OSCP Lock Write-up

本文最后更新于 2026年3月12日下午

一、靶场详情

靶场名称：

Lock

靶场地址：

https://app.hackthebox.com/machines/Lock

靶场环境连接说明：

演示为 HackTheBox 平台在线靶机，需通过 OpenVPN 客户端连接平台提供的 VPN 环境才能访问靶机。注意：平台新发布的靶机可以免费练习，而历史靶机则需要开通会员才能使用。还需要注意连接 HackTheBox 平台 VPN 需要挂载代理，具体方式可参考之前的历史文章或留言。

二、思路总结

突破边界（获取用户旗帜）：

Git token 泄露 –> 上传 web shell –> 系统 ellen.freeman 用户权限 –> mremoteng 配置文件解密 –> 系统 Gale.Dekarios 用户权限 –> 用户旗帜

权限提升（获取管理员旗帜）：

PDF24 Creator 本地提权漏洞（UI 界面） –> 系统 system 权限 –> 管理员旗帜

三、靶场攻击演示

3.1 靶场信息收集

使用 nmap 对靶机进行端口扫描。

TCP 端口扫描：

sudo nmap -p- 10.129.234.64 --min-rate=2000

PORT     STATE SERVICE
80/tcp   open  http
445/tcp  open  microsoft-ds
3000/tcp open  ppp
3389/tcp open  ms-wbt-server

UDP 端口扫描：未发现可利用的端口。

继续使用 nmap 对已开放端口的服务进行信息收集。

TCP 服务信息搜集：

sudo nmap -p80,445,3000,3389 -sCV 10.129.234.64

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Lock - Index
445/tcp  open  microsoft-ds?
3000/tcp open  http          Golang net/http server
| fingerprint-strings:
|   GenericLines, Help, RTSPRequest:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 200 OK
|     Cache-Control: max-age=0, private, must-revalidate, no-transform
|     Content-Type: text/html; charset=utf-8
|     Set-Cookie: i_like_gitea=51680e916066cc82; Path=/; HttpOnly; SameSite=Lax
|     Set-Cookie: _csrf=leEPxHUbCx2kqspq-0aULZoSrOM6MTc2MTI3OTAxODk1MjgxNzkwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|     X-Frame-Options: SAMEORIGIN
|     Date: Fri, 24 Oct 2025 04:10:19 GMT
|     <!DOCTYPE html>
|     <html lang="en-US" class="theme-auto">
|     <head>
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <title>Gitea: Git with a cup of tea</title>
|     <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiR2l0ZWE6IEdpdCB3aXRoIGEgY3VwIG9mIHRlYSIsInNob3J0X25hbWUiOiJHaXRlYTogR2l0IHdpdGggYSBjdXAgb2YgdGVhIiwic3RhcnRfdXJsIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwLyIsImljb25zIjpbeyJzcmMiOiJodHRwOi8vbG9jYWxob3N0OjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLCJzaXplcyI6IjU
|   HTTPOptions:
|     HTTP/1.0 405 Method Not Allowed
|     Allow: HEAD
|     Allow: GET
|     Cache-Control: max-age=0, private, must-revalidate, no-transform
|     Set-Cookie: i_like_gitea=181d8a8a4a7acbc2; Path=/; HttpOnly; SameSite=Lax
|     Set-Cookie: _csrf=Gl4N9I85QBauPiwaKCicZyBfqpk6MTc2MTI3OTAxOTUyMDgzNjIwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|     X-Frame-Options: SAMEORIGIN
|     Date: Fri, 24 Oct 2025 04:10:19 GMT
|_    Content-Length: 0
|_http-title: Gitea: Git with a cup of tea
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=Lock
| Not valid before: 2025-10-23T03:18:38
|_Not valid after:  2026-04-24T03:18:38
| rdp-ntlm-info:
|   Target_Name: LOCK
|   NetBIOS_Domain_Name: LOCK
|   NetBIOS_Computer_Name: LOCK
|   DNS_Domain_Name: Lock
|   DNS_Computer_Name: Lock
|   Product_Version: 10.0.20348
|_  System_Time: 2025-10-24T04:10:42+00:00
|_ssl-date: 2025-10-24T04:11:23+00:00; -8s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows