《2024fulcrum域渗透实战技术.docx》由会员分享,可在线阅读,更多相关《2024fulcrum域渗透实战技术.docx(27页珍藏版)》请在优知文库上搜索。
1、域渗透实战之fuIcrum信息收集端口扫描FUZZ接口目录遍历目录暴力破解端口端口漏洞利用XXe漏洞文件泄露XXe文件读取权限提升SSRF漏洞编写脚本反弹SheIlOshell域渗透网络枚举翻配置文件解密密码隧道搭建1.DAP春询使用原始PowerSheU进行枚举上传POWerVieW工具执行命令获取oot.txt反弹Shell信息收集端口扫描使用nmap进行端口扫描,发现存在大量端口开放1.IDeee.e.62StartingNnap7.92(https:/nMap.org)at223-9-1722:27CSTWarning:1.1.1.62givinguponportbecausertra
2、nsaissioncaphit(1).Mnupscanreportfor1.1.1.62Hostisup(.slatency).Notshown:57532filteredtcpports(noresponse),7998closedtcpports(reset)PORTSTATESERVICEVtcpopenunknown22/tcpopnssh8tcpopenhttp88/tcpopnkrberossec9999/tcpopenabyssNmapdone:1IPaddress(1hostup)scannedin89.71seconds接着去查看其版本和对应的服务TMP.22.M,a,WW.
3、4231.1.1.2Startinf77.W(ht5:(WPQrg)at2239-1722:29CSTWmpscanreportfor1.1.1.62Not1up(.51slatency).msmsemimy0WtcpopRhttpa!fin1.1.(Ubuntu)I.ttp-rvrMter:nfil.l.(Utantu)Siltdow*tMvatitl(ttWtl;charttU11*).2ilcpth0BnN.1UbUnQUttftu.2(UtatM1.ima;prtcl2.)Ih*Mt*v:IM72(tU)I2566:“:“:S:g:cli3:7c:”;S:lc:M(CA1.256lB:
4、c4:9d:M:6:n:4t:M:M:n:*f:U:4e:Sl:M:f(C551)MAs0P-titl:Inputstrifaasnotlaacometfcml.Itt-wthods:1.PotentullyriskymtMs:TMeESiACPopenhttpAflfUt.l.(Ubuntu)IJIUAMfver-e*f:RgiMl.t.(Ubuntu)IMSrotots.3:1SUUOWdEnf9999U99fMtpRflfii1.1.(Ubuntu)I.MtMrvr-hdr:niMl.i,(Utuntu)IEltriagMincorrvctf11Mt.IM:1. RKRtUUyrisky
5、aHod*:TMCIM42)tcotftMtFMlMlE1.1.(Ubwntu)1 .H.2:VBMM*rFUUjii3A-fg7deiH.fIMI/HCMCeWFrHRttCMlMCM1*RMl.BtfMFMTtr.l.-TWVM,WT4ret;Xltt.M.M-Uti三e9BM9MtrAtfZrtEW7tBtteMUiMtwrCWrt目录遍历使用工具进行目录枚举未发现有用的目录froatHtrr:1.1.1.62:Php.l_l_)l_)Il_IIIXnpi*irZIII一J八Il,_wr:2.7.TarturlZThrwdi“Ehst StatusCodes Tiatout(mc) I-
6、f11t,Con*t*mrat-wdu-4rvctoristitZW.;*431,J2.W7.JM1froabustr2.7.UftrocbutrfrM-confit.tBlp(TJhttpszfitfM.C(He9i52froatasttrrlaatstFressEM11tousthe5.)efaMlMlM,IWnnoM,sGtal.p%AcMP4laal.lMtflal,flp9.MMa0Rrfmbvmp./,r,k1UnVh三f6TB.n,3c.”laHComettienclwCt三eUe*3mwl9Wn.pae.llMMR.NWtM*utfM.ru4.aUpmMr.aefBICeHU1
7、.三RtBhM发现其存在XXe漏洞T/MTTF1WtIeltIegm*11uwM三AeWtIStocUnailM*ccHtwfMl.wlmowMl三l,MfiTaaiiMiavit.4MBMi9./3AccU三nv三v6g.6a,HIMKeAntCemectMRMt,ClltMC4RnctM*WwttaM.U三-IrMtUO-tae1C三m三W-i4HfthMmvwXFOOCTVfrt(*11BQnw三aMS1UVaJJI111MXMW三nMMMOtYHYftWlMtUR11WVM*三tW4C三moctM11lMtervrM三X*Hiwtw1* tetn.Ul1MnMMemCftRtCRtTy
8、999HutAR)M.ce*wetf- CeveitA4Rlw XEZc26BH6CawteRtV4R9KU文件泄露然后使用XXe进行加载.dtd文件来读取文件k*wXXe文件读取开后http服务八XVnrvrMSefRrtWMS/,.明一;%e.K.3-(iatM2JMt9,MMtNWtMN-iawmt,:x:,l(11九el*ae.ie.3【皿nncn.rmj.m.i.j-1nnr.t.-t,Smzz二;二nrr-,;:-一=:血SWMhfJerm1uH4d0rerlT13AMUMMCvM叱,VWUIZtc9lFnmte7lrcxrm6umMMtoMcMM44cHfcsl.HIKn】OMcteMC