原创---渗透测试某大型企业内网（域渗透、核心交换机）
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;"><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">1</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、弱口令扫描提权进服务器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">首先</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ipconfig</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">自己的</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ip</span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">为</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.12.*<b>*</b></span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，得知要扫描的网段为</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.0.1-10.10.19.555</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，楼层总共为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">19</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">层，所以为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">19</span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，扫描结果如下</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">:</span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-f6533a9793090fad.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="340" src="http://cobjon.com/w/php/upload/202401/05/af6bbc21.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-14c65e4ba25cc00f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="303" src="http://cobjon.com/w/php/upload/202401/05/d5bb194b.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ipc </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">弱口令的就不截登录图了，我们看</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">mssql </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">弱口令，先看</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.9.1 </span></b><b><i><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，</span></i></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">sa</span></i></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">密码为空我们执行</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">执行一下命令看看</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-32ed95aa5b6eb289.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="401" src="http://cobjon.com/w/php/upload/202401/05/6f8105c3.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">开了</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">3389 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，直接加账号进去</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-311bd044fcd5a5be.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="195" src="http://cobjon.com/w/php/upload/202401/05/bb7d93cc.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">一看就知道是财务系统的服务器，我们千万不能搞破坏呀，看看另一台如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-7aed916499824b65.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="398" src="http://cobjon.com/w/php/upload/202401/05/cc77a779.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">直接加个后门，</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-67056c01ac161596.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="331" src="http://cobjon.com/w/php/upload/202401/05/30164598.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">有管理员进去了，我就不登录了，以此类推拿下好几台服务器。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">2 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、域环境下渗透搞定域内全部机器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">经测试</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.1.1-10.10.1.255 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">网段有域，根据扫描到的服务器账号密码登录一下，执行</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ipconfig /all </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得知</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-492de6cb9d9e605a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="375" src="http://cobjon.com/w/php/upload/202401/05/51de99eb.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">当前域为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">fsll.com </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ping </span></b><b><i><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">一下</span></i></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">fsll.com</span></i></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得知域服务器</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">iP </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">为</span><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.1.36</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，执行命令</span><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">net user /domain </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-8cf73d3606cb104a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="409" src="http://cobjon.com/w/php/upload/202401/05/9648e62f.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我们需要拿下域服务器，我们的思路是抓</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">hash </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，因为嗅探的话管理员很少登陆所以时间上来不及，那好吧，执行</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">PsExec.exe -s -u administrator -p administrator \10.10.1.36 -c c:\s.exe</span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，这句命令的意思是利用当前控制的服务器抓取域服务器</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ip</span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">hash,10.10.1.36</span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">为域服务器，如图：</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-0907df74edd5618d.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="229" src="http://cobjon.com/w/php/upload/202401/05/7eb382c2.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">cluster </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">这个用户我们远程登录一下域服务器如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-cfa150df28ef4536.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="412" src="http://cobjon.com/w/php/upload/202401/05/417c0634.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">尽管我们抓的不是</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">administrator </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的密码，但是仍然可以远程登录，通过本地抓取域服务器我们得到了</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">administrator </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的密码如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-a13fbfb754ae4fcb.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="407" src="http://cobjon.com/w/php/upload/202401/05/f72f9de9.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得知域服务器管</span></b><b><span style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">理员密码和用户名同名，早知道就不用这么麻烦抓</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">hash </span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">了，那么我们获得域服务器，那又该如何获得域下的服务器呢，大家看我的思路如图：</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-68cef545fa0e6243.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="331" src="http://cobjon.com/w/php/upload/202401/05/0b538119.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">域下有好几台服务器，我们可以</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ping </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">一下</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ip </span></b><b><i><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，这里只</span></i></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ping</span></i></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">一台，</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ping</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">blade9</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得知</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">iP </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.1.22 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，然后我们右键管理添加账户密码这样就可以远程登录了，以此类推，就可以拿下域下的所有机器。。如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-15fc9957c8e5daab.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="407" src="http://cobjon.com/w/php/upload/202401/05/2829c1ee.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">经过的提前扫描，服务器主要集中到</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.1.1-10.10.1.254 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">这个段，加上前面弱口令的一些服务器这个段算是搞完了。我在打开域服务器的远程连接中查看到还有</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.13.50.X </span></b><b><i><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">段，经扫描</span></i></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.13.50.101 </span></i></b><b><i><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">开了</span></i></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">3389</span></i></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，我用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">扫描如下图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-d4d96210375a1952.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="296" src="http://cobjon.com/w/php/upload/202401/05/b75e8437.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ms08067 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">成功溢出服务器，成功登录服务器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-72ad91b91731ee4a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="410" src="http://cobjon.com/w/php/upload/202401/05/e1ffe24c.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我插管理员在线，貌似也是有域的，这就是域服务器，而且域下没有别的机器，我们经抓</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">hash </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得知</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">administrator </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">密码为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">zydlasen</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">这样两个域我们就全部拿下了。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">3 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、通过</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">oa </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">系统入侵进服务器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">Oa </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">系统的地址是</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"><a href="http://10.10.1.21:8060/oa/login.vm" target="_blank"><span style="color:#4183C4;">http://10.10.1.21:8060/oa/login.vm</span></a></span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-29bbbdb60e8b2e0b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="201" src="http://cobjon.com/w/php/upload/202401/05/4981241d.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">没有验证码，我插，试了好多弱口令都不行，没办法想到了溯雪，所以就开溯雪配置好如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-a9d368cba04bc41f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="272" height="230" src="http://cobjon.com/w/php/upload/202401/05/7590225e.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">填写错误标记开扫结果如下</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-6d014d2b4a8e01f1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="360" height="236" src="http://cobjon.com/w/php/upload/202401/05/e6ba22ba.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">下面我们进</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">OA</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-fc3a834d5754faf9.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="146" src="http://cobjon.com/w/php/upload/202401/05/cbd3dd1c.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我们想办法拿</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">webshell </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，在一处上传地方上传</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">jsp </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">马如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-718ca7a0856a633f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="209" src="http://cobjon.com/w/php/upload/202401/05/ae54153d.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-7654922efc05de91.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="352" src="http://cobjon.com/w/php/upload/202401/05/222b603b.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">jsp </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的大马同样提权</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ok </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，哈哈其实这台服务器之前已经拿好了</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">4 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">tomcat </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">提权进服务器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">扫描目标</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ip </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">发现如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-2b30aee2aad0c43c.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="300" src="http://cobjon.com/w/php/upload/202401/05/b79743f0.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">登录如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-d8afa17cc81020dc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="263" src="http://cobjon.com/w/php/upload/202401/05/cd4af5e2.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">找个上传的地方上传如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-aee80342d982d77f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="286" src="http://cobjon.com/w/php/upload/202401/05/75cd8a1a.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">然后就是同样执行命令提权，过程不在写了</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">5 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">cain </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">对局域网进行</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ARP </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">嗅探和</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">DNS </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">欺骗</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">首先测试</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ARP </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">嗅探如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-7bd65974166097d2.