https://nmap.org <span class="o">)</span> at 2025-07-06 19:31 UTC </span></span><span class="line"><span class="cl">...<span class="o">[</span>snip<span class="o">]</span>... </span></span><span class="line"><span class="cl">Nmap scan report <span class="k">for</span> 10.129.234.51 </span></span><span class="line"><span class="cl">Host is up, received echo-reply ttl <span class="m">127</span> <span class="o">(</span>0.15s latency<span class="o">)</span>. </span></span><span class="line"><span class="cl">Scanned at 2025-07-06 19:31:40 UTC <span class="k">for</span> 14s </span></span><span class="line"><span class="cl">Not shown: <span class="m">65534</span> filtered tcp ports <span class="o">(</span>no-response<span class="o">)</span> </span></span><span class="line"><span class="cl">PORT STATE SERVICE REASON </span></span><span class="line"><span class="cl">3389/tcp open ms-wbt-server syn-ack ttl <span class="m">127</span> </span></span></code></pre></td></tr></table> </div> </div><p>详细版本扫描显示Windows系统信息：</p>