准备考 OSCP,发现有意思的数据传输方式,特此练习一遍
参考链接:https://blog.ropnop.com/transferring-files-from-kali-to-windows/
2019年3月30日17:29:09 【原创】
简介
无论那种情况,我们有时候会需要从 linux 系统传输数据到 windows 系统,尤其是文件。但是往往 nc 没有同时存在于双方系统上,此时就需要其他的简便方法来操作。
nc 文件传输
nc 使用:传送门 – Kali Linux渗透测试 003 基本工具–NC
• 传输文件( B->A )
A:root@kali:~# nc -lp 4444 > 2.mp4
B:root@metasploitable:~# nc -nv 192.168.1.100 4444 < AWVS\ 01.avi -q 1
或(A->B)
A:root@kali:~# nc -q 1 -lp 4444 < 2.mp4
B:root@metasploitable:~# nc -nv 192.168.1.100 4444 > 3.mp4
• 传输目录
A:root@kali:~# tar zcvf - testdir/ | nc -lp 4444 -q 1
B:root@metasploitable:~# nc 192.168.1.100 4444 | tar zxvf -
启动 apache 服务器
root@kali:~# /etc/init.d/apache2 start
[ ok ] Starting apache2 (via systemctl): apache2.service.
root@kali:~# netstat -tulnp | grep 80
tcp6 0 0 :::80 :::* LISTEN 1248/apache2
可以看到打开 80 端口 ,如果使用 apache 环境,需要经文件复制进 /var/www/html/ 目录
root@kali:~# cp team.exe /var/www/html/
或者 使用 python 自带的模块搭建简单的 HTTP 环境
如果不需要再使用,可以先停止 apache 服务
root@kali:~# /etc/init.d/apache2 stop
root@kali:~# python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
此时 HTTP 监听的根目录是运行此命令当前所在的目录(我的环境是 root 家目录)
进行文件下载
使用浏览器进行下载
浏览器访问 http://10.10.10.166/team.exe
windows 环境可以使用 certutil.exe 工具
PS C:\Users\John> certutil.exe -urlcache -split -f "http://10.10.10.166/team.exe" team.exe
windows 环境可以使用 powershell 环境
PS C:\Users\John> powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.10.166:8000/team.exe','team.exe')"
另外还有 bitsadmin 工具
PS C:\Users\John> bitsadmin /transfer n http://10.10.10.166:8000/team.exe D:\PSTools.zip
参考资料:
https://www.cnblogs.com/gayhub/p/6517655.html
https://stackoverflow.com/questions/28143160/how-can-i-download-a-file-with-batch-file-without-using-any-external-tools
linux 环境
root@ubuntu:~# curl http://10.10.10.166:8000/team.exe > team.exe
root@ubuntu:~# wget http://10.10.10.166:8000/ssh_login.txt
启动
使用 python 模块
# 使用前需要先安装 python 模块
root@kali:~# apt-get install python-pyftpdlib
root@kali:~# python -m pyftpdlib -p 21
如果要授予匿名用户写入权限,请同时添加该-w标志。
使用 MSF
Module options (auxiliary/server/ftp):
Name Current Setting Required Description
---- --------------- -------- -----------
FTPPASS no Configure a specific password that should be allowed access
FTPROOT /tmp/ftproot yes The FTP root directory to serve files from
FTPUSER no Configure a specific username that should be allowed access
PASVPORT 0 no The local PASV data port to listen on (0 is random)
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 21 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
Auxiliary action:
Name Description
---- -----------
Service
msf5 auxiliary(server/ftp) > set FTPROOT /root
msf5 auxiliary(server/ftp) > run -j
[*] Auxiliary module running as background job 0.
[*] Started service listener on 0.0.0.0:21
[*] Server started.
进行在后台运行,结束可以使用 jobs -k
下载,使用 anonymous 账户登录
PS C:\Users\John> ftp 10.10.10.166
连接到 10.10.10.166。
220 FTP Server Ready
500 'OPTS UTF8 ON': command not understood.
用户(10.10.10.166:(none)): anonymous
331 User name okay, need password...
密码:
230 Login OK
ftp> dir
200 PORT command successful.
425 Can't build data connection
ftp> ls
200 PORT command successful.
500 'NLST ': command not understood.
ftp> binary
200 Type is set
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls
total 1888
drwxr-xr-x 2 0 0 512 Jan 1 2000 lmg
drwxr-xr-x 2 0 0 512 Jan 1 2000 Downloads
-rwxr-xr-x 2 0 0 512 Jan 1 2000 team.exe
-rw-r--r-- 1 0 0 1515 Jan 1 2000 .viminfo
226 Transfer complete.
ftp: 收到 1903 字节,用时 0.14秒 13.59千字节/秒。
ftp> get team.exe
200 PORT command successful.
150 Opening BINARY mode data connection for team.exe
226 Transfer complete.
ftp: 收到 4803401 字节,用时 0.05秒 102200.02千字节/秒。
ftp>
也可以浏览器 直接访问 ftp:// 10.10.10.166
另外,如果是命令行环境,可以一步直接下载
# 创建文件:ftp_commands.txt
open 10.10.10.166
anonymous
whatever
binary
get team.exe
bye
# 执行命令
PS C:\Users\John> ftp -s:ftp_commands.txt
启动
默认安装在Windows XP中
MSF
Module options (auxiliary/server/tftp):
Name Current Setting Required Description
---- --------------- -------- -----------
OUTPUTPATH /tmp yes The directory in which uploaded files will be written.
SRVHOST 0.0.0.0 yes The local host to listen on.
SRVPORT 69 yes The local port to listen on.
TFTPROOT /tmp yes The TFTP root directory to serve files from
Auxiliary action:
Name Description
---- -----------
Service
msf5 auxiliary(server/tftp) > set TFTPROOT /root
TFTPROOT => /root
msf5 auxiliary(server/tftp) > run -j
[*] Auxiliary module running as background job 1.
[*] Starting TFTP server on 0.0.0.0:69...
[*] Files will be served from /root
[*] Uploaded files will be saved in /tmp
下载
windows 10 环境默认带有 tftp 客户端,如果不带,就可以使用 pkgmgr /iu:“TFTP” 命令
PS C:\Users\John> tftp -i 10.10.10.166 GET team.exe
在linux启动 samba服务
root@kali:~# git clone https://github.com/CoreSecurity/impacket
root@kali:~# cd impacket/
root@kali:~/impacket# python3 setup.py install
root@kali:~/impacket# cd examples/
root@kali:~/impacket/examples# python smbserver.py ROPNOP /root
Impacket v0.9.17 - Copyright 2002-2018 Core Security Technologies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
在一行中,我们已经启动并运行了SMB共享。您可以smbclient从Linux 确认一下是否已经开启:
root@kali:~# smbclient -L 10.10.10.166 --no-pass
Sharename Type Comment
--------- ---- -------
ROPNOP Disk
IPC$ Disk
Reconnecting with SMB1 for workgroup listing.
Connection to 10.10.10.166 failed (Error NT_STATUS_CONNECTION_REFUSED)
Failed to connect with SMB1 -- no workgroup available
或者在 windows 使用 net view 看一下
PS C:\Users\John> net view \\10.10.10.166