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="282" src="http://cobjon.com/w/php/upload/202401/05/406c73e2.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">测试结果如下图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-db7987bf7c609310.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="359" src="http://cobjon.com/w/php/upload/202401/05/432a17fa.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">哈哈嗅探到的东西少是因为这个域下才有几台机器</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">下面我们测试</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">DNS</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">欺骗，如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-124f8e922780116c.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="317" src="http://cobjon.com/w/php/upload/202401/05/eb8c2706.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.12.188 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">是我本地搭建了小旋风了，我们看看结果：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-6f78dff77b94982e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="977" height="425" src="http://cobjon.com/w/php/upload/202401/05/9453a4c5.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">（注：欺骗这个过程由于我之前录制了教程，截图教程了）</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">6 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、成功入侵交换机</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我在扫描</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.0. </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">段的时候发现有个</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">3389 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">好可疑地址是</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">10.10.0.65 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，经过</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">扫描也没发现明显可利用的漏洞，后来经过查看之前抓</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">hash </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">得到这台服务器的密码为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">lasenjt, </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我插，感觉测评我们公司的运气是杠杠的，不过也从侧面知道安全是做的何等的烂呀</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">我们进服务器看看，插有福吧看着面熟吧</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-c7a42b776edffdcf.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="546" height="362" src="http://cobjon.com/w/php/upload/202401/05/a4897831.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">装了思科交换机管理系统，我们继续看，有两个</span></b><b><span style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">管理员</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-bcca470982cd1bac.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="319" src="http://cobjon.com/w/php/upload/202401/05/e5afe85b.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">这程序功能老强大了，可以直接配置个管理员登陆</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">N </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">多交换机，经过翻看，直接得出几台交换机的特权密码如图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-7c890d02610d11bd.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="302" src="http://cobjon.com/w/php/upload/202401/05/622c1a8a.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">172.16.4.1,172.16.20.1 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">密码分别为：</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">@lasenjjz </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">@lasenjjz </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，好几个特权密码这里就不一一列举了，下面利用另一种方法读配置文件，利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">communuity string </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">读取，得知已知的值为</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">lasenjtw *</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，下面我们利用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">IP Network Browser </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">读取配置文件如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-512af9d67c9b448a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="404" src="http://cobjon.com/w/php/upload/202401/05/3f6b457c.png" alt="" style="vertical-align:middle;" /></a><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">点</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">config </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，必须写好对应的</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">communuity string </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">值，如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-77c53b4d45eba914.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="347" src="http://cobjon.com/w/php/upload/202401/05/bc6e3186.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">远程登录看看，如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-d886647aeba99ea0.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="418" src="http://cobjon.com/w/php/upload/202401/05/9712ff97.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">直接进入特权模式，以此类推搞了将近</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">70 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">台交换机如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-cf40fc9b2a67170c.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="465" src="http://cobjon.com/w/php/upload/202401/05/6c1491a0.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-f63dd8f672b4daa9.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="391" src="http://cobjon.com/w/php/upload/202401/05/b801463c.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">总结交换机的渗透这块，主要是拿到了</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">cisco </span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">交换机的管理系统直接查看特权密码和直接用</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">communuity string </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">读取配置文件查看交换机用户密码和特权密码，如果没拿到思科交换机管理系统的话就只能靠</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">扫描了，只要是</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">public </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">权限就能读取配置文件了，之前扫描到一个</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的结果为</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">public </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，这里上一张图</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-8a6e141fa45c912a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="228" src="http://cobjon.com/w/php/upload/202401/05/a2210604.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">确实可以读取配置文件的。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">除此之外还渗进了一些</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">web </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">登录交换机和一个远程管理控制系统如下图</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-6300f2137c4539e0.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="335" src="http://cobjon.com/w/php/upload/202401/05/a91b52a0.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-eb3afcdb766229dd.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="384" src="http://cobjon.com/w/php/upload/202401/05/5935bc48.