建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
Windows下的滲透測試之提權(quán)的基本套路（上）
從t0到t3 - 信息搜集
創(chuàng)新互聯(lián)一直秉承“誠信做人，踏實做事”的原則，不欺瞞客戶，是我們最起碼的底線！ 以服務(wù)為基礎(chǔ)，以質(zhì)量求生存，以技術(shù)求發(fā)展，成交一個客戶多一個朋友！為您提供成都網(wǎng)站設(shè)計、網(wǎng)站建設(shè)、外貿(mào)網(wǎng)站建設(shè)、成都網(wǎng)頁設(shè)計、小程序制作、成都網(wǎng)站開發(fā)、成都網(wǎng)站制作、成都軟件開發(fā)、重慶APP開發(fā)公司是成都本地專業(yè)的網(wǎng)站建設(shè)和網(wǎng)站設(shè)計公司，等你一起來見證！
一開始，我們擁有的帳號是一個沒有特權(quán)的普通賬號。假設(shè)我們已經(jīng)在遠(yuǎn)程或者在本地利用EXP進(jìn)行了一次攻擊并且獲得了一個反彈回來的shell。根本上說，在時間t0，我們不知道被攻擊的機(jī)器是做什么的，它和誰進(jìn)行連接，我們擁有怎樣的權(quán)限，甚至它的操作系統(tǒng)是哪個。
因此，開始的時候，我們就需要快速的搜集一些至關(guān)重要的信息，這樣我們就可以了解一下我們所處環(huán)境的情況。
首先，先看看我們連接的什么類型的操作系統(tǒng)
- C:\Windows\system32> systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
- OS Name: Microsoft Windows 7 Professional
- OS Version: 6.1.7601 Service Pack 1 Build 7601
注：中文環(huán)境下，"OS Name"為"OS 名稱"，"OS Version"為"OS 版本"
接著，看下計算機(jī)名和我們使用的用戶
- C:\Windows\system32> hostname
- b33f
- C:\Windows\system32> echo %username%
- user1
現(xiàn)在我們有了基本的信息，接下來我們可以列出計算機(jī)上的其它用戶，并且可以看一下我們當(dāng)前用戶的詳細(xì)信息。從下面的結(jié)果可以看出，user1不是本地用戶組Administrators的成員。
- C:\Windows\system32> net users
- User accounts for \\B33F
- -------------------------------------------------------------------------------
- Administrator b33f Guest
- user1
- The command completed successfully.
- C:\Windows\system32> net user user1
- User name user1
- Full Name
- Comment
- User's comment
- Country code 000 (System Default)
- Account active Yes
- Account expires Never
- Password last set 1/11/2014 7:47:14 PM
- Password expires Never
- Password changeable 1/11/2014 7:47:14 PM
- Password required Yes
- User may change password Yes
- Workstations allowed All
- Logon script
- User profile
- Home directory
- Last logon 1/11/2014 8:05:09 PM
- Logon hours allowed All
- Local Group Memberships *Users
- Global Group memberships *None
- The command completed successfully.
這是我們暫時需要了解的關(guān)于用戶的所有信息。接下來我們需要從網(wǎng)絡(luò)方面搜集信息了。
首先，看一下網(wǎng)絡(luò)連接和路由表。
- C:\Windows\system32> ipconfig /all
- Windows IP Configuration
- Host Name . . . . . . . . . . . . : b33f
- Primary Dns Suffix . . . . . . . :
- Node Type . . . . . . . . . . . . : Hybrid
- IP Routing Enabled. . . . . . . . : No
- WINS Proxy Enabled. . . . . . . . : No
- Ethernet adapter Bluetooth Network Connection:
- Media State . . . . . . . . . . . : Media disconnected
- Connection-specific DNS Suffix . :
- Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
- Physical Address. . . . . . . . . : 0C-84-DC-62-60-29
- DHCP Enabled. . . . . . . . . . . : Yes
- Autoconfiguration Enabled . . . . : Yes
- Ethernet adapter Local Area Connection:
- Connection-specific DNS Suffix . :
- Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
- Physical Address. . . . . . . . . : 00-0C-29-56-79-35
- DHCP Enabled. . . . . . . . . . . : Yes
- Autoconfiguration Enabled . . . . : Yes
- Link-local IPv6 Address . . . . . : fe80::5cd4:9caf:61c0:ba6e%11(Preferred)
- IPv4 Address. . . . . . . . . . . : 192.168.0.104(Preferred)
- Subnet Mask . . . . . . . . . . . : 255.255.255.0
- Lease Obtained. . . . . . . . . . : Saturday, January 11, 2014 3:53:55 PM
- Lease Expires . . . . . . . . . . : Sunday, January 12, 2014 3:53:55 PM
- Default Gateway . . . . . . . . . : 192.168.0.1
- DHCP Server . . . . . . . . . . . : 192.168.0.1
- DHCPv6 IAID . . . . . . . . . . . : 234884137
- DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-14-24-1D-00-0C-29-56-79-35
- DNS Servers . . . . . . . . . . . : 192.168.0.1
- NetBIOS over Tcpip. . . . . . . . : Enabled
- C:\Windows\system32> route print
- ===========================================================================
- Interface List
- 18...0c 84 dc 62 60 29 ......Bluetooth Device (Personal Area Network)
- 13...00 ff 0c 0d 4f ed ......TAP-Windows Adapter V9
- 11...00 0c 29 56 79 35 ......Intel(R) PRO/1000 MT Network Connection
- 1...........................Software Loopback Interface 1
- 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
