前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >Windows提权之快速查找Exploit

Windows提权之快速查找Exploit

作者头像
渗透攻击红队
发布2019-11-19 14:58:39
1.2K0
发布2019-11-19 14:58:39
举报
文章被收录于专栏:漏洞知识库漏洞知识库

Windows提权之快速查找Exploit

提权前言

拿到一个WebSHELL后,需要看对方服务器打了那些补丁,根据没打的补丁来选择对应的Exploit来进行提权

  • POC
代码语言:javascript
复制
systeminfo>liuwx.txt&(for %i in ( KB4013389 KB3199135 KB3186973 KB3178466 KB3164038 KB3143145 KB3143141 KB3136041 K3134228 KB3089656 KB3067505 KB3077657 KB3057839 KB3057191 KB3031432 KB3036220 KB3023266 KB2989935 KB3011780 KB3000061 KB2992611 KB2975684 KB2914368 KB2850851 KB2840221 KB2778930 KB2972621 KB2671387 KB2592799 KB2566454 KB2503665 KB2393802 KB2305420 KB2267960 KB982799 KB2160329 KB977165 KB971468 KB975517 KB970483 KB959454 KB957097 KB958644 KB956803 KB941693 KB921883 KB899588 KB823980 ) do @type liuwx.txt|@find /i "%i"|| @echo %i is Yes)&del /f /q /a liuwx.txt
代码语言:javascript
复制
KB4013389 is Yes
KB3199135 is Yes
KB3186973 is Yes
KB3178466 is Yes
KB3164038 is Yes
KB3143145 is Yes
KB3143141 is Yes
KB3136041 is Yes
K3134228 is Yes
KB3089656 is Yes
KB3067505 is Yes
KB3077657 is Yes
KB3057839 is Yes
KB3057191 is Yes
KB3031432 is Yes
KB3036220 is Yes
KB3023266 is Yes
KB2989935 is Yes
KB3011780 is Yes
KB3000061 is Yes
KB2992611 is Yes
KB2975684 is Yes
KB2914368 is Yes
KB2850851 is Yes
KB2840221 is Yes
KB2778930 is Yes
KB2972621 is Yes
KB2671387 is Yes
KB2592799 is Yes
KB2566454 is Yes
KB2503665 is Yes
KB2393802 is Yes
KB2305420 is Yes
KB2267960 is Yes
KB982799 is Yes
KB2160329 is Yes
KB977165 is Yes
KB971468 is Yes
KB975517 is Yes
KB970483 is Yes
KB959454 is Yes
KB957097 is Yes
KB958644 is Yes
KB956803 is Yes
KB941693 is Yes
KB921883 is Yes
KB899588 is Yes
KB823980 is Yes

从上图得知,有很多补丁没有打,那么就可以根据这些补丁号来选择相应的Exp

MS16-032提权

这里是Windows Server 2008,然后刚好KB3143141这个补丁没打,那么我就用MS16-032来进行提权:

运行了ms16-032exe,直接弹出了一个DOS窗口,是系统管理员权限!

本文参与 腾讯云自媒体同步曝光计划,分享自微信公众号。
原始发表:2019-10-30,如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 漏洞知识库 微信公众号,前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • 提权前言
  • MS16-032提权
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档