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">直接用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">UID </span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">是</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">USERID </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，默认</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">PW </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">是</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">PASSW0RD( </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">注意是数字</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">0 </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">不是字母</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">O) </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">登录了，可以远程管理所有的</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">3389 </span><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">。</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-5056c85ec77224e0.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="367" src="http://cobjon.com/w/php/upload/202401/05/45a5ea6b.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">上图千兆交换机管理系统。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">7 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">、入侵山石网关防火墙</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">对某公司网关进行渗透测试。。。具体详情如下：</span></b><b><span style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">思路是通过社工来搞定网关，所以就想办法收集内网管理员的信息，经测试发现域服务器的域用户比较多，所以就给服务器安装了</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> cain </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">进行本地</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> hash </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">的读取，读取信息如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-5dbe21b4f67fb569.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="400" src="http://cobjon.com/w/php/upload/202401/05/71a1a75a.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">网关是山石网关，在不知道具体有哪些用户名（默认有个</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> hillstone </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">无法删除，属于内置用户）的情况下只能根据最有可能的账号结合抓到的密码一个一个测试，最终还是没成功，后来想到叫人写个程序暴力破解，但是发现错误三次，就会锁定</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> IP2 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">分钟，所以效果不是很好，登陆域服务器发现桌面有个屏幕录像专家，打开看个教程，发现服务器登陆过网关，里面有</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> id </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">地址记录，地址是</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> 172.16.251.254 </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">这样就想到用</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> ie </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">密码读取器来查看</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> ie </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">历史密码</span></b><b><span style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"> </span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">如图：</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-2eadee0662094c87.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="288" src="http://cobjon.com/w/php/upload/202401/05/2e048934.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">然后登陆网关如图：</span></b><b><i><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">**</span></i></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-e481e82711e3e7a8.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="554" height="407" src="http://cobjon.com/w/php/upload/202401/05/4328c1b6.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">经过半天的努力，防火墙网关我进来了，我渗透进一台域服务器，进去抓了域所有用户的密码一个个去试网关，都没成功，忽然发现桌面上安装了屏幕录制专家，我就打开看了，发现有个录像里</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">**</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">ie</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">家里里</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">172.16.251.254</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，这不就是网关的地址么，所以我就用</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">administrator</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">登陆了域服务器，然后打开网关地址，妈呀网关的账号直接就在记录里，可惜没有密码，哈哈不过这也不错，真心比乱搞强多了，然后忽然想到用</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">IE</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">密码记录器查看密码，于是乎下载了一个工具查看密码，这样网关就搞定了，彩笔的是原来这个早已经被我搞出来了，是交换机的特权密码，</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">73</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">台的密码我也不可能一个个的试吧，本来想写个程序，结果打电话给山石人家说密码错误三次直接封</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">IP</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">好吧，有时候有些东西真的是需要耐心的，当然也需要一定的智慧，当然也有一定的运气成分在里面，就这样网关就被拿到了，之前用</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">nessus</span><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">扫没扫到漏洞，至此大型局域网渗透就完结，哈哈，大牛不要笑话哦！</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">**</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">总结：本渗透测试过程没有什么高的技术含量，全靠运气和细心的发现才得以有此过程，整个渗透测试过程全部录制为视频教程。。。由于时间仓促，所以渗透就到此为止，在工作组下的个人</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">PC</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">还没有拿下，严格的说这个渗透是不完美的，本来还想再做交换机端口镜像的教程，但是考虑到网络的稳定性这里就不搞测试了，还请大家海涵。。谢谢观赏。。鄙人</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">QQ</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">：</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">635833</span></b><b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">，欢迎进行技术交流。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">补充：最近公司换领导，本来想搞搞端口镜像，嗅探和</span></b><b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">dns**</span></b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">欺骗，但考虑到其有一定的风险性就后续暂时不会搞了。现在上一张摸清楚的拓扑图：</span><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;">**</span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:11.25pt;margin-left:0cm;margin-right:0cm;margin-top:11.25pt;text-align:center;text-justify:inter-ideograph;">
<span lang="EN-US" style="font-family:宋体;font-size:12.0pt;">
<hr size="0" width="100%" noshade="noshade" style="color:#333333;" align="center" />
</span>
</div>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<a href="http://upload-images.jianshu.io/upload_images/5822121-c3ebda51a7c035c1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240"><img width="736" height="538" src="http://cobjon.com/w/php/upload/202401/05/8f5c057b.png" alt="" style="vertical-align:middle;" /></a><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;margin-bottom:18.0pt;text-align:left;text-justify:inter-ideograph;">
<b><span style="color:#333333;font-family:宋体;font-size:11.5pt;letter-spacing:.55pt;">注：已经给公司提交渗透测试报告，并已修复漏洞，为了尽量不影响文章的观赏性，故不再打码处理。。。</span></b><span lang="EN-US" style="color:#333333;font-family:Segoe UI,sans-serif;font-size:11.5pt;letter-spacing:.55pt;"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<span lang="EN-US"> </span>
</p>
页:
[1]