- 15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter \#2
- 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter \#3
- 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
- ===========================================================================
- IPv4 Route Table
- ===========================================================================
- Active Routes:
- Network Destination Netmask Gateway Interface Metric
- 0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.104 10
- 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
- 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
- 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
- 192.168.0.0 255.255.255.0 On-link 192.168.0.104 266
- 192.168.0.104 255.255.255.255 On-link 192.168.0.104 266
- 192.168.0.255 255.255.255.255 On-link 192.168.0.104 266
- 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
- 224.0.0.0 240.0.0.0 On-link 192.168.0.104 266
- 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
- 255.255.255.255 255.255.255.255 On-link 192.168.0.104 266
- ===========================================================================
- Persistent Routes:
- None
- IPv6 Route Table
- ===========================================================================
- Active Routes:
- If Metric Network Destination Gateway
- 14 58 ::/0 On-link
- 1 306 ::1/128 On-link
- 14 58 2001::/32 On-link
- 14 306 2001:0:5ef5:79fb:8d2:b4e:3f57:ff97/128
- On-link
- 11 266 fe80::/64 On-link
- 14 306 fe80::/64 On-link
- 14 306 fe80::8d2:b4e:3f57:ff97/128
- On-link
- 11 266 fe80::5cd4:9caf:61c0:ba6e/128
- On-link
- 1 306 ff00::/8 On-link
- 14 306 ff00::/8 On-link
- 11 266 ff00::/8 On-link
- ===========================================================================
- Persistent Routes:
- None
arp -A 展示了ARP緩存表.
- C:\Windows\system32> arp -A
- Interface: 192.168.0.104 --- 0xb
- Internet Address Physical Address Type
- 192.168.0.1 90-94-e4-c5-b0-46 dynamic
- 192.168.0.101 ac-22-0b-af-bb-43 dynamic
- 192.168.0.255 ff-ff-ff-ff-ff-ff static
- 224.0.0.22 01-00-5e-00-00-16 static
- 224.0.0.251 01-00-5e-00-00-fb static
- 224.0.0.252 01-00-5e-00-00-fc static
- 239.255.255.250 01-00-5e-7f-ff-fa static
- 255.255.255.255 ff-ff-ff-ff-ff-ff static
下面可以看到活動的網(wǎng)絡(luò)連接和防火墻規(guī)則
- C:\Windows\system32> netstat -ano
- Active Connections
- Proto Local Address Foreign Address State PID
- TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 684
- TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
- TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
- TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING 1400
- TCP 192.168.0.104:139 0.0.0.0:0 LISTENING 4
- TCP [::]:135 [::]:0 LISTENING 684
- TCP [::]:445 [::]:0 LISTENING 4
- TCP [::]:5357 [::]:0 LISTENING 4
- UDP 0.0.0.0:5355 *:* 1100
- UDP 0.0.0.0:52282 *:* 976
- UDP 0.0.0.0:55202 *:* 2956
- UDP 0.0.0.0:59797 *:* 1400
- UDP 127.0.0.1:1900 *:* 2956
- UDP 127.0.0.1:65435 *:* 2956
- UDP 192.168.0.104:137 *:* 4
- UDP 192.168.0.104:138 *:* 4
- UDP 192.168.0.104:1900 *:* 2956
- UDP 192.168.0.104:5353 *:* 1400
- UDP 192.168.0.104:65434 *:* 2956
- UDP [::]:5355 *:* 1100
- UDP [::]:52281 *:* 976
- UDP [::]:52283 *:* 976
- UDP [::]:55203 *:* 2956
- UDP [::]:59798 *:* 1400
- UDP [::1]:1900 *:* 2956
- UDP [::1]:5353 *:* 1400
- UDP [::1]:65433 *:* 2956
- UDP [fe80::5cd4:9caf:61c0:ba6e%11]:1900 *:* 2956
- UDP [fe80::5cd4:9caf:61c0:ba6e%11]:65432 *:* 2956
接下來的兩個netsh命令是不能在所有操作系統(tǒng)都通用的命令的例子，netsh firewall命令只能在XP SP2及其以上版本的操作系統(tǒng)使用。
- C:\Windows\system32> netsh firewall show state
- Firewall status:
- -------------------------------------------------------------------
- Profile = Standard
- Operational mode = Enable
- Exception mode = Enable
- Multicast/broadcast response mode = Enable
- Notification mode = Enable
- Group policy version = Windows Firewall
- Remote admin mode = Disable
- Ports currently open on all network interfaces:
- Port Protocol Version Program
- -------------------------------------------------------------------
- No ports are currently open on all network interfaces.
- C:\Windows\system32> netsh firewall show config
- Domain profile configuration:
- -------------------------------------------------------------------
- Operational mode = Enable
- Exception mode = Enable
- Multicast/broadcast response mode = Enable
- Notification mode = Enable
- Allowed programs configuration for Domain profile:
- Mode Traffic direction Name / Program
- -------------------------------------------------------------------
- Port configuration for Domain profile:
- Port Protocol Mode Traffic direction Name
- -------------------------------------------------------------------
- ICMP configuration for Domain profile:
- Mode Type Description
- -------------------------------------------------------------------
- Enable 2 Allow outbound packet too big
- Standard profile configuration (current):
- -------------------------------------------------------------------
- Operational mode = Enable
- Exception mode = Enable
- Multicast/broadcast response mode = Enable
- Notification mode = Enable
- Service configuration for Standard profile:
- Mode Customized Name
- -------------------------------------------------------------------
- Enable No Network Discovery
- Allowed programs configuration for Standard profile:
- Mode Traffic direction Name / Program
- -------------------------------------------------------------------
- Enable Inbound COMRaider / E:\comraider\comraider.exe
- Enable Inbound nc.exe / C:\users\b33f\desktop\nc.exe
- Port configuration for Standard profile:
- Port Protocol Mode Traffic direction Name
- -------------------------------------------------------------------
- ICMP configuration for Standard profile:
- Mode Type Description
- -------------------------------------------------------------------
- Enable 2 Allow outbound packet too big
- Log configuration:
- -------------------------------------------------------------------
- File location = C:\Windows\system32\LogFiles\Firewall\pfirewall.log
- Max file size = 4096 KB
- Dropped packets = Disable
- Connections = Disable
最后，我們大概的看一下計算機(jī)上的：計劃任務(wù)，正在運(yùn)行的進(jìn)程，啟動的服務(wù)，安裝的驅(qū)動程序。
這條命令將詳細(xì)的展示出所有的計劃任務(wù)：
- C:\Windows\system32> schtasks /query /fo LIST /v
- Folder: \Microsoft\Windows Defender
- HostName: B33F
- TaskName: \Microsoft\Windows Defender\MP Scheduled Scan
- Next Run Time: 1/22/2014 5:11:13 AM
- Status: Ready
- Logon Mode: Interactive/Background
- Last Run Time: N/A
- Last Result: 1
- Author: N/A
- Task To Run: c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob
- -WinTask -RestrictPrivilegesScan
- Start In: N/A
- Comment: Scheduled Scan
- Scheduled Task State: Enabled
- Idle Time: Only Start If Idle for 1 minutes, If Not Idle Retry For 240 minutes
- Power Management: No Start On Batteries
- Run As User: SYSTEM
- Delete Task If Not Rescheduled: Enabled
- Stop Task If Runs X Hours and X Mins: 72:00:00
- Schedule: Scheduling data is not available in this format.
- Schedule Type: Daily
- Start Time: 5:11:13 AM
- Start Date: 1/1/2000
- End Date: 1/1/2100
- Days: Every 1 day(s)
- Months: N/A
- Repeat: Every: Disabled
- Repeat: Until: Time: Disabled
- Repeat: Until: Duration: Disabled
- Repeat: Stop If Still Running: Disabled
- [..Snip..]
下面的這條命令將正在運(yùn)行的進(jìn)程和該進(jìn)程啟動的服務(wù)列了出來：
- C:\Windows\system32> tasklist /SVC
- Image Name PID Services
- ========================= ======== ============================================
- System Idle Process 0 N/A
- System 4 N/A
- smss.exe 244 N/A
- csrss.exe 332 N/A
- csrss.exe 372 N/A
- wininit.exe 380 N/A
- winlogon.exe 428 N/A
- services.exe 476 N/A
- lsass.exe 484 SamSs
- lsm.exe 496 N/A
- svchost.exe 588 DcomLaunch, PlugPlay, Power
- svchost.exe 668 RpcEptMapper, RpcSs
- svchost.exe 760 Audiosrv, Dhcp, eventlog,
- HomeGroupProvider, lmhosts, wscsvc
- svchost.exe 800 AudioEndpointBuilder, CscService, Netman,
- SysMain, TrkWks, UxSms, WdiSystemHost,
- wudfsvc
- svchost.exe 836 AeLookupSvc, BITS, gpsvc, iphlpsvc,
- LanmanServer, MMCSS, ProfSvc, Schedule,
- seclogon, SENS, ShellHWDetection, Themes,
- Winmgmt, wuauserv
- audiodg.exe 916 N/A
- svchost.exe 992 EventSystem, fdPHost, netprofm, nsi,
- WdiServiceHost, WinHttpAutoProxySvc
- svchost.exe 1104 CryptSvc, Dnscache, LanmanWorkstation,
- NlaSvc
- spoolsv.exe 1244 Spooler
- svchost.exe 1272 BFE, DPS, MpsSvc
- mDNSResponder.exe 1400 Bonjour Service
- taskhost.exe 1504 N/A
- taskeng.exe 1556 N/A
- vmtoolsd.exe 1580 VMTools
- dwm.exe 1660 N/A
- explorer.exe 1668 N/A
- vmware-usbarbitrator.exe 1768 VMUSBArbService
- TPAutoConnSvc.exe 1712 TPAutoConnSvc
- [..Snip..]
- C:\Windows\system32> net start
- These Windows services are started:
- Application Experience
- Application Information
- Background Intelligent Transfer Service
- Base Filtering Engine
- Bluetooth Support Service
- Bonjour Service
- COM+ Event System
- COM+ System Application
- Cryptographic Services
- DCOM Server Process Launcher
- Desktop Window Manager Session Manager
- DHCP Client
- Diagnostic Policy Service
- Diagnostic Service Host
- Diagnostic System Host
- Distributed Link Tracking Client
- Distributed Transaction Coordinator
- DNS Client
- Function Discovery Provider Host
- Function Discovery Resource Publication
- Group Policy Client
- [..Snip..]
這有時是有用的，一些第三方驅(qū)動程序,即使是有信譽(yù)的公司,也可能有比瑞士奶酪上的孔還多的的漏洞。這僅僅是有可能的,因為對ring0攻擊在大多數(shù)人專業(yè)技能之外。
- C:\Windows\system32> DRIVERQUERY
- Module Name Display Name Driver Type Link Date
- ============ ====================== ============= ======================
- 1394ohci 1394 OHCI Compliant Ho Kernel 11/20/2010 6:01:11 PM
- ACPI Microsoft ACPI Driver Kernel 11/20/2010 4:37:52 PM
- AcpiPmi ACPI Power Meter Drive Kernel 11/20/2010 4:47:55 PM
- adp94xx adp94xx Kernel 12/6/2008 7:59:55 AM
- adpahci adpahci Kernel 5/2/2007 1:29:26 AM
- adpu320 adpu320 Kernel 2/28/2007 8:03:08 AM
- AFD Ancillary Function Dri Kernel 11/20/2010 4:40:00 PM
- agp440 Intel AGP Bus Filter Kernel 7/14/2009 7:25:36 AM
- aic78xx aic78xx Kernel 4/12/2006 8:20:11 AM
- aliide aliide Kernel 7/14/2009 7:11:17 AM
- amdagp AMD AGP Bus Filter Dri Kernel 7/14/2009 7:25:36 AM
- amdide amdide Kernel 7/14/2009 7:11:19 AM
- AmdK8 AMD K8 Processor Drive Kernel 7/14/2009 7:11:03 AM
- AmdPPM AMD Processor Driver Kernel 7/14/2009 7:11:03 AM
- amdsata amdsata Kernel 3/19/2010 9:08:27 AM
- amdsbs amdsbs Kernel 3/21/2009&nbs
分享文章：Windows下的滲透測試之提權(quán)的基本套路（上）
當(dāng)前URL：http://www.5511xx.com/article/ccopsoj